-
Notifications
You must be signed in to change notification settings - Fork 26
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Problem working versus CIFS from kernel 5.17 #95
Comments
If the kernel sets a flag but then does not set the corresponding fields it is broken and needs to be fixed. |
@smfrench are you aware of this? |
Looks like a straightforward fix. Will do a patch for it now. Any ideas what MacOS and Windows clients do when they use NTLMSSP (is the version info sent on BOTH ntlmssp_negotiate and ntlmssp_auth request or just the ntlmssp_negotiate)? Presumably they would only send it on the ntlmssp_negotiate. |
It looks like Windows client sends version info on BOTH the ntlmssp_negotiate and ntlmssp_auth requests |
It doesn't really matter if you send version or not, what matters is that you are consistent with flags sent. |
Our goal in sending the version info was to allow support engineers to be able to identify enough about the client to be able to rule out known bugs in old versions of Linux kernel (that are missing many fixes) when a user complains about a problem running their app on an SMB3.1.1 mount - so sending the version info on the ntlmssp_negotiate is all we need. |
You have to be careful that sending the version may change the behavior of the peer, Check the MS-NLMP document, it mention something about Windows making some assumptions when it starts seeing the version field being sent. |
Simplest fix seems to be something like this (rather than adding more to the NTLMSSP_AUTH request): diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c
|
@smfrench are you going to push this fix? It looks good to me. |
Added a fix to cifs-2.6.git for-next for this. See https://git.samba.org/?p=sfrench/cifs-2.6.git;a=commit;h=19826558210b9102a7d4681c91784d137d60d71b |
[ Upstream commit 1982655 ] The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d0053 ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 1982655 ] The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d0053 ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 1982655 ] The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d0053 ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 1982655 ] The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d0053 ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 1982655 ] The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d0053 ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 1982655 ] The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d0053 ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 1982655 ] The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d0053 ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
BugLink: https://bugs.launchpad.net/bugs/2037005 [ Upstream commit 1982655 ] The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d0053 ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Kamal Mostafa <kamal@canonical.com> Signed-off-by: Roxana Nicolescu <roxana.nicolescu@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2036450 The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d005337b2c ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2036450 The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d005337b2c ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2036450 The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d005337b2c ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2036450 The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d005337b2c ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2036450 The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d005337b2c ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2036450 The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d005337b2c ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2036450 The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d005337b2c ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2036450 The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d005337b2c ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2036450 The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d005337b2c ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
auth request The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d0053 ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com>
BugLink: https://bugs.launchpad.net/bugs/2036450 The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d005337b2c ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2036450 The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d005337b2c ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2036450 The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d005337b2c ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2036450 The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: gssapi/gss-ntlmssp#95 Fixes: 52d005337b2c ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman <roy.shterman@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Hi,
In Linux kernel 5.17 the client started to use Version in the Negotiate message -
`commit 52d005337b2c94ab37273d9ad8382d4fb051defd
Author: Steve French stfrench@microsoft.com
Date: Wed Jan 19 22:00:29 2022 -0600
`
This commit is causing the VERSION flag to be set also in the AUTH message but the client is not sending Version in the auth message so we are doing wrong parsing and failing the login because the first header is written in offset 64 while we are expecting it in offset 72 (because we add the version size).
Checking the kernel code I see the logic decides about the offset in the payload only based on the offset mentioned in the first header and not basing it on the struct size, thoughts about changing it to have the same logic?
The text was updated successfully, but these errors were encountered: