Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 95b1cb90 authored by Steve French's avatar Steve French
Browse files

[CIFS] enable parsing for transport encryption mount parm 



Samba now supports transport encryption on particular exports
(mounted tree ids can be encrypted for servers which support the
unix extensions).  This adds parsing support to cifs mount
option parsing for this.

Signed-off-by: default avatarSteve French <sfrench@us.ibm.com>
parent c2cf07d5

fs/cifs/README

+5 −0
Original line number Diff line number Diff line
@@ -483,6 +483,11 @@ A partial list of the supported mount options follows: 
 sign           Must use packet signing (helps avoid unwanted data modification

		by intermediate systems in the route).  Note that signing

		does not work with lanman or plaintext authentication.

 seal           Must seal (encrypt) all data on this mounted share before

		sending on the network.  Requires support for Unix Extensions.

		Note that this differs from the sign mount option in that it

		causes encryption of data sent over this mounted share but other

		shares mounted to the same server are unaffected.

 sec            Security mode.  Allowed values are:

			none	attempt to connection as a null user (no name)

			krb5    Use Kerberos version 5 authentication

fs/cifs/cifsglob.h

+1 −0
Original line number Diff line number Diff line
@@ -281,6 +281,7 @@ struct cifsTconInfo { 
	bool ipc:1;		/* set if connection to IPC$ eg for RPC/PIPES */

	bool retry:1;

	bool nocase:1;

	bool seal:1;      /* transport encryption for this mounted share */

	bool unix_ext:1;  /* if false disable Linux extensions to CIFS protocol

				for this mount even if server would support */

	/* BB add field for back pointer to sb struct(s)? */

fs/cifs/connect.c

+17 −8
Original line number Diff line number Diff line
@@ -87,8 +87,9 @@ struct smb_vol { 
	bool no_linux_ext:1;

	bool sfu_emul:1;

	bool nullauth:1;   /* attempt to authenticate with null user */

	unsigned nocase;     /* request case insensitive filenames */

	unsigned nobrl;      /* disable sending byte range locks to srv */

	bool nocase:1;     /* request case insensitive filenames */

	bool nobrl:1;      /* disable sending byte range locks to srv */

	bool seal:1;       /* request transport encryption on share */

	unsigned int rsize;

	unsigned int wsize;

	unsigned int sockopt;
@@ -1273,8 +1274,12 @@ cifs_parse_mount_options(char *options, const char *devname, 
			vol->no_psx_acl = 1;

		} else if (strnicmp(data, "sign", 4) == 0) {

			vol->secFlg |= CIFSSEC_MUST_SIGN;

/*		} else if (strnicmp(data, "seal",4) == 0) {

			vol->secFlg |= CIFSSEC_MUST_SEAL; */

		} else if (strnicmp(data, "seal", 4) == 0) {

			/* we do not do the following in secFlags because seal

			   is a per tree connection (mount) not a per socket

			   or per-smb connection option in the protocol */

			/* vol->secFlg |= CIFSSEC_MUST_SEAL; */

			vol->seal = 1;

		} else if (strnicmp(data, "direct", 6) == 0) {

			vol->direct_io = 1;

		} else if (strnicmp(data, "forcedirectio", 13) == 0) {
@@ -2126,6 +2131,9 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb, 
			   for the retry flag is used */

			tcon->retry = volume_info.retry;

			tcon->nocase = volume_info.nocase;

			if (tcon->seal != volume_info.seal)

				cERROR(1, ("transport encryption setting "

					   "conflicts with existing tid"));

		} else {

			tcon = tconInfoAlloc();

			if (tcon == NULL)
@@ -2159,6 +2167,7 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb, 
					atomic_inc(&pSesInfo->inUse);

					tcon->retry = volume_info.retry;

					tcon->nocase = volume_info.nocase;

					tcon->seal = volume_info.seal;

				}

			}

		}