* [PATCH v2] smb: client: terminate session upon failed client required signing @ 2026-02-05 1:00 Aaditya Kansal 2026-02-15 13:16 ` Aaditya Kansal 0 siblings, 1 reply; 8+ messages in thread From: Aaditya Kansal @ 2026-02-05 1:00 UTC (permalink / raw) To: sfrench; +Cc: linux-cifs, Aaditya Kansal Currently, when smb signature verification fails, the behaviour is to log the failure without any action to terminate the session. Call cifs_reconnect() when client required signature verification fails. Otherwise, log the error without reconnecting. Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com> --- Changes in v2: - reconnect only triggered when client required signature verification fails --- fs/smb/client/cifstransport.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c index 28d1cee90625..6c1fbf0bef6d 100644 --- a/fs/smb/client/cifstransport.c +++ b/fs/smb/client/cifstransport.c @@ -169,12 +169,18 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server, iov[0].iov_base = mid->resp_buf; iov[0].iov_len = len; - /* FIXME: add code to kill session */ + rc = cifs_verify_signature(&rqst, server, mid->sequence_number); - if (rc) + if (rc) { cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n", rc); + + if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) { + cifs_reconnect(server, true); + return rc; + } + } } /* BB special case reconnect tid and uid here? */ -- 2.52.0 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH v2] smb: client: terminate session upon failed client required signing 2026-02-05 1:00 [PATCH v2] smb: client: terminate session upon failed client required signing Aaditya Kansal @ 2026-02-15 13:16 ` Aaditya Kansal 2026-02-15 18:31 ` Steve French 0 siblings, 1 reply; 8+ messages in thread From: Aaditya Kansal @ 2026-02-15 13:16 UTC (permalink / raw) To: sfrench; +Cc: linux-cifs On 2/5/26 06:30, Aaditya Kansal wrote: > Currently, when smb signature verification fails, the behaviour is to log > the failure without any action to terminate the session. > > Call cifs_reconnect() when client required signature verification fails. > Otherwise, log the error without reconnecting. > > Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com> > --- > Changes in v2: > - reconnect only triggered when client required signature verification fails > --- > fs/smb/client/cifstransport.c | 10 ++++++++-- > 1 file changed, 8 insertions(+), 2 deletions(-) > > diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c > index 28d1cee90625..6c1fbf0bef6d 100644 > --- a/fs/smb/client/cifstransport.c > +++ b/fs/smb/client/cifstransport.c > @@ -169,12 +169,18 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server, > > iov[0].iov_base = mid->resp_buf; > iov[0].iov_len = len; > - /* FIXME: add code to kill session */ > + > rc = cifs_verify_signature(&rqst, server, > mid->sequence_number); > - if (rc) > + if (rc) { > cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n", > rc); > + > + if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) { > + cifs_reconnect(server, true); > + return rc; > + } > + } > } > > /* BB special case reconnect tid and uid here? */ Hi, I am writing this as a ping for this patch. Thanks -- -AK ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v2] smb: client: terminate session upon failed client required signing 2026-02-15 13:16 ` Aaditya Kansal @ 2026-02-15 18:31 ` Steve French 2026-02-15 19:23 ` Aaditya Kansal 0 siblings, 1 reply; 8+ messages in thread From: Steve French @ 2026-02-15 18:31 UTC (permalink / raw) To: Aaditya Kansal; +Cc: sfrench, linux-cifs On Sun, Feb 15, 2026 at 7:17 AM Aaditya Kansal <aadityakansal390@gmail.com> wrote: > > > > On 2/5/26 06:30, Aaditya Kansal wrote: > > Currently, when smb signature verification fails, the behaviour is to log > > the failure without any action to terminate the session. > > > > Call cifs_reconnect() when client required signature verification fails. > > Otherwise, log the error without