Attachment #761299 for bug #821895

View | Details | Raw Unified | Return to bug 821895
Collapse All | Expand All




	select CRYPTO_GCM
	select CRYPTO_ECB
	select CRYPTO_AES
	select CRYPTO_LIB_DES
	select KEYS
	select DNS_RESOLVER
	select ASN1


	  If unsure, say Y.

config CIFS_WEAK_PW_HASH
	bool "Support legacy servers which use weaker LANMAN security"
	depends on CIFS && CIFS_ALLOW_INSECURE_LEGACY
	help
	  Modern CIFS servers including Samba and most Windows versions
	  (since 1997) support stronger NTLM (and even NTLMv2 and Kerberos)
	  security mechanisms. These hash the password more securely
	  than the mechanisms used in the older LANMAN version of the
	  SMB protocol but LANMAN based authentication is needed to
	  establish sessions with some old SMB servers.

	  Enabling this option allows the cifs module to mount to older
	  LANMAN based servers such as OS/2 and Windows 95, but such
	  mounts may be less secure than mounts using NTLM or more recent
	  security mechanisms if you are on a public network.  Unless you
	  have a need to access old SMB servers (and are on a private
	  network) you probably want to say N.  Even if this support
	  is enabled in the kernel build, LANMAN authentication will not be
	  used automatically. At runtime LANMAN mounts are disabled but
	  can be set to required (or optional) either in
	  /proc/fs/cifs (see Documentation/admin-guide/cifs/usage.rst for
	  more detail) or via an option on the mount command. This support
	  is disabled by default in order to reduce the possibility of a
	  downgrade attack.

	  If unsure, say N.

config CIFS_UPCALL
	bool "Kerberos/SPNEGO advanced session setup"
	depends on CIFS

Lines 249-254 Link Here

(-)a/fs/cifs/cifs_debug.c (+11 lines)
249	#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY	249	#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
250	seq_printf(m, ",ALLOW_INSECURE_LEGACY");	250	seq_printf(m, ",ALLOW_INSECURE_LEGACY");
251	#endif	251	#endif
		252	#ifdef CONFIG_CIFS_WEAK_PW_HASH
		253	seq_printf(m, ",WEAK_PW_HASH");
		254	#endif
252	#ifdef CONFIG_CIFS_POSIX	255	#ifdef CONFIG_CIFS_POSIX
253	seq_printf(m, ",CIFS_POSIX");	256	seq_printf(m, ",CIFS_POSIX");
254	#endif	257	#endif
Lines 927-932 Link Here
927	*flags = CIFSSEC_MUST_NTLMSSP;	930	*flags = CIFSSEC_MUST_NTLMSSP;
928	else if ((*flags & CIFSSEC_MUST_NTLMV2) == CIFSSEC_MUST_NTLMV2)	931	else if ((*flags & CIFSSEC_MUST_NTLMV2) == CIFSSEC_MUST_NTLMV2)
929	*flags = CIFSSEC_MUST_NTLMV2;	932	*flags = CIFSSEC_MUST_NTLMV2;
		933	else if ((*flags & CIFSSEC_MUST_NTLM) == CIFSSEC_MUST_NTLM)
		934	*flags = CIFSSEC_MUST_NTLM;
		935	else if (CIFSSEC_MUST_LANMAN &&
		936	(*flags & CIFSSEC_MUST_LANMAN) == CIFSSEC_MUST_LANMAN)
		937	*flags = CIFSSEC_MUST_LANMAN;
		938	else if (CIFSSEC_MUST_PLNTXT &&
		939	(*flags & CIFSSEC_MUST_PLNTXT) == CIFSSEC_MUST_PLNTXT)
		940	*flags = CIFSSEC_MUST_PLNTXT;
930		941
931	*flags \|= signflags;	942	*flags \|= signflags;
932	}	943	}

Lines 147-152 Link Here

(-)a/fs/cifs/cifs_swn.c (+2 lines)
147	goto nlmsg_fail;	147	goto nlmsg_fail;
148	}	148	}
149	break;	149	break;
		150	case LANMAN:
		151	case NTLM:
150	case NTLMv2:	152	case NTLMv2:
151	case RawNTLMSSP:	153	case RawNTLMSSP:
152	ret = cifs_swn_auth_info_ntlm(swnreg->tcon, skb);	154	ret = cifs_swn_auth_info_ntlm(swnreg->tcon, skb);





}

/* first calculate 24 bytes ntlm response and then 16 byte session key */
int setup_ntlm_response(struct cifs_ses *ses, const struct nls_table *nls_cp)
{
	int rc = 0;
	unsigned int temp_len = CIFS_SESS_KEY_SIZE + CIFS_AUTH_RESP_SIZE;
	char temp_key[CIFS_SESS_KEY_SIZE];

	if (!ses)
		return -EINVAL;

	ses->auth_key.response = kmalloc(temp_len, GFP_KERNEL);
	if (!ses->auth_key.response)
		return -ENOMEM;

	ses->auth_key.len = temp_len;

	rc = SMBNTencrypt(ses->password, ses->server->cryptkey,
			ses->auth_key.response + CIFS_SESS_KEY_SIZE, nls_cp);
	if (rc) {
		cifs_dbg(FYI, "%s Can't generate NTLM response, error: %d\n",
			 __func__, rc);
		return rc;
	}

	rc = E_md4hash(ses->password, temp_key, nls_cp);
	if (rc) {
		cifs_dbg(FYI, "%s Can't generate NT hash, error: %d\n",
			 __func__, rc);
		return rc;
	}

	rc = mdfour(ses->auth_key.response, temp_key, CIFS_SESS_KEY_SIZE);
	if (rc)
		cifs_dbg(FYI, "%s Can't generate NTLM session key, error: %d\n",
			 __func__, rc);

	return rc;
}

#ifdef CONFIG_CIFS_WEAK_PW_HASH
int calc_lanman_hash(const char *password, const char *cryptkey, bool encrypt,
			char *lnm_session_key)
{
	int i, len;
	int rc;
	char password_with_pad[CIFS_ENCPWD_SIZE] = {0};

	if (password) {
		for (len = 0; len < CIFS_ENCPWD_SIZE; len++)
			if (!password[len])
				break;

		memcpy(password_with_pad, password, len);
	}

	if (!encrypt && global_secflags & CIFSSEC_MAY_PLNTXT) {
		memcpy(lnm_session_key, password_with_pad,
			CIFS_ENCPWD_SIZE);
		return 0;
	}

	/* calculate old style session key */
	/* calling toupper is less broken than repeatedly
	calling nls_toupper would be since that will never
	work for UTF8, but neither handles multibyte code pages
	but the only alternative would be converting to UCS-16 (Unicode)
	(using a routine something like UniStrupr) then
	uppercasing and then converting back from Unicode - which
	would only worth doing it if we knew it were utf8. Basically
	utf8 and other multibyte codepages each need their own strupper
	function since a byte at a time will ont work. */

	for (i = 0; i < CIFS_ENCPWD_SIZE; i++)
		password_with_pad[i] = toupper(password_with_pad[i]);

	rc = SMBencrypt(password_with_pad, cryptkey, lnm_session_key);

	return rc;
}
#endif /* CIFS_WEAK_PW_HASH */

/* Build a proper attribute value/target info pairs blob.
 * Fill in netbios and dns domain name and workstation name
 * and client time (total five av pairs and + one end of fields indicator.

Lines 436-444 Link Here

(-)a/fs/cifs/cifsfs.c (+6 lines)
436	seq_puts(s, ",sec=");	436	seq_puts(s, ",sec=");
437		437
438	switch (ses->sectype) {	438	switch (ses->sectype) {
		439	case LANMAN:
		440	seq_puts(s, "lanman");
		441	break;
439	case NTLMv2:	442	case NTLMv2:
440	seq_puts(s, "ntlmv2");	443	seq_puts(s, "ntlmv2");
441	break;	444	break;
		445	case NTLM:
		446	seq_puts(s, "ntlm");
		447	break;
442	case Kerberos:	448	case Kerberos:
443	seq_puts(s, "krb5");	449	seq_puts(s, "krb5");
444	break;	450	break;

