1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3 *
4 * SMB/CIFS session setup handling routines
5 *
6 * Copyright (c) International Business Machines Corp., 2006, 2009
7 * Author(s): Steve French (sfrench@us.ibm.com)
8 *
9 */
10
11 #include "cifspdu.h"
12 #include "cifsglob.h"
13 #include "cifsproto.h"
14 #include "cifs_unicode.h"
15 #include "cifs_debug.h"
16 #include "ntlmssp.h"
17 #include "nterr.h"
18 #include <linux/utsname.h>
19 #include <linux/slab.h>
20 #include <linux/version.h>
21 #include "cifsfs.h"
22 #include "cifs_spnego.h"
23 #include "smb2proto.h"
24 #include "fs_context.h"
25
26 static int
27 cifs_ses_add_channel(struct cifs_ses *ses,
28 struct cifs_server_iface *iface);
29
is_ses_using_iface(struct cifs_ses * ses,struct cifs_server_iface * iface)30 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
31 {
32 int i;
33
34 spin_lock(&ses->chan_lock);
35 for (i = 0; i < ses->chan_count; i++) {
36 if (ses->chans[i].iface == iface) {
37 spin_unlock(&ses->chan_lock);
38 return true;
39 }
40 }
41 spin_unlock(&ses->chan_lock);
42 return false;
43 }
44
45 /* channel helper functions. assumed that chan_lock is held by caller. */
46
47 int
cifs_ses_get_chan_index(struct cifs_ses * ses,struct TCP_Server_Info * server)48 cifs_ses_get_chan_index(struct cifs_ses *ses,
49 struct TCP_Server_Info *server)
50 {
51 unsigned int i;
52
53 /* if the channel is waiting for termination */
54 if (server && server->terminate)
55 return CIFS_INVAL_CHAN_INDEX;
56
57 for (i = 0; i < ses->chan_count; i++) {
58 if (ses->chans[i].server == server)
59 return i;
60 }
61
62 /* If we didn't find the channel, it is likely a bug */
63 if (server)
64 cifs_dbg(VFS, "unable to get chan index for server: 0x%llx",
65 server->conn_id);
66 return CIFS_INVAL_CHAN_INDEX;
67 }
68
69 void
cifs_chan_set_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)70 cifs_chan_set_in_reconnect(struct cifs_ses *ses,
71 struct TCP_Server_Info *server)
72 {
73 int chan_index = cifs_ses_get_chan_index(ses, server);
74
75 if (chan_index == CIFS_INVAL_CHAN_INDEX)
76 return;
77
78 ses->chans[chan_index].in_reconnect = true;
79 }
80
81 void
cifs_chan_clear_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)82 cifs_chan_clear_in_reconnect(struct cifs_ses *ses,
83 struct TCP_Server_Info *server)
84 {
85 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
86
87 if (chan_index == CIFS_INVAL_CHAN_INDEX)
88 return;
89
90 ses->chans[chan_index].in_reconnect = false;
91 }
92
93 void
cifs_chan_set_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)94 cifs_chan_set_need_reconnect(struct cifs_ses *ses,
95 struct TCP_Server_Info *server)
96 {
97 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
98
99 if (chan_index == CIFS_INVAL_CHAN_INDEX)
100 return;
101
102 set_bit(chan_index, &ses->chans_need_reconnect);
103 cifs_dbg(FYI, "Set reconnect bitmask for chan %u; now 0x%lx\n",
104 chan_index, ses->chans_need_reconnect);
105 }
106
107 void
cifs_chan_clear_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)108 cifs_chan_clear_need_reconnect(struct cifs_ses *ses,
109 struct TCP_Server_Info *server)
110 {
111 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
112
113 if (chan_index == CIFS_INVAL_CHAN_INDEX)
114 return;
115
116 clear_bit(chan_index, &ses->chans_need_reconnect);
117 cifs_dbg(FYI, "Cleared reconnect bitmask for chan %u; now 0x%lx\n",
118 chan_index, ses->chans_need_reconnect);
119 }
120
121 bool
cifs_chan_needs_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)122 cifs_chan_needs_reconnect(struct cifs_ses *ses,
123 struct TCP_Server_Info *server)
124 {
125 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
126
127 if (chan_index == CIFS_INVAL_CHAN_INDEX)
128 return true; /* err on the safer side */
129
130 return CIFS_CHAN_NEEDS_RECONNECT(ses, chan_index);
131 }
132
133 bool
cifs_chan_is_iface_active(struct cifs_ses * ses,struct TCP_Server_Info * server)134 cifs_chan_is_iface_active(struct cifs_ses *ses,
135 struct TCP_Server_Info *server)
136 {
137 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
138
139 if (chan_index == CIFS_INVAL_CHAN_INDEX)
140 return true; /* err on the safer side */
141
142 return ses->chans[chan_index].iface &&
143 ses->chans[chan_index].iface->is_active;
144 }
145
146 /* returns number of channels added */
cifs_try_adding_channels(struct cifs_ses * ses)147 int cifs_try_adding_channels(struct cifs_ses *ses)
148 {
149 struct TCP_Server_Info *server = ses->server;
150 int old_chan_count, new_chan_count;
151 int left;
152 int rc = 0;
153 int tries = 0;
154 size_t iface_weight = 0, iface_min_speed = 0;
155 struct cifs_server_iface *iface = NULL, *niface = NULL;
156 struct cifs_server_iface *last_iface = NULL;
157
158 spin_lock(&ses->chan_lock);
159
160 new_chan_count = old_chan_count = ses->chan_count;
161 left = ses->chan_max - ses->chan_count;
162
163 if (left <= 0) {
164 spin_unlock(&ses->chan_lock);
165 cifs_dbg(FYI,
166 "ses already at max_channels (%zu), nothing to open\n",
167 ses->chan_max);
168 return 0;
169 }
170
171 if (server->dialect < SMB30_PROT_ID) {
172 spin_unlock(&ses->chan_lock);
173 cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
174 return 0;
175 }
176
177 if (!(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
178 spin_unlock(&ses->chan_lock);
179 cifs_server_dbg(VFS, "no multichannel support\n");
180 return 0;
181 }
182 spin_unlock(&ses->chan_lock);
183
184 while (left > 0) {
185
186 tries++;
187 if (tries > 3*ses->chan_max) {
188 cifs_dbg(VFS, "too many channel open attempts (%d channels left to open)\n",
189 left);
190 break;
191 }
192
193 spin_lock(&ses->iface_lock);
194 if (!ses->iface_count) {
195 spin_unlock(&ses->iface_lock);
196 cifs_dbg(ONCE, "server %s does not advertise interfaces\n",
197 ses->server->hostname);
198 break;
199 }
200
201 if (!iface)
202 iface = list_first_entry(&ses->iface_list, struct cifs_server_iface,
203 iface_head);
204 last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
205 iface_head);
206 iface_min_speed = last_iface->speed;
207
208 list_for_each_entry_safe_from(iface, niface, &ses->iface_list,
209 iface_head) {
210 /* do not mix rdma and non-rdma interfaces */
211 if (iface->rdma_capable != ses->server->rdma)
212 continue;
213
214 /* skip ifaces that are unusable */
215 if (!iface->is_active ||
216 (is_ses_using_iface(ses, iface) &&
217 !iface->rss_capable))
218 continue;
219
220 /* check if we already allocated enough channels */
221 iface_weight = iface->speed / iface_min_speed;
222
223 if (iface->weight_fulfilled >= iface_weight)
224 continue;
225
226 /* take ref before unlock */
227 kref_get(&iface->refcount);
228
229 spin_unlock(&ses->iface_lock);
230 rc = cifs_ses_add_channel(ses, iface);
231 spin_lock(&ses->iface_lock);
232
233 if (rc) {
234 cifs_dbg(VFS, "failed to open extra channel on iface:%pIS rc=%d\n",
235 &iface->sockaddr,
236 rc);
237 kref_put(&iface->refcount, release_iface);
238 /* failure to add chan should increase weight */
239 iface->weight_fulfilled++;
240 continue;
241 }
242
243 iface->num_channels++;
244 iface->weight_fulfilled++;
245 cifs_info("successfully opened new channel on iface:%pIS\n",
246 &iface->sockaddr);
247 break;
248 }
249
250 /* reached end of list. reset weight_fulfilled and start over */
251 if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
252 list_for_each_entry(iface, &ses->iface_list, iface_head)
253 iface->weight_fulfilled = 0;
254 spin_unlock(&ses->iface_lock);
255 iface = NULL;
256 continue;
257 }
258 spin_unlock(&ses->iface_lock);
259
260 left--;
261 new_chan_count++;
262 }
263
264 return new_chan_count - old_chan_count;
265 }
266
267 /*
268 * called when multichannel is disabled by the server.
