Loading...
Note: File does not exist in v6.13.7.
1/*
2 * fs/cifs/sess.c
3 *
4 * SMB/CIFS session setup handling routines
5 *
6 * Copyright (c) International Business Machines Corp., 2006, 2009
7 * Author(s): Steve French (sfrench@us.ibm.com)
8 *
9 * This library is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU Lesser General Public License as published
11 * by the Free Software Foundation; either version 2.1 of the License, or
12 * (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
17 * the GNU Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public License
20 * along with this library; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 */
23
24#include "cifspdu.h"
25#include "cifsglob.h"
26#include "cifsproto.h"
27#include "cifs_unicode.h"
28#include "cifs_debug.h"
29#include "ntlmssp.h"
30#include "nterr.h"
31#include <linux/utsname.h>
32#include <linux/slab.h>
33#include "cifs_spnego.h"
34#include "smb2proto.h"
35
36bool
37is_server_using_iface(struct TCP_Server_Info *server,
38 struct cifs_server_iface *iface)
39{
40 struct sockaddr_in *i4 = (struct sockaddr_in *)&iface->sockaddr;
41 struct sockaddr_in6 *i6 = (struct sockaddr_in6 *)&iface->sockaddr;
42 struct sockaddr_in *s4 = (struct sockaddr_in *)&server->dstaddr;
43 struct sockaddr_in6 *s6 = (struct sockaddr_in6 *)&server->dstaddr;
44
45 if (server->dstaddr.ss_family != iface->sockaddr.ss_family)
46 return false;
47 if (server->dstaddr.ss_family == AF_INET) {
48 if (s4->sin_addr.s_addr != i4->sin_addr.s_addr)
49 return false;
50 } else if (server->dstaddr.ss_family == AF_INET6) {
51 if (memcmp(&s6->sin6_addr, &i6->sin6_addr,
52 sizeof(i6->sin6_addr)) != 0)
53 return false;
54 } else {
55 /* unknown family.. */
56 return false;
57 }
58 return true;
59}
60
61bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
62{
63 int i;
64
65 for (i = 0; i < ses->chan_count; i++) {
66 if (is_server_using_iface(ses->chans[i].server, iface))
67 return true;
68 }
69 return false;
70}
71
72/* returns number of channels added */
73int cifs_try_adding_channels(struct cifs_ses *ses)
74{
75 int old_chan_count = ses->chan_count;
76 int left = ses->chan_max - ses->chan_count;
77 int i = 0;
78 int rc = 0;
79 int tries = 0;
80 struct cifs_server_iface *ifaces = NULL;
81 size_t iface_count;
82
83 if (left <= 0) {
84 cifs_dbg(FYI,
85 "ses already at max_channels (%zu), nothing to open\n",
86 ses->chan_max);
87 return 0;
88 }
89
90 if (ses->server->dialect < SMB30_PROT_ID) {
91 cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
92 return 0;
93 }
94
95 /*
96 * Make a copy of the iface list at the time and use that
97 * instead so as to not hold the iface spinlock for opening
98 * channels
99 */
100 spin_lock(&ses->iface_lock);
101 iface_count = ses->iface_count;
102 if (iface_count <= 0) {
103 spin_unlock(&ses->iface_lock);
104 cifs_dbg(VFS, "no iface list available to open channels\n");
105 return 0;
106 }
107 ifaces = kmemdup(ses->iface_list, iface_count*sizeof(*ifaces),
108 GFP_ATOMIC);
109 if (!ifaces) {
110 spin_unlock(&ses->iface_lock);
111 return 0;
112 }
113 spin_unlock(&ses->iface_lock);
114
115 /*
116 * Keep connecting to same, fastest, iface for all channels as
117 * long as its RSS. Try next fastest one if not RSS or channel
118 * creation fails.
119 */
120 while (left > 0) {
121 struct cifs_server_iface *iface;
122
123 tries++;
124 if (tries > 3*ses->chan_max) {
125 cifs_dbg(FYI, "too many channel open attempts (%d channels left to open)\n",
126 left);
127 break;
128 }
129
130 iface = &ifaces[i];
131 if (is_ses_using_iface(ses, iface) && !iface->rss_capable) {
132 i = (i+1) % iface_count;
133 continue;
134 }
135
136 rc = cifs_ses_add_channel(ses, iface);
137 if (rc) {
138 cifs_dbg(FYI, "failed to open extra channel on iface#%d rc=%d\n",
139 i, rc);
140 i = (i+1) % iface_count;
141 continue;
142 }
143
144 cifs_dbg(FYI, "successfully opened new channel on iface#%d\n",
145 i);
146 left--;
147 }
148
149 kfree(ifaces);
150 return ses->chan_count - old_chan_count;
151}
152
153/*
154 * If server is a channel of ses, return the corresponding enclosing
155 * cifs_chan otherwise return NULL.
156 */
157struct cifs_chan *
158cifs_ses_find_chan(struct cifs_ses *ses, struct TCP_Server_Info *server)
159{
160 int i;
161
162 for (i = 0; i < ses->chan_count; i++) {
163 if (ses->chans[i].server == server)
164 return &ses->chans[i];
165 }
166 return NULL;
167}
168
169int
170cifs_ses_add_channel(struct cifs_ses *ses, struct cifs_server_iface *iface)
171{
172 struct cifs_chan *chan;
173 struct smb_vol vol = {NULL};
174 static const char unc_fmt[] = "\\%s\\foo";
175 char unc[sizeof(unc_fmt)+SERVER_NAME_LEN_WITH_NULL] = {0};
176 struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
177 struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
178 int rc;
179 unsigned int xid = get_xid();
180
181 if (iface->sockaddr.ss_family == AF_INET)
182 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
183 ses, iface->speed, iface->rdma_capable ? "yes" : "no",
184 &ipv4->sin_addr);
185 else
186 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
187 ses, iface->speed, iface->rdma_capable ? "yes" : "no",
188 &ipv6->sin6_addr);
189
190 /*
191 * Setup a smb_vol with mostly the same info as the existing
192 * session and overwrite it with the requested iface data.
193 *
194 * We need to setup at least the fields used for negprot and
195 * sesssetup.
196 *
197 * We only need the volume here, so we can reuse memory from
198 * the session and server without caring about memory
199 * management.
