1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3 *
4 * SMB/CIFS session setup handling routines
5 *
6 * Copyright (c) International Business Machines Corp., 2006, 2009
7 * Author(s): Steve French (sfrench@us.ibm.com)
8 *
9 */
10
11 #include "cifspdu.h"
12 #include "cifsglob.h"
13 #include "cifsproto.h"
14 #include "cifs_unicode.h"
15 #include "cifs_debug.h"
16 #include "ntlmssp.h"
17 #include "nterr.h"
18 #include <linux/utsname.h>
19 #include <linux/slab.h>
20 #include <linux/version.h>
21 #include "cifsfs.h"
22 #include "cifs_spnego.h"
23 #include "smb2proto.h"
24 #include "fs_context.h"
25
26 static int
27 cifs_ses_add_channel(struct cifs_ses *ses,
28 struct cifs_server_iface *iface);
29
is_ses_using_iface(struct cifs_ses * ses,struct cifs_server_iface * iface)30 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
31 {
32 int i;
33
34 spin_lock(&ses->chan_lock);
35 for (i = 0; i < ses->chan_count; i++) {
36 if (ses->chans[i].iface == iface) {
37 spin_unlock(&ses->chan_lock);
38 return true;
39 }
40 }
41 spin_unlock(&ses->chan_lock);
42 return false;
43 }
44
45 /* channel helper functions. assumed that chan_lock is held by caller. */
46
47 int
cifs_ses_get_chan_index(struct cifs_ses * ses,struct TCP_Server_Info * server)48 cifs_ses_get_chan_index(struct cifs_ses *ses,
49 struct TCP_Server_Info *server)
50 {
51 unsigned int i;
52
53 /* if the channel is waiting for termination */
54 if (server && server->terminate)
55 return CIFS_INVAL_CHAN_INDEX;
56
57 for (i = 0; i < ses->chan_count; i++) {
58 if (ses->chans[i].server == server)
59 return i;
60 }
61
62 /* If we didn't find the channel, it is likely a bug */
63 if (server)
64 cifs_dbg(VFS, "unable to get chan index for server: 0x%llx",
65 server->conn_id);
66 return CIFS_INVAL_CHAN_INDEX;
67 }
68
69 void
cifs_chan_set_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)70 cifs_chan_set_in_reconnect(struct cifs_ses *ses,
71 struct TCP_Server_Info *server)
72 {
73 int chan_index = cifs_ses_get_chan_index(ses, server);
74
75 if (chan_index == CIFS_INVAL_CHAN_INDEX)
76 return;
77
78 ses->chans[chan_index].in_reconnect = true;
79 }
80
81 void
cifs_chan_clear_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)82 cifs_chan_clear_in_reconnect(struct cifs_ses *ses,
83 struct TCP_Server_Info *server)
84 {
85 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
86
87 if (chan_index == CIFS_INVAL_CHAN_INDEX)
88 return;
89
90 ses->chans[chan_index].in_reconnect = false;
91 }
92
93 void
cifs_chan_set_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)94 cifs_chan_set_need_reconnect(struct cifs_ses *ses,
95 struct TCP_Server_Info *server)
96 {
97 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
98
99 if (chan_index == CIFS_INVAL_CHAN_INDEX)
100 return;
101
102 set_bit(chan_index, &ses->chans_need_reconnect);
103 cifs_dbg(FYI, "Set reconnect bitmask for chan %u; now 0x%lx\n",
104 chan_index, ses->chans_need_reconnect);
105 }
106
107 void
cifs_chan_clear_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)108 cifs_chan_clear_need_reconnect(struct cifs_ses *ses,
109 struct TCP_Server_Info *server)
110 {
111 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
112
113 if (chan_index == CIFS_INVAL_CHAN_INDEX)
114 return;
115
116 clear_bit(chan_index, &ses->chans_need_reconnect);
117 cifs_dbg(FYI, "Cleared reconnect bitmask for chan %u; now 0x%lx\n",
118 chan_index, ses->chans_need_reconnect);
119 }
120
121 bool
cifs_chan_needs_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)122 cifs_chan_needs_reconnect(struct cifs_ses *ses,
123 struct TCP_Server_Info *server)
124 {
125 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
126
127 if (chan_index == CIFS_INVAL_CHAN_INDEX)
128 return true; /* err on the safer side */
129
130 return CIFS_CHAN_NEEDS_RECONNECT(ses, chan_index);
131 }
132
133 bool
cifs_chan_is_iface_active(struct cifs_ses * ses,struct TCP_Server_Info * server)134 cifs_chan_is_iface_active(struct cifs_ses *ses,
135 struct TCP_Server_Info *server)
136 {
137 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
138
139 if (chan_index == CIFS_INVAL_CHAN_INDEX)
140 return true; /* err on the safer side */
141
142 return ses->chans[chan_index].iface &&
143 ses->chans[chan_index].iface->is_active;
144 }
145
146 /* returns number of channels added */
cifs_try_adding_channels(struct cifs_ses * ses)147 int cifs_try_adding_channels(struct cifs_ses *ses)
148 {
149 struct TCP_Server_Info *server = ses->server;
150 int old_chan_count, new_chan_count;
151 int left;
152 int rc = 0;
153 int tries = 0;
154 size_t iface_weight = 0, iface_min_speed = 0;
155 struct cifs_server_iface *iface = NULL, *niface = NULL;
156 struct cifs_server_iface *last_iface = NULL;
157
158 spin_lock(&ses->chan_lock);
159
160 new_chan_count = old_chan_count = ses->chan_count;
161 left = ses->chan_max - ses->chan_count;
162
163 if (left <= 0) {
164 spin_unlock(&ses->chan_lock);
165 cifs_dbg(FYI,
166 "ses already at max_channels (%zu), nothing to open\n",
167 ses->chan_max);
168 return 0;
169 }
170
171 if (server->dialect < SMB30_PROT_ID) {
172 spin_unlock(&ses->chan_lock);
173 cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
174 return 0;
175 }
176
177 if (!(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
178 spin_unlock(&ses->chan_lock);
179 cifs_server_dbg(VFS, "no multichannel support\n");
180 return 0;
181 }
182 spin_unlock(&ses->chan_lock);
183
184 while (left > 0) {
185
186 tries++;
187 if (tries > 3*ses->chan_max) {
188 cifs_dbg(VFS, "too many channel open attempts (%d channels left to open)\n",
189 left);
190 break;
191 }
192
193 spin_lock(&ses->iface_lock);
194 if (!ses->iface_count) {
195 spin_unlock(&ses->iface_lock);
196 cifs_dbg(ONCE, "server %s does not advertise interfaces\n",
197 ses->server->hostname);
198 break;
199 }
200
201 if (!iface)
202 iface = list_first_entry(&ses->iface_list, struct cifs_server_iface,
203 iface_head);
204 last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
205 iface_head);
206 iface_min_speed = last_iface->speed;
207
208 list_for_each_entry_safe_from(iface, niface, &ses->iface_list,
209 iface_head) {
210 /* do not mix rdma and non-rdma interfaces */
211 if (iface->rdma_capable != ses->server->rdma)
212 continue;
213
214 /* skip ifaces that are unusable */
215 if (!iface->is_active ||
216 (is_ses_using_iface(ses, iface) &&
217 !iface->rss_capable))
218 continue;
219
220 /* check if we already allocated enough channels */
221 iface_weight = iface->speed / iface_min_speed;
222
223 if (iface->weight_fulfilled >= iface_weight)
224 continue;
225
226 /* take ref before unlock */
227 kref_get(&iface->refcount);
228
229 spin_unlock(&ses->iface_lock);
230 rc = cifs_ses_add_channel(ses, iface);
231 spin_lock(&ses->iface_lock);
232
233 if (rc) {
234 cifs_dbg(VFS, "failed to open extra channel on iface:%pIS rc=%d\n",
235 &iface->sockaddr,
236 rc);
237 kref_put(&iface->refcount, release_iface);
238 /* failure to add chan should increase weight */
239 iface->weight_fulfilled++;
240 continue;
241 }
242
243 iface->num_channels++;
244 iface->weight_fulfilled++;
245 cifs_info("successfully opened new channel on iface:%pIS\n",
246 &iface->sockaddr);
247 break;
248 }
249
250 /* reached end of list. reset weight_fulfilled and start over */
251 if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
252 list_for_each_entry(iface, &ses->iface_list, iface_head)
253 iface->weight_fulfilled = 0;
254 spin_unlock(&ses->iface_lock);
255 iface = NULL;
256 continue;
257 }
258 spin_unlock(&ses->iface_lock);
259
260 left--;
261 new_chan_count++;
262 }
263
264 return new_chan_count - old_chan_count;
265 }
266
267 /*
268 * called when multichannel is disabled by the server.
