?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge tag 'regmap-fix-v5.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git...
[linux/fpc-iii.git] / fs / cifs / sess.c
blob213465718fa89d7005e01f05bd718157b9540af2
1 /*
2 * fs/cifs/sess.c
3 *
4 * SMB/CIFS session setup handling routines
5 *
6 * Copyright (c) International Business Machines Corp., 2006, 2009
7 * Author(s): Steve French (sfrench@us.ibm.com)
8 *
9 * This library is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU Lesser General Public License as published
11 * by the Free Software Foundation; either version 2.1 of the License, or
12 * (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
17 * the GNU Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public License
20 * along with this library; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 */
23
24 #include "cifspdu.h"
25 #include "cifsglob.h"
26 #include "cifsproto.h"
27 #include "cifs_unicode.h"
28 #include "cifs_debug.h"
29 #include "ntlmssp.h"
30 #include "nterr.h"
31 #include <linux/utsname.h>
32 #include <linux/slab.h>
33 #include "cifs_spnego.h"
34 #include "smb2proto.h"
35 #include "fs_context.h"
36
37 static int
38 cifs_ses_add_channel(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses,
39 struct cifs_server_iface *iface);
40
41 bool
42 is_server_using_iface(struct TCP_Server_Info *server,
43 struct cifs_server_iface *iface)
44 {
45 struct sockaddr_in *i4 = (struct sockaddr_in *)&iface->sockaddr;
46 struct sockaddr_in6 *i6 = (struct sockaddr_in6 *)&iface->sockaddr;
47 struct sockaddr_in *s4 = (struct sockaddr_in *)&server->dstaddr;
48 struct sockaddr_in6 *s6 = (struct sockaddr_in6 *)&server->dstaddr;
49
50 if (server->dstaddr.ss_family != iface->sockaddr.ss_family)
51 return false;
52 if (server->dstaddr.ss_family == AF_INET) {
53 if (s4->sin_addr.s_addr != i4->sin_addr.s_addr)
54 return false;
55 } else if (server->dstaddr.ss_family == AF_INET6) {
56 if (memcmp(&s6->sin6_addr, &i6->sin6_addr,
57 sizeof(i6->sin6_addr)) != 0)
58 return false;
59 } else {
60 /* unknown family.. */
61 return false;
62 }
63 return true;
64 }
65
66 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
67 {
68 int i;
69
70 for (i = 0; i < ses->chan_count; i++) {
71 if (is_server_using_iface(ses->chans[i].server, iface))
72 return true;
73 }
74 return false;
75 }
76
77 /* returns number of channels added */
78 int cifs_try_adding_channels(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses)
79 {
80 int old_chan_count = ses->chan_count;
81 int left = ses->chan_max - ses->chan_count;
82 int i = 0;
83 int rc = 0;
84 int tries = 0;
85 struct cifs_server_iface *ifaces = NULL;
86 size_t iface_count;
87
88 if (left <= 0) {
89 cifs_dbg(FYI,
90 "ses already at max_channels (%zu), nothing to open\n",
91 ses->chan_max);
92 return 0;
93 }
94
95 if (ses->server->dialect < SMB30_PROT_ID) {
96 cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
97 return 0;
98 }
99
100 /*
101 * Make a copy of the iface list at the time and use that
102 * instead so as to not hold the iface spinlock for opening
103 * channels
104 */
105 spin_lock(&ses->iface_lock);
106 iface_count = ses->iface_count;
107 if (iface_count <= 0) {
108 spin_unlock(&ses->iface_lock);
109 cifs_dbg(VFS, "no iface list available to open channels\n");
110 return 0;
111 }
112 ifaces = kmemdup(ses->iface_list, iface_count*sizeof(*ifaces),
113 GFP_ATOMIC);
114 if (!ifaces) {
115 spin_unlock(&ses->iface_lock);
116 return 0;
117 }
118 spin_unlock(&ses->iface_lock);
119
120 /*
121 * Keep connecting to same, fastest, iface for all channels as
122 * long as its RSS. Try next fastest one if not RSS or channel
123 * creation fails.
124 */
125 while (left > 0) {
126 struct cifs_server_iface *iface;
127
128 tries++;
129 if (tries > 3*ses->chan_max) {
130 cifs_dbg(FYI, "too many channel open attempts (%d channels left to open)\n",
131 left);
132 break;
133 }
134
135 iface = &ifaces[i];
136 if (is_ses_using_iface(ses, iface) && !iface->rss_capable) {
137 i = (i+1) % iface_count;
138 continue;
139 }
140
141 rc = cifs_ses_add_channel(cifs_sb, ses, iface);
142 if (rc) {
143 cifs_dbg(FYI, "failed to open extra channel on iface#%d rc=%d\n",
144 i, rc);
145 i = (i+1) % iface_count;
146 continue;
147 }
148
149 cifs_dbg(FYI, "successfully opened new channel on iface#%d\n",
150 i);
151 left--;
152 }
153
154 kfree(ifaces);
155 return ses->chan_count - old_chan_count;
156 }
157
158 /*
159 * If server is a channel of ses, return the corresponding enclosing
160 * cifs_chan otherwise return NULL.
161 */
162 struct cifs_chan *
163 cifs_ses_find_chan(struct cifs_ses *ses, struct TCP_Server_Info *server)
164 {
165 int i;
166
167 for (i = 0; i < ses->chan_count; i++) {
168 if (ses->chans[i].server == server)
169 return &ses->chans[i];
170 }
171 return NULL;
172 }
173
174 static int
175 cifs_ses_add_channel(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses,
176 struct cifs_server_iface *iface)
177 {
178 struct cifs_chan *chan;
179 struct smb3_fs_context ctx = {NULL};
180 static const char unc_fmt[] = "\\%s\\foo";
181 char unc[sizeof(unc_fmt)+SERVER_NAME_LEN_WITH_NULL] = {0};
182 struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
183 struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
184 int rc;
185 unsigned int xid = get_xid();
186
187 if (iface->sockaddr.ss_family == AF_INET)
188 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
189 ses, iface->speed, iface->rdma_capable ? "yes" : "no",
190 &ipv4->sin_addr);
191 else
192 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
193 ses, iface->speed, iface->rdma_capable ? "yes" : "no",
194 &ipv6->sin6_addr);
195
196 /*
197 * Setup a ctx with mostly the same info as the existing
198 * session and overwrite it with the requested iface data.
199 *
200 * We need to setup at least the fields used for negprot and
201 * sesssetup.
202 *
203 * We only need the ctx here, so we can reuse memory from
204 * the session and server without caring about memory
205 * management.