200 */
201
202 /* Always make new connection for now (TODO?) */
203 vol.nosharesock = true;
204
205 /* Auth */
206 vol.domainauto = ses->domainAuto;
207 vol.domainname = ses->domainName;
208 vol.username = ses->user_name;
209 vol.password = ses->password;
210 vol.sectype = ses->sectype;
211 vol.sign = ses->sign;
212
213 /* UNC and paths */
214 /* XXX: Use ses->server->hostname? */
215 sprintf(unc, unc_fmt, ses->serverName);
216 vol.UNC = unc;
217 vol.prepath = "";
218
219 /* Reuse same version as master connection */
220 vol.vals = ses->server->vals;
221 vol.ops = ses->server->ops;
222
223 vol.noblocksnd = ses->server->noblocksnd;
224 vol.noautotune = ses->server->noautotune;
225 vol.sockopt_tcp_nodelay = ses->server->tcp_nodelay;
226 vol.echo_interval = ses->server->echo_interval / HZ;
227
228 /*
229 * This will be used for encoding/decoding user/domain/pw
230 * during sess setup auth.
231 *
232 * XXX: We use the default for simplicity but the proper way
233 * would be to use the one that ses used, which is not
234 * stored. This might break when dealing with non-ascii
235 * strings.
236 */
237 vol.local_nls = load_nls_default();
238
239 /* Use RDMA if possible */
240 vol.rdma = iface->rdma_capable;
241 memcpy(&vol.dstaddr, &iface->sockaddr, sizeof(struct sockaddr_storage));
242
243 /* reuse master con client guid */
244 memcpy(&vol.client_guid, ses->server->client_guid,
245 SMB2_CLIENT_GUID_SIZE);
246 vol.use_client_guid = true;
247
248 mutex_lock(&ses->session_mutex);
249
250 chan = ses->binding_chan = &ses->chans[ses->chan_count];
251 chan->server = cifs_get_tcp_session(&vol);
252 if (IS_ERR(chan->server)) {
253 rc = PTR_ERR(chan->server);
254 chan->server = NULL;
255 goto out;
256 }
257 spin_lock(&cifs_tcp_ses_lock);
258 chan->server->is_channel = true;
259 spin_unlock(&cifs_tcp_ses_lock);
260
261 /*
262 * We need to allocate the server crypto now as we will need
263 * to sign packets before we generate the channel signing key
264 * (we sign with the session key)
265 */
266 rc = smb311_crypto_shash_allocate(chan->server);
267 if (rc) {
268 cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
269 goto out;
270 }
271
272 ses->binding = true;
273 rc = cifs_negotiate_protocol(xid, ses);
274 if (rc)
275 goto out;
276
277 rc = cifs_setup_session(xid, ses, vol.local_nls);
278 if (rc)
279 goto out;
280
281 /* success, put it on the list
282 * XXX: sharing ses between 2 tcp servers is not possible, the
283 * way "internal" linked lists works in linux makes element
284 * only able to belong to one list
285 *
286 * the binding session is already established so the rest of
287 * the code should be able to look it up, no need to add the
288 * ses to the new server.
289 */
290
291 ses->chan_count++;
292 atomic_set(&ses->chan_seq, 0);
293out:
294 ses->binding = false;
295 ses->binding_chan = NULL;
296 mutex_unlock(&ses->session_mutex);
297
298 if (rc && chan->server)
299 cifs_put_tcp_session(chan->server, 0);
300 unload_nls(vol.local_nls);
301
302 return rc;
303}
304
305static __u32 cifs_ssetup_hdr(struct cifs_ses *ses, SESSION_SETUP_ANDX *pSMB)
306{
307 __u32 capabilities = 0;
308
309 /* init fields common to all four types of SessSetup */
310 /* Note that offsets for first seven fields in req struct are same */
311 /* in CIFS Specs so does not matter which of 3 forms of struct */
312 /* that we use in next few lines */
313 /* Note that header is initialized to zero in header_assemble */
314 pSMB->req.AndXCommand = 0xFF;
315 pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
316 CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
317 USHRT_MAX));
318 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
319 pSMB->req.VcNumber = cpu_to_le16(1);
320
321 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
322
323 /* BB verify whether signing required on neg or just on auth frame
324 (and NTLM case) */
325
326 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
327 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
328
329 if (ses->server->sign)
330 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
331
332 if (ses->capabilities & CAP_UNICODE) {
333 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
334 capabilities |= CAP_UNICODE;
335 }
336 if (ses->capabilities & CAP_STATUS32) {
337 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
338 capabilities |= CAP_STATUS32;
339 }
340 if (ses->capabilities & CAP_DFS) {
341 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
342 capabilities |= CAP_DFS;
343 }
344 if (ses->capabilities & CAP_UNIX)
345 capabilities |= CAP_UNIX;
346
347 return capabilities;
348}
349
350static void
351unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
352{
353 char *bcc_ptr = *pbcc_area;
354 int bytes_ret = 0;
355
356 /* Copy OS version */
357 bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
358 nls_cp);
359 bcc_ptr += 2 * bytes_ret;
360 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
361 32, nls_cp);
362 bcc_ptr += 2 * bytes_ret;
363 bcc_ptr += 2; /* trailing null */
364
365 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
366 32, nls_cp);
367 bcc_ptr += 2 * bytes_ret;
368 bcc_ptr += 2; /* trailing null */
369
370 *pbcc_area = bcc_ptr;
371}
372
373static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
374 const struct nls_table *nls_cp)
375{
376 char *bcc_ptr = *pbcc_area;
377 int bytes_ret = 0;
378
379 /* copy domain */
380 if (ses->domainName == NULL) {
381 /* Sending null domain better than using a bogus domain name (as
382 we did briefly in 2.6.18) since server will use its default */
383 *bcc_ptr = 0;
384 *(bcc_ptr+1) = 0;
385 bytes_ret = 0;
386 } else
387 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
388 CIFS_MAX_DOMAINNAME_LEN, nls_cp);
389 bcc_ptr += 2 * bytes_ret;
390 bcc_ptr += 2; /* account for null terminator */
391
392 *pbcc_area = bcc_ptr;
393}
394
395
396static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
397 const struct nls_table *nls_cp)
398{
399 char *bcc_ptr = *pbcc_area;
400 int bytes_ret = 0;
401
402 /* BB FIXME add check that strings total less
403 than 335 or will need to send them as arrays */
404
405 /* unicode strings, must be word aligned before the call */
406/* if ((long) bcc_ptr % 2) {
407 *bcc_ptr = 0;
408 bcc_ptr++;
409 } */
410 /* copy user */
411 if (ses->user_name == NULL) {
412 /* null user mount */
413 *bcc_ptr = 0;
414 *(bcc_ptr+1) = 0;
415 } else {
416 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
417 CIFS_MAX_USERNAME_LEN, nls_cp);
418 }
419 bcc_ptr += 2 * bytes_ret;
420 bcc_ptr += 2; /* account for null termination */
421
422 unicode_domain_string(&bcc_ptr, ses, nls_cp);
423 unicode_oslm_strings(&bcc_ptr, nls_cp);
424
425 *pbcc_area = bcc_ptr;
426}
427
428static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