269 * this always gets called from smb2_reconnect
270 * and cannot get called in parallel threads.
271 */
272 void
cifs_disable_secondary_channels(struct cifs_ses * ses)273 cifs_disable_secondary_channels(struct cifs_ses *ses)
274 {
275 int i, chan_count;
276 struct TCP_Server_Info *server;
277 struct cifs_server_iface *iface;
278
279 spin_lock(&ses->chan_lock);
280 chan_count = ses->chan_count;
281 if (chan_count == 1)
282 goto done;
283
284 ses->chan_count = 1;
285
286 /* for all secondary channels reset the need reconnect bit */
287 ses->chans_need_reconnect &= 1;
288
289 for (i = 1; i < chan_count; i++) {
290 iface = ses->chans[i].iface;
291 server = ses->chans[i].server;
292
293 /*
294 * remove these references first, since we need to unlock
295 * the chan_lock here, since iface_lock is a higher lock
296 */
297 ses->chans[i].iface = NULL;
298 ses->chans[i].server = NULL;
299 spin_unlock(&ses->chan_lock);
300
301 if (iface) {
302 spin_lock(&ses->iface_lock);
303 iface->num_channels--;
304 if (iface->weight_fulfilled)
305 iface->weight_fulfilled--;
306 kref_put(&iface->refcount, release_iface);
307 spin_unlock(&ses->iface_lock);
308 }
309
310 if (server) {
311 if (!server->terminate) {
312 server->terminate = true;
313 cifs_signal_cifsd_for_reconnect(server, false);
314 }
315 cifs_put_tcp_session(server, false);
316 }
317
318 spin_lock(&ses->chan_lock);
319 }
320
321 done:
322 spin_unlock(&ses->chan_lock);
323 }
324
325 /* update the iface for the channel if necessary. */
326 void
cifs_chan_update_iface(struct cifs_ses * ses,struct TCP_Server_Info * server)327 cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server)
328 {
329 unsigned int chan_index;
330 size_t iface_weight = 0, iface_min_speed = 0;
331 struct cifs_server_iface *iface = NULL;
332 struct cifs_server_iface *old_iface = NULL;
333 struct cifs_server_iface *last_iface = NULL;
334 struct sockaddr_storage ss;
335 int retry = 0;
336
337 spin_lock(&ses->chan_lock);
338 chan_index = cifs_ses_get_chan_index(ses, server);
339 if (chan_index == CIFS_INVAL_CHAN_INDEX) {
340 spin_unlock(&ses->chan_lock);
341 return;
342 }
343
344 if (ses->chans[chan_index].iface) {
345 old_iface = ses->chans[chan_index].iface;
346 if (old_iface->is_active) {
347 spin_unlock(&ses->chan_lock);
348 return;
349 }
350 }
351 spin_unlock(&ses->chan_lock);
352
353 spin_lock(&server->srv_lock);
354 ss = server->dstaddr;
355 spin_unlock(&server->srv_lock);
356
357 spin_lock(&ses->iface_lock);
358 if (!ses->iface_count) {
359 spin_unlock(&ses->iface_lock);
360 cifs_dbg(ONCE, "server %s does not advertise interfaces\n", ses->server->hostname);
361 return;
362 }
363
364 try_again:
365 last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
366 iface_head);
367 iface_min_speed = last_iface->speed;
368
369 /* then look for a new one */
370 list_for_each_entry(iface, &ses->iface_list, iface_head) {
371 if (!chan_index) {
372 /* if we're trying to get the updated iface for primary channel */
373 if (!cifs_match_ipaddr((struct sockaddr *) &ss,
374 (struct sockaddr *) &iface->sockaddr))
375 continue;
376
377 kref_get(&iface->refcount);
378 break;
379 }
380
381 /* do not mix rdma and non-rdma interfaces */
382 if (iface->rdma_capable != server->rdma)
383 continue;
384
385 if (!iface->is_active ||
386 (is_ses_using_iface(ses, iface) &&
387 !iface->rss_capable)) {
388 continue;
389 }
390
391 /* check if we already allocated enough channels */
392 iface_weight = iface->speed / iface_min_speed;
393
394 if (iface->weight_fulfilled >= iface_weight)
395 continue;
396
397 kref_get(&iface->refcount);
398 break;
399 }
400
401 if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
402 list_for_each_entry(iface, &ses->iface_list, iface_head)
403 iface->weight_fulfilled = 0;
404
405 /* see if it can be satisfied in second attempt */
406 if (!retry++)
407 goto try_again;
408
409 iface = NULL;
410 cifs_dbg(FYI, "unable to find a suitable iface\n");
411 }
412
413 if (!iface) {
414 if (!chan_index)
415 cifs_dbg(FYI, "unable to get the interface matching: %pIS\n",
416 &ss);
417 else {
418 cifs_dbg(FYI, "unable to find another interface to replace: %pIS\n",
419 &old_iface->sockaddr);
420 }
421
422 spin_unlock(&ses->iface_lock);
423 return;
424 }
425
426 /* now drop the ref to the current iface */
427 if (old_iface) {
428 cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n",
429 &old_iface->sockaddr,
430 &iface->sockaddr);
431
432 old_iface->num_channels--;
433 if (old_iface->weight_fulfilled)
434 old_iface->weight_fulfilled--;
435 iface->num_channels++;
436 iface->weight_fulfilled++;
437
438 kref_put(&old_iface->refcount, release_iface);
439 } else if (!chan_index) {
440 /* special case: update interface for primary channel */
441 cifs_dbg(FYI, "referencing primary channel iface: %pIS\n",
442 &iface->sockaddr);
443 iface->num_channels++;
444 iface->weight_fulfilled++;
445 }
446 spin_unlock(&ses->iface_lock);
447
448 spin_lock(&ses->chan_lock);
449 chan_index = cifs_ses_get_chan_index(ses, server);
450 if (chan_index == CIFS_INVAL_CHAN_INDEX) {
451 spin_unlock(&ses->chan_lock);
452 return;
453 }
454
455 ses->chans[chan_index].iface = iface;
456 spin_unlock(&ses->chan_lock);
457
458 spin_lock(&server->srv_lock);
459 memcpy(&server->dstaddr, &iface->sockaddr, sizeof(server->dstaddr));
460 spin_unlock(&server->srv_lock);
461 }
462
463 static int
cifs_ses_add_channel(struct cifs_ses * ses,struct cifs_server_iface * iface)464 cifs_ses_add_channel(struct cifs_ses *ses,
465 struct cifs_server_iface *iface)
466 {
467 struct TCP_Server_Info *chan_server;
468 struct cifs_chan *chan;
469 struct smb3_fs_context *ctx;
470 static const char unc_fmt[] = "\\%s\\foo";
471 struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
472 struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
473 size_t len;
474 int rc;
475 unsigned int xid = get_xid();
476
477 if (iface->sockaddr.ss_family == AF_INET)
478 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
479 ses, iface->speed, str_yes_no(iface->rdma_capable),
480 &ipv4->sin_addr);
481 else
482 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI6)\n",
483 ses, iface->speed, str_yes_no(iface->rdma_capable),
484 &ipv6->sin6_addr);
485
486 /*
487 * Setup a ctx with mostly the same info as the existing
488 * session and overwrite it with the requested iface data.
489 *
490 * We need to setup at least the fields used for negprot and
491 * sesssetup.
