1 // SPDX-License-Identifier: LGPL-2.1 2 /* 3 * 4 * SMB/CIFS session setup handling routines 5 * 6 * Copyright (c) International Business Machines Corp., 2006, 2009 7 * Author(s): Steve French (sfrench@us.ibm.com) 8 * 9 */ 10 11 #include "cifsglob.h" 12 #include "cifsproto.h" 13 #include "cifs_unicode.h" 14 #include "cifs_debug.h" 15 #include "ntlmssp.h" 16 #include "nterr.h" 17 #include <linux/utsname.h> 18 #include <linux/slab.h> 19 #include <linux/version.h> 20 #include "cifsfs.h" 21 #include "cifs_spnego.h" 22 #include "smb2proto.h" 23 #include "fs_context.h" 24 25 static int 26 cifs_ses_add_channel(struct cifs_ses *ses, 27 struct cifs_server_iface *iface); 28 29 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface) 30 { 31 int i; 32 33 spin_lock(&ses->chan_lock); 34 for (i = 0; i < ses->chan_count; i++) { 35 if (ses->chans[i].iface == iface) { 36 spin_unlock(&ses->chan_lock); 37 return true; 38 } 39 } 40 spin_unlock(&ses->chan_lock); 41 return false; 42 } 43 44 /* channel helper functions. assumed that chan_lock is held by caller. */ 45 46 int 47 cifs_ses_get_chan_index(struct cifs_ses *ses, 48 struct TCP_Server_Info *server) 49 { 50 unsigned int i; 51 52 /* if the channel is waiting for termination */ 53 if (server && server->terminate) 54 return CIFS_INVAL_CHAN_INDEX; 55 56 for (i = 0; i < ses->chan_count; i++) { 57 if (ses->chans[i].server == server) 58 return i; 59 } 60 61 /* If we didn't find the channel, it is likely a bug */ 62 if (server) 63 cifs_dbg(VFS, "unable to get chan index for server: 0x%llx", 64 server->conn_id); 65 return CIFS_INVAL_CHAN_INDEX; 66 } 67 68 void 69 cifs_chan_set_in_reconnect(struct cifs_ses *ses, 70 struct TCP_Server_Info *server) 71 { 72 int chan_index = cifs_ses_get_chan_index(ses, server); 73 74 if (chan_index == CIFS_INVAL_CHAN_INDEX) 75 return; 76 77 ses->chans[chan_index].in_reconnect = true; 78 } 79 80 void 81 cifs_chan_clear_in_reconnect(struct cifs_ses *ses, 82 struct TCP_Server_Info *server) 83 { 84 unsigned int chan_index = cifs_ses_get_chan_index(ses, server); 85 86 if (chan_index == CIFS_INVAL_CHAN_INDEX) 87 return; 88 89 ses->chans[chan_index].in_reconnect = false; 90 } 91 92 void 93 cifs_chan_set_need_reconnect(struct cifs_ses *ses, 94 struct TCP_Server_Info *server) 95 { 96 unsigned int chan_index = cifs_ses_get_chan_index(ses, server); 97 98 if (chan_index == CIFS_INVAL_CHAN_INDEX) 99 return; 100 101 set_bit(chan_index, &ses->chans_need_reconnect); 102 cifs_dbg(FYI, "Set reconnect bitmask for chan %u; now 0x%lx\n", 103 chan_index, ses->chans_need_reconnect); 104 } 105 106 void 107 cifs_chan_clear_need_reconnect(struct cifs_ses *ses, 108 struct TCP_Server_Info *server) 109 { 110 unsigned int chan_index = cifs_ses_get_chan_index(ses, server); 111 112 if (chan_index == CIFS_INVAL_CHAN_INDEX) 113 return; 114 115 clear_bit(chan_index, &ses->chans_need_reconnect); 116 cifs_dbg(FYI, "Cleared reconnect bitmask for chan %u; now 0x%lx\n", 117 chan_index, ses->chans_need_reconnect); 118 } 119 120 bool 121 cifs_chan_needs_reconnect(struct cifs_ses *ses, 122 struct TCP_Server_Info *server) 123 { 124 unsigned int chan_index = cifs_ses_get_chan_index(ses, server); 125 126 if (chan_index == CIFS_INVAL_CHAN_INDEX) 127 return true; /* err on the safer side */ 128 129 return CIFS_CHAN_NEEDS_RECONNECT(ses, chan_index); 130 } 131 132 bool 133 cifs_chan_is_iface_active(struct cifs_ses *ses, 134 struct TCP_Server_Info *server) 135 { 136 unsigned int chan_index = cifs_ses_get_chan_index(ses, server); 137 138 if (chan_index == CIFS_INVAL_CHAN_INDEX) 139 return true; /* err on the safer side */ 140 141 return ses->chans[chan_index].iface && 142 ses->chans[chan_index].iface->is_active; 143 } 144 145 /* returns number of channels added */ 146 int cifs_try_adding_channels(struct cifs_ses *ses) 147 { 148 struct TCP_Server_Info *server = ses->server; 149 int old_chan_count, new_chan_count; 150 int left; 151 int