429 const struct nls_table *nls_cp)
430{
431 char *bcc_ptr = *pbcc_area;
432 int len;
433
434 /* copy user */
435 /* BB what about null user mounts - check that we do this BB */
436 /* copy user */
437 if (ses->user_name != NULL) {
438 len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
439 if (WARN_ON_ONCE(len < 0))
440 len = CIFS_MAX_USERNAME_LEN - 1;
441 bcc_ptr += len;
442 }
443 /* else null user mount */
444 *bcc_ptr = 0;
445 bcc_ptr++; /* account for null termination */
446
447 /* copy domain */
448 if (ses->domainName != NULL) {
449 len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
450 if (WARN_ON_ONCE(len < 0))
451 len = CIFS_MAX_DOMAINNAME_LEN - 1;
452 bcc_ptr += len;
453 } /* else we will send a null domain name
454 so the server will default to its own domain */
455 *bcc_ptr = 0;
456 bcc_ptr++;
457
458 /* BB check for overflow here */
459
460 strcpy(bcc_ptr, "Linux version ");
461 bcc_ptr += strlen("Linux version ");
462 strcpy(bcc_ptr, init_utsname()->release);
463 bcc_ptr += strlen(init_utsname()->release) + 1;
464
465 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
466 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
467
468 *pbcc_area = bcc_ptr;
469}
470
471static void
472decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
473 const struct nls_table *nls_cp)
474{
475 int len;
476 char *data = *pbcc_area;
477
478 cifs_dbg(FYI, "bleft %d\n", bleft);
479
480 kfree(ses->serverOS);
481 ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
482 cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
483 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
484 data += len;
485 bleft -= len;
486 if (bleft <= 0)
487 return;
488
489 kfree(ses->serverNOS);
490 ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
491 cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
492 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
493 data += len;
494 bleft -= len;
495 if (bleft <= 0)
496 return;
497
498 kfree(ses->serverDomain);
499 ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
500 cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
501
502 return;
503}
504
505static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
506 struct cifs_ses *ses,
507 const struct nls_table *nls_cp)
508{
509 int len;
510 char *bcc_ptr = *pbcc_area;
511
512 cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
513
514 len = strnlen(bcc_ptr, bleft);
515 if (len >= bleft)
516 return;
517
518 kfree(ses->serverOS);
519
520 ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
521 if (ses->serverOS) {
522 memcpy(ses->serverOS, bcc_ptr, len);
523 ses->serverOS[len] = 0;
524 if (strncmp(ses->serverOS, "OS/2", 4) == 0)
525 cifs_dbg(FYI, "OS/2 server\n");
526 }
527
528 bcc_ptr += len + 1;
529 bleft -= len + 1;
530
531 len = strnlen(bcc_ptr, bleft);
532 if (len >= bleft)
533 return;
534
535 kfree(ses->serverNOS);
536
537 ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
538 if (ses->serverNOS) {
539 memcpy(ses->serverNOS, bcc_ptr, len);
540 ses->serverNOS[len] = 0;
541 }
542
543 bcc_ptr += len + 1;
544 bleft -= len + 1;
545
546 len = strnlen(bcc_ptr, bleft);
547 if (len > bleft)
548 return;
549
550 /* No domain field in LANMAN case. Domain is
551 returned by old servers in the SMB negprot response */
552 /* BB For newer servers which do not support Unicode,
553 but thus do return domain here we could add parsing
554 for it later, but it is not very important */
555 cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
556}
557
558int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
559 struct cifs_ses *ses)
560{
561 unsigned int tioffset; /* challenge message target info area */
562 unsigned int tilen; /* challenge message target info area length */
563
564 CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
565
566 if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
567 cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
568 return -EINVAL;
569 }
570
571 if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
572 cifs_dbg(VFS, "blob signature incorrect %s\n",
573 pblob->Signature);
574 return -EINVAL;
575 }
576 if (pblob->MessageType != NtLmChallenge) {
577 cifs_dbg(VFS, "Incorrect message type %d\n",
578 pblob->MessageType);
579 return -EINVAL;
580 }
581
582 memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
583 /* BB we could decode pblob->NegotiateFlags; some may be useful */
584 /* In particular we can examine sign flags */
585 /* BB spec says that if AvId field of MsvAvTimestamp is populated then
586 we must set the MIC field of the AUTHENTICATE_MESSAGE */
587 ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags);
588 tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
589 tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
590 if (tioffset > blob_len || tioffset + tilen > blob_len) {
591 cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
592 tioffset, tilen);
593 return -EINVAL;
594 }
595 if (tilen) {
596 ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
597 GFP_KERNEL);
598 if (!ses->auth_key.response) {
599 cifs_dbg(VFS, "Challenge target info alloc failure\n");
600 return -ENOMEM;
601 }
602 ses->auth_key.len = tilen;
603 }
604
605 return 0;
606}
607
608/* BB Move to ntlmssp.c eventually */
609
610/* We do not malloc the blob, it is passed in pbuffer, because
611 it is fixed size, and small, making this approach cleaner */
612void build_ntlmssp_negotiate_blob(unsigned char *pbuffer,
613 struct cifs_ses *ses)
614{
615 struct TCP_Server_Info *server = cifs_ses_server(ses);
616 NEGOTIATE_MESSAGE *sec_blob = (NEGOTIATE_MESSAGE *)pbuffer;
617 __u32 flags;
618
619 memset(pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
620 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
621 sec_blob->MessageType = NtLmNegotiate;
622
623 /* BB is NTLMV2 session security format easier to use here? */
624 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
625 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
626 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
627 NTLMSSP_NEGOTIATE_SEAL;
628 if (server->sign)
629 flags |= NTLMSSP_NEGOTIATE_SIGN;
630 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
631 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
632
633 sec_blob->NegotiateFlags = cpu_to_le32(flags);
634
635 sec_blob->WorkstationName.BufferOffset = 0;
636 sec_blob->WorkstationName.Length = 0;
637 sec_blob->WorkstationName.MaximumLength = 0;
638
639 /* Domain name is sent on the Challenge not Negotiate NTLMSSP request */
640 sec_blob->DomainName.BufferOffset = 0;
641 sec_blob->DomainName.Length = 0;
642 sec_blob->DomainName.MaximumLength = 0;
643}
644
645static int size_of_ntlmssp_blob(struct cifs_ses *ses)
646{