206 */
207
208 /* Always make new connection for now (TODO?) */
209 ctx.nosharesock = true;
210
211 /* Auth */
212 ctx.domainauto = ses->domainAuto;
213 ctx.domainname = ses->domainName;
214 ctx.username = ses->user_name;
215 ctx.password = ses->password;
216 ctx.sectype = ses->sectype;
217 ctx.sign = ses->sign;
218
219 /* UNC and paths */
220 /* XXX: Use ses->server->hostname? */
221 sprintf(unc, unc_fmt, ses->serverName);
222 ctx.UNC = unc;
223 ctx.prepath = "";
224
225 /* Reuse same version as master connection */
226 ctx.vals = ses->server->vals;
227 ctx.ops = ses->server->ops;
228
229 ctx.noblocksnd = ses->server->noblocksnd;
230 ctx.noautotune = ses->server->noautotune;
231 ctx.sockopt_tcp_nodelay = ses->server->tcp_nodelay;
232 ctx.echo_interval = ses->server->echo_interval / HZ;
233
234 /*
235 * This will be used for encoding/decoding user/domain/pw
236 * during sess setup auth.
237 */
238 ctx.local_nls = cifs_sb->local_nls;
239
240 /* Use RDMA if possible */
241 ctx.rdma = iface->rdma_capable;
242 memcpy(&ctx.dstaddr, &iface->sockaddr, sizeof(struct sockaddr_storage));
243
244 /* reuse master con client guid */
245 memcpy(&ctx.client_guid, ses->server->client_guid,
246 SMB2_CLIENT_GUID_SIZE);
247 ctx.use_client_guid = true;
248
249 mutex_lock(&ses->session_mutex);
250
251 chan = ses->binding_chan = &ses->chans[ses->chan_count];
252 chan->server = cifs_get_tcp_session(&ctx);
253 if (IS_ERR(chan->server)) {
254 rc = PTR_ERR(chan->server);
255 chan->server = NULL;
256 goto out;
257 }
258 spin_lock(&cifs_tcp_ses_lock);
259 chan->server->is_channel = true;
260 spin_unlock(&cifs_tcp_ses_lock);
261
262 /*
263 * We need to allocate the server crypto now as we will need
264 * to sign packets before we generate the channel signing key
265 * (we sign with the session key)
266 */
267 rc = smb311_crypto_shash_allocate(chan->server);
268 if (rc) {
269 cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
270 goto out;
271 }
272
273 ses->binding = true;
274 rc = cifs_negotiate_protocol(xid, ses);
275 if (rc)
276 goto out;
277
278 rc = cifs_setup_session(xid, ses, cifs_sb->local_nls);
279 if (rc)
280 goto out;
281
282 /* success, put it on the list
283 * XXX: sharing ses between 2 tcp servers is not possible, the
284 * way "internal" linked lists works in linux makes element
285 * only able to belong to one list
286 *
287 * the binding session is already established so the rest of
288 * the code should be able to look it up, no need to add the
289 * ses to the new server.
290 */
291
292 ses->chan_count++;
293 atomic_set(&ses->chan_seq, 0);
294 out:
295 ses->binding = false;
296 ses->binding_chan = NULL;
297 mutex_unlock(&ses->session_mutex);
298
299 if (rc && chan->server)
300 cifs_put_tcp_session(chan->server, 0);
301
302 return rc;
303 }
304
305 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses, SESSION_SETUP_ANDX *pSMB)
306 {
307 __u32 capabilities = 0;
308
309 /* init fields common to all four types of SessSetup */
310 /* Note that offsets for first seven fields in req struct are same */
311 /* in CIFS Specs so does not matter which of 3 forms of struct */
312 /* that we use in next few lines */
313 /* Note that header is initialized to zero in header_assemble */
314 pSMB->req.AndXCommand = 0xFF;
315 pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
316 CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
317 USHRT_MAX));
318 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
319 pSMB->req.VcNumber = cpu_to_le16(1);
320
321 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
322
323 /* BB verify whether signing required on neg or just on auth frame
324 (and NTLM case) */
325
326 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
327 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
328
329 if (ses->server->sign)
330 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
331
332 if (ses->capabilities & CAP_UNICODE) {
333 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
334 capabilities |= CAP_UNICODE;
335 }
336 if (ses->capabilities & CAP_STATUS32) {
337 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
338 capabilities |= CAP_STATUS32;
339 }
340 if (ses->capabilities & CAP_DFS) {
341 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
342 capabilities |= CAP_DFS;
343 }
344 if (ses->capabilities & CAP_UNIX)
345 capabilities |= CAP_UNIX;
346
347 return capabilities;
348 }
349
350 static void
351 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
352 {
353 char *bcc_ptr = *pbcc_area;
354 int bytes_ret = 0;
355
356 /* Copy OS version */
357 bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
358 nls_cp);
359 bcc_ptr += 2 * bytes_ret;
360 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
361 32, nls_cp);
362 bcc_ptr += 2 * bytes_ret;
363 bcc_ptr += 2; /* trailing null */
364
365 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
366 32, nls_cp);
367 bcc_ptr += 2 * bytes_ret;
368 bcc_ptr += 2; /* trailing null */
369
370 *pbcc_area = bcc_ptr;
371 }
372
373 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
374 const struct nls_table *nls_cp)
375 {
376 char *bcc_ptr = *pbcc_area;
377 int bytes_ret = 0;
378
379 /* copy domain */
380 if (ses->domainName == NULL) {
381 /* Sending null domain better than using a bogus domain name (as
382 we did briefly in 2.6.18) since server will use its default */
383 *bcc_ptr = 0;
384 *(bcc_ptr+1) = 0;
385 bytes_ret = 0;
386 } else
387 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
388 CIFS_MAX_DOMAINNAME_LEN, nls_cp);
389 bcc_ptr += 2 * bytes_ret;
390 bcc_ptr += 2; /* account for null terminator */
391
392 *pbcc_area = bcc_ptr;
393 }
394
395
396 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
397 const struct nls_table *nls_cp)
398 {
399 char *bcc_ptr = *pbcc_area;
400 int bytes_ret = 0;
401
402 /* BB FIXME add check that strings total less
403 than 335 or will need to send them as arrays */
404
405 /* unicode strings, must be word aligned before the call */
406 /* if ((long) bcc_ptr % 2) {
407 *bcc_ptr = 0;
408 bcc_ptr++;
409 } */
410 /* copy user */
411 if (ses->user_name == NULL) {
412 /* null user mount */
413 *bcc_ptr = 0;
414 *(bcc_ptr+1) = 0;
415 } else {
416 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
417 CIFS_MAX_USERNAME_LEN, nls_cp);
418 }
419 bcc_ptr += 2 * bytes_ret;
420 bcc_ptr += 2; /* account for null termination */
421
422 unicode_domain_string(&bcc_ptr, ses, nls_cp);
423 unicode_oslm_strings(&bcc_ptr, nls_cp);
424
425 *pbcc_area = bcc_ptr;
426 }
427
428 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
429 const struct nls_table *nls_cp)
430 {
431 char *bcc_ptr = *pbcc_area;
432 int len;
433
434 /* copy user */
