cifs: track the enablement of signing in the TCP_Server_Info

Currently, we determine this according to flags in the sec_mode, flags
in the global_secflags and via other methods. That makes the semantics
very hard to follow and there are corner cases where we don't handle
this correctly.

Add a new bool to the TCP_Server_Info that acts as a simple flag to tell
us whether signing is enabled on this connection or not, and fix up the
places that need to determine this to use that flag.

This is a bit weird for the SMB2 case, where signing is per-session.
SMB2 needs work in this area already though. The existing SMB2 code has
similar logic to what we're using here, so there should be no real
change in behavior. These changes should make it easier to implement
per-session signing in the future though.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Reviewed-by: Pavel Shilovsky <piastry@etersoft.ru>
Signed-off-by: Steve French <smfrench@gmail.com>

1 files changed, 17 insertions, 23 deletions

diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 1609699e7bec..ad8ef10de0bd 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -119,8 +119,7 @@ smb2_hdr_assemble(struct smb2_hdr *hdr, __le16 smb2_cmd /* command */ ,
         /* BB how does SMB2 do case sensitive? */
         /* if (tcon->nocase)
                 hdr->Flags |= SMBFLG_CASELESS; */
-        if (tcon->ses && tcon->ses->server &&
-            (tcon->ses->server->sec_mode & SECMODE_SIGN_REQUIRED))
+        if (tcon->ses && tcon->ses->server && tcon->ses->server->sign)
                 hdr->Flags |= SMB2_FLAGS_SIGNED;
 out:
         pdu->StructureSize2 = cpu_to_le16(parmsize);
@@ -330,7 +329,6 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
         int resp_buftype;
         struct TCP_Server_Info *server = ses->server;
         unsigned int sec_flags;
-        u16 temp = 0;
         int blob_offset, blob_length;
         char *security_blob;
         int flags = CIFS_NEG_OP;
@@ -362,12 +360,12 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
         inc_rfc1001_len(req, 2);
 
         /* only one of SMB2 signing flags may be set in SMB2 request */
-        if ((sec_flags & CIFSSEC_MUST_SIGN) == CIFSSEC_MUST_SIGN)
-                temp = SMB2_NEGOTIATE_SIGNING_REQUIRED;
-        else if (sec_flags & CIFSSEC_MAY_SIGN) /* MAY_SIGN is a single flag */
-                temp = SMB2_NEGOTIATE_SIGNING_ENABLED;
-
-        req->SecurityMode = cpu_to_le16(temp);
+        if (ses->sign)
+                req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED;
+        else if (global_secflags & CIFSSEC_MAY_SIGN)
+                req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED;
+        else
+                req->SecurityMode = 0;
 
         req->Capabilities = cpu_to_le32(ses->server->vals->req_capabilities);
 
@@ -424,8 +422,7 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
                 goto neg_exit;
         }
 
-        cifs_dbg(FYI, "sec_flags 0x%x\n", sec_flags);
-        rc = cifs_enable_signing(server, sec_flags);
+        rc = cifs_enable_signing(server, ses->sign);
 #ifdef CONFIG_SMB2_ASN1  /* BB REMOVEME when updated asn1.c ready */
         if (rc)
                 goto neg_exit;
@@ -457,7 +454,6 @@ SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
         __le32 phase = NtLmNegotiate; /* NTLMSSP, if needed, is multistage */
         struct TCP_Server_Info *server = ses->server;
         unsigned int sec_flags;
-        u8 temp = 0;
         u16 blob_length = 0;
         char *security_blob;
         char *ntlmssp_blob = NULL;
@@ -502,14 +498,13 @@ ssetup_ntlmssp_authenticate:
         req->hdr.CreditRequest = cpu_to_le16(3);
 
         /* only one of SMB2 signing flags may be set in SMB2 request */
-        if ((sec_flags & CIFSSEC_MUST_SIGN) == CIFSSEC_MUST_SIGN)
-                temp = SMB2_NEGOTIATE_SIGNING_REQUIRED;
-        else if (ses->server->sec_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED)
-                temp = SMB2_NEGOTIATE_SIGNING_REQUIRED;
-        else if (sec_flags & CIFSSEC_MAY_SIGN) /* MAY_SIGN is a single flag */
-                temp = SMB2_NEGOTIATE_SIGNING_ENABLED;
-
-        req->SecurityMode = temp;
+        if (server->sign)
+                req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED;
+        else if (global_secflags & CIFSSEC_MAY_SIGN) /* one flag unlike MUST_ */
+                req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED;
+        else
+                req->SecurityMode = 0;
+
         req->Capabilities = 0;
         req->Channel = 0; /* MBZ */
 
@@ -652,7 +647,7 @@ SMB2_logoff(const unsigned int xid, struct cifs_ses *ses)
 
          /* since no tcon, smb2_init can not do this, so do here */
         req->hdr.SessionId = ses->Suid;
-        if (server->sec_mode & SECMODE_SIGN_REQUIRED)
+        if (server->sign)
                 req->hdr.Flags |= SMB2_FLAGS_SIGNED;
 
         rc = SendReceiveNoRsp(xid, ses, (char *) &req->hdr, 0);
@@ -1357,8 +1352,7 @@ smb2_readv_callback(struct mid_q_entry *mid)
         case MID_RESPONSE_RECEIVED:
                 credits_received = le16_to_cpu(buf->CreditRequest);
                 /* result already set, check signature */
-                if (server->sec_mode &
-                    (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) {
+                if (server->sign) {
                         int rc;
 
                         rc = smb2_verify_signature(&rqst, server);