rc = 0; 152 int tries = 0, attempts; 153 size_t iface_weight = 0, iface_min_speed = 0; 154 struct cifs_server_iface *iface = NULL, *candidate = NULL; 155 struct cifs_server_iface *last_iface = NULL; 156 157 spin_lock(&ses->chan_lock); 158 159 new_chan_count = old_chan_count = ses->chan_count; 160 left = ses->chan_max - ses->chan_count; 161 162 if (left <= 0) { 163 spin_unlock(&ses->chan_lock); 164 cifs_dbg(FYI, 165 "ses already at max_channels (%zu), nothing to open\n", 166 ses->chan_max); 167 return 0; 168 } 169 170 if (server->dialect < SMB30_PROT_ID) { 171 spin_unlock(&ses->chan_lock); 172 cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n"); 173 return 0; 174 } 175 176 if (!(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) { 177 spin_unlock(&ses->chan_lock); 178 cifs_server_dbg(VFS, "no multichannel support\n"); 179 return 0; 180 } 181 spin_unlock(&ses->chan_lock); 182 183 while (left > 0) { 184 185 tries++; 186 if (tries > 3*ses->chan_max) { 187 cifs_dbg(VFS, "too many channel open attempts (%d channels left to open)\n", 188 left); 189 break; 190 } 191 192 spin_lock(&ses->iface_lock); 193 if (!ses->iface_count) { 194 spin_unlock(&ses->iface_lock); 195 cifs_dbg(ONCE, "server %s does not advertise interfaces\n", 196 ses->server->hostname); 197 break; 198 } 199 200 last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface, 201 iface_head); 202 iface_min_speed = last_iface->speed; 203 spin_unlock(&ses->iface_lock); 204 205 attempts = 0; 206 while (left > 0) { 207 spin_lock(&ses->iface_lock); 208 209 /* 210 * iface_lock must be dropped while opening a channel, 211 * and a concurrent interface refresh may remove and 212 * free entries during that window, so no list entry 213 * may be kept across it without a reference. Scan 214 * the list from the beginning each time and only pass 215 * a referenced candidate to cifs_ses_add_channel(); 216 * weight_fulfilled tracks the progress so that no 217 * iface is selected beyond its weight. 218 */ 219 candidate = NULL; 220 list_for_each_entry(iface, &ses->iface_list, iface_head) { 221 /* do not mix rdma and non-rdma interfaces */ 222 if (iface->rdma_capable != ses->server->rdma) 223 continue; 224 225 /* skip ifaces that are unusable */ 226 if (!iface->is_active || 227 (is_ses_using_iface(ses, iface) && 228 !iface->rss_capable)) 229 continue; 230 231 /* check if we already allocated enough channels */ 232 iface_weight = iface->speed / iface_min_speed; 233 234 if (iface->weight_fulfilled >= iface_weight) 235 continue; 236 237 /* take ref before unlock */ 238 kref_get(&iface->refcount); 239 candidate = iface; 240 break; 241 } 242 243 if (!candidate) { 244 /* no usable iface. reset weight_fulfilled and start over */ 245 list_for_each_entry(iface, &ses->iface_list, iface_head) 246 iface->weight_fulfilled = 0; 247 spin_unlock(&ses->iface_lock); 248 break; 249 } 250 251 attempts++; 252 if (attempts > 3 * ses->chan_max) { 253 kref_put(&candidate->refcount, release_iface); 254 spin_unlock(&ses->iface_lock); 255 break; 256 } 257 258 spin_unlock(&ses->iface_lock); 259 rc = cifs_ses_add_channel(ses, candidate); 260 spin_lock(&ses->iface_lock); 261 262 if (rc) { 263 cifs_dbg(VFS, "failed to open extra channel on iface:%pIS rc=%d\n", 264 &candidate->sockaddr, 265 rc); 266 /* failure to add chan should increase weight */ 267 candidate->weight_fulfilled++; 268 kref_put(&candidate->refcount, release_iface); 269 spin_unlock(&ses->iface_lock); 270 continue; 271 } 272 273 candidate->num_channels++; 274 candidate->weight_fulfilled++; 275 cifs_info("successfully opened new channel on iface:%pIS\n", 276 &candidate->sockaddr); 277 spin_unlock(&ses->iface_lock); 278 279 left--; 280 new_chan_count++; 281 break; 282 } 283 } 284 285 return new_chan_count - old_chan_count; 286 } 287 288 /* 289 * cifs_decrease_secondary_channels - Reduce the number of active secondary channels 290 * @ses: pointer to the CIFS session structure 291 * @disable_mchan: if true, reduce to a single channel; if false, reduce to chan_max 292 * 293 * This function disables and cleans up extra secondary channels for a CIFS session. 294 * If called during reconfiguration, it reduces the channel count to the new maximum (chan_max). 295 * Otherwise, it disables all but the primary channel. 296 */ 297 void 298 cifs_decrease_secondary_channels(struct cifs_ses *ses, bool disable_mchan) 299 { 300 int i, chan_count; 301 struct TCP_Server_Info *server; 302 struct cifs_server_iface *iface; 303 304 spin_lock(&ses->chan_lock); 305 chan_count = ses->chan_count; 306 if (chan_count == 1) 307 goto done; 308 309 /* Update the chan_count to the new maximum */ 310 if (disable_mchan) { 311 cifs_dbg(FYI, "server does not support multichannel anymore.\n"); 312 ses->chan_count = 1; 313 } else { 314 ses->chan_count = ses->chan_max; 315 } 316 317 /* Disable all secondary channels beyond the new chan_count */ 318 for (i = ses->chan_count ; i < chan_count; i++) { 319 iface = ses->chans[i].iface; 320 server = ses->chans[i].server; 321 322 /* 323 * remove these references first, since we need to unlock 324 * the chan_lock here, since iface_lock is a higher lock 325 */ 326 ses->chans[i].iface = NULL; 327 ses->chans[i].server = NULL; 328 spin_unlock(&ses->chan_lock); 329 330 if (iface) { 331 spin_lock(&ses->iface_lock); 332 iface->num_channels--; 333 if (iface->weight_fulfilled) 334 iface->weight_fulfilled--; 335 kref_put(&iface->refcount, release_iface); 336 spin_unlock(&ses->iface_lock); 337 } 338 339 if (server) { 340 if (!server->terminate) { 341 server->terminate = true; 342 cifs_signal_cifsd_for_reconnect(server, false); 343 } 344 cifs_put_tcp_session(server, false); 345 } 346 347 spin_lock(&ses->chan_lock); 348 } 349 350 /* For extra secondary channels, reset the need reconnect bit */ 351 if (ses->chan_count == 1) { 352 cifs_dbg(VFS, "Disable all secondary channels\n"); 353 ses->chans_need_reconnect &= 1; 354 } else { 355 cifs_dbg(VFS, "Disable extra secondary channels\n"); 356 ses->chans_need_reconnect &= ((1UL << ses->chan_max) - 1); 357 } 358 359 done: 360 spin_unlock(&ses->chan_lock); 361 } 362 363 /* update the iface for the channel if necessary. */ 364 void 365 cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) 366 { 367 unsigned int chan_index; 368 size_t iface_weight = 0, iface_min_speed = 0; 369 struct cifs_server_iface *iface = NULL; 370 struct cifs_server_iface *old_iface = NULL; 371 struct cifs_server_iface *last_iface = NULL; 372 struct sockaddr_storage ss; 373 int retry = 0; 374 375 spin_lock(&ses->chan_lock); 376 chan_index = cifs_ses_get_chan_index(ses, server); 377 if (chan_index == CIFS_INVAL_CHAN_INDEX) { 378 spin_unlock(&ses->chan_lock); 379 return; 380 } 381 382 if (ses->chans[chan_index].iface) { 383 old_iface = ses->chans[chan_index].iface; 384 if (old_iface->is_active) { 385 spin_unlock(&ses->chan_lock); 386 return; 387 } 388 } 389 spin_unlock(&ses->chan_lock); 390 391 spin_lock(&server->srv_lock); 392 ss = server->dstaddr; 393 spin_unlock(&server->srv_lock); 394 395 spin_lock(&ses->iface_lock); 396 if (!ses->iface_count) { 397 spin_unlock(&ses->iface_lock); 398 cifs_dbg(ONCE, "server %s does not advertise interfaces\n", ses->server->hostname); 399 return; 400 } 401 402 try_again: 403 last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface, 404 iface_head); 405 iface_min_speed = last_iface->speed; 406 407 /* then look for a new one */ 408 list_for_each_entry(iface, &ses->iface_list, iface_head) { 409 if (!chan_index) { 410 /* if we're trying to get the updated iface for primary channel */ 411 if (!cifs_match_ipaddr((struct sockaddr *) &ss, 412 (struct sockaddr *) &iface->sockaddr)) 413 continue; 414 415 kref_get(&iface->refcount); 416 break; 417 } 418 419 /* do not mix rdma and non-rdma interfaces */ 420 if (iface->rdma_capable != server->rdma) 421 continue; 422 423 if (!iface->is_active || 424 (is_ses_using_iface(ses, iface) && 425 !iface->rss_capable)) { 426 continue; 427 } 428 429 /* check if we already allocated enough channels */ 430 iface_weight = iface->speed / iface_min_speed; 431 432 if (iface->weight_fulfilled >= iface_weight) 433 continue; 434 435 kref_get(&iface->refcount); 436 break; 437 } 438 439 if (list_entry_is_head(iface, &ses->iface_list, iface_head)) { 440 list_for_each_entry(iface, &ses->iface_list, iface_head) 441 iface->weight_fulfilled = 0; 442 443 /* see if it can be satisfied in second attempt */ 444 if (!retry++) 445 goto try_again; 446 447 iface = NULL; 448 cifs_dbg(FYI, "unable to find a suitable iface\n"); 449 } 450 451 if (!iface) { 452 if (!chan_index) 453 cifs_dbg(FYI, "unable to get the interface matching: %pIS\n", 454 &ss); 455 else { 456 cifs_dbg(FYI, "unable to find another interface to replace: %pIS\n", 457 &old_iface->sockaddr); 458 } 459 460 spin_unlock(&ses->iface_lock); 461 return; 462 } 463 464 /* now drop the ref to the current iface */ 465 if (old_iface) { 466 cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n", 467 &old_iface->sockaddr, 468 &iface->sockaddr); 469 470 old_iface->num_channels--; 471 if (old_iface->weight_fulfilled) 472 old_iface->weight_fulfilled--; 473 iface->num_channels++; 474 iface->weight_fulfilled++; 475 476 kref_put(&old_iface->refcount, release_iface); 477 } else if (!chan_index) { 478 /* special case: update interface for primary channel */ 479 cifs_dbg(FYI, "referencing primary channel iface: %pIS\n", 480 &iface->sockaddr); 481 iface->num_channels++; 482 iface->weight_fulfilled++; 483 } 484 spin_unlock(&ses->iface_lock); 485 486 spin_lock(&ses->chan_lock); 487 chan_index = cifs_ses_get_chan_index(ses, server); 488 if (chan_index == CIFS_INVAL_CHAN_INDEX) { 489 spin_unlock(&ses->chan_lock); 490 return; 491 } 492 493 ses->chans[chan_index].iface = iface; 494 spin_unlock(&ses->chan_lock); 495 496 spin_lock(&server->srv_lock); 497 memcpy(&server->dstaddr, &iface->sockaddr, sizeof(server->dstaddr)); 498 spin_unlock(&server->srv_lock); 499 } 500 501 static int 502 cifs_ses_add_channel(struct cifs_ses *ses, 503 struct cifs_server_iface *iface) 504 { 505 struct TCP_Server_Info *chan_server; 506 struct cifs_chan *chan; 507 struct smb3_fs_context *ctx; 508 static const char unc_fmt[] = "\\%s\\foo"; 509 struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr; 510 struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr; 511 size_t len; 512 int rc; 513 unsigned int xid = get_xid(); 514 515 if (iface->sockaddr.ss_family == AF_INET) 516 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n", 517 ses, iface->speed, str_yes_no(iface->rdma_capable), 518 &ipv4->sin_addr); 519 else 520 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI6)\n", 521 ses, iface->speed, str_yes_no(iface->rdma_capable), 522 &ipv6->sin6_addr); 523 524 /* 525 * Setup a ctx with mostly the same info as the existing 526 * session and overwrite it with the requested iface data. 527 * 528 * We need to setup at least the fields used for negprot and 529 * sesssetup. 530 * 531 * We only need the ctx here, so we can reuse memory from 532 * the session and server without caring about memory 533 * management. 534 */ 535 ctx = kzalloc_obj(*ctx); 536 if (!ctx) { 537 rc = -ENOMEM; 538 goto out_free_xid; 539 } 540 541 /* Always make new connection for now (TODO?) */ 542 ctx->nosharesock = true; 543 544 /* Auth */ 545 ctx->domainauto = ses->domainAuto; 546 ctx->domainname = ses->domainName; 547 548 ctx->server_hostname = ses->server->hostname; 549 550 ctx->username = ses->user_name; 551 ctx->password = ses->password; 552 ctx->sectype = ses->sectype; 553 ctx->sign = ses->sign; 554 ctx->unicode = ses->unicode; 555 556 /* UNC and paths */ 557 /* XXX: Use ses->server->hostname? */ 558 len = sizeof(unc_fmt) + SERVER_NAME_LEN_WITH_NULL; 559 ctx->UNC = kzalloc(len, GFP_KERNEL); 560 if (!ctx->UNC) { 561 rc = -ENOMEM; 562 goto out_free_ctx; 563 } 564 scnprintf(ctx->UNC, len, unc_fmt, ses->ip_addr); 565 ctx->prepath = ""; 566 567 /* Reuse same version as master connection */ 568 ctx->vals = ses->server->vals; 569 ctx->ops = ses->server->ops; 570 571 ctx->noblocksnd = ses->server->noblocksnd; 572 ctx->noautotune = ses->server->noautotune; 573 ctx->sockopt_tcp_nodelay = ses->server->tcp_nodelay; 574 ctx->echo_interval = ses->server->echo_interval / HZ; 575 ctx->max_credits = ses->server->max_credits; 576 ctx->min_offload = ses->server->min_offload; 577 ctx->compress = ses->server->compression.requested; 578 ctx->dfs_conn = ses->server->dfs_conn; 579 ctx->ignore_signature = ses->server->ignore_signature; 580 ctx->leaf_fullpath = ses->server->leaf_fullpath; 581 ctx->rootfs = ses->server->noblockcnt; 582 ctx->retrans = ses->server->retrans; 583 584 /* 585 * This will be used for encoding/decoding user/domain/pw 586 * during sess setup auth. 587 */ 588 ctx->local_nls = ses->local_nls; 589 590 /* Use RDMA if possible */ 591 ctx->rdma = iface->rdma_capable; 592 memcpy(&ctx->dstaddr, &iface->sockaddr, sizeof(ctx->dstaddr)); 593 594 /* reuse master con client guid */ 595 memcpy(&ctx->client_guid, ses->server->client_guid, 596 sizeof(ctx->client_guid)); 597 ctx->use_client_guid = true; 598 599 chan_server = cifs_get_tcp_session(ctx, ses->server); 600 601 spin_lock(&ses->chan_lock); 602 chan = &ses->chans[ses->chan_count]; 603 chan->server = chan_server; 604 if (IS_ERR(chan->server)) { 605 rc = PTR_ERR(chan->server); 606 chan->server = NULL; 607 spin_unlock(&ses->chan_lock); 608 goto out; 609 } 610 chan->iface = iface; 611 ses->chan_count++; 612 atomic_set(&ses->chan_seq, 0); 613 614 /* Mark this channel as needing connect/setup */ 615 cifs_chan_set_need_reconnect(ses, chan->server); 616 617 spin_unlock(&ses->chan_lock); 618 619 mutex_lock(&ses->session_mutex); 620 621 rc = cifs_negotiate_protocol(xid, ses, chan->server); 622 if (!rc) 623 rc = cifs_setup_session(xid, ses, chan->server, ses->local_nls); 624 625 mutex_unlock(&ses->session_mutex); 626 627 out: 628 if (rc && chan->server) { 629 cifs_put_tcp_session(chan->server, 0); 630 631 spin_lock(&ses->chan_lock); 632 633 /* we rely on all bits beyond chan_count to be clear */ 634 cifs_chan_clear_need_reconnect(ses, chan->server); 635 ses->chan_count--; 636 /* 637 * chan_count should never reach 0 as at least the primary 638 * channel is always allocated 639 */ 640 WARN_ON(ses->chan_count < 1); 641 spin_unlock(&ses->chan_lock); 642 } 643 644 kfree(ctx->UNC); 645 out_free_ctx: 646 kfree(ctx); 647 out_free_xid: 648 free_xid(xid); 649 return rc; 650 } 651 652 653 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, 654 struct cifs_ses *ses) 655 { 656 unsigned int tioffset; /* challenge message target info area */ 657 unsigned int tilen; /* challenge message target info area length */ 658 CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr; 659 __u32 server_flags; 660 661 if (blob_len < sizeof(CHALLENGE_MESSAGE)) { 662 cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len); 663 return -EINVAL; 664 } 665 666 if (memcmp(pblob->Signature, "NTLMSSP", 8)) { 667 cifs_dbg(VFS, "blob signature incorrect %s\n", 668 pblob->Signature); 669 return -EINVAL; 670 } 671 if (pblob->MessageType != NtLmChallenge) { 672 cifs_dbg(VFS, "Incorrect message type %d\n", 673 pblob->MessageType); 674 return -EINVAL; 675 } 676 677 server_flags = le32_to_cpu(pblob->NegotiateFlags); 678 cifs_dbg(FYI, "%s: negotiate=0x%08x challenge=0x%08x\n", __func__, 679 ses->ntlmssp->client_flags, server_flags); 680 681 if ((ses->ntlmssp->client_flags & (NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN)) && 682 (!(server_flags & NTLMSSP_NEGOTIATE_56) && !(server_flags & NTLMSSP_NEGOTIATE_128))) { 683 cifs_dbg(VFS, "%s: requested signing/encryption but server did not return either 56-bit or 128-bit session key size\n", 684 __func__); 685 return -EINVAL; 686 } 687 if (!