Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b22dfb73 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6 

* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
  [CIFS] check version in spnego upcall response
  [CIFS] Kerberos support not considered experimental anymore
  [CIFS] distinguish between Kerberos and MSKerberos in upcall
  cifs: add local server pointer to cifs_setup_session
  [CIFS] reindent misindented statement
parents bd5a54e9 3dae49ab

fs/Kconfig

+0 −1
Original line number Diff line number Diff line
@@ -1984,7 +1984,6 @@ config CIFS_EXPERIMENTAL 


config CIFS_UPCALL

	  bool "Kerberos/SPNEGO advanced session setup (EXPERIMENTAL)"

	  depends on CIFS_EXPERIMENTAL

	  depends on KEYS

	  help

	    Enables an upcall mechanism for CIFS which accesses

fs/cifs/CHANGES

+5 −1
Original line number Diff line number Diff line
@@ -4,7 +4,11 @@ Fix premature write failure on congested networks (we would give up 
on EAGAIN from the socket too quickly on large writes).

Cifs_mkdir and cifs_create now respect the setgid bit on parent dir.

Fix endian problems in acl (mode from/to cifs acl) on bigendian

architectures.

architectures.  Fix problems with preserving timestamps on copying open

files (e.g. "cp -a") to Windows servers.  For mkdir and create honor setgid bit

on parent directory when server supports Unix Extensions but not POSIX

create. Update cifs.upcall version to handle new Kerberos sec flags

(this requires update of cifs.upcall program from Samba).



Version 1.53

------------

fs/cifs/README

+26 −4
Original line number Diff line number Diff line
@@ -644,6 +644,28 @@ returned success. 
	

Also note that "cat /proc/fs/cifs/DebugData" will display information about

the active sessions and the shares that are mounted.

Enabling Kerberos (extended security) works when CONFIG_CIFS_EXPERIMENTAL is

on but requires a user space helper (from the Samba project). NTLM and NTLMv2 and

LANMAN support do not require this helper.
 


Enabling Kerberos (extended security) works but requires version 1.2 or later

of the helper program cifs.upcall to be present and to be configured in the

/etc/request-key.conf file.  The cifs.upcall helper program is from the Samba

project(http://www.samba.org). NTLM and NTLMv2 and LANMAN support do not

require this helper. Note that NTLMv2 security (which does not require the

cifs.upcall helper program), instead of using Kerberos, is sufficient for

some use cases.



Enabling DFS support (used to access shares transparently in an MS-DFS

global name space) requires that CONFIG_CIFS_EXPERIMENTAL be enabled.  In

addition, DFS support for target shares which are specified as UNC

names which begin with host names (rather than IP addresses) requires

a user space helper (such as cifs.upcall) to be present in order to

translate host names to ip address, and the user space helper must also

be configured in the file /etc/request-key.conf



To use cifs Kerberos and DFS support, the Linux keyutils package should be

installed and something like the following lines should be added to the

/etc/request-key.conf file:



create cifs.spnego * * /usr/local/sbin/cifs.upcall %k

create dns_resolver * * /usr/local/sbin/cifs.upcall %k

fs/cifs/asn1.c

+8 −3
Original line number Diff line number Diff line
@@ -476,6 +476,7 @@ decode_negTokenInit(unsigned char *security_blob, int length, 
	unsigned int cls, con, tag, oidlen, rc;

	bool use_ntlmssp = false;

	bool use_kerberos = false;

	bool use_mskerberos = false;



	*secType = NTLM; /* BB eventually make Kerberos or NLTMSSP the default*/
@@ -574,10 +575,12 @@ decode_negTokenInit(unsigned char *security_blob, int length, 
					 *(oid + 1), *(oid + 2), *(oid + 3)));



				if (compare_oid(oid, oidlen, MSKRB5_OID,

						MSKRB5_OID_LEN))

					use_kerberos = true;

						MSKRB5_OID_LEN) &&

						!use_kerberos)

					use_mskerberos = true;

				else if (compare_oid(oid, oidlen, KRB5_OID,

						     KRB5_OID_LEN))

						     KRB5_OID_LEN) &&

						     !use_mskerberos)

					use_kerberos = true;

				else if (compare_oid(oid, oidlen, NTLMSSP_OID,

						     NTLMSSP_OID_LEN))
@@ -630,6 +633,8 @@ decode_negTokenInit(unsigned char *security_blob, int length, 


	if (use_kerberos)

		*secType = Kerberos;

	else if (use_mskerberos)

		*secType = MSKerberos;

	else if (use_ntlmssp)

		*secType = NTLMSSP;

fs/cifs/cifs_spnego.c

+3 −1
Original line number Diff line number Diff line
@@ -114,9 +114,11 @@ cifs_get_spnego_key(struct cifsSesInfo *sesInfo) 


	dp = description + strlen(description);



	/* for now, only sec=krb5 is valid */

	/* for now, only sec=krb5 and sec=mskrb5 are valid */

	if (server->secType == Kerberos)

		sprintf(dp, ";sec=krb5");

	else if (server->secType == MSKerberos)

		sprintf(dp, ";sec=mskrb5");

	else

		goto out;