From patchwork Tue Jan 28 07:13:14 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve French X-Patchwork-Id: 13952098 Received: from mail-lf1-f48.google.com (mail-lf1-f48.google.com [209.85.167.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D94381C878E for ; Tue, 28 Jan 2025 07:13:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738048410; cv=none; b=aFf2GscAu2vJYYrlsbjcaanEbsEqS8SAdhjOW2j1muixBoSNxx8T97+R3cfQsBXpfF70Jpz5cNbcuJDJLTrbk3Tzasjsgk6uRQfbq6gq8ZE8T5Vd/i6i+ICZkpvQcQcI0QBj04hoNPXTrSZUtCbpduDqnodSNNRjfwBBJfEBids= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738048410; c=relaxed/simple; bh=5U+q8G47oNRn/ewSSC7hApC27P6RL4NTAgE+ob+bYmE=; h=MIME-Version:From:Date:Message-ID:Subject:To:Content-Type; b=iduuAvlETHvtsYwb6qZz+S3D70iM8pi3/sNeB0SKtPYFr0HsDtYNMHNyclGvshZ1tKPmeDOas3R/u0+XywF9kMDIjYuDBn8YA6/Z61HTwfisZmiYk1TthElxOYMuq3QRr6SeHdj89f6+p12ZbBk3lO9nAeMUbtnJpMSPgjNQK98= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mwnPjy3C; arc=none smtp.client-ip=209.85.167.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mwnPjy3C" Received: by mail-lf1-f48.google.com with SMTP id 2adb3069b0e04-540254357c8so5312120e87.1 for ; Mon, 27 Jan 2025 23:13:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1738048406; x=1738653206; darn=vger.kernel.org; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=WusTfgPBKYdPXO28CMdbQyIwxw9Tkvpu+VYEDGlZQyQ=; b=mwnPjy3CE1wAFNCfJXnoui5JRpTVyCD7rpySHYYT2J8dD3O1JTIdE+COO0u+Z1iFa1 lRI9SyeEjbRIE+WuCcshYb4+46CHoOZwaHbkrhjzaWcEpZxtvyb5/TssXaruLdftsclg 0aS8J1kvJQhiRbwwJ7hzaV4rAtBXN61UjzI9HU0sZhcM5V6s1LiFXMsgN52nAsnxsbZs pO++iaV3t+brGRfaUrgz2NxeD+fBZyUIIW1ycLGnszQ7MkYC3KnqRJBFu+juqSCVnP9t Hm8dVEwV3DsJe+FDG2agS4hrf17XhuDUyz+YzKgimoFqKkXSCp2YkfB0dBedfG2VFRzJ UAow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1738048406; x=1738653206; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=WusTfgPBKYdPXO28CMdbQyIwxw9Tkvpu+VYEDGlZQyQ=; b=c125pCrf19zPLLF7iGfV8M+j5q24laq9crsYnEbGlR1dIHfbwdr1KeZFFlMMjyfj5j enD5qSjhJJw5KPXXW11yjzz3W9B9QuUdtfaAH51R+HsshSepvs5SJdvxQi9mVo4I72FR tBBCFm4TdY16QsAmuAlCx2XrJsK4CiCmi4f43yj6uHIcA/EpWp+PTspJGDTTdAZeDQUD 4S2GOCfnV2H7rY+8nTvMHrWEsmpQEp8SEIAJosUi35NBPkbC3EDetzdobU7l4ue2kOfe Y7u8VekFFdqgaqwAsVgbPWzzhyHsVd6oJtlSyuBja1PE/jWKSK9vHNsutN8Bc0GoGbMM 8FjQ== X-Gm-Message-State: AOJu0YwgZJzuaePKv1m/YrQYpr3LU4DyRKhlr/SiAG/gdkwvjJZ7vhoS spE+p6f4kjzei/EKUXRzGsbPsJCIN1H8s6SAdd9H0QNP9xjquIWWoLl+Pi5soEHYqaKsv+TxmxI VSiOSWt49NEoYoNvP+LgyJanlqisGvn30 X-Gm-Gg: ASbGncv+xvYpZFun3q2opnqSzg8xDe8EYGFjLU9sd9HYr2byYrJXA9wSG9j4Pfc0M76 f5ixVPFFo1JgjgTZvPZ/McgF+wxpEYZmLUs59XA77I/Oegc/yJdxBBbNn76CLru/1d7B+OBHcB/ 6Sml7x24oblKaWIQgLQKa3sNEnlPAKITE= X-Google-Smtp-Source: AGHT+IHpnD3Jykh2NVNzhMAIMj3SA4VjCmtgIAevK5z3WKsdC0sDcs3lciRMCz2uMPEok9tSY4wLBK3eQPeyV2nICb8= X-Received: by 2002:a05:6512:2346:b0:53e:23ec:b2e7 with SMTP id 2adb3069b0e04-5439c2805f9mr16949223e87.34.1738048405980; Mon, 27 Jan 2025 23:13:25 -0800 (PST) Precedence: bulk X-Mailing-List: linux-cifs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Steve French Date: Tue, 28 Jan 2025 01:13:14 -0600 X-Gm-Features: AWEUYZlQViSD1GYJ0S4TtC3UGoP482C6Dvz7VN2iCBkZw-Eu1oqzj9CvCS0YZX0 Message-ID: Subject: [PATCH][SMB3 client] allow us to get kerberos ticket when server advertises IAKerb To: CIFS There are now more servers which advertise support for IAKerb (passthrough Kerberos authentication via proxy). IAKerb is a public extension industry standard Kerberos protocol that allows a client without line-of-sight to a Domain Controller to authenticate. There can be cases where we would fail to mount if the server only advertises the OID for IAKerb in SPNEGO/GSSAPI. Add code to allow us to still upcall to userspace in these cases to obtain the Kerberos ticket. See attached WIP patch From 4772651ff18900098f7a3ee7088ffbfdc20c4c15 Mon Sep 17 00:00:00 2001 From: Steve French Date: Tue, 28 Jan 2025 01:04:23 -0600 Subject: [PATCH] smb3: add support