(server_flags & NTLMSSP_NEGOTIATE_NTLM) && !(server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) { 688 cifs_dbg(VFS, "%s: server does not seem to support either NTLMv1 or NTLMv2\n", __func__); 689 return -EINVAL; 690 } 691 if (ses->server->sign && !(server_flags & NTLMSSP_NEGOTIATE_SIGN)) { 692 cifs_dbg(VFS, "%s: forced packet signing but server does not seem to support it\n", 693 __func__); 694 return -EOPNOTSUPP; 695 } 696 if ((ses->ntlmssp->client_flags & NTLMSSP_NEGOTIATE_KEY_XCH) && 697 !(server_flags & NTLMSSP_NEGOTIATE_KEY_XCH)) 698 pr_warn_once("%s: authentication has been weakened as server does not support key exchange\n", 699 __func__); 700 701 ses->ntlmssp->server_flags = server_flags; 702 703 memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE); 704 /* 705 * In particular we can examine sign flags 706 * 707 * BB spec says that if AvId field of MsvAvTimestamp is populated then 708 * we must set the MIC field of the AUTHENTICATE_MESSAGE 709 */ 710 711 tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset); 712 tilen = le16_to_cpu(pblob->TargetInfoArray.Length); 713 if (tioffset > blob_len || tioffset + tilen > blob_len) { 714 cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n", 715 tioffset, tilen); 716 return -EINVAL; 717 } 718 if (tilen) { 719 kfree_sensitive(ses->auth_key.response); 720 ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen, 721 GFP_KERNEL); 722 if (!ses->auth_key.response) { 723 cifs_dbg(VFS, "Challenge target info alloc failure\n"); 724 return -ENOMEM; 725 } 726 ses->auth_key.len = tilen; 727 } 728 729 return 0; 730 } 731 732 static int size_of_ntlmssp_blob(struct cifs_ses *ses, int base_size) 733 { 734 int sz = base_size + ses->auth_key.len 735 - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2; 736 737 if (ses->domainName) 738 sz += sizeof(__le16) * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN); 739 else 740 sz += sizeof(__le16); 741 742 if (ses->user_name) 743 sz += sizeof(__le16) * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN); 744 else 745 sz += sizeof(__le16); 746 747 if (ses->workstation_name[0]) 748 sz += sizeof(__le16) * strnlen(ses->workstation_name, 749 ntlmssp_workstation_name_size(ses)); 750 else 751 sz += sizeof(__le16); 752 753 return sz; 754 } 755 756 static inline void cifs_security_buffer_from_str(SECURITY_BUFFER *pbuf, 757 char *str_value, 758 int str_length, 759 unsigned char *pstart, 760 unsigned char **pcur, 761 const struct nls_table *nls_cp) 762 { 763 unsigned char *tmp = pstart; 764 int len; 765 766 if (!pbuf) 767 return; 768 769 if (!pcur) 770 pcur = &tmp; 771 772 if (!str_value) { 773 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart); 774 pbuf->Length = 0; 775 pbuf->MaximumLength = 0; 776 *pcur += sizeof(__le16); 777 } else { 778 len = cifs_strtoUTF16((__le16 *)*pcur, 779 str_value, 780 str_length, 781 nls_cp); 782 len *= sizeof(__le16); 783 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart); 784 pbuf->Length = cpu_to_le16(len); 785 pbuf->MaximumLength = cpu_to_le16(len); 786 *pcur += len; 787 } 788 } 789 790 /* BB Move to ntlmssp.c eventually */ 791 792 int build_ntlmssp_negotiate_blob(unsigned char **pbuffer, 793 u16 *buflen, 794 struct cifs_ses *ses, 795 struct TCP_Server_Info *server, 796 const struct nls_table *nls_cp) 797 { 798 int rc = 0; 799 NEGOTIATE_MESSAGE *sec_blob; 800 __u32 flags; 801 unsigned char *tmp; 802 int len; 803 804 len = size_of_ntlmssp_blob(ses, sizeof(NEGOTIATE_MESSAGE)); 805 *pbuffer = kmalloc(len, GFP_KERNEL); 806 if (!