xref: /linux/fs/smb/client/sess.c (revision 2c1ed907520c50326b8f604907a8478b27881a2e)
1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3  *
4  *   SMB/CIFS session setup handling routines
5  *
6  *   Copyright (c) International Business Machines  Corp., 2006, 2009
7  *   Author(s): Steve French (sfrench@us.ibm.com)
8  *
9  */
10 
11 #include "cifspdu.h"
12 #include "cifsglob.h"
13 #include "cifsproto.h"
14 #include "cifs_unicode.h"
15 #include "cifs_debug.h"
16 #include "ntlmssp.h"
17 #include "nterr.h"
18 #include <linux/utsname.h>
19 #include <linux/slab.h>
20 #include <linux/version.h>
21 #include "cifsfs.h"
22 #include "cifs_spnego.h"
23 #include "smb2proto.h"
24 #include "fs_context.h"
25 
26 static int
27 cifs_ses_add_channel(struct cifs_ses *ses,
28 		     struct cifs_server_iface *iface);
29 
is_ses_using_iface(struct cifs_ses * ses,struct cifs_server_iface * iface)30 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
31 {
32 	int i;
33 
34 	spin_lock(&ses->chan_lock);
35 	for (i = 0; i < ses->chan_count; i++) {
36 		if (ses->chans[i].iface == iface) {
37 			spin_unlock(&ses->chan_lock);
38 			return true;
39 		}
40 	}
41 	spin_unlock(&ses->chan_lock);
42 	return false;
43 }
44 
45 /* channel helper functions. assumed that chan_lock is held by caller. */
46 
47 int
cifs_ses_get_chan_index(struct cifs_ses * ses,struct TCP_Server_Info * server)48 cifs_ses_get_chan_index(struct cifs_ses *ses,
49 			struct TCP_Server_Info *server)
50 {
51 	unsigned int i;
52 
53 	/* if the channel is waiting for termination */
54 	if (server && server->terminate)
55 		return CIFS_INVAL_CHAN_INDEX;
56 
57 	for (i = 0; i < ses->chan_count; i++) {
58 		if (ses->chans[i].server == server)
59 			return i;
60 	}
61 
62 	/* If we didn't find the channel, it is likely a bug */
63 	if (server)
64 		cifs_dbg(VFS, "unable to get chan index for server: 0x%llx",
65 			 server->conn_id);
66 	return CIFS_INVAL_CHAN_INDEX;
67 }
68 
69 void
cifs_chan_set_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)70 cifs_chan_set_in_reconnect(struct cifs_ses *ses,
71 			     struct TCP_Server_Info *server)
72 {
73 	int chan_index = cifs_ses_get_chan_index(ses, server);
74 
75 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
76 		return;
77 
78 	ses->chans[chan_index].in_reconnect = true;
79 }
80 
81 void
cifs_chan_clear_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)82 cifs_chan_clear_in_reconnect(struct cifs_ses *ses,
83 			     struct TCP_Server_Info *server)
84 {
85 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
86 
87 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
88 		return;
89 
90 	ses->chans[chan_index].in_reconnect = false;
91 }
92 
93 void
cifs_chan_set_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)94 cifs_chan_set_need_reconnect(struct cifs_ses *ses,
95 			     struct TCP_Server_Info *server)
96 {
97 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
98 
99 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
100 		return;
101 
102 	set_bit(chan_index, &ses->chans_need_reconnect);
103 	cifs_dbg(FYI, "Set reconnect bitmask for chan %u; now 0x%lx\n",
104 		 chan_index, ses->chans_need_reconnect);
105 }
106 
107 void
cifs_chan_clear_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)108 cifs_chan_clear_need_reconnect(struct cifs_ses *ses,
109 			       struct TCP_Server_Info *server)
110 {
111 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
112 
113 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
114 		return;
115 
116 	clear_bit(chan_index, &ses->chans_need_reconnect);
117 	cifs_dbg(FYI, "Cleared reconnect bitmask for chan %u; now 0x%lx\n",
118 		 chan_index, ses->chans_need_reconnect);
119 }
120 
121 bool
cifs_chan_needs_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)122 cifs_chan_needs_reconnect(struct cifs_ses *ses,
123 			  struct TCP_Server_Info *server)
124 {
125 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
126 
127 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
128 		return true;	/* err on the safer side */
129 
130 	return CIFS_CHAN_NEEDS_RECONNECT(ses, chan_index);
131 }
132 
133 bool
cifs_chan_is_iface_active(struct cifs_ses * ses,struct TCP_Server_Info * server)134 cifs_chan_is_iface_active(struct cifs_ses *ses,
135 			  struct TCP_Server_Info *server)
136 {