492 *
493 * We only need the ctx here, so we can reuse memory from
494 * the session and server without caring about memory
495 * management.
496 */
497 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
498 if (!ctx) {
499 rc = -ENOMEM;
500 goto out_free_xid;
501 }
502
503 /* Always make new connection for now (TODO?) */
504 ctx->nosharesock = true;
505
506 /* Auth */
507 ctx->domainauto = ses->domainAuto;
508 ctx->domainname = ses->domainName;
509
510 ctx->server_hostname = ses->server->hostname;
511
512 ctx->username = ses->user_name;
513 ctx->password = ses->password;
514 ctx->sectype = ses->sectype;
515 ctx->sign = ses->sign;
516 ctx->unicode = ses->unicode;
517
518 /* UNC and paths */
519 /* XXX: Use ses->server->hostname? */
520 len = sizeof(unc_fmt) + SERVER_NAME_LEN_WITH_NULL;
521 ctx->UNC = kzalloc(len, GFP_KERNEL);
522 if (!ctx->UNC) {
523 rc = -ENOMEM;
524 goto out_free_ctx;
525 }
526 scnprintf(ctx->UNC, len, unc_fmt, ses->ip_addr);
527 ctx->prepath = "";
528
529 /* Reuse same version as master connection */
530 ctx->vals = ses->server->vals;
531 ctx->ops = ses->server->ops;
532
533 ctx->noblocksnd = ses->server->noblocksnd;
534 ctx->noautotune = ses->server->noautotune;
535 ctx->sockopt_tcp_nodelay = ses->server->tcp_nodelay;
536 ctx->echo_interval = ses->server->echo_interval / HZ;
537 ctx->max_credits = ses->server->max_credits;
538 ctx->min_offload = ses->server->min_offload;
539 ctx->compress = ses->server->compression.requested;
540 ctx->dfs_conn = ses->server->dfs_conn;
541 ctx->ignore_signature = ses->server->ignore_signature;
542 ctx->leaf_fullpath = ses->server->leaf_fullpath;
543 ctx->rootfs = ses->server->noblockcnt;
544 ctx->retrans = ses->server->retrans;
545
546 /*
547 * This will be used for encoding/decoding user/domain/pw
548 * during sess setup auth.
549 */
550 ctx->local_nls = ses->local_nls;
551
552 /* Use RDMA if possible */
553 ctx->rdma = iface->rdma_capable;
554 memcpy(&ctx->dstaddr, &iface->sockaddr, sizeof(ctx->dstaddr));
555
556 /* reuse master con client guid */
557 memcpy(&ctx->client_guid, ses->server->client_guid,
558 sizeof(ctx->client_guid));
559 ctx->use_client_guid = true;
560
561 chan_server = cifs_get_tcp_session(ctx, ses->server);
562
563 spin_lock(&ses->chan_lock);
564 chan = &ses->chans[ses->chan_count];
565 chan->server = chan_server;
566 if (IS_ERR(chan->server)) {
567 rc = PTR_ERR(chan->server);
568 chan->server = NULL;
569 spin_unlock(&ses->chan_lock);
570 goto out;
571 }
572 chan->iface = iface;
573 ses->chan_count++;
574 atomic_set(&ses->chan_seq, 0);
575
576 /* Mark this channel as needing connect/setup */
577 cifs_chan_set_need_reconnect(ses, chan->server);
578
579 spin_unlock(&ses->chan_lock);
580
581 mutex_lock(&ses->session_mutex);
582 /*
583 * We need to allocate the server crypto now as we will need
584 * to sign packets before we generate the channel signing key
585 * (we sign with the session key)
586 */
587 rc = smb311_crypto_shash_allocate(chan->server);
588 if (rc) {
589 cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
590 mutex_unlock(&ses->session_mutex);
591 goto out;
592 }
593
594 rc = cifs_negotiate_protocol(xid, ses, chan->server);
595 if (!rc)
596 rc = cifs_setup_session(xid, ses, chan->server, ses->local_nls);
597
598 mutex_unlock(&ses->session_mutex);
599
600 out:
601 if (rc && chan->server) {
602 cifs_put_tcp_session(chan->server, 0);
603
604 spin_lock(&ses->chan_lock);
605
606 /* we rely on all bits beyond chan_count to be clear */
607 cifs_chan_clear_need_reconnect(ses, chan->server);
608 ses->chan_count--;
609 /*
610 * chan_count should never reach 0 as at least the primary
611 * channel is always allocated
612 */
613 WARN_ON(ses->chan_count < 1);
614 spin_unlock(&ses->chan_lock);
615 }
616
617 kfree(ctx->UNC);
618 out_free_ctx:
619 kfree(ctx);
620 out_free_xid:
621 free_xid(xid);
622 return rc;
623 }
624
625 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
cifs_ssetup_hdr(struct cifs_ses * ses,struct TCP_Server_Info * server,SESSION_SETUP_ANDX * pSMB)626 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses,
627 struct TCP_Server_Info *server,
628 SESSION_SETUP_ANDX *pSMB)
629 {
630 __u32 capabilities = 0;
631
632 /* init fields common to all four types of SessSetup */
633 /* Note that offsets for first seven fields in req struct are same */
634 /* in CIFS Specs so does not matter which of 3 forms of struct */
635 /* that we use in next few lines */
636 /* Note that header is initialized to zero in header_assemble */
637 pSMB->req.AndXCommand = 0xFF;
638 pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
639 CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
640 USHRT_MAX));
641 pSMB->req.MaxMpxCount = cpu_to_le16(server->maxReq);
642 pSMB->req.VcNumber = cpu_to_le16(1);
643 pSMB->req.SessionKey = server->session_key_id;
644
645 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
646
647 /* BB verify whether signing required on neg or just auth frame (and NTLM case) */
648
649 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
650 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
651
652 if (server->sign)
653 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
654
655 if (ses->capabilities & CAP_UNICODE) {
656 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
657 capabilities |= CAP_UNICODE;
658 }
659 if (ses->capabilities & CAP_STATUS32) {
660 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
661 capabilities |= CAP_STATUS32;
662 }
663 if (ses->capabilities & CAP_DFS) {
664 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
665 capabilities |= CAP_DFS;
666 }
667 if (ses->capabilities & CAP_UNIX)
668 capabilities |= CAP_UNIX;
669
670 return capabilities;
671 }
672
673 static void
unicode_oslm_strings(char ** pbcc_area,const struct nls_table * nls_cp)674 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
675 {
676 char *bcc_ptr = *pbcc_area;
677 int bytes_ret = 0;
678
679 /* Copy OS version */
680 bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
681 nls_cp);
682 bcc_ptr += 2 * bytes_ret;
683 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
684 32, nls_cp);
685 bcc_ptr += 2 * bytes_ret;
686 bcc_ptr += 2; /* trailing null */
687
688 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
689 32, nls_cp);
690 bcc_ptr += 2 * bytes_ret;
691 bcc_ptr += 2; /* trailing null */
692
693 *pbcc_area = bcc_ptr;
694 }
695
696 static void
ascii_oslm_strings(char ** pbcc_area,const struct nls_table * nls_cp)697 ascii_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
698 {
699 char *bcc_ptr = *pbcc_area;
700
701 strcpy(bcc_ptr, "Linux version ");
702 bcc_ptr += strlen("Linux version ");
703 strcpy(bcc_ptr, init_utsname()->release);
704 bcc_ptr += strlen(init_utsname()->release) + 1;
705
706 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
707 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
708
709 *pbcc_area = bcc_ptr;
710 }
711
unicode_domain_string(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)712 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
713 const struct nls_table *nls_cp)
714 {
715 char *bcc_ptr = *pbcc_area;
716 int bytes_ret = 0;
717
718 /* copy domain */
719 if (ses->domainName == NULL) {
720 /*
721 * Sending null domain better than using a bogus domain name (as
722 * we did briefly in 2.6.18) since server will use its default
723 */
724 *bcc_ptr = 0;
725 *(bcc_ptr+1) = 0;
726 bytes_ret = 0;
727 } else
728 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
729 CIFS_MAX_DOMAINNAME_LEN, nls_cp);
730 bcc_ptr += 2 * bytes_ret;
731 bcc_ptr += 2; /* account for null terminator */
732
733 *pbcc_area = bcc_ptr;
734 }
735
ascii_domain_string(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)736 static void ascii_domain_string(char **pbcc_area, struct cifs_ses *ses,
737 const struct nls_table *nls_cp)
738 {
739 char *bcc_ptr = *pbcc_area;
