fs/cifs/sess.c

   1 /*
   2  *   fs/cifs/sess.c
   3  *
   4  *   SMB/CIFS session setup handling routines
   5  *
   6  *   Copyright (c) International Business Machines  Corp., 2006
   7  *   Author(s): Steve French (sfrench@us.ibm.com)
   8  *
   9  *   This library is free software; you can redistribute it and/or modify
  10  *   it under the terms of the GNU Lesser General Public License as published
  11  *   by the Free Software Foundation; either version 2.1 of the License, or
  12  *   (at your option) any later version.
  13  *
  14  *   This library is distributed in the hope that it will be useful,
  15  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  17  *   the GNU Lesser General Public License for more details.
  18  *
  19  *   You should have received a copy of the GNU Lesser General Public License
  20  *   along with this library; if not, write to the Free Software
  21  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  22  */
  23
  24 #include "cifspdu.h"
  25 #include "cifsglob.h"
  26 #include "cifsproto.h"
  27 #include "cifs_unicode.h"
  28 #include "cifs_debug.h"
  29 #include "ntlmssp.h"
  30 #include "nterr.h"
  31 #include <linux/utsname.h>
  32
  33 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
  34                          unsigned char *p24);
  35
  36 static __u32 cifs_ssetup_hdr(struct cifsSesInfo *ses, SESSION_SETUP_ANDX *pSMB)
  37 {
  38         __u32 capabilities = 0;
  39
  40         /* init fields common to all four types of SessSetup */
  41         /* note that header is initialized to zero in header_assemble */
  42         pSMB->req.AndXCommand = 0xFF;
  43         pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
  44         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
  45
  46         /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
  47
  48         /* BB verify whether signing required on neg or just on auth frame
  49            (and NTLM case) */
  50
  51         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
  52                         CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
  53
  54         if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
  55                 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
  56
  57         if (ses->capabilities & CAP_UNICODE) {
  58                 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
  59                 capabilities |= CAP_UNICODE;
  60         }
  61         if (ses->capabilities & CAP_STATUS32) {
  62                 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
  63                 capabilities |= CAP_STATUS32;
  64         }
  65         if (ses->capabilities & CAP_DFS) {
  66                 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
  67                 capabilities |= CAP_DFS;
  68         }
  69         if (ses->capabilities & CAP_UNIX) {
  70                 capabilities |= CAP_UNIX;
  71         }
  72
  73         /* BB check whether to init vcnum BB */
  74         return capabilities;
  75 }
  76
  77 static void unicode_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
  78                             const struct nls_table * nls_cp)
  79 {
  80         char * bcc_ptr = *pbcc_area;
  81         int bytes_ret = 0;
  82
  83         /* BB FIXME add check that strings total less
  84         than 335 or will need to send them as arrays */
  85
  86         /* unicode strings, must be word aligned before the call */
  87 /*      if ((long) bcc_ptr % 2) {
  88                 *bcc_ptr = 0;
  89                 bcc_ptr++;
  90         } */
  91         /* copy user */
  92         if(ses->userName == NULL) {
  93                 /* null user mount */
  94                 *bcc_ptr = 0;
  95                 *(bcc_ptr+1) = 0;
  96         } else { /* 300 should be long enough for any conceivable user name */
  97                 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->userName,
  98                                           300, nls_cp);
  99         }
 100         bcc_ptr += 2 * bytes_ret;
 101         bcc_ptr += 2; /* account for null termination */
 102         /* copy domain */
 103         if(ses->domainName == NULL) {
 104                 /* Sending null domain better than using a bogus domain name (as
 105                 we did briefly in 2.6.18) since server will use its default */