435 /* BB what about null user mounts - check that we do this BB */
436 /* copy user */
437 if (ses->user_name != NULL) {
438 len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
439 if (WARN_ON_ONCE(len < 0))
440 len = CIFS_MAX_USERNAME_LEN - 1;
441 bcc_ptr += len;
442 }
443 /* else null user mount */
444 *bcc_ptr = 0;
445 bcc_ptr++; /* account for null termination */
446
447 /* copy domain */
448 if (ses->domainName != NULL) {
449 len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
450 if (WARN_ON_ONCE(len < 0))
451 len = CIFS_MAX_DOMAINNAME_LEN - 1;
452 bcc_ptr += len;
453 } /* else we will send a null domain name
454 so the server will default to its own domain */
455 *bcc_ptr = 0;
456 bcc_ptr++;
457
458 /* BB check for overflow here */
459
460 strcpy(bcc_ptr, "Linux version ");
461 bcc_ptr += strlen("Linux version ");
462 strcpy(bcc_ptr, init_utsname()->release);
463 bcc_ptr += strlen(init_utsname()->release) + 1;
464
465 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
466 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
467
468 *pbcc_area = bcc_ptr;
469 }
470
471 static void
472 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
473 const struct nls_table *nls_cp)
474 {
475 int len;
476 char *data = *pbcc_area;
477
478 cifs_dbg(FYI, "bleft %d\n", bleft);
479
480 kfree(ses->serverOS);
481 ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
482 cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
483 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
484 data += len;
485 bleft -= len;
486 if (bleft <= 0)
487 return;
488
489 kfree(ses->serverNOS);
490 ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
491 cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
492 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
493 data += len;
494 bleft -= len;
495 if (bleft <= 0)
496 return;
497
498 kfree(ses->serverDomain);
499 ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
500 cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
501
502 return;
503 }
504
505 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
506 struct cifs_ses *ses,
507 const struct nls_table *nls_cp)
508 {
509 int len;
510 char *bcc_ptr = *pbcc_area;
511
512 cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
513
514 len = strnlen(bcc_ptr, bleft);
515 if (len >= bleft)
516 return;
517
518 kfree(ses->serverOS);
519
520 ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
521 if (ses->serverOS) {
522 memcpy(ses->serverOS, bcc_ptr, len);
523 ses->serverOS[len] = 0;
524 if (strncmp(ses->serverOS, "OS/2", 4) == 0)
525 cifs_dbg(FYI, "OS/2 server\n");
526 }
527
528 bcc_ptr += len + 1;
529 bleft -= len + 1;
530
531 len = strnlen(bcc_ptr, bleft);
532 if (len >= bleft)
533 return;
534
535 kfree(ses->serverNOS);
536
537 ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
538 if (ses->serverNOS) {
539 memcpy(ses->serverNOS, bcc_ptr, len);
540 ses->serverNOS[len] = 0;
541 }
542
543 bcc_ptr += len + 1;
544 bleft -= len + 1;
545
546 len = strnlen(bcc_ptr, bleft);
547 if (len > bleft)
548 return;
549
550 /* No domain field in LANMAN case. Domain is
551 returned by old servers in the SMB negprot response */
552 /* BB For newer servers which do not support Unicode,
553 but thus do return domain here we could add parsing
554 for it later, but it is not very important */
555 cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
556 }
557
558 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
559 struct cifs_ses *ses)
560 {
561 unsigned int tioffset; /* challenge message target info area */
562 unsigned int tilen; /* challenge message target info area length */
563
564 CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
565
566 if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
567 cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
568 return -EINVAL;
569 }
570
571 if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
572 cifs_dbg(VFS, "blob signature incorrect %s\n",
573 pblob->Signature);
574 return -EINVAL;
575 }
576 if (pblob->MessageType != NtLmChallenge) {
577 cifs_dbg(VFS, "Incorrect message type %d\n",
578 pblob->MessageType);
579 return -EINVAL;
580 }
581
582 memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
583 /* BB we could decode pblob->NegotiateFlags; some may be useful */
584 /* In particular we can examine sign flags */
585 /* BB spec says that if AvId field of MsvAvTimestamp is populated then
586 we must set the MIC field of the AUTHENTICATE_MESSAGE */
587 ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags);
588 tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
589 tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
590 if (tioffset > blob_len || tioffset + tilen > blob_len) {
591 cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
592 tioffset, tilen);
593 return -EINVAL;
594 }
595 if (tilen) {
596 ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
597 GFP_KERNEL);
598 if (!ses->auth_key.response) {
599 cifs_dbg(VFS, "Challenge target info alloc failure\n");
600 return -ENOMEM;
601 }
602 ses->auth_key.len = tilen;
603 }
604
605 return 0;
606 }
607
608 /* BB Move to ntlmssp.c eventually */
609
610 /* We do not malloc the blob, it is passed in pbuffer, because
611 it is fixed size, and small, making this approach cleaner */
612 void build_ntlmssp_negotiate_blob(unsigned char *pbuffer,
613 struct cifs_ses *ses)
614 {
615 struct TCP_Server_Info *server = cifs_ses_server(ses);
616 NEGOTIATE_MESSAGE *sec_blob = (NEGOTIATE_MESSAGE *)pbuffer;
617 __u32 flags;
618
619 memset(pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
620 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
621 sec_blob->MessageType = NtLmNegotiate;
622
623 /* BB is NTLMV2 session security format easier to use here? */
624 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
625 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
626 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
627 NTLMSSP_NEGOTIATE_SEAL;
628 if (server->sign)
629 flags |= NTLMSSP_NEGOTIATE_SIGN;
630 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
631 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
632
633 sec_blob->NegotiateFlags = cpu_to_le32(flags);
634
635 sec_blob->WorkstationName.BufferOffset = 0;
636 sec_blob->WorkstationName.Length = 0;
637 sec_blob->WorkstationName.MaximumLength = 0;
638
639 /* Domain name is sent on the Challenge not Negotiate NTLMSSP request */
640 sec_blob->DomainName.BufferOffset = 0;
641 sec_blob->DomainName.Length = 0;
642 sec_blob->DomainName.MaximumLength = 0;
643 }
644
645 static int size_of_ntlmssp_blob(struct cifs_ses *ses)
646 {
647 int sz = sizeof(AUTHENTICATE_MESSAGE) + ses->auth_key.len
648 - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