Lines 114-119 Link Here

(-)a/fs/cifs/cifsglob.h (-2 / +30 lines)
114		114
115	enum securityEnum {	115	enum securityEnum {
116	Unspecified = 0, /* not specified */	116	Unspecified = 0, /* not specified */
		117	LANMAN, /* Legacy LANMAN auth */
		118	NTLM, /* Legacy NTLM012 auth with NTLM hash */
117	NTLMv2, /* Legacy NTLM auth with NTLMv2 hash */	119	NTLMv2, /* Legacy NTLM auth with NTLMv2 hash */
118	RawNTLMSSP, /* NTLMSSP without SPNEGO, NTLMv2 hash */	120	RawNTLMSSP, /* NTLMSSP without SPNEGO, NTLMv2 hash */
119	Kerberos, /* Kerberos via SPNEGO */	121	Kerberos, /* Kerberos via SPNEGO */
Lines 633-638 Link Here
633	struct session_key session_key;	635	struct session_key session_key;
634	unsigned long lstrp; /* when we got last response from this server */	636	unsigned long lstrp; /* when we got last response from this server */
635	struct cifs_secmech secmech; /* crypto sec mech functs, descriptors */	637	struct cifs_secmech secmech; /* crypto sec mech functs, descriptors */
		638	#define CIFS_NEGFLAVOR_LANMAN 0 /* wct == 13, LANMAN */
636	#define CIFS_NEGFLAVOR_UNENCAP 1 /* wct == 17, but no ext_sec */	639	#define CIFS_NEGFLAVOR_UNENCAP 1 /* wct == 17, but no ext_sec */
637	#define CIFS_NEGFLAVOR_EXTENDED 2 /* wct == 17, ext_sec bit set */	640	#define CIFS_NEGFLAVOR_EXTENDED 2 /* wct == 17, ext_sec bit set */
638	char negflavor; /* NEGOTIATE response flavor */	641	char negflavor; /* NEGOTIATE response flavor */
Lines 1733-1740 Link Here
1733		1736
1734	/* Security Flags: indicate type of session setup needed */	1737	/* Security Flags: indicate type of session setup needed */
1735	#define CIFSSEC_MAY_SIGN 0x00001	1738	#define CIFSSEC_MAY_SIGN 0x00001
		1739	#define CIFSSEC_MAY_NTLM 0x00002
1736	#define CIFSSEC_MAY_NTLMV2 0x00004	1740	#define CIFSSEC_MAY_NTLMV2 0x00004
1737	#define CIFSSEC_MAY_KRB5 0x00008	1741	#define CIFSSEC_MAY_KRB5 0x00008
		1742	#ifdef CONFIG_CIFS_WEAK_PW_HASH
		1743	#define CIFSSEC_MAY_LANMAN 0x00010
		1744	#define CIFSSEC_MAY_PLNTXT 0x00020
		1745	#else
		1746	#define CIFSSEC_MAY_LANMAN 0
		1747	#define CIFSSEC_MAY_PLNTXT 0
		1748	#endif /* weak passwords */
1738	#define CIFSSEC_MAY_SEAL 0x00040 /* not supported yet */	1749	#define CIFSSEC_MAY_SEAL 0x00040 /* not supported yet */
1739	#define CIFSSEC_MAY_NTLMSSP 0x00080 /* raw ntlmssp with ntlmv2 */	1750	#define CIFSSEC_MAY_NTLMSSP 0x00080 /* raw ntlmssp with ntlmv2 */
1740		1751
Lines 1742-1760 Link Here
1742	/* note that only one of the following can be set so the	1753	/* note that only one of the following can be set so the
1743	result of setting MUST flags more than once will be to	1754	result of setting MUST flags more than once will be to
1744	require use of the stronger protocol */	1755	require use of the stronger protocol */
		1756	#define CIFSSEC_MUST_NTLM 0x02002
1745	#define CIFSSEC_MUST_NTLMV2 0x04004	1757	#define CIFSSEC_MUST_NTLMV2 0x04004
1746	#define CIFSSEC_MUST_KRB5 0x08008	1758	#define CIFSSEC_MUST_KRB5 0x08008
		1759	#ifdef CONFIG_CIFS_WEAK_PW_HASH
		1760	#define CIFSSEC_MUST_LANMAN 0x10010
		1761	#define CIFSSEC_MUST_PLNTXT 0x20020
		1762	#ifdef CONFIG_CIFS_UPCALL
		1763	#define CIFSSEC_MASK 0xBF0BF /* allows weak security but also krb5 */
		1764	#else
		1765	#define CIFSSEC_MASK 0xB70B7 /* current flags supported if weak */
		1766	#endif /* UPCALL */
		1767	#else /* do not allow weak pw hash */
		1768	#define CIFSSEC_MUST_LANMAN 0
		1769	#define CIFSSEC_MUST_PLNTXT 0
1747	#ifdef CONFIG_CIFS_UPCALL	1770	#ifdef CONFIG_CIFS_UPCALL
1748	#define CIFSSEC_MASK 0x8F08F /* flags supported if no weak allowed */	1771	#define CIFSSEC_MASK 0x8F08F /* flags supported if no weak allowed */
1749	#else	1772	#else
1750	#define CIFSSEC_MASK 0x87087 /* flags supported if no weak allowed */	1773	#define CIFSSEC_MASK 0x87087 /* flags supported if no weak allowed */
1751	#endif /* UPCALL */	1774	#endif /* UPCALL */
		1775	#endif /* WEAK_PW_HASH */
1752	#define CIFSSEC_MUST_SEAL 0x40040 /* not supported yet */	1776	#define CIFSSEC_MUST_SEAL 0x40040 /* not supported yet */
1753	#define CIFSSEC_MUST_NTLMSSP 0x80080 /* raw ntlmssp with ntlmv2 */	1777	#define CIFSSEC_MUST_NTLMSSP 0x80080 /* raw ntlmssp with ntlmv2 */
1754		1778
1755	#define CIFSSEC_DEF (CIFSSEC_MAY_SIGN \| CIFSSEC_MAY_NTLMV2 \| CIFSSEC_MAY_NTLMSSP)	1779	#define CIFSSEC_DEF (CIFSSEC_MAY_SIGN \| CIFSSEC_MAY_NTLMV2 \| CIFSSEC_MAY_NTLMSSP)
1756	#define CIFSSEC_MAX (CIFSSEC_MUST_NTLMV2)	1780	#define CIFSSEC_MAX (CIFSSEC_MUST_SIGN \| CIFSSEC_MUST_NTLMV2)
1757	#define CIFSSEC_AUTH_MASK (CIFSSEC_MAY_NTLMV2 \| CIFSSEC_MAY_KRB5 \| CIFSSEC_MAY_NTLMSSP)	1781	#define CIFSSEC_AUTH_MASK (CIFSSEC_MAY_NTLM \| CIFSSEC_MAY_NTLMV2 \| CIFSSEC_MAY_LANMAN \| CIFSSEC_MAY_PLNTXT \| CIFSSEC_MAY_KRB5 \| CIFSSEC_MAY_NTLMSSP)
1758	/*	1782	/*
1759	*****************************************************************	1783	*****************************************************************
1760	* All constants go here	1784	* All constants go here
Lines 1918-1923 Link Here
1918	return "Kerberos";	1942	return "Kerberos";
1919	case NTLMv2:	1943	case NTLMv2:
1920	return "NTLMv2";	1944	return "NTLMv2";
		1945	case NTLM:
		1946	return "NTLM";
		1947	case LANMAN:
		1948	return "LANMAN";
1921	default:	1949	default:
1922	return "Unknown";	1950	return "Unknown";
1923	}	1951	}

Lines 13-19 Link Here

(-)a/fs/cifs/cifspdu.h (+28 lines)
13	#include <asm/unaligned.h>	13	#include <asm/unaligned.h>
14	#include "../smbfs_common/smbfsctl.h"	14	#include "../smbfs_common/smbfsctl.h"
15		15
		16	#ifdef CONFIG_CIFS_WEAK_PW_HASH
		17	#define LANMAN_PROT 0
		18	#define LANMAN2_PROT 1
		19	#define CIFS_PROT 2
		20	#else
16	#define CIFS_PROT 0	21	#define CIFS_PROT 0
		22	#endif
17	#define POSIX_PROT (CIFS_PROT+1)	23	#define POSIX_PROT (CIFS_PROT+1)
18	#define BAD_PROT 0xFFFF	24	#define BAD_PROT 0xFFFF
19		25
Lines 498-505 Link Here
498	unsigned char DialectsArray[1];	504	unsigned char DialectsArray[1];
499	} __attribute__((packed)) NEGOTIATE_REQ;	505	} __attribute__((packed)) NEGOTIATE_REQ;
500		506
		507	/* Dialect index is 13 for LANMAN */
		508
501	#define MIN_TZ_ADJ (15 * 60) /* minimum grid for timezones in seconds */	509	#define MIN_TZ_ADJ (15 * 60) /* minimum grid for timezones in seconds */
502		510
		511	typedef struct lanman_neg_rsp {
		512	struct smb_hdr hdr; /* wct = 13 */
		513	__le16 DialectIndex;
		514	__le16 SecurityMode;
		515	__le16 MaxBufSize;
		516	__le16 MaxMpxCount;
		517	__le16 MaxNumberVcs;
		518	__le16 RawMode;
		519	__le32 SessionKey;
		520	struct {
		521	__le16 Time;
		522	__le16 Date;
		523	} __attribute__((packed)) SrvTime;
		524	__le16 ServerTimeZone;
		525	__le16 EncryptionKeyLength;
		526	__le16 Reserved;
		527	__u16 ByteCount;
		528	unsigned char EncryptionKey[1];
		529	} __attribute__((packed)) LANMAN_NEG_RSP;
		530
503	#define READ_RAW_ENABLE 1	531	#define READ_RAW_ENABLE 1
504	#define WRITE_RAW_ENABLE 2	532	#define WRITE_RAW_ENABLE 2
505	#define RAW_ENABLE (READ_RAW_ENABLE \| WRITE_RAW_ENABLE)	533	#define RAW_ENABLE (READ_RAW_ENABLE \| WRITE_RAW_ENABLE)

