From patchwork Wed Jun 6 23:02:56 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve French X-Patchwork-Id: 10450999 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 95F8860375 for ; Wed, 6 Jun 2018 23:03:21 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 73C0E24BFE for ; Wed, 6 Jun 2018 23:03:21 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6714525EF7; Wed, 6 Jun 2018 23:03:21 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI, T_DKIM_INVALID, T_TVD_MIME_EPI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9130E24BFE for ; Wed, 6 Jun 2018 23:03:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752042AbeFFXDU (ORCPT ); Wed, 6 Jun 2018 19:03:20 -0400 Received: from mail-pf0-f182.google.com ([209.85.192.182]:36004 "EHLO mail-pf0-f182.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752026AbeFFXDT (ORCPT ); Wed, 6 Jun 2018 19:03:19 -0400 Received: by mail-pf0-f182.google.com with SMTP id a12-v6so3872907pfi.3 for ; Wed, 06 Jun 2018 16:03:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=K98YTfNlRV90YN+ph7DAH4aor58fKc51wz20Wo27eBw=; b=IV3VruJi/BGHCM8nHRlUxKTvrXpe5jCubWgaTWWbkQFt7tj50CQHBHMJpu+hB1ErYU 9FqVjq38QMdXbJAbc3nWqYhVZ8FQmqF2I78yFIf2Vt7LvsHBM/PgpPlUxA/VIojcQ6aE PEnZdoKD3MXTCLSXsz5ysAM2e7lDRMYES5p9Pqm8fG84xa7zsW6eKcfomKXJAnyMMnr5 u8d7urt1EIh1b8uqBBfWHpNoURKYN52hcunR/8ZgSdBJQDJFAUW0v/MkA11wTqWNvpKT 534jsXA5d3pNDVPJAep87d3Nh7EtBKs6aXQV4CUkoYQKNkIABEGa15zZB7w8EAvGeXF2 Fv1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=K98YTfNlRV90YN+ph7DAH4aor58fKc51wz20Wo27eBw=; b=JFxdvWAuFQo10TaZIjG2EO0PC9N/c3XgDql2dc3DKeF1TWZfC4zkv9NwdRsSIr7eek ykSO1j/5xSgfo84JoUO5dJLhXy22S3w7XslDrKDljGPIsczj3btXQtPusVbwslSOFMBZ Gr+XcqCwj17fzhQN0tpBRrsYZ204dxVaqFlRUyU4pLIcNA86JO+qQOzbsJqnjPncWEKz 97Vd09dXo0844VeYRHs1u9tyYw/ClPeMUNRBFh2svYDBh0Km458i4/PJdWXISK+N9Z+V CjFvziEemvZdmQ5JWtLZw4dKmQT1tUHUOx65hoLw+IsrcpVJd9utUHetjc325AHVV7Rt 2UyA== X-Gm-Message-State: APt69E293tcopj+5JyQ279jNdoW9frg+7p2K+2GQTrQk6DSz9fGiHxOK PTET4ValF3pGcZyZNx7YYlmGfsLytMIWcAwiajic1A== X-Google-Smtp-Source: ADUXVKI2Uz4zajxuTQxFNk4JH+KMYqtZmKRu6kfcNz7yKee2gNzhsPH7K/WcuwxKIkPRUGkfbR4ZOjbNC9M+PsqcDdo= X-Received: by 2002:aa7:808f:: with SMTP id v15-v6mr2294395pff.38.1528326197389; Wed, 06 Jun 2018 16:03:17 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a17:90a:80cc:0:0:0:0 with HTTP; Wed, 6 Jun 2018 16:02:56 -0700 (PDT) From: Steve French Date: Wed, 6 Jun 2018 18:02:56 -0500 Message-ID: Subject: [PATCH] smb3: do not allow insecure cifs (vers=1.0) mounts if mounting smb3 To: CIFS Cc: Pavel Shilovskiy , ronnie sahlberg , Tom Talpey , =?UTF-8?Q?Aur=C3=A9lien_Aptel?= Sender: linux-cifs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-cifs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Reviewed-by: Ronnie Sahlberg From 8ea0364df15e9ca80c0e586d558319b45431812b Mon Sep 17 00:00:00 2001 From: Steve French Date: Wed, 6 Jun 2018 17:59:29 -0500 Subject: [PATCH] smb3: do not allow insecure cifs mounts when using smb3 if mounting as smb3 do not allow cifs (vers=1.0) or insecure vers=2.0 mounts. For example: root@smf-Thinkpad-P51:~/cifs-2.6# mount -t smb3 //127.0.0.1/scratch /mnt -o username=testuser,password=Testpass1 root@smf-Thinkpad-P51:~/cifs-2.6# umount /mnt root@smf-Thinkpad-P51:~/cifs-2.6# mount -t smb3 //127.0.0.1/scratch /mnt -o username=testuser,password=Testpass1,vers=1.0 mount: /mnt: wrong fs type, bad option, bad superblock on //127.0.0.1/scratch ... root@smf-Thinkpad-P51:~/cifs-2.6# dmesg | grep smb3 [ 4302.200122] CIFS VFS: vers=1.0 (cifs) forbidden with smb3 root@smf-Thinkpad-P51:~/cifs-2.6# mount -t smb3 //127.0.0.1/scratch /mnt -o username=testuser,password=Testpass1,vers=3.11 Signed-off-by: Steve French --- fs/cifs/cifsfs.c | 22 ++++++++++++++++++---- fs/cifs/cifsproto.h | 2 +- fs/cifs/connect.c | 26 +++++++++++++++++--------- 3 files changed, 36 insertions(+), 14 deletions(-) diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c index eb7b6573f322..d5aa7ae917bf 100644 --- a/fs/cifs/cifsfs.c +++ b/fs/cifs/cifsfs.c @@ -698,8 +698,8 @@ static int cifs_set_super(struct super_block *sb, void *data) } static struct dentry * -cifs_do_mount(struct file_system_type *fs_type, - int flags, const char *dev_name, void *data) +cifs_smb3_do_mount(struct file_system_type *fs_type, + int flags, const char *dev_name, void *data, bool is_smb3) { int rc; struct super_block *sb; @@ -710,7 +710,7 @@ cifs_do_mount(struct file_system_type *fs_type, cifs_dbg(FYI, "Devname: %s flags: %d\n", dev_name, flags); - volume_info = cifs_get_volume_info((char *)data, dev_name); + volume_info = cifs_get_volume_info((char *)data, dev_name, is_smb3); if (IS_ERR(volume_info)) return ERR_CAST(volume_info); @@ -790,6 +790,20 @@ cifs_do_mount(struct file_system_type *fs_type, goto out; } +static struct dentry * +smb3_do_mount(struct file_system_type *fs_type, + int flags, const char *dev_name, void *data) +{ + return cifs_smb3_do_mount(fs_type, flags, dev_name, data, true); +} + +static struct dentry * +cifs_do_mount(struct file_system_type *fs_type, + int flags, const char *dev_name, void *data) +{ + return cifs_smb3_do_mount(fs_type, flags, dev_name, data, false); +} + static ssize_t cifs_loose_read_iter(struct kiocb *iocb, struct iov_iter *iter) { @@ -925,7 +939,7 @@ MODULE_ALIAS_FS("cifs"); static struct file_system_type smb3_fs_type = { .owner = THIS_MODULE, .name = "smb3", - .mount = cifs_do_mount, + .mount = smb3_do_mount, .kill_sb = cifs_kill_sb, /* .fs_flags */ }; diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h index 84765c8764bf..4e0d183c3d10 100644 --- a/fs/cifs/cifsproto.h +++ b/fs/cifs/cifsproto.h @@ -211,7 +211,7 @@ extern int cifs_setup_cifs_sb(struct smb_vol *pvolume_info, extern int cifs_match_super(struct super_block *, void *); extern void cifs_cleanup_volume_info(struct smb_vol *pvolume_info); extern struct smb_vol *cifs_get_volume_info(char *mount_data, - const char *devname); + const char *devname, bool is_smb3); extern int cifs_mount(struct cifs_sb_info *, struct smb_vol *); extern void cifs_umount(struct cifs_sb_info *); extern void cifs_mark_open_files_invalid(struct cifs_tcon *tcon); diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index e5a2fe7f0dd4..88c9d6fc539b 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -320,7 +320,7 @@ static int generic_ip_connect(struct TCP_Server_Info *server); static void tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink); static void cifs_prune_tlinks(struct work_struct *work); static int cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data, - const char *devname); + const char *devname, bool is_smb3); /* * cifs tcp session reconnection @@ -1166,7 +1166,7 @@ cifs_parse_cache_flavor(char *value, struct smb_vol *vol) } static int -cifs_parse_smb_version(char *value, struct smb_vol *vol) +cifs_parse_smb_version(char *value, struct smb_vol *vol, bool is_smb3) { substring_t args[MAX_OPT_ARGS]; @@ -1176,6 +1176,10 @@ cifs_parse_smb_version(char *value, struct smb_vol *vol) cifs_dbg(VFS, "mount with legacy dialect disabled\n"); return 1; } + if (is_smb3) { + cifs_dbg(VFS, "vers=1.0 (cifs) forbidden with smb3\n"); + return 1; + } vol->ops = &smb1_operations; vol->vals = &smb1_values; break; @@ -1184,6 +1188,10 @@ cifs_parse_smb_version(char *value, struct smb_vol *vol) cifs_dbg(VFS, "mount with legacy dialect disabled\n"); return 1; } + if (is_smb3) { + cifs_dbg(VFS, "vers=2.0 forbidden with smb3\n"); + return 1; + } vol->ops = &smb20_operations; vol->vals = &smb20_values; break; @@ -1272,7 +1280,7 @@ cifs_parse_devname(const char *devname, struct smb_vol *vol) static int cifs_parse_mount_options(const char *mountdata, const char *devname, - struct smb_vol *vol) + struct smb_vol *vol, bool is_smb3) { char *data, *end; char *mountdata_copy = NULL, *options; @@ -1985,7 +1993,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname, if (string == NULL) goto out_nomem; - if (cifs_parse_smb_version(string, vol) != 0) + if (cifs_parse_smb_version(string, vol, is_smb3) != 0) goto cifs_parse_mount_err; got_version = true; break; @@ -3803,7 +3811,7 @@ expand_dfs_referral(const unsigned int xid, struct cifs_ses *ses, } else { cleanup_volume_info_contents(volume_info); rc = cifs_setup_volume_info(volume_info, mdata, - fake_devname); + fake_devname, false); } kfree(fake_devname); kfree(cifs_sb->mountdata); @@ -3816,11 +3824,11 @@ expand_dfs_referral(const unsigned int xid, struct cifs_ses *ses, static int cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data, - const char *devname) + const char *devname, bool is_smb3) { int rc = 0; - if (cifs_parse_mount_options(mount_data, devname, volume_info)) + if (cifs_parse_mount_options(mount_data, devname, volume_info, is_smb3)) return -EINVAL; if (volume_info->nullauth) { @@ -3854,7 +3862,7 @@ cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data, } struct smb_vol * -cifs_get_volume_info(char *mount_data, const char *devname) +cifs_get_volume_info(char *mount_data, const char *devname, bool is_smb3) { int rc; struct smb_vol *volume_info; @@ -3863,7 +3871,7 @@ cifs_get_volume_info(char *mount_data, const char *devname) if (!volume_info) return ERR_PTR(-ENOMEM); - rc = cifs_setup_volume_info(volume_info, mount_data, devname); + rc = cifs_setup_volume_info(volume_info, mount_data, devname, is_smb3); if (rc) { cifs_cleanup_volume_info(volume_info); volume_info = ERR_PTR(rc); -- 2.17.1