*pbuffer) { 807 rc = -ENOMEM; 808 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc); 809 *buflen = 0; 810 goto setup_ntlm_neg_ret; 811 } 812 sec_blob = (NEGOTIATE_MESSAGE *)*pbuffer; 813 814 memset(*pbuffer, 0, sizeof(NEGOTIATE_MESSAGE)); 815 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8); 816 sec_blob->MessageType = NtLmNegotiate; 817 818 /* BB is NTLMV2 session security format easier to use here? */ 819 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET | 820 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | 821 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC | 822 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL | 823 NTLMSSP_NEGOTIATE_SIGN; 824 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess) 825 flags |= NTLMSSP_NEGOTIATE_KEY_XCH; 826 827 tmp = *pbuffer + sizeof(NEGOTIATE_MESSAGE); 828 ses->ntlmssp->client_flags = flags; 829 sec_blob->NegotiateFlags = cpu_to_le32(flags); 830 831 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */ 832 cifs_security_buffer_from_str(&sec_blob->DomainName, 833 NULL, 834 CIFS_MAX_DOMAINNAME_LEN, 835 *pbuffer, &tmp, 836 nls_cp); 837 838 cifs_security_buffer_from_str(&sec_blob->WorkstationName, 839 NULL, 840 CIFS_MAX_WORKSTATION_LEN, 841 *pbuffer, &tmp, 842 nls_cp); 843 844 *buflen = tmp - *pbuffer; 845 setup_ntlm_neg_ret: 846 return rc; 847 } 848 849 /* 850 * Build ntlmssp blob with additional fields, such as version, 851 * supported by modern servers. For safety limit to SMB3 or later 852 * See notes in MS-NLMP Section 2.2.2.1 e.g. 853 */ 854 int build_ntlmssp_smb3_negotiate_blob(unsigned char **pbuffer, 855 u16 *buflen, 856 struct cifs_ses *ses, 857 struct TCP_Server_Info *server, 858 const struct nls_table *nls_cp) 859 { 860 int rc = 0; 861 struct negotiate_message *sec_blob; 862 __u32 flags; 863 unsigned char *tmp; 864 int len; 865 866 len = size_of_ntlmssp_blob(ses, sizeof(struct negotiate_message)); 867 *pbuffer = kmalloc(len, GFP_KERNEL); 868 if (!*pbuffer) { 869 rc = -ENOMEM; 870 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc); 871 *buflen = 0; 872 goto setup_ntlm_smb3_neg_ret; 873 } 874 sec_blob = (struct negotiate_message *)*pbuffer; 875 876 memset(*pbuffer, 0, sizeof(struct negotiate_message)); 877 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8); 878 sec_blob->MessageType = NtLmNegotiate; 879 880 /* BB is NTLMV2 session security format easier to use here? */ 881 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET | 882 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | 883 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC | 884 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL | 885 NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_VERSION; 886 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess) 887 flags |= NTLMSSP_NEGOTIATE_KEY_XCH; 888 889 sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR; 890 sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL; 891 sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD); 892 sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3; 893 894 tmp = *pbuffer + sizeof(struct negotiate_message); 895 ses->ntlmssp->client_flags = flags; 896 sec_blob->NegotiateFlags = cpu_to_le32(flags); 897 898 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */ 899 cifs_security_buffer_from_str(&sec_blob->DomainName, 900 NULL, 901 CIFS_MAX_DOMAINNAME_LEN, 902 *pbuffer, &tmp, 903 nls_cp); 904 905 cifs_security_buffer_from_str(&sec_blob->WorkstationName, 906 NULL, 907 CIFS_MAX_WORKSTATION_LEN, 908 *pbuffer, &tmp, 909 nls_cp); 910 911 *buflen = tmp - *pbuffer; 912 setup_ntlm_smb3_neg_ret: 913 return rc; 914 } 915 916 917 /* See MS-NLMP 2.2.1.3 */ 918 int build_ntlmssp_auth_blob(unsigned char **pbuffer, 919 u16 *buflen, 920 struct cifs_ses *ses, 921 struct TCP_Server_Info *server, 922 const struct nls_table *nls_cp) 923 { 924 int rc; 925 AUTHENTICATE_MESSAGE *sec_blob; 926 __u32 flags; 927 unsigned char *tmp; 928 int len; 929 930 rc = setup_ntlmv2_rsp(ses, nls_cp); 931 if (rc) { 932 cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc); 933 *buflen = 0; 934 goto setup_ntlmv2_ret; 935 } 936 937 len = size_of_ntlmssp_blob(ses, sizeof(AUTHENTICATE_MESSAGE)); 938 *pbuffer = kmalloc(len, GFP_KERNEL); 939 if (!