649
650 if (ses->domainName)
651 sz += 2 * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
652 else
653 sz += 2;
654
655 if (ses->user_name)
656 sz += 2 * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
657 else
658 sz += 2;
659
660 return sz;
661 }
662
663 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
664 u16 *buflen,
665 struct cifs_ses *ses,
666 const struct nls_table *nls_cp)
667 {
668 int rc;
669 AUTHENTICATE_MESSAGE *sec_blob;
670 __u32 flags;
671 unsigned char *tmp;
672
673 rc = setup_ntlmv2_rsp(ses, nls_cp);
674 if (rc) {
675 cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
676 *buflen = 0;
677 goto setup_ntlmv2_ret;
678 }
679 *pbuffer = kmalloc(size_of_ntlmssp_blob(ses), GFP_KERNEL);
680 if (!*pbuffer) {
681 rc = -ENOMEM;
682 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
683 *buflen = 0;
684 goto setup_ntlmv2_ret;
685 }
686 sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
687
688 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
689 sec_blob->MessageType = NtLmAuthenticate;
690
691 flags = NTLMSSP_NEGOTIATE_56 |
692 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_TARGET_INFO |
693 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
694 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
695 NTLMSSP_NEGOTIATE_SEAL;
696 if (ses->server->sign)
697 flags |= NTLMSSP_NEGOTIATE_SIGN;
698 if (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
699 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
700
701 tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
702 sec_blob->NegotiateFlags = cpu_to_le32(flags);
703
704 sec_blob->LmChallengeResponse.BufferOffset =
705 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
706 sec_blob->LmChallengeResponse.Length = 0;
707 sec_blob->LmChallengeResponse.MaximumLength = 0;
708
709 sec_blob->NtChallengeResponse.BufferOffset =
710 cpu_to_le32(tmp - *pbuffer);
711 if (ses->user_name != NULL) {
712 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
713 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
714 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
715
716 sec_blob->NtChallengeResponse.Length =
717 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
718 sec_blob->NtChallengeResponse.MaximumLength =
719 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
720 } else {
721 /*
722 * don't send an NT Response for anonymous access
723 */
724 sec_blob->NtChallengeResponse.Length = 0;
725 sec_blob->NtChallengeResponse.MaximumLength = 0;
726 }
727
728 if (ses->domainName == NULL) {
729 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
730 sec_blob->DomainName.Length = 0;
731 sec_blob->DomainName.MaximumLength = 0;
732 tmp += 2;
733 } else {
734 int len;
735 len = cifs_strtoUTF16((__le16 *)tmp, ses->domainName,
736 CIFS_MAX_DOMAINNAME_LEN, nls_cp);
737 len *= 2; /* unicode is 2 bytes each */
738 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
739 sec_blob->DomainName.Length = cpu_to_le16(len);
740 sec_blob->DomainName.MaximumLength = cpu_to_le16(len);
741 tmp += len;
742 }
743
744 if (ses->user_name == NULL) {
745 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
746 sec_blob->UserName.Length = 0;
747 sec_blob->UserName.MaximumLength = 0;
748 tmp += 2;
749 } else {
750 int len;
751 len = cifs_strtoUTF16((__le16 *)tmp, ses->user_name,
752 CIFS_MAX_USERNAME_LEN, nls_cp);
753 len *= 2; /* unicode is 2 bytes each */
754 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
755 sec_blob->UserName.Length = cpu_to_le16(len);
756 sec_blob->UserName.MaximumLength = cpu_to_le16(len);
757 tmp += len;
758 }
759
760 sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
761 sec_blob->WorkstationName.Length = 0;
762 sec_blob->WorkstationName.MaximumLength = 0;
763 tmp += 2;
764
765 if (((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) ||
766 (ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC))
767 && !calc_seckey(ses)) {
768 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
769 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
770 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
771 sec_blob->SessionKey.MaximumLength =
772 cpu_to_le16(CIFS_CPHTXT_SIZE);
773 tmp += CIFS_CPHTXT_SIZE;
774 } else {
775 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
776 sec_blob->SessionKey.Length = 0;
777 sec_blob->SessionKey.MaximumLength = 0;
778 }
779
780 *buflen = tmp - *pbuffer;
781 setup_ntlmv2_ret:
782 return rc;
783 }
784
785 enum securityEnum
786 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
787 {
788 switch (server->negflavor) {
789 case CIFS_NEGFLAVOR_EXTENDED:
790 switch (requested) {
791 case Kerberos:
792 case RawNTLMSSP:
793 return requested;
794 case Unspecified:
795 if (server->sec_ntlmssp &&
796 (global_secflags & CIFSSEC_MAY_NTLMSSP))
797 return RawNTLMSSP;
798 if ((server->sec_kerberos || server->sec_mskerberos) &&
799 (global_secflags & CIFSSEC_MAY_KRB5))
800 return Kerberos;
801 fallthrough;
802 default:
803 return Unspecified;
804 }
805 case CIFS_NEGFLAVOR_UNENCAP:
806 switch (requested) {
807 case NTLM:
808 case NTLMv2:
809 return requested;
810 case Unspecified:
811 if (global_secflags & CIFSSEC_MAY_NTLMV2)
812 return NTLMv2;
813 if (global_secflags & CIFSSEC_MAY_NTLM)
814 return NTLM;
815 break;
816 default:
817 break;
818 }
819 fallthrough; /* to attempt LANMAN authentication next */
820 case CIFS_NEGFLAVOR_LANMAN:
821 switch (requested) {
822 case LANMAN:
823 return requested;
824 case Unspecified:
825 if (global_secflags & CIFSSEC_MAY_LANMAN)
826 return LANMAN;
827 fallthrough;
828 default:
829 return Unspecified;
830 }
831 default:
832 return Unspecified;
833 }
834 }
835
836 struct sess_data {
837 unsigned int xid;
838 struct cifs_ses *ses;
839 struct nls_table *nls_cp;
840 void (*func)(struct sess_data *);
841 int result;
842
843 /* we will send the SMB in three pieces:
844 * a fixed length beginning part, an optional
845 * SPNEGO blob (which can be zero length), and a
846 * last part which will include the strings
847 * and rest of bcc area. This allows us to avoid
848 * a large buffer 17K allocation
849 */
850 int buf0_type;
851 struct kvec iov[3];
852 };
853
854 static int
855 sess_alloc_buffer(struct sess_data *sess_data, int wct)
856 {
857 int rc;
858 struct cifs_ses *ses = sess_data->ses;
859 struct smb_hdr *smb_buf;
860
861 rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
862 (void **)&smb_buf);
863
864 if (rc)
865 return rc;
866
867 sess_data->iov[0].iov_base = (char *)smb_buf;
868 sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
869 /*
870 * This variable will be used to clear the buffer
871 * allocated above in case of any error in the calling function.
