Commit acf96fef authored by Steve French's avatar Steve French

smb3.1.1: do not fail if no encryption required but server doesn't support it

There are cases where the server can return a cipher type of 0 and
it not be an error. For example server supported no encryption types
(e.g. server completely disabled encryption), or the server and
client didn't support any encryption types in common (e.g. if a
server only supported AES256_CCM). In those cases encryption would
not be supported, but that can be ok if the client did not require
encryption on mount and it should not return an error.

In the case in which mount requested encryption ("seal" on mount)
then checks later on during tree connection will return the proper
rc, but if seal was not requested by client, since server is allowed
to return 0 to indicate no supported cipher, we should not fail mount.
Reported-by: default avatarPavel Shilovsky <pshilov@microsoft.com>
Reviewed-by: default avatarPavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 0bd294b5
...@@ -616,9 +616,19 @@ static int decode_encrypt_ctx(struct TCP_Server_Info *server, ...@@ -616,9 +616,19 @@ static int decode_encrypt_ctx(struct TCP_Server_Info *server,
return -EOPNOTSUPP; return -EOPNOTSUPP;
} }
} else if (ctxt->Ciphers[0] == 0) { } else if (ctxt->Ciphers[0] == 0) {
/* e.g. if server only supported AES256_CCM (very unlikely) */ /*
cifs_dbg(VFS, "Server does not support requested encryption types\n"); * e.g. if server only supported AES256_CCM (very unlikely)
return -EOPNOTSUPP; * or server supported no encryption types or had all disabled.
* Since GLOBAL_CAP_ENCRYPTION will be not set, in the case
* in which mount requested encryption ("seal") checks later
* on during tree connection will return proper rc, but if
* seal not requested by client, since server is allowed to
* return 0 to indicate no supported cipher, we can't fail here
*/
server->cipher_type = 0;
server->capabilities &= ~SMB2_GLOBAL_CAP_ENCRYPTION;
pr_warn_once("Server does not support requested encryption types\n");
return 0;
} else if ((ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_CCM) && } else if ((ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_CCM) &&
(ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_GCM) && (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_GCM) &&
(ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM)) { (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES256_GCM)) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment