move sectype to the cifs_ses instead of TCP_Server_Info (3f618223) · Commits · 戴 / test

fs/cifs/cifsencrypt.c

+2 −2

Original line number	Original line	Diff line number	Diff line
	@@ -535,7 +535,7 @@ CalcNTLMv2_response(const struct cifs_ses ses, char ntlmv2_hash)
	return rc;		return rc;
	}		}

	if (ses->server->secType == RawNTLMSSP)		if (ses->server->negflavor == CIFS_NEGFLAVOR_EXTENDED)
	memcpy(ses->auth_key.response + offset,		memcpy(ses->auth_key.response + offset,
	ses->ntlmssp->cryptkey, CIFS_SERVER_CHALLENGE_SIZE);		ses->ntlmssp->cryptkey, CIFS_SERVER_CHALLENGE_SIZE);
	else		else
	@@ -567,7 +567,7 @@ setup_ntlmv2_rsp(struct cifs_ses ses, const struct nls_table nls_cp)
	char ntlmv2_hash[16];		char ntlmv2_hash[16];
	unsigned char tiblob = NULL; / target info blob */		unsigned char tiblob = NULL; / target info blob */

	if (ses->server->secType == RawNTLMSSP) {		if (ses->server->negflavor == CIFS_NEGFLAVOR_EXTENDED) {
	if (!ses->domainName) {		if (!ses->domainName) {
	rc = find_domain_name(ses, nls_cp);		rc = find_domain_name(ses, nls_cp);
	if (rc) {		if (rc) {

fs/cifs/cifsglob.h

+0 −2

Original line number	Original line	Diff line number	Diff line
	@@ -401,7 +401,6 @@ struct smb_vol {
	kgid_t backupgid;		kgid_t backupgid;
	umode_t file_mode;		umode_t file_mode;
	umode_t dir_mode;		umode_t dir_mode;
	unsigned secFlg;
	enum securityEnum sectype; /* sectype requested via mnt opts */		enum securityEnum sectype; /* sectype requested via mnt opts */
	bool sign; /* was signing requested via mnt opts? */		bool sign; /* was signing requested via mnt opts? */
	bool retry:1;		bool retry:1;
	@@ -519,7 +518,6 @@ struct TCP_Server_Info {
	bool echoes:1; /* enable echoes */		bool echoes:1; /* enable echoes */
	#endif		#endif
	u16 dialect; /* dialect index that server chose */		u16 dialect; /* dialect index that server chose */
	enum securityEnum secType;
	bool oplocks:1; /* enable oplocks */		bool oplocks:1; /* enable oplocks */
	unsigned int maxReq; /* Clients should submit no more */		unsigned int maxReq; /* Clients should submit no more */
	/* than maxReq distinct unanswered SMBs to the server when using */		/* than maxReq distinct unanswered SMBs to the server when using */

fs/cifs/cifsproto.h

+2 −0

Original line number	Original line	Diff line number	Diff line
	@@ -118,6 +118,8 @@ extern void header_assemble(struct smb_hdr , char / command */ ,
	extern int small_smb_init_no_tc(const int smb_cmd, const int wct,		extern int small_smb_init_no_tc(const int smb_cmd, const int wct,
	struct cifs_ses *ses,		struct cifs_ses *ses,
	void **request_buf);		void **request_buf);
			extern enum securityEnum select_sectype(struct TCP_Server_Info *server,
			enum securityEnum requested);
	extern int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,		extern int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
	const struct nls_table *nls_cp);		const struct nls_table *nls_cp);
	extern struct timespec cifs_NTtimeToUnix(__le64 utc_nanoseconds_since_1601);		extern struct timespec cifs_NTtimeToUnix(__le64 utc_nanoseconds_since_1601);

fs/cifs/cifssmb.c

+20 −72

Original line number	Original line	Diff line number	Diff line
	@@ -368,11 +368,12 @@ vt2_err:
	}		}