Lines 500-511 Link Here

(-)a/fs/cifs/cifsproto.h (+10 lines)
500	extern int cifs_verify_signature(struct smb_rqst *rqst,	500	extern int cifs_verify_signature(struct smb_rqst *rqst,
501	struct TCP_Server_Info *server,	501	struct TCP_Server_Info *server,
502	__u32 expected_sequence_number);	502	__u32 expected_sequence_number);
		503	extern int SMBNTencrypt(unsigned char , unsigned char , unsigned char *,
		504	const struct nls_table *);
		505	extern int setup_ntlm_response(struct cifs_ses , const struct nls_table );
503	extern int setup_ntlmv2_rsp(struct cifs_ses , const struct nls_table );	506	extern int setup_ntlmv2_rsp(struct cifs_ses , const struct nls_table );
504	extern void cifs_crypto_secmech_release(struct TCP_Server_Info *server);	507	extern void cifs_crypto_secmech_release(struct TCP_Server_Info *server);
505	extern int calc_seckey(struct cifs_ses *);	508	extern int calc_seckey(struct cifs_ses *);
506	extern int generate_smb30signingkey(struct cifs_ses *);	509	extern int generate_smb30signingkey(struct cifs_ses *);
507	extern int generate_smb311signingkey(struct cifs_ses *);	510	extern int generate_smb311signingkey(struct cifs_ses *);
508		511
		512	#ifdef CONFIG_CIFS_WEAK_PW_HASH
		513	extern int calc_lanman_hash(const char password, const char cryptkey,
		514	bool encrypt, char *lnm_session_key);
		515	#endif /* CIFS_WEAK_PW_HASH */
509	extern int CIFSSMBCopy(unsigned int xid,	516	extern int CIFSSMBCopy(unsigned int xid,
510	struct cifs_tcon *source_tcon,	517	struct cifs_tcon *source_tcon,
511	const char *fromName,	518	const char *fromName,
Lines 542-549 Link Here
542	struct cifs_sb_info *cifs_sb,	549	struct cifs_sb_info *cifs_sb,
543	struct cifs_fattr *fattr,	550	struct cifs_fattr *fattr,
544	const unsigned char *path);	551	const unsigned char *path);
		552	extern int mdfour(unsigned char , unsigned char , int);
545	extern int E_md4hash(const unsigned char passwd, unsigned char p16,	553	extern int E_md4hash(const unsigned char passwd, unsigned char p16,
546	const struct nls_table *codepage);	554	const struct nls_table *codepage);
		555	extern int SMBencrypt(unsigned char passwd, const unsigned char c8,
		556	unsigned char *p24);
547		557
548	extern int	558	extern int
549	cifs_setup_volume_info(struct smb3_fs_context ctx, const char mntopts, const char *devname);	559	cifs_setup_volume_info(struct smb3_fs_context ctx, const char mntopts, const char *devname);

Lines 41-46 Link Here

(-)a/fs/cifs/cifssmb.c (-1 / +105 lines)
41	int index;	41	int index;
42	char *name;	42	char *name;
43	} protocols[] = {	43	} protocols[] = {
		44	#ifdef CONFIG_CIFS_WEAK_PW_HASH
		45	{LANMAN_PROT, "\2LM1.2X002"},
		46	{LANMAN2_PROT, "\2LANMAN2.1"},
		47	#endif /* weak password hashing for legacy clients */
44	{CIFS_PROT, "\2NT LM 0.12"},	48	{CIFS_PROT, "\2NT LM 0.12"},
45	{POSIX_PROT, "\2POSIX 2"},	49	{POSIX_PROT, "\2POSIX 2"},
46	{BAD_PROT, "\2"}	50	{BAD_PROT, "\2"}
Lines 50-55 Link Here
50	int index;	54	int index;
51	char *name;	55	char *name;
52	} protocols[] = {	56	} protocols[] = {
		57	#ifdef CONFIG_CIFS_WEAK_PW_HASH
		58	{LANMAN_PROT, "\2LM1.2X002"},
		59	{LANMAN2_PROT, "\2LANMAN2.1"},
		60	#endif /* weak password hashing for legacy clients */
53	{CIFS_PROT, "\2NT LM 0.12"},	61	{CIFS_PROT, "\2NT LM 0.12"},
54	{BAD_PROT, "\2"}	62	{BAD_PROT, "\2"}
55	};	63	};
Lines 57-65 Link Here
57		65
58	/* define the number of elements in the cifs dialect array */	66	/* define the number of elements in the cifs dialect array */
59	#ifdef CONFIG_CIFS_POSIX	67	#ifdef CONFIG_CIFS_POSIX
		68	#ifdef CONFIG_CIFS_WEAK_PW_HASH
		69	#define CIFS_NUM_PROT 4
		70	#else
60	#define CIFS_NUM_PROT 2	71	#define CIFS_NUM_PROT 2
		72	#endif /* CIFS_WEAK_PW_HASH */
61	#else /* not posix */	73	#else /* not posix */
		74	#ifdef CONFIG_CIFS_WEAK_PW_HASH
		75	#define CIFS_NUM_PROT 3
		76	#else
62	#define CIFS_NUM_PROT 1	77	#define CIFS_NUM_PROT 1
		78	#endif /* CONFIG_CIFS_WEAK_PW_HASH */
63	#endif /* CIFS_POSIX */	79	#endif /* CIFS_POSIX */
64		80
65	/*	81	/*
Lines 458-463 Link Here
458	return 0;	474	return 0;
459	}	475	}
460		476
		477	#ifdef CONFIG_CIFS_WEAK_PW_HASH
		478	static int
		479	decode_lanman_negprot_rsp(struct TCP_Server_Info server, NEGOTIATE_RSP pSMBr)
		480	{
		481	__s16 tmp;
		482	struct lanman_neg_rsp rsp = (struct lanman_neg_rsp )pSMBr;
		483
		484	if (server->dialect != LANMAN_PROT && server->dialect != LANMAN2_PROT)
		485	return -EOPNOTSUPP;
		486
		487	server->sec_mode = le16_to_cpu(rsp->SecurityMode);
		488	server->maxReq = min_t(unsigned int,
		489	le16_to_cpu(rsp->MaxMpxCount),
		490	cifs_max_pending);
		491	set_credits(server, server->maxReq);
		492	server->maxBuf = le16_to_cpu(rsp->MaxBufSize);
		493	/* set up max_read for readpages check */
		494	server->max_read = server->maxBuf;
		495	/* even though we do not use raw we might as well set this
		496	accurately, in case we ever find a need for it */
		497	if ((le16_to_cpu(rsp->RawMode) & RAW_ENABLE) == RAW_ENABLE) {
		498	server->max_rw = 0xFF00;
		499	server->capabilities = CAP_MPX_MODE \| CAP_RAW_MODE;
		500	} else {
		501	server->max_rw = 0;/* do not need to use raw anyway */
		502	server->capabilities = CAP_MPX_MODE;
		503	}
		504	tmp = (__s16)le16_to_cpu(rsp->ServerTimeZone);
		505	if (tmp == -1) {
		506	/* OS/2 often does not set timezone therefore
		507	* we must use server time to calc time zone.
		508	* Could deviate slightly from the right zone.
		509	* Smallest defined timezone difference is 15 minutes
		510	* (i.e. Nepal). Rounding up/down is done to match
		511	* this requirement.
		512	*/
		513	int val, seconds, remain, result;
		514	struct timespec64 ts;
		515	time64_t utc = ktime_get_real_seconds();
		516	ts = cnvrtDosUnixTm(rsp->SrvTime.Date,
		517	rsp->SrvTime.Time, 0);
		518	cifs_dbg(FYI, "SrvTime %lld sec since 1970 (utc: %lld) diff: %lld\n",
		519	ts.tv_sec, utc,
		520	utc - ts.tv_sec);
		521	val = (int)(utc - ts.tv_sec);
		522	seconds = abs(val);
		523	result = (seconds / MIN_TZ_ADJ) * MIN_TZ_ADJ;
		524	remain = seconds % MIN_TZ_ADJ;
		525	if (remain >= (MIN_TZ_ADJ / 2))
		526	result += MIN_TZ_ADJ;
		527	if (val < 0)
		528	result = -result;
		529	server->timeAdj = result;
		530	} else {
		531	server->timeAdj = (int)tmp;
		532	server->timeAdj = 60; / also in seconds */
		533	}
		534	cifs_dbg(FYI, "server->timeAdj: %d seconds\n", server->timeAdj);
		535
		536
		537	/* BB get server time for time conversions and add
		538	code to use it and timezone since this is not UTC */
		539
		540	if (rsp->EncryptionKeyLength ==
541	cpu_to_le16(CIFS_CRYPTO_KEY_SIZE)) {
542	memcpy(server->cryptkey, rsp->EncryptionKey,
543	CIFS_CRYPTO_KEY_SIZE);
544	} else if (server->sec_mode & SECMODE_PW_ENCRYPT) {
545	return -EIO; /* need cryptkey unless plain text */
546	}
547
548	cifs_dbg(FYI, "LANMAN negotiated\n");
549	return 0;
550	}
551	#else
552	static inline int
553	decode_lanman_negprot_rsp(struct TCP_Server_Info server, NEGOTIATE_RSP pSMBr)
554	{
555	cifs_dbg(VFS, "mount failed, cifs module not built with CIFS_WEAK_PW_HASH support\n");
556	return -EOPNOTSUPP;
557	}
558	#endif
559
461	static bool	560	static bool
462	should_set_ext_sec_flag(enum securityEnum sectype)	561	should_set_ext_sec_flag(enum securityEnum sectype)
463	{	562	{
Lines 526-537 Link Here
526	server->dialect = le16_to_cpu(pSMBr->DialectIndex);	625	server->dialect = le16_to_cpu(pSMBr->DialectIndex);
527	cifs_dbg(FYI, "Dialect: %d\n", server->dialect);	626	cifs_dbg(FYI, "Dialect: %d\n", server->dialect);
528	/* Check wct = 1 error case */	627	/* Check wct = 1 error case */
529	if ((pSMBr->hdr.WordCount <= 13) \|\| (server->dialect == BAD_PROT)) {	628	if ((pSMBr->hdr.WordCount < 13) \|\| (server->dialect == BAD_PROT)) {
530	/* core returns wct = 1, but we do not ask for core - otherwise	629	/* core returns wct = 1, but we do not ask for core - otherwise
531	small wct just comes when dialect index is -1 indicating we	630	small wct just comes when dialect index is -1 indicating we
532	could not negotiate a common dialect */	631	could not negotiate a common dialect */
533	rc = -EOPNOTSUPP;	632	rc = -EOPNOTSUPP;
534	goto neg_err_exit;	633	goto neg_err_exit;
		634	} else if (pSMBr->hdr.WordCount == 13) {
		635	server->negflavor = CIFS_NEGFLAVOR_LANMAN;
		636	rc = decode_lanman_negprot_rsp(server, pSMBr);
		637	goto signing_check;
535	} else if (pSMBr->hdr.WordCount != 17) {	638	} else if (pSMBr->hdr.WordCount != 17) {
536	/* unknown wct */	639	/* unknown wct */
537	rc = -EOPNOTSUPP;	640	rc = -EOPNOTSUPP;
Lines 573-578 Link Here
573	server->capabilities &= ~CAP_EXTENDED_SECURITY;	676	server->capabilities &= ~CAP_EXTENDED_SECURITY;
574	}	677	}
575		678
		679	signing_check:
576	if (!rc)	680	if (!rc)
577	rc = cifs_enable_signing(server, ses->sign);	681	rc = cifs_enable_signing(server, ses->sign);
578	neg_err_exit:	682	neg_err_exit:




