ksmbd: enforce signing required by the session

SMB2_FLAGS_SIGNED is controlled by the incoming request and only indicates
that a signature accompanies that request. Do not use it to decide whether a
signing-required session must authenticate the request.

Reject an unsigned plaintext request before dispatch when the session
requires signing. Continue to validate signatures on signed requests,
including when signing is optional. Encrypted requests have already been
authenticated during decryption.

An OPLOCK_BREAK acknowledgment is a session request and is subject to the
same signing rule, so do not exclude it from signed-request detection.

Reported-by: Charles Vosburgh <trilobyte777@gmail.com>
Tested-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

0 files changed, 0 insertions, 0 deletions