*pbuffer) { 940 rc = -ENOMEM; 941 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc); 942 *buflen = 0; 943 goto setup_ntlmv2_ret; 944 } 945 sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer; 946 947 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8); 948 sec_blob->MessageType = NtLmAuthenticate; 949 950 /* send version information in ntlmssp authenticate also */ 951 flags = ses->ntlmssp->server_flags | NTLMSSP_REQUEST_TARGET | 952 NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_VERSION | 953 NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED; 954 955 sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR; 956 sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL; 957 sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD); 958 sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3; 959 960 tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE); 961 sec_blob->NegotiateFlags = cpu_to_le32(flags); 962 963 sec_blob->LmChallengeResponse.BufferOffset = 964 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE)); 965 sec_blob->LmChallengeResponse.Length = 0; 966 sec_blob->LmChallengeResponse.MaximumLength = 0; 967 968 sec_blob->NtChallengeResponse.BufferOffset = 969 cpu_to_le32(tmp - *pbuffer); 970 if (ses->user_name != NULL) { 971 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE, 972 ses->auth_key.len - CIFS_SESS_KEY_SIZE); 973 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE; 974 975 sec_blob->NtChallengeResponse.Length = 976 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); 977 sec_blob->NtChallengeResponse.MaximumLength = 978 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); 979 } else { 980 /* 981 * don't send an NT Response for anonymous access 982 */ 983 sec_blob->NtChallengeResponse.Length = 0; 984 sec_blob->NtChallengeResponse.MaximumLength = 0; 985 } 986 987 cifs_security_buffer_from_str(&sec_blob->DomainName, 988 ses->domainName, 989 CIFS_MAX_DOMAINNAME_LEN, 990 *pbuffer, &tmp, 991 nls_cp); 992 993 cifs_security_buffer_from_str(&sec_blob->UserName, 994 ses->user_name, 995 CIFS_MAX_USERNAME_LEN, 996 *pbuffer, &tmp, 997 nls_cp); 998 999 cifs_security_buffer_from_str(&sec_blob->WorkstationName, 1000 ses->workstation_name, 1001 ntlmssp_workstation_name_size(ses), 1002 *pbuffer, &tmp, 1003 nls_cp); 1004 1005 if ((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) && 1006 (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) && 1007 !calc_seckey(ses)) { 1008 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE); 1009 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer); 1010 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE); 1011 sec_blob->SessionKey.MaximumLength = 1012 cpu_to_le16(CIFS_CPHTXT_SIZE); 1013 tmp += CIFS_CPHTXT_SIZE; 1014 } else { 1015 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer); 1016 sec_blob->SessionKey.Length = 0; 1017 sec_blob->SessionKey.MaximumLength = 0; 1018 } 1019 1020 *buflen = tmp - *pbuffer; 1021 setup_ntlmv2_ret: 1022 return rc; 1023 } 1024 1025 enum securityEnum 1026 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested) 1027 { 1028 switch (server->negflavor) { 1029 case CIFS_NEGFLAVOR_EXTENDED: 1030 switch (requested) { 1031 case Kerberos: 1032 case RawNTLMSSP: 1033 case IAKerb: 1034 return requested; 1035 case Unspecified: 1036 if (server->sec_ntlmssp && 1037 (global_secflags & CIFSSEC_MAY_NTLMSSP)) 1038 return RawNTLMSSP; 1039 if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) && 1040 (global_secflags & CIFSSEC_MAY_KRB5)) 1041 return Kerberos; 1042 fallthrough; 1043 default: 1044 return Unspecified; 1045 } 1046 case CIFS_NEGFLAVOR_UNENCAP: 1047 switch (requested) { 1048 case NTLMv2: 1049 return requested; 1050 case Unspecified: 1051 if (global_secflags & CIFSSEC_MAY_NTLMV2) 1052 return NTLMv2; 1053 break; 1054 default: 1055 break; 1056 } 1057 fallthrough; 1058 default: 1059 return Unspecified; 1060 } 1061 } 1062