269 * this always gets called from smb2_reconnect
270 * and cannot get called in parallel threads.
271 */
272 void
cifs_disable_secondary_channels(struct cifs_ses * ses)273 cifs_disable_secondary_channels(struct cifs_ses *ses)
274 {
275 int i, chan_count;
276 struct TCP_Server_Info *server;
277 struct cifs_server_iface *iface;
278
279 spin_lock(&ses->chan_lock);
280 chan_count = ses->chan_count;
281 if (chan_count == 1)
282 goto done;
283
284 ses->chan_count = 1;
285
286 /* for all secondary channels reset the need reconnect bit */
287 ses->chans_need_reconnect &= 1;
288
289 for (i = 1; i < chan_count; i++) {
290 iface = ses->chans[i].iface;
291 server = ses->chans[i].server;
292
293 /*
294 * remove these references first, since we need to unlock
295 * the chan_lock here, since iface_lock is a higher lock
296 */
297 ses->chans[i].iface = NULL;
298 ses->chans[i].server = NULL;
299 spin_unlock(&ses->chan_lock);
300
301 if (iface) {
302 spin_lock(&ses->iface_lock);
303 iface->num_channels--;
304 if (iface->weight_fulfilled)
305 iface->weight_fulfilled--;
306 kref_put(&iface->refcount, release_iface);
307 spin_unlock(&ses->iface_lock);
308 }
309
310 if (server) {
311 if (!server->terminate) {
312 server->terminate = true;
313 cifs_signal_cifsd_for_reconnect(server, false);
314 }
315 cifs_put_tcp_session(server, false);
316 }
317
318 spin_lock(&ses->chan_lock);
319 }
320
321 done:
322 spin_unlock(&ses->chan_lock);
323 }
324
325 /* update the iface for the channel if necessary. */
326 void
cifs_chan_update_iface(struct cifs_ses * ses,struct TCP_Server_Info * server)327 cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server)
328 {
329 unsigned int chan_index;
330 size_t iface_weight = 0, iface_min_speed = 0;
331 struct cifs_server_iface *iface = NULL;
332 struct cifs_server_iface *old_iface = NULL;
333 struct cifs_server_iface *last_iface = NULL;
334 struct sockaddr_storage ss;
335
336 spin_lock(&ses->chan_lock);
337 chan_index = cifs_ses_get_chan_index(ses, server);
338 if (chan_index == CIFS_INVAL_CHAN_INDEX) {
339 spin_unlock(&ses->chan_lock);
340 return;
341 }
342
343 if (ses->chans[chan_index].iface) {
344 old_iface = ses->chans[chan_index].iface;
345 if (old_iface->is_active) {
346 spin_unlock(&ses->chan_lock);
347 return;
348 }
349 }
350 spin_unlock(&ses->chan_lock);
351
352 spin_lock(&server->srv_lock);
353 ss = server->dstaddr;
354 spin_unlock(&server->srv_lock);
355
356 spin_lock(&ses->iface_lock);
357 if (!ses->iface_count) {
358 spin_unlock(&ses->iface_lock);
359 cifs_dbg(ONCE, "server %s does not advertise interfaces\n", ses->server->hostname);
360 return;
361 }
362
363 last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
364 iface_head);
365 iface_min_speed = last_iface->speed;
366
367 /* then look for a new one */
368 list_for_each_entry(iface, &ses->iface_list, iface_head) {
369 if (!chan_index) {
370 /* if we're trying to get the updated iface for primary channel */
371 if (!cifs_match_ipaddr((struct sockaddr *) &ss,
372 (struct sockaddr *) &iface->sockaddr))
373 continue;
374
375 kref_get(&iface->refcount);
376 break;
377 }
378
379 /* do not mix rdma and non-rdma interfaces */
380 if (iface->rdma_capable != server->rdma)
381 continue;
382
383 if (!iface->is_active ||
384 (is_ses_using_iface(ses, iface) &&
385 !iface->rss_capable)) {
386 continue;
387 }
388
389 /* check if we already allocated enough channels */
390 iface_weight = iface->speed / iface_min_speed;
391
392 if (iface->weight_fulfilled >= iface_weight)
393 continue;
394
395 kref_get(&iface->refcount);
396 break;
397 }
398
399 if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
400 iface = NULL;
401 cifs_dbg(FYI, "unable to find a suitable iface\n");
402 }
403
404 if (!iface) {
405 if (!chan_index)
406 cifs_dbg(FYI, "unable to get the interface matching: %pIS\n",
407 &ss);
408 else {
409 cifs_dbg(FYI, "unable to find another interface to replace: %pIS\n",
410 &old_iface->sockaddr);
411 }
412
413 spin_unlock(&ses->iface_lock);
414 return;
415 }
416
417 /* now drop the ref to the current iface */
418 if (old_iface) {
419 cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n",
420 &old_iface->sockaddr,
421 &iface->sockaddr);
422
423 old_iface->num_channels--;
424 if (old_iface->weight_fulfilled)
425 old_iface->weight_fulfilled--;
426 iface->num_channels++;
427 iface->weight_fulfilled++;
428
429 kref_put(&old_iface->refcount, release_iface);
430 } else if (!chan_index) {
431 /* special case: update interface for primary channel */
432 cifs_dbg(FYI, "referencing primary channel iface: %pIS\n",
433 &iface->sockaddr);
434 iface->num_channels++;
435 iface->weight_fulfilled++;
436 }
437 spin_unlock(&ses->iface_lock);
438
439 spin_lock(&ses->chan_lock);
440 chan_index = cifs_ses_get_chan_index(ses, server);
441 if (chan_index == CIFS_INVAL_CHAN_INDEX) {
442 spin_unlock(&ses->chan_lock);
443 return;
444 }
445
446 ses->chans[chan_index].iface = iface;
447 spin_unlock(&ses->chan_lock);
448
449 spin_lock(&server->srv_lock);
450 memcpy(&server->dstaddr, &iface->sockaddr, sizeof(server->dstaddr));
451 spin_unlock(&server->srv_lock);
452 }
453
454 static int
cifs_ses_add_channel(struct cifs_ses * ses,struct cifs_server_iface * iface)455 cifs_ses_add_channel(struct cifs_ses *ses,
456 struct cifs_server_iface *iface)
457 {
458 struct TCP_Server_Info *chan_server;
459 struct cifs_chan *chan;
460 struct smb3_fs_context *ctx;
461 static const char unc_fmt[] = "\\%s\\foo";
462 struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
463 struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
464 size_t len;
465 int rc;
466 unsigned int xid = get_xid();
467
468 if (iface->sockaddr.ss_family == AF_INET)
469 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
470 ses, iface->speed, str_yes_no(iface->rdma_capable),
471 &ipv4->sin_addr);
472 else
473 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI6)\n",
474 ses, iface->speed, str_yes_no(iface->rdma_capable),
475 &ipv6->sin6_addr);
476
477 /*
478 * Setup a ctx with mostly the same info as the existing
479 * session and overwrite it with the requested iface data.
480 *
481 * We need to setup at least the fields used for negprot and
482 * sesssetup.
483 *
484 * We only need the ctx here, so we can reuse memory from
485 * the session and server without caring about memory
486 * management.