872 */
873 sess_data->buf0_type = CIFS_SMALL_BUFFER;
874
875 /* 2000 big enough to fit max user, domain, NOS name etc. */
876 sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
877 if (!sess_data->iov[2].iov_base) {
878 rc = -ENOMEM;
879 goto out_free_smb_buf;
880 }
881
882 return 0;
883
884 out_free_smb_buf:
885 kfree(smb_buf);
886 sess_data->iov[0].iov_base = NULL;
887 sess_data->iov[0].iov_len = 0;
888 sess_data->buf0_type = CIFS_NO_BUFFER;
889 return rc;
890 }
891
892 static void
893 sess_free_buffer(struct sess_data *sess_data)
894 {
895
896 free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
897 sess_data->buf0_type = CIFS_NO_BUFFER;
898 kfree(sess_data->iov[2].iov_base);
899 }
900
901 static int
902 sess_establish_session(struct sess_data *sess_data)
903 {
904 struct cifs_ses *ses = sess_data->ses;
905
906 mutex_lock(&ses->server->srv_mutex);
907 if (!ses->server->session_estab) {
908 if (ses->server->sign) {
909 ses->server->session_key.response =
910 kmemdup(ses->auth_key.response,
911 ses->auth_key.len, GFP_KERNEL);
912 if (!ses->server->session_key.response) {
913 mutex_unlock(&ses->server->srv_mutex);
914 return -ENOMEM;
915 }
916 ses->server->session_key.len =
917 ses->auth_key.len;
918 }
919 ses->server->sequence_number = 0x2;
920 ses->server->session_estab = true;
921 }
922 mutex_unlock(&ses->server->srv_mutex);
923
924 cifs_dbg(FYI, "CIFS session established successfully\n");
925 spin_lock(&GlobalMid_Lock);
926 ses->status = CifsGood;
927 ses->need_reconnect = false;
928 spin_unlock(&GlobalMid_Lock);
929
930 return 0;
931 }
932
933 static int
934 sess_sendreceive(struct sess_data *sess_data)
935 {
936 int rc;
937 struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
938 __u16 count;
939 struct kvec rsp_iov = { NULL, 0 };
940
941 count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
942 be32_add_cpu(&smb_buf->smb_buf_length, count);
943 put_bcc(count, smb_buf);
944
945 rc = SendReceive2(sess_data->xid, sess_data->ses,
946 sess_data->iov, 3 /* num_iovecs */,
947 &sess_data->buf0_type,
948 CIFS_LOG_ERROR, &rsp_iov);
949 cifs_small_buf_release(sess_data->iov[0].iov_base);
950 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
951
952 return rc;
953 }
954
955 /*
956 * LANMAN and plaintext are less secure and off by default.
957 * So we make this explicitly be turned on in kconfig (in the
958 * build) and turned on at runtime (changed from the default)
959 * in proc/fs/cifs or via mount parm. Unfortunately this is
960 * needed for old Win (e.g. Win95), some obscure NAS and OS/2
961 */
962 #ifdef CONFIG_CIFS_WEAK_PW_HASH
963 static void
964 sess_auth_lanman(struct sess_data *sess_data)
965 {
966 int rc = 0;
967 struct smb_hdr *smb_buf;
968 SESSION_SETUP_ANDX *pSMB;
969 char *bcc_ptr;
970 struct cifs_ses *ses = sess_data->ses;
971 char lnm_session_key[CIFS_AUTH_RESP_SIZE];
972 __u16 bytes_remaining;
973
974 /* lanman 2 style sessionsetup */
975 /* wct = 10 */
976 rc = sess_alloc_buffer(sess_data, 10);
977 if (rc)
978 goto out;
979
980 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
981 bcc_ptr = sess_data->iov[2].iov_base;
982 (void)cifs_ssetup_hdr(ses, pSMB);
983
984 pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE;
985
986 if (ses->user_name != NULL) {
987 /* no capabilities flags in old lanman negotiation */
988 pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
989
990 /* Calculate hash with password and copy into bcc_ptr.
991 * Encryption Key (stored as in cryptkey) gets used if the
992 * security mode bit in Negotiate Protocol response states
993 * to use challenge/response method (i.e. Password bit is 1).
994 */
995 rc = calc_lanman_hash(ses->password, ses->server->cryptkey,
996 ses->server->sec_mode & SECMODE_PW_ENCRYPT ?
997 true : false, lnm_session_key);
998 if (rc)
999 goto out;
1000
1001 memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE);
1002 bcc_ptr += CIFS_AUTH_RESP_SIZE;
1003 } else {
1004 pSMB->old_req.PasswordLength = 0;
1005 }
1006
1007 /*
1008 * can not sign if LANMAN negotiated so no need
1009 * to calculate signing key? but what if server
1010 * changed to do higher than lanman dialect and
1011 * we reconnected would we ever calc signing_key?