 106                 *bcc_ptr = 0;
 107                 *(bcc_ptr+1) = 0;
 108                 bytes_ret = 0;
 109         } else
 110                 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->domainName,
 111                                           256, nls_cp);
 112         bcc_ptr += 2 * bytes_ret;
 113         bcc_ptr += 2;  /* account for null terminator */
 114
 115         /* Copy OS version */
 116         bytes_ret = cifs_strtoUCS((__le16 *)bcc_ptr, "Linux version ", 32,
 117                                   nls_cp);
 118         bcc_ptr += 2 * bytes_ret;
 119         bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, init_utsname()->release,
 120                                   32, nls_cp);
 121         bcc_ptr += 2 * bytes_ret;
 122         bcc_ptr += 2; /* trailing null */
 123
 124         bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
 125                                   32, nls_cp);
 126         bcc_ptr += 2 * bytes_ret;
 127         bcc_ptr += 2; /* trailing null */
 128
 129         *pbcc_area = bcc_ptr;
 130 }
 131
 132 static void ascii_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
 133                           const struct nls_table * nls_cp)
 134 {
 135         char * bcc_ptr = *pbcc_area;
 136
 137         /* copy user */
 138         /* BB what about null user mounts - check that we do this BB */
 139         /* copy user */
 140         if(ses->userName == NULL) {
 141                 /* BB what about null user mounts - check that we do this BB */
 142         } else { /* 300 should be long enough for any conceivable user name */
 143                 strncpy(bcc_ptr, ses->userName, 300);
 144         }
 145         /* BB improve check for overflow */
 146         bcc_ptr += strnlen(ses->userName, 300);
 147         *bcc_ptr = 0;
 148         bcc_ptr++; /* account for null termination */
 149
 150         /* copy domain */
 151
 152         if(ses->domainName != NULL) {
 153                 strncpy(bcc_ptr, ses->domainName, 256);
 154                 bcc_ptr += strnlen(ses->domainName, 256);
 155         } /* else we will send a null domain name
 156              so the server will default to its own domain */
 157         *bcc_ptr = 0;
 158         bcc_ptr++;
 159
 160         /* BB check for overflow here */
 161
 162         strcpy(bcc_ptr, "Linux version ");
 163         bcc_ptr += strlen("Linux version ");
 164         strcpy(bcc_ptr, init_utsname()->release);
 165         bcc_ptr += strlen(init_utsname()->release) + 1;
 166
 167         strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
 168         bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
 169
 170         *pbcc_area = bcc_ptr;
 171 }
 172
 173 static int decode_unicode_ssetup(char ** pbcc_area, int bleft, struct cifsSesInfo *ses,
 174                             const struct nls_table * nls_cp)
 175 {
 176         int rc = 0;
 177         int words_left, len;
 178         char * data = *pbcc_area;
 179
 180
 181
 182         cFYI(1,("bleft %d",bleft));
 183
 184
 185         /* SMB header is unaligned, so cifs servers word align start of
 186            Unicode strings */
 187         data++;
 188         bleft--; /* Windows servers do not always double null terminate
 189                     their final Unicode string - in which case we
 190                     now will not attempt to decode the byte of junk
 191                     which follows it */
 192
 193         words_left = bleft / 2;
 194
 195         /* save off server operating system */
 196         len = UniStrnlen((wchar_t *) data, words_left);
 197
 198 /* We look for obvious messed up bcc or strings in response so we do not go off
 199    the end since (at least) WIN2K and Windows XP have a major bug in not null
 200    terminating last Unicode string in response  */
 201         if(len >= words_left)
 202                 return rc;
 203
 204         if(ses->serverOS)
 205                 kfree(ses->serverOS);
 206         /* UTF-8 string will not grow more than four times as big as UCS-16 */
 207         ses->serverOS = kzalloc(4 * len, GFP_KERNEL);
 208         if(ses->serverOS != NULL) {
 209                 cifs_strfromUCS_le(ses->serverOS, (__le16 *)data, len,
 210                                    nls_cp);
 211         }
 212         data += 2 * (len + 1);
 213         words_left -= len + 1;
 214
