From 145024e3e4a32353420660ec689fb98c960ac3c8 Mon Sep 17 00:00:00 2001 From: Steve French Date: Wed, 9 Dec 2020 21:25:13 -0600 Subject: SMB3.1.1: update comments clarifying SPNEGO info in negprot response Trivial changes to clarify confusing comment about SPNEGO blog (and also one length comparisons in negotiate context parsing). Suggested-by: Tom Talpey Suggested-by: Pavel Shilovsky Signed-off-by: Steve French --- fs/cifs/smb2misc.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) (limited to 'fs/cifs/smb2misc.c') diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c index 2da6b41cb552..c2c5e4122a04 100644 --- a/fs/cifs/smb2misc.c +++ b/fs/cifs/smb2misc.c @@ -109,8 +109,17 @@ static __u32 get_neg_ctxt_len(struct smb2_sync_hdr *hdr, __u32 len, (pneg_rsp->DialectRevision != cpu_to_le16(SMB311_PROT_ID))) return 0; - /* Make sure that negotiate contexts start after gss security blob */ + /* + * if SPNEGO blob present (ie the RFC2478 GSS info which indicates + * which security mechanisms the server supports) make sure that + * the negotiate contexts start after it + */ nc_offset = le32_to_cpu(pneg_rsp->NegotiateContextOffset); + /* + * non_ctxlen is at least shdr->StructureSize + pdu->StructureSize2 + * and the latter is 1 byte bigger than the fix-sized area of the + * NEGOTIATE response + */ if (nc_offset + 1 < non_ctxlen) { pr_warn_once("Invalid negotiate context offset %d\n", nc_offset); return 0; -- cgit v1.2.3