ncpfs: Verify packet signatures on replies.

fs/ncpfs/ncpsign_kernel.c

@@ -108,5 +108,21 @@ void __sign_packet(struct ncp_server *server, const char *packet, size_t size, _
 	memcpy(sign_buff, server->sign_last, 8);
 }
 
+int sign_verify_reply(struct ncp_server *server, const char *packet, size_t size, __u32 totalsize, const void *sign_buff) {
+	unsigned char data[64];
+	unsigned char hash[16];
+
+	memcpy(data, server->sign_root, 8);
+	*(__u32*)(data + 8) = totalsize;
+	if (size < 52) {
+		memcpy(data + 12, packet, size);
+		memset(data + 12 + size, 0, 52 - size);
+	} else {
+		memcpy(data + 12, packet, 52);
+	}
+	nwsign(server->sign_last, data, hash);
+	return memcmp(sign_buff, hash, 8);
+}
+
 #endif	/* CONFIG_NCPFS_PACKET_SIGNING */
 

fs/ncpfs/ncpsign_kernel.h

@@ -12,6 +12,7 @@
 
 #ifdef CONFIG_NCPFS_PACKET_SIGNING
 void __sign_packet(struct ncp_server *server, const char *data, size_t size, __u32 totalsize, void *sign_buff);
+int sign_verify_reply(struct ncp_server *server, const char *data, size_t size, __u32 totalsize, const void *sign_buff);
 #endif
 
 static inline size_t sign_packet(struct ncp_server *server, const char *data, size_t size, __u32 totalsize, void *sign_buff) {

fs/ncpfs/sock.c

@@ -391,7 +391,14 @@ static void __ncpdgram_rcv_proc(void *s) {
 						if (result < 8 + 8) {
 							result = -EIO;
 						} else {
+							unsigned int hdrl;
+							
 							result -= 8;
+							hdrl = sock->sk->family == AF_INET ? 8 : 6;
+							if (sign_verify_reply(server, ((char*)req->reply_buf) + hdrl, result - hdrl, cpu_to_le32(result), ((char*)req->reply_buf) + result)) {
+								printk(KERN_INFO "ncpfs: Signature violation\n");
+								result = -EIO;
+							}
 						}
 					}
 #endif
@@ -593,6 +600,15 @@ skipdata:;
 						return -EIO;
 					}
 				}
+#ifdef CONFIG_NCPFS_PACKET_SIGNING				
+				if (server->sign_active && req->tx_type != NCP_DEALLOC_SLOT_REQUEST) {
+					if (sign_verify_reply(server, (unsigned char*)(req->reply_buf) + 6, req->datalen - 6, cpu_to_be32(req->datalen + 16), &server->rcv.buf.type)) {
+						printk(KERN_ERR "ncpfs: tcp: Signature violation\n");
+						__ncp_abort_request(server, req, -EIO);
+						return -EIO;
+					}
+				}
+#endif				
 				ncp_finish_request(req, req->datalen);
 			nextreq:;
 				__ncp_next_request(server);