diff options
| author | Steve French <stfrench@microsoft.com> | 2018-05-24 11:11:07 +0200 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2018-05-30 23:06:18 +0200 |
| commit | f92a720ee9d5d4e76a9621ce0812aef133c7b981 (patch) | |
| tree | 26f6387be83eba35333481337bcbe43491277053 /fs/cifs/connect.c | |
| parent | cifs: make minor clarifications to module params for cifs.ko (diff) | |
| download | linux-f92a720ee9d5d4e76a9621ce0812aef133c7b981.tar.xz linux-f92a720ee9d5d4e76a9621ce0812aef133c7b981.zip | |
cifs: allow disabling less secure legacy dialects
To improve security it may be helpful to have additional ways to restrict the
ability to override the default dialects (SMB2.1, SMB3 and SMB3.02) on mount
with old dialects (CIFS/SMB1 and SMB2) since vers=1.0 (CIFS/SMB1) and vers=2.0
are weaker and less secure.
Add a module parameter "disable_legacy_dialects"
(/sys/module/cifs/parameters/disable_legacy_dialects) which can be set to
1 (or equivalently Y) to forbid use of vers=1.0 or vers=2.0 on mount.
Also cleans up a few build warnings about globals for various module parms.
Signed-off-by: Steve French <smfrench@gmail.com>
Diffstat (limited to '')
| -rw-r--r-- | fs/cifs/connect.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 83b0234d443c..ed3b6de88395 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -61,6 +61,7 @@ #define RFC1001_PORT 139 extern mempool_t *cifs_req_poolp; +extern bool disable_legacy_dialects; /* FIXME: should these be tunable? */ #define TLINK_ERROR_EXPIRE (1 * HZ) @@ -1146,10 +1147,18 @@ cifs_parse_smb_version(char *value, struct smb_vol *vol) switch (match_token(value, cifs_smb_version_tokens, args)) { case Smb_1: + if (disable_legacy_dialects) { + cifs_dbg(VFS, "mount with legacy dialect disabled\n"); + return 1; + } vol->ops = &smb1_operations; vol->vals = &smb1_values; break; case Smb_20: + if (disable_legacy_dialects) { + cifs_dbg(VFS, "mount with legacy dialect disabled\n"); + return 1; + } vol->ops = &smb20_operations; vol->vals = &smb20_values; break; |