		*bcc_ptr = 0; /* password is null byte */
		bcc_ptr++;              /* skip password */
		/* already aligned so no need to do it below */
	} else {
		pSMB->PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
		/* BB FIXME add code to fail this if NTLMv2 or Kerberos
		   specified as required (when that support is added to
		   the vfs in the future) as only NTLM or the much
		   weaker LANMAN (which we do not send by default) is accepted
		   by Samba (not sure whether other servers allow
		   NTLMv2 password here) */
#ifdef CONFIG_CIFS_WEAK_PW_HASH
		if ((global_secflags & CIFSSEC_MAY_LANMAN) &&
		    (ses->sectype == LANMAN))
			calc_lanman_hash(tcon->password, ses->server->cryptkey,
					 ses->server->sec_mode &
					    SECMODE_PW_ENCRYPT ? true : false,
					 bcc_ptr);
		else
#endif /* CIFS_WEAK_PW_HASH */
		rc = SMBNTencrypt(tcon->password, ses->server->cryptkey,
					bcc_ptr, nls_codepage);
		if (rc) {
			cifs_dbg(FYI, "%s Can't generate NTLM rsp. Error: %d\n",
				 __func__, rc);
			cifs_buf_release(smb_buffer);
			return rc;
		}

		bcc_ptr += CIFS_AUTH_RESP_SIZE;
		if (ses->capabilities & CAP_UNICODE) {
			/* must align unicode strings */
			*bcc_ptr = 0; /* null byte password */
			bcc_ptr++;
		}
	}

	if (ses->server->sign)

Lines 57-65 Link Here

(-)a/fs/cifs/fs_context.c (+14 lines)
57	{ Opt_sec_krb5p, "krb5p" },	57	{ Opt_sec_krb5p, "krb5p" },
58	{ Opt_sec_ntlmsspi, "ntlmsspi" },	58	{ Opt_sec_ntlmsspi, "ntlmsspi" },
59	{ Opt_sec_ntlmssp, "ntlmssp" },	59	{ Opt_sec_ntlmssp, "ntlmssp" },
		60	{ Opt_ntlm, "ntlm" },
		61	{ Opt_sec_ntlmi, "ntlmi" },
60	{ Opt_sec_ntlmv2, "nontlm" },	62	{ Opt_sec_ntlmv2, "nontlm" },
61	{ Opt_sec_ntlmv2, "ntlmv2" },	63	{ Opt_sec_ntlmv2, "ntlmv2" },
62	{ Opt_sec_ntlmv2i, "ntlmv2i" },	64	{ Opt_sec_ntlmv2i, "ntlmv2i" },
		65	{ Opt_sec_lanman, "lanman" },
63	{ Opt_sec_none, "none" },	66	{ Opt_sec_none, "none" },
64		67
65	{ Opt_sec_err, NULL }	68	{ Opt_sec_err, NULL }
Lines 218-229 Link Here
218	case Opt_sec_ntlmssp:	221	case Opt_sec_ntlmssp:
219	ctx->sectype = RawNTLMSSP;	222	ctx->sectype = RawNTLMSSP;
220	break;	223	break;
		224	case Opt_sec_ntlmi:
		225	ctx->sign = true;
		226	fallthrough;
		227	case Opt_ntlm:
		228	ctx->sectype = NTLM;
		229	break;
221	case Opt_sec_ntlmv2i:	230	case Opt_sec_ntlmv2i:
222	ctx->sign = true;	231	ctx->sign = true;
223	fallthrough;	232	fallthrough;
224	case Opt_sec_ntlmv2:	233	case Opt_sec_ntlmv2:
225	ctx->sectype = NTLMv2;	234	ctx->sectype = NTLMv2;
226	break;	235	break;
		236	#ifdef CONFIG_CIFS_WEAK_PW_HASH
		237	case Opt_sec_lanman:
		238	ctx->sectype = LANMAN;
		239	break;
		240	#endif
227	case Opt_sec_none:	241	case Opt_sec_none:
228	ctx->nullauth = 1;	242	ctx->nullauth = 1;
229	break;	243	break;

Lines 47-54 Link Here

(-)a/fs/cifs/fs_context.h (+3 lines)
47	Opt_sec_krb5p,	47	Opt_sec_krb5p,
48	Opt_sec_ntlmsspi,	48	Opt_sec_ntlmsspi,
49	Opt_sec_ntlmssp,	49	Opt_sec_ntlmssp,
		50	Opt_ntlm,
		51	Opt_sec_ntlmi,
50	Opt_sec_ntlmv2,	52	Opt_sec_ntlmv2,
51	Opt_sec_ntlmv2i,	53	Opt_sec_ntlmv2i,
		54	Opt_sec_lanman,
52	Opt_sec_none,	55	Opt_sec_none,
53		56
54	Opt_sec_err	57	Opt_sec_err




