Re: [PATCH 1/2] ksmbd: pass through NTLM authentication to a domain controller

[Namjae Jeon]

> @@ -225,6 +284,14 @@ int ksmbd_decode_ntlmssp_auth_blob(struct authenticate_message *authblob,
>             nt_len < CIFS_ENCPWD_SIZE)
>                 return -EINVAL;
>
> +       if (test_user_flag(sess->user, KSMBD_USER_FLAG_PASSTHROUGH)) {
> +               ret = ksmbd_auth_ntlm_passthrough(conn, authblob, blob_len,
> +                                                 sess_key);
> +               if (ret)
> +                       return ret;
> +               goto key_exchange;
ksmbd_auth_ntlmv2() returns -EOPNOTSUPP when fips_enabled is set, but
this branch bypasses that check and proceeds with authentication.
Delegating response verification to userspace and the DC does not
change the fact that this is an NTLMv2 flow, and KEY_XCH can still
reach the kernel’s ARC4 key-exchange path. Could we keep pass-through
authentication disabled when fips_enabled is set, before taking this
branch?

> +       }
> +
>         /* TODO : use domain name that imported from configuration file */
>         domain_name = smb_strndup_from_utf16((const char *)authblob + dn_off,
>                                              dn_len, true, conn->local_nls);