Commit 908b852d authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'smb3-security-fixes-for-4.13' of git://git.samba.org/sfrench/cifs-2.6 

Pull cifs fixes and sane default from Steve French:
 "Upgrade default dialect to more secure SMB3 from older cifs dialect"

* tag 'smb3-security-fixes-for-4.13' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: Clean up unused variables in smb2pdu.c
  [SMB3] Improve security, move default dialect to SMB3 from old CIFS
  [SMB3] Remove ifdef since SMB3 (and later) now STRONGLY preferred
  CIFS: Reconnect expired SMB sessions
  CIFS: Display SMB2 error codes in the hex format
  cifs: Use smb 2 - 3 and cifsacl mount options setacl function
  cifs: prototype declaration and definition to set acl for smb 2 - 3 and cifsacl mount options
parents 3bf7878f 68a6afa7

fs/cifs/Kconfig

+31 −52
Original line number Diff line number Diff line 
config CIFS

	tristate "CIFS support (advanced network filesystem, SMBFS successor)"

	tristate "SMB3 and CIFS support (advanced network filesystem)"

	depends on INET

	select NLS

	select CRYPTO
@@ -10,28 +10,35 @@ config CIFS 
	select CRYPTO_ECB

	select CRYPTO_DES

	help

	  This is the client VFS module for the Common Internet File System

	  (CIFS) protocol which is the successor to the Server Message Block

	  (SMB) protocol, the native file sharing mechanism for most early

	  PC operating systems.  The CIFS protocol is fully supported by

	  file servers such as Windows 2000 (including Windows 2003, Windows 2008,

	  NT 4 and Windows XP) as well by Samba (which provides excellent CIFS

	  server support for Linux and many other operating systems). Limited

	  support for OS/2 and Windows ME and similar servers is provided as

	  well.

	  This is the client VFS module for the SMB3 family of NAS protocols,

	  as well as for earlier dialects such as SMB2.1, SMB2 and the

	  Common Internet File System (CIFS) protocol.  CIFS was the successor

	  to the original dialect, the Server Message Block (SMB) protocol, the

	  native file sharing mechanism for most early PC operating systems.



	  The module also provides optional support for the followon

	  protocols for CIFS including SMB3, which enables

	  useful performance and security features (see the description

	  of CONFIG_CIFS_SMB2).

	  The SMB3 protocol is supported by most modern operating systems and

	  NAS appliances (e.g. Samba, Windows 8, Windows 2012, MacOS).

	  The older CIFS protocol was included in Windows NT4, 2000 and XP (and

	  later) as well by Samba (which provides excellent CIFS and SMB3

	  server support for Linux and many other operating systems). Limited

	  support for OS/2 and Windows ME and similar very old servers is

	  provided as well.



	  The cifs module provides an advanced network file system

	  client for mounting to CIFS compliant servers.  It includes

	  The cifs module provides an advanced network file system client

	  for mounting to SMB3 (and CIFS) compliant servers.  It includes

	  support for DFS (hierarchical name space), secure per-user

	  session establishment via Kerberos or NTLM or NTLMv2,

	  safe distributed caching (oplock), optional packet

	  signing, Unicode and other internationalization improvements.

	  If you need to mount to Samba or Windows from this machine, say Y.



	  In general, the default dialects, SMB3 and later, enable better

	  performance, security and features, than would be possible with CIFS.

	  Note that when mounting to Samba, due to the CIFS POSIX extensions,

	  CIFS mounts can provide slightly better POSIX compatibility

	  than SMB3 mounts. SMB2/SMB3 mount options are also

	  slightly simpler (compared to CIFS) due to protocol improvements.



	  If you need to mount to Samba, Macs or Windows from this machine, say Y.



config CIFS_STATS

        bool "CIFS statistics"
@@ -89,7 +96,7 @@ config CIFS_UPCALL 
	  Enables an upcall mechanism for CIFS which accesses userspace helper

	  utilities to provide SPNEGO packaged (RFC 4178) Kerberos tickets

	  which are needed to mount to certain secure servers (for which more

	  secure Kerberos authentication is required). If unsure, say N.

	  secure Kerberos authentication is required). If unsure, say Y.



config CIFS_XATTR

        bool "CIFS extended attributes"
@@ -105,7 +112,7 @@ config CIFS_XATTR 
          (used by some filesystems to store ACLs) is not supported at

          this time.