	static int		static int
	decode_ext_sec_blob(struct TCP_Server_Info server, NEGOTIATE_RSP pSMBr)		decode_ext_sec_blob(struct cifs_ses ses, NEGOTIATE_RSP pSMBr)
	{		{
	int rc = 0;		int rc = 0;
	u16 count;		u16 count;
	char *guid = pSMBr->u.extended_response.GUID;		char *guid = pSMBr->u.extended_response.GUID;
			struct TCP_Server_Info *server = ses->server;

	count = get_bcc(&pSMBr->hdr);		count = get_bcc(&pSMBr->hdr);
	if (count < SMB1_CLIENT_GUID_SIZE)		if (count < SMB1_CLIENT_GUID_SIZE)
	@@ -391,27 +392,13 @@ decode_ext_sec_blob(struct TCP_Server_Info server, NEGOTIATE_RSP pSMBr)
	}		}

	if (count == SMB1_CLIENT_GUID_SIZE) {		if (count == SMB1_CLIENT_GUID_SIZE) {
	server->secType = RawNTLMSSP;		server->sec_ntlmssp = true;
	} else {		} else {
	count -= SMB1_CLIENT_GUID_SIZE;		count -= SMB1_CLIENT_GUID_SIZE;
	rc = decode_negTokenInit(		rc = decode_negTokenInit(
	pSMBr->u.extended_response.SecurityBlob, count, server);		pSMBr->u.extended_response.SecurityBlob, count, server);
	if (rc != 1)		if (rc != 1)
	return -EINVAL;		return -EINVAL;

	/* Make sure server supports what we want to use */
	switch(server->secType) {
	case Kerberos:
	if (!server->sec_kerberos && !server->sec_mskerberos)
	return -EOPNOTSUPP;
	break;
	case RawNTLMSSP:
	if (!server->sec_ntlmssp)
	return -EOPNOTSUPP;
	break;
	default:
	return -EOPNOTSUPP;
	}
	}		}

	return 0;		return 0;
	@@ -462,8 +449,7 @@ cifs_enable_signing(struct TCP_Server_Info *server, bool mnt_sign_required)

	#ifdef CONFIG_CIFS_WEAK_PW_HASH		#ifdef CONFIG_CIFS_WEAK_PW_HASH
	static int		static int
	decode_lanman_negprot_rsp(struct TCP_Server_Info server, NEGOTIATE_RSP pSMBr,		decode_lanman_negprot_rsp(struct TCP_Server_Info server, NEGOTIATE_RSP pSMBr)
	unsigned int secFlags)
	{		{
	__s16 tmp;		__s16 tmp;
	struct lanman_neg_rsp rsp = (struct lanman_neg_rsp )pSMBr;		struct lanman_neg_rsp rsp = (struct lanman_neg_rsp )pSMBr;
	@@ -471,12 +457,6 @@ decode_lanman_negprot_rsp(struct TCP_Server_Info server, NEGOTIATE_RSP pSMBr,
	if (server->dialect != LANMAN_PROT && server->dialect != LANMAN2_PROT)		if (server->dialect != LANMAN_PROT && server->dialect != LANMAN2_PROT)
	return -EOPNOTSUPP;		return -EOPNOTSUPP;

	if ((secFlags & CIFSSEC_MAY_LANMAN) \|\| (secFlags & CIFSSEC_MAY_PLNTXT))
	server->secType = LANMAN;
	else {
	cifs_dbg(VFS, "mount failed weak security disabled in /proc/fs/cifs/SecurityFlags\n");
	return -EOPNOTSUPP;
	}
	server->sec_mode = le16_to_cpu(rsp->SecurityMode);		server->sec_mode = le16_to_cpu(rsp->SecurityMode);
	server->maxReq = min_t(unsigned int,		server->maxReq = min_t(unsigned int,
	le16_to_cpu(rsp->MaxMpxCount),		le16_to_cpu(rsp->MaxMpxCount),
	@@ -542,8 +522,7 @@ decode_lanman_negprot_rsp(struct TCP_Server_Info server, NEGOTIATE_RSP pSMBr,
	}		}
	#else		#else
	static inline int		static inline int
	decode_lanman_negprot_rsp(struct TCP_Server_Info server, NEGOTIATE_RSP pSMBr,		decode_lanman_negprot_rsp(struct TCP_Server_Info server, NEGOTIATE_RSP pSMBr)
	unsigned int secFlags)
	{		{
	cifs_dbg(VFS, "mount failed, cifs module not built with CIFS_WEAK_PW_HASH support\n");		cifs_dbg(VFS, "mount failed, cifs module not built with CIFS_WEAK_PW_HASH support\n");
	return -EOPNOTSUPP;		return -EOPNOTSUPP;
	@@ -551,18 +530,21 @@ decode_lanman_negprot_rsp(struct TCP_Server_Info server, NEGOTIATE_RSP pSMBr,
	#endif		#endif

