review-2.6.22.y/cifs-fix-wrong-smb-signing-checks.patch

   1 From: Suresh Jayaraman <sjayaraman@suse.de>
   2 Subject: Fix sign mount option and sign proc config setting
   3 References: 329790, CVE-2007-3843
   4 Patch mainline: 2.6.23-rc1
   5
   6 Backported the fix (2.6.23-rc1) from Steve French. The original patch removes
   7 few commented functions (which are not required) as part of this fix, backport
   8 also does the same to retain compatibility.
   9
  10 We were checking the wrong (old) global variable to determine
  11 whether to override server and force signing on the SMB
  12 connection.
  13
  14 Acked-by: Dave Kleikamp <shaggy@austin.ibm.com>
  15 Signed-off-by: Steve French <sfrench@us.ibm.com>
  16 Signed-off-by: Suresh Jayaraman <sjayaraman@suse.de>
  17 Signed-off-by: Oliver Pinter <oliver.pntr@gmail.com>
  18
  19 ---
  20  fs/cifs/cifs_debug.c |   92 ++++-----------------------------------------------
  21  fs/cifs/cifssmb.c    |   34 ++++++++++++------
  22  2 files changed, 30 insertions(+), 96 deletions(-)
  23
  24 ---
  25 Index: linux-2.6.22-SL103_BRANCH/fs/cifs/cifs_debug.c
  26 ===================================================================
  27 --- linux-2.6.22-SL103_BRANCH.orig/fs/cifs/cifs_debug.c 2007-11-23 16:23:30.000000000 +0530
  28 +++ linux-2.6.22-SL103_BRANCH/fs/cifs/cifs_debug.c      2007-11-23 16:24:23.000000000 +0530
  29 @@ -901,90 +901,14 @@ security_flags_write(struct file *file,
  30         }
  31         /* flags look ok - update the global security flags for cifs module */
  32         extended_security = flags;
  33 +       if (extended_security & CIFSSEC_MUST_SIGN) {
  34 +               /* requiring signing implies signing is allowed */
  35 +               extended_security |= CIFSSEC_MAY_SIGN;
  36 +               cFYI(1, ("packet signing now required"));
  37 +       } else if ((extended_security & CIFSSEC_MAY_SIGN) == 0) {
  38 +               cFYI(1, ("packet signing disabled"));
  39 +       }
  40 +       /* BB should we turn on MAY flags for other MUST options? */
  41         return count;
  42  }
  43 -
  44 -/* static int
  45 -ntlmv2_enabled_read(char *page, char **start, off_t off,
  46 -                      int count, int *eof, void *data)
  47 -{
  48 -       int len;
  49 -
  50 -       len = sprintf(page, "%d\n", ntlmv2_support);
  51 -
  52 -       len -= off;
  53 -       *start = page + off;
  54 -
  55 -       if (len > count)
  56 -               len = count;
  57 -       else
  58 -               *eof = 1;
  59 -
  60 -       if (len < 0)
  61 -               len = 0;
  62 -
  63 -       return len;
  64 -}
  65 -static int
  66 -ntlmv2_enabled_write(struct file *file, const char __user *buffer,
  67 -                       unsigned long count, void *data)
  68 -{
  69 -       char c;
  70 -       int rc;
  71 -
  72 -       rc = get_user(c, buffer);
  73 -       if (rc)
  74 -               return rc;
  75 -       if (c == '0' || c == 'n' || c == 'N')
  76 -               ntlmv2_support = 0;
  77 -       else if (c == '1' || c == 'y' || c == 'Y')
  78 -               ntlmv2_support = 1;
  79 -       else if (c == '2')
  80 -               ntlmv2_support = 2;
  81 -
  82 -       return count;
  83 -}
  84 -
  85 -static int
  86 -packet_signing_enabled_read(char *page, char **start, off_t off,
  87 -                      int count, int *eof, void *data)
  88 -{
  89 -       int len;
  90 -
  91 -       len = sprintf(page, "%d\n", sign_CIFS_PDUs);
  92 -
  93 -       len -= off;
  94 -       *start = page + off;
  95 -
  96 -       if (len > count)
  97 -               len = count;
  98 -       else
  99 -               *eof = 1;
 100 -
 101 -       if (len < 0)
 102 -               len = 0;
 103 -
 104 -       return len;
 105 -}
 106 -static int
 107 -packet_signing_enabled_write(struct file *file, const char __user *buffer,
