fs/cifs: correctly to anonymous authentication for the LANMAN authentication

commit fa8f3a354bb775ec586e4475bcb07f7dece97e0c upstream.

Only server which map unknown users to guest will allow
access using a non-null LMChallengeResponse.

For Samba it's the "map to guest = bad user" option.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11913

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
[bwh: Backported to 3.2:
 - Adjust context, indentation
 - Keep ses->flags assignment out of the new if-statement]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index e8bc77d..587037f 100644 (file)
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -655,23 +655,25 @@ ssetup_ntlmssp_authenticate:
 
                pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE;
 
-               /* no capabilities flags in old lanman negotiation */
-
-               pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
-
-               /* Calculate hash with password and copy into bcc_ptr.
-                * Encryption Key (stored as in cryptkey) gets used if the
-                * security mode bit in Negottiate Protocol response states
-                * to use challenge/response method (i.e. Password bit is 1).
-                */
-
-               rc = calc_lanman_hash(ses->password, ses->server->cryptkey,
-                                ses->server->sec_mode & SECMODE_PW_ENCRYPT ?
-                                       true : false, lnm_session_key);
-
+               if (ses->user_name != NULL) {
+                       /* no capabilities flags in old lanman negotiation */
+                       pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
+
+                       /* Calculate hash with password and copy into bcc_ptr.
+                        * Encryption Key (stored as in cryptkey) gets used if the
+                        * security mode bit in Negottiate Protocol response states
+                        * to use challenge/response method (i.e. Password bit is 1).
+                        */
+                       rc = calc_lanman_hash(ses->password, ses->server->cryptkey,
+                                             ses->server->sec_mode & SECMODE_PW_ENCRYPT ?
+                                             true : false, lnm_session_key);
+
+                       memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE);
+                       bcc_ptr += CIFS_AUTH_RESP_SIZE;
+               } else {
+                       pSMB->old_req.PasswordLength = 0;
+               }
                ses->flags |= CIFS_SES_LANMAN;
-               memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE);
-               bcc_ptr += CIFS_AUTH_RESP_SIZE;
 
                /* can not sign if LANMAN negotiated so no need
                to calculate signing key? but what if server