		}
	case CIFS_NEGFLAVOR_UNENCAP:
		switch (requested) {
		case NTLM:
		case NTLMv2:
			return requested;
		case Unspecified:
			if (global_secflags & CIFSSEC_MAY_NTLMV2)
				return NTLMv2;
			if (global_secflags & CIFSSEC_MAY_NTLM)
				return NTLM;
			break;
		default:
			break;
		}
		fallthrough;	/* to attempt LANMAN authentication next */
	case CIFS_NEGFLAVOR_LANMAN:
		switch (requested) {
		case LANMAN:
			return requested;
		case Unspecified:
			if (global_secflags & CIFSSEC_MAY_LANMAN)
				return LANMAN;
			fallthrough;
		default:
			return Unspecified;
		}
	default:
		return Unspecified;
	}

	return rc;
}

/*
 * LANMAN and plaintext are less secure and off by default.
 * So we make this explicitly be turned on in kconfig (in the
 * build) and turned on at runtime (changed from the default)
 * in proc/fs/cifs or via mount parm.  Unfortunately this is
 * needed for old Win (e.g. Win95), some obscure NAS and OS/2
 */
#ifdef CONFIG_CIFS_WEAK_PW_HASH
static void
sess_auth_lanman(struct sess_data *sess_data)
{
	int rc = 0;
	struct smb_hdr *smb_buf;
	SESSION_SETUP_ANDX *pSMB;
	char *bcc_ptr;
	struct cifs_ses *ses = sess_data->ses;
	char lnm_session_key[CIFS_AUTH_RESP_SIZE];
	__u16 bytes_remaining;

	/* lanman 2 style sessionsetup */
	/* wct = 10 */
	rc = sess_alloc_buffer(sess_data, 10);
	if (rc)
		goto out;

	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
	bcc_ptr = sess_data->iov[2].iov_base;
	(void)cifs_ssetup_hdr(ses, pSMB);

	pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE;

	if (ses->user_name != NULL) {
		/* no capabilities flags in old lanman negotiation */
		pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);

		/* Calculate hash with password and copy into bcc_ptr.
		 * Encryption Key (stored as in cryptkey) gets used if the
		 * security mode bit in Negotiate Protocol response states
		 * to use challenge/response method (i.e. Password bit is 1).
		 */
		rc = calc_lanman_hash(ses->password, ses->server->cryptkey,
				      ses->server->sec_mode & SECMODE_PW_ENCRYPT ?
				      true : false, lnm_session_key);
		if (rc)
			goto out;

		memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE);
		bcc_ptr += CIFS_AUTH_RESP_SIZE;
	} else {
		pSMB->old_req.PasswordLength = 0;
	}

	/*
	 * can not sign if LANMAN negotiated so no need
	 * to calculate signing key? but what if server
	 * changed to do higher than lanman dialect and
	 * we reconnected would we ever calc signing_key?
	 */

	cifs_dbg(FYI, "Negotiating LANMAN setting up strings\n");
	/* Unicode not allowed for LANMAN dialects */
	ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);

	sess_data->iov[2].iov_len = (long) bcc_ptr -
			(long) sess_data->iov[2].iov_base;

	rc = sess_sendreceive(sess_data);
	if (rc)
		goto out;

	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;

	/* lanman response has a word count of 3 */
	if (smb_buf->WordCount != 3) {
		rc = -EIO;
		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
		goto out;
	}

	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
		cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */

	ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);

	bytes_remaining = get_bcc(smb_buf);
	bcc_ptr = pByteArea(smb_buf);

	/* BB check if Unicode and decode strings */
	if (bytes_remaining == 0) {
		/* no string area to decode, do nothing */
	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
		/* unicode string area must be word-aligned */
		if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
			++bcc_ptr;
			--bytes_remaining;
		}
		decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
				      sess_data->nls_cp);
	} else {
		decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
				    sess_data->nls_cp);
	}

	rc = sess_establish_session(sess_data);
out:
	sess_data->result = rc;
	sess_data->func = NULL;
	sess_free_buffer(sess_data);
}

#endif

static void
sess_auth_ntlm(struct sess_data *sess_data)
{
	int rc = 0;
	struct smb_hdr *smb_buf;
	SESSION_SETUP_ANDX *pSMB;
	char *bcc_ptr;
	struct cifs_ses *ses = sess_data->ses;
	__u32 capabilities;
	__u16 bytes_remaining;

	/* old style NTLM sessionsetup */
	/* wct = 13 */
	rc = sess_alloc_buffer(sess_data, 13);
	if (rc)
		goto out;

	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
	bcc_ptr = sess_data->iov[2].iov_base;
	capabilities = cifs_ssetup_hdr(ses, pSMB);

	pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
	if (ses->user_name != NULL) {
		pSMB->req_no_secext.CaseInsensitivePasswordLength =
				cpu_to_le16(CIFS_AUTH_RESP_SIZE);
		pSMB->req_no_secext.CaseSensitivePasswordLength =
				cpu_to_le16(CIFS_AUTH_RESP_SIZE);

		/* calculate ntlm response and session key */
		rc = setup_ntlm_response(ses, sess_data->nls_cp);
		if (rc) {
			cifs_dbg(VFS, "Error %d during NTLM authentication\n",
					 rc);
			goto out;
		}

		/* copy ntlm response */
		memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
				CIFS_AUTH_RESP_SIZE);
		bcc_ptr += CIFS_AUTH_RESP_SIZE;
		memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
				CIFS_AUTH_RESP_SIZE);
		bcc_ptr += CIFS_AUTH_RESP_SIZE;
	} else {
		pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
		pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
	}

	if (ses->capabilities & CAP_UNICODE) {
		/* unicode strings must be word aligned */
		if (sess_data->iov[0].iov_len % 2) {
			*bcc_ptr = 0;
			bcc_ptr++;
		}
		unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
	} else {
		ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
	}


	sess_data->iov[2].iov_len = (long) bcc_ptr -
			(long) sess_data->iov[2].iov_base;

	rc = sess_sendreceive(sess_data);
	if (rc)
		goto out;

	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;

	if (smb_buf->WordCount != 3) {
		rc = -EIO;
		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
		goto out;
	}

	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
		cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */

	ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);

	bytes_remaining = get_bcc(smb_buf);
	bcc_ptr = pByteArea(smb_buf);

	/* BB check if Unicode and decode strings */
	if (bytes_remaining == 0) {
		/* no string area to decode, do nothing */
	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
		/* unicode string area must be word-aligned */
		if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
			++bcc_ptr;
			--bytes_remaining;
		}
		decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
				      sess_data->nls_cp);
	} else {
		decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
				    sess_data->nls_cp);
	}

	rc = sess_establish_session(sess_data);
out:
	sess_data->result = rc;
	sess_data->func = NULL;
	sess_free_buffer(sess_data);
	kfree(ses->auth_key.response);
	ses->auth_key.response = NULL;
}

static void
sess_auth_ntlmv2(struct sess_data *sess_data)
{

	}

	switch (type) {
	case LANMAN:
		/* LANMAN and plaintext are less secure and off by default.
		 * So we make this explicitly be turned on in kconfig (in the
		 * build) and turned on at runtime (changed from the default)
		 * in proc/fs/cifs or via mount parm.  Unfortunately this is
		 * needed for old Win (e.g. Win95), some obscure NAS and OS/2 */
#ifdef CONFIG_CIFS_WEAK_PW_HASH
		sess_data->func = sess_auth_lanman;
		break;
#else
		return -EOPNOTSUPP;
#endif
	case NTLM:
		sess_data->func = sess_auth_ntlm;
		break;
	case NTLMv2:
		sess_data->func = sess_auth_ntlmv2;
		break;




#include <linux/string.h>
#include <linux/kernel.h>
#include <linux/random.h>
#include <crypto/des.h>
#include "cifs_fs_sb.h"
#include "cifs_unicode.h"
#include "cifspdu.h"

#define SSVALX(buf,pos,val) (CVAL(buf,pos)=(val)&0xFF,CVAL(buf,pos+1)=(val)>>8)
#define SSVAL(buf,pos,val) SSVALX((buf),(pos),((__u16)(val)))

static void
str_to_key(unsigned char *str, unsigned char *key)
{
	int i;

	key[0] = str[0] >> 1;
	key[1] = ((str[0] & 0x01) << 6) | (str[1] >> 2);
	key[2] = ((str[1] & 0x03) << 5) | (str[2] >> 3);
	key[3] = ((str[2] & 0x07) << 4) | (str[3] >> 4);
	key[4] = ((str[3] & 0x0F) << 3) | (str[4] >> 5);
	key[5] = ((str[4] & 0x1F) << 2) | (str[5] >> 6);
	key[6] = ((str[5] & 0x3F) << 1) | (str[6] >> 7);
	key[7] = str[6] & 0x7F;
	for (i = 0; i < 8; i++)
		key[i] = (key[i] << 1);
}

static int
smbhash(unsigned char *out, const unsigned char *in, unsigned char *key)
{
	unsigned char key2[8];
	struct des_ctx ctx;

	str_to_key(key, key2);

	if (fips_enabled) {
		cifs_dbg(VFS, "FIPS compliance enabled: DES not permitted\n");
		return -ENOENT;
	}

	des_expand_key(&ctx, key2, DES_KEY_SIZE);
	des_encrypt(&ctx, out, in);
	memzero_explicit(&ctx, sizeof(ctx));

	return 0;
}

static int
E_P16(unsigned char *p14, unsigned char *p16)
{
	int rc;
	unsigned char sp8[8] =
	    { 0x4b, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24, 0x25 };

	rc = smbhash(p16, sp8, p14);
	if (rc)
		return rc;
	rc = smbhash(p16 + 8, sp8, p14 + 7);
	return rc;
}

static int
E_P24(unsigned char *p21, const unsigned char *c8, unsigned char *p24)
{
	int rc;

	rc = smbhash(p24, c8, p21);
	if (rc)
		return rc;
	rc = smbhash(p24 + 8, c8, p21 + 7);
	if (rc)
		return rc;
	rc = smbhash(p24 + 16, c8, p21 + 14);
	return rc;
}