 108 -                       unsigned long count, void *data)
 109 -{
 110 -       char c;
 111 -       int rc;
 112 -
 113 -       rc = get_user(c, buffer);
 114 -       if (rc)
 115 -               return rc;
 116 -       if (c == '0' || c == 'n' || c == 'N')
 117 -               sign_CIFS_PDUs = 0;
 118 -       else if (c == '1' || c == 'y' || c == 'Y')
 119 -               sign_CIFS_PDUs = 1;
 120 -       else if (c == '2')
 121 -               sign_CIFS_PDUs = 2;
 122 -
 123 -       return count;
 124 -} */
 125 -
 126 -
 127  #endif
 128 Index: linux-2.6.22-SL103_BRANCH/fs/cifs/cifssmb.c
 129 ===================================================================
 130 --- linux-2.6.22-SL103_BRANCH.orig/fs/cifs/cifssmb.c    2007-11-23 16:23:30.000000000 +0530
 131 +++ linux-2.6.22-SL103_BRANCH/fs/cifs/cifssmb.c 2007-11-23 16:24:23.000000000 +0530
 132 @@ -426,11 +426,11 @@ CIFSSMBNegotiate(unsigned int xid, struc
 133
 134         /* if any of auth flags (ie not sign or seal) are overriden use them */
 135         if(ses->overrideSecFlg & (~(CIFSSEC_MUST_SIGN | CIFSSEC_MUST_SEAL)))
 136 -               secFlags = ses->overrideSecFlg;
 137 +               secFlags = ses->overrideSecFlg; /* BB FIXME fix sign flags? */
 138         else /* if override flags set only sign/seal OR them with global auth */
 139                 secFlags = extended_security | ses->overrideSecFlg;
 140
 141 -       cFYI(1,("secFlags 0x%x",secFlags));
 142 +       cFYI(1, ("secFlags 0x%x", secFlags));
 143
 144         pSMB->hdr.Mid = GetNextMid(server);
 145         pSMB->hdr.Flags2 |= (SMBFLG2_UNICODE | SMBFLG2_ERR_STATUS);
 146 @@ -633,22 +633,32 @@ CIFSSMBNegotiate(unsigned int xid, struc
 147  #ifdef CONFIG_CIFS_WEAK_PW_HASH
 148  signing_check:
 149  #endif
 150 -       if(sign_CIFS_PDUs == FALSE) {
 151 +       if ((secFlags & CIFSSEC_MAY_SIGN) == 0) {
 152 +               /* MUST_SIGN already includes the MAY_SIGN FLAG
 153 +                  so if this is zero it means that signing is disabled */
 154 +               cFYI(1, ("Signing disabled"));
 155                 if(server->secMode & SECMODE_SIGN_REQUIRED)
 156 -                       cERROR(1,("Server requires "
 157 -                                "/proc/fs/cifs/PacketSigningEnabled to be on"));
 158 +                       cERROR(1, ("Server requires "
 159 +                                "/proc/fs/cifs/PacketSigningEnabled "
 160 +                                "to be on"));
 161                 server->secMode &=
 162                         ~(SECMODE_SIGN_ENABLED | SECMODE_SIGN_REQUIRED);
 163 -       } else if(sign_CIFS_PDUs == 1) {
 164 +       } else if ((secFlags & CIFSSEC_MUST_SIGN) == CIFSSEC_MUST_SIGN) {
 165 +               /* signing required */
 166 +               cFYI(1, ("Must sign - secFlags 0x%x", secFlags));
 167 +               if((server->secMode &
 168 +                       (SECMODE_SIGN_ENABLED | SECMODE_SIGN_REQUIRED)) == 0) {
 169 +                       cERROR(1,
 170 +                               ("signing required but server lacks support"));
 171 +               } else
 172 +                       server->secMode |= SECMODE_SIGN_REQUIRED;
 173 +       } else {
 174 +               /* signing optional ie CIFSSEC_MAY_SIGN */
 175                 if((server->secMode & SECMODE_SIGN_REQUIRED) == 0)
 176 -                       server->secMode &=
 177 +                       server->secMode &=
 178                                 ~(SECMODE_SIGN_ENABLED | SECMODE_SIGN_REQUIRED);
 179 -       } else if(sign_CIFS_PDUs == 2) {
 180 -               if((server->secMode &
 181 -                       (SECMODE_SIGN_ENABLED | SECMODE_SIGN_REQUIRED)) == 0) {
 182 -                       cERROR(1,("signing required but server lacks support"));
 183 -               }
 184         }
 185 +
 186  neg_err_exit:
 187         cifs_buf_release(pSMB);
 188