 215         /* save off server network operating system */
 216         len = UniStrnlen((wchar_t *) data, words_left);
 217
 218         if(len >= words_left)
 219                 return rc;
 220
 221         if(ses->serverNOS)
 222                 kfree(ses->serverNOS);
 223         ses->serverNOS = kzalloc(4 * len, GFP_KERNEL); /* BB this is wrong length FIXME BB */
 224         if(ses->serverNOS != NULL) {
 225                 cifs_strfromUCS_le(ses->serverNOS, (__le16 *)data, len,
 226                                    nls_cp);
 227                 if(strncmp(ses->serverNOS, "NT LAN Manager 4",16) == 0) {
 228                         cFYI(1,("NT4 server"));
 229                         ses->flags |= CIFS_SES_NT4;
 230                 }
 231         }
 232         data += 2 * (len + 1);
 233         words_left -= len + 1;
 234
 235         /* save off server domain */
 236         len = UniStrnlen((wchar_t *) data, words_left);
 237
 238         if(len > words_left)
 239                 return rc;
 240
 241         if(ses->serverDomain)
 242                 kfree(ses->serverDomain);
 243         ses->serverDomain = kzalloc(2 * (len + 1), GFP_KERNEL); /* BB FIXME wrong length */
 244         if(ses->serverDomain != NULL) {
 245                 cifs_strfromUCS_le(ses->serverDomain, (__le16 *)data, len,
 246                                    nls_cp);
 247                 ses->serverDomain[2*len] = 0;
 248                 ses->serverDomain[(2*len) + 1] = 0;
 249         }
 250         data += 2 * (len + 1);
 251         words_left -= len + 1;
 252
 253         cFYI(1,("words left: %d",words_left));
 254
 255         return rc;
 256 }
 257
 258 static int decode_ascii_ssetup(char ** pbcc_area, int bleft, struct cifsSesInfo *ses,
 259                             const struct nls_table * nls_cp)
 260 {
 261         int rc = 0;
 262         int len;
 263         char * bcc_ptr = *pbcc_area;
 264
 265         cFYI(1,("decode sessetup ascii. bleft %d", bleft));
 266
 267         len = strnlen(bcc_ptr, bleft);
 268         if(len >= bleft)
 269                 return rc;
 270
 271         if(ses->serverOS)
 272                 kfree(ses->serverOS);
 273
 274         ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
 275         if(ses->serverOS)
 276                 strncpy(ses->serverOS, bcc_ptr, len);
 277         if(strncmp(ses->serverOS, "OS/2",4) == 0) {
 278                         cFYI(1,("OS/2 server"));
 279                         ses->flags |= CIFS_SES_OS2;
 280         }
 281
 282         bcc_ptr += len + 1;
 283         bleft -= len + 1;
 284
 285         len = strnlen(bcc_ptr, bleft);
 286         if(len >= bleft)
 287                 return rc;
 288
 289         if(ses->serverNOS)
 290                 kfree(ses->serverNOS);
 291
 292         ses->serverNOS = kzalloc(len + 1, GFP_KERNEL);
 293         if(ses->serverNOS)
 294                 strncpy(ses->serverNOS, bcc_ptr, len);
 295
 296         bcc_ptr += len + 1;
 297         bleft -= len + 1;
 298
 299         len = strnlen(bcc_ptr, bleft);
 300         if(len > bleft)
 301                 return rc;
 302
 303         /* No domain field in LANMAN case. Domain is
 304            returned by old servers in the SMB negprot response */
 305         /* BB For newer servers which do not support Unicode,
 306            but thus do return domain here we could add parsing
 307            for it later, but it is not very important */
 308         cFYI(1,("ascii: bytes left %d",bleft));
 309
 310         return rc;
 311 }
 312
 313 int
 314 CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
 315                 const struct nls_table *nls_cp)
 316 {
 317         int rc = 0;
 318         int wct;
 319         struct smb_hdr *smb_buf;
 320         char *bcc_ptr;
 321         char *str_area;
 322         SESSION_SETUP_ANDX *pSMB;
 323         __u32 capabilities;
 324         int count;
 325         int resp_buf_type = 0;
 326         struct kvec iov[2];
 327         enum securityEnum type;
 328         __u16 action;
 329         int bytes_remaining;
 330
 331         if(ses == NULL)
 332                 return -EINVAL;
 333
 334         type = ses->server->secType;
 335
 336         cFYI(1,("sess setup type %d",type));
 337         if(type == LANMAN) {
 338 #ifndef CONFIG_CIFS_WEAK_PW_HASH
 339                 /* LANMAN and plaintext are less secure and off by default.