647 int sz = sizeof(AUTHENTICATE_MESSAGE) + ses->auth_key.len
648 - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
649
650 if (ses->domainName)
651 sz += 2 * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
652 else
653 sz += 2;
654
655 if (ses->user_name)
656 sz += 2 * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
657 else
658 sz += 2;
659
660 return sz;
661}
662
663int build_ntlmssp_auth_blob(unsigned char **pbuffer,
664 u16 *buflen,
665 struct cifs_ses *ses,
666 const struct nls_table *nls_cp)
667{
668 int rc;
669 AUTHENTICATE_MESSAGE *sec_blob;
670 __u32 flags;
671 unsigned char *tmp;
672
673 rc = setup_ntlmv2_rsp(ses, nls_cp);
674 if (rc) {
675 cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
676 *buflen = 0;
677 goto setup_ntlmv2_ret;
678 }
679 *pbuffer = kmalloc(size_of_ntlmssp_blob(ses), GFP_KERNEL);
680 if (!*pbuffer) {
681 rc = -ENOMEM;
682 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
683 *buflen = 0;
684 goto setup_ntlmv2_ret;
685 }
686 sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
687
688 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
689 sec_blob->MessageType = NtLmAuthenticate;
690
691 flags = NTLMSSP_NEGOTIATE_56 |
692 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_TARGET_INFO |
693 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
694 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
695 NTLMSSP_NEGOTIATE_SEAL;
696 if (ses->server->sign)
697 flags |= NTLMSSP_NEGOTIATE_SIGN;
698 if (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
699 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
700
701 tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
702 sec_blob->NegotiateFlags = cpu_to_le32(flags);
703
704 sec_blob->LmChallengeResponse.BufferOffset =
705 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
706 sec_blob->LmChallengeResponse.Length = 0;
707 sec_blob->LmChallengeResponse.MaximumLength = 0;
708
709 sec_blob->NtChallengeResponse.BufferOffset =
710 cpu_to_le32(tmp - *pbuffer);
711 if (ses->user_name != NULL) {
712 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
713 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
714 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
715
716 sec_blob->NtChallengeResponse.Length =
717 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
718 sec_blob->NtChallengeResponse.MaximumLength =
719 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
720 } else {
721 /*
722 * don't send an NT Response for anonymous access
723 */
724 sec_blob->NtChallengeResponse.Length = 0;
725 sec_blob->NtChallengeResponse.MaximumLength = 0;
726 }
727
728 if (ses->domainName == NULL) {
729 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
730 sec_blob->DomainName.Length = 0;
731 sec_blob->DomainName.MaximumLength = 0;
732 tmp += 2;
733 } else {
734 int len;
735 len = cifs_strtoUTF16((__le16 *)tmp, ses->domainName,
736 CIFS_MAX_DOMAINNAME_LEN, nls_cp);
737 len *= 2; /* unicode is 2 bytes each */
738 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
739 sec_blob->DomainName.Length = cpu_to_le16(len);
740 sec_blob->DomainName.MaximumLength = cpu_to_le16(len);
741 tmp += len;
742 }
743
744 if (ses->user_name == NULL) {
745 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
746 sec_blob->UserName.Length = 0;
747 sec_blob->UserName.MaximumLength = 0;
748 tmp += 2;
749 } else {
750 int len;
751 len = cifs_strtoUTF16((__le16 *)tmp, ses->user_name,
752 CIFS_MAX_USERNAME_LEN, nls_cp);
753 len *= 2; /* unicode is 2 bytes each */
754 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
755 sec_blob->UserName.Length = cpu_to_le16(len);
756 sec_blob->UserName.MaximumLength = cpu_to_le16(len);
757 tmp += len;
758 }
759
760 sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
761 sec_blob->WorkstationName.Length = 0;
762 sec_blob->WorkstationName.MaximumLength = 0;
763 tmp += 2;
764
765 if (((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) ||
766 (ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC))
767 && !calc_seckey(ses)) {
768 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
769 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
770 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
771 sec_blob->SessionKey.MaximumLength =
772 cpu_to_le16(CIFS_CPHTXT_SIZE);
773 tmp += CIFS_CPHTXT_SIZE;
774 } else {
775 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
776 sec_blob->SessionKey.Length = 0;
777 sec_blob->SessionKey.MaximumLength = 0;
778 }
779
780 *buflen = tmp - *pbuffer;
781setup_ntlmv2_ret:
782 return rc;
783}
784
785enum securityEnum
786cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
787{
788 switch (server->negflavor) {
789 case CIFS_NEGFLAVOR_EXTENDED:
790 switch (requested) {
791 case Kerberos:
792 case RawNTLMSSP:
793 return requested;
794 case Unspecified:
795 if (server->sec_ntlmssp &&
796 (global_secflags & CIFSSEC_MAY_NTLMSSP))
797 return RawNTLMSSP;
798 if ((server->sec_kerberos || server->sec_mskerberos) &&
799 (global_secflags & CIFSSEC_MAY_KRB5))
800 return Kerberos;
801 fallthrough;
802 default:
803 return Unspecified;
804 }
805 case CIFS_NEGFLAVOR_UNENCAP:
806 switch (requested) {
807 case NTLM:
808 case NTLMv2:
809 return requested;
810 case Unspecified:
811 if (global_secflags & CIFSSEC_MAY_NTLMV2)
812 return NTLMv2;
813 if (global_secflags & CIFSSEC_MAY_NTLM)
814 return NTLM;
815 default:
816 break;
817 }
818 fallthrough; /* to attempt LANMAN authentication next */
819 case CIFS_NEGFLAVOR_LANMAN:
820 switch (requested) {
821 case LANMAN:
822 return requested;
823 case Unspecified:
824 if (global_secflags & CIFSSEC_MAY_LANMAN)
825 return LANMAN;
826 fallthrough;
827 default:
828 return Unspecified;
829 }
830 default:
831 return Unspecified;
832 }
833}
834
835struct sess_data {
836 unsigned int xid;
837 struct cifs_ses *ses;
838 struct nls_table *nls_cp;
839 void (*func)(struct sess_data *);
840 int result;
841
842 /* we will send the SMB in three pieces:
843 * a fixed length beginning part, an optional
844 * SPNEGO blob (which can be zero length), and a
845 * last part which will include the strings
846 * and rest of bcc area. This allows us to avoid
847 * a large buffer 17K allocation
848 */
849 int buf0_type;
850 struct kvec iov[3];
851};
852
853static int
854sess_alloc_buffer(struct sess_data *sess_data, int wct)
855{
856 int rc;
857 struct cifs_ses *ses = sess_data->ses;
858 struct smb_hdr *smb_buf;
859
860 rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
861 (void **)&smb_buf);
862
863 if (rc)
864 return rc;
865
866 sess_data->iov[0].iov_base = (char *)smb_buf;
867 sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
868 /*
869 * This variable will be used to clear the buffer
870 * allocated above in case of any error in the calling function.
