Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ef3f2de2 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6 

* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
  [CIFS] DFS build fixes
  [CIFS] DFS support: provide shrinkable mounts
  [CIFS] Do not log path names in lookup errors
  [CIFS] DFS support patchset: Added mountdata
  [CIFS] Forgot to add two new files from previous commit
  [CIFS] DNS name resolution helper upcall for cifs
  [CIFS] fix checkpatch warnings in fs/cifs/inode.c
  [CIFS] hold ses sem on tcp session reconnect during mount
  [CIFS] Allow setting mode via cifs acl
  [CIFS]  fix unicode string alignment in SPNEGO setup
  [CIFS] cifs_partialpagewrite() cleanup
  [CIFS]  use krb5 session key from first SMB session after a NegProt
  [CIFS] redo existing session setup if needed in cifs_mount
  [CIFS] Only dump SPNEGO key if CONFIG_CIFS_DEBUG2 is set
  [CIFS] fix SetEA failure to some Samba versions
parents 1c7c2cde 366781c1

fs/Kconfig

+26 −13
Original line number Diff line number Diff line
@@ -1899,13 +1899,15 @@ config CIFS 
	  file servers such as Windows 2000 (including Windows 2003, NT 4  

	  and Windows XP) as well by Samba (which provides excellent CIFS

	  server support for Linux and many other operating systems). Limited

	  support for OS/2 and Windows ME and similar servers is provided as well.



	  The intent of the cifs module is to provide an advanced

	  network file system client for mounting to CIFS compliant servers,

	  including support for dfs (hierarchical name space), secure per-user

	  session establishment, safe distributed caching (oplock), optional

	  packet signing, Unicode and other internationalization improvements. 

	  support for OS/2 and Windows ME and similar servers is provided as

	  well.



	  The cifs module provides an advanced network file system

	  client for mounting to CIFS compliant servers.  It includes

	  support for DFS (hierarchical name space), secure per-user

	  session establishment via Kerberos or NTLM or NTLMv2,

	  safe distributed caching (oplock), optional packet

	  signing, Unicode and other internationalization improvements.

	  If you need to mount to Samba or Windows from this machine, say Y.



config CIFS_STATS
@@ -1937,7 +1939,8 @@ config CIFS_WEAK_PW_HASH 
	  (since 1997) support stronger NTLM (and even NTLMv2 and Kerberos)

	  security mechanisms. These hash the password more securely

	  than the mechanisms used in the older LANMAN version of the

          SMB protocol needed to establish sessions with old SMB servers.

	  SMB protocol but LANMAN based authentication is needed to

	  establish sessions with some old SMB servers.



	  Enabling this option allows the cifs module to mount to older

	  LANMAN based servers such as OS/2 and Windows 95, but such
@@ -1945,8 +1948,8 @@ config CIFS_WEAK_PW_HASH 
	  security mechanisms if you are on a public network.  Unless you

	  have a need to access old SMB servers (and are on a private 

	  network) you probably want to say N.  Even if this support

	  is enabled in the kernel build, they will not be used

	  automatically. At runtime LANMAN mounts are disabled but

	  is enabled in the kernel build, LANMAN authentication will not be

	  used automatically. At runtime LANMAN mounts are disabled but

	  can be set to required (or optional) either in

	  /proc/fs/cifs (see fs/cifs/README for more detail) or via an

	  option on the mount command. This support is disabled by
@@ -2012,12 +2015,22 @@ config CIFS_UPCALL 
	  depends on CIFS_EXPERIMENTAL

	  depends on KEYS

	  help

	    Enables an upcall mechanism for CIFS which will be used to contact

	    userspace helper utilities to provide SPNEGO packaged Kerberos

	    tickets which are needed to mount to certain secure servers

	    Enables an upcall mechanism for CIFS which accesses

	    userspace helper utilities to provide SPNEGO packaged (RFC 4178)

	    Kerberos tickets which are needed to mount to certain secure servers

	    (for which more secure Kerberos authentication is required). If

	    unsure, say N.



config CIFS_DFS_UPCALL

	  bool "DFS feature support (EXPERIMENTAL)"

	  depends on CIFS_EXPERIMENTAL

	  depends on KEYS

	  help

	    Enables an upcall mechanism for CIFS which contacts userspace

	    helper utilities to provide server name resolution (host names to

	    IP addresses) which is needed for implicit mounts of DFS junction

	    points. If unsure, say N.



config NCP_FS

	tristate "NCP file system support (to mount NetWare volumes)"

	depends on IPX!=n || INET

fs/cifs/CHANGES

+4 −1
Original line number Diff line number Diff line
@@ -3,7 +3,10 @@ Version 1.52 
Fix oops on second mount to server when null auth is used.

Enable experimental Kerberos support.  Return writebehind errors on flush

and sync so that events like out of disk space get reported properly on

cached files.

cached files. Fix setxattr failure to certain Samba versions. Fix mount

of second share to disconnected server session (autoreconnect on this).

Add ability to modify cifs acls for handling chmod (when mounted with

cifsacl flag).