reconnecting. > > > > Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com> > > --- > > Changes in v2: > > - reconnect only triggered when client required signature verification fails > > --- > > fs/smb/client/cifstransport.c | 10 ++++++++-- > > 1 file changed, 8 insertions(+), 2 deletions(-) > > > > diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c > > index 28d1cee90625..6c1fbf0bef6d 100644 > > --- a/fs/smb/client/cifstransport.c > > +++ b/fs/smb/client/cifstransport.c > > @@ -169,12 +169,18 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server, > > > > iov[0].iov_base = mid->resp_buf; > > iov[0].iov_len = len; > > - /* FIXME: add code to kill session */ > > + > > rc = cifs_verify_signature(&rqst, server, > > mid->sequence_number); > > - if (rc) > > + if (rc) { > > cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n", > > rc); > > + > > + if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) { > > + cifs_reconnect(server, true); > > + return rc; > > + } > > + } > > } > > > > /* BB special case reconnect tid and uid here? */ > Hi, I am writing this as a ping for this patch. Thanks merged into cifs-2.6.git for-next but had to rebase it to merge into current code. Have you verified the behavior of default (smb3.1.1) mounts as well? -- Thanks, Steve ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v2] smb: client: terminate session upon failed client required signing 2026-02-15 18:31 ` Steve French @ 2026-02-15 19:23 ` Aaditya Kansal 2026-02-15 21:08 ` Steve French 0 siblings, 1 reply; 8+ messages in thread From: Aaditya Kansal @ 2026-02-15 19:23 UTC (permalink / raw) To: Steve French; +Cc: sfrench, linux-cifs On 2/16/26 00:01, Steve French wrote: > On Sun, Feb 15, 2026 at 7:17 AM Aaditya Kansal > <aadityakansal390@gmail.com> wrote: >> >> >> On 2/5/26 06:30, Aaditya Kansal wrote: >>> Currently, when smb signature verification fails, the behaviour is to log >>> the failure without any action to terminate the session. >>> >>> Call cifs_reconnect() when client required signature verification fails. >>> Otherwise, log the error without reconnecting. >>> >>> Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com> >>> --- >>> Changes in v2: >>> - reconnect only triggered when client required signature verification fails >>> --- >>> fs/smb/client/cifstransport.c | 10 ++++++++-- >>> 1 file changed, 8 insertions(+), 2 deletions(-) >>> >>> diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c >>> index 28d1cee90625..6c1fbf0bef6d 100644 >>> --- a/fs/smb/client/cifstransport.c >>> +++ b/fs/smb/client/cifstransport.c >>> @@ -169,12 +169,18 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server, >>> >>> iov[0].iov_base = mid->resp_buf; >>> iov[0].iov_len = len; >>> - /* FIXME: add code to kill session */ >>> + >>> rc = cifs_verify_signature(&rqst, server, >>> mid->sequence_number); >>> - if (rc) >>> + if (rc) { >>> cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n", >>> rc); >>> + >>> + if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) { >>> + cifs_reconnect(server, true); >>> + return rc; >>> + } >>> + } >>> } >>> >>> /* BB special case reconnect tid and uid here? */ >> Hi, I am writing this as a ping for this patch. Thanks > merged into cifs-2.6.git for-next but had to rebase it to merge into > current code. > > Have you verified the behavior of default (smb3.1.1) mounts as well? > Thank you. Yes, I have checked it for the default version. Tested for both client required and server required signature verification. -- -AK ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v2] smb: client: terminate session upon failed client required signing 2026-02-15 19:23 ` Aaditya Kansal @ 2026-02-15 21:08 ` Steve French 2026-02-15 22:42 ` Aaditya Kansal 0 siblings, 1 reply; 8+ messages in thread From: Steve French @ 2026-02-15 21:08 UTC (permalink / raw) To: Aaditya Kansal; +Cc: sfrench, linux-cifs On Sun, Feb 15, 2026 at 1:23 PM Aaditya Kansal <aadityakansal390@gmail.com> wrote: > > > On 2/16/26 00:01, Steve French wrote: > > On Sun, Feb 