	static bool		static bool
	should_set_ext_sec_flag(unsigned int secFlags)		should_set_ext_sec_flag(enum securityEnum sectype)
	{		{
	if ((secFlags & CIFSSEC_MUST_KRB5) == CIFSSEC_MUST_KRB5)		switch (sectype) {
	return true;		case RawNTLMSSP:
	else if ((secFlags & CIFSSEC_AUTH_MASK) == CIFSSEC_MAY_KRB5)		case Kerberos:
	return true;
	else if ((secFlags & CIFSSEC_MUST_NTLMSSP) == CIFSSEC_MUST_NTLMSSP)
	return true;		return true;
	else if ((secFlags & CIFSSEC_AUTH_MASK) == CIFSSEC_MAY_NTLMSSP)		case Unspecified:
			if (global_secflags &
			(CIFSSEC_MAY_KRB5 \| CIFSSEC_MAY_NTLMSSP))
	return true;		return true;
			/* Fallthrough */
			default:
	return false;		return false;
	}		}
			}

	int		int
	CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses)		CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses)
	@@ -574,7 +556,6 @@ CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses)
	int i;		int i;
	struct TCP_Server_Info *server = ses->server;		struct TCP_Server_Info *server = ses->server;
	u16 count;		u16 count;
	unsigned int secFlags;

	if (!server) {		if (!server) {
	WARN(1, "%s: server is NULL!\n", __func__);		WARN(1, "%s: server is NULL!\n", __func__);
	@@ -586,18 +567,10 @@ CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses)
	if (rc)		if (rc)
	return rc;		return rc;

	/* if any of auth flags (ie not sign or seal) are overriden use them */
	if (ses->overrideSecFlg & (~(CIFSSEC_MUST_SIGN \| CIFSSEC_MUST_SEAL)))
	secFlags = ses->overrideSecFlg; /* BB FIXME fix sign flags? */
	else /* if override flags set only sign/seal OR them with global auth */
	secFlags = global_secflags \| ses->overrideSecFlg;

	cifs_dbg(FYI, "secFlags 0x%x\n", secFlags);

	pSMB->hdr.Mid = get_next_mid(server);		pSMB->hdr.Mid = get_next_mid(server);
	pSMB->hdr.Flags2 \|= (SMBFLG2_UNICODE \| SMBFLG2_ERR_STATUS);		pSMB->hdr.Flags2 \|= (SMBFLG2_UNICODE \| SMBFLG2_ERR_STATUS);

	if (should_set_ext_sec_flag(secFlags)) {		if (should_set_ext_sec_flag(ses->sectype)) {
	cifs_dbg(FYI, "Requesting extended security.");		cifs_dbg(FYI, "Requesting extended security.");
	pSMB->hdr.Flags2 \|= SMBFLG2_EXT_SEC;		pSMB->hdr.Flags2 \|= SMBFLG2_EXT_SEC;
	}		}
	@@ -627,7 +600,7 @@ CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses)
	goto neg_err_exit;		goto neg_err_exit;
	} else if (pSMBr->hdr.WordCount == 13) {		} else if (pSMBr->hdr.WordCount == 13) {
	server->negflavor = CIFS_NEGFLAVOR_LANMAN;		server->negflavor = CIFS_NEGFLAVOR_LANMAN;
	rc = decode_lanman_negprot_rsp(server, pSMBr, secFlags);		rc = decode_lanman_negprot_rsp(server, pSMBr);
	goto signing_check;		goto signing_check;
	} else if (pSMBr->hdr.WordCount != 17) {		} else if (pSMBr->hdr.WordCount != 17) {
	/* unknown wct */		/* unknown wct */
	@@ -640,31 +613,6 @@ CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses)
	if ((server->sec_mode & SECMODE_USER) == 0)		if ((server->sec_mode & SECMODE_USER) == 0)
	cifs_dbg(FYI, "share mode security\n");		cifs_dbg(FYI, "share mode security\n");

	if ((server->sec_mode & SECMODE_PW_ENCRYPT) == 0)
	#ifdef CONFIG_CIFS_WEAK_PW_HASH
	if ((secFlags & CIFSSEC_MAY_PLNTXT) == 0)
	#endif /* CIFS_WEAK_PW_HASH */
	cifs_dbg(VFS, "Server requests plain text password but client support disabled\n");

	if ((secFlags & CIFSSEC_MUST_NTLMV2) == CIFSSEC_MUST_NTLMV2)
	server->secType = NTLMv2;
	else if (secFlags & CIFSSEC_MAY_NTLM)
	server->secType = NTLM;
	else if (secFlags & CIFSSEC_MAY_NTLMV2)
	server->secType = NTLMv2;
	else if (secFlags & CIFSSEC_MAY_KRB5)
	server->secType = Kerberos;
	else if (secFlags & CIFSSEC_MAY_NTLMSSP)
	server->secType = RawNTLMSSP;
	else if (secFlags & CIFSSEC_MAY_LANMAN)
	server->secType = LANMAN;
	else {
	rc = -EOPNOTSUPP;
	cifs_dbg(VFS, "Invalid security type\n");
	goto neg_err_exit;
	}
	/* else ... any others ...? */

	/* one byte, so no need to convert this or EncryptionKeyLen from		/* one byte, so no need to convert this or EncryptionKeyLen from
	little endian */		little endian */
	server->maxReq = min_t(unsigned int, le16_to_cpu(pSMBr->MaxMpxCount),		server->maxReq = min_t(unsigned int, le16_to_cpu(pSMBr->MaxMpxCount),
	@@ -686,7 +634,7 @@ CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses)
	server->capabilities & CAP_EXTENDED_SECURITY) &&		server->capabilities & CAP_EXTENDED_SECURITY) &&
	(pSMBr->EncryptionKeyLength == 0)) {		(pSMBr->EncryptionKeyLength == 0)) {
	server->negflavor = CIFS_NEGFLAVOR_EXTENDED;		server->negflavor = CIFS_NEGFLAVOR_EXTENDED;
	rc = decode_ext_sec_blob(server, pSMBr);		rc = decode_ext_sec_blob(ses, pSMBr);
	} else if (server->sec_mode & SECMODE_PW_ENCRYPT) {		} else if (server->sec_mode & SECMODE_PW_ENCRYPT) {
	rc = -EIO; /* no crypt key only if plain text pwd */		rc = -EIO; /* no crypt key only if plain text pwd */
	} else {		} else {

fs/cifs/connect.c

+33 −84

Original line number	Original line	Diff line number	Diff line
	@@ -1033,56 +1033,40 @@ static int cifs_parse_security_flavors(char *value,
	vol->sign = false;		vol->sign = false;