1012 */
1013
1014 cifs_dbg(FYI, "Negotiating LANMAN setting up strings\n");
1015 /* Unicode not allowed for LANMAN dialects */
1016 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1017
1018 sess_data->iov[2].iov_len = (long) bcc_ptr -
1019 (long) sess_data->iov[2].iov_base;
1020
1021 rc = sess_sendreceive(sess_data);
1022 if (rc)
1023 goto out;
1024
1025 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1026 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1027
1028 /* lanman response has a word count of 3 */
1029 if (smb_buf->WordCount != 3) {
1030 rc = -EIO;
1031 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1032 goto out;
1033 }
1034
1035 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1036 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1037
1038 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1039 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1040
1041 bytes_remaining = get_bcc(smb_buf);
1042 bcc_ptr = pByteArea(smb_buf);
1043
1044 /* BB check if Unicode and decode strings */
1045 if (bytes_remaining == 0) {
1046 /* no string area to decode, do nothing */
1047 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1048 /* unicode string area must be word-aligned */
1049 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1050 ++bcc_ptr;
1051 --bytes_remaining;
1052 }
1053 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1054 sess_data->nls_cp);
1055 } else {
1056 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1057 sess_data->nls_cp);
1058 }
1059
1060 rc = sess_establish_session(sess_data);
1061 out:
1062 sess_data->result = rc;
1063 sess_data->func = NULL;
1064 sess_free_buffer(sess_data);
1065 }
1066
1067 #endif
1068
1069 static void
1070 sess_auth_ntlm(struct sess_data *sess_data)
1071 {
1072 int rc = 0;
1073 struct smb_hdr *smb_buf;
1074 SESSION_SETUP_ANDX *pSMB;
1075 char *bcc_ptr;
1076 struct cifs_ses *ses = sess_data->ses;
1077 __u32 capabilities;
1078 __u16 bytes_remaining;
1079
1080 /* old style NTLM sessionsetup */
1081 /* wct = 13 */
1082 rc = sess_alloc_buffer(sess_data, 13);
1083 if (rc)
1084 goto out;
1085
1086 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1087 bcc_ptr = sess_data->iov[2].iov_base;
1088 capabilities = cifs_ssetup_hdr(ses, pSMB);
1089
1090 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1091 if (ses->user_name != NULL) {
1092 pSMB->req_no_secext.CaseInsensitivePasswordLength =
1093 cpu_to_le16(CIFS_AUTH_RESP_SIZE);
1094 pSMB->req_no_secext.CaseSensitivePasswordLength =
1095 cpu_to_le16(CIFS_AUTH_RESP_SIZE);
1096
1097 /* calculate ntlm response and session key */
1098 rc = setup_ntlm_response(ses, sess_data->nls_cp);
1099 if (rc) {
1100 cifs_dbg(VFS, "Error %d during NTLM authentication\n",
1101 rc);
1102 goto out;
1103 }
1104
1105 /* copy ntlm response */
1106 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1107 CIFS_AUTH_RESP_SIZE);
1108 bcc_ptr += CIFS_AUTH_RESP_SIZE;
1109 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1110 CIFS_AUTH_RESP_SIZE);
1111 bcc_ptr += CIFS_AUTH_RESP_SIZE;
1112 } else {
1113 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1114 pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1115 }
1116
1117 if (ses->capabilities & CAP_UNICODE) {
1118 /* unicode strings must be word aligned */
1119 if (sess_data->iov[0].iov_len % 2) {
1120 *bcc_ptr = 0;
1121 bcc_ptr++;
1122 }
1123 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1124 } else {
1125 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1126 }
1127
1128
1129 sess_data->iov[2].iov_len = (long) bcc_ptr -
1130 (long) sess_data->iov[2].iov_base;
1131
1132 rc = sess_sendreceive(sess_data);
1133 if (rc)
1134 goto out;
1135
1136 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1137 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1138
1139 if (smb_buf->WordCount != 3) {
1140 rc = -EIO;
1141 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1142 goto out;
1143 }
1144
1145 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1146 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1147
1148 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1149 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1150
1151 bytes_remaining = get_bcc(smb_buf);
1152 bcc_ptr = pByteArea(smb_buf);
1153
1154 /* BB check if Unicode and decode strings */
1155 if (bytes_remaining == 0) {
1156 /* no string area to decode, do nothing */
1157 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1158 /* unicode string area must be word-aligned */
1159 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1160 ++bcc_ptr;
1161 --bytes_remaining;
1162 }
1163 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1164 sess_data->nls_cp);
1165 } else {
1166 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1167 sess_data->nls_cp);
1168 }
1169
1170 rc = sess_establish_session(sess_data);
1171 out:
1172 sess_data->result = rc;
1173 sess_data->func = NULL;
1174 sess_free_buffer(sess_data);
1175 kfree(ses->auth_key.response);
1176 ses->auth_key.response = NULL;
1177 }
1178
1179 static void
1180 sess_auth_ntlmv2(struct sess_data *sess_data)
1181 {
1182 int rc = 0;
1183 struct smb_hdr *smb_buf;
1184 SESSION_SETUP_ANDX *pSMB;
1185 char *bcc_ptr;
1186 struct cifs_ses *ses = sess_data->ses;
1187 __u32 capabilities;
1188 __u16 bytes_remaining;
1189
1190 /* old style NTLM sessionsetup */
1191 /* wct = 13 */
1192 rc = sess_alloc_buffer(sess_data, 13);
1193 if (rc)
1194 goto out;
1195
1196 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1197 bcc_ptr = sess_data->iov[2].iov_base;
1198 capabilities = cifs_ssetup_hdr(ses, pSMB);
1199
1200 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1201
1202 /* LM2 password would be here if we supported it */
1203 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1204
1205 if (ses->user_name != NULL) {
1206 /* calculate nlmv2 response and session key */
1207 rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
1208 if (rc) {
1209 cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
1210 goto out;
1211 }
1212
1213 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1214 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1215 bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1216
1217 /* set case sensitive password length after tilen may get
1218 * assigned, tilen is 0 otherwise.
1219 */
1220 pSMB->req_no_secext.CaseSensitivePasswordLength =
1221 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1222 } else {
1223 pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1224 }
1225
1226 if (ses->capabilities & CAP_UNICODE) {
1227 if (sess_data->iov[0].iov_len % 2) {
1228 *bcc_ptr = 0;
1229 bcc_ptr++;
1230 }
1231 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1232 } else {
1233 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1234 }
1235
1236
1237 sess_data->iov[2].iov_len = (long) bcc_ptr -
1238 (long) sess_data->iov[2].iov_base;
1239
1240 rc = sess_sendreceive(sess_data);
1241 if (rc)
1242 goto out;
1243
1244 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1245 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1246
1247 if (smb_buf->WordCount != 3) {