487 */
488 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
489 if (!ctx) {
490 rc = -ENOMEM;
491 goto out_free_xid;
492 }
493
494 /* Always make new connection for now (TODO?) */
495 ctx->nosharesock = true;
496
497 /* Auth */
498 ctx->domainauto = ses->domainAuto;
499 ctx->domainname = ses->domainName;
500
501 ctx->server_hostname = ses->server->hostname;
502
503 ctx->username = ses->user_name;
504 ctx->password = ses->password;
505 ctx->sectype = ses->sectype;
506 ctx->sign = ses->sign;
507 ctx->unicode = ses->unicode;
508
509 /* UNC and paths */
510 /* XXX: Use ses->server->hostname? */
511 len = sizeof(unc_fmt) + SERVER_NAME_LEN_WITH_NULL;
512 ctx->UNC = kzalloc(len, GFP_KERNEL);
513 if (!ctx->UNC) {
514 rc = -ENOMEM;
515 goto out_free_ctx;
516 }
517 scnprintf(ctx->UNC, len, unc_fmt, ses->ip_addr);
518 ctx->prepath = "";
519
520 /* Reuse same version as master connection */
521 ctx->vals = ses->server->vals;
522 ctx->ops = ses->server->ops;
523
524 ctx->noblocksnd = ses->server->noblocksnd;
525 ctx->noautotune = ses->server->noautotune;
526 ctx->sockopt_tcp_nodelay = ses->server->tcp_nodelay;
527 ctx->echo_interval = ses->server->echo_interval / HZ;
528 ctx->max_credits = ses->server->max_credits;
529 ctx->min_offload = ses->server->min_offload;
530 ctx->compress = ses->server->compression.requested;
531 ctx->dfs_conn = ses->server->dfs_conn;
532 ctx->ignore_signature = ses->server->ignore_signature;
533 ctx->leaf_fullpath = ses->server->leaf_fullpath;
534 ctx->rootfs = ses->server->noblockcnt;
535 ctx->retrans = ses->server->retrans;
536
537 /*
538 * This will be used for encoding/decoding user/domain/pw
539 * during sess setup auth.
540 */
541 ctx->local_nls = ses->local_nls;
542
543 /* Use RDMA if possible */
544 ctx->rdma = iface->rdma_capable;
545 memcpy(&ctx->dstaddr, &iface->sockaddr, sizeof(ctx->dstaddr));
546
547 /* reuse master con client guid */
548 memcpy(&ctx->client_guid, ses->server->client_guid,
549 sizeof(ctx->client_guid));
550 ctx->use_client_guid = true;
551
552 chan_server = cifs_get_tcp_session(ctx, ses->server);
553
554 spin_lock(&ses->chan_lock);
555 chan = &ses->chans[ses->chan_count];
556 chan->server = chan_server;
557 if (IS_ERR(chan->server)) {
558 rc = PTR_ERR(chan->server);
559 chan->server = NULL;
560 spin_unlock(&ses->chan_lock);
561 goto out;
562 }
563 chan->iface = iface;
564 ses->chan_count++;
565 atomic_set(&ses->chan_seq, 0);
566
567 /* Mark this channel as needing connect/setup */
568 cifs_chan_set_need_reconnect(ses, chan->server);
569
570 spin_unlock(&ses->chan_lock);
571
572 mutex_lock(&ses->session_mutex);
573 /*
574 * We need to allocate the server crypto now as we will need
575 * to sign packets before we generate the channel signing key
576 * (we sign with the session key)
577 */
578 rc = smb311_crypto_shash_allocate(chan->server);
579 if (rc) {
580 cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
581 mutex_unlock(&ses->session_mutex);
582 goto out;
583 }
584
585 rc = cifs_negotiate_protocol(xid, ses, chan->server);
586 if (!rc)
587 rc = cifs_setup_session(xid, ses, chan->server, ses->local_nls);
588
589 mutex_unlock(&ses->session_mutex);
590
591 out:
592 if (rc && chan->server) {
593 cifs_put_tcp_session(chan->server, 0);
594
595 spin_lock(&ses->chan_lock);
596
597 /* we rely on all bits beyond chan_count to be clear */
598 cifs_chan_clear_need_reconnect(ses, chan->server);
599 ses->chan_count--;
600 /*
601 * chan_count should never reach 0 as at least the primary
602 * channel is always allocated
603 */
604 WARN_ON(ses->chan_count < 1);
605 spin_unlock(&ses->chan_lock);
606 }
607
608 kfree(ctx->UNC);
609 out_free_ctx:
610 kfree(ctx);
611 out_free_xid:
612 free_xid(xid);
613 return rc;
614 }
615
616 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
cifs_ssetup_hdr(struct cifs_ses * ses,struct TCP_Server_Info * server,SESSION_SETUP_ANDX * pSMB)617 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses,
618 struct TCP_Server_Info *server,
619 SESSION_SETUP_ANDX *pSMB)
620 {
621 __u32 capabilities = 0;
622
623 /* init fields common to all four types of SessSetup */
624 /* Note that offsets for first seven fields in req struct are same */
625 /* in CIFS Specs so does not matter which of 3 forms of struct */
626 /* that we use in next few lines */
627 /* Note that header is initialized to zero in header_assemble */
628 pSMB->req.AndXCommand = 0xFF;
629 pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
630 CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
631 USHRT_MAX));
632 pSMB->req.MaxMpxCount = cpu_to_le16(server->maxReq);
633 pSMB->req.VcNumber = cpu_to_le16(1);
634 pSMB->req.SessionKey = server->session_key_id;
635
636 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
637
638 /* BB verify whether signing required on neg or just auth frame (and NTLM case) */
639
640 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
641 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
642
643 if (server->sign)
644 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
645
646 if (ses->capabilities & CAP_UNICODE) {
647 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
648 capabilities |= CAP_UNICODE;
649 }
650 if (ses->capabilities & CAP_STATUS32) {
651 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
652 capabilities |= CAP_STATUS32;
653 }
654 if (ses->capabilities & CAP_DFS) {
655 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
656 capabilities |= CAP_DFS;
657 }
658 if (ses->capabilities & CAP_UNIX)
659 capabilities |= CAP_UNIX;
660
661 return capabilities;
662 }
663
664 static void
unicode_oslm_strings(char ** pbcc_area,const struct nls_table * nls_cp)665 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
666 {
667 char *bcc_ptr = *pbcc_area;
668 int bytes_ret = 0;
669
670 /* Copy OS version */
671 bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
672 nls_cp);
673 bcc_ptr += 2 * bytes_ret;
674 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
675 32, nls_cp);
676 bcc_ptr += 2 * bytes_ret;
677 bcc_ptr += 2; /* trailing null */
678
679 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
680 32, nls_cp);
681 bcc_ptr += 2 * bytes_ret;
682 bcc_ptr += 2; /* trailing null */
683
684 *pbcc_area = bcc_ptr;
685 }
686
687 static void
ascii_oslm_strings(char ** pbcc_area,const struct nls_table * nls_cp)688 ascii_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
689 {
690 char *bcc_ptr = *pbcc_area;
691
692 strcpy(bcc_ptr, "Linux version ");
693 bcc_ptr += strlen("Linux version ");
694 strcpy(bcc_ptr, init_utsname()->release);
695 bcc_ptr += strlen(init_utsname()->release) + 1;
696
697 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
698 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
699
700 *pbcc_area = bcc_ptr;
701 }
702
unicode_domain_string(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)703 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
704 const struct nls_table *nls_cp)
705 {
706 char *bcc_ptr = *pbcc_area;
707 int bytes_ret = 0;
708
709 /* copy domain */
710 if (ses->domainName == NULL) {
711 /*
712 * Sending null domain better than using a bogus domain name (as
713 * we did briefly in 2.6.18) since server will use its default
714 */
715 *bcc_ptr = 0;
716 *(bcc_ptr+1) = 0;
717 bytes_ret = 0;
718 } else
719 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
720 CIFS_MAX_DOMAINNAME_LEN, nls_cp);
721 bcc_ptr += 2 * bytes_ret;
722 bcc_ptr += 2; /* account for null terminator */
723
724 *pbcc_area = bcc_ptr;
725 }
726
ascii_domain_string(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)727 static void ascii_domain_string(char **pbcc_area, struct cifs_ses *ses,
728 const struct nls_table *nls_cp)
729 {
730 char *bcc_ptr = *pbcc_area;
731 int len;
732
733 /* copy domain */
734 if (ses->domainName != NULL) {