 340                 So we make this explicitly be turned on in kconfig (in the
 341                 build) and turned on at runtime (changed from the default)
 342                 in proc/fs/cifs or via mount parm.  Unfortunately this is
 343                 needed for old Win (e.g. Win95), some obscure NAS and OS/2 */
 344                 return -EOPNOTSUPP;
 345 #endif
 346                 wct = 10; /* lanman 2 style sessionsetup */
 347         } else if((type == NTLM) || (type == NTLMv2)) {
 348                 /* For NTLMv2 failures eventually may need to retry NTLM */
 349                 wct = 13; /* old style NTLM sessionsetup */
 350         } else /* same size for negotiate or auth, NTLMSSP or extended security */
 351                 wct = 12;
 352
 353         rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
 354                             (void **)&smb_buf);
 355         if(rc)
 356                 return rc;
 357
 358         pSMB = (SESSION_SETUP_ANDX *)smb_buf;
 359
 360         capabilities = cifs_ssetup_hdr(ses, pSMB);
 361
 362         /* we will send the SMB in two pieces,
 363         a fixed length beginning part, and a
 364         second part which will include the strings
 365         and rest of bcc area, in order to avoid having
 366         to do a large buffer 17K allocation */
 367         iov[0].iov_base = (char *)pSMB;
 368         iov[0].iov_len = smb_buf->smb_buf_length + 4;
 369
 370         /* 2000 big enough to fit max user, domain, NOS name etc. */
 371         str_area = kmalloc(2000, GFP_KERNEL);
 372         bcc_ptr = str_area;
 373
 374         ses->flags &= ~CIFS_SES_LANMAN;
 375
 376         if(type == LANMAN) {
 377 #ifdef CONFIG_CIFS_WEAK_PW_HASH
 378                 char lnm_session_key[CIFS_SESS_KEY_SIZE];
 379
 380                 /* no capabilities flags in old lanman negotiation */
 381
 382                 pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
 383                 /* BB calculate hash with password */
 384                 /* and copy into bcc */
 385
 386                 calc_lanman_hash(ses, lnm_session_key);
 387                 ses->flags |= CIFS_SES_LANMAN;
 388 /* #ifdef CONFIG_CIFS_DEBUG2
 389                 cifs_dump_mem("cryptkey: ",ses->server->cryptKey,
 390                         CIFS_SESS_KEY_SIZE);
 391 #endif */
 392                 memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_SESS_KEY_SIZE);
 393                 bcc_ptr += CIFS_SESS_KEY_SIZE;
 394
 395                 /* can not sign if LANMAN negotiated so no need
 396                 to calculate signing key? but what if server
 397                 changed to do higher than lanman dialect and
 398                 we reconnected would we ever calc signing_key? */
 399
 400                 cFYI(1,("Negotiating LANMAN setting up strings"));
 401                 /* Unicode not allowed for LANMAN dialects */
 402                 ascii_ssetup_strings(&bcc_ptr, ses, nls_cp);
 403 #endif
 404         } else if (type == NTLM) {
 405                 char ntlm_session_key[CIFS_SESS_KEY_SIZE];
 406
 407                 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
 408                 pSMB->req_no_secext.CaseInsensitivePasswordLength =
 409                         cpu_to_le16(CIFS_SESS_KEY_SIZE);
 410                 pSMB->req_no_secext.CaseSensitivePasswordLength =
 411                         cpu_to_le16(CIFS_SESS_KEY_SIZE);
 412
 413                 /* calculate session key */
 414                 SMBNTencrypt(ses->password, ses->server->cryptKey,
 415                              ntlm_session_key);
 416
 417                 if(first_time) /* should this be moved into common code
 418                                   with similar ntlmv2 path? */
 419                         cifs_calculate_mac_key(ses->server->mac_signing_key,
 420                                 ntlm_session_key, ses->password);
 421                 /* copy session key */
 422
 423                 memcpy(bcc_ptr, (char *)ntlm_session_key,CIFS_SESS_KEY_SIZE);
 424                 bcc_ptr += CIFS_SESS_KEY_SIZE;
 425                 memcpy(bcc_ptr, (char *)ntlm_session_key,CIFS_SESS_KEY_SIZE);
 426                 bcc_ptr += CIFS_SESS_KEY_SIZE;
 427                 if(ses->capabilities & CAP_UNICODE) {
 428                         /* unicode strings must be word aligned */
 429                         if (iov[0].iov_len % 2) {
 430                                 *bcc_ptr = 0;
 431                                 bcc_ptr++;
 432                         }
 433                         unicode_ssetup_strings(&bcc_ptr, ses, nls_cp);
 434                 } else
 435                         ascii_ssetup_strings(&bcc_ptr, ses, nls_cp);
 436         } else if (type == NTLMv2) {
 437                 char * v2_sess_key =
 438                         kmalloc(sizeof(struct ntlmv2_resp), GFP_KERNEL);
 439
 440                 /* BB FIXME change all users of v2_sess_key to