740 int len;
741
742 /* copy domain */
743 if (ses->domainName != NULL) {
744 len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
745 if (WARN_ON_ONCE(len < 0))
746 len = CIFS_MAX_DOMAINNAME_LEN - 1;
747 bcc_ptr += len;
748 } /* else we send a null domain name so server will default to its own domain */
749 *bcc_ptr = 0;
750 bcc_ptr++;
751
752 *pbcc_area = bcc_ptr;
753 }
754
unicode_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)755 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
756 const struct nls_table *nls_cp)
757 {
758 char *bcc_ptr = *pbcc_area;
759 int bytes_ret = 0;
760
761 /* BB FIXME add check that strings less than 335 or will need to send as arrays */
762
763 /* copy user */
764 if (ses->user_name == NULL) {
765 /* null user mount */
766 *bcc_ptr = 0;
767 *(bcc_ptr+1) = 0;
768 } else {
769 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
770 CIFS_MAX_USERNAME_LEN, nls_cp);
771 }
772 bcc_ptr += 2 * bytes_ret;
773 bcc_ptr += 2; /* account for null termination */
774
775 unicode_domain_string(&bcc_ptr, ses, nls_cp);
776 unicode_oslm_strings(&bcc_ptr, nls_cp);
777
778 *pbcc_area = bcc_ptr;
779 }
780
ascii_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)781 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
782 const struct nls_table *nls_cp)
783 {
784 char *bcc_ptr = *pbcc_area;
785 int len;
786
787 /* copy user */
788 /* BB what about null user mounts - check that we do this BB */
789 /* copy user */
790 if (ses->user_name != NULL) {
791 len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
792 if (WARN_ON_ONCE(len < 0))
793 len = CIFS_MAX_USERNAME_LEN - 1;
794 bcc_ptr += len;
795 }
796 /* else null user mount */
797 *bcc_ptr = 0;
798 bcc_ptr++; /* account for null termination */
799
800 /* BB check for overflow here */
801
802 ascii_domain_string(&bcc_ptr, ses, nls_cp);
803 ascii_oslm_strings(&bcc_ptr, nls_cp);
804
805 *pbcc_area = bcc_ptr;
806 }
807
808 static void
decode_unicode_ssetup(char ** pbcc_area,int bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)809 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
810 const struct nls_table *nls_cp)
811 {
812 int len;
813 char *data = *pbcc_area;
814
815 cifs_dbg(FYI, "bleft %d\n", bleft);
816
817 kfree(ses->serverOS);
818 ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
819 cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
820 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
821 data += len;
822 bleft -= len;
823 if (bleft <= 0)
824 return;
825
826 kfree(ses->serverNOS);
827 ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
828 cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
829 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
830 data += len;
831 bleft -= len;
832 if (bleft <= 0)
833 return;
834
835 kfree(ses->serverDomain);
836 ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
837 cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
838
839 return;
840 }
841
decode_ascii_ssetup(char ** pbcc_area,__u16 bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)842 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
843 struct cifs_ses *ses,
844 const struct nls_table *nls_cp)
845 {
846 int len;
847 char *bcc_ptr = *pbcc_area;
848
849 cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
850
851 len = strnlen(bcc_ptr, bleft);
852 if (len >= bleft)
853 return;
854
855 kfree(ses->serverOS);
856
857 ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
858 if (ses->serverOS) {
859 memcpy(ses->serverOS, bcc_ptr, len);
860 ses->serverOS[len] = 0;
861 if (strncmp(ses->serverOS, "OS/2", 4) == 0)
862 cifs_dbg(FYI, "OS/2 server\n");
863 }
864
865 bcc_ptr += len + 1;
866 bleft -= len + 1;
867
868 len = strnlen(bcc_ptr, bleft);
869 if (len >= bleft)
870 return;
871
872 kfree(ses->serverNOS);
873
874 ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
875 if (ses->serverNOS) {
876 memcpy(ses->serverNOS, bcc_ptr, len);
877 ses->serverNOS[len] = 0;
878 }
879
880 bcc_ptr += len + 1;
881 bleft -= len + 1;
882
883 len = strnlen(bcc_ptr, bleft);
884 if (len > bleft)
885 return;
886
887 /*
888 * No domain field in LANMAN case. Domain is
889 * returned by old servers in the SMB negprot response
890 *
891 * BB For newer servers which do not support Unicode,
892 * but thus do return domain here, we could add parsing
893 * for it later, but it is not very important
894 */
895 cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
896 }
897 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
898
decode_ntlmssp_challenge(char * bcc_ptr,int blob_len,struct cifs_ses * ses)899 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
900 struct cifs_ses *ses)
901 {
902 unsigned int tioffset; /* challenge message target info area */
903 unsigned int tilen; /* challenge message target info area length */
904 CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
905 __u32 server_flags;
906
907 if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
908 cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
909 return -EINVAL;
910 }
911
912 if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
913 cifs_dbg(VFS, "blob signature incorrect %s\n",
914 pblob->Signature);
915 return -EINVAL;
916 }
917 if (pblob->MessageType != NtLmChallenge) {
918 cifs_dbg(VFS, "Incorrect message type %d\n",
919 pblob->MessageType);
920 return -EINVAL;
921 }
922
923 server_flags = le32_to_cpu(pblob->NegotiateFlags);
924 cifs_dbg(FYI, "%s: negotiate=0x%08x challenge=0x%08x\n", __func__,
925 ses->ntlmssp->client_flags, server_flags);
926
927 if ((ses->ntlmssp->client_flags & (NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN)) &&
928 (!(server_flags & NTLMSSP_NEGOTIATE_56) && !(server_flags & NTLMSSP_NEGOTIATE_128))) {
929 cifs_dbg(VFS, "%s: requested signing/encryption but server did not return either 56-bit or 128-bit session key size\n",
930 __func__);
931 return -EINVAL;
932 }
933 if (!(server_flags & NTLMSSP_NEGOTIATE_NTLM) && !(server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) {
934 cifs_dbg(VFS, "%s: server does not seem to support either NTLMv1 or NTLMv2\n", __func__);
935 return -EINVAL;
936 }
937 if (ses->server->sign && !(server_flags & NTLMSSP_NEGOTIATE_SIGN)) {
938 cifs_dbg(VFS, "%s: forced packet signing but server does not seem to support it\n",
939 __func__);
940 return -EOPNOTSUPP;
941 }
942 if ((ses->ntlmssp->client_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
943 !(server_flags & NTLMSSP_NEGOTIATE_KEY_XCH))
944 pr_warn_once("%s: authentication has been weakened as server does not support key exchange\n",
945 __func__);
946
947 ses->ntlmssp->server_flags = server_flags;
948
949 memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
950 /*
951 * In particular we can examine sign flags
952 *
953 * BB spec says that if AvId field of MsvAvTimestamp is populated then
954 * we must set the MIC field of the AUTHENTICATE_MESSAGE
955 */
956
957 tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
958 tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
959 if (tioffset > blob_len || tioffset + tilen > blob_len) {
960 cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
961 tioffset, tilen);
962 return -EINVAL;
963 }
964 if (tilen) {
965 kfree_sensitive(ses->auth_key.response);
966 ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
967 GFP_KERNEL);
968 if (!ses->auth_key.response) {
969 cifs_dbg(VFS, "Challenge target info alloc failure\n");
970 return -ENOMEM;
971 }
972 ses->auth_key.len = tilen;
973 }
974
975 return 0;
976 }
977
size_of_ntlmssp_blob(struct cifs_ses * ses,int base_size)978 static int size_of_ntlmssp_blob(struct cifs_ses *ses, int base_size)
979 {
980 int sz = base_size + ses->auth_key.len
981 - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
982
983 if (ses->domainName)
984 sz += sizeof(__le16) * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
