Commit 0124cc45 authored by Jeff Layton's avatar Jeff Layton Committed by Steve French
Browse files

cifs: store the real expected sequence number in the mid 



Currently, the signing routines take a pointer to a place to store the
expected sequence number for the mid response. It then stores a value
that's one below what that sequence number should be, and then adds one
to it when verifying the signature on the response.

Increment the sequence number before storing the value in the mid, and
eliminate the "+1" when checking the signature.

Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Signed-off-by: default avatarSteve French <sfrench@us.ibm.com>
Signed-off-by: default avatarSteve French <smfrench@gmail.com>
parent ad313cb8

fs/cifs/cifsencrypt.c

+2 −2
Original line number Diff line number Diff line
@@ -135,8 +135,8 @@ int cifs_sign_rqst(struct smb_rqst *rqst, struct TCP_Server_Info *server, 
				cpu_to_le32(server->sequence_number);

	cifs_pdu->Signature.Sequence.Reserved = 0;



	*pexpected_response_sequence_number = server->sequence_number++;

	server->sequence_number++;

	*pexpected_response_sequence_number = ++server->sequence_number;

	++server->sequence_number;



	rc = cifs_calc_signature(rqst, server, smb_signature);

	if (rc)

fs/cifs/cifssmb.c

+1 −1
Original line number Diff line number Diff line
@@ -1545,7 +1545,7 @@ cifs_readv_callback(struct mid_q_entry *mid) 
			int rc = 0;



			rc = cifs_verify_signature(&rqst, server,

						  mid->sequence_number + 1);

						  mid->sequence_number);

			if (rc)

				cifs_dbg(VFS, "SMB signature verification returned error = %d\n",

					 rc);

fs/cifs/transport.c

+1 −1
Original line number Diff line number Diff line
@@ -622,7 +622,7 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server, 
		iov.iov_len = len;

		/* FIXME: add code to kill session */

		rc = cifs_verify_signature(&rqst, server,

					   mid->sequence_number + 1);

					   mid->sequence_number);

		if (rc)

			cifs_dbg(VFS, "SMB signature verification returned error = %d\n",

				 rc);

CRA Git | Maintained and supported by SUSTech CRA and CCSE