          If unsure, say N.

          If unsure, say Y.



config CIFS_POSIX

        bool "CIFS POSIX Extensions"
@@ -125,7 +132,7 @@ config CIFS_ACL 
	  help

	    Allows fetching CIFS/NTFS ACL from the server.  The DACL blob

	    is handed over to the application/caller.  See the man

	    page for getcifsacl for more information.

	    page for getcifsacl for more information.  If unsure, say Y.



config CIFS_DEBUG

	bool "Enable CIFS debugging routines"
@@ -148,12 +155,13 @@ config CIFS_DEBUG2 


config CIFS_DEBUG_DUMP_KEYS

	bool "Dump encryption keys for offline decryption (Unsafe)"

	depends on CIFS_DEBUG && CIFS_SMB2

	depends on CIFS_DEBUG

	help

	   Enabling this will dump the encryption and decryption keys

	   used to communicate on an encrypted share connection on the

	   console. This allows Wireshark to decrypt and dissect

	   encrypted network captures. Enable this carefully.

	   If unsure, say N.



config CIFS_DFS_UPCALL

	  bool "DFS feature support"
@@ -166,7 +174,7 @@ config CIFS_DFS_UPCALL 
	    an upcall mechanism for CIFS which contacts userspace helper

	    utilities to provide server name resolution (host names to

	    IP addresses) which is needed for implicit mounts of DFS junction

	    points. If unsure, say N.

	    points. If unsure, say Y.



config CIFS_NFSD_EXPORT

	  bool "Allow nfsd to export CIFS file system"
@@ -174,38 +182,9 @@ config CIFS_NFSD_EXPORT 
	  help

	   Allows NFS server to export a CIFS mounted share (nfsd over cifs)



config CIFS_SMB2

	bool "SMB2 and SMB3 network file system support"

	depends on CIFS

	select KEYS

	select FSCACHE

	select DNS_RESOLVER

	select CRYPTO_AES

	select CRYPTO_SHA256

	select CRYPTO_CMAC

	select CRYPTO_AEAD2

	select CRYPTO_CCM



	help

	  This enables support for the Server Message Block version 2

	  family of protocols, including SMB3.  SMB3 support is

	  enabled on mount by specifying "vers=3.0" in the mount

	  options. These protocols are the successors to the popular

	  CIFS and SMB network file sharing protocols. SMB3 is the

	  native file sharing mechanism for the more recent

	  versions of Windows (Windows 8 and Windows 2012 and

	  later) and Samba server and many others support SMB3 well.

	  In general SMB3 enables better performance, security

	  and features, than would be possible with CIFS (Note that

	  when mounting to Samba, due to the CIFS POSIX extensions,

	  CIFS mounts can provide slightly better POSIX compatibility

	  than SMB3 mounts do though). Note that SMB2/SMB3 mount

	  options are also slightly simpler (compared to CIFS) due

	  to protocol improvements.



config CIFS_SMB311

	bool "SMB3.1.1 network file system support (Experimental)"

	depends on CIFS_SMB2

	depends on CIFS



	help

	  This enables experimental support for the newest, SMB3.1.1, dialect.

fs/cifs/Makefile

+3 −4
Original line number Diff line number Diff line
@@ -6,7 +6,9 @@ obj-$(CONFIG_CIFS) += cifs.o 
cifs-y := cifsfs.o cifssmb.o cifs_debug.o connect.o dir.o file.o inode.o \

	  link.o misc.o netmisc.o smbencrypt.o transport.o asn1.o \

	  cifs_unicode.o nterr.o cifsencrypt.o \

	  readdir.o ioctl.o sess.o export.o smb1ops.o winucase.o

	  readdir.o ioctl.o sess.o export.o smb1ops.o winucase.o \

	  smb2ops.o smb2maperror.o smb2transport.o \

	  smb2misc.o smb2pdu.o smb2inode.o smb2file.o



cifs-$(CONFIG_CIFS_XATTR) += xattr.o

cifs-$(CONFIG_CIFS_ACL) += cifsacl.o
@@ -16,6 +18,3 @@ cifs-$(CONFIG_CIFS_UPCALL) += cifs_spnego.o 
cifs-$(CONFIG_CIFS_DFS_UPCALL) += dns_resolve.o cifs_dfs_ref.o



