Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eeac8047 authored by Steve French's avatar Steve French
Browse files

[CIFS] Fix CIFS to recognize share mode security 



Fix Samba bugzilla bug 3301

In share mode encrypted password must be sent on tree connection (in our
case only the NTLM password is sent, not the older LANMAN one).

Signed-off-by: default avatarSteve French <sfrench@us.ibm.com>
parent 84153973

fs/cifs/CHANGES

+2 −1
Original line number Diff line number Diff line
@@ -3,7 +3,8 @@ Version 1.40 
Use fsuid (fsgid) more consistently instead of uid (gid). Improve performance

of readpages by eliminating one extra memcpy. Allow update of file size

from remote server even if file is open for write as long as mount is

directio.

directio.  Recognize share mode security and send NTLM encrypted password

on tree connect if share mode negotiated.



Version 1.39

------------

fs/cifs/cifsacl.h

+3 −3
Original line number Diff line number Diff line
@@ -26,13 +26,13 @@ struct cifs_sid { 
	__u8 revision; /* revision level */

	__u8 num_subauths;

	__u8 authority[6];

	__u8 sub_auth[4];

	__u32 sub_auth[4];

	/* next sub_auth if any ... */

} __attribute__((packed));



/* everyone */

const cifs_sid sid_everyone = {1, 1, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0}};

extern const struct cifs_sid sid_everyone;

/* group users */

const cifs_sid sid_user = {1, 2 , {0, 0, 0, 0, 0, 5}, {32, 545, 0, 0}};

extern const struct cifs_sid sid_user;



#endif /* _CIFSACL_H */

fs/cifs/cifssmb.c

+14 −6
Original line number Diff line number Diff line
@@ -37,6 +37,7 @@ 
#include "cifsproto.h"

#include "cifs_unicode.h"

#include "cifs_debug.h"

#include "cifsacl.h"



#ifdef CONFIG_CIFS_POSIX

static struct {
@@ -373,6 +374,8 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses) 
			 (struct smb_hdr *) pSMBr, &bytes_returned, 0);

	if (rc == 0) {

		server->secMode = pSMBr->SecurityMode;

		if((server->secMode & SECMODE_USER) == 0)

			cFYI(1,("share mode security"));

		server->secType = NTLM; /* BB override default for

					   NTLMv2 or kerberos v5 */

		/* one byte - no need to convert this or EncryptionKeyLen
@@ -411,8 +414,7 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses) 
						(server->server_GUID,

						pSMBr->u.extended_response.

						GUID, 16) != 0) {

						cFYI(1,

						     ("UID of server does not match previous connection to same ip address"));

						cFYI(1, ("server UID changed"));

						memcpy(server->

							server_GUID,

							pSMBr->u.
@@ -2494,8 +2496,14 @@ CIFSGetExtAttr(const int xid, struct cifsTconInfo *tcon, 


#endif /* CONFIG_POSIX */





/* security id for everyone */

const struct cifs_sid sid_everyone = {1, 1, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0}};

/* group users */

const struct cifs_sid sid_user = {1, 2 , {0, 0, 0, 0, 0, 5}, {32, 545, 0, 0}};



/* Convert CIFS ACL to POSIX form */

static int parse_sec_desc(struct sec_desc * psec_desc, int acl_len)

static int parse_sec_desc(struct cifs_sid * psec_desc, int acl_len)

{

	return 0;

}

fs/cifs/connect.c

+22 −5
Original line number Diff line number Diff line
@@ -1795,7 +1795,8 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb, 
		cifs_sb->mnt_gid = volume_info.linux_gid;

		cifs_sb->mnt_file_mode = volume_info.file_mode;

		cifs_sb->mnt_dir_mode = volume_info.dir_mode;

		cFYI(1,("file mode: 0x%x  dir mode: 0x%x",cifs_sb->mnt_file_mode,cifs_sb->mnt_dir_mode));

		cFYI(1,("file mode: 0x%x  dir mode: 0x%x",

			cifs_sb->mnt_file_mode,cifs_sb->mnt_dir_mode));



		if(volume_info.noperm)

			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
@@ -3248,9 +3249,26 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses, 


	pSMB->AndXCommand = 0xFF;

	pSMB->Flags = cpu_to_le16(TCON_EXTENDED_SECINFO);

	pSMB->PasswordLength = cpu_to_le16(1);	/* minimum */

	bcc_ptr = &pSMB->Password[0];

	if((ses->server->secMode) & SECMODE_USER) {

		pSMB->PasswordLength = cpu_to_le16(1);	/* minimum */

		bcc_ptr++;              /* skip password */

	} else {

		pSMB->PasswordLength = cpu_to_le16(CIFS_SESSION_KEY_SIZE);

		/* BB FIXME add code to fail this if NTLMv2 or Kerberos

		   specified as required (when that support is added to

		   the vfs in the future) as only NTLM or the much

		   weaker LANMAN (which we do not send) is accepted

		   by Samba (not sure whether other servers allow

		   NTLMv2 password here) */

		SMBNTencrypt(ses->password,

			     ses->server->cryptKey,

			     bcc_ptr);



		bcc_ptr += CIFS_SESSION_KEY_SIZE;

		*bcc_ptr = 0;

		bcc_ptr++; /* align */

	}



	if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))

		smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
@@ -3268,7 +3286,6 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses, 
		bcc_ptr += 2 * length;	/* convert num of 16 bit words to bytes */

		bcc_ptr += 2;	/* skip trailing null */

	} else {		/* ASCII */



		strcpy(bcc_ptr, tree);

		bcc_ptr += strlen(tree) + 1;

	}