985 else
986 sz += sizeof(__le16);
987
988 if (ses->user_name)
989 sz += sizeof(__le16) * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
990 else
991 sz += sizeof(__le16);
992
993 if (ses->workstation_name[0])
994 sz += sizeof(__le16) * strnlen(ses->workstation_name,
995 ntlmssp_workstation_name_size(ses));
996 else
997 sz += sizeof(__le16);
998
999 return sz;
1000 }
1001
cifs_security_buffer_from_str(SECURITY_BUFFER * pbuf,char * str_value,int str_length,unsigned char * pstart,unsigned char ** pcur,const struct nls_table * nls_cp)1002 static inline void cifs_security_buffer_from_str(SECURITY_BUFFER *pbuf,
1003 char *str_value,
1004 int str_length,
1005 unsigned char *pstart,
1006 unsigned char **pcur,
1007 const struct nls_table *nls_cp)
1008 {
1009 unsigned char *tmp = pstart;
1010 int len;
1011
1012 if (!pbuf)
1013 return;
1014
1015 if (!pcur)
1016 pcur = &tmp;
1017
1018 if (!str_value) {
1019 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
1020 pbuf->Length = 0;
1021 pbuf->MaximumLength = 0;
1022 *pcur += sizeof(__le16);
1023 } else {
1024 len = cifs_strtoUTF16((__le16 *)*pcur,
1025 str_value,
1026 str_length,
1027 nls_cp);
1028 len *= sizeof(__le16);
1029 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
1030 pbuf->Length = cpu_to_le16(len);
1031 pbuf->MaximumLength = cpu_to_le16(len);
1032 *pcur += len;
1033 }
1034 }
1035
1036 /* BB Move to ntlmssp.c eventually */
1037
build_ntlmssp_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1038 int build_ntlmssp_negotiate_blob(unsigned char **pbuffer,
1039 u16 *buflen,
1040 struct cifs_ses *ses,
1041 struct TCP_Server_Info *server,
1042 const struct nls_table *nls_cp)
1043 {
1044 int rc = 0;
1045 NEGOTIATE_MESSAGE *sec_blob;
1046 __u32 flags;
1047 unsigned char *tmp;
1048 int len;
1049
1050 len = size_of_ntlmssp_blob(ses, sizeof(NEGOTIATE_MESSAGE));
1051 *pbuffer = kmalloc(len, GFP_KERNEL);
1052 if (!*pbuffer) {
1053 rc = -ENOMEM;
1054 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1055 *buflen = 0;
1056 goto setup_ntlm_neg_ret;
1057 }
1058 sec_blob = (NEGOTIATE_MESSAGE *)*pbuffer;
1059
1060 memset(*pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
1061 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1062 sec_blob->MessageType = NtLmNegotiate;
1063
1064 /* BB is NTLMV2 session security format easier to use here? */
1065 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
1066 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1067 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1068 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1069 NTLMSSP_NEGOTIATE_SIGN;
1070 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1071 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1072
1073 tmp = *pbuffer + sizeof(NEGOTIATE_MESSAGE);
1074 ses->ntlmssp->client_flags = flags;
1075 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1076
1077 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1078 cifs_security_buffer_from_str(&sec_blob->DomainName,
1079 NULL,
1080 CIFS_MAX_DOMAINNAME_LEN,
1081 *pbuffer, &tmp,
1082 nls_cp);
1083
1084 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1085 NULL,
1086 CIFS_MAX_WORKSTATION_LEN,
1087 *pbuffer, &tmp,
1088 nls_cp);
1089
1090 *buflen = tmp - *pbuffer;
1091 setup_ntlm_neg_ret:
1092 return rc;
1093 }
1094
1095 /*
1096 * Build ntlmssp blob with additional fields, such as version,
1097 * supported by modern servers. For safety limit to SMB3 or later
1098 * See notes in MS-NLMP Section 2.2.2.1 e.g.
1099 */
build_ntlmssp_smb3_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1100 int build_ntlmssp_smb3_negotiate_blob(unsigned char **pbuffer,
1101 u16 *buflen,
1102 struct cifs_ses *ses,
1103 struct TCP_Server_Info *server,
1104 const struct nls_table *nls_cp)
1105 {
1106 int rc = 0;
1107 struct negotiate_message *sec_blob;
1108 __u32 flags;
1109 unsigned char *tmp;
1110 int len;
1111
1112 len = size_of_ntlmssp_blob(ses, sizeof(struct negotiate_message));
1113 *pbuffer = kmalloc(len, GFP_KERNEL);
1114 if (!*pbuffer) {
1115 rc = -ENOMEM;
1116 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1117 *buflen = 0;
1118 goto setup_ntlm_smb3_neg_ret;
1119 }
1120 sec_blob = (struct negotiate_message *)*pbuffer;
1121
1122 memset(*pbuffer, 0, sizeof(struct negotiate_message));
1123 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1124 sec_blob->MessageType = NtLmNegotiate;
1125
1126 /* BB is NTLMV2 session security format easier to use here? */
1127 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
1128 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1129 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1130 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1131 NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_VERSION;
1132 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1133 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1134
1135 sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1136 sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1137 sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1138 sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1139
1140 tmp = *pbuffer + sizeof(struct negotiate_message);
1141 ses->ntlmssp->client_flags = flags;
1142 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1143
1144 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1145 cifs_security_buffer_from_str(&sec_blob->DomainName,
1146 NULL,
1147 CIFS_MAX_DOMAINNAME_LEN,
1148 *pbuffer, &tmp,
1149 nls_cp);
1150
1151 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1152 NULL,
1153 CIFS_MAX_WORKSTATION_LEN,
1154 *pbuffer, &tmp,
1155 nls_cp);
1156
1157 *buflen = tmp - *pbuffer;
1158 setup_ntlm_smb3_neg_ret:
1159 return rc;
1160 }
1161
1162
1163 /* See MS-NLMP 2.2.1.3 */
build_ntlmssp_auth_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1164 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
1165 u16 *buflen,
1166 struct cifs_ses *ses,
1167 struct TCP_Server_Info *server,
1168 const struct nls_table *nls_cp)
1169 {
1170 int rc;
1171 AUTHENTICATE_MESSAGE *sec_blob;
1172 __u32 flags;
1173 unsigned char *tmp;
1174 int len;
1175
1176 rc = setup_ntlmv2_rsp(ses, nls_cp);
1177 if (rc) {
1178 cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
1179 *buflen = 0;
1180 goto setup_ntlmv2_ret;
1181 }
1182
1183 len = size_of_ntlmssp_blob(ses, sizeof(AUTHENTICATE_MESSAGE));
1184 *pbuffer = kmalloc(len, GFP_KERNEL);
1185 if (!*pbuffer) {
1186 rc = -ENOMEM;
1187 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1188 *buflen = 0;
1189 goto setup_ntlmv2_ret;
1190 }
1191 sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
1192
1193 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1194 sec_blob->MessageType = NtLmAuthenticate;
1195
1196 /* send version information in ntlmssp authenticate also */
1197 flags = ses->ntlmssp->server_flags | NTLMSSP_REQUEST_TARGET |
1198 NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_VERSION |
1199 NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED;
1200
1201 sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1202 sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1203 sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1204 sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1205
1206 tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
1207 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1208
1209 sec_blob->LmChallengeResponse.BufferOffset =
1210 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
1211 sec_blob->LmChallengeResponse.Length = 0;
1212 sec_blob->LmChallengeResponse.MaximumLength = 0;
1213
1214 sec_blob->NtChallengeResponse.BufferOffset =
1215 cpu_to_le32(tmp - *pbuffer);
1216 if (ses->user_name != NULL) {
1217 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1218 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1219 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1220
