github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ksmbd: enforce signing required by the session

Browse Source 
SMB2_FLAGS_SIGNED is controlled by the incoming request and only indicates
that a signature accompanies that request. Do not use it to decide whether a
signing-required session must authenticate the request.

Reject an unsigned plaintext request before dispatch when the session
requires signing. Continue to validate signatures on signed requests,
including when signing is optional. Encrypted requests have already been
authenticated during decryption.

An OPLOCK_BREAK acknowledgment is a session request and is subject to the
same signing rule, so do not exclude it from signed-request detection.

Reported-by: Charles Vosburgh <trilobyte777@gmail.com>
Tested-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
This commit is contained in:
Namjae Jeon 2026-07-17 11:32:00 +09:00 committed by Steve French
parent e148e567a9
commit 2bebf2470a
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
fs/smb/server/server.c
View File

@ -112,6 +112,7 @@ static int __process_request(struct ksmbd_work *work, struct ksmbd_conn *conn,
{
struct smb_version_cmds *cmds;
u16 command;
bool signed_req;
int ret;
if (check_conn_state(work))
@ -138,7 +139,14 @@ static int __process_request(struct ksmbd_work *work, struct ksmbd_conn *conn,
return SERVER_HANDLER_ABORT;
}
if (work->sess && conn->ops->is_sign_req(work, command)) {
signed_req = conn->ops->is_sign_req && conn->ops->is_sign_req(work, command);
if (work->sess && work->sess->sign && !work->encrypted &&
!signed_req) {
conn->ops->set_rsp_status(work, STATUS_ACCESS_DENIED);
return SERVER_HANDLER_ABORT;
}
if (work->sess && signed_req) {
ret = conn->ops->check_sign_req(work);
if (!ret) {
conn->ops->set_rsp_status(work, STATUS_ACCESS_DENIED);

3
fs/smb/server/smb2pdu.c
View File

@ -9596,8 +9596,7 @@ bool smb2_is_sign_req(struct ksmbd_work *work, unsigned int command)
struct smb2_hdr *rcv_hdr2 = smb_get_msg(work->request_buf);
if ((rcv_hdr2->Flags & SMB2_FLAGS_SIGNED) &&
command != SMB2_NEGOTIATE_HE &&
command != SMB2_OPLOCK_BREAK_HE)
command != SMB2_NEGOTIATE_HE)
return true;
return false;