/* produce a md4 message digest from data of length n bytes */
int
mdfour(unsigned char *md4_hash, unsigned char *link_str, int link_len)
{
	int rc;

}

/*
   This implements the X/Open SMB password encryption
   It takes a password, a 8 byte "crypt key" and puts 24 bytes of
   encrypted password into p24 */
/* Note that password must be uppercased and null terminated */
int
SMBencrypt(unsigned char *passwd, const unsigned char *c8, unsigned char *p24)
{
	int rc;
	unsigned char p14[14], p16[16], p21[21];

	memset(p14, '\0', 14);
	memset(p16, '\0', 16);
	memset(p21, '\0', 21);

	memcpy(p14, passwd, 14);
	rc = E_P16(p14, p16);
	if (rc)
		return rc;

	memcpy(p21, p16, 16);
	rc = E_P24(p21, c8, p24);

	return rc;
}

/*
 * Creates the MD4 Hash of the users password in NT UNICODE.
 */



	return rc;
}

/* Does the NT MD4 hash then des encryption. */
int
SMBNTencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24,
		const struct nls_table *codepage)
{
	int rc;
	unsigned char p16[16], p21[21];

	memset(p16, '\0', 16);
	memset(p21, '\0', 21);

	rc = E_md4hash(passwd, p16, codepage);
	if (rc) {
		cifs_dbg(FYI, "%s Can't generate NT hash, error: %d\n",
			 __func__, rc);
		return rc;
	}
	memcpy(p21, p16, 16);
	rc = E_P24(p21, c8, p24);
	return rc;
}

Return to bug 821895

Lines 3702-3707 Link Here

(-)a/fs/cifs/connect.c (+32 lines)
3702	bcc_ptr = 0; / password is null byte */	3702	bcc_ptr = 0; / password is null byte */
3703	bcc_ptr++; /* skip password */	3703	bcc_ptr++; /* skip password */
3704	/* already aligned so no need to do it below */	3704	/* already aligned so no need to do it below */
		3705	} else {
		3706	pSMB->PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
		3707	/* BB FIXME add code to fail this if NTLMv2 or Kerberos
		3708	specified as required (when that support is added to
		3709	the vfs in the future) as only NTLM or the much
		3710	weaker LANMAN (which we do not send by default) is accepted
		3711	by Samba (not sure whether other servers allow
		3712	NTLMv2 password here) */
		3713	#ifdef CONFIG_CIFS_WEAK_PW_HASH
		3714	if ((global_secflags & CIFSSEC_MAY_LANMAN) &&
		3715	(ses->sectype == LANMAN))
		3716	calc_lanman_hash(tcon->password, ses->server->cryptkey,
		3717	ses->server->sec_mode &
		3718	SECMODE_PW_ENCRYPT ? true : false,
		3719	bcc_ptr);
		3720	else
		3721	#endif /* CIFS_WEAK_PW_HASH */
		3722	rc = SMBNTencrypt(tcon->password, ses->server->cryptkey,
		3723	bcc_ptr, nls_codepage);
		3724	if (rc) {
		3725	cifs_dbg(FYI, "%s Can't generate NTLM rsp. Error: %d\n",
		3726	__func__, rc);
		3727	cifs_buf_release(smb_buffer);
		3728	return rc;
		3729	}
		3730
		3731	bcc_ptr += CIFS_AUTH_RESP_SIZE;
		3732	if (ses->capabilities & CAP_UNICODE) {
		3733	/* must align unicode strings */
		3734	bcc_ptr = 0; / null byte password */
		3735	bcc_ptr++;
		3736	}
3705	}	3737	}
3706		3738
3707	if (ses->server->sign)	3739	if (ses->server->sign)

Lines 14-19 Link Here

(-)a/fs/cifs/Kconfig (+28 lines)
14	select CRYPTO_GCM	14	select CRYPTO_GCM
15	select CRYPTO_ECB	15	select CRYPTO_ECB
16	select CRYPTO_AES	16	select CRYPTO_AES
		17	select CRYPTO_LIB_DES
17	select KEYS	18	select KEYS
18	select DNS_RESOLVER	19	select DNS_RESOLVER
19	select ASN1	20	select ASN1
Lines 82-87 Link Here
82		83
83	If unsure, say Y.	84	If unsure, say Y.
84		85
		86	config CIFS_WEAK_PW_HASH
		87	bool "Support legacy servers which use weaker LANMAN security"
		88	depends on CIFS && CIFS_ALLOW_INSECURE_LEGACY
		89	help
		90	Modern CIFS servers including Samba and most Windows versions
		91	(since 1997) support stronger NTLM (and even NTLMv2 and Kerberos)
		92	security mechanisms. These hash the password more securely
		93	than the mechanisms used in the older LANMAN version of the
		94	SMB protocol but LANMAN based authentication is needed to
		95	establish sessions with some old SMB servers.
		96
		97	Enabling this option allows the cifs module to mount to older
		98	LANMAN based servers such as OS/2 and Windows 95, but such
		99	mounts may be less secure than mounts using NTLM or more recent
		100	security mechanisms if you are on a public network. Unless you
		101	have a need to access old SMB servers (and are on a private
		102	network) you probably want to say N. Even if this support
		103	is enabled in the kernel build, LANMAN authentication will not be
		104	used automatically. At runtime LANMAN mounts are disabled but
		105	can be set to required (or optional) either in
		106	/proc/fs/cifs (see Documentation/admin-guide/cifs/usage.rst for
		107	more detail) or via an option on the mount command. This support
		108	is disabled by default in order to reduce the possibility of a
		109	downgrade attack.
		110
		111	If unsure, say N.
		112
85	config CIFS_UPCALL	113	config CIFS_UPCALL
86	bool "Kerberos/SPNEGO advanced session setup"	114	bool "Kerberos/SPNEGO advanced session setup"
87	depends on CIFS	115	depends on CIFS

Lines 249-254 Link Here

(-)a/fs/cifs/cifsencrypt.c (+81 lines)
249		249
250	}	250	}
251		251
		252	/* first calculate 24 bytes ntlm response and then 16 byte session key */
		253	int setup_ntlm_response(struct cifs_ses ses, const struct nls_table nls_cp)
		254	{
		255	int rc = 0;
		256	unsigned int temp_len = CIFS_SESS_KEY_SIZE + CIFS_AUTH_RESP_SIZE;
		257	char temp_key[CIFS_SESS_KEY_SIZE];
		258
		259	if (!ses)
		260	return -EINVAL;
		261
		262	ses->auth_key.response = kmalloc(temp_len, GFP_KERNEL);
		263	if (!ses->auth_key.response)
		264	return -ENOMEM;
		265
		266	ses->auth_key.len = temp_len;
		267
		268	rc = SMBNTencrypt(ses->password, ses->server->cryptkey,
		269	ses->auth_key.response + CIFS_SESS_KEY_SIZE, nls_cp);
		270	if (rc) {
		271	cifs_dbg(FYI, "%s Can't generate NTLM response, error: %d\n",
		272	__func__, rc);
		273	return rc;
		274	}
		275
		276	rc = E_md4hash(ses->password, temp_key, nls_cp);
		277	if (rc) {
		278	cifs_dbg(FYI, "%s Can't generate NT hash, error: %d\n",
		279	__func__, rc);
		280	return rc;
		281	}
		282
		283	rc = mdfour(ses->auth_key.response, temp_key, CIFS_SESS_KEY_SIZE);
		284	if (rc)
		285	cifs_dbg(FYI, "%s Can't generate NTLM session key, error: %d\n",
		286	__func__, rc);
		287
		288	return rc;
		289	}
		290
		291	#ifdef CONFIG_CIFS_WEAK_PW_HASH
		292	int calc_lanman_hash(const char password, const char cryptkey, bool encrypt,
		293	char *lnm_session_key)
		294	{
		295	int i, len;
		296	int rc;
		297	char password_with_pad[CIFS_ENCPWD_SIZE] = {0};
		298
		299	if (password) {
		300	for (len = 0; len < CIFS_ENCPWD_SIZE; len++)
		301	if (!password[len])
		302	break;
		303
		304	memcpy(password_with_pad, password, len);
		305	}
		306
		307	if (!encrypt && global_secflags & CIFSSEC_MAY_PLNTXT) {
		308	memcpy(lnm_session_key, password_with_pad,
		309	CIFS_ENCPWD_SIZE);
		310	return 0;
		311	}
		312
		313	/* calculate old style session key */
		314	/* calling toupper is less broken than repeatedly
		315	calling nls_toupper would be since that will never
316	work for UTF8, but neither handles multibyte code pages
317	but the only alternative would be converting to UCS-16 (Unicode)
318	(using a routine something like UniStrupr) then
319	uppercasing and then converting back from Unicode - which
320	would only worth doing it if we knew it were utf8. Basically
321	utf8 and other multibyte codepages each need their own strupper
322	function since a byte at a time will ont work. */
323
324	for (i = 0; i < CIFS_ENCPWD_SIZE; i++)
325	password_with_pad[i] = toupper(password_with_pad[i]);
326
327	rc = SMBencrypt(password_with_pad, cryptkey, lnm_session_key);
328
329	return rc;
330	}
331	#endif /* CIFS_WEAK_PW_HASH */
332
252	/* Build a proper attribute value/target info pairs blob.	333	/* Build a proper attribute value/target info pairs blob.
253	* Fill in netbios and dns domain name and workstation name	334	* Fill in netbios and dns domain name and workstation name
254	* and client time (total five av pairs and + one end of fields indicator.	335	* and client time (total five av pairs and + one end of fields indicator.

