[CIFS] check version in spnego upcall response

Currently, we don't check the version in the SPNEGO upcall response
even though one is provided. Jeff and Q have made the corresponding
change to the Samba client (cifs.upcall).

Acked-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>

diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index f5d0083e09fa235bf30c0440f7132fb7e10a6dc7..526041a52d352c33427957b383fb3e18e99049b0 100644 (file)
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -4,7 +4,11 @@ Fix premature write failure on congested networks (we would give up
 on EAGAIN from the socket too quickly on large writes).
 Cifs_mkdir and cifs_create now respect the setgid bit on parent dir.
 Fix endian problems in acl (mode from/to cifs acl) on bigendian
-architectures.
+architectures.  Fix problems with preserving timestamps on copying open
+files (e.g. "cp -a") to Windows servers.  For mkdir and create honor setgid bit
+on parent directory when server supports Unix Extensions but not POSIX
+create. Update cifs.upcall version to handle new Kerberos sec flags
+(this requires update of cifs.upcall program from Samba).
 
 Version 1.53
 ------------

diff --git a/fs/cifs/cifs_spnego.h b/fs/cifs/cifs_spnego.h
index 05a34b17a1ab4411d87875525adfe772e6edf26d..e4041ec4d712943c412e0d97addbea7c4964c77a 100644 (file)
--- a/fs/cifs/cifs_spnego.h
+++ b/fs/cifs/cifs_spnego.h
@@ -23,7 +23,7 @@
 #ifndef _CIFS_SPNEGO_H
 #define _CIFS_SPNEGO_H
 
-#define CIFS_SPNEGO_UPCALL_VERSION 1
+#define CIFS_SPNEGO_UPCALL_VERSION 2
 
 /*
  * The version field should always be set to CIFS_SPNEGO_UPCALL_VERSION.

diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 3188e4d9cddb12039ab4edcfe5a0cdd00a1212db..b537fad3bf50684c2b3405df74a69ea9dd9e29a3 100644 (file)
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -516,6 +516,15 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
                }
 
                msg = spnego_key->payload.data;
+               /* check version field to make sure that cifs.upcall is
+                  sending us a response in an expected form */
+               if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
+                       cERROR(1, ("incorrect version of cifs.upcall (expected"
+                                  " %d but got %d)",
+                                  CIFS_SPNEGO_UPCALL_VERSION, msg->version));
+                       rc = -EKEYREJECTED;
+                       goto ssetup_exit;
+               }
                /* bail out if key is too long */
                if (msg->sesskey_len >
                    sizeof(ses->server->mac_signing_key.data.krb5)) {