Attachment 176601 Details for Bug 253315 – patch -- fix signing mount options

[patch] patch -- fix signing mount options

linux-2.6.18-cifs-sign-option-fix.patch (text/plain), 4.19 KB, created by Jeff Layton on 2007-08-28 13:51:27 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jeff Layton

Created: 2007-08-28 13:51:27 UTC

Size: 4.19 KB

patch

obsolete

>--- linux-2.6.18.noarch/fs/cifs/cifs_debug.c.~1~
>+++ linux-2.6.18.noarch/fs/cifs/cifs_debug.c
>@@ -895,90 +895,14 @@ security_flags_write(struct file *file, 
> 	}
> 	/* flags look ok - update the global security flags for cifs module */
> 	extended_security = flags;
>+	if (extended_security & CIFSSEC_MUST_SIGN) {
>+		/* requiring signing implies signing is allowed */
>+		extended_security |= CIFSSEC_MAY_SIGN;
>+		cFYI(1, ("packet signing now required"));
>+	} else if ((extended_security & CIFSSEC_MAY_SIGN) == 0) {
>+		cFYI(1, ("packet signing disabled"));
>+	}
>+	/* BB should we turn on MAY flags for other MUST options? */
> 	return count;
> }
>-
>-/* static int
>-ntlmv2_enabled_read(char *page, char **start, off_t off,
>-		       int count, int *eof, void *data)
>-{
>-	int len;
>-
>-	len = sprintf(page, "%d\n", ntlmv2_support);
>-
>-	len -= off;
>-	*start = page + off;
>-
>-	if (len > count)
>-		len = count;
>-	else
>-		*eof = 1;
>-
>-	if (len < 0)
>-		len = 0;
>-
>-	return len;
>-}
>-static int
>-ntlmv2_enabled_write(struct file *file, const char __user *buffer,
>-			unsigned long count, void *data)
>-{
>-	char c;
>-	int rc;
>-
>-	rc = get_user(c, buffer);
>-	if (rc)
>-		return rc;
>-	if (c == '0' || c == 'n' || c == 'N')
>-		ntlmv2_support = 0;
>-	else if (c == '1' || c == 'y' || c == 'Y')
>-		ntlmv2_support = 1;
>-	else if (c == '2')
>-		ntlmv2_support = 2;
>-
>-	return count;
>-}
>-
>-static int
>-packet_signing_enabled_read(char *page, char **start, off_t off,
>-		       int count, int *eof, void *data)
>-{
>-	int len;
>-
>-	len = sprintf(page, "%d\n", sign_CIFS_PDUs);
>-
>-	len -= off;
>-	*start = page + off;
>-
>-	if (len > count)
>-		len = count;
>-	else
>-		*eof = 1;
>-
>-	if (len < 0)
>-		len = 0;
>-
>-	return len;
>-}
>-static int
>-packet_signing_enabled_write(struct file *file, const char __user *buffer,
>-			unsigned long count, void *data)
>-{
>-	char c;
>-	int rc;
>-
>-	rc = get_user(c, buffer);
>-	if (rc)
>-		return rc;
>-	if (c == '0' || c == 'n' || c == 'N')
>-		sign_CIFS_PDUs = 0;
>-	else if (c == '1' || c == 'y' || c == 'Y')
>-		sign_CIFS_PDUs = 1;
>-	else if (c == '2')
>-		sign_CIFS_PDUs = 2;
>-
>-	return count;
>-} */
>-
>-
> #endif
>--- linux-2.6.18.noarch/fs/cifs/cifssmb.c.~1~
>+++ linux-2.6.18.noarch/fs/cifs/cifssmb.c
>@@ -411,11 +411,11 @@ CIFSSMBNegotiate(unsigned int xid, struc
> 
> 	/* if any of auth flags (ie not sign or seal) are overriden use them */
> 	if(ses->overrideSecFlg & (~(CIFSSEC_MUST_SIGN | CIFSSEC_MUST_SEAL)))
>-		secFlags = ses->overrideSecFlg;
>+		secFlags = ses->overrideSecFlg;  /* BB FIXME fix sign flags? */
> 	else /* if override flags set only sign/seal OR them with global auth */
> 		secFlags = extended_security | ses->overrideSecFlg;
> 
>-	cFYI(1,("secFlags 0x%x",secFlags));
>+	cFYI(1, ("secFlags 0x%x", secFlags));
> 
> 	pSMB->hdr.Mid = GetNextMid(server);
> 	pSMB->hdr.Flags2 |= SMBFLG2_UNICODE;
>@@ -582,22 +582,33 @@ CIFSSMBNegotiate(unsigned int xid, struc
> #ifdef CONFIG_CIFS_WEAK_PW_HASH
> signing_check:
> #endif
>-	if(sign_CIFS_PDUs == FALSE) {        
>+	if ((secFlags & CIFSSEC_MAY_SIGN) == 0) {
>+		/* MUST_SIGN already includes the MAY_SIGN FLAG
>+		   so if this is zero it means that signing is disabled */
>+		cFYI(1, ("Signing disabled"));
> 		if(server->secMode & SECMODE_SIGN_REQUIRED)
>-			cERROR(1,("Server requires "
>-				 "/proc/fs/cifs/PacketSigningEnabled to be on"));
>+			cERROR(1, ("Server requires "
>+				   "/proc/fs/cifs/PacketSigningEnabled "
>+				   "to be on"));
> 		server->secMode &= 
> 			~(SECMODE_SIGN_ENABLED | SECMODE_SIGN_REQUIRED);
>-	} else if(sign_CIFS_PDUs == 1) {
>+	} else if ((secFlags & CIFSSEC_MUST_SIGN) == CIFSSEC_MUST_SIGN) {
>+		/* signing required */
>+		cFYI(1, ("Must sign - segFlags 0x%x", secFlags));
>+		if ((server->secMode &
>+			(SECMODE_SIGN_ENABLED | SECMODE_SIGN_REQUIRED)) == 0) {
>+			cERROR(1,
>+				("signing required but server lacks support"));
>+			rc = -EOPNOTSUPP;
>+		} else
>+			server->secMode |= SECMODE_SIGN_REQUIRED;
>+	} else {
>+		/* signing optional ie CIFSSEC_MAY_SIGN */
> 		if((server->secMode & SECMODE_SIGN_REQUIRED) == 0)
> 			server->secMode &= 
> 				~(SECMODE_SIGN_ENABLED | SECMODE_SIGN_REQUIRED);
>-	} else if(sign_CIFS_PDUs == 2) {
>-		if((server->secMode & 
>-			(SECMODE_SIGN_ENABLED | SECMODE_SIGN_REQUIRED)) == 0) {
>-			cERROR(1,("signing required but server lacks support"));
>-		}
> 	}
>+	
> neg_err_exit:	
> 	cifs_buf_release(pSMB);
>

Actions: View | Diff

Attachments on bug 253315: 176061 | 176601