Patch "SMB3: Add support for multidialect negotiate (SMB2.1 and later)" has been added to the 4.13-stable tree
This is a note to let you know that I've just added the patch titled
SMB3: Add support for multidialect negotiate (SMB2.1 and later)
to the 4.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
smb3-add-support-for-multidialect-negotiate-smb2.1-and-later.patch
and it can be found in the queue-4.13 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From
9764c02fcbad40001fd3f63558d918e4d519bb75Mon Sep 17 00:00:00 2001
From: Steve French <[email protected]>
Date: Sun, 17 Sep 2017 10:41:35 -0500
Subject: SMB3: Add support for multidialect negotiate (SMB2.1 and later)
From: Steve French <[email protected]>
commit 9764c02fcbad40001fd3f63558d918e4d519bb75 upstream.
With the need to discourage use of less secure dialect, SMB1 (CIFS), we temporarily upgraded the dialect to SMB3 in 4.13, but since there are various servers which only support SMB2.1 (2.1 is more secure than CIFS/SMB1) but not optimal for a default dialect - add support for multidialect negotiation. cifs.ko will now request SMB2.1 or later (ie SMB2.1 or SMB3.0, SMB3.02) and the server will pick the latest most secure one it can support.
In addition since we are sending multidialect negotiate, add support for secure negotiate to validate that a man in the middle didn't downgrade us.
--- fs/cifs/cifsglob.h | 6 +++ fs/cifs/connect.c | 24 ++++++++++---- fs/cifs/smb2ops.c | 40 ++++++++++++++++++++++++ fs/cifs/smb2pdu.c | 85 ++++++++++++++++++++++++++++++++++++++++++++++------- fs/cifs/smb2pdu.h | 2 - 5 files changed, 139 insertions(+), 18 deletions(-)
fs/cifs/cifsglob.h +6 -0
@@ -188,6 +188,8 @@ enum smb_version {#ifdef CONFIG_CIFS_SMB311 Smb_311, #endif /* SMB311 */ + Smb_3any, + Smb_default, Smb_version_err };
@@ -1701,6 +1703,10 @@ extern struct smb_version_values smb20_v#define SMB21_VERSION_STRING "2.1"extern struct smb_version_operations smb21_operations;extern struct smb_version_values smb21_values; +#define SMBDEFAULT_VERSION_STRING "default" +extern struct smb_version_values smbdefault_values; +#define SMB3ANY_VERSION_STRING "3" +extern struct smb_version_values smb3any_values;#define SMB30_VERSION_STRING "3.0"extern struct smb_version_operations smb30_operations;extern struct smb_version_values smb30_values;
fs/cifs/connect.c +17 -7
@@ -301,6 +301,8 @@ static const match_table_t cifs_smb_vers { Smb_311, SMB311_VERSION_STRING }, { Smb_311, ALT_SMB311_VERSION_STRING }, #endif /* SMB311 */ + { Smb_3any, SMB3ANY_VERSION_STRING }, + { Smb_default, SMBDEFAULT_VERSION_STRING }, { Smb_version_err, NULL } };
@@ -1147,6 +1149,14 @@ cifs_parse_smb_version(char *value, stru vol->vals = &smb311_values;break ;#endif /* SMB311 */ +case Smb_3any: + vol->ops = &smb30_operations;/* currently identical with 3.0 */ + vol->vals = &smb3any_values; +break ; +case Smb_default: + vol->ops = &smb30_operations;/* currently identical with 3.0 */ + vol->vals = &smbdefault_values; +break ;default :cifs_dbg (VFS ,"Unknown vers= option specified: %s\n" , value);return 1 ;
@@ -1273,9 +1283,9 @@ cifs_parse_mount_options(const char *mou vol->actimeo =CIFS_DEF_ACTIMEO ; -/* FIXME: add autonegotiation for SMB3 or later rather than just SMB3 */ - vol->ops = &smb30_operations;/* both secure and accepted widely */ - vol->vals = &smb30_values; +/* offer SMB2.1 and later (SMB3 etc). Secure and widely accepted */ + vol->ops = &smb30_operations; + vol->vals = &smbdefault_values; vol->echo_interval =SMB_ECHO_INTERVAL_DEFAULT ;