735 len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
736 if (WARN_ON_ONCE(len < 0))
737 len = CIFS_MAX_DOMAINNAME_LEN - 1;
738 bcc_ptr += len;
739 } /* else we send a null domain name so server will default to its own domain */
740 *bcc_ptr = 0;
741 bcc_ptr++;
742
743 *pbcc_area = bcc_ptr;
744 }
745
unicode_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)746 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
747 const struct nls_table *nls_cp)
748 {
749 char *bcc_ptr = *pbcc_area;
750 int bytes_ret = 0;
751
752 /* BB FIXME add check that strings less than 335 or will need to send as arrays */
753
754 /* copy user */
755 if (ses->user_name == NULL) {
756 /* null user mount */
757 *bcc_ptr = 0;
758 *(bcc_ptr+1) = 0;
759 } else {
760 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
761 CIFS_MAX_USERNAME_LEN, nls_cp);
762 }
763 bcc_ptr += 2 * bytes_ret;
764 bcc_ptr += 2; /* account for null termination */
765
766 unicode_domain_string(&bcc_ptr, ses, nls_cp);
767 unicode_oslm_strings(&bcc_ptr, nls_cp);
768
769 *pbcc_area = bcc_ptr;
770 }
771
ascii_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)772 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
773 const struct nls_table *nls_cp)
774 {
775 char *bcc_ptr = *pbcc_area;
776 int len;
777
778 /* copy user */
779 /* BB what about null user mounts - check that we do this BB */
780 /* copy user */
781 if (ses->user_name != NULL) {
782 len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
783 if (WARN_ON_ONCE(len < 0))
784 len = CIFS_MAX_USERNAME_LEN - 1;
785 bcc_ptr += len;
786 }
787 /* else null user mount */
788 *bcc_ptr = 0;
789 bcc_ptr++; /* account for null termination */
790
791 /* BB check for overflow here */
792
793 ascii_domain_string(&bcc_ptr, ses, nls_cp);
794 ascii_oslm_strings(&bcc_ptr, nls_cp);
795
796 *pbcc_area = bcc_ptr;
797 }
798
799 static void
decode_unicode_ssetup(char ** pbcc_area,int bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)800 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
801 const struct nls_table *nls_cp)
802 {
803 int len;
804 char *data = *pbcc_area;
805
806 cifs_dbg(FYI, "bleft %d\n", bleft);
807
808 kfree(ses->serverOS);
809 ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
810 cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
811 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
812 data += len;
813 bleft -= len;
814 if (bleft <= 0)
815 return;
816
817 kfree(ses->serverNOS);
818 ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
819 cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
820 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
821 data += len;
822 bleft -= len;
823 if (bleft <= 0)
824 return;
825
826 kfree(ses->serverDomain);
827 ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
828 cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
829
830 return;
831 }
832
decode_ascii_ssetup(char ** pbcc_area,__u16 bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)833 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
834 struct cifs_ses *ses,
835 const struct nls_table *nls_cp)
836 {
837 int len;
838 char *bcc_ptr = *pbcc_area;
839
840 cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
841
842 len = strnlen(bcc_ptr, bleft);
843 if (len >= bleft)
844 return;
845
846 kfree(ses->serverOS);
847
848 ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
849 if (ses->serverOS) {
850 memcpy(ses->serverOS, bcc_ptr, len);
851 ses->serverOS[len] = 0;
852 if (strncmp(ses->serverOS, "OS/2", 4) == 0)
853 cifs_dbg(FYI, "OS/2 server\n");
854 }
855
856 bcc_ptr += len + 1;
857 bleft -= len + 1;
858
859 len = strnlen(bcc_ptr, bleft);
860 if (len >= bleft)
861 return;
862
863 kfree(ses->serverNOS);
864
865 ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
866 if (ses->serverNOS) {
867 memcpy(ses->serverNOS, bcc_ptr, len);
868 ses->serverNOS[len] = 0;
869 }
870
871 bcc_ptr += len + 1;
872 bleft -= len + 1;
873
874 len = strnlen(bcc_ptr, bleft);
875 if (len > bleft)
876 return;
877
878 /*
879 * No domain field in LANMAN case. Domain is
880 * returned by old servers in the SMB negprot response
881 *
882 * BB For newer servers which do not support Unicode,
883 * but thus do return domain here, we could add parsing
884 * for it later, but it is not very important
885 */
886 cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
887 }
888 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
889
decode_ntlmssp_challenge(char * bcc_ptr,int blob_len,struct cifs_ses * ses)890 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
891 struct cifs_ses *ses)
892 {
893 unsigned int tioffset; /* challenge message target info area */
894 unsigned int tilen; /* challenge message target info area length */
895 CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
896 __u32 server_flags;
897
898 if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
899 cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
900 return -EINVAL;
901 }
902
903 if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
904 cifs_dbg(VFS, "blob signature incorrect %s\n",
905 pblob->Signature);
906 return -EINVAL;
907 }
908 if (pblob->MessageType != NtLmChallenge) {
909 cifs_dbg(VFS, "Incorrect message type %d\n",
910 pblob->MessageType);
911 return -EINVAL;
912 }
913
914 server_flags = le32_to_cpu(pblob->NegotiateFlags);
915 cifs_dbg(FYI, "%s: negotiate=0x%08x challenge=0x%08x\n", __func__,
916 ses->ntlmssp->client_flags, server_flags);
917
918 if ((ses->ntlmssp->client_flags & (NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN)) &&
919 (!(server_flags & NTLMSSP_NEGOTIATE_56) && !(server_flags & NTLMSSP_NEGOTIATE_128))) {
920 cifs_dbg(VFS, "%s: requested signing/encryption but server did not return either 56-bit or 128-bit session key size\n",
921 __func__);
922 return -EINVAL;
923 }
924 if (!(server_flags & NTLMSSP_NEGOTIATE_NTLM) && !(server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) {
925 cifs_dbg(VFS, "%s: server does not seem to support either NTLMv1 or NTLMv2\n", __func__);
926 return -EINVAL;
927 }
928 if (ses->server->sign && !(server_flags & NTLMSSP_NEGOTIATE_SIGN)) {
929 cifs_dbg(VFS, "%s: forced packet signing but server does not seem to support it\n",
930 __func__);
931 return -EOPNOTSUPP;
932 }
933 if ((ses->ntlmssp->client_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
934 !(server_flags & NTLMSSP_NEGOTIATE_KEY_XCH))
935 pr_warn_once("%s: authentication has been weakened as server does not support key exchange\n",
936 __func__);
937
938 ses->ntlmssp->server_flags = server_flags;
939
940 memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
941 /*
942 * In particular we can examine sign flags
943 *
944 * BB spec says that if AvId field of MsvAvTimestamp is populated then
945 * we must set the MIC field of the AUTHENTICATE_MESSAGE
946 */
947
948 tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
949 tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
950 if (tioffset > blob_len || tioffset + tilen > blob_len) {
951 cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
952 tioffset, tilen);
953 return -EINVAL;
954 }
955 if (tilen) {
956 kfree_sensitive(ses->auth_key.response);
957 ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
958 GFP_KERNEL);
959 if (!ses->auth_key.response) {
960 cifs_dbg(VFS, "Challenge target info alloc failure\n");
961 return -ENOMEM;
962 }
963 ses->auth_key.len = tilen;
964 }
965
966 return 0;
967 }
968
size_of_ntlmssp_blob(struct cifs_ses * ses,int base_size)969 static int size_of_ntlmssp_blob(struct cifs_ses *ses, int base_size)
970 {
971 int sz = base_size + ses->auth_key.len
972 - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
973
974 if (ses->domainName)
975 sz += sizeof(__le16) * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
976 else
977 sz += sizeof(__le16);
978
