diff options
| author | Steve French <stfrench@microsoft.com> | 2024-04-05 02:06:56 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-05-17 13:02:17 +0300 |
| commit | 08bedfbc1b5071c14cd18580c938a5212d01ea70 (patch) | |
| tree | f8792aa1d75c4c6480d7c67ec4ba0a88962e4b10 /fs/smb/client/connect.c | |
| parent | 82f9e213b124a7d2bb5b16ea35d570260ef467e0 (diff) | |
| download | linux-08bedfbc1b5071c14cd18580c938a5212d01ea70.tar.xz | |
smb3: fix broken reconnect when password changing on the server by allowing password rotation
[ Upstream commit 35f834265e0dc78b003aa0d1af65cafb89666b76 ]
There are various use cases that are becoming more common in which password
changes are scheduled on a server(s) periodically but the clients connected
to this server need to stay connected (even in the face of brief network
reconnects) due to mounts which can not be easily unmounted and mounted at
will, and servers that do password rotation do not always have the ability
to tell the clients exactly when to the new password will be effective,
so add support for an alt password ("password2=") on mount (and also
remount) so that we can anticipate the upcoming change to the server
without risking breaking existing mounts.
An alternative would have been to use the kernel keyring for this but the
processes doing the reconnect do not have access to the keyring but do
have access to the ses structure.
Reviewed-by: Bharath SM <bharathsm@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs/smb/client/connect.c')
| -rw-r--r-- | fs/smb/client/connect.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c index c5705de7f9de..cb3bed8364e0 100644 --- a/fs/smb/client/connect.c +++ b/fs/smb/client/connect.c @@ -2178,6 +2178,7 @@ cifs_set_cifscreds(struct smb3_fs_context *ctx, struct cifs_ses *ses) } ++delim; + /* BB consider adding support for password2 (Key Rotation) for multiuser in future */ ctx->password = kstrndup(delim, len, GFP_KERNEL); if (!ctx->password) { cifs_dbg(FYI, "Unable to allocate %zd bytes for password\n", @@ -2201,6 +2202,7 @@ cifs_set_cifscreds(struct smb3_fs_context *ctx, struct cifs_ses *ses) kfree(ctx->username); ctx->username = NULL; kfree_sensitive(ctx->password); + /* no need to free ctx->password2 since not allocated in this path */ ctx->password = NULL; goto out_key_put; } @@ -2312,6 +2314,12 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb3_fs_context *ctx) if (!ses->password) goto get_ses_fail; } + /* ctx->password freed at unmount */ + if (ctx->password2) { + ses->password2 = kstrdup(ctx->password2, GFP_KERNEL); + if (!ses->password2) + goto get_ses_fail; + } if (ctx->domainname) { ses->domainName = kstrdup(ctx->domainname, GFP_KERNEL); if (!ses->domainName) |