Lines 798-813 Link Here

(-)a/fs/cifs/sess.c (-1 / +254 lines)
798	}	798	}
799	case CIFS_NEGFLAVOR_UNENCAP:	799	case CIFS_NEGFLAVOR_UNENCAP:
800	switch (requested) {	800	switch (requested) {
		801	case NTLM:
801	case NTLMv2:	802	case NTLMv2:
802	return requested;	803	return requested;
803	case Unspecified:	804	case Unspecified:
804	if (global_secflags & CIFSSEC_MAY_NTLMV2)	805	if (global_secflags & CIFSSEC_MAY_NTLMV2)
805	return NTLMv2;	806	return NTLMv2;
		807	if (global_secflags & CIFSSEC_MAY_NTLM)
		808	return NTLM;
806	break;	809	break;
807	default:	810	default:
808	break;	811	break;
809	}	812	}
810	fallthrough;	813	fallthrough; /* to attempt LANMAN authentication next */
		814	case CIFS_NEGFLAVOR_LANMAN:
		815	switch (requested) {
		816	case LANMAN:
		817	return requested;
		818	case Unspecified:
		819	if (global_secflags & CIFSSEC_MAY_LANMAN)
		820	return LANMAN;
		821	fallthrough;
		822	default:
		823	return Unspecified;
		824	}
811	default:	825	default:
812	return Unspecified;	826	return Unspecified;
813	}	827	}
Lines 932-937 Link Here
932	return rc;	946	return rc;
933	}	947	}
934		948
		949	/*
		950	* LANMAN and plaintext are less secure and off by default.
		951	* So we make this explicitly be turned on in kconfig (in the
		952	* build) and turned on at runtime (changed from the default)
		953	* in proc/fs/cifs or via mount parm. Unfortunately this is
		954	* needed for old Win (e.g. Win95), some obscure NAS and OS/2
		955	*/
		956	#ifdef CONFIG_CIFS_WEAK_PW_HASH
		957	static void
		958	sess_auth_lanman(struct sess_data *sess_data)
		959	{
		960	int rc = 0;
		961	struct smb_hdr *smb_buf;
		962	SESSION_SETUP_ANDX *pSMB;
		963	char *bcc_ptr;
		964	struct cifs_ses *ses = sess_data->ses;
		965	char lnm_session_key[CIFS_AUTH_RESP_SIZE];
		966	__u16 bytes_remaining;
		967
		968	/* lanman 2 style sessionsetup */
		969	/* wct = 10 */
		970	rc = sess_alloc_buffer(sess_data, 10);
		971	if (rc)
		972	goto out;
		973
		974	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
		975	bcc_ptr = sess_data->iov[2].iov_base;
		976	(void)cifs_ssetup_hdr(ses, pSMB);
		977
		978	pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE;
		979
		980	if (ses->user_name != NULL) {
		981	/* no capabilities flags in old lanman negotiation */
		982	pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
		983
		984	/* Calculate hash with password and copy into bcc_ptr.
		985	* Encryption Key (stored as in cryptkey) gets used if the
		986	* security mode bit in Negotiate Protocol response states
		987	* to use challenge/response method (i.e. Password bit is 1).
		988	*/
		989	rc = calc_lanman_hash(ses->password, ses->server->cryptkey,
		990	ses->server->sec_mode & SECMODE_PW_ENCRYPT ?
		991	true : false, lnm_session_key);
		992	if (rc)
		993	goto out;
		994
		995	memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE);
		996	bcc_ptr += CIFS_AUTH_RESP_SIZE;
		997	} else {
		998	pSMB->old_req.PasswordLength = 0;
		999	}
		1000
		1001	/*
		1002	* can not sign if LANMAN negotiated so no need
		1003	* to calculate signing key? but what if server
		1004	* changed to do higher than lanman dialect and
		1005	* we reconnected would we ever calc signing_key?
		1006	*/
		1007
		1008	cifs_dbg(FYI, "Negotiating LANMAN setting up strings\n");
		1009	/* Unicode not allowed for LANMAN dialects */
		1010	ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
		1011
		1012	sess_data->iov[2].iov_len = (long) bcc_ptr -
1013	(long) sess_data->iov[2].iov_base;
1014
1015	rc = sess_sendreceive(sess_data);
1016	if (rc)
1017	goto out;
1018
1019	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1020	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1021
1022	/* lanman response has a word count of 3 */
1023	if (smb_buf->WordCount != 3) {
1024	rc = -EIO;
1025	cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1026	goto out;
1027	}
1028
1029	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1030	cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1031
1032	ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1033	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1034
1035	bytes_remaining = get_bcc(smb_buf);
1036	bcc_ptr = pByteArea(smb_buf);
1037
1038	/* BB check if Unicode and decode strings */
1039	if (bytes_remaining == 0) {
1040	/* no string area to decode, do nothing */
1041	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1042	/* unicode string area must be word-aligned */
1043	if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1044	++bcc_ptr;
1045	--bytes_remaining;
1046	}
1047	decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1048	sess_data->nls_cp);
1049	} else {
1050	decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1051	sess_data->nls_cp);
1052	}
1053
1054	rc = sess_establish_session(sess_data);
1055	out:
1056	sess_data->result = rc;
1057	sess_data->func = NULL;
1058	sess_free_buffer(sess_data);
1059	}
1060
1061	#endif
1062
1063	static void
1064	sess_auth_ntlm(struct sess_data *sess_data)
1065	{
1066	int rc = 0;
1067	struct smb_hdr *smb_buf;
1068	SESSION_SETUP_ANDX *pSMB;
1069	char *bcc_ptr;
1070	struct cifs_ses *ses = sess_data->ses;
1071	__u32 capabilities;
1072	__u16 bytes_remaining;
1073
1074	/* old style NTLM sessionsetup */
1075	/* wct = 13 */
1076	rc = sess_alloc_buffer(sess_data, 13);
1077	if (rc)
1078	goto out;
1079
1080	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1081	bcc_ptr = sess_data->iov[2].iov_base;
1082	capabilities = cifs_ssetup_hdr(ses, pSMB);
1083
1084	pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1085	if (ses->user_name != NULL) {
1086	pSMB->req_no_secext.CaseInsensitivePasswordLength =
1087	cpu_to_le16(CIFS_AUTH_RESP_SIZE);
1088	pSMB->req_no_secext.CaseSensitivePasswordLength =
1089	cpu_to_le16(CIFS_AUTH_RESP_SIZE);
1090
1091	/* calculate ntlm response and session key */
1092	rc = setup_ntlm_response(ses, sess_data->nls_cp);
1093	if (rc) {
1094	cifs_dbg(VFS, "Error %d during NTLM authentication\n",
1095	rc);
1096	goto out;
1097	}
1098
1099	/* copy ntlm response */
1100	memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1101	CIFS_AUTH_RESP_SIZE);
1102	bcc_ptr += CIFS_AUTH_RESP_SIZE;
1103	memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1104	CIFS_AUTH_RESP_SIZE);
1105	bcc_ptr += CIFS_AUTH_RESP_SIZE;
1106	} else {
1107	pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1108	pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1109	}
1110
1111	if (ses->capabilities & CAP_UNICODE) {
1112	/* unicode strings must be word aligned */
1113	if (sess_data->iov[0].iov_len % 2) {
1114	*bcc_ptr = 0;
1115	bcc_ptr++;
1116	}
1117	unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1118	} else {
1119	ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1120	}
1121
1122
1123	sess_data->iov[2].iov_len = (long) bcc_ptr -
1124	(long) sess_data->iov[2].iov_base;
1125
1126	rc = sess_sendreceive(sess_data);
1127	if (rc)
1128	goto out;
1129
1130	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1131	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1132
1133	if (smb_buf->WordCount != 3) {
1134	rc = -EIO;
1135	cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1136	goto out;
1137	}
1138
1139	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1140	cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1141
1142	ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1143	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1144
1145	bytes_remaining = get_bcc(smb_buf);
1146	bcc_ptr = pByteArea(smb_buf);
1147
1148	/* BB check if Unicode and decode strings */
1149	if (bytes_remaining == 0) {
1150	/* no string area to decode, do nothing */
1151	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1152	/* unicode string area must be word-aligned */
1153	if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1154	++bcc_ptr;
1155	--bytes_remaining;
1156	}
1157	decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1158	sess_data->nls_cp);
1159	} else {
1160	decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1161	sess_data->nls_cp);
1162	}
1163
1164	rc = sess_establish_session(sess_data);
1165	out:
1166	sess_data->result = rc;
1167	sess_data->func = NULL;
1168	sess_free_buffer(sess_data);
1169	kfree(ses->auth_key.response);
1170	ses->auth_key.response = NULL;
1171	}
1172
935	static void	1173	static void
936	sess_auth_ntlmv2(struct sess_data *sess_data)	1174	sess_auth_ntlmv2(struct sess_data *sess_data)
937	{	1175	{
Lines 1436-1441 Link Here
1436	}	1674	}
1437		1675
1438	switch (type) {	1676	switch (type) {
		1677	case LANMAN:
		1678	/* LANMAN and plaintext are less secure and off by default.
		1679	* So we make this explicitly be turned on in kconfig (in the
		1680	* build) and turned on at runtime (changed from the default)
		1681	* in proc/fs/cifs or via mount parm. Unfortunately this is
		1682	* needed for old Win (e.g. Win95), some obscure NAS and OS/2 */
		1683	#ifdef CONFIG_CIFS_WEAK_PW_HASH
		1684	sess_data->func = sess_auth_lanman;
		1685	break;
		1686	#else
		1687	return -EOPNOTSUPP;
		1688	#endif
		1689	case NTLM:
		1690	sess_data->func = sess_auth_ntlm;
		1691	break;
1439	case NTLMv2:	1692	case NTLMv2:
1440	sess_data->func = sess_auth_ntlmv2;	1693	sess_data->func = sess_auth_ntlmv2;
1441	break;	1694	break;