15, 2026 at 7:17 AM Aaditya Kansal > > <aadityakansal390@gmail.com> wrote: > >> > >> > >> On 2/5/26 06:30, Aaditya Kansal wrote: > >>> Currently, when smb signature verification fails, the behaviour is to log > >>> the failure without any action to terminate the session. > >>> > >>> Call cifs_reconnect() when client required signature verification fails. > >>> Otherwise, log the error without reconnecting. > >>> > >>> Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com> > >>> --- > >>> Changes in v2: > >>> - reconnect only triggered when client required signature verification fails > >>> --- > >>> fs/smb/client/cifstransport.c | 10 ++++++++-- > >>> 1 file changed, 8 insertions(+), 2 deletions(-) > >>> > >>> diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c > >>> index 28d1cee90625..6c1fbf0bef6d 100644 > >>> --- a/fs/smb/client/cifstransport.c > >>> +++ b/fs/smb/client/cifstransport.c > >>> @@ -169,12 +169,18 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server, > >>> > >>> iov[0].iov_base = mid->resp_buf; > >>> iov[0].iov_len = len; > >>> - /* FIXME: add code to kill session */ > >>> + > >>> rc = cifs_verify_signature(&rqst, server, > >>> mid->sequence_number); > >>> - if (rc) > >>> + if (rc) { > >>> cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n", > >>> rc); > >>> + > >>> + if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) { > >>> + cifs_reconnect(server, true); > >>> + return rc; > >>> + } > >>> + } > >>> } > >>> > >>> /* BB special case reconnect tid and uid here? */ > >> Hi, I am writing this as a ping for this patch. Thanks > > merged into cifs-2.6.git for-next but had to rebase it to merge into > > current code. > > > > Have you verified the behavior of default (smb3.1.1) mounts as well? > > > Thank you. Yes, I have checked it for the default version. > Tested for both client required and server required signature verification. You were able to verify (simulate) it as well for default ie SMB3.1.1 (not just for SMB1 which this patch fixes), and no changes needed for SMB3.1.1? -- Thanks, Steve ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v2] smb: client: terminate session upon failed client required signing 2026-02-15 21:08 ` Steve French @ 2026-02-15 22:42 ` Aaditya Kansal 2026-02-16 1:24 ` Steve French 0 siblings, 1 reply; 8+ messages in thread From: Aaditya Kansal @ 2026-02-15 22:42 UTC (permalink / raw) To: Steve French; +Cc: sfrench, linux-cifs On 2/16/26 02:38, Steve French wrote: > On Sun, Feb 15, 2026 at 1:23 PM Aaditya Kansal > <aadityakansal390@gmail.com> wrote: >> >> On 2/16/26 00:01, Steve French wrote: >>> On Sun, Feb 15, 2026 at 7:17 AM Aaditya Kansal >>> <aadityakansal390@gmail.com> wrote: >>>> >>>> On 2/5/26 06:30, Aaditya Kansal wrote: >>>>> Currently, when smb signature verification fails, the behaviour is to log >>>>> the failure without any action to terminate the session. >>>>> >>>>> Call cifs_reconnect() when client required signature verification fails. >>>>> Otherwise, log the error without reconnecting. >>>>> >>>>> Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com> >>>>> --- >>>>> Changes in v2: >>>>> - reconnect only triggered when client required signature verification fails >>>>> --- >>>>> fs/smb/client/cifstransport.c | 10 ++++++++-- >>>>> 1 file changed, 8 insertions(+), 2 deletions(-) >>>>> >>>>> diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c >>>>> index 28d1cee90625..6c1fbf0bef6d 100644 >>>>> --- a/fs/smb/client/cifstransport.c >>>>> +++ b/fs/smb/client/cifstransport.c >>>>> @@ -169,12 +169,18 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server, >>>>> >>>>> iov[0].iov_base = mid->resp_buf; >>>>> iov[0].iov_len = len; >>>>> - /* FIXME: add code to kill session */ >>>>> + >>>>> rc = cifs_verify_signature(&rqst, server, >>>>> mid->sequence_number); >>>>> - if (rc) >>>>> + if (rc) { >>>>> cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n", >>>>> rc); >>>>> + >>>>> + if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) { >>>>> + cifs_reconnect(server, true); >>>>> + return