Commit ef65aaed authored by Sachin Prabhu's avatar Sachin Prabhu Committed by Steve French
Browse files

smb2: Enforce sec= mount option 



If the security type specified using a mount option is not supported,
the SMB2 session setup code changes the security type to RawNTLMSSP. We
should instead fail the mount and return an error.

The patch changes the code for SMB2 to make it similar to the code used
for SMB1. Like in SMB1, we now use the global security flags to select
the security method to be used when no security method is specified and
to return an error when the requested auth method is not available.

For SMB2, we also use ntlmv2 as a synonym for nltmssp.

Signed-off-by: default avatarSachin Prabhu <sprabhu@redhat.com>
Acked-by: default avatarPavel Shilovsky <pshilov@microsoft.com>
Acked-by: default avatarJeff Layton <jlayton@redhat.com>
Signed-off-by: default avatarSteve French <smfrench@gmail.com>
parent 284316dd

fs/cifs/cifsglob.h

+3 −0
Original line number Diff line number Diff line
@@ -443,6 +443,9 @@ struct smb_version_operations { 
	int (*is_transform_hdr)(void *buf);

	int (*receive_transform)(struct TCP_Server_Info *,

				 struct mid_q_entry **);

	enum securityEnum (*select_sectype)(struct TCP_Server_Info *,

			    enum securityEnum);



};



struct smb_version_values {

fs/cifs/cifsproto.h

+2 −0
Original line number Diff line number Diff line
@@ -533,4 +533,6 @@ int cifs_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, 
int __cifs_calc_signature(struct smb_rqst *rqst,

			struct TCP_Server_Info *server, char *signature,

			struct shash_desc *shash);

enum securityEnum cifs_select_sectype(struct TCP_Server_Info *,

					enum securityEnum);

#endif			/* _CIFSPROTO_H */

fs/cifs/connect.c

+2 −1
Original line number Diff line number Diff line
@@ -2073,7 +2073,8 @@ match_security(struct TCP_Server_Info *server, struct smb_vol *vol) 
	 * that was specified, or "Unspecified" if that sectype was not

	 * compatible with the given NEGOTIATE request.

	 */

	if (select_sectype(server, vol->sectype) == Unspecified)

	if (server->ops->select_sectype(server, vol->sectype)

	     == Unspecified)

		return false;



	/*

fs/cifs/sess.c

+2 −2
Original line number Diff line number Diff line
@@ -498,7 +498,7 @@ setup_ntlmv2_ret: 
}



enum securityEnum

select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)

cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)

{

	switch (server->negflavor) {

	case CIFS_NEGFLAVOR_EXTENDED:
@@ -1391,7 +1391,7 @@ static int select_sec(struct cifs_ses *ses, struct sess_data *sess_data) 
{

	int type;



	type = select_sectype(ses->server, ses->sectype);

	type = cifs_select_sectype(ses->server, ses->sectype);

	cifs_dbg(FYI, "sess setup type %d\n", type);

	if (type == Unspecified) {

		cifs_dbg(VFS,

fs/cifs/smb1ops.c

+1 −0
Original line number Diff line number Diff line
@@ -1087,6 +1087,7 @@ struct smb_version_operations smb1_operations = { 
	.is_read_op = cifs_is_read_op,

	.wp_retry_size = cifs_wp_retry_size,

	.dir_needs_close = cifs_dir_needs_close,

	.select_sectype = cifs_select_sectype,

#ifdef CONFIG_CIFS_XATTR

	.query_all_EAs = CIFSSMBQAllEAs,

	.set_EA = CIFSSMBSetEA,

CRA Git | Maintained and supported by SUSTech CRA and CCSE