summaryrefslogtreecommitdiffstats
path: root/fs/cifs/cifsglob.h
diff options
context:
space:
mode:
authorSteve French <smfrench@gmail.com>2013-11-19 23:44:46 -0600
committerSteve French <smfrench@gmail.com>2013-11-19 23:52:54 -0600
commitff1c038addc4f205d5f1ede449426c7d316c0eed (patch)
tree6beb176bfee8d237bc06586474493f73702f0959 /fs/cifs/cifsglob.h
parent7d3fb24bce87a240ee5a5f99cdd72b1f336d5c3b (diff)
downloadlinux-ff1c038addc4f205d5f1ede449426c7d316c0eed.tar.gz
linux-ff1c038addc4f205d5f1ede449426c7d316c0eed.tar.bz2
linux-ff1c038addc4f205d5f1ede449426c7d316c0eed.zip
Check SMB3 dialects against downgrade attacks
When we are running SMB3 or SMB3.02 connections which are signed we need to validate the protocol negotiation information, to ensure that the negotiate protocol response was not tampered with. Add the missing FSCTL which is sent at mount time (immediately after the SMB3 Tree Connect) to validate that the capabilities match what we think the server sent. "Secure dialect negotiation is introduced in SMB3 to protect against man-in-the-middle attempt to downgrade dialect negotiation. The idea is to prevent an eavesdropper from downgrading the initially negotiated dialect and capabilities between the client and the server." For more explanation see 2.2.31.4 of MS-SMB2 or http://blogs.msdn.com/b/openspecification/archive/2012/06/28/smb3-secure-dialect-negotiation.aspx Reviewed-by: Pavel Shilovsky <piastry@etersoft.ru> Signed-off-by: Steve French <smfrench@gmail.com>
Diffstat (limited to 'fs/cifs/cifsglob.h')
-rw-r--r--fs/cifs/cifsglob.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index d9ea7ada1378..f918a998a087 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -384,6 +384,7 @@ struct smb_version_operations {
int (*clone_range)(const unsigned int, struct cifsFileInfo *src_file,
struct cifsFileInfo *target_file, u64 src_off, u64 len,
u64 dest_off);
+ int (*validate_negotiate)(const unsigned int, struct cifs_tcon *);
};
struct smb_version_values {