cifs-$(CONFIG_CIFS_FSCACHE) += fscache.o cache.o
 


cifs-$(CONFIG_CIFS_SMB2) += smb2ops.o smb2maperror.o smb2transport.o \

			    smb2misc.o smb2pdu.o smb2inode.o smb2file.o

fs/cifs/cifs_unicode.c

+0 −2
Original line number Diff line number Diff line
@@ -588,7 +588,6 @@ ctoUTF16_out: 
	return j;

}



#ifdef CONFIG_CIFS_SMB2

/*

 * cifs_local_to_utf16_bytes - how long will a string be after conversion?

 * @from - pointer to input string
@@ -647,4 +646,3 @@ cifs_strndup_to_utf16(const char *src, const int maxlen, int *utf16_len, 
	*utf16_len = len;

	return dst;

}
 
#endif /* CONFIG_CIFS_SMB2 */

fs/cifs/cifs_unicode.h

+0 −2
Original line number Diff line number Diff line
@@ -116,11 +116,9 @@ char *cifs_strndup_from_utf16(const char *src, const int maxlen, 
extern int cifsConvertToUTF16(__le16 *target, const char *source, int maxlen,

			      const struct nls_table *cp, int mapChars);

extern int cifs_remap(struct cifs_sb_info *cifs_sb);

#ifdef CONFIG_CIFS_SMB2

extern __le16 *cifs_strndup_to_utf16(const char *src, const int maxlen,

				     int *utf16_len, const struct nls_table *cp,

				     int remap);

#endif /* CONFIG_CIFS_SMB2 */

#endif



wchar_t cifs_toupper(wchar_t in);

fs/cifs/cifsfs.c

+3 −10
Original line number Diff line number Diff line
@@ -51,9 +51,7 @@ 
#include <linux/key-type.h>

#include "cifs_spnego.h"

#include "fscache.h"

#ifdef CONFIG_CIFS_SMB2

#include "smb2pdu.h"

#endif



int cifsFYI = 0;

bool traceSMB;
@@ -277,9 +275,8 @@ cifs_alloc_inode(struct super_block *sb) 
	cifs_inode->uniqueid = 0;

	cifs_inode->createtime = 0;

	cifs_inode->epoch = 0;

#ifdef CONFIG_CIFS_SMB2

	generate_random_uuid(cifs_inode->lease_key);

#endif



	/*

	 * Can not set i_flags here - they get immediately overwritten to zero

	 * by the VFS.
@@ -1213,14 +1210,12 @@ cifs_destroy_inodecache(void) 
static int

cifs_init_request_bufs(void)

{

	size_t max_hdr_size = MAX_CIFS_HDR_SIZE;

#ifdef CONFIG_CIFS_SMB2

	/*

	 * SMB2 maximum header size is bigger than CIFS one - no problems to

	 * allocate some more bytes for CIFS.

	 */

	max_hdr_size = MAX_SMB2_HDR_SIZE;

#endif

	size_t max_hdr_size = MAX_SMB2_HDR_SIZE;



	if (CIFSMaxBufSize < 8192) {

	/* Buffer size can not be smaller than 2 * PATH_MAX since maximum

	Unicode path name has to fit in any SMB/CIFS path based frames */
@@ -1476,12 +1471,10 @@ MODULE_SOFTDEP("pre: hmac"); 
MODULE_SOFTDEP("pre: md4");

MODULE_SOFTDEP("pre: md5");

MODULE_SOFTDEP("pre: nls");

#ifdef CONFIG_CIFS_SMB2

MODULE_SOFTDEP("pre: aes");

MODULE_SOFTDEP("pre: cmac");

MODULE_SOFTDEP("pre: sha256");

MODULE_SOFTDEP("pre: aead2");

MODULE_SOFTDEP("pre: ccm");

#endif /* CONFIG_CIFS_SMB2 */

module_init(init_cifs)

module_exit(exit_cifs)

CRA Git | Maintained and supported by SUSTech CRA and CCSE