Commit 50285882 authored by Jeff Layton's avatar Jeff Layton Committed by Steve French
Browse files

cifs: fix SMB2 signing enablement in cifs_enable_signing 



Commit 9ddec561 (cifs: move handling of signed connections into
separate function) broke signing on SMB2/3 connections. While the code
to enable signing on the connections was very similar between the two,
the bits that get set in the sec_mode are different.

Declare a couple of new smb_version_values fields and set them
appropriately for SMB1 and SMB2/3. Then change cifs_enable_signing to
use those instead.

Reported-by: default avatarShirish Pargaonkar <shirishpargaonkar@gmail.com>
Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Tested-by: default avatarShirish Pargaonkar <shirishpargaonkar@gmail.com>
Signed-off-by: default avatarSteve French <smfrench@gmail.com>
parent e65a5cb4

fs/cifs/cifsglob.h

+2 −0
Original line number Diff line number Diff line
@@ -387,6 +387,8 @@ struct smb_version_values { 
	unsigned int	cap_nt_find;

	unsigned int	cap_large_files;

	unsigned int	oplock_read;

	__u16		signing_enabled;

	__u16		signing_required;

};



#define HEADER_SIZE(server) (server->vals->header_size)

fs/cifs/cifssmb.c

+2 −2
Original line number Diff line number Diff line
@@ -407,8 +407,8 @@ decode_ext_sec_blob(struct cifs_ses *ses, NEGOTIATE_RSP *pSMBr) 
int

cifs_enable_signing(struct TCP_Server_Info *server, bool mnt_sign_required)

{

	bool srv_sign_required = server->sec_mode & SECMODE_SIGN_REQUIRED;

	bool srv_sign_enabled = server->sec_mode & SECMODE_SIGN_ENABLED;

	bool srv_sign_required = server->sec_mode & server->vals->signing_required;

	bool srv_sign_enabled = server->sec_mode & server->vals->signing_enabled;

	bool mnt_sign_enabled = global_secflags & CIFSSEC_MAY_SIGN;



	/*

fs/cifs/smb1ops.c

+2 −0
Original line number Diff line number Diff line
@@ -957,4 +957,6 @@ struct smb_version_values smb1_values = { 
	.cap_nt_find = CAP_NT_SMBS | CAP_NT_FIND,

	.cap_large_files = CAP_LARGE_FILES,

	.oplock_read = OPLOCK_READ,

	.signing_enabled = SECMODE_SIGN_ENABLED,

	.signing_required = SECMODE_SIGN_REQUIRED,

};

fs/cifs/smb2ops.c

+8 −0
Original line number Diff line number Diff line
@@ -729,6 +729,8 @@ struct smb_version_values smb20_values = { 
	.cap_nt_find = SMB2_NT_FIND,

	.cap_large_files = SMB2_LARGE_FILES,

	.oplock_read = SMB2_OPLOCK_LEVEL_II,

	.signing_enabled = SMB2_NEGOTIATE_SIGNING_ENABLED | SMB2_NEGOTIATE_SIGNING_REQUIRED,

	.signing_required = SMB2_NEGOTIATE_SIGNING_REQUIRED,

};



struct smb_version_values smb21_values = {
@@ -747,6 +749,8 @@ struct smb_version_values smb21_values = { 
	.cap_nt_find = SMB2_NT_FIND,

	.cap_large_files = SMB2_LARGE_FILES,

	.oplock_read = SMB2_OPLOCK_LEVEL_II,

	.signing_enabled = SMB2_NEGOTIATE_SIGNING_ENABLED | SMB2_NEGOTIATE_SIGNING_REQUIRED,

	.signing_required = SMB2_NEGOTIATE_SIGNING_REQUIRED,

};



struct smb_version_values smb30_values = {
@@ -765,6 +769,8 @@ struct smb_version_values smb30_values = { 
	.cap_nt_find = SMB2_NT_FIND,

	.cap_large_files = SMB2_LARGE_FILES,

	.oplock_read = SMB2_OPLOCK_LEVEL_II,

	.signing_enabled = SMB2_NEGOTIATE_SIGNING_ENABLED | SMB2_NEGOTIATE_SIGNING_REQUIRED,

	.signing_required = SMB2_NEGOTIATE_SIGNING_REQUIRED,

};



struct smb_version_values smb302_values = {
@@ -783,4 +789,6 @@ struct smb_version_values smb302_values = { 
	.cap_nt_find = SMB2_NT_FIND,

	.cap_large_files = SMB2_LARGE_FILES,

	.oplock_read = SMB2_OPLOCK_LEVEL_II,

	.signing_enabled = SMB2_NEGOTIATE_SIGNING_ENABLED | SMB2_NEGOTIATE_SIGNING_REQUIRED,

	.signing_required = SMB2_NEGOTIATE_SIGNING_REQUIRED,

};

CRA Git | Maintained and supported by SUSTech CRA and CCSE