Commit e598d1d8 authored by Jeff Layton's avatar Jeff Layton Committed by Steve French
Browse files

cifs: track the flavor of the NEGOTIATE reponse 



Track what sort of NEGOTIATE response we get from the server, as that
will govern what sort of authentication types this socket will support.

There are three possibilities:

LANMAN: server sent legacy LANMAN-type response

UNENCAP: server sent a newer-style response, but extended security bit
wasn't set. This socket will only support unencapsulated auth types.

EXTENDED: server sent a newer-style response with the extended security
bit set. This is necessary to support krb5 and ntlmssp auth types.

Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Reviewed-by: default avatarPavel Shilovsky <piastry@etersoft.ru>
Signed-off-by: default avatarSteve French <smfrench@gmail.com>
parent 515d82ff

fs/cifs/cifsglob.h

+4 −0
Original line number Diff line number Diff line
@@ -541,6 +541,10 @@ struct TCP_Server_Info { 
	struct session_key session_key;

	unsigned long lstrp; /* when we got last response from this server */

	struct cifs_secmech secmech; /* crypto sec mech functs, descriptors */

#define	CIFS_NEGFLAVOR_LANMAN	0	/* wct == 13, LANMAN */

#define	CIFS_NEGFLAVOR_UNENCAP	1	/* wct == 17, but no ext_sec */

#define	CIFS_NEGFLAVOR_EXTENDED	2	/* wct == 17, ext_sec bit set */

	char	negflavor;	/* NEGOTIATE response flavor */

	/* extended security flavors that server supports */

	bool	sec_ntlmssp;		/* supports NTLMSSP */

	bool	sec_kerberosu2u;	/* supports U2U Kerberos */

fs/cifs/cifssmb.c

+10 −5
Original line number Diff line number Diff line
@@ -615,6 +615,7 @@ CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses) 
		rc = -EOPNOTSUPP;

		goto neg_err_exit;

	} else if (pSMBr->hdr.WordCount == 13) {

		server->negflavor = CIFS_NEGFLAVOR_LANMAN;

		rc = decode_lanman_negprot_rsp(server, pSMBr, secFlags);

		goto signing_check;

	} else if (pSMBr->hdr.WordCount != 17) {
@@ -666,17 +667,21 @@ CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses) 
	server->timeAdj = (int)(__s16)le16_to_cpu(pSMBr->ServerTimeZone);

	server->timeAdj *= 60;



	if (pSMBr->EncryptionKeyLength == CIFS_CRYPTO_KEY_SIZE)

	if (pSMBr->EncryptionKeyLength == CIFS_CRYPTO_KEY_SIZE) {

		server->negflavor = CIFS_NEGFLAVOR_UNENCAP;

		memcpy(ses->server->cryptkey, pSMBr->u.EncryptionKey,

		       CIFS_CRYPTO_KEY_SIZE);

	else if ((pSMBr->hdr.Flags2 & SMBFLG2_EXT_SEC ||

	} else if ((pSMBr->hdr.Flags2 & SMBFLG2_EXT_SEC ||

			server->capabilities & CAP_EXTENDED_SECURITY) &&

				(pSMBr->EncryptionKeyLength == 0))

				(pSMBr->EncryptionKeyLength == 0)) {

		server->negflavor = CIFS_NEGFLAVOR_EXTENDED;

		rc = decode_ext_sec_blob(server, pSMBr);

	else if (server->sec_mode & SECMODE_PW_ENCRYPT)

	} else if (server->sec_mode & SECMODE_PW_ENCRYPT) {

		rc = -EIO; /* no crypt key only if plain text pwd */

	else

	} else {

		server->negflavor = CIFS_NEGFLAVOR_UNENCAP;

		server->capabilities &= ~CAP_EXTENDED_SECURITY;

	}



signing_check:

	if (!rc)

fs/cifs/smb2pdu.c

+2 −0
Original line number Diff line number Diff line
@@ -405,6 +405,8 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses) 
	}

	server->dialect = le16_to_cpu(rsp->DialectRevision);



	/* SMB2 only has an extended negflavor */

	server->negflavor = CIFS_NEGFLAVOR_EXTENDED;

	server->maxBuf = le32_to_cpu(rsp->MaxTransactSize);

	server->max_read = le32_to_cpu(rsp->MaxReadSize);

	server->max_write = le32_to_cpu(rsp->MaxWriteSize);