 441                    struct ntlmv2_resp */
 442
 443                 if(v2_sess_key == NULL) {
 444                         cifs_small_buf_release(smb_buf);
 445                         return -ENOMEM;
 446                 }
 447
 448                 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
 449
 450                 /* LM2 password would be here if we supported it */
 451                 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
 452                 /*      cpu_to_le16(LM2_SESS_KEY_SIZE); */
 453
 454                 pSMB->req_no_secext.CaseSensitivePasswordLength =
 455                         cpu_to_le16(sizeof(struct ntlmv2_resp));
 456
 457                 /* calculate session key */
 458                 setup_ntlmv2_rsp(ses, v2_sess_key, nls_cp);
 459                 if(first_time) /* should this be moved into common code
 460                                   with similar ntlmv2 path? */
 461                 /*   cifs_calculate_ntlmv2_mac_key(ses->server->mac_signing_key,
 462                                 response BB FIXME, v2_sess_key); */
 463
 464                 /* copy session key */
 465
 466         /*      memcpy(bcc_ptr, (char *)ntlm_session_key,LM2_SESS_KEY_SIZE);
 467                 bcc_ptr += LM2_SESS_KEY_SIZE; */
 468                 memcpy(bcc_ptr, (char *)v2_sess_key, sizeof(struct ntlmv2_resp));
 469                 bcc_ptr += sizeof(struct ntlmv2_resp);
 470                 kfree(v2_sess_key);
 471                 if(ses->capabilities & CAP_UNICODE) {
 472                         if(iov[0].iov_len % 2) {
 473                                 *bcc_ptr = 0;
 474                         }       bcc_ptr++;
 475                         unicode_ssetup_strings(&bcc_ptr, ses, nls_cp);
 476                 } else
 477                         ascii_ssetup_strings(&bcc_ptr, ses, nls_cp);
 478         } else /* NTLMSSP or SPNEGO */ {
 479                 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
 480                 capabilities |= CAP_EXTENDED_SECURITY;
 481                 pSMB->req.Capabilities = cpu_to_le32(capabilities);
 482                 /* BB set password lengths */
 483         }
 484
 485         count = (long) bcc_ptr - (long) str_area;
 486         smb_buf->smb_buf_length += count;
 487
 488         BCC_LE(smb_buf) = cpu_to_le16(count);
 489
 490         iov[1].iov_base = str_area;
 491         iov[1].iov_len = count;
 492         rc = SendReceive2(xid, ses, iov, 2 /* num_iovecs */, &resp_buf_type,
 493                           CIFS_STD_OP /* not long */ | CIFS_LOG_ERROR);
 494         /* SMB request buf freed in SendReceive2 */
 495
 496         cFYI(1,("ssetup rc from sendrecv2 is %d",rc));
 497         if(rc)
 498                 goto ssetup_exit;
 499
 500         pSMB = (SESSION_SETUP_ANDX *)iov[0].iov_base;
 501         smb_buf = (struct smb_hdr *)iov[0].iov_base;
 502
 503         if((smb_buf->WordCount != 3) && (smb_buf->WordCount != 4)) {
 504                 rc = -EIO;
 505                 cERROR(1,("bad word count %d", smb_buf->WordCount));
 506                 goto ssetup_exit;
 507         }
 508         action = le16_to_cpu(pSMB->resp.Action);
 509         if (action & GUEST_LOGIN)
 510                 cFYI(1, ("Guest login")); /* BB mark SesInfo struct? */
 511         ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
 512         cFYI(1, ("UID = %d ", ses->Suid));
 513         /* response can have either 3 or 4 word count - Samba sends 3 */
 514         /* and lanman response is 3 */
 515         bytes_remaining = BCC(smb_buf);
 516         bcc_ptr = pByteArea(smb_buf);
 517
 518         if(smb_buf->WordCount == 4) {
 519                 __u16 blob_len;
 520                 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
 521                 bcc_ptr += blob_len;
 522                 if(blob_len > bytes_remaining) {
 523                         cERROR(1,("bad security blob length %d", blob_len));
 524                         rc = -EINVAL;
 525                         goto ssetup_exit;
 526                 }
 527                 bytes_remaining -= blob_len;
 528         }
 529
 530         /* BB check if Unicode and decode strings */
 531         if(smb_buf->Flags2 & SMBFLG2_UNICODE)
 532                 rc = decode_unicode_ssetup(&bcc_ptr, bytes_remaining,
 533                                                    ses, nls_cp);
 534         else
 535                 rc = decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,nls_cp);
 536
 537 ssetup_exit:
 538         kfree(str_area);
 539         if(resp_buf_type == CIFS_SMALL_BUFFER) {
 540                 cFYI(1,("ssetup freeing small buf %p", iov[0].iov_base));
 541                 cifs_small_buf_release(iov[0].iov_base);
 542         } else if(resp_buf_type == CIFS_LARGE_BUFFER)
 543                 cifs_buf_release(iov[0].iov_base);
 544
 545         return rc;
 546 }