| Message ID | CAH2r5mutYBiXyBnMWKF66DGrKHd7=ypsPGcg_XSrJW=JykNBbQ@mail.gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | [smb,client] updating warning message for sec=krb5p | expand |
On Wed, Feb 7, 2024 at 11:38 AM Steve French <smfrench@gmail.com> wrote: > > smb3: clarify mount warning > > When a user tries to use the "sec=krb5p" mount parameter to encrypt > data on connection to a server (when authenticating with Kerberos), we > indicate that it is not supported, but do not note the equivalent > recommended mount parameter ("sec=krb5,seal") which turns on encryption > for that mount (and uses Kerberos for auth). Without an updated > mount warning > it could confuse some NFS users. Note that for SMB3+ we support > encryption, > but consider it ("seal") a distinct mount parameter since the same > user may choose > to encrypt to one share but not another from the same client. > Update the warning message > to reduce confusion. > > See attached. > -- > Thanks, > > Steve Looks good to me.
From 608b0d580f917e02b6afd1be3e479b29587bb88a Mon Sep 17 00:00:00 2001
From: Steve French <stfrench@microsoft.com>
Date: Tue, 6 Feb 2024 23:57:18 -0600
Subject: [PATCH] smb3: clarify mount warning
When a user tries to use the "sec=krb5p" mount parameter to encrypt
data on connection to a server (when authenticating with Kerberos), we
indicate that it is not supported, but do not note the equivalent
recommended mount parameter ("sec=krb5,seal") which turns on encryption
for that mount (and uses Kerberos for auth). Update the warning message.
Signed-off-by: Steve French <stfrench@microsoft.com>
---
fs/smb/client/fs_context.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c
index 600a77052c3b..6993cd358b94 100644
--- a/fs/smb/client/fs_context.c
+++ b/fs/smb/client/fs_context.c
@@ -211,7 +211,7 @@ cifs_parse_security_flavors(struct fs_context *fc, char *value, struct smb3_fs_c
switch (match_token(value, cifs_secflavor_tokens, args)) {
case Opt_sec_krb5p:
- cifs_errorf(fc, "sec=krb5p is not supported!\n");
+ cifs_errorf(fc, "sec=krb5p is not supported. Use sec=krb5,seal instead\n");
return 1;
case Opt_sec_krb5i:
ctx->sign = true;
--
2.40.1
smb3: clarify mount warning When a user tries to use the "sec=krb5p" mount parameter to encrypt data on connection to a server (when authenticating with Kerberos), we indicate that it is not supported, but do not note the equivalent recommended mount parameter ("sec=krb5,seal") which turns on encryption for that mount (and uses Kerberos for auth). Without an updated mount warning it could confuse some NFS users. Note that for SMB3+ we support encryption, but consider it ("seal") a distinct mount parameter since the same user may choose to encrypt to one share but not another from the same client. Update the warning message to reduce confusion. See attached.