for IAKerb There are now more servers which advertise support for IAKerb (passthrough Kerberos authentication via proxy). IAKerb is a public extension industry standard Kerberos protocol that allows a client without line-of-sight to a Domain Controller to authenticate. There can be cases where we would fail to mount if the server only advertises the OID for IAKerb in SPNEGO/GSSAPI. Add code to allow us to still upcall to userspace in these cases to obtain the Kerberos ticket. Signed-off-by: Steve French --- fs/smb/client/asn1.c | 2 ++ fs/smb/client/cifs_spnego.c | 4 +++- fs/smb/client/cifsglob.h | 4 ++++ fs/smb/client/sess.c | 3 ++- fs/smb/client/smb2pdu.c | 2 +- 5 files changed, 12 insertions(+), 3 deletions(-) diff --git a/fs/smb/client/asn1.c b/fs/smb/client/asn1.c index b5724ef9f182..214a44509e7b 100644 --- a/fs/smb/client/asn1.c +++ b/fs/smb/client/asn1.c @@ -52,6 +52,8 @@ int cifs_neg_token_init_mech_type(void *context, size_t hdrlen, server->sec_kerberos = true; else if (oid == OID_ntlmssp) server->sec_ntlmssp = true; + else if (oid == OID_IAKerb) + server->sec_iakerb = true; else { char buf[50]; diff --git a/fs/smb/client/cifs_spnego.c b/fs/smb/client/cifs_spnego.c index 28f568b5fc27..bc1c1e9b288a 100644 --- a/fs/smb/client/cifs_spnego.c +++ b/fs/smb/client/cifs_spnego.c @@ -138,11 +138,13 @@ cifs_get_spnego_key(struct cifs_ses *sesInfo, dp = description + strlen(description); - /* for now, only sec=krb5 and sec=mskrb5 are valid */ + /* for now, only sec=krb5 and sec=mskrb5 and iakerb are valid */ if (server->sec_kerberos) sprintf(dp, ";sec=krb5"); else if (server->sec_mskerberos) sprintf(dp, ";sec=mskrb5"); + else if (server->sec_iakerb) + sprintf(dp, ";sec=iakerb"); else { cifs_dbg(VFS, "unknown or missing server auth type, use krb5\n"); sprintf(dp, ";sec=krb5"); diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h index 49ffc040f736..a765b91885fd 100644 --- a/fs/smb/client/cifsglob.h +++ b/fs/smb/client/cifsglob.h @@ -151,6 +151,7 @@ enum securityEnum { NTLMv2, /* Legacy NTLM auth with NTLMv2 hash */ RawNTLMSSP, /* NTLMSSP without SPNEGO, NTLMv2 hash */ Kerberos, /* Kerberos via SPNEGO */ + IAKerb, /* Kerberos proxy */ }; enum upcall_target_enum { @@ -751,6 +752,7 @@ struct TCP_Server_Info { bool sec_kerberosu2u; /* supports U2U Kerberos */ bool sec_kerberos; /* supports plain Kerberos */ bool sec_mskerberos; /* supports legacy MS Kerberos */ + bool sec_iakerb; /* supports pass-through auth for Kerberos (krb5 proxy) */ bool large_buf; /* is current buffer large? */ /* use SMBD connection instead of socket */ bool rdma; @@ -2118,6 +2120,8 @@ static inline char *get_security_type_str(enum securityEnum sectype) return "Kerberos"; case NTLMv2: return "NTLMv2"; + case IAKerb: + return "IAKerb"; default: return "Unknown"; } diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c index 91d4d409cb1d..faa80e7d54a6 100644 --- a/fs/smb/client/sess.c +++ b/fs/smb/client/sess.c @@ -1235,12 +1235,13 @@ cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested) switch (requested) { case Kerberos: case RawNTLMSSP: + case IAKerb: return requested; case Unspecified: if (server->sec_ntlmssp && (global_secflags & CIFSSEC_MAY_NTLMSSP)) return RawNTLMSSP; - if ((server->sec_kerberos || server->sec_mskerberos) && + if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) && (global_secflags & CIFSSEC_MAY_KRB5)) return Kerberos; fallthrough; diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index 9f54596a6866..40ad9e79437a 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -1429,7 +1429,7 @@ smb2_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested) if (server->sec_ntlmssp && (global_secflags & CIFSSEC_MAY_NTLMSSP)) return RawNTLMSSP; - if ((server->sec_kerberos || server->sec_mskerberos) && + if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) && (global_secflags & CIFSSEC_MAY_KRB5)) return Kerberos; fallthrough; -- 2.43.0