979 if (ses->user_name)
980 sz += sizeof(__le16) * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
981 else
982 sz += sizeof(__le16);
983
984 if (ses->workstation_name[0])
985 sz += sizeof(__le16) * strnlen(ses->workstation_name,
986 ntlmssp_workstation_name_size(ses));
987 else
988 sz += sizeof(__le16);
989
990 return sz;
991 }
992
cifs_security_buffer_from_str(SECURITY_BUFFER * pbuf,char * str_value,int str_length,unsigned char * pstart,unsigned char ** pcur,const struct nls_table * nls_cp)993 static inline void cifs_security_buffer_from_str(SECURITY_BUFFER *pbuf,
994 char *str_value,
995 int str_length,
996 unsigned char *pstart,
997 unsigned char **pcur,
998 const struct nls_table *nls_cp)
999 {
1000 unsigned char *tmp = pstart;
1001 int len;
1002
1003 if (!pbuf)
1004 return;
1005
1006 if (!pcur)
1007 pcur = &tmp;
1008
1009 if (!str_value) {
1010 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
1011 pbuf->Length = 0;
1012 pbuf->MaximumLength = 0;
1013 *pcur += sizeof(__le16);
1014 } else {
1015 len = cifs_strtoUTF16((__le16 *)*pcur,
1016 str_value,
1017 str_length,
1018 nls_cp);
1019 len *= sizeof(__le16);
1020 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
1021 pbuf->Length = cpu_to_le16(len);
1022 pbuf->MaximumLength = cpu_to_le16(len);
1023 *pcur += len;
1024 }
1025 }
1026
1027 /* BB Move to ntlmssp.c eventually */
1028
build_ntlmssp_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1029 int build_ntlmssp_negotiate_blob(unsigned char **pbuffer,
1030 u16 *buflen,
1031 struct cifs_ses *ses,
1032 struct TCP_Server_Info *server,
1033 const struct nls_table *nls_cp)
1034 {
1035 int rc = 0;
1036 NEGOTIATE_MESSAGE *sec_blob;
1037 __u32 flags;
1038 unsigned char *tmp;
1039 int len;
1040
1041 len = size_of_ntlmssp_blob(ses, sizeof(NEGOTIATE_MESSAGE));
1042 *pbuffer = kmalloc(len, GFP_KERNEL);
1043 if (!*pbuffer) {
1044 rc = -ENOMEM;
1045 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1046 *buflen = 0;
1047 goto setup_ntlm_neg_ret;
1048 }
1049 sec_blob = (NEGOTIATE_MESSAGE *)*pbuffer;
1050
1051 memset(*pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
1052 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1053 sec_blob->MessageType = NtLmNegotiate;
1054
1055 /* BB is NTLMV2 session security format easier to use here? */
1056 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
1057 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1058 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1059 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1060 NTLMSSP_NEGOTIATE_SIGN;
1061 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1062 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1063
1064 tmp = *pbuffer + sizeof(NEGOTIATE_MESSAGE);
1065 ses->ntlmssp->client_flags = flags;
1066 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1067
1068 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1069 cifs_security_buffer_from_str(&sec_blob->DomainName,
1070 NULL,
1071 CIFS_MAX_DOMAINNAME_LEN,
1072 *pbuffer, &tmp,
1073 nls_cp);
1074
1075 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1076 NULL,
1077 CIFS_MAX_WORKSTATION_LEN,
1078 *pbuffer, &tmp,
1079 nls_cp);
1080
1081 *buflen = tmp - *pbuffer;
1082 setup_ntlm_neg_ret:
1083 return rc;
1084 }
1085
1086 /*
1087 * Build ntlmssp blob with additional fields, such as version,
1088 * supported by modern servers. For safety limit to SMB3 or later
1089 * See notes in MS-NLMP Section 2.2.2.1 e.g.
1090 */
build_ntlmssp_smb3_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1091 int build_ntlmssp_smb3_negotiate_blob(unsigned char **pbuffer,
1092 u16 *buflen,
1093 struct cifs_ses *ses,
1094 struct TCP_Server_Info *server,
1095 const struct nls_table *nls_cp)
1096 {
1097 int rc = 0;
1098 struct negotiate_message *sec_blob;
1099 __u32 flags;
1100 unsigned char *tmp;
1101 int len;
1102
1103 len = size_of_ntlmssp_blob(ses, sizeof(struct negotiate_message));
1104 *pbuffer = kmalloc(len, GFP_KERNEL);
1105 if (!*pbuffer) {
1106 rc = -ENOMEM;
1107 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1108 *buflen = 0;
1109 goto setup_ntlm_smb3_neg_ret;
1110 }
1111 sec_blob = (struct negotiate_message *)*pbuffer;
1112
1113 memset(*pbuffer, 0, sizeof(struct negotiate_message));
1114 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1115 sec_blob->MessageType = NtLmNegotiate;
1116
1117 /* BB is NTLMV2 session security format easier to use here? */
1118 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
1119 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1120 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1121 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1122 NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_VERSION;
1123 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1124 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1125
1126 sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1127 sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1128 sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1129 sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1130
1131 tmp = *pbuffer + sizeof(struct negotiate_message);
1132 ses->ntlmssp->client_flags = flags;
1133 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1134
1135 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1136 cifs_security_buffer_from_str(&sec_blob->DomainName,
1137 NULL,
1138 CIFS_MAX_DOMAINNAME_LEN,
1139 *pbuffer, &tmp,
1140 nls_cp);
1141
1142 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1143 NULL,
1144 CIFS_MAX_WORKSTATION_LEN,
1145 *pbuffer, &tmp,
1146 nls_cp);
1147
1148 *buflen = tmp - *pbuffer;
1149 setup_ntlm_smb3_neg_ret:
1150 return rc;
1151 }
1152
1153
1154 /* See MS-NLMP 2.2.1.3 */
build_ntlmssp_auth_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1155 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
1156 u16 *buflen,
1157 struct cifs_ses *ses,
1158 struct TCP_Server_Info *server,
1159 const struct nls_table *nls_cp)
1160 {
1161 int rc;
1162 AUTHENTICATE_MESSAGE *sec_blob;
1163 __u32 flags;
1164 unsigned char *tmp;
1165 int len;
1166
1167 rc = setup_ntlmv2_rsp(ses, nls_cp);
1168 if (rc) {
1169 cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
1170 *buflen = 0;
1171 goto setup_ntlmv2_ret;
1172 }
1173
1174 len = size_of_ntlmssp_blob(ses, sizeof(AUTHENTICATE_MESSAGE));
1175 *pbuffer = kmalloc(len, GFP_KERNEL);
1176 if (!*pbuffer) {
1177 rc = -ENOMEM;
1178 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1179 *buflen = 0;
1180 goto setup_ntlmv2_ret;
1181 }
1182 sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
1183
1184 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1185 sec_blob->MessageType = NtLmAuthenticate;
1186
1187 /* send version information in ntlmssp authenticate also */
1188 flags = ses->ntlmssp->server_flags | NTLMSSP_REQUEST_TARGET |
1189 NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_VERSION |
1190 NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED;
1191
1192 sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1193 sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1194 sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1195 sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1196
1197 tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
1198 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1199
1200 sec_blob->LmChallengeResponse.BufferOffset =
1201 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
1202 sec_blob->LmChallengeResponse.Length = 0;
1203 sec_blob->LmChallengeResponse.MaximumLength = 0;
1204
1205 sec_blob->NtChallengeResponse.BufferOffset =
1206 cpu_to_le32(tmp - *pbuffer);
1207 if (ses->user_name != NULL) {
1208 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1209 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1210 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1211
