diff options
| author | Steve French <smfrench@gmail.com> | 2013-11-19 23:44:46 -0600 |
|---|---|---|
| committer | Steve French <smfrench@gmail.com> | 2013-11-19 23:52:54 -0600 |
| commit | ff1c038addc4f205d5f1ede449426c7d316c0eed (patch) | |
| tree | 6beb176bfee8d237bc06586474493f73702f0959 /fs/cifs/smb2proto.h | |
| parent | 7d3fb24bce87a240ee5a5f99cdd72b1f336d5c3b (diff) | |
| download | linux-next-ff1c038addc4f205d5f1ede449426c7d316c0eed.tar.gz | |
Check SMB3 dialects against downgrade attacks
When we are running SMB3 or SMB3.02 connections which are signed
we need to validate the protocol negotiation information,
to ensure that the negotiate protocol response was not tampered with.
Add the missing FSCTL which is sent at mount time (immediately after
the SMB3 Tree Connect) to validate that the capabilities match
what we think the server sent.
"Secure dialect negotiation is introduced in SMB3 to protect against
man-in-the-middle attempt to downgrade dialect negotiation.
The idea is to prevent an eavesdropper from downgrading the initially
negotiated dialect and capabilities between the client and the server."
For more explanation see 2.2.31.4 of MS-SMB2 or
http://blogs.msdn.com/b/openspecification/archive/2012/06/28/smb3-secure-dialect-negotiation.aspx
Reviewed-by: Pavel Shilovsky <piastry@etersoft.ru>
Signed-off-by: Steve French <smfrench@gmail.com>
Diffstat (limited to 'fs/cifs/smb2proto.h')
| -rw-r--r-- | fs/cifs/smb2proto.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h index b4eea105b08c..93adc64666f3 100644 --- a/fs/cifs/smb2proto.h +++ b/fs/cifs/smb2proto.h @@ -162,5 +162,6 @@ extern int smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon, struct smb2_lock_element *buf); extern int SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon, __u8 *lease_key, const __le32 lease_state); +extern int smb3_validate_negotiate(const unsigned int, struct cifs_tcon *); #endif /* _SMB2PROTO_H */ |