diff mbox series

Fix guest smb3.1.1 mounts to Samba

Message ID CAH2r5mvRk9dCu3cwYNrCY8L2jUGR92vKjjiAniMqyPjvzCrV9A@mail.gmail.com (mailing list archive)
State New, archived
Headers show
Series Fix guest smb3.1.1 mounts to Samba | expand

Commit Message

Steve French March 23, 2019, 1:01 a.m. UTC 
Add to Ronnie's patch check for null user so we can handle guest
mounts for 3.1.1 to Samba as well

Comments

Steve French March 23, 2019, 3:35 a.m. UTC | #1 
Version 2 of patch added additional check that it is not krb5 mount
when username is null


On Fri, Mar 22, 2019 at 8:01 PM Steve French <smfrench@gmail.com> wrote:
>
> Add to Ronnie's patch check for null user so we can handle guest
> mounts for 3.1.1 to Samba as well
>
>
>
> --
> Thanks,
>
> Steve
Andreas Hasenack March 23, 2019, 3:36 p.m. UTC | #2 
The current for-next branch (I tested
cf7d624f8dcc9b833a8489208b6ef6dcc5dd308b) worked for me:

root@andreas-disco-cifs:~# mount //localhost/pub /mnt -o guest,vers=3.11
root@andreas-disco-cifs:~# mount -t cifs
//localhost/pub on /mnt type cifs
(rw,relatime,vers=3.1.1,sec=none,cache=strict,uid=0,noforceuid,gid=0,noforcegid,addr=127.0.0.1,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1)

root@andreas-disco-cifs:~# uname -a
Linux andreas-disco-cifs 5.1.0-rc1 #2 SMP Sat Mar 23 15:01:59 UTC 2019
x86_64 x86_64 x86_64 GNU/Linux

On Sat, Mar 23, 2019 at 12:35 AM Steve French <smfrench@gmail.com> wrote:
>
> Version 2 of patch added additional check that it is not krb5 mount
> when username is null
>
>
> On Fri, Mar 22, 2019 at 8:01 PM Steve French <smfrench@gmail.com> wrote:
> >
> > Add to Ronnie's patch check for null user so we can handle guest
> > mounts for 3.1.1 to Samba as well
> >
> >
> >
> > --
> > Thanks,
> >
> > Steve
>
>
>
> --
> Thanks,
>
> Steve
diff mbox series

Patch

From 5f377dd082fe24ced7fd5a8d31d7fac3af5686b9 Mon Sep 17 00:00:00 2001
From: Steve French <stfrench@microsoft.com>
Date: Fri, 22 Mar 2019 19:52:29 -0500
Subject: [PATCH] SMB3: Fix SMB3.1.1 guest mounts to Samba

Workaround problem with Samba responses to SMB3.1.1
null user (guest) mounts.  The server doesn't set the
expected flag in the session setup response so we have
to do a similar check to what is done in smb3_validate_negotiate
where we also check if the user is a null user.

Note that the commit below tightened the conditions and forced signing
for the SMB2-TreeConnect commands as per MS-SMB2.
However, this should only apply to normal user sessions and not for
cases where there is no user (even if server forgets to set the flag
in the response) since we don't have anything useful to sign with.
This is especially important now that the more secure SMB3.1.1 protocol
is in the default dialect list.

An earlier patch ("cifs: allow guest mounts to work for smb3.11") fixed
the guest mounts to Windows.

    Fixes: 6188f28bf608 ("Tree connect for SMB3.1.1 must be signed for non-encrypted shares")

Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
CC: Stable <stable@vger.kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
---
 fs/cifs/smb2pdu.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 8e4a1da95418..4cdf26e39426 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1631,10 +1631,13 @@  SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
 	/*
 	 * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1
 	 * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1
+	 * (Samba servers don't always set the flag so also check if null user)
 	 */
 	if ((ses->server->dialect == SMB311_PROT_ID) &&
 	    !smb3_encryption_required(tcon) &&
-	    !(ses->session_flags & (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)))
+	    !(ses->session_flags &
+		    (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) &&
+	    (ses->user_name != NULL))
 		req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
 
 	memset(&rqst, 0, sizeof(struct smb_rqst));
-- 
2.17.1