smb3: add support for IAKerb

There are now more servers which advertise support for IAKerb (passthrough
Kerberos authentication via proxy).  IAKerb is a public extension industry
standard Kerberos protocol that allows a client without line-of-sight
to a Domain Controller to authenticate. There can be cases where we
would fail to mount if the server only advertises the OID for IAKerb
in SPNEGO/GSSAPI.  Add code to allow us to still upcall to userspace
in these cases to obtain the Kerberos ticket.

Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/client/asn1.c b/fs/smb/client/asn1.c
index b5724ef9f182f492123af7867bc0bdfd0b1ef44b..214a44509e7b990175b552997af2e04159b577b6 100644 (file)
--- a/fs/smb/client/asn1.c
+++ b/fs/smb/client/asn1.c
@@ -52,6 +52,8 @@ int cifs_neg_token_init_mech_type(void *context, size_t hdrlen,
                server->sec_kerberos = true;
        else if (oid == OID_ntlmssp)
                server->sec_ntlmssp = true;
+       else if (oid == OID_IAKerb)
+               server->sec_iakerb = true;
        else {
                char buf[50];
 

diff --git a/fs/smb/client/cifs_spnego.c b/fs/smb/client/cifs_spnego.c
index 28f568b5fc2771b7a11d0e83d0ac1cb9baf20636..bc1c1e9b288addb8b01b9192c3d8af3cbb1f53ed 100644 (file)
--- a/fs/smb/client/cifs_spnego.c
+++ b/fs/smb/client/cifs_spnego.c
@@ -138,11 +138,13 @@ cifs_get_spnego_key(struct cifs_ses *sesInfo,
 
        dp = description + strlen(description);
 
-       /* for now, only sec=krb5 and sec=mskrb5 are valid */
+       /* for now, only sec=krb5 and sec=mskrb5 and iakerb are valid */
        if (server->sec_kerberos)
                sprintf(dp, ";sec=krb5");
        else if (server->sec_mskerberos)
                sprintf(dp, ";sec=mskrb5");
+       else if (server->sec_iakerb)
+               sprintf(dp, ";sec=iakerb");
        else {
                cifs_dbg(VFS, "unknown or missing server auth type, use krb5\n");
                sprintf(dp, ";sec=krb5");

diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h
index 5ba6b46fe9d1ef3e32c1d821bb340deb2d714993..a68434ad744ae344729847474fd90086c80cd192 100644 (file)
--- a/fs/smb/client/cifsglob.h
+++ b/fs/smb/client/cifsglob.h
@@ -151,6 +151,7 @@ enum securityEnum {
        NTLMv2,                 /* Legacy NTLM auth with NTLMv2 hash */
        RawNTLMSSP,             /* NTLMSSP without SPNEGO, NTLMv2 hash */
        Kerberos,               /* Kerberos via SPNEGO */
+       IAKerb,                 /* Kerberos proxy */
 };
 
 enum upcall_target_enum {
@@ -781,6 +782,7 @@ struct TCP_Server_Info {
        bool    sec_kerberosu2u;        /* supports U2U Kerberos */
        bool    sec_kerberos;           /* supports plain Kerberos */
        bool    sec_mskerberos;         /* supports legacy MS Kerberos */
+       bool    sec_iakerb;             /* supports pass-through auth for Kerberos (krb5 proxy) */
        bool    large_buf;              /* is current buffer large? */
        /* use SMBD connection instead of socket */
        bool    rdma;
@@ -2148,6 +2150,8 @@ static inline char *get_security_type_str(enum securityEnum sectype)
                return "Kerberos";
        case NTLMv2:
                return "NTLMv2";
+       case IAKerb:
+               return "IAKerb";
        default:
                return "Unknown";
        }

diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c
index 91d4d409cb1dc623c63b65877322c961e2940a49..faa80e7d54a6e8bd7505961f47a6c43a813f5326 100644 (file)
--- a/fs/smb/client/sess.c
+++ b/fs/smb/client/sess.c
@@ -1235,12 +1235,13 @@ cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
                switch (requested) {
                case Kerberos:
                case RawNTLMSSP:
+               case IAKerb:
                        return requested;
                case Unspecified:
                        if (server->sec_ntlmssp &&
                            (global_secflags & CIFSSEC_MAY_NTLMSSP))
                                return RawNTLMSSP;
-                       if ((server->sec_kerberos || server->sec_mskerberos) &&
+                       if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) &&
                            (global_secflags & CIFSSEC_MAY_KRB5))
                                return Kerberos;
                        fallthrough;

diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c
index 9f54596a6866cd3f355a4b67cbeb6bd705aafe2e..40ad9e79437a4ba0d8a9d4374c8b163b4de08504 100644 (file)
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -1429,7 +1429,7 @@ smb2_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
                if (server->sec_ntlmssp &&
                        (global_secflags & CIFSSEC_MAY_NTLMSSP))
                        return RawNTLMSSP;
-               if ((server->sec_kerberos || server->sec_mskerberos) &&
+               if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) &&
                        (global_secflags & CIFSSEC_MAY_KRB5))
                        return Kerberos;
                fallthrough;