Lines 18-23 Link Here

(-)a/fs/cifs/smbencrypt.c (-1 / +116 lines)
18	#include <linux/string.h>	18	#include <linux/string.h>
19	#include <linux/kernel.h>	19	#include <linux/kernel.h>
20	#include <linux/random.h>	20	#include <linux/random.h>
		21	#include <crypto/des.h>
21	#include "cifs_fs_sb.h"	22	#include "cifs_fs_sb.h"
22	#include "cifs_unicode.h"	23	#include "cifs_unicode.h"
23	#include "cifspdu.h"	24	#include "cifspdu.h"
Lines 38-45 Link Here
38	#define SSVALX(buf,pos,val) (CVAL(buf,pos)=(val)&0xFF,CVAL(buf,pos+1)=(val)>>8)	39	#define SSVALX(buf,pos,val) (CVAL(buf,pos)=(val)&0xFF,CVAL(buf,pos+1)=(val)>>8)
39	#define SSVAL(buf,pos,val) SSVALX((buf),(pos),((__u16)(val)))	40	#define SSVAL(buf,pos,val) SSVALX((buf),(pos),((__u16)(val)))
40		41
41	/* produce a md4 message digest from data of length n bytes */	42	static void
		43	str_to_key(unsigned char str, unsigned char key)
		44	{
		45	int i;
		46
		47	key[0] = str[0] >> 1;
		48	key[1] = ((str[0] & 0x01) << 6) \| (str[1] >> 2);
		49	key[2] = ((str[1] & 0x03) << 5) \| (str[2] >> 3);
		50	key[3] = ((str[2] & 0x07) << 4) \| (str[3] >> 4);
		51	key[4] = ((str[3] & 0x0F) << 3) \| (str[4] >> 5);
		52	key[5] = ((str[4] & 0x1F) << 2) \| (str[5] >> 6);
		53	key[6] = ((str[5] & 0x3F) << 1) \| (str[6] >> 7);
		54	key[7] = str[6] & 0x7F;
		55	for (i = 0; i < 8; i++)
		56	key[i] = (key[i] << 1);
		57	}
		58
		59	static int
		60	smbhash(unsigned char out, const unsigned char in, unsigned char *key)
		61	{
		62	unsigned char key2[8];
		63	struct des_ctx ctx;
		64
		65	str_to_key(key, key2);
		66
		67	if (fips_enabled) {
		68	cifs_dbg(VFS, "FIPS compliance enabled: DES not permitted\n");
		69	return -ENOENT;
		70	}
		71
		72	des_expand_key(&ctx, key2, DES_KEY_SIZE);
		73	des_encrypt(&ctx, out, in);
		74	memzero_explicit(&ctx, sizeof(ctx));
		75
		76	return 0;
		77	}
		78
42	static int	79	static int
		80	E_P16(unsigned char p14, unsigned char p16)
		81	{
		82	int rc;
		83	unsigned char sp8[8] =
		84	{ 0x4b, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24, 0x25 };
		85
		86	rc = smbhash(p16, sp8, p14);
		87	if (rc)
		88	return rc;
		89	rc = smbhash(p16 + 8, sp8, p14 + 7);
		90	return rc;
		91	}
		92
		93	static int
		94	E_P24(unsigned char p21, const unsigned char c8, unsigned char *p24)
		95	{
		96	int rc;
		97
		98	rc = smbhash(p24, c8, p21);
		99	if (rc)
		100	return rc;
		101	rc = smbhash(p24 + 8, c8, p21 + 7);
		102	if (rc)
		103	return rc;
		104	rc = smbhash(p24 + 16, c8, p21 + 14);
		105	return rc;
		106	}
		107
		108	/* produce a md4 message digest from data of length n bytes */
		109	int
43	mdfour(unsigned char md4_hash, unsigned char link_str, int link_len)	110	mdfour(unsigned char md4_hash, unsigned char link_str, int link_len)
44	{	111	{
45	int rc;	112	int rc;
Lines 65-70 Link Here
65	}	132	}
66		133
67	/*	134	/*
		135	This implements the X/Open SMB password encryption
		136	It takes a password, a 8 byte "crypt key" and puts 24 bytes of
		137	encrypted password into p24 */
		138	/* Note that password must be uppercased and null terminated */
		139	int
		140	SMBencrypt(unsigned char passwd, const unsigned char c8, unsigned char *p24)
		141	{
		142	int rc;
		143	unsigned char p14[14], p16[16], p21[21];
		144
		145	memset(p14, '\0', 14);
		146	memset(p16, '\0', 16);
		147	memset(p21, '\0', 21);
		148
		149	memcpy(p14, passwd, 14);
		150	rc = E_P16(p14, p16);
		151	if (rc)
		152	return rc;
		153
		154	memcpy(p21, p16, 16);
		155	rc = E_P24(p21, c8, p24);
		156
		157	return rc;
		158	}
		159
		160	/*
68	* Creates the MD4 Hash of the users password in NT UNICODE.	161	* Creates the MD4 Hash of the users password in NT UNICODE.
69	*/	162	*/
70		163
Lines 89-91 Link Here
89		182
90	return rc;	183	return rc;
91	}	184	}
		185
		186	/* Does the NT MD4 hash then des encryption. */
		187	int
		188	SMBNTencrypt(unsigned char passwd, unsigned char c8, unsigned char *p24,
		189	const struct nls_table *codepage)
		190	{
		191	int rc;
		192	unsigned char p16[16], p21[21];
		193
		194	memset(p16, '\0', 16);
		195	memset(p21, '\0', 21);
		196
		197	rc = E_md4hash(passwd, p16, codepage);
		198	if (rc) {
		199	cifs_dbg(FYI, "%s Can't generate NT hash, error: %d\n",
		200	__func__, rc);
		201	return rc;
		202	}
		203	memcpy(p21, p16, 16);
		204	rc = E_P24(p21, c8, p24);
		205	return rc;
		206	}