1248 rc = -EIO;
1249 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1250 goto out;
1251 }
1252
1253 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1254 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1255
1256 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1257 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1258
1259 bytes_remaining = get_bcc(smb_buf);
1260 bcc_ptr = pByteArea(smb_buf);
1261
1262 /* BB check if Unicode and decode strings */
1263 if (bytes_remaining == 0) {
1264 /* no string area to decode, do nothing */
1265 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1266 /* unicode string area must be word-aligned */
1267 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1268 ++bcc_ptr;
1269 --bytes_remaining;
1270 }
1271 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1272 sess_data->nls_cp);
1273 } else {
1274 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1275 sess_data->nls_cp);
1276 }
1277
1278 rc = sess_establish_session(sess_data);
1279 out:
1280 sess_data->result = rc;
1281 sess_data->func = NULL;
1282 sess_free_buffer(sess_data);
1283 kfree(ses->auth_key.response);
1284 ses->auth_key.response = NULL;
1285 }
1286
1287 #ifdef CONFIG_CIFS_UPCALL
1288 static void
1289 sess_auth_kerberos(struct sess_data *sess_data)
1290 {
1291 int rc = 0;
1292 struct smb_hdr *smb_buf;
1293 SESSION_SETUP_ANDX *pSMB;
1294 char *bcc_ptr;
1295 struct cifs_ses *ses = sess_data->ses;
1296 __u32 capabilities;
1297 __u16 bytes_remaining;
1298 struct key *spnego_key = NULL;
1299 struct cifs_spnego_msg *msg;
1300 u16 blob_len;
1301
1302 /* extended security */
1303 /* wct = 12 */
1304 rc = sess_alloc_buffer(sess_data, 12);
1305 if (rc)
1306 goto out;
1307
1308 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1309 bcc_ptr = sess_data->iov[2].iov_base;
1310 capabilities = cifs_ssetup_hdr(ses, pSMB);
1311
1312 spnego_key = cifs_get_spnego_key(ses);
1313 if (IS_ERR(spnego_key)) {
1314 rc = PTR_ERR(spnego_key);
1315 spnego_key = NULL;
1316 goto out;
1317 }
1318
1319 msg = spnego_key->payload.data[0];
1320 /*
1321 * check version field to make sure that cifs.upcall is
1322 * sending us a response in an expected form
1323 */
1324 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1325 cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1326 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1327 rc = -EKEYREJECTED;
1328 goto out_put_spnego_key;
1329 }
1330
1331 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1332 GFP_KERNEL);
1333 if (!ses->auth_key.response) {
1334 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1335 msg->sesskey_len);
1336 rc = -ENOMEM;
1337 goto out_put_spnego_key;
1338 }
1339 ses->auth_key.len = msg->sesskey_len;
1340
1341 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1342 capabilities |= CAP_EXTENDED_SECURITY;
1343 pSMB->req.Capabilities = cpu_to_le32(capabilities);
1344 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1345 sess_data->iov[1].iov_len = msg->secblob_len;
1346 pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1347
1348 if (ses->capabilities & CAP_UNICODE) {
1349 /* unicode strings must be word aligned */
1350 if ((sess_data->iov[0].iov_len
1351 + sess_data->iov[1].iov_len) % 2) {
1352 *bcc_ptr = 0;
1353 bcc_ptr++;
1354 }
1355 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1356 unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1357 } else {
1358 /* BB: is this right? */
1359 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1360 }
1361
1362 sess_data->iov[2].iov_len = (long) bcc_ptr -
1363 (long) sess_data->iov[2].iov_base;
1364
1365 rc = sess_sendreceive(sess_data);
1366 if (rc)
1367 goto out_put_spnego_key;
1368
1369 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1370 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1371
1372 if (smb_buf->WordCount != 4) {
1373 rc = -EIO;
1374 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1375 goto out_put_spnego_key;
1376 }
1377
1378 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1379 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1380
1381 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1382 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1383
1384 bytes_remaining = get_bcc(smb_buf);
1385 bcc_ptr = pByteArea(smb_buf);
1386
1387 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1388 if (blob_len > bytes_remaining) {
1389 cifs_dbg(VFS, "bad security blob length %d\n",
1390 blob_len);
1391 rc = -EINVAL;
1392 goto out_put_spnego_key;
1393 }
1394 bcc_ptr += blob_len;
1395 bytes_remaining -= blob_len;
1396
1397 /* BB check if Unicode and decode strings */
1398 if (bytes_remaining == 0) {
1399 /* no string area to decode, do nothing */
1400 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1401 /* unicode string area must be word-aligned */
1402 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1403 ++bcc_ptr;
1404 --bytes_remaining;
1405 }
1406 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1407 sess_data->nls_cp);
1408 } else {
1409 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1410 sess_data->nls_cp);
1411 }
1412
1413 rc = sess_establish_session(sess_data);
1414 out_put_spnego_key:
1415 key_invalidate(spnego_key);
1416 key_put(spnego_key);
1417 out:
1418 sess_data->result = rc;
1419 sess_data->func = NULL;
1420 sess_free_buffer(sess_data);
1421 kfree(ses->auth_key.response);
1422 ses->auth_key.response = NULL;
1423 }
1424
1425 #endif /* ! CONFIG_CIFS_UPCALL */
1426
1427 /*
1428 * The required kvec buffers have to be allocated before calling this
1429 * function.
1430 */
1431 static int
1432 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1433 {
1434 SESSION_SETUP_ANDX *pSMB;
1435 struct cifs_ses *ses = sess_data->ses;
1436 __u32 capabilities;
1437 char *bcc_ptr;
1438
1439 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1440
1441 capabilities = cifs_ssetup_hdr(ses, pSMB);
1442 if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) {
1443 cifs_dbg(VFS, "NTLMSSP requires Unicode support\n");
1444 return -ENOSYS;
1445 }
1446
1447 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1448 capabilities |= CAP_EXTENDED_SECURITY;
1449 pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1450
1451 bcc_ptr = sess_data->iov[2].iov_base;
1452 /* unicode strings must be word aligned */
1453 if ((sess_data->iov[0].iov_len + sess_data->iov[1].iov_len) % 2) {
1454 *bcc_ptr = 0;
1455 bcc_ptr++;
1456 }
1457 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1458
1459 sess_data->iov[2].iov_len = (long) bcc_ptr -
1460 (long) sess_data->iov[2].iov_base;
1461
1462 return 0;
1463 }
1464
1465 static void
1466 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1467
1468 static void
1469 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1470 {
1471 int rc;
1472 struct smb_hdr *smb_buf;
1473 SESSION_SETUP_ANDX *pSMB;
1474 struct cifs_ses *ses = sess_data->ses;
1475 __u16 bytes_remaining;
1476 char *bcc_ptr;
1477 u16 blob_len;
1478
1479 cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1480
1481 /*
1482 * if memory allocation is successful, caller of this function
1483 * frees it.