1212 sec_blob->NtChallengeResponse.Length =
1213 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1214 sec_blob->NtChallengeResponse.MaximumLength =
1215 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1216 } else {
1217 /*
1218 * don't send an NT Response for anonymous access
1219 */
1220 sec_blob->NtChallengeResponse.Length = 0;
1221 sec_blob->NtChallengeResponse.MaximumLength = 0;
1222 }
1223
1224 cifs_security_buffer_from_str(&sec_blob->DomainName,
1225 ses->domainName,
1226 CIFS_MAX_DOMAINNAME_LEN,
1227 *pbuffer, &tmp,
1228 nls_cp);
1229
1230 cifs_security_buffer_from_str(&sec_blob->UserName,
1231 ses->user_name,
1232 CIFS_MAX_USERNAME_LEN,
1233 *pbuffer, &tmp,
1234 nls_cp);
1235
1236 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1237 ses->workstation_name,
1238 ntlmssp_workstation_name_size(ses),
1239 *pbuffer, &tmp,
1240 nls_cp);
1241
1242 if ((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
1243 (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) &&
1244 !calc_seckey(ses)) {
1245 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
1246 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1247 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
1248 sec_blob->SessionKey.MaximumLength =
1249 cpu_to_le16(CIFS_CPHTXT_SIZE);
1250 tmp += CIFS_CPHTXT_SIZE;
1251 } else {
1252 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1253 sec_blob->SessionKey.Length = 0;
1254 sec_blob->SessionKey.MaximumLength = 0;
1255 }
1256
1257 *buflen = tmp - *pbuffer;
1258 setup_ntlmv2_ret:
1259 return rc;
1260 }
1261
1262 enum securityEnum
cifs_select_sectype(struct TCP_Server_Info * server,enum securityEnum requested)1263 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
1264 {
1265 switch (server->negflavor) {
1266 case CIFS_NEGFLAVOR_EXTENDED:
1267 switch (requested) {
1268 case Kerberos:
1269 case RawNTLMSSP:
1270 case IAKerb:
1271 return requested;
1272 case Unspecified:
1273 if (server->sec_ntlmssp &&
1274 (global_secflags & CIFSSEC_MAY_NTLMSSP))
1275 return RawNTLMSSP;
1276 if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) &&
1277 (global_secflags & CIFSSEC_MAY_KRB5))
1278 return Kerberos;
1279 fallthrough;
1280 default:
1281 return Unspecified;
1282 }
1283 case CIFS_NEGFLAVOR_UNENCAP:
1284 switch (requested) {
1285 case NTLMv2:
1286 return requested;
1287 case Unspecified:
1288 if (global_secflags & CIFSSEC_MAY_NTLMV2)
1289 return NTLMv2;
1290 break;
1291 default:
1292 break;
1293 }
1294 fallthrough;
1295 default:
1296 return Unspecified;
1297 }
1298 }
1299
1300 struct sess_data {
1301 unsigned int xid;
1302 struct cifs_ses *ses;
1303 struct TCP_Server_Info *server;
1304 struct nls_table *nls_cp;
1305 void (*func)(struct sess_data *);
1306 int result;
1307
1308 /* we will send the SMB in three pieces:
1309 * a fixed length beginning part, an optional
1310 * SPNEGO blob (which can be zero length), and a
1311 * last part which will include the strings
1312 * and rest of bcc area. This allows us to avoid
1313 * a large buffer 17K allocation
1314 */
1315 int buf0_type;
1316 struct kvec iov[3];
1317 };
1318
1319 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
1320 static int
sess_alloc_buffer(struct sess_data * sess_data,int wct)1321 sess_alloc_buffer(struct sess_data *sess_data, int wct)
1322 {
1323 int rc;
1324 struct cifs_ses *ses = sess_data->ses;
1325 struct smb_hdr *smb_buf;
1326
1327 rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
1328 (void **)&smb_buf);
1329
1330 if (rc)
1331 return rc;
1332
1333 sess_data->iov[0].iov_base = (char *)smb_buf;
1334 sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
1335 /*
1336 * This variable will be used to clear the buffer
1337 * allocated above in case of any error in the calling function.
1338 */
1339 sess_data->buf0_type = CIFS_SMALL_BUFFER;
1340
1341 /* 2000 big enough to fit max user, domain, NOS name etc. */
1342 sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
1343 if (!sess_data->iov[2].iov_base) {
1344 rc = -ENOMEM;
1345 goto out_free_smb_buf;
1346 }
1347
1348 return 0;
1349
1350 out_free_smb_buf:
1351 cifs_small_buf_release(smb_buf);
1352 sess_data->iov[0].iov_base = NULL;
1353 sess_data->iov[0].iov_len = 0;
1354 sess_data->buf0_type = CIFS_NO_BUFFER;
1355 return rc;
1356 }
1357
1358 static void
sess_free_buffer(struct sess_data * sess_data)1359 sess_free_buffer(struct sess_data *sess_data)
1360 {
1361 struct kvec *iov = sess_data->iov;
1362
1363 /*
1364 * Zero the session data before freeing, as it might contain sensitive info (keys, etc).
1365 * Note that iov[1] is already freed by caller.
1366 */
1367 if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base)
1368 memzero_explicit(iov[0].iov_base, iov[0].iov_len);
1369
1370 free_rsp_buf(sess_data->buf0_type, iov[0].iov_base);
1371 sess_data->buf0_type = CIFS_NO_BUFFER;
1372 kfree_sensitive(iov[2].iov_base);
1373 }
1374
1375 static int
sess_establish_session(struct sess_data * sess_data)1376 sess_establish_session(struct sess_data *sess_data)
1377 {
1378 struct cifs_ses *ses = sess_data->ses;
1379 struct TCP_Server_Info *server = sess_data->server;
1380
1381 cifs_server_lock(server);
1382 if (!server->session_estab) {
1383 if (server->sign) {
1384 server->session_key.response =
1385 kmemdup(ses->auth_key.response,
1386 ses->auth_key.len, GFP_KERNEL);
1387 if (!server->session_key.response) {
1388 cifs_server_unlock(server);
1389 return -ENOMEM;
1390 }
1391 server->session_key.len =
1392 ses->auth_key.len;
1393 }
1394 server->sequence_number = 0x2;
1395 server->session_estab = true;
1396 }
1397 cifs_server_unlock(server);
1398
1399 cifs_dbg(FYI, "CIFS session established successfully\n");
1400 return 0;
1401 }
1402
1403 static int
sess_sendreceive(struct sess_data * sess_data)1404 sess_sendreceive(struct sess_data *sess_data)
1405 {
1406 int rc;
1407 struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
1408 __u16 count;
1409 struct kvec rsp_iov = { NULL, 0 };
1410
1411 count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
1412 be32_add_cpu(&smb_buf->smb_buf_length, count);
1413 put_bcc(count, smb_buf);
1414
1415 rc = SendReceive2(sess_data->xid, sess_data->ses,
1416 sess_data->iov, 3 /* num_iovecs */,
1417 &sess_data->buf0_type,
1418 CIFS_LOG_ERROR, &rsp_iov);
1419 cifs_small_buf_release(sess_data->iov[0].iov_base);
1420 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
1421
1422 return rc;
1423 }
1424
1425 static void
sess_auth_ntlmv2(struct sess_data * sess_data)1426 sess_auth_ntlmv2(struct sess_data *sess_data)
1427 {
1428 int rc = 0;
1429 struct smb_hdr *smb_buf;
1430 SESSION_SETUP_ANDX *pSMB;
1431 char *bcc_ptr;
1432 struct cifs_ses *ses = sess_data->ses;
1433 struct TCP_Server_Info *server = sess_data->server;
1434 __u32 capabilities;
1435 __u16 bytes_remaining;
1436
1437 /* old style NTLM sessionsetup */
1438 /* wct = 13 */
1439 rc = sess_alloc_buffer(sess_data, 13);
1440 if (rc)
1441 goto out;
1442
1443 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1444 bcc_ptr = sess_data->iov[2].iov_base;
1445 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1446
1447 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1448
1449 /* LM2 password would be here if we supported it */
1450 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1451
1452 if (ses->user_name != NULL) {
1453 /* calculate nlmv2 response and session key */
1454 rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
1455 if (rc) {
1456 cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
1457 goto out;
1458 }
1459
1460 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1461 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1462 bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1463
1464 /* set case sensitive password length after tilen may get
1465 * assigned, tilen is 0 otherwise.