	switch (match_token(value, cifs_secflavor_tokens, args)) {		switch (match_token(value, cifs_secflavor_tokens, args)) {
			case Opt_sec_krb5p:
			cifs_dbg(VFS, "sec=krb5p is not supported!\n");
			return 1;
			case Opt_sec_krb5i:
			vol->sign = true;
			/* Fallthrough */
	case Opt_sec_krb5:		case Opt_sec_krb5:
	vol->sectype = Kerberos;		vol->sectype = Kerberos;
	vol->secFlg \|= CIFSSEC_MAY_KRB5 \| CIFSSEC_MAY_SIGN;
	break;		break;
	case Opt_sec_krb5i:		case Opt_sec_ntlmsspi:
	vol->sectype = Kerberos;
	vol->sign = true;		vol->sign = true;
	vol->secFlg \|= CIFSSEC_MAY_KRB5 \| CIFSSEC_MUST_SIGN;		/* Fallthrough */
	break;
	case Opt_sec_krb5p:
	/* vol->secFlg \|= CIFSSEC_MUST_SEAL \| CIFSSEC_MAY_KRB5; */
	cifs_dbg(VFS, "Krb5 cifs privacy not supported\n");
	break;
	case Opt_sec_ntlmssp:		case Opt_sec_ntlmssp:
	vol->sectype = RawNTLMSSP;		vol->sectype = RawNTLMSSP;
	vol->secFlg \|= CIFSSEC_MAY_NTLMSSP;
	break;		break;
	case Opt_sec_ntlmsspi:		case Opt_sec_ntlmi:
	vol->sectype = RawNTLMSSP;
	vol->sign = true;		vol->sign = true;
	vol->secFlg \|= CIFSSEC_MAY_NTLMSSP \| CIFSSEC_MUST_SIGN;		/* Fallthrough */
	break;
	case Opt_ntlm:		case Opt_ntlm:
	/* ntlm is default so can be turned off too */
	vol->sectype = NTLM;		vol->sectype = NTLM;
	vol->secFlg \|= CIFSSEC_MAY_NTLM;
	break;		break;
	case Opt_sec_ntlmi:		case Opt_sec_ntlmv2i:
	vol->sectype = NTLM;
	vol->sign = true;		vol->sign = true;
	vol->secFlg \|= CIFSSEC_MAY_NTLM \| CIFSSEC_MUST_SIGN;		/* Fallthrough */
	break;
	case Opt_sec_ntlmv2:		case Opt_sec_ntlmv2:
	vol->sectype = NTLMv2;		vol->sectype = NTLMv2;
	vol->secFlg \|= CIFSSEC_MAY_NTLMV2;
	break;
	case Opt_sec_ntlmv2i:
	vol->sectype = NTLMv2;
	vol->sign = true;
	vol->secFlg \|= CIFSSEC_MAY_NTLMV2 \| CIFSSEC_MUST_SIGN;
	break;		break;
	#ifdef CONFIG_CIFS_WEAK_PW_HASH		#ifdef CONFIG_CIFS_WEAK_PW_HASH
	case Opt_sec_lanman:		case Opt_sec_lanman:
	vol->sectype = LANMAN;		vol->sectype = LANMAN;
	vol->secFlg \|= CIFSSEC_MAY_LANMAN;
	break;		break;
	#endif		#endif
	case Opt_sec_none:		case Opt_sec_none:
	vol->nullauth = 1;		vol->nullauth = 1;
	vol->secFlg \|= CIFSSEC_MAY_NTLM;
	break;		break;
	default:		default:
	cifs_dbg(VFS, "bad security option: %s\n", value);		cifs_dbg(VFS, "bad security option: %s\n", value);
	@@ -1445,7 +1429,6 @@ cifs_parse_mount_options(const char mountdata, const char devname,
	vol->local_lease = 1;		vol->local_lease = 1;
	break;		break;
	case Opt_sign:		case Opt_sign:
	vol->secFlg \|= CIFSSEC_MUST_SIGN;
	vol->sign = true;		vol->sign = true;
	break;		break;
	case Opt_seal:		case Opt_seal:
	@@ -2003,40 +1986,19 @@ match_address(struct TCP_Server_Info server, struct sockaddr addr,
	static bool		static bool
	match_security(struct TCP_Server_Info server, struct smb_vol vol)		match_security(struct TCP_Server_Info server, struct smb_vol vol)
	{		{
	unsigned int secFlags;		/*
			* The select_sectype function should either return the vol->sectype
	if (vol->secFlg & (~(CIFSSEC_MUST_SIGN \| CIFSSEC_MUST_SEAL)))		* that was specified, or "Unspecified" if that sectype was not
	secFlags = vol->secFlg;		* compatible with the given NEGOTIATE request.
	else		*/
	secFlags = global_secflags \| vol->secFlg;		if (select_sectype(server, vol->sectype) == Unspecified)

	switch (server->secType) {
	case LANMAN:
	if (!(secFlags & (CIFSSEC_MAY_LANMAN\|CIFSSEC_MAY_PLNTXT)))
	return false;
	break;
	case NTLMv2:
	if (!(secFlags & CIFSSEC_MAY_NTLMV2))
	return false;
	break;
	case NTLM:
	if (!(secFlags & CIFSSEC_MAY_NTLM))
	return false;
	break;
	case Kerberos:
	if (!(secFlags & CIFSSEC_MAY_KRB5))
	return false;
	break;
	case RawNTLMSSP:
	if (!(secFlags & CIFSSEC_MAY_NTLMSSP))
	return false;
	break;
	default:
	/* shouldn't happen */
	return false;		return false;
	}

