Patch "SMB: Validate negotiate (to protect against downgrade) even if signing off" has been added to the 4.13-stable tree

This is a note to let you know that I've just added the patch titled

SMB: Validate negotiate (to protect against downgrade) even if signing off

to the 4.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
smb-validate-negotiate-to-protect-against-downgrade-even-if-signing-off.patch
and it can be found in the queue-4.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Steve French <[email protected]>
Date: Wed, 20 Sep 2017 19:57:18 -0500
Subject: SMB: Validate negotiate (to protect against downgrade) even if signing off

From: Steve French <[email protected]>

commit 0603c96f3af50e2f9299fa410c224ab1d465e0f9 upstream.

As long as signing is supported (ie not a guest user connection) and connection is SMB3 or SMB3.02, then validate negotiate (protect against man in the middle downgrade attacks). We had been doing this only when signing was required, not when signing was just enabled, but this more closely matches recommended SMB3 behavior and is better security. Suggested by Metze.

---
 fs/cifs/smb2pdu.c |   17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

@@ -644,15 +644,22 @@ int smb3_validate_negotiate(const unsign
 
 	/*
 	 * validation ioctl must be signed, so no point sending this if we
-	 * can not sign it.  We could eventually change this to selectively
+	 * can not sign it (ie are not known user).  Even if signing is not
+	 * required (enabled but not negotiated), in those cases we selectively
 	 * sign just this, the first and only signed request on a connection.
-	 * This is good enough for now since a user who wants better security
-	 * would also enable signing on the mount. Having validation of
-	 * negotiate info for signed connections helps reduce attack vectors
+	 * Having validation of negotiate info  helps reduce attack vectors.
 	 */
-	if (tcon->ses->server->sign == false)
+	if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST)
 		return 0; /* validation requires signing */
 
+	if (tcon->ses->user_name == NULL) {
+		cifs_dbg(FYI, "Can't validate negotiate: null user mount\n");
+		return 0; /* validation requires signing */
+	}
+
+	if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL)
+		cifs_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n");
+
 	vneg_inbuf.Capabilities =
 			cpu_to_le32(tcon->ses->server->vals->req_capabilities);
 	memcpy(vneg_inbuf.Guid, tcon->ses->server->client_guid,

Patches currently in stable-queue which might be from [email protected] are

queue-4.13/cifs-release-cifs-root_cred-after-exit_cifs.patch queue-4.13/smb3-warn-user-if-trying-to-sign-connection-that-authenticated-as-guest.patch queue-4.13/smb3-handle-new-statx-fields.patch queue-4.13/smb3-add-support-for-multidialect-negotiate-smb2.1-and-later.patch queue-4.13/smb3-don-t-ignore-o_sync-o_dsync-and-o_direct-flags.patch queue-4.13/fix-smb3.1.1-guest-authentication-to-samba.patch queue-4.13/cifs-release-auth_key.response-for-reconnect.patch queue-4.13/smb3-fix-endian-warning.patch queue-4.13/smb-validate-negotiate-to-protect-against-downgrade-even-if-signing-off.patch queue-4.13/cifs-check-rsp-for-null-before-dereferencing-in-smb2_open.patch