1466 */
1467 pSMB->req_no_secext.CaseSensitivePasswordLength =
1468 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1469 } else {
1470 pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1471 }
1472
1473 if (ses->capabilities & CAP_UNICODE) {
1474 if (!IS_ALIGNED(sess_data->iov[0].iov_len, 2)) {
1475 *bcc_ptr = 0;
1476 bcc_ptr++;
1477 }
1478 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1479 } else {
1480 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1481 }
1482
1483
1484 sess_data->iov[2].iov_len = (long) bcc_ptr -
1485 (long) sess_data->iov[2].iov_base;
1486
1487 rc = sess_sendreceive(sess_data);
1488 if (rc)
1489 goto out;
1490
1491 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1492 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1493
1494 if (smb_buf->WordCount != 3) {
1495 rc = -EIO;
1496 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1497 goto out;
1498 }
1499
1500 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1501 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1502
1503 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1504 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1505
1506 bytes_remaining = get_bcc(smb_buf);
1507 bcc_ptr = pByteArea(smb_buf);
1508
1509 /* BB check if Unicode and decode strings */
1510 if (bytes_remaining == 0) {
1511 /* no string area to decode, do nothing */
1512 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1513 /* unicode string area must be word-aligned */
1514 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1515 ++bcc_ptr;
1516 --bytes_remaining;
1517 }
1518 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1519 sess_data->nls_cp);
1520 } else {
1521 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1522 sess_data->nls_cp);
1523 }
1524
1525 rc = sess_establish_session(sess_data);
1526 out:
1527 sess_data->result = rc;
1528 sess_data->func = NULL;
1529 sess_free_buffer(sess_data);
1530 kfree_sensitive(ses->auth_key.response);
1531 ses->auth_key.response = NULL;
1532 }
1533
1534 #ifdef CONFIG_CIFS_UPCALL
1535 static void
sess_auth_kerberos(struct sess_data * sess_data)1536 sess_auth_kerberos(struct sess_data *sess_data)
1537 {
1538 int rc = 0;
1539 struct smb_hdr *smb_buf;
1540 SESSION_SETUP_ANDX *pSMB;
1541 char *bcc_ptr;
1542 struct cifs_ses *ses = sess_data->ses;
1543 struct TCP_Server_Info *server = sess_data->server;
1544 __u32 capabilities;
1545 __u16 bytes_remaining;
1546 struct key *spnego_key = NULL;
1547 struct cifs_spnego_msg *msg;
1548 u16 blob_len;
1549
1550 /* extended security */
1551 /* wct = 12 */
1552 rc = sess_alloc_buffer(sess_data, 12);
1553 if (rc)
1554 goto out;
1555
1556 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1557 bcc_ptr = sess_data->iov[2].iov_base;
1558 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1559
1560 spnego_key = cifs_get_spnego_key(ses, server);
1561 if (IS_ERR(spnego_key)) {
1562 rc = PTR_ERR(spnego_key);
1563 spnego_key = NULL;
1564 goto out;
1565 }
1566
1567 msg = spnego_key->payload.data[0];
1568 /*
1569 * check version field to make sure that cifs.upcall is
1570 * sending us a response in an expected form
1571 */
1572 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1573 cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1574 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1575 rc = -EKEYREJECTED;
1576 goto out_put_spnego_key;
1577 }
1578
1579 kfree_sensitive(ses->auth_key.response);
1580 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1581 GFP_KERNEL);
1582 if (!ses->auth_key.response) {
1583 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1584 msg->sesskey_len);
1585 rc = -ENOMEM;
1586 goto out_put_spnego_key;
1587 }
1588 ses->auth_key.len = msg->sesskey_len;
1589
1590 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1591 capabilities |= CAP_EXTENDED_SECURITY;
1592 pSMB->req.Capabilities = cpu_to_le32(capabilities);
1593 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1594 sess_data->iov[1].iov_len = msg->secblob_len;
1595 pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1596
1597 if (pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) {
1598 /* unicode strings must be word aligned */
1599 if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1600 *bcc_ptr = 0;
1601 bcc_ptr++;
1602 }
1603 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1604 unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1605 } else {
1606 ascii_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1607 ascii_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1608 }
1609
1610 sess_data->iov[2].iov_len = (long) bcc_ptr -
1611 (long) sess_data->iov[2].iov_base;
1612
1613 rc = sess_sendreceive(sess_data);
1614 if (rc)
1615 goto out_put_spnego_key;
1616
1617 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1618 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1619
1620 if (smb_buf->WordCount != 4) {
1621 rc = -EIO;
1622 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1623 goto out_put_spnego_key;
1624 }
1625
1626 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1627 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1628
1629 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1630 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1631
1632 bytes_remaining = get_bcc(smb_buf);
1633 bcc_ptr = pByteArea(smb_buf);
1634
1635 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1636 if (blob_len > bytes_remaining) {
1637 cifs_dbg(VFS, "bad security blob length %d\n",
1638 blob_len);
1639 rc = -EINVAL;
1640 goto out_put_spnego_key;
1641 }
1642 bcc_ptr += blob_len;
1643 bytes_remaining -= blob_len;
1644
1645 /* BB check if Unicode and decode strings */
1646 if (bytes_remaining == 0) {
1647 /* no string area to decode, do nothing */
1648 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1649 /* unicode string area must be word-aligned */
1650 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1651 ++bcc_ptr;
1652 --bytes_remaining;
1653 }
1654 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1655 sess_data->nls_cp);
1656 } else {
1657 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1658 sess_data->nls_cp);
1659 }
1660
1661 rc = sess_establish_session(sess_data);
1662 out_put_spnego_key:
1663 key_invalidate(spnego_key);
1664 key_put(spnego_key);
1665 out:
1666 sess_data->result = rc;
1667 sess_data->func = NULL;
1668 sess_free_buffer(sess_data);
1669 kfree_sensitive(ses->auth_key.response);
1670 ses->auth_key.response = NULL;
1671 }
1672
1673 #endif /* ! CONFIG_CIFS_UPCALL */
1674
1675 /*
1676 * The required kvec buffers have to be allocated before calling this
1677 * function.
1678 */
1679 static int
_sess_auth_rawntlmssp_assemble_req(struct sess_data * sess_data)1680 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1681 {
1682 SESSION_SETUP_ANDX *pSMB;
1683 struct cifs_ses *ses = sess_data->ses;
1684 struct TCP_Server_Info *server = sess_data->server;
1685 __u32 capabilities;
1686 char *bcc_ptr;
1687
1688 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1689
1690 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1691 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1692 capabilities |= CAP_EXTENDED_SECURITY;
1693 pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1694
1695 bcc_ptr = sess_data->iov[2].iov_base;
1696
1697 if (pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) {
1698 /* unicode strings must be word aligned */
1699 if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1700 *bcc_ptr = 0;
1701 bcc_ptr++;
1702 }
1703 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1704 } else {
1705 ascii_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1706 }
1707
1708 sess_data->iov[2].iov_len = (long) bcc_ptr -
1709 (long) sess_data->iov[2].iov_base;
1710
1711 return 0;
1712 }
1713
1714 static void
1715 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1716
1717 static void
sess_auth_rawntlmssp_negotiate(struct sess_data * sess_data)1718 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1719 {
1720 int rc;
1721 struct smb_hdr *smb_buf;
1722 SESSION_SETUP_ANDX *pSMB;
1723 struct cifs_ses *ses = sess_data->ses;
1724 struct TCP_Server_Info *server = sess_data->server;
1725 __u16 bytes_remaining;
1726 char *bcc_ptr;
1727 unsigned char *ntlmsspblob = NULL;
1728 u16 blob_len;
1729
1730 cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1731
1732 /*
1733 * if memory allocation is successful, caller of this function
1734 * frees it.