	/* now check if signing mode is acceptable */		/*
			* Now check if signing mode is acceptable. No need to check
			* global_secflags at this point since if MUST_SIGN is set then
			* the server->sign had better be too.
			*/
	if (vol->sign && !server->sign)		if (vol->sign && !server->sign)
	return false;		return false;

	@@ -2239,7 +2201,11 @@ out_err:

	static int match_session(struct cifs_ses ses, struct smb_vol vol)		static int match_session(struct cifs_ses ses, struct smb_vol vol)
	{		{
	switch (ses->server->secType) {		if (vol->sectype != Unspecified &&
			vol->sectype != ses->sectype)
			return 0;

			switch (ses->sectype) {
	case Kerberos:		case Kerberos:
	if (!uid_eq(vol->cred_uid, ses->cred_uid))		if (!uid_eq(vol->cred_uid, ses->cred_uid))
	return 0;		return 0;
	@@ -2516,7 +2482,6 @@ cifs_get_smb_ses(struct TCP_Server_Info server, struct smb_vol volume_info)
	ses->cred_uid = volume_info->cred_uid;		ses->cred_uid = volume_info->cred_uid;
	ses->linux_uid = volume_info->linux_uid;		ses->linux_uid = volume_info->linux_uid;

	ses->overrideSecFlg = volume_info->secFlg;
	ses->sectype = volume_info->sectype;		ses->sectype = volume_info->sectype;
	ses->sign = volume_info->sign;		ses->sign = volume_info->sign;

	@@ -3681,7 +3646,7 @@ CIFSTCon(const unsigned int xid, struct cifs_ses *ses,
	NTLMv2 password here) */		NTLMv2 password here) */
	#ifdef CONFIG_CIFS_WEAK_PW_HASH		#ifdef CONFIG_CIFS_WEAK_PW_HASH
	if ((global_secflags & CIFSSEC_MAY_LANMAN) &&		if ((global_secflags & CIFSSEC_MAY_LANMAN) &&
	(ses->server->secType == LANMAN))		(ses->sectype == LANMAN))
	calc_lanman_hash(tcon->password, ses->server->cryptkey,		calc_lanman_hash(tcon->password, ses->server->cryptkey,
	ses->server->sec_mode &		ses->server->sec_mode &
	SECMODE_PW_ENCRYPT ? true : false,		SECMODE_PW_ENCRYPT ? true : false,
	@@ -3893,27 +3858,11 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses,
	static int		static int
	cifs_set_vol_auth(struct smb_vol vol, struct cifs_ses ses)		cifs_set_vol_auth(struct smb_vol vol, struct cifs_ses ses)
	{		{
	switch (ses->server->secType) {		vol->sectype = ses->sectype;
	case Kerberos:
	vol->secFlg = CIFSSEC_MUST_KRB5;		/* krb5 is special, since we don't need username or pw */
			if (vol->sectype == Kerberos)
	return 0;		return 0;
	case NTLMv2:
	vol->secFlg = CIFSSEC_MUST_NTLMV2;
	break;
	case NTLM:
	vol->secFlg = CIFSSEC_MUST_NTLM;
	break;
	case RawNTLMSSP:
	vol->secFlg = CIFSSEC_MUST_NTLMSSP;
	break;
	case LANMAN:
	vol->secFlg = CIFSSEC_MUST_LANMAN;
	break;
	default:
	/* should never happen */
	vol->secFlg = 0;
	break;
	}

	return cifs_set_cifscreds(vol, ses);		return cifs_set_cifscreds(vol, ses);
	}		}

Admin message