871 */
872 sess_data->buf0_type = CIFS_SMALL_BUFFER;
873
874 /* 2000 big enough to fit max user, domain, NOS name etc. */
875 sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
876 if (!sess_data->iov[2].iov_base) {
877 rc = -ENOMEM;
878 goto out_free_smb_buf;
879 }
880
881 return 0;
882
883out_free_smb_buf:
884 kfree(smb_buf);
885 sess_data->iov[0].iov_base = NULL;
886 sess_data->iov[0].iov_len = 0;
887 sess_data->buf0_type = CIFS_NO_BUFFER;
888 return rc;
889}
890
891static void
892sess_free_buffer(struct sess_data *sess_data)
893{
894
895 free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
896 sess_data->buf0_type = CIFS_NO_BUFFER;
897 kfree(sess_data->iov[2].iov_base);
898}
899
900static int
901sess_establish_session(struct sess_data *sess_data)
902{
903 struct cifs_ses *ses = sess_data->ses;
904
905 mutex_lock(&ses->server->srv_mutex);
906 if (!ses->server->session_estab) {
907 if (ses->server->sign) {
908 ses->server->session_key.response =
909 kmemdup(ses->auth_key.response,
910 ses->auth_key.len, GFP_KERNEL);
911 if (!ses->server->session_key.response) {
912 mutex_unlock(&ses->server->srv_mutex);
913 return -ENOMEM;
914 }
915 ses->server->session_key.len =
916 ses->auth_key.len;
917 }
918 ses->server->sequence_number = 0x2;
919 ses->server->session_estab = true;
920 }
921 mutex_unlock(&ses->server->srv_mutex);
922
923 cifs_dbg(FYI, "CIFS session established successfully\n");
924 spin_lock(&GlobalMid_Lock);
925 ses->status = CifsGood;
926 ses->need_reconnect = false;
927 spin_unlock(&GlobalMid_Lock);
928
929 return 0;
930}
931
932static int
933sess_sendreceive(struct sess_data *sess_data)
934{
935 int rc;
936 struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
937 __u16 count;
938 struct kvec rsp_iov = { NULL, 0 };
939
940 count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
941 be32_add_cpu(&smb_buf->smb_buf_length, count);
942 put_bcc(count, smb_buf);
943
944 rc = SendReceive2(sess_data->xid, sess_data->ses,
945 sess_data->iov, 3 /* num_iovecs */,
946 &sess_data->buf0_type,
947 CIFS_LOG_ERROR, &rsp_iov);
948 cifs_small_buf_release(sess_data->iov[0].iov_base);
949 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
950
951 return rc;
952}
953
954/*
955 * LANMAN and plaintext are less secure and off by default.
956 * So we make this explicitly be turned on in kconfig (in the
957 * build) and turned on at runtime (changed from the default)
958 * in proc/fs/cifs or via mount parm. Unfortunately this is
959 * needed for old Win (e.g. Win95), some obscure NAS and OS/2
960 */
961#ifdef CONFIG_CIFS_WEAK_PW_HASH
962static void
963sess_auth_lanman(struct sess_data *sess_data)
964{
965 int rc = 0;
966 struct smb_hdr *smb_buf;
967 SESSION_SETUP_ANDX *pSMB;
968 char *bcc_ptr;
969 struct cifs_ses *ses = sess_data->ses;
970 char lnm_session_key[CIFS_AUTH_RESP_SIZE];
971 __u16 bytes_remaining;
972
973 /* lanman 2 style sessionsetup */
974 /* wct = 10 */
975 rc = sess_alloc_buffer(sess_data, 10);
976 if (rc)
977 goto out;
978
979 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
980 bcc_ptr = sess_data->iov[2].iov_base;
981 (void)cifs_ssetup_hdr(ses, pSMB);
982
983 pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE;
984
985 if (ses->user_name != NULL) {
986 /* no capabilities flags in old lanman negotiation */
987 pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
988
989 /* Calculate hash with password and copy into bcc_ptr.
990 * Encryption Key (stored as in cryptkey) gets used if the
991 * security mode bit in Negotiate Protocol response states
992 * to use challenge/response method (i.e. Password bit is 1).
993 */
994 rc = calc_lanman_hash(ses->password, ses->server->cryptkey,
995 ses->server->sec_mode & SECMODE_PW_ENCRYPT ?
996 true : false, lnm_session_key);
997 if (rc)
998 goto out;
999
1000 memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE);
1001 bcc_ptr += CIFS_AUTH_RESP_SIZE;
1002 } else {
1003 pSMB->old_req.PasswordLength = 0;
1004 }
1005
1006 /*
1007 * can not sign if LANMAN negotiated so no need
1008 * to calculate signing key? but what if server
1009 * changed to do higher than lanman dialect and
1010 * we reconnected would we ever calc signing_key?