1221 sec_blob->NtChallengeResponse.Length =
1222 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1223 sec_blob->NtChallengeResponse.MaximumLength =
1224 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1225 } else {
1226 /*
1227 * don't send an NT Response for anonymous access
1228 */
1229 sec_blob->NtChallengeResponse.Length = 0;
1230 sec_blob->NtChallengeResponse.MaximumLength = 0;
1231 }
1232
1233 cifs_security_buffer_from_str(&sec_blob->DomainName,
1234 ses->domainName,
1235 CIFS_MAX_DOMAINNAME_LEN,
1236 *pbuffer, &tmp,
1237 nls_cp);
1238
1239 cifs_security_buffer_from_str(&sec_blob->UserName,
1240 ses->user_name,
1241 CIFS_MAX_USERNAME_LEN,
1242 *pbuffer, &tmp,
1243 nls_cp);
1244
1245 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1246 ses->workstation_name,
1247 ntlmssp_workstation_name_size(ses),
1248 *pbuffer, &tmp,
1249 nls_cp);
1250
1251 if ((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
1252 (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) &&
1253 !calc_seckey(ses)) {
1254 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
1255 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1256 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
1257 sec_blob->SessionKey.MaximumLength =
1258 cpu_to_le16(CIFS_CPHTXT_SIZE);
1259 tmp += CIFS_CPHTXT_SIZE;
1260 } else {
1261 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1262 sec_blob->SessionKey.Length = 0;
1263 sec_blob->SessionKey.MaximumLength = 0;
1264 }
1265
1266 *buflen = tmp - *pbuffer;
1267 setup_ntlmv2_ret:
1268 return rc;
1269 }
1270
1271 enum securityEnum
cifs_select_sectype(struct TCP_Server_Info * server,enum securityEnum requested)1272 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
1273 {
1274 switch (server->negflavor) {
1275 case CIFS_NEGFLAVOR_EXTENDED:
1276 switch (requested) {
1277 case Kerberos:
1278 case RawNTLMSSP:
1279 case IAKerb:
1280 return requested;
1281 case Unspecified:
1282 if (server->sec_ntlmssp &&
1283 (global_secflags & CIFSSEC_MAY_NTLMSSP))
1284 return RawNTLMSSP;
1285 if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) &&
1286 (global_secflags & CIFSSEC_MAY_KRB5))
1287 return Kerberos;
1288 fallthrough;
1289 default:
1290 return Unspecified;
1291 }
1292 case CIFS_NEGFLAVOR_UNENCAP:
1293 switch (requested) {
1294 case NTLMv2:
1295 return requested;
1296 case Unspecified:
1297 if (global_secflags & CIFSSEC_MAY_NTLMV2)
1298 return NTLMv2;
1299 break;
1300 default:
1301 break;
1302 }
1303 fallthrough;
1304 default:
1305 return Unspecified;
1306 }
1307 }
1308
1309 struct sess_data {
1310 unsigned int xid;
1311 struct cifs_ses *ses;
1312 struct TCP_Server_Info *server;
1313 struct nls_table *nls_cp;
1314 void (*func)(struct sess_data *);
1315 int result;
1316
1317 /* we will send the SMB in three pieces:
1318 * a fixed length beginning part, an optional
1319 * SPNEGO blob (which can be zero length), and a
1320 * last part which will include the strings
1321 * and rest of bcc area. This allows us to avoid
1322 * a large buffer 17K allocation
1323 */
1324 int buf0_type;
1325 struct kvec iov[3];
1326 };
1327
1328 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
1329 static int
sess_alloc_buffer(struct sess_data * sess_data,int wct)1330 sess_alloc_buffer(struct sess_data *sess_data, int wct)
1331 {
1332 int rc;
1333 struct cifs_ses *ses = sess_data->ses;
1334 struct smb_hdr *smb_buf;
1335
1336 rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
1337 (void **)&smb_buf);
1338
1339 if (rc)
1340 return rc;
1341
1342 sess_data->iov[0].iov_base = (char *)smb_buf;
1343 sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
1344 /*
1345 * This variable will be used to clear the buffer
1346 * allocated above in case of any error in the calling function.
1347 */
1348 sess_data->buf0_type = CIFS_SMALL_BUFFER;
1349
1350 /* 2000 big enough to fit max user, domain, NOS name etc. */
1351 sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
1352 if (!sess_data->iov[2].iov_base) {
1353 rc = -ENOMEM;
1354 goto out_free_smb_buf;
1355 }
1356
1357 return 0;
1358
1359 out_free_smb_buf:
1360 cifs_small_buf_release(smb_buf);
1361 sess_data->iov[0].iov_base = NULL;
1362 sess_data->iov[0].iov_len = 0;
1363 sess_data->buf0_type = CIFS_NO_BUFFER;
1364 return rc;
1365 }
1366
1367 static void
sess_free_buffer(struct sess_data * sess_data)1368 sess_free_buffer(struct sess_data *sess_data)
1369 {
1370 struct kvec *iov = sess_data->iov;
1371
1372 /*
1373 * Zero the session data before freeing, as it might contain sensitive info (keys, etc).
1374 * Note that iov[1] is already freed by caller.
1375 */
1376 if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base)
1377 memzero_explicit(iov[0].iov_base, iov[0].iov_len);
1378
1379 free_rsp_buf(sess_data->buf0_type, iov[0].iov_base);
1380 sess_data->buf0_type = CIFS_NO_BUFFER;
1381 kfree_sensitive(iov[2].iov_base);
1382 }
1383
1384 static int
sess_establish_session(struct sess_data * sess_data)1385 sess_establish_session(struct sess_data *sess_data)
1386 {
1387 struct cifs_ses *ses = sess_data->ses;
1388 struct TCP_Server_Info *server = sess_data->server;
1389
1390 cifs_server_lock(server);
1391 if (!server->session_estab) {
1392 if (server->sign) {
1393 server->session_key.response =
1394 kmemdup(ses->auth_key.response,
1395 ses->auth_key.len, GFP_KERNEL);
1396 if (!server->session_key.response) {
1397 cifs_server_unlock(server);
1398 return -ENOMEM;
1399 }
1400 server->session_key.len =
1401 ses->auth_key.len;
1402 }
1403 server->sequence_number = 0x2;
1404 server->session_estab = true;
1405 }
1406 cifs_server_unlock(server);
1407
1408 cifs_dbg(FYI, "CIFS session established successfully\n");
1409 return 0;
1410 }
1411
1412 static int
sess_sendreceive(struct sess_data * sess_data)1413 sess_sendreceive(struct sess_data *sess_data)
1414 {
1415 int rc;
1416 struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
1417 __u16 count;
1418 struct kvec rsp_iov = { NULL, 0 };
1419
1420 count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
1421 be32_add_cpu(&smb_buf->smb_buf_length, count);
1422 put_bcc(count, smb_buf);
1423
1424 rc = SendReceive2(sess_data->xid, sess_data->ses,
1425 sess_data->iov, 3 /* num_iovecs */,
1426 &sess_data->buf0_type,
1427 CIFS_LOG_ERROR, &rsp_iov);
1428 cifs_small_buf_release(sess_data->iov[0].iov_base);
1429 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
1430
1431 return rc;
1432 }
1433
1434 static void
sess_auth_ntlmv2(struct sess_data * sess_data)1435 sess_auth_ntlmv2(struct sess_data *sess_data)
1436 {
1437 int rc = 0;
1438 struct smb_hdr *smb_buf;
1439 SESSION_SETUP_ANDX *pSMB;
1440 char *bcc_ptr;
1441 struct cifs_ses *ses = sess_data->ses;
1442 struct TCP_Server_Info *server = sess_data->server;
1443 __u32 capabilities;
1444 __u16 bytes_remaining;
1445
1446 /* old style NTLM sessionsetup */
1447 /* wct = 13 */
1448 rc = sess_alloc_buffer(sess_data, 13);
1449 if (rc)
1450 goto out;
1451
1452 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1453 bcc_ptr = sess_data->iov[2].iov_base;
1454 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1455
1456 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1457
1458 /* LM2 password would be here if we supported it */
1459 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1460
1461 if (ses->user_name != NULL) {
1462 /* calculate nlmv2 response and session key */
1463 rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
1464 if (rc) {
1465 cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
1466 goto out;
1467 }
1468
1469 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1470 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1471 bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1472
1473 /* set case sensitive password length after tilen may get
1474 * assigned, tilen is 0 otherwise.
