All of lore.kernel.org
 help / color / mirror / Atom feed
From: Tom Talpey <ttalpey@microsoft.com>
To: Steve French <smfrench@gmail.com>,
	Andreas Hasenack <andreas@canonical.com>
Cc: CIFS <linux-cifs@vger.kernel.org>, Paulo Alcantara <palcantara@suse.de>
Subject: RE: "Bad SMB2 signature for message" with kernel 5.0.0, works with 4.19.0
Date: Thu, 21 Mar 2019 14:26:49 +0000	[thread overview]
Message-ID: <SN4PR2101MB07362B23C8469E355E955B27A0420@SN4PR2101MB0736.namprd21.prod.outlook.com> (raw)
In-Reply-To: <CAH2r5msqKdOwDwTsfeXGKg2wQ0tHfNGp+Lh=EchMKO+a5k6NNA@mail.gmail.com>

> -----Original Message-----
> From: linux-cifs-owner@vger.kernel.org <linux-cifs-owner@vger.kernel.org> On
> Behalf Of Steve French
> Sent: Wednesday, March 20, 2019 5:08 PM
> To: Andreas Hasenack <andreas@canonical.com>
> Cc: CIFS <linux-cifs@vger.kernel.org>; Paulo Alcantara <palcantara@suse.de>
> Subject: Re: "Bad SMB2 signature for message" with kernel 5.0.0, works with
> 4.19.0
> 
> I am not sure it is legal to require signing and to connect as guest.
>  See quote from protocol specification (MS-SMB2):
> 
> If the SMB2_SESSION_FLAG_IS_GUEST bit is set in the SessionFlags field
> of the SMB2
> SESSION_SETUP Response and if Session.SigningRequired is TRUE, this indicates
> a
> SESSION_SETUP failure and the connection MUST be terminated. If the
> SMB2_SESSION_FLAG_IS_GUEST bit is set in the SessionFlags field of the SMB2
> SESSION_SETUP Response and if RequireMessageSigning is FALSE,
> Session.SigningRequired
> MUST be set to FALSE.

It's even more fundamental. A guest login has no secret, and without a secret
there is nothing to drive the signing algorithm. Therefore, a guest session cannot
validly sign.

If the client is attempting to sign as guest, that's a bug. If the server is accepting
a request with an invalid signature, that's another bug.

Tom.

  reply	other threads:[~2019-03-21 14:26 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-03-20 18:39 "Bad SMB2 signature for message" with kernel 5.0.0, works with 4.19.0 Andreas Hasenack
2019-03-20 21:50 ` Paulo Alcantara
2019-03-21  0:14   ` Andreas Hasenack
2019-03-20 22:08 ` Steve French
2019-03-21 14:26   ` Tom Talpey [this message]
2019-03-21  1:44 ` Steve French
2019-03-21 12:24   ` Andreas Hasenack
2019-03-21  5:03 ` ronnie sahlberg
2019-03-21 12:25   ` Andreas Hasenack

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=SN4PR2101MB07362B23C8469E355E955B27A0420@SN4PR2101MB0736.namprd21.prod.outlook.com \
    --to=ttalpey@microsoft.com \
    --cc=andreas@canonical.com \
    --cc=linux-cifs@vger.kernel.org \
    --cc=palcantara@suse.de \
    --cc=smfrench@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.