1011 */
1012
1013 cifs_dbg(FYI, "Negotiating LANMAN setting up strings\n");
1014 /* Unicode not allowed for LANMAN dialects */
1015 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1016
1017 sess_data->iov[2].iov_len = (long) bcc_ptr -
1018 (long) sess_data->iov[2].iov_base;
1019
1020 rc = sess_sendreceive(sess_data);
1021 if (rc)
1022 goto out;
1023
1024 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1025 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1026
1027 /* lanman response has a word count of 3 */
1028 if (smb_buf->WordCount != 3) {
1029 rc = -EIO;
1030 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1031 goto out;
1032 }
1033
1034 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1035 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1036
1037 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1038 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1039
1040 bytes_remaining = get_bcc(smb_buf);
1041 bcc_ptr = pByteArea(smb_buf);
1042
1043 /* BB check if Unicode and decode strings */
1044 if (bytes_remaining == 0) {
1045 /* no string area to decode, do nothing */
1046 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1047 /* unicode string area must be word-aligned */
1048 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1049 ++bcc_ptr;
1050 --bytes_remaining;
1051 }
1052 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1053 sess_data->nls_cp);
1054 } else {
1055 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1056 sess_data->nls_cp);
1057 }
1058
1059 rc = sess_establish_session(sess_data);
1060out:
1061 sess_data->result = rc;
1062 sess_data->func = NULL;
1063 sess_free_buffer(sess_data);
1064}
1065
1066#endif
1067
1068static void
1069sess_auth_ntlm(struct sess_data *sess_data)
1070{
1071 int rc = 0;
1072 struct smb_hdr *smb_buf;
1073 SESSION_SETUP_ANDX *pSMB;
1074 char *bcc_ptr;
1075 struct cifs_ses *ses = sess_data->ses;
1076 __u32 capabilities;
1077 __u16 bytes_remaining;
1078
1079 /* old style NTLM sessionsetup */
1080 /* wct = 13 */
1081 rc = sess_alloc_buffer(sess_data, 13);
1082 if (rc)
1083 goto out;
1084
1085 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1086 bcc_ptr = sess_data->iov[2].iov_base;
1087 capabilities = cifs_ssetup_hdr(ses, pSMB);
1088
1089 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1090 if (ses->user_name != NULL) {
1091 pSMB->req_no_secext.CaseInsensitivePasswordLength =
1092 cpu_to_le16(CIFS_AUTH_RESP_SIZE);
1093 pSMB->req_no_secext.CaseSensitivePasswordLength =
1094 cpu_to_le16(CIFS_AUTH_RESP_SIZE);
1095
1096 /* calculate ntlm response and session key */
1097 rc = setup_ntlm_response(ses, sess_data->nls_cp);
1098 if (rc) {
1099 cifs_dbg(VFS, "Error %d during NTLM authentication\n",
1100 rc);
1101 goto out;
1102 }
1103
1104 /* copy ntlm response */
1105 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1106 CIFS_AUTH_RESP_SIZE);
1107 bcc_ptr += CIFS_AUTH_RESP_SIZE;
1108 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1109 CIFS_AUTH_RESP_SIZE);
1110 bcc_ptr += CIFS_AUTH_RESP_SIZE;
1111 } else {
1112 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1113 pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1114 }
1115
1116 if (ses->capabilities & CAP_UNICODE) {
1117 /* unicode strings must be word aligned */
1118 if (sess_data->iov[0].iov_len % 2) {
1119 *bcc_ptr = 0;
1120 bcc_ptr++;
1121 }
1122 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1123 } else {
1124 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1125 }
1126
1127
1128 sess_data->iov[2].iov_len = (long) bcc_ptr -
1129 (long) sess_data->iov[2].iov_base;
1130
1131 rc = sess_sendreceive(sess_data);
1132 if (rc)
1133 goto out;
1134
1135 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1136 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1137
1138 if (smb_buf->WordCount != 3) {
1139 rc = -EIO;
1140 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1141 goto out;
1142 }
1143
1144 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1145 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1146
1147 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1148 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1149
1150 bytes_remaining = get_bcc(smb_buf);
1151 bcc_ptr = pByteArea(smb_buf);
1152
1153 /* BB check if Unicode and decode strings */
1154 if (bytes_remaining == 0) {
1155 /* no string area to decode, do nothing */
1156 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1157 /* unicode string area must be word-aligned */
1158 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1159 ++bcc_ptr;
1160 --bytes_remaining;
1161 }
1162 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1163 sess_data->nls_cp);
1164 } else {
1165 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1166 sess_data->nls_cp);
1167 }
1168
1169 rc = sess_establish_session(sess_data);
1170out:
1171 sess_data->result = rc;
1172 sess_data->func = NULL;
1173 sess_free_buffer(sess_data);
1174 kfree(ses->auth_key.response);
1175 ses->auth_key.response = NULL;
1176}
1177
1178static void
1179sess_auth_ntlmv2(struct sess_data *sess_data)
1180{
1181 int rc = 0;
1182 struct smb_hdr *smb_buf;
1183 SESSION_SETUP_ANDX *pSMB;
1184 char *bcc_ptr;
1185 struct cifs_ses *ses = sess_data->ses;
1186 __u32 capabilities;
1187 __u16 bytes_remaining;
1188
1189 /* old style NTLM sessionsetup */
1190 /* wct = 13 */
1191 rc = sess_alloc_buffer(sess_data, 13);
1192 if (rc)
1193 goto out;
1194
1195 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1196 bcc_ptr = sess_data->iov[2].iov_base;
1197 capabilities = cifs_ssetup_hdr(ses, pSMB);
1198
1199 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1200
1201 /* LM2 password would be here if we supported it */
1202 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1203
1204 if (ses->user_name != NULL) {
1205 /* calculate nlmv2 response and session key */
1206 rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
1207 if (rc) {
1208 cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
1209 goto out;
1210 }
1211
1212 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1213 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1214 bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1215
1216 /* set case sensitive password length after tilen may get
1217 * assigned, tilen is 0 otherwise.
1218 */
1219 pSMB->req_no_secext.CaseSensitivePasswordLength =
1220 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1221 } else {
1222 pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1223 }
1224
1225 if (ses->capabilities & CAP_UNICODE) {
1226 if (sess_data->iov[0].iov_len % 2) {
1227 *bcc_ptr = 0;
1228 bcc_ptr++;
1229 }
1230 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1231 } else {
1232 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1233 }
1234
1235
1236 sess_data->iov[2].iov_len = (long) bcc_ptr -
1237 (long) sess_data->iov[2].iov_base;
1238
1239 rc = sess_sendreceive(sess_data);
1240 if (rc)
1241 goto out;
1242
1243 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1244 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1245
1246 if (smb_buf->WordCount != 3) {