rc; >>>>> + } >>>>> + } >>>>> } >>>>> >>>>> /* BB special case reconnect tid and uid here? */ >>>> Hi, I am writing this as a ping for this patch. Thanks >>> merged into cifs-2.6.git for-next but had to rebase it to merge into >>> current code. >>> >>> Have you verified the behavior of default (smb3.1.1) mounts as well? >>> >> Thank you. Yes, I have checked it for the default version. >> Tested for both client required and server required signature verification. > You were able to verify (simulate) it as well for default ie SMB3.1.1 > (not just for SMB1 > which this patch fixes), and no changes needed for SMB3.1.1? > > Yes, I verified for default version (3.1.1). First I set signing required option on server side, then I set the sign flag on client side. SMB3.1.1 mounts with no issues. -- -AK ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v2] smb: client: terminate session upon failed client required signing 2026-02-15 22:42 ` Aaditya Kansal @ 2026-02-16 1:24 ` Steve French 2026-02-16 5:18 ` Aaditya Kansal 0 siblings, 1 reply; 8+ messages in thread From: Steve French @ 2026-02-16 1:24 UTC (permalink / raw) To: Aaditya Kansal; +Cc: sfrench, linux-cifs On Sun, Feb 15, 2026 at 4:42 PM Aaditya Kansal <aadityakansal390@gmail.com> wrote: > > > > On 2/16/26 02:38, Steve French wrote: > > On Sun, Feb 15, 2026 at 1:23 PM Aaditya Kansal > > <aadityakansal390@gmail.com> wrote: > >> > >> On 2/16/26 00:01, Steve French wrote: > >>> On Sun, Feb 15, 2026 at 7:17 AM Aaditya Kansal > >>> <aadityakansal390@gmail.com> wrote: > >>>> > >>>> On 2/5/26 06:30, Aaditya Kansal wrote: > >>>>> Currently, when smb signature verification fails, the behaviour is to log > >>>>> the failure without any action to terminate the session. > >>>>> > >>>>> Call cifs_reconnect() when client required signature verification fails. > >>>>> Otherwise, log the error without reconnecting. > >>>>> > >>>>> Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com> > >>>>> --- > >>>>> Changes in v2: > >>>>> - reconnect only triggered when client required signature verification fails > >>>>> --- > >>>>> fs/smb/client/cifstransport.c | 10 ++++++++-- > >>>>> 1 file changed, 8 insertions(+), 2 deletions(-) > >>>>> > >>>>> diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c > >>>>> index 28d1cee90625..6c1fbf0bef6d 100644 > >>>>> --- a/fs/smb/client/cifstransport.c > >>>>> +++ b/fs/smb/client/cifstransport.c > >>>>> @@ -169,12 +169,18 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server, > >>>>> > >>>>> iov[0].iov_base = mid->resp_buf; > >>>>> iov[0].iov_len = len; > >>>>> - /* FIXME: add code to kill session */ > >>>>> + > >>>>> rc = cifs_verify_signature(&rqst, server, > >>>>> mid->sequence_number); > >>>>> - if (rc) > >>>>> + if (rc) { > >>>>> cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n", > >>>>> rc); > >>>>> + > >>>>> + if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) { > >>>>> + cifs_reconnect(server, true); > >>>>> + return rc; > >>>>> + } > >>>>> + } > >>>>> } > >>>>> > >>>>> /* BB special case reconnect tid and uid here? */ > >>>> Hi, I am writing this as a ping for this patch. Thanks > >>> merged into cifs-2.6.git for-next but had to rebase it to merge into > >>> current code. > >>> > >>> Have you verified the behavior of default (smb3.1.1) mounts as well? > >>> > >> Thank you. Yes, I have checked it for the default version. > >> Tested for both client required and server required signature verification. > > You were able to verify (simulate) it as well for default ie SMB3.1.1 > > (not just for SMB1 > > which this patch fixes), and no changes needed for SMB3.1.1? > > > > > Yes, I verified for default version (3.1.1). First I set signing > required option on server side, > then I set the sign flag on client side. SMB3.1.1 mounts with no issues. How were you able to simulate bad signatures being sent from the server for SMB3.1.1? and for SMB1? -- Thanks, Steve ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v2] smb: client: terminate session upon failed client required signing 2026-02-16 1:24 ` Steve French @ 2026-02-16 5:18 ` Aaditya Kansal 0 siblings, 0 replies; 8+ messages in thread From: Aaditya Kansal @ 2026-02-16 5:18 UTC (permalink / raw) To: Steve French; +Cc: sfrench, linux-cifs On 2/16/26 06:54, Steve French wrote: > On Sun, Feb 15, 2026 at 4:42 PM Aaditya Kansal > <aadityakansal390@gmail.com> wrote: >> >> >> On 2/16/26 02:38, Steve French wrote: >>> On Sun, Feb 15, 2026 at 1:23 PM Aaditya Kansal >>> <aadityakansal390@gmail.com> wrote: >>>> On 2/16/26 00:01, Steve French wrote: >>>>> On Sun, Feb 15, 2026 at 7:17 AM Aaditya Kansal >>>>> <aadityakansal390@gmail.com> wrote: >>>>>> On 2/5/26 06:30, Aaditya Kansal wrote: >>>>>>> Currently, when smb signature verification fails, the behaviour is to log >>>>>>> the failure without any action to terminate the session. >>>>>>> >>>>>>> Call cifs_reconnect() when client required signature verification fails. >>>>>>> Otherwise, log the error without reconnecting. >>>>>>> >>>>>>> Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com> >>>>>>> --- >>>>>>> Changes in v2: >>>>>>> - reconnect only triggered when client required signature verification fails >>>>>>> --- >>>>>>> fs/smb/client/cifstransport.c | 10 ++++++++-- >>>>>>> 1 file changed, 8 insertions(+), 2 deletions(-) >>>>>>> >>>>>>> diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c >>>>>>> index 28d1cee90625..6c1fbf0bef6d 100644 >>>>>>> --- a/fs/smb/client/cifstransport.c >>>>>>> +++ b/fs/smb/client/cifstransport.c >>>>>>> @@ -169,12 +169,18 @@ cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server, >>>>>>> >>>>>>> iov[0].iov_base = mid->resp_buf; >>>>>>> iov[0].iov_len = len; >>>>>>> - /* FIXME: add code to kill session */ >>>>>>> + >>>>>>> rc = cifs_verify_signature(&rqst, server, >>>>>>> mid->sequence_number); >>>>>>> - if (rc) >>>>>>> + if (rc) { >>>>>>> cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n", >>>>>>> rc); >>>>>>> + >>>>>>> + if (!(server->sec_mode & SECMODE_SIGN_REQUIRED)) { >>>>>>> + cifs_reconnect(server, true); >>>>>>> + return rc; >>>>>>> + } >>>>>>> + } >>>>>>> } >>>>>>> >>>>>>> /* BB special case reconnect tid and uid here? */ >>>>>> Hi, I am writing this as a ping for this patch. Thanks >>>>> merged into cifs-2.6.git for-next but had to rebase it to merge into >>>>> current code. >>>>> >>>>> Have you verified the behavior of default (smb3.1.1) mounts as well? >>>>> >>>> Thank you. Yes, I have checked it for the default version. >>>> Tested for both client required and server required signature verification. >>> You were able to verify (simulate) it as well for default ie SMB3.1.1 >>> (not just for SMB1 >>> which this patch fixes), and no changes needed for SMB3.1.1? >>> >>> >> Yes, I verified for default version (3.1.1). First I set signing >> required option on server side, >> then I set the sign flag on client side. SMB3.1.1 mounts with no issues. > How were you able to simulate bad signatures being sent from the server > for SMB3.1.1? and for SMB1? > I changed the condition that checks cifs_verify_signature on client side and set it to true, to ensure the failed signature verification path is hit. For cifs, it reconnected on client required signature verification and for server side, it just logged the error. For SMB3.1.1, the path doesn't hit and the behavior remains unchanged. -- -AK ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2026-02-16 5:18 UTC | newest] Thread overview: 8+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-02-05 1:00 [PATCH v2] smb: client: terminate session upon failed client required signing Aaditya Kansal 2026-02-15 13:16 ` Aaditya Kansal 2026-02-15 18:31 ` Steve French 2026-02-15 19:23 ` Aaditya Kansal 2026-02-15 21:08 ` Steve French 2026-02-15 22:42 ` Aaditya Kansal 2026-02-16 1:24 ` Steve French 2026-02-16 5:18 ` Aaditya Kansal
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox