Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 26efa0ba authored by Jeff Layton's avatar Jeff Layton Committed by Steve French
Browse files

cifs: have decode_negTokenInit set flags in server struct 



...rather than the secType. This allows us to get rid of the MSKerberos
securityEnum. The client just makes a decision at upcall time.

Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Signed-off-by: default avatarSteve French <sfrench@us.ibm.com>
parent 198b5682

fs/cifs/asn1.c

+8 −22
Original line number Diff line number Diff line
@@ -492,17 +492,13 @@ compare_oid(unsigned long *oid1, unsigned int oid1len, 


int

decode_negTokenInit(unsigned char *security_blob, int length,

		    enum securityEnum *secType)

		    struct TCP_Server_Info *server)

{

	struct asn1_ctx ctx;

	unsigned char *end;

	unsigned char *sequence_end;

	unsigned long *oid = NULL;

	unsigned int cls, con, tag, oidlen, rc;

	bool use_ntlmssp = false;

	bool use_kerberos = false;

	bool use_kerberosu2u = false;

	bool use_mskerberos = false;



	/* cifs_dump_mem(" Received SecBlob ", security_blob, length); */
@@ -599,20 +595,17 @@ decode_negTokenInit(unsigned char *security_blob, int length, 
					*(oid + 1), *(oid + 2), *(oid + 3));



				if (compare_oid(oid, oidlen, MSKRB5_OID,

						MSKRB5_OID_LEN) &&

						!use_mskerberos)

					use_mskerberos = true;

						MSKRB5_OID_LEN))

					server->sec_mskerberos = true;

				else if (compare_oid(oid, oidlen, KRB5U2U_OID,

						     KRB5U2U_OID_LEN) &&

						     !use_kerberosu2u)

					use_kerberosu2u = true;

						     KRB5U2U_OID_LEN))

					server->sec_kerberosu2u = true;

				else if (compare_oid(oid, oidlen, KRB5_OID,

						     KRB5_OID_LEN) &&

						     !use_kerberos)

					use_kerberos = true;

						     KRB5_OID_LEN))

					server->sec_kerberos = true;

				else if (compare_oid(oid, oidlen, NTLMSSP_OID,

						     NTLMSSP_OID_LEN))

					use_ntlmssp = true;

					server->sec_ntlmssp = true;



				kfree(oid);

			}
@@ -669,12 +662,5 @@ decode_negTokenInit(unsigned char *security_blob, int length, 
	cFYI(1, "Need to call asn1_octets_decode() function for %s",

		ctx.pointer);	/* is this UTF-8 or ASCII? */

decode_negtoken_exit:

	if (use_kerberos)

		*secType = Kerberos;

	else if (use_mskerberos)

		*secType = MSKerberos;

	else if (use_ntlmssp)

		*secType = RawNTLMSSP;



	return 1;

}

fs/cifs/cifs_spnego.c

+2 −2
Original line number Diff line number Diff line
@@ -133,9 +133,9 @@ cifs_get_spnego_key(struct cifsSesInfo *sesInfo) 
	dp = description + strlen(description);



	/* for now, only sec=krb5 and sec=mskrb5 are valid */

	if (server->secType == Kerberos)

	if (server->sec_kerberos)

		sprintf(dp, ";sec=krb5");

	else if (server->secType == MSKerberos)

	else if (server->sec_mskerberos)

		sprintf(dp, ";sec=mskrb5");

	else

		goto out;

fs/cifs/cifsglob.h

+5 −1
Original line number Diff line number Diff line
@@ -87,7 +87,6 @@ enum securityEnum { 
	RawNTLMSSP,		/* NTLMSSP without SPNEGO, NTLMv2 hash */

/*	NTLMSSP, */ /* can use rawNTLMSSP instead of NTLMSSP via SPNEGO */

	Kerberos,		/* Kerberos via SPNEGO */

	MSKerberos,		/* MS Kerberos via SPNEGO */

};



enum protocolEnum {
@@ -186,6 +185,11 @@ struct TCP_Server_Info { 
	char ntlmv2_hash[16];

	unsigned long lstrp; /* when we got last response from this server */

	u16 dialect; /* dialect index that server chose */

	/* extended security flavors that server supports */

	bool	sec_kerberos;		/* supports plain Kerberos */

	bool	sec_mskerberos;		/* supports legacy MS Kerberos */

	bool	sec_kerberosu2u;	/* supports U2U Kerberos */

	bool	sec_ntlmssp;		/* supports NTLMSSP */

};



/*

fs/cifs/cifsproto.h

+1 −1
Original line number Diff line number Diff line
@@ -85,7 +85,7 @@ extern struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *); 
extern unsigned int smbCalcSize(struct smb_hdr *ptr);

extern unsigned int smbCalcSize_LE(struct smb_hdr *ptr);

extern int decode_negTokenInit(unsigned char *security_blob, int length,

			enum securityEnum *secType);

			struct TCP_Server_Info *server);

extern int cifs_convert_address(char *src, void *dst);

extern int map_smb_to_linux_error(struct smb_hdr *smb, int logErr);

extern void header_assemble(struct smb_hdr *, char /* command */ ,

fs/cifs/cifssmb.c

+9 −3
Original line number Diff line number Diff line
@@ -597,13 +597,19 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses) 
			server->secType = RawNTLMSSP;

		} else {

			rc = decode_negTokenInit(pSMBr->u.extended_response.

						 SecurityBlob,

						 count - 16,

						 &server->secType);

						 SecurityBlob, count - 16,

						 server);

			if (rc == 1)

				rc = 0;

			else

				rc = -EINVAL;



			if (server->sec_kerberos || server->sec_mskerberos)

				server->secType = Kerberos;

			else if (server->sec_ntlmssp)

				server->secType = RawNTLMSSP;

			else

				rc = -EOPNOTSUPP;

		}

	} else

		server->capabilities &= ~CAP_EXTENDED_SECURITY;