Print this page 
NEX-16824 SMB client connection setup rework
NEX-17232 SMB client reconnect failures
Reviewed by: Evan Layton <evan.layton@nexenta.com>
Reviewed by: Matt Barden <matt.barden@nexenta.com>
and: (improve debug)
Split Close
Expand all
Collapse all
          --- old/usr/src/lib/libsmbfs/smb/krb5ssp.c
          +++ new/usr/src/lib/libsmbfs/smb/krb5ssp.c
↓ open down ↓ 24 lines elided ↑ open up ↑ 
  25   25   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26   26   * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27   27   * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28   28   * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29   29   * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30   30   * SUCH DAMAGE.
  31   31   */
  32   32  
  33   33  /*
  34   34   * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
       35 + * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
  35   36   */
  36   37  
  37   38  /*
  38   39   * Kerberos V Security Support Provider
  39   40   *
  40   41   * Based on code previously in ctx.c (from Boris Popov?)
  41   42   * but then mostly rewritten at Sun.
  42   43   */
  43   44  
  44   45  #include <errno.h>
↓ open down ↓ 216 lines elided ↑ open up ↑ 
 261  262          if ((err = krb5ssp_get_tkt(ss, prin, &tkt, &tktlen)) != 0)
 262  263                  goto out;
 263  264          if ((err = krb5ssp_tkt2gtok(tkt, tktlen, &gtok, &gtoklen)) != 0)
 264  265                  goto out;
 265  266  
 266  267          if ((err = mb_init_sz(out_mb, gtoklen)) != 0)
 267  268                  goto out;
 268  269          if ((err = mb_put_mem(out_mb, gtok, gtoklen, MB_MSYSTEM)) != 0)
 269  270                  goto out;
 270  271  
 271      -        if (ctx->ct_vcflags & SMBV_WILL_SIGN)
 272      -                ctx->ct_hflags2 |= SMB_FLAGS2_SECURITY_SIGNATURE;
 273      -
 274  272  out:
 275  273          if (gtok)
 276  274                  free(gtok);
 277  275          if (tkt)
 278  276                  free(tkt);
 279  277  
 280  278          return (err);
 281  279  }
 282  280  
 283  281  /*
↓ open down ↓ 92 lines elided ↑ open up ↑ 
 376  374   *
 377  375   * Called after successful authentication.
 378  376   * Setup the MAC key for signing.
 379  377   */
 380  378  int
 381  379  krb5ssp_final(struct ssp_ctx *sp)
 382  380  {
 383  381          struct smb_ctx *ctx = sp->smb_ctx;
 384  382          krb5ssp_state_t *ss = sp->sp_private;
 385  383          krb5_keyblock   *ssn_key = NULL;
 386      -        int err, len;
      384 +        int err;
 387  385  
 388  386          /*
 389  387           * Save the session key, used for SMB signing
 390  388           * and possibly other consumers (RPC).
 391  389           */
 392  390          err = krb5_auth_con_getlocalsubkey(
 393  391              ss->ss_krb5ctx, ss->ss_auth, &ssn_key);
 394  392          if (err != 0) {
 395  393                  DPRINT("_getlocalsubkey, err=0x%x (%s)",
 396  394                      err, error_message(err));
 397  395                  if (err <= 0 || err > ESTALE)
 398  396                          err = EAUTH;
 399  397                  goto out;
 400  398          }
 401      -        memset(ctx->ct_ssn_key, 0, SMBIOC_HASH_SZ);
 402      -        if ((len = ssn_key->length) > SMBIOC_HASH_SZ)
 403      -                len = SMBIOC_HASH_SZ;
 404      -        memcpy(ctx->ct_ssn_key, ssn_key->contents, len);
 405  399  
      400 +        /* Sanity check the length */
      401 +        if (ssn_key->length > 1024) {
      402 +                DPRINT("session key too long");
      403 +                err = EAUTH;
      404 +                goto out;
      405 +        }
      406 +
 406  407          /*
 407      -         * Set the MAC key on the first successful auth.
      408 +         * Update/save the session key.
 408  409           */
 409      -        if ((ctx->ct_hflags2 & SMB_FLAGS2_SECURITY_SIGNATURE) &&
 410      -            (ctx->ct_mackey == NULL)) {
 411      -                ctx->ct_mackeylen = ssn_key->length;
 412      -                ctx->ct_mackey = malloc(ctx->ct_mackeylen);
 413      -                if (ctx->ct_mackey == NULL) {
 414      -                        ctx->ct_mackeylen = 0;
 415      -                        err = ENOMEM;
 416      -                        goto out;
 417      -                }
 418      -                memcpy(ctx->ct_mackey, ssn_key->contents,
 419      -                    ctx->ct_mackeylen);
 420      -                /*
 421      -                 * Apparently, the server used seq. no. zero
 422      -                 * for our previous message, so next is two.
 423      -                 */
 424      -                ctx->ct_mac_seqno = 2;
      410 +        if (ctx->ct_ssnkey_buf != NULL) {
      411 +                free(ctx->ct_ssnkey_buf);
      412 +                ctx->ct_ssnkey_buf = NULL;
 425  413          }
      414 +        ctx->ct_ssnkey_buf = malloc(ssn_key->length);
      415 +        if (ctx->ct_ssnkey_buf == NULL) {
      416 +                err = ENOMEM;
      417 +                goto out;
      418 +        }
      419 +        ctx->ct_ssnkey_len = ssn_key->length;
      420 +        memcpy(ctx->ct_ssnkey_buf, ssn_key->contents, ctx->ct_ssnkey_len);
 426  421          err = 0;
 427  422  
 428  423  out:
 429      -        if (ssn_key)
      424 +        if (ssn_key != NULL)
 430  425                  krb5_free_keyblock(ss->ss_krb5ctx, ssn_key);
 431  426  
 432  427          return (err);
 433  428  }
 434  429  
 435  430  /*
 436  431   * krb5ssp_next_token
 437  432   *
 438  433   * See ssp.c: ssp_ctx_next_token
 439  434   */
↓ open down ↓ 123 lines elided ↑ open up ↑ 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX