changing
#define CIFSSEC_DEF (CIFSSEC_MAY_SIGN | CIFSSEC_MAY_NTLM |
CIFSSEC_MAY_NTLMV2 | CIFSSEC_MAY_NTLMSSP)
to
#define CIFSSEC_DEF (CIFSSEC_MAY_SIGN | CIFSSEC_MAY_NTLMSSP)
affects more code
On Fri, Nov 23, 2012 at 8:48 PM, Steve French <smfrench@xxxxxxxxx> wrote:
> it doesn't change security flags - but it seemed the smallest and
> safest since it basically says:
> 1) if you pass in "sec=" then use that
> 2) otherwise use ntlmssp (with ntlmv2)
>
> so shouldn't have any unintended consequences (and the sign mount
> option should work as expected as well)
>
> On Fri, Nov 23, 2012 at 7:41 PM, Jeff Layton <jlayton@xxxxxxxxxx> wrote:
>> On Fri, 23 Nov 2012 17:36:45 -0600
>> Steve French <smfrench@xxxxxxxxx> wrote:
>>
>>> This patch to upgrade the default security mechanism to ntlmv2/ntlmssp
>>> (which is broadly supported for years now, and a reasonable minimum,
>>> far better than ntlm) is overdue, but I had to rework it to simplify
>>> it.
>>>
>>> diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
>>> index 5c670b9..3bca289 100644
>>> --- a/fs/cifs/connect.c
>>> +++ b/fs/cifs/connect.c
>>> @@ -1103,6 +1103,7 @@ cifs_parse_mount_options(const char *mountdata,
>>> const char *devname,
>>> bool uid_specified = false;
>>> bool gid_specified = false;
>>> bool sloppy = false;
>>> + bool sec_explicitly_set = false;
>>> char *invalid = NULL;
>>> char *nodename = utsname()->nodename;
>>> char *string = NULL;
>>> @@ -1763,6 +1764,7 @@ cifs_parse_mount_options(const char *mountdata,
>>> const char *devname,
>>>
>>> if (cifs_parse_security_flavors(string, vol) != 0)
>>> goto cifs_parse_mount_err;
>>> + sec_explicitly_set = true;
>>> break;
>>> case Opt_cache:
>>> string = match_strdup(args);
>>> @@ -1799,6 +1801,8 @@ cifs_parse_mount_options(const char *mountdata,
>>> const char *devname,
>>> goto cifs_parse_mount_err;
>>> }
>>> #endif
>>> + if (sec_explicitly_set == false)
>>> + vol->secFlg |= CIFSSEC_MAY_NTLMSSP;
>>>
>>> if (vol->UNCip == NULL)
>>> vol->UNCip = &vol->UNC[2];
>>> @@ -2397,8 +2401,6 @@ cifs_set_cifscreds(struct smb_vol *vol
>>> __attribute__((unused)),
>>> }
>>> #endif /* CONFIG_KEYS */
>>>
>>> -static bool warned_on_ntlm; /* globals init to false automatically */
>>> -
>>> static struct cifs_ses *
>>> cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
>>> {
>>> @@ -2475,14 +2477,6 @@ cifs_get_smb_ses(struct TCP_Server_Info
>>> *server, struct smb_vol *volume_info)
>>> ses->cred_uid = volume_info->cred_uid;
>>> ses->linux_uid = volume_info->linux_uid;
>>>
>>> - /* ntlmv2 is much stronger than ntlm security, and has been broadly
>>> - supported for many years, time to update default security mechanism */
>>> - if ((volume_info->secFlg == 0) && warned_on_ntlm == false) {
>>> - warned_on_ntlm = true;
>>> - cERROR(1, "default security mechanism requested. The default "
>>> - "security mechanism will be upgraded from ntlm to "
>>> - "ntlmv2 in kernel release 3.3");
>>> - }
>>> ses->overrideSecFlg = volume_info->secFlg;
>>>
>>> mutex_lock(&ses->session_mutex);
>>>
>>
>> How does this change the SecurityFlags interface?
>>
>> --
>> Jeff Layton <jlayton@xxxxxxxxxx>
>
>
>
> --
> Thanks,
>
> Steve
--
Thanks,
Steve
--
To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
