cifs: dereferencing first then checking

[net-next-2.6.git] / fs / cifs / sess.c

diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index b2934683bd0833835a31c99bba43a4bae9cc53c8..7b01d3f6eed6e76cff6317f16c43b366c1af595d 100644 (file)
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -399,23 +399,22 @@ static int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
                return -EINVAL;
        }
 
-       memcpy(ses->cryptKey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
+       memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
        /* BB we could decode pblob->NegotiateFlags; some may be useful */
        /* In particular we can examine sign flags */
        /* BB spec says that if AvId field of MsvAvTimestamp is populated then
                we must set the MIC field of the AUTHENTICATE_MESSAGE */
-
+       ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags);
        tioffset = cpu_to_le16(pblob->TargetInfoArray.BufferOffset);
        tilen = cpu_to_le16(pblob->TargetInfoArray.Length);
-       ses->tilen = tilen;
-       if (ses->tilen) {
-               ses->tiblob = kmalloc(tilen, GFP_KERNEL);
-               if (!ses->tiblob) {
+       if (tilen) {
+               ses->auth_key.response = kmalloc(tilen, GFP_KERNEL);
+               if (!ses->auth_key.response) {
                        cERROR(1, "Challenge target info allocation failure");
-                       ses->tilen = 0;
                        return -ENOMEM;
                }
-               memcpy(ses->tiblob,  bcc_ptr + tioffset, ses->tilen);
+               memcpy(ses->auth_key.response, bcc_ptr + tioffset, tilen);
+               ses->auth_key.len = tilen;
        }
 
        return 0;
@@ -440,10 +439,12 @@ static void build_ntlmssp_negotiate_blob(unsigned char *pbuffer,
                NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
                NTLMSSP_NEGOTIATE_NTLM;
        if (ses->server->secMode &
-          (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
+                       (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) {
                flags |= NTLMSSP_NEGOTIATE_SIGN;
-       if (ses->server->secMode & SECMODE_SIGN_REQUIRED)
-               flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
+               if (!ses->server->session_estab)
+                       flags |= NTLMSSP_NEGOTIATE_KEY_XCH |
+                               NTLMSSP_NEGOTIATE_EXTENDED_SEC;
+       }
 
        sec_blob->NegotiateFlags |= cpu_to_le32(flags);
 
@@ -543,9 +544,19 @@ static int build_ntlmssp_auth_blob(unsigned char *pbuffer,
        sec_blob->WorkstationName.MaximumLength = 0;
        tmp += 2;
 
-       sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer);
-       sec_blob->SessionKey.Length = 0;
-       sec_blob->SessionKey.MaximumLength = 0;
+       if ((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
+                       !calc_seckey(ses)) {
+               memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
+               sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer);
+               sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
+               sec_blob->SessionKey.MaximumLength =
+                               cpu_to_le16(CIFS_CPHTXT_SIZE);
+               tmp += CIFS_CPHTXT_SIZE;
+       } else {
+               sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer);
+               sec_blob->SessionKey.Length = 0;
+               sec_blob->SessionKey.MaximumLength = 0;
+       }
 
 setup_ntlmv2_ret:
        *buflen = tmp - pbuffer;
@@ -589,8 +600,16 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses,
                return -EINVAL;
 
        type = ses->server->secType;
-
        cFYI(1, "sess setup type %d", type);
+       if (type == RawNTLMSSP) {
+               /* if memory allocation is successful, caller of this function
+                * frees it.
+                */
+               ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
+               if (!ses->ntlmssp)
+                       return -ENOMEM;
+       }
+
 ssetup_ntlmssp_authenticate:
        if (phase == NtLmChallenge)
                phase = NtLmAuthenticate; /* if ntlmssp, now final phase */
@@ -655,10 +674,14 @@ ssetup_ntlmssp_authenticate:
                /* no capabilities flags in old lanman negotiation */
 
                pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
-               /* BB calculate hash with password */
-               /* and copy into bcc */
 
-               calc_lanman_hash(ses->password, ses->cryptKey,
+               /* Calculate hash with password and copy into bcc_ptr.
+                * Encryption Key (stored as in cryptkey) gets used if the
+                * security mode bit in Negottiate Protocol response states
+                * to use challenge/response method (i.e. Password bit is 1).
+                */
+
+               calc_lanman_hash(ses->password, ses->server->cryptkey,
                                 ses->server->secMode & SECMODE_PW_ENCRYPT ?
                                        true : false, lnm_session_key);
 
@@ -726,7 +749,7 @@ ssetup_ntlmssp_authenticate:
                 * assigned, tilen is 0 otherwise.
                 */
                pSMB->req_no_secext.CaseSensitivePasswordLength =
-                       cpu_to_le16(ses->auth_key.len);
+                       cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
 
                if (ses->capabilities & CAP_UNICODE) {
                        if (iov[0].iov_len % 2) {