@@ -1987,11 +1997,10 @@ cifs_parse_mount_options(const char *mouif (got_version == false)pr_warn ("No dialect specified on mount. Default has changed to " -"a more secure dialect, SMB3 (vers=3.0), from CIFS " +"a more secure dialect, SMB2.1 or later (e.g. SMB3), from CIFS " "(SMB1). To use the less secure SMB1 dialect to access " -"old servers which do not support SMB3 specify vers=1.0" -" on mount. For somewhat newer servers such as Windows " -"7 try vers=2.1.\n" ); +"old servers which do not support SMB3 (or SMB2.1) specify vers=1.0" +" on mount.\n" );kfree (mountdata_copy);return 0 ;
@@ -2132,6 +2141,7 @@ static int match_server(struct TCP_Serveif (vol->nosharesock)return 0 ; +/* BB update this for smb3any and default case */ if ((server->vals != vol->vals) || (server->ops != vol->ops))return 0 ;
fs/cifs/smb2ops.c +40 -0
@@ -2906,6 +2906,46 @@ struct smb_version_values smb21_values = .create_lease_size = sizeof(struct create_lease), }; +struct smb_version_values smb3any_values = { + .version_string =SMB3ANY_VERSION_STRING , + .protocol_id =SMB302_PROT_ID ,/* doesn't matter, send protocol array */ + .req_capabilities =SMB2_GLOBAL_CAP_DFS |SMB2_GLOBAL_CAP_LEASING |SMB2_GLOBAL_CAP_LARGE_MTU |SMB2_GLOBAL_CAP_PERSISTENT_HANDLES |SMB2_GLOBAL_CAP_ENCRYPTION , + .large_lock_type =0 , + .exclusive_lock_type =SMB2_LOCKFLAG_EXCLUSIVE_LOCK , + .shared_lock_type =SMB2_LOCKFLAG_SHARED_LOCK , + .unlock_lock_type =SMB2_LOCKFLAG_UNLOCK , + .header_size =sizeof (struct smb2_hdr ), + .max_header_size =MAX_SMB2_HDR_SIZE , + .read_rsp_size =sizeof (struct smb2_read_rsp ) -1 , + .lock_cmd =SMB2_LOCK , + .cap_unix =0 , + .cap_nt_find =SMB2_NT_FIND , + .cap_large_files =SMB2_LARGE_FILES , + .signing_enabled =SMB2_NEGOTIATE_SIGNING_ENABLED |SMB2_NEGOTIATE_SIGNING_REQUIRED , + .signing_required =SMB2_NEGOTIATE_SIGNING_REQUIRED , + .create_lease_size =sizeof (struct create_lease_v2 ), +}; + +struct smb_version_values smbdefault_values = { + .version_string =SMBDEFAULT_VERSION_STRING , + .protocol_id =SMB302_PROT_ID ,/* doesn't matter, send protocol array */ + .req_capabilities =SMB2_GLOBAL_CAP_DFS |SMB2_GLOBAL_CAP_LEASING |SMB2_GLOBAL_CAP_LARGE_MTU |SMB2_GLOBAL_CAP_PERSISTENT_HANDLES |SMB2_GLOBAL_CAP_ENCRYPTION , + .large_lock_type =0 , + .exclusive_lock_type =SMB2_LOCKFLAG_EXCLUSIVE_LOCK , + .shared_lock_type =SMB2_LOCKFLAG_SHARED_LOCK , + .unlock_lock_type =SMB2_LOCKFLAG_UNLOCK , + .header_size =sizeof (struct smb2_hdr ), + .max_header_size =MAX_SMB2_HDR_SIZE , + .read_rsp_size =sizeof (struct smb2_read_rsp ) -1 , + .lock_cmd =SMB2_LOCK , + .cap_unix =0 , + .cap_nt_find =SMB2_NT_FIND , + .cap_large_files =SMB2_LARGE_FILES , + .signing_enabled =SMB2_NEGOTIATE_SIGNING_ENABLED |SMB2_NEGOTIATE_SIGNING_REQUIRED , + .signing_required =SMB2_NEGOTIATE_SIGNING_REQUIRED , + .create_lease_size =sizeof (struct create_lease_v2 ), +}; +struct smb_version_values smb30_values = { .version_string =SMB30_VERSION_STRING , .protocol_id =SMB30_PROT_ID ,
fs/cifs/smb2pdu.c +75 -10
122 lines not on this page · raw message
fs/cifs/smb2pdu.h +1 -1
@@ -716,7 +716,7 @@ struct validate_negotiate_info_req {__u8 Guid[SMB2_CLIENT_GUID_SIZE ];__le16 SecurityMode;__le16 DialectCount; -__le16 Dialects[1 ];/* dialect (someday maybe list) client asked for */ +__le16 Dialects[3 ];/* BB expand this if autonegotiate > 3 dialects */ } __packed;struct validate_negotiate_info_rsp {
Patches currently in stable-queue which might be from [email protected] are
queue-4.13/cifs-release-cifs-root_cred-after-exit_cifs.patch queue-4.13/smb3-add-support-for-multidialect-negotiate-smb2.1-and-later.patch queue-4.13/cifs-check-rsp-for-null-before-dereferencing-in-smb2_open.patch queue-4.13/cifs-release-auth_key.response-for-reconnect.patch