[CIFS] enable parsing for transport encryption mount parm

Samba now supports transport encryption on particular exports
(mounted tree ids can be encrypted for servers which support the
unix extensions).  This adds parsing support to cifs mount
option parsing for this.

Signed-off-by: Steve French <sfrench@us.ibm.com>

diff --git a/fs/cifs/README b/fs/cifs/README
index 621aa1a85971394d37424e2a50c9cf71c9aa2146..2bd6fe556f887b8e59f1668d8b7ebcd3db050edc 100644 (file)
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -483,6 +483,11 @@ A partial list of the supported mount options follows:
  sign           Must use packet signing (helps avoid unwanted data modification
                by intermediate systems in the route).  Note that signing
                does not work with lanman or plaintext authentication.
+ seal           Must seal (encrypt) all data on this mounted share before
+               sending on the network.  Requires support for Unix Extensions.
+               Note that this differs from the sign mount option in that it
+               causes encryption of data sent over this mounted share but other
+               shares mounted to the same server are unaffected.
  sec            Security mode.  Allowed values are:
                        none    attempt to connection as a null user (no name)
                        krb5    Use Kerberos version 5 authentication

diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index b7d9f698e63ec5e04ace67469025be11053b423f..08914053242b1b4cea3965d0c0516efa3592222f 100644 (file)
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -281,6 +281,7 @@ struct cifsTconInfo {
        bool ipc:1;             /* set if connection to IPC$ eg for RPC/PIPES */
        bool retry:1;
        bool nocase:1;
+       bool seal:1;      /* transport encryption for this mounted share */
        bool unix_ext:1;  /* if false disable Linux extensions to CIFS protocol
                                for this mount even if server would support */
        /* BB add field for back pointer to sb struct(s)? */

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index c397fcfd9f1a6740e37b94ee410ea3ccfeb2cce6..023434f72c156dd41576f2243517ef2760de6a2d 100644 (file)
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -60,7 +60,7 @@ struct smb_vol {
        char *domainname;
        char *UNC;
        char *UNCip;
-       char *in6_addr;  /* ipv6 address as human readable form of in6_addr */
+       char *in6_addr;   /* ipv6 address as human readable form of in6_addr */
        char *iocharset;  /* local code page for mapping to and from Unicode */
        char source_rfc1001_name[16]; /* netbios name of client */
        char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
@@ -82,13 +82,14 @@ struct smb_vol {
        bool no_xattr:1;   /* set if xattr (EA) support should be disabled*/
        bool server_ino:1; /* use inode numbers from server ie UniqueId */
        bool direct_io:1;
-       bool remap:1;     /* set to remap seven reserved chars in filenames */
-       bool posix_paths:1;   /* unset to not ask for posix pathnames. */
+       bool remap:1;      /* set to remap seven reserved chars in filenames */
+       bool posix_paths:1; /* unset to not ask for posix pathnames. */
        bool no_linux_ext:1;
        bool sfu_emul:1;
-       bool nullauth:1; /* attempt to authenticate with null user */
-       unsigned nocase;     /* request case insensitive filenames */
-       unsigned nobrl;      /* disable sending byte range locks to srv */
+       bool nullauth:1;   /* attempt to authenticate with null user */
+       bool nocase:1;     /* request case insensitive filenames */
+       bool nobrl:1;      /* disable sending byte range locks to srv */
+       bool seal:1;       /* request transport encryption on share */
        unsigned int rsize;
        unsigned int wsize;
        unsigned int sockopt;
@@ -1273,8 +1274,12 @@ cifs_parse_mount_options(char *options, const char *devname,
                        vol->no_psx_acl = 1;
                } else if (strnicmp(data, "sign", 4) == 0) {
                        vol->secFlg |= CIFSSEC_MUST_SIGN;
-/*             } else if (strnicmp(data, "seal",4) == 0) {
-                       vol->secFlg |= CIFSSEC_MUST_SEAL; */
+               } else if (strnicmp(data, "seal", 4) == 0) {
+                       /* we do not do the following in secFlags because seal
+                          is a per tree connection (mount) not a per socket
+                          or per-smb connection option in the protocol */
+                       /* vol->secFlg |= CIFSSEC_MUST_SEAL; */
+                       vol->seal = 1;
                } else if (strnicmp(data, "direct", 6) == 0) {
                        vol->direct_io = 1;
                } else if (strnicmp(data, "forcedirectio", 13) == 0) {
@@ -2126,6 +2131,9 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                           for the retry flag is used */
                        tcon->retry = volume_info.retry;
                        tcon->nocase = volume_info.nocase;
+                       if (tcon->seal != volume_info.seal)
+                               cERROR(1, ("transport encryption setting "
+                                          "conflicts with existing tid"));
                } else {
                        tcon = tconInfoAlloc();
                        if (tcon == NULL)
@@ -2159,6 +2167,7 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                                        atomic_inc(&pSesInfo->inUse);
                                        tcon->retry = volume_info.retry;
                                        tcon->nocase = volume_info.nocase;
+                                       tcon->seal = volume_info.seal;
                                }
                        }
                }