1247 rc = -EIO;
1248 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1249 goto out;
1250 }
1251
1252 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1253 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1254
1255 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1256 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1257
1258 bytes_remaining = get_bcc(smb_buf);
1259 bcc_ptr = pByteArea(smb_buf);
1260
1261 /* BB check if Unicode and decode strings */
1262 if (bytes_remaining == 0) {
1263 /* no string area to decode, do nothing */
1264 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1265 /* unicode string area must be word-aligned */
1266 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1267 ++bcc_ptr;
1268 --bytes_remaining;
1269 }
1270 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1271 sess_data->nls_cp);
1272 } else {
1273 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1274 sess_data->nls_cp);
1275 }
1276
1277 rc = sess_establish_session(sess_data);
1278out:
1279 sess_data->result = rc;
1280 sess_data->func = NULL;
1281 sess_free_buffer(sess_data);
1282 kfree(ses->auth_key.response);
1283 ses->auth_key.response = NULL;
1284}
1285
1286#ifdef CONFIG_CIFS_UPCALL
1287static void
1288sess_auth_kerberos(struct sess_data *sess_data)
1289{
1290 int rc = 0;
1291 struct smb_hdr *smb_buf;
1292 SESSION_SETUP_ANDX *pSMB;
1293 char *bcc_ptr;
1294 struct cifs_ses *ses = sess_data->ses;
1295 __u32 capabilities;
1296 __u16 bytes_remaining;
1297 struct key *spnego_key = NULL;
1298 struct cifs_spnego_msg *msg;
1299 u16 blob_len;
1300
1301 /* extended security */
1302 /* wct = 12 */
1303 rc = sess_alloc_buffer(sess_data, 12);
1304 if (rc)
1305 goto out;
1306
1307 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1308 bcc_ptr = sess_data->iov[2].iov_base;
1309 capabilities = cifs_ssetup_hdr(ses, pSMB);
1310
1311 spnego_key = cifs_get_spnego_key(ses);
1312 if (IS_ERR(spnego_key)) {
1313 rc = PTR_ERR(spnego_key);
1314 spnego_key = NULL;
1315 goto out;
1316 }
1317
1318 msg = spnego_key->payload.data[0];
1319 /*
1320 * check version field to make sure that cifs.upcall is
1321 * sending us a response in an expected form
1322 */
1323 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1324 cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1325 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1326 rc = -EKEYREJECTED;
1327 goto out_put_spnego_key;
1328 }
1329
1330 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1331 GFP_KERNEL);
1332 if (!ses->auth_key.response) {
1333 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1334 msg->sesskey_len);
1335 rc = -ENOMEM;
1336 goto out_put_spnego_key;
1337 }
1338 ses->auth_key.len = msg->sesskey_len;
1339
1340 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1341 capabilities |= CAP_EXTENDED_SECURITY;
1342 pSMB->req.Capabilities = cpu_to_le32(capabilities);
1343 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1344 sess_data->iov[1].iov_len = msg->secblob_len;
1345 pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1346
1347 if (ses->capabilities & CAP_UNICODE) {
1348 /* unicode strings must be word aligned */
1349 if ((sess_data->iov[0].iov_len
1350 + sess_data->iov[1].iov_len) % 2) {
1351 *bcc_ptr = 0;
1352 bcc_ptr++;
1353 }
1354 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1355 unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1356 } else {
1357 /* BB: is this right? */
1358 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1359 }
1360
1361 sess_data->iov[2].iov_len = (long) bcc_ptr -
1362 (long) sess_data->iov[2].iov_base;
1363
1364 rc = sess_sendreceive(sess_data);
1365 if (rc)
1366 goto out_put_spnego_key;
1367
1368 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1369 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1370
1371 if (smb_buf->WordCount != 4) {
1372 rc = -EIO;
1373 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1374 goto out_put_spnego_key;
1375 }
1376
1377 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1378 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1379
1380 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1381 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1382
1383 bytes_remaining = get_bcc(smb_buf);
1384 bcc_ptr = pByteArea(smb_buf);
1385
1386 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1387 if (blob_len > bytes_remaining) {
1388 cifs_dbg(VFS, "bad security blob length %d\n",
1389 blob_len);
1390 rc = -EINVAL;
1391 goto out_put_spnego_key;
1392 }
1393 bcc_ptr += blob_len;
1394 bytes_remaining -= blob_len;
1395
1396 /* BB check if Unicode and decode strings */
1397 if (bytes_remaining == 0) {
1398 /* no string area to decode, do nothing */
1399 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1400 /* unicode string area must be word-aligned */
1401 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1402 ++bcc_ptr;
1403 --bytes_remaining;
1404 }
1405 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1406 sess_data->nls_cp);
1407 } else {
1408 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1409 sess_data->nls_cp);
1410 }
1411
1412 rc = sess_establish_session(sess_data);
1413out_put_spnego_key:
1414 key_invalidate(spnego_key);
1415 key_put(spnego_key);
1416out:
1417 sess_data->result = rc;
1418 sess_data->func = NULL;
1419 sess_free_buffer(sess_data);
1420 kfree(ses->auth_key.response);
1421 ses->auth_key.response = NULL;
1422}
1423
1424#endif /* ! CONFIG_CIFS_UPCALL */
1425
1426/*
1427 * The required kvec buffers have to be allocated before calling this
1428 * function.
1429 */
1430static int
1431_sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1432{
1433 SESSION_SETUP_ANDX *pSMB;
1434 struct cifs_ses *ses = sess_data->ses;
1435 __u32 capabilities;
1436 char *bcc_ptr;
1437
1438 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1439
1440 capabilities = cifs_ssetup_hdr(ses, pSMB);
1441 if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) {
1442 cifs_dbg(VFS, "NTLMSSP requires Unicode support\n");
1443 return -ENOSYS;
1444 }
1445
1446 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1447 capabilities |= CAP_EXTENDED_SECURITY;
1448 pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1449
1450 bcc_ptr = sess_data->iov[2].iov_base;
1451 /* unicode strings must be word aligned */
1452 if ((sess_data->iov[0].iov_len + sess_data->iov[1].iov_len) % 2) {
1453 *bcc_ptr = 0;
1454 bcc_ptr++;
1455 }
1456 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1457
1458 sess_data->iov[2].iov_len = (long) bcc_ptr -
1459 (long) sess_data->iov[2].iov_base;
1460
1461 return 0;
1462}
1463
1464static void
1465sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1466
1467static void
1468sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1469{
1470 int rc;
1471 struct smb_hdr *smb_buf;
1472 SESSION_SETUP_ANDX *pSMB;
1473 struct cifs_ses *ses = sess_data->ses;
1474 __u16 bytes_remaining;
1475 char *bcc_ptr;
1476 u16 blob_len;
1477
1478 cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1479
1480 /*
1481 * if memory allocation is successful, caller of this function
1482 * frees it.