1735 */
1736 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1737 if (!ses->ntlmssp) {
1738 rc = -ENOMEM;
1739 goto out;
1740 }
1741 ses->ntlmssp->sesskey_per_smbsess = false;
1742
1743 /* wct = 12 */
1744 rc = sess_alloc_buffer(sess_data, 12);
1745 if (rc)
1746 goto out;
1747
1748 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1749
1750 /* Build security blob before we assemble the request */
1751 rc = build_ntlmssp_negotiate_blob(&ntlmsspblob,
1752 &blob_len, ses, server,
1753 sess_data->nls_cp);
1754 if (rc)
1755 goto out_free_ntlmsspblob;
1756
1757 sess_data->iov[1].iov_len = blob_len;
1758 sess_data->iov[1].iov_base = ntlmsspblob;
1759 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1760
1761 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1762 if (rc)
1763 goto out_free_ntlmsspblob;
1764
1765 rc = sess_sendreceive(sess_data);
1766
1767 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1768 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1769
1770 /* If true, rc here is expected and not an error */
1771 if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1772 smb_buf->Status.CifsError ==
1773 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1774 rc = 0;
1775
1776 if (rc)
1777 goto out_free_ntlmsspblob;
1778
1779 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1780
1781 if (smb_buf->WordCount != 4) {
1782 rc = -EIO;
1783 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1784 goto out_free_ntlmsspblob;
1785 }
1786
1787 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1788 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1789
1790 bytes_remaining = get_bcc(smb_buf);
1791 bcc_ptr = pByteArea(smb_buf);
1792
1793 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1794 if (blob_len > bytes_remaining) {
1795 cifs_dbg(VFS, "bad security blob length %d\n",
1796 blob_len);
1797 rc = -EINVAL;
1798 goto out_free_ntlmsspblob;
1799 }
1800
1801 rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1802
1803 out_free_ntlmsspblob:
1804 kfree_sensitive(ntlmsspblob);
1805 out:
1806 sess_free_buffer(sess_data);
1807
1808 if (!rc) {
1809 sess_data->func = sess_auth_rawntlmssp_authenticate;
1810 return;
1811 }
1812
1813 /* Else error. Cleanup */
1814 kfree_sensitive(ses->auth_key.response);
1815 ses->auth_key.response = NULL;
1816 kfree_sensitive(ses->ntlmssp);
1817 ses->ntlmssp = NULL;
1818
1819 sess_data->func = NULL;
1820 sess_data->result = rc;
1821 }
1822
1823 static void
sess_auth_rawntlmssp_authenticate(struct sess_data * sess_data)1824 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1825 {
1826 int rc;
1827 struct smb_hdr *smb_buf;
1828 SESSION_SETUP_ANDX *pSMB;
1829 struct cifs_ses *ses = sess_data->ses;
1830 struct TCP_Server_Info *server = sess_data->server;
1831 __u16 bytes_remaining;
1832 char *bcc_ptr;
1833 unsigned char *ntlmsspblob = NULL;
1834 u16 blob_len;
1835
1836 cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1837
1838 /* wct = 12 */
1839 rc = sess_alloc_buffer(sess_data, 12);
1840 if (rc)
1841 goto out;
1842
1843 /* Build security blob before we assemble the request */
1844 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1845 smb_buf = (struct smb_hdr *)pSMB;
1846 rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1847 &blob_len, ses, server,
1848 sess_data->nls_cp);
1849 if (rc)
1850 goto out_free_ntlmsspblob;
1851 sess_data->iov[1].iov_len = blob_len;
1852 sess_data->iov[1].iov_base = ntlmsspblob;
1853 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1854 /*
1855 * Make sure that we tell the server that we are using
1856 * the uid that it just gave us back on the response
1857 * (challenge)
1858 */
1859 smb_buf->Uid = ses->Suid;
1860
1861 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1862 if (rc)
1863 goto out_free_ntlmsspblob;
1864
1865 rc = sess_sendreceive(sess_data);
1866 if (rc)
1867 goto out_free_ntlmsspblob;
1868
1869 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1870 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1871 if (smb_buf->WordCount != 4) {
1872 rc = -EIO;
1873 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1874 goto out_free_ntlmsspblob;
1875 }
1876
1877 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1878 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1879
1880 if (ses->Suid != smb_buf->Uid) {
1881 ses->Suid = smb_buf->Uid;
1882 cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1883 }
1884
1885 bytes_remaining = get_bcc(smb_buf);
1886 bcc_ptr = pByteArea(smb_buf);
1887 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1888 if (blob_len > bytes_remaining) {
1889 cifs_dbg(VFS, "bad security blob length %d\n",
1890 blob_len);
1891 rc = -EINVAL;
1892 goto out_free_ntlmsspblob;
1893 }
1894 bcc_ptr += blob_len;
1895 bytes_remaining -= blob_len;
1896
1897
1898 /* BB check if Unicode and decode strings */
1899 if (bytes_remaining == 0) {
1900 /* no string area to decode, do nothing */
1901 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1902 /* unicode string area must be word-aligned */
1903 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1904 ++bcc_ptr;
1905 --bytes_remaining;
1906 }
1907 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1908 sess_data->nls_cp);
1909 } else {
1910 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1911 sess_data->nls_cp);
1912 }
1913
1914 out_free_ntlmsspblob:
1915 kfree_sensitive(ntlmsspblob);
1916 out:
1917 sess_free_buffer(sess_data);
1918
1919 if (!rc)
1920 rc = sess_establish_session(sess_data);
1921
1922 /* Cleanup */
1923 kfree_sensitive(ses->auth_key.response);
1924 ses->auth_key.response = NULL;
1925 kfree_sensitive(ses->ntlmssp);
1926 ses->ntlmssp = NULL;
1927
1928 sess_data->func = NULL;
1929 sess_data->result = rc;
1930 }
1931
select_sec(struct sess_data * sess_data)1932 static int select_sec(struct sess_data *sess_data)
1933 {
1934 int type;
1935 struct cifs_ses *ses = sess_data->ses;
1936 struct TCP_Server_Info *server = sess_data->server;
1937
1938 type = cifs_select_sectype(server, ses->sectype);
1939 cifs_dbg(FYI, "sess setup type %d\n", type);
1940 if (type == Unspecified) {
1941 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1942 return -EINVAL;
1943 }
1944
1945 switch (type) {
1946 case NTLMv2:
1947 sess_data->func = sess_auth_ntlmv2;
1948 break;
1949 case Kerberos:
1950 #ifdef CONFIG_CIFS_UPCALL
1951 sess_data->func = sess_auth_kerberos;
1952 break;
1953 #else
1954 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1955 return -ENOSYS;
1956 #endif /* CONFIG_CIFS_UPCALL */
1957 case RawNTLMSSP:
1958 sess_data->func = sess_auth_rawntlmssp_negotiate;
1959 break;
1960 default:
1961 cifs_dbg(VFS, "secType %d not supported!\n", type);
1962 return -ENOSYS;
1963 }
1964
1965 return 0;
1966 }
1967
CIFS_SessSetup(const unsigned int xid,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1968 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
1969 struct TCP_Server_Info *server,
1970 const struct nls_table *nls_cp)
1971 {
1972 int rc = 0;
1973 struct sess_data *sess_data;
1974
1975 if (ses == NULL) {
1976 WARN(1, "%s: ses == NULL!", __func__);
1977 return -EINVAL;
1978 }
1979
1980 sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
1981 if (!sess_data)
1982 return -ENOMEM;
1983
1984 sess_data->xid = xid;
1985 sess_data->ses = ses;
1986 sess_data->server = server;
1987 sess_data->buf0_type = CIFS_NO_BUFFER;
1988 sess_data->nls_cp = (struct nls_table *) nls_cp;
1989
1990 rc = select_sec(sess_data);
1991 if (rc)
1992 goto out;
1993
1994 while (sess_data->func)
1995 sess_data->func(sess_data);
1996
1997 /* Store result before we free sess_data */
1998 rc = sess_data->result;
1999
2000 out:
2001 kfree_sensitive(sess_data);
2002 return rc;
2003 }
2004 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
2005