1475 */
1476 pSMB->req_no_secext.CaseSensitivePasswordLength =
1477 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1478 } else {
1479 pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1480 }
1481
1482 if (ses->capabilities & CAP_UNICODE) {
1483 if (!IS_ALIGNED(sess_data->iov[0].iov_len, 2)) {
1484 *bcc_ptr = 0;
1485 bcc_ptr++;
1486 }
1487 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1488 } else {
1489 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1490 }
1491
1492
1493 sess_data->iov[2].iov_len = (long) bcc_ptr -
1494 (long) sess_data->iov[2].iov_base;
1495
1496 rc = sess_sendreceive(sess_data);
1497 if (rc)
1498 goto out;
1499
1500 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1501 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1502
1503 if (smb_buf->WordCount != 3) {
1504 rc = -EIO;
1505 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1506 goto out;
1507 }
1508
1509 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1510 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1511
1512 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1513 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1514
1515 bytes_remaining = get_bcc(smb_buf);
1516 bcc_ptr = pByteArea(smb_buf);
1517
1518 /* BB check if Unicode and decode strings */
1519 if (bytes_remaining == 0) {
1520 /* no string area to decode, do nothing */
1521 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1522 /* unicode string area must be word-aligned */
1523 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1524 ++bcc_ptr;
1525 --bytes_remaining;
1526 }
1527 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1528 sess_data->nls_cp);
1529 } else {
1530 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1531 sess_data->nls_cp);
1532 }
1533
1534 rc = sess_establish_session(sess_data);
1535 out:
1536 sess_data->result = rc;
1537 sess_data->func = NULL;
1538 sess_free_buffer(sess_data);
1539 kfree_sensitive(ses->auth_key.response);
1540 ses->auth_key.response = NULL;
1541 }
1542
1543 #ifdef CONFIG_CIFS_UPCALL
1544 static void
sess_auth_kerberos(struct sess_data * sess_data)1545 sess_auth_kerberos(struct sess_data *sess_data)
1546 {
1547 int rc = 0;
1548 struct smb_hdr *smb_buf;
1549 SESSION_SETUP_ANDX *pSMB;
1550 char *bcc_ptr;
1551 struct cifs_ses *ses = sess_data->ses;
1552 struct TCP_Server_Info *server = sess_data->server;
1553 __u32 capabilities;
1554 __u16 bytes_remaining;
1555 struct key *spnego_key = NULL;
1556 struct cifs_spnego_msg *msg;
1557 u16 blob_len;
1558
1559 /* extended security */
1560 /* wct = 12 */
1561 rc = sess_alloc_buffer(sess_data, 12);
1562 if (rc)
1563 goto out;
1564
1565 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1566 bcc_ptr = sess_data->iov[2].iov_base;
1567 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1568
1569 spnego_key = cifs_get_spnego_key(ses, server);
1570 if (IS_ERR(spnego_key)) {
1571 rc = PTR_ERR(spnego_key);
1572 spnego_key = NULL;
1573 goto out;
1574 }
1575
1576 msg = spnego_key->payload.data[0];
1577 /*
1578 * check version field to make sure that cifs.upcall is
1579 * sending us a response in an expected form
1580 */
1581 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1582 cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1583 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1584 rc = -EKEYREJECTED;
1585 goto out_put_spnego_key;
1586 }
1587
1588 kfree_sensitive(ses->auth_key.response);
1589 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1590 GFP_KERNEL);
1591 if (!ses->auth_key.response) {
1592 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1593 msg->sesskey_len);
1594 rc = -ENOMEM;
1595 goto out_put_spnego_key;
1596 }
1597 ses->auth_key.len = msg->sesskey_len;
1598
1599 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1600 capabilities |= CAP_EXTENDED_SECURITY;
1601 pSMB->req.Capabilities = cpu_to_le32(capabilities);
1602 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1603 sess_data->iov[1].iov_len = msg->secblob_len;
1604 pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1605
1606 if (pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) {
1607 /* unicode strings must be word aligned */
1608 if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1609 *bcc_ptr = 0;
1610 bcc_ptr++;
1611 }
1612 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1613 unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1614 } else {
1615 ascii_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1616 ascii_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1617 }
1618
1619 sess_data->iov[2].iov_len = (long) bcc_ptr -
1620 (long) sess_data->iov[2].iov_base;
1621
1622 rc = sess_sendreceive(sess_data);
1623 if (rc)
1624 goto out_put_spnego_key;
1625
1626 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1627 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1628
1629 if (smb_buf->WordCount != 4) {
1630 rc = -EIO;
1631 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1632 goto out_put_spnego_key;
1633 }
1634
1635 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1636 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1637
1638 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1639 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1640
1641 bytes_remaining = get_bcc(smb_buf);
1642 bcc_ptr = pByteArea(smb_buf);
1643
1644 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1645 if (blob_len > bytes_remaining) {
1646 cifs_dbg(VFS, "bad security blob length %d\n",
1647 blob_len);
1648 rc = -EINVAL;
1649 goto out_put_spnego_key;
1650 }
1651 bcc_ptr += blob_len;
1652 bytes_remaining -= blob_len;
1653
1654 /* BB check if Unicode and decode strings */
1655 if (bytes_remaining == 0) {
1656 /* no string area to decode, do nothing */
1657 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1658 /* unicode string area must be word-aligned */
1659 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1660 ++bcc_ptr;
1661 --bytes_remaining;
1662 }
1663 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1664 sess_data->nls_cp);
1665 } else {
1666 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1667 sess_data->nls_cp);
1668 }
1669
1670 rc = sess_establish_session(sess_data);
1671 out_put_spnego_key:
1672 key_invalidate(spnego_key);
1673 key_put(spnego_key);
1674 out:
1675 sess_data->result = rc;
1676 sess_data->func = NULL;
1677 sess_free_buffer(sess_data);
1678 kfree_sensitive(ses->auth_key.response);
1679 ses->auth_key.response = NULL;
1680 }
1681
1682 #endif /* ! CONFIG_CIFS_UPCALL */
1683
1684 /*
1685 * The required kvec buffers have to be allocated before calling this
1686 * function.
1687 */
1688 static int
_sess_auth_rawntlmssp_assemble_req(struct sess_data * sess_data)1689 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1690 {
1691 SESSION_SETUP_ANDX *pSMB;
1692 struct cifs_ses *ses = sess_data->ses;
1693 struct TCP_Server_Info *server = sess_data->server;
1694 __u32 capabilities;
1695 char *bcc_ptr;
1696
1697 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1698
1699 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1700 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1701 capabilities |= CAP_EXTENDED_SECURITY;
1702 pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1703
1704 bcc_ptr = sess_data->iov[2].iov_base;
1705
1706 if (pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) {
1707 /* unicode strings must be word aligned */
1708 if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1709 *bcc_ptr = 0;
1710 bcc_ptr++;
1711 }
1712 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1713 } else {
1714 ascii_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1715 }
1716
1717 sess_data->iov[2].iov_len = (long) bcc_ptr -
1718 (long) sess_data->iov[2].iov_base;
1719
1720 return 0;
1721 }
1722
1723 static void
1724 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1725
1726 static void
sess_auth_rawntlmssp_negotiate(struct sess_data * sess_data)1727 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1728 {
1729 int rc;
1730 struct smb_hdr *smb_buf;
1731 SESSION_SETUP_ANDX *pSMB;
1732 struct cifs_ses *ses = sess_data->ses;
1733 struct TCP_Server_Info *server = sess_data->server;
1734 __u16 bytes_remaining;
1735 char *bcc_ptr;
1736 unsigned char *ntlmsspblob = NULL;
1737 u16 blob_len;
1738
1739 cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1740
1741 /*
1742 * if memory allocation is successful, caller of this function
1743 * frees it.