1484 */
1485 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1486 if (!ses->ntlmssp) {
1487 rc = -ENOMEM;
1488 goto out;
1489 }
1490 ses->ntlmssp->sesskey_per_smbsess = false;
1491
1492 /* wct = 12 */
1493 rc = sess_alloc_buffer(sess_data, 12);
1494 if (rc)
1495 goto out;
1496
1497 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1498
1499 /* Build security blob before we assemble the request */
1500 build_ntlmssp_negotiate_blob(pSMB->req.SecurityBlob, ses);
1501 sess_data->iov[1].iov_len = sizeof(NEGOTIATE_MESSAGE);
1502 sess_data->iov[1].iov_base = pSMB->req.SecurityBlob;
1503 pSMB->req.SecurityBlobLength = cpu_to_le16(sizeof(NEGOTIATE_MESSAGE));
1504
1505 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1506 if (rc)
1507 goto out;
1508
1509 rc = sess_sendreceive(sess_data);
1510
1511 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1512 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1513
1514 /* If true, rc here is expected and not an error */
1515 if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1516 smb_buf->Status.CifsError ==
1517 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1518 rc = 0;
1519
1520 if (rc)
1521 goto out;
1522
1523 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1524
1525 if (smb_buf->WordCount != 4) {
1526 rc = -EIO;
1527 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1528 goto out;
1529 }
1530
1531 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1532 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1533
1534 bytes_remaining = get_bcc(smb_buf);
1535 bcc_ptr = pByteArea(smb_buf);
1536
1537 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1538 if (blob_len > bytes_remaining) {
1539 cifs_dbg(VFS, "bad security blob length %d\n",
1540 blob_len);
1541 rc = -EINVAL;
1542 goto out;
1543 }
1544
1545 rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1546 out:
1547 sess_free_buffer(sess_data);
1548
1549 if (!rc) {
1550 sess_data->func = sess_auth_rawntlmssp_authenticate;
1551 return;
1552 }
1553
1554 /* Else error. Cleanup */
1555 kfree(ses->auth_key.response);
1556 ses->auth_key.response = NULL;
1557 kfree(ses->ntlmssp);
1558 ses->ntlmssp = NULL;
1559
1560 sess_data->func = NULL;
1561 sess_data->result = rc;
1562 }
1563
1564 static void
1565 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1566 {
1567 int rc;
1568 struct smb_hdr *smb_buf;
1569 SESSION_SETUP_ANDX *pSMB;
1570 struct cifs_ses *ses = sess_data->ses;
1571 __u16 bytes_remaining;
1572 char *bcc_ptr;
1573 unsigned char *ntlmsspblob = NULL;
1574 u16 blob_len;
1575
1576 cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1577
1578 /* wct = 12 */
1579 rc = sess_alloc_buffer(sess_data, 12);
1580 if (rc)
1581 goto out;
1582
1583 /* Build security blob before we assemble the request */
1584 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1585 smb_buf = (struct smb_hdr *)pSMB;
1586 rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1587 &blob_len, ses, sess_data->nls_cp);
1588 if (rc)
1589 goto out_free_ntlmsspblob;
1590 sess_data->iov[1].iov_len = blob_len;
1591 sess_data->iov[1].iov_base = ntlmsspblob;
1592 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1593 /*
1594 * Make sure that we tell the server that we are using
1595 * the uid that it just gave us back on the response
1596 * (challenge)
1597 */
1598 smb_buf->Uid = ses->Suid;
1599
1600 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1601 if (rc)
1602 goto out_free_ntlmsspblob;
1603
1604 rc = sess_sendreceive(sess_data);
1605 if (rc)
1606 goto out_free_ntlmsspblob;
1607
1608 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1609 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1610 if (smb_buf->WordCount != 4) {
1611 rc = -EIO;
1612 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1613 goto out_free_ntlmsspblob;
1614 }
1615
1616 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1617 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1618
1619 if (ses->Suid != smb_buf->Uid) {
1620 ses->Suid = smb_buf->Uid;
1621 cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1622 }
1623
1624 bytes_remaining = get_bcc(smb_buf);
1625 bcc_ptr = pByteArea(smb_buf);
1626 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1627 if (blob_len > bytes_remaining) {
1628 cifs_dbg(VFS, "bad security blob length %d\n",
1629 blob_len);
1630 rc = -EINVAL;
1631 goto out_free_ntlmsspblob;
1632 }
1633 bcc_ptr += blob_len;
1634 bytes_remaining -= blob_len;
1635
1636
1637 /* BB check if Unicode and decode strings */
1638 if (bytes_remaining == 0) {
1639 /* no string area to decode, do nothing */
1640 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1641 /* unicode string area must be word-aligned */
1642 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1643 ++bcc_ptr;
1644 --bytes_remaining;
1645 }
1646 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1647 sess_data->nls_cp);
1648 } else {
1649 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1650 sess_data->nls_cp);
1651 }
1652
1653 out_free_ntlmsspblob:
1654 kfree(ntlmsspblob);
1655 out:
1656 sess_free_buffer(sess_data);
1657
1658 if (!rc)
1659 rc = sess_establish_session(sess_data);
1660
1661 /* Cleanup */
1662 kfree(ses->auth_key.response);
1663 ses->auth_key.response = NULL;
1664 kfree(ses->ntlmssp);
1665 ses->ntlmssp = NULL;
1666
1667 sess_data->func = NULL;
1668 sess_data->result = rc;
1669 }
1670
1671 static int select_sec(struct cifs_ses *ses, struct sess_data *sess_data)
1672 {
1673 int type;
1674
1675 type = cifs_select_sectype(ses->server, ses->sectype);
1676 cifs_dbg(FYI, "sess setup type %d\n", type);
1677 if (type == Unspecified) {
1678 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1679 return -EINVAL;
1680 }
1681
1682 switch (type) {
1683 case LANMAN:
1684 /* LANMAN and plaintext are less secure and off by default.
1685 * So we make this explicitly be turned on in kconfig (in the
1686 * build) and turned on at runtime (changed from the default)
1687 * in proc/fs/cifs or via mount parm. Unfortunately this is
1688 * needed for old Win (e.g. Win95), some obscure NAS and OS/2 */
1689 #ifdef CONFIG_CIFS_WEAK_PW_HASH
1690 sess_data->func = sess_auth_lanman;
1691 break;
1692 #else
1693 return -EOPNOTSUPP;
1694 #endif
1695 case NTLM:
1696 sess_data->func = sess_auth_ntlm;
1697 break;
1698 case NTLMv2:
1699 sess_data->func = sess_auth_ntlmv2;
1700 break;
1701 case Kerberos:
1702 #ifdef CONFIG_CIFS_UPCALL
1703 sess_data->func = sess_auth_kerberos;
1704 break;
1705 #else
1706 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1707 return -ENOSYS;
1708 #endif /* CONFIG_CIFS_UPCALL */
1709 case RawNTLMSSP:
1710 sess_data->func = sess_auth_rawntlmssp_negotiate;
1711 break;
1712 default:
1713 cifs_dbg(VFS, "secType %d not supported!\n", type);
1714 return -ENOSYS;
1715 }
1716
1717 return 0;
1718 }
1719
1720 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
1721 const struct nls_table *nls_cp)
1722 {
1723 int rc = 0;
1724 struct sess_data *sess_data;
1725
1726 if (ses == NULL) {
1727 WARN(1, "%s: ses == NULL!", __func__);
1728 return -EINVAL;
1729 }
1730
1731 sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
1732 if (!sess_data)
1733 return -ENOMEM;
1734
1735 rc = select_sec(ses, sess_data);
1736 if (rc)
1737 goto out;
1738
1739 sess_data->xid = xid;
1740 sess_data->ses = ses;
1741 sess_data->buf0_type = CIFS_NO_BUFFER;
1742 sess_data->nls_cp = (struct nls_table *) nls_cp;
1743
1744 while (sess_data->func)
1745 sess_data->func(sess_data);
1746
1747 /* Store result before we free sess_data */
1748 rc = sess_data->result;
1749
1750 out:
1751 kfree(sess_data);
1752 return rc;
1753 }
Linux with added FPC-III support