1483 */
1484 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1485 if (!ses->ntlmssp) {
1486 rc = -ENOMEM;
1487 goto out;
1488 }
1489 ses->ntlmssp->sesskey_per_smbsess = false;
1490
1491 /* wct = 12 */
1492 rc = sess_alloc_buffer(sess_data, 12);
1493 if (rc)
1494 goto out;
1495
1496 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1497
1498 /* Build security blob before we assemble the request */
1499 build_ntlmssp_negotiate_blob(pSMB->req.SecurityBlob, ses);
1500 sess_data->iov[1].iov_len = sizeof(NEGOTIATE_MESSAGE);
1501 sess_data->iov[1].iov_base = pSMB->req.SecurityBlob;
1502 pSMB->req.SecurityBlobLength = cpu_to_le16(sizeof(NEGOTIATE_MESSAGE));
1503
1504 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1505 if (rc)
1506 goto out;
1507
1508 rc = sess_sendreceive(sess_data);
1509
1510 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1511 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1512
1513 /* If true, rc here is expected and not an error */
1514 if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1515 smb_buf->Status.CifsError ==
1516 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1517 rc = 0;
1518
1519 if (rc)
1520 goto out;
1521
1522 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1523
1524 if (smb_buf->WordCount != 4) {
1525 rc = -EIO;
1526 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1527 goto out;
1528 }
1529
1530 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1531 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1532
1533 bytes_remaining = get_bcc(smb_buf);
1534 bcc_ptr = pByteArea(smb_buf);
1535
1536 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1537 if (blob_len > bytes_remaining) {
1538 cifs_dbg(VFS, "bad security blob length %d\n",
1539 blob_len);
1540 rc = -EINVAL;
1541 goto out;
1542 }
1543
1544 rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1545out:
1546 sess_free_buffer(sess_data);
1547
1548 if (!rc) {
1549 sess_data->func = sess_auth_rawntlmssp_authenticate;
1550 return;
1551 }
1552
1553 /* Else error. Cleanup */
1554 kfree(ses->auth_key.response);
1555 ses->auth_key.response = NULL;
1556 kfree(ses->ntlmssp);
1557 ses->ntlmssp = NULL;
1558
1559 sess_data->func = NULL;
1560 sess_data->result = rc;
1561}
1562
1563static void
1564sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1565{
1566 int rc;
1567 struct smb_hdr *smb_buf;
1568 SESSION_SETUP_ANDX *pSMB;
1569 struct cifs_ses *ses = sess_data->ses;
1570 __u16 bytes_remaining;
1571 char *bcc_ptr;
1572 unsigned char *ntlmsspblob = NULL;
1573 u16 blob_len;
1574
1575 cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1576
1577 /* wct = 12 */
1578 rc = sess_alloc_buffer(sess_data, 12);
1579 if (rc)
1580 goto out;
1581
1582 /* Build security blob before we assemble the request */
1583 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1584 smb_buf = (struct smb_hdr *)pSMB;
1585 rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1586 &blob_len, ses, sess_data->nls_cp);
1587 if (rc)
1588 goto out_free_ntlmsspblob;
1589 sess_data->iov[1].iov_len = blob_len;
1590 sess_data->iov[1].iov_base = ntlmsspblob;
1591 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1592 /*
1593 * Make sure that we tell the server that we are using
1594 * the uid that it just gave us back on the response
1595 * (challenge)
1596 */
1597 smb_buf->Uid = ses->Suid;
1598
1599 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1600 if (rc)
1601 goto out_free_ntlmsspblob;
1602
1603 rc = sess_sendreceive(sess_data);
1604 if (rc)
1605 goto out_free_ntlmsspblob;
1606
1607 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1608 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1609 if (smb_buf->WordCount != 4) {
1610 rc = -EIO;
1611 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1612 goto out_free_ntlmsspblob;
1613 }
1614
1615 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1616 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1617
1618 if (ses->Suid != smb_buf->Uid) {
1619 ses->Suid = smb_buf->Uid;
1620 cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1621 }
1622
1623 bytes_remaining = get_bcc(smb_buf);
1624 bcc_ptr = pByteArea(smb_buf);
1625 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1626 if (blob_len > bytes_remaining) {
1627 cifs_dbg(VFS, "bad security blob length %d\n",
1628 blob_len);
1629 rc = -EINVAL;
1630 goto out_free_ntlmsspblob;
1631 }
1632 bcc_ptr += blob_len;
1633 bytes_remaining -= blob_len;
1634
1635
1636 /* BB check if Unicode and decode strings */
1637 if (bytes_remaining == 0) {
1638 /* no string area to decode, do nothing */
1639 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1640 /* unicode string area must be word-aligned */
1641 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1642 ++bcc_ptr;
1643 --bytes_remaining;
1644 }
1645 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1646 sess_data->nls_cp);
1647 } else {
1648 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1649 sess_data->nls_cp);
1650 }
1651
1652out_free_ntlmsspblob:
1653 kfree(ntlmsspblob);
1654out:
1655 sess_free_buffer(sess_data);
1656
1657 if (!rc)
1658 rc = sess_establish_session(sess_data);
1659
1660 /* Cleanup */
1661 kfree(ses->auth_key.response);
1662 ses->auth_key.response = NULL;
1663 kfree(ses->ntlmssp);
1664 ses->ntlmssp = NULL;
1665
1666 sess_data->func = NULL;
1667 sess_data->result = rc;
1668}
1669
1670static int select_sec(struct cifs_ses *ses, struct sess_data *sess_data)
1671{
1672 int type;
1673
1674 type = cifs_select_sectype(ses->server, ses->sectype);
1675 cifs_dbg(FYI, "sess setup type %d\n", type);
1676 if (type == Unspecified) {
1677 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1678 return -EINVAL;
1679 }
1680
1681 switch (type) {
1682 case LANMAN:
1683 /* LANMAN and plaintext are less secure and off by default.
1684 * So we make this explicitly be turned on in kconfig (in the
1685 * build) and turned on at runtime (changed from the default)
1686 * in proc/fs/cifs or via mount parm. Unfortunately this is
1687 * needed for old Win (e.g. Win95), some obscure NAS and OS/2 */
1688#ifdef CONFIG_CIFS_WEAK_PW_HASH
1689 sess_data->func = sess_auth_lanman;
1690 break;
1691#else
1692 return -EOPNOTSUPP;
1693#endif
1694 case NTLM:
1695 sess_data->func = sess_auth_ntlm;
1696 break;
1697 case NTLMv2:
1698 sess_data->func = sess_auth_ntlmv2;
1699 break;
1700 case Kerberos:
1701#ifdef CONFIG_CIFS_UPCALL
1702 sess_data->func = sess_auth_kerberos;
1703 break;
1704#else
1705 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1706 return -ENOSYS;
1707#endif /* CONFIG_CIFS_UPCALL */
1708 case RawNTLMSSP:
1709 sess_data->func = sess_auth_rawntlmssp_negotiate;
1710 break;
1711 default:
1712 cifs_dbg(VFS, "secType %d not supported!\n", type);
1713 return -ENOSYS;
1714 }
1715
1716 return 0;
1717}
1718
1719int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
1720 const struct nls_table *nls_cp)
1721{
1722 int rc = 0;
1723 struct sess_data *sess_data;
1724
1725 if (ses == NULL) {
1726 WARN(1, "%s: ses == NULL!", __func__);
1727 return -EINVAL;
1728 }
1729
1730 sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
1731 if (!sess_data)
1732 return -ENOMEM;
1733
1734 rc = select_sec(ses, sess_data);
1735 if (rc)
1736 goto out;
1737
1738 sess_data->xid = xid;
1739 sess_data->ses = ses;
1740 sess_data->buf0_type = CIFS_NO_BUFFER;
1741 sess_data->nls_cp = (struct nls_table *) nls_cp;
1742
1743 while (sess_data->func)
1744 sess_data->func(sess_data);
1745
1746 /* Store result before we free sess_data */
1747 rc = sess_data->result;
1748
1749out:
1750 kfree(sess_data);
1751 return rc;
1752}