1744 */
1745 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1746 if (!ses->ntlmssp) {
1747 rc = -ENOMEM;
1748 goto out;
1749 }
1750 ses->ntlmssp->sesskey_per_smbsess = false;
1751
1752 /* wct = 12 */
1753 rc = sess_alloc_buffer(sess_data, 12);
1754 if (rc)
1755 goto out;
1756
1757 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1758
1759 /* Build security blob before we assemble the request */
1760 rc = build_ntlmssp_negotiate_blob(&ntlmsspblob,
1761 &blob_len, ses, server,
1762 sess_data->nls_cp);
1763 if (rc)
1764 goto out_free_ntlmsspblob;
1765
1766 sess_data->iov[1].iov_len = blob_len;
1767 sess_data->iov[1].iov_base = ntlmsspblob;
1768 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1769
1770 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1771 if (rc)
1772 goto out_free_ntlmsspblob;
1773
1774 rc = sess_sendreceive(sess_data);
1775
1776 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1777 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1778
1779 /* If true, rc here is expected and not an error */
1780 if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1781 smb_buf->Status.CifsError ==
1782 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1783 rc = 0;
1784
1785 if (rc)
1786 goto out_free_ntlmsspblob;
1787
1788 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1789
1790 if (smb_buf->WordCount != 4) {
1791 rc = -EIO;
1792 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1793 goto out_free_ntlmsspblob;
1794 }
1795
1796 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1797 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1798
1799 bytes_remaining = get_bcc(smb_buf);
1800 bcc_ptr = pByteArea(smb_buf);
1801
1802 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1803 if (blob_len > bytes_remaining) {
1804 cifs_dbg(VFS, "bad security blob length %d\n",
1805 blob_len);
1806 rc = -EINVAL;
1807 goto out_free_ntlmsspblob;
1808 }
1809
1810 rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1811
1812 out_free_ntlmsspblob:
1813 kfree_sensitive(ntlmsspblob);
1814 out:
1815 sess_free_buffer(sess_data);
1816
1817 if (!rc) {
1818 sess_data->func = sess_auth_rawntlmssp_authenticate;
1819 return;
1820 }
1821
1822 /* Else error. Cleanup */
1823 kfree_sensitive(ses->auth_key.response);
1824 ses->auth_key.response = NULL;
1825 kfree_sensitive(ses->ntlmssp);
1826 ses->ntlmssp = NULL;
1827
1828 sess_data->func = NULL;
1829 sess_data->result = rc;
1830 }
1831
1832 static void
sess_auth_rawntlmssp_authenticate(struct sess_data * sess_data)1833 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1834 {
1835 int rc;
1836 struct smb_hdr *smb_buf;
1837 SESSION_SETUP_ANDX *pSMB;
1838 struct cifs_ses *ses = sess_data->ses;
1839 struct TCP_Server_Info *server = sess_data->server;
1840 __u16 bytes_remaining;
1841 char *bcc_ptr;
1842 unsigned char *ntlmsspblob = NULL;
1843 u16 blob_len;
1844
1845 cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1846
1847 /* wct = 12 */
1848 rc = sess_alloc_buffer(sess_data, 12);
1849 if (rc)
1850 goto out;
1851
1852 /* Build security blob before we assemble the request */
1853 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1854 smb_buf = (struct smb_hdr *)pSMB;
1855 rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1856 &blob_len, ses, server,
1857 sess_data->nls_cp);
1858 if (rc)
1859 goto out_free_ntlmsspblob;
1860 sess_data->iov[1].iov_len = blob_len;
1861 sess_data->iov[1].iov_base = ntlmsspblob;
1862 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1863 /*
1864 * Make sure that we tell the server that we are using
1865 * the uid that it just gave us back on the response
1866 * (challenge)
1867 */
1868 smb_buf->Uid = ses->Suid;
1869
1870 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1871 if (rc)
1872 goto out_free_ntlmsspblob;
1873
1874 rc = sess_sendreceive(sess_data);
1875 if (rc)
1876 goto out_free_ntlmsspblob;
1877
1878 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1879 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1880 if (smb_buf->WordCount != 4) {
1881 rc = -EIO;
1882 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1883 goto out_free_ntlmsspblob;
1884 }
1885
1886 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1887 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1888
1889 if (ses->Suid != smb_buf->Uid) {
1890 ses->Suid = smb_buf->Uid;
1891 cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1892 }
1893
1894 bytes_remaining = get_bcc(smb_buf);
1895 bcc_ptr = pByteArea(smb_buf);
1896 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1897 if (blob_len > bytes_remaining) {
1898 cifs_dbg(VFS, "bad security blob length %d\n",
1899 blob_len);
1900 rc = -EINVAL;
1901 goto out_free_ntlmsspblob;
1902 }
1903 bcc_ptr += blob_len;
1904 bytes_remaining -= blob_len;
1905
1906
1907 /* BB check if Unicode and decode strings */
1908 if (bytes_remaining == 0) {
1909 /* no string area to decode, do nothing */
1910 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1911 /* unicode string area must be word-aligned */
1912 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1913 ++bcc_ptr;
1914 --bytes_remaining;
1915 }
1916 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1917 sess_data->nls_cp);
1918 } else {
1919 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1920 sess_data->nls_cp);
1921 }
1922
1923 out_free_ntlmsspblob:
1924 kfree_sensitive(ntlmsspblob);
1925 out:
1926 sess_free_buffer(sess_data);
1927
1928 if (!rc)
1929 rc = sess_establish_session(sess_data);
1930
1931 /* Cleanup */
1932 kfree_sensitive(ses->auth_key.response);
1933 ses->auth_key.response = NULL;
1934 kfree_sensitive(ses->ntlmssp);
1935 ses->ntlmssp = NULL;
1936
1937 sess_data->func = NULL;
1938 sess_data->result = rc;
1939 }
1940
select_sec(struct sess_data * sess_data)1941 static int select_sec(struct sess_data *sess_data)
1942 {
1943 int type;
1944 struct cifs_ses *ses = sess_data->ses;
1945 struct TCP_Server_Info *server = sess_data->server;
1946
1947 type = cifs_select_sectype(server, ses->sectype);
1948 cifs_dbg(FYI, "sess setup type %d\n", type);
1949 if (type == Unspecified) {
1950 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1951 return -EINVAL;
1952 }
1953
1954 switch (type) {
1955 case NTLMv2:
1956 sess_data->func = sess_auth_ntlmv2;
1957 break;
1958 case Kerberos:
1959 #ifdef CONFIG_CIFS_UPCALL
1960 sess_data->func = sess_auth_kerberos;
1961 break;
1962 #else
1963 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1964 return -ENOSYS;
1965 #endif /* CONFIG_CIFS_UPCALL */
1966 case RawNTLMSSP:
1967 sess_data->func = sess_auth_rawntlmssp_negotiate;
1968 break;
1969 default:
1970 cifs_dbg(VFS, "secType %d not supported!\n", type);
1971 return -ENOSYS;
1972 }
1973
1974 return 0;
1975 }
1976
CIFS_SessSetup(const unsigned int xid,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1977 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
1978 struct TCP_Server_Info *server,
1979 const struct nls_table *nls_cp)
1980 {
1981 int rc = 0;
1982 struct sess_data *sess_data;
1983
1984 if (ses == NULL) {
1985 WARN(1, "%s: ses == NULL!", __func__);
1986 return -EINVAL;
1987 }
1988
1989 sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
1990 if (!sess_data)
1991 return -ENOMEM;
1992
1993 sess_data->xid = xid;
1994 sess_data->ses = ses;
1995 sess_data->server = server;
1996 sess_data->buf0_type = CIFS_NO_BUFFER;
1997 sess_data->nls_cp = (struct nls_table *) nls_cp;
1998
1999 rc = select_sec(sess_data);
2000 if (rc)
2001 goto out;
2002
2003 while (sess_data->func)
2004 sess_data->func(sess_data);
2005
2006 /* Store result before we free sess_data */
2007 rc = sess_data->result;
2008
2009 out:
2010 kfree_sensitive(sess_data);
2011 return rc;
2012 }
2013 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
2014