Version 1.51

------------

fs/cifs/Makefile

+2 −0
Original line number Diff line number Diff line
@@ -9,3 +9,5 @@ cifs-y := cifsfs.o cifssmb.o cifs_debug.o connect.o dir.o file.o inode.o \ 
	  readdir.o ioctl.o sess.o export.o cifsacl.o



cifs-$(CONFIG_CIFS_UPCALL) += cifs_spnego.o



cifs-$(CONFIG_CIFS_DFS_UPCALL) += dns_resolve.o cifs_dfs_ref.o

fs/cifs/README

+17 −11
Original line number Diff line number Diff line
@@ -56,7 +56,8 @@ the CIFS VFS web site) copy it to the same directory in which mount.smbfs and 
similar files reside (usually /sbin).  Although the helper software is not  

required, mount.cifs is recommended.  Eventually the Samba 3.0 utility program 

"net" may also be helpful since it may someday provide easier mount syntax for

users who are used to Windows e.g.  net use <mount point> <UNC name or cifs URL>

users who are used to Windows e.g.

	net use <mount point> <UNC name or cifs URL>

Note that running the Winbind pam/nss module (logon service) on all of your

Linux clients is useful in mapping Uids and Gids consistently across the

domain to the proper network user.  The mount.cifs mount helper can be
@@ -248,7 +249,7 @@ A partial list of the supported mount options follows: 
		the CIFS session.

  password	The user password.  If the mount helper is

		installed, the user will be prompted for password

		if it is not supplied.

		if not supplied.

  ip		The ip address of the target server

  unc		The target server Universal Network Name (export) to 

		mount.
@@ -283,7 +284,7 @@ A partial list of the supported mount options follows: 
		can be enabled by specifying file_mode and dir_mode on 

		the client.  Note that the mount.cifs helper must be

		at version 1.10 or higher to support specifying the uid

		(or gid) in non-numberic form.

		(or gid) in non-numeric form.

  gid		Set the default gid for inodes (similar to above).

  file_mode     If CIFS Unix extensions are not supported by the server

		this overrides the default mode for file inodes.
@@ -417,9 +418,10 @@ A partial list of the supported mount options follows: 
  acl   	Allow setfacl and getfacl to manage posix ACLs if server

		supports them.  (default)

  noacl 	Do not allow setfacl and getfacl calls on this mount

  user_xattr    Allow getting and setting user xattrs as OS/2 EAs (extended

		attributes) to the server (default) e.g. via setfattr 

		and getfattr utilities. 

  user_xattr    Allow getting and setting user xattrs (those attributes whose

		name begins with "user." or "os2.") as OS/2 EAs (extended

		attributes) to the server.  This allows support of the

		setfattr and getfattr utilities. (default)

  nouser_xattr  Do not allow getfattr/setfattr to get/set/list xattrs 

  mapchars      Translate six of the seven reserved characters (not backslash)

			*?<>|:
@@ -434,6 +436,7 @@ A partial list of the supported mount options follows: 
 nomapchars     Do not translate any of these seven characters (default).

 nocase         Request case insensitive path name matching (case

		sensitive is the default if the server suports it).

		(mount option "ignorecase" is identical to "nocase")

 posixpaths     If CIFS Unix extensions are supported, attempt to

		negotiate posix path name support which allows certain

		characters forbidden in typical CIFS filenames, without
@@ -485,6 +488,9 @@ A partial list of the supported mount options follows: 
			ntlmv2i Use NTLMv2 password hashing with packet signing

			lanman  (if configured in kernel config) use older

				lanman hash

hard		Retry file operations if server is not responding

soft		Limit retries to unresponsive servers (usually only

		one retry) before returning an error.  (default)



The mount.cifs mount helper also accepts a few mount options before -o

including:
@@ -535,8 +541,8 @@ SecurityFlags Flags which control security negotiation and 
			must use NTLM					0x02002

			may use NTLMv2					0x00004

			must use NTLMv2					0x04004

			may use Kerberos security (not implemented yet) 0x00008

			must use Kerberos (not implemented yet)         0x08008

			may use Kerberos security			0x00008

			must use Kerberos				0x08008

			may use lanman (weak) password hash  		0x00010

			must use lanman password hash			0x10010

			may use plaintext passwords    			0x00020
@@ -626,6 +632,6 @@ returned success. 
	

Also note that "cat /proc/fs/cifs/DebugData" will display information about 

the active sessions and the shares that are mounted.

Enabling Kerberos (extended security) works when CONFIG_CIFS_EXPERIMENTAL is enabled

but requires a user space helper (from the Samba project). NTLM and NTLMv2 and

LANMAN support do not require this helpr.
 
Enabling Kerberos (extended security) works when CONFIG_CIFS_EXPERIMENTAL is

on but requires a user space helper (from the Samba project). NTLM and NTLMv2 and

LANMAN support do not require this helper.

fs/cifs/TODO

+6 −8
Original line number Diff line number Diff line 
Version 1.49 April 26, 2007

Version 1.52 January 3, 2008



A Partial List of Missing Features

==================================
@@ -16,16 +16,14 @@ SecurityDescriptors 
c) Better pam/winbind integration (e.g. to handle uid mapping

better)



d) Verify that Kerberos signing works



e) Cleanup now unneeded SessSetup code in

d) Cleanup now unneeded SessSetup code in

fs/cifs/connect.c and add back in NTLMSSP code if any servers

need it



f) MD5-HMAC signing SMB PDUs when SPNEGO style SessionSetup 

used (Kerberos or NTLMSSP). Signing alreadyimplemented for NTLM

and raw NTLMSSP already. This is important when enabling

extended security and mounting to Windows 2003 Servers

e) ms-dfs and ms-dfs host name resolution cleanup



f) fix NTLMv2 signing when two mounts with different users to same

server.



g) Directory entry caching relies on a 1 second timer, rather than 

using FindNotify or equivalent.  - (started)