137 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
138 
139 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
140 		return true;	/* err on the safer side */
141 
142 	return ses->chans[chan_index].iface &&
143 		ses->chans[chan_index].iface->is_active;
144 }
145 
146 /* returns number of channels added */
cifs_try_adding_channels(struct cifs_ses * ses)147 int cifs_try_adding_channels(struct cifs_ses *ses)
148 {
149 	struct TCP_Server_Info *server = ses->server;
150 	int old_chan_count, new_chan_count;
151 	int left;
152 	int rc = 0;
153 	int tries = 0;
154 	size_t iface_weight = 0, iface_min_speed = 0;
155 	struct cifs_server_iface *iface = NULL, *niface = NULL;
156 	struct cifs_server_iface *last_iface = NULL;
157 
158 	spin_lock(&ses->chan_lock);
159 
160 	new_chan_count = old_chan_count = ses->chan_count;
161 	left = ses->chan_max - ses->chan_count;
162 
163 	if (left <= 0) {
164 		spin_unlock(&ses->chan_lock);
165 		cifs_dbg(FYI,
166 			 "ses already at max_channels (%zu), nothing to open\n",
167 			 ses->chan_max);
168 		return 0;
169 	}
170 
171 	if (server->dialect < SMB30_PROT_ID) {
172 		spin_unlock(&ses->chan_lock);
173 		cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
174 		return 0;
175 	}
176 
177 	if (!(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
178 		spin_unlock(&ses->chan_lock);
179 		cifs_server_dbg(VFS, "no multichannel support\n");
180 		return 0;
181 	}
182 	spin_unlock(&ses->chan_lock);
183 
184 	while (left > 0) {
185 
186 		tries++;
187 		if (tries > 3*ses->chan_max) {
188 			cifs_dbg(VFS, "too many channel open attempts (%d channels left to open)\n",
189 				 left);
190 			break;
191 		}
192 
193 		spin_lock(&ses->iface_lock);
194 		if (!ses->iface_count) {
195 			spin_unlock(&ses->iface_lock);
196 			cifs_dbg(ONCE, "server %s does not advertise interfaces\n",
197 				      ses->server->hostname);
198 			break;
199 		}
200 
201 		if (!iface)
202 			iface = list_first_entry(&ses->iface_list, struct cifs_server_iface,
203 						 iface_head);
204 		last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
205 					     iface_head);
206 		iface_min_speed = last_iface->speed;
207 
208 		list_for_each_entry_safe_from(iface, niface, &ses->iface_list,
209 				    iface_head) {
210 			/* do not mix rdma and non-rdma interfaces */
211 			if (iface->rdma_capable != ses->server->rdma)
212 				continue;
213 
214 			/* skip ifaces that are unusable */
215 			if (!iface->is_active ||
216 			    (is_ses_using_iface(ses, iface) &&
217 			     !iface->rss_capable))
218 				continue;
219 
220 			/* check if we already allocated enough channels */
221 			iface_weight = iface->speed / iface_min_speed;
222 
223 			if (iface->weight_fulfilled >= iface_weight)
224 				continue;
225 
226 			/* take ref before unlock */
227 			kref_get(&iface->refcount);
228 
229 			spin_unlock(&ses->iface_lock);
230 			rc = cifs_ses_add_channel(ses, iface);
231 			spin_lock(&ses->iface_lock);
232 
233 			if (rc) {
234 				cifs_dbg(VFS, "failed to open extra channel on iface:%pIS rc=%d\n",
235 					 &iface->sockaddr,
236 					 rc);
237 				kref_put(&iface->refcount, release_iface);
238 				/* failure to add chan should increase weight */
239 				iface->weight_fulfilled++;
240 				continue;
241 			}
242 
243 			iface->num_channels++;
244 			iface->weight_fulfilled++;
245 			cifs_dbg(VFS, "successfully opened new channel on iface:%pIS\n",
246 				 &iface->sockaddr);
247 			break;
248 		}
249 
250 		/* reached end of list. reset weight_fulfilled and start over */
251 		if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
252 			list_for_each_entry(iface, &ses->iface_list, iface_head)
253 				iface->weight_fulfilled = 0;
254 			spin_unlock(&ses->iface_lock);
255 			iface = NULL;
256 			continue;
257 		}
258 		spin_unlock(&ses->iface_lock);
259 
260 		left--;
261 		new_chan_count++;
262 	}
263 
264 	return new_chan_count - old_chan_count;
265 }
266 
267 /*
268  * called when multichannel is disabled by the server.
269  * this always gets called from smb2_reconnect
270  * and cannot get called in parallel threads.
271  */
272 void
cifs_disable_secondary_channels(struct cifs_ses * ses)273 cifs_disable_secondary_channels(struct cifs_ses *ses)
274 {
275 	int i, chan_count;
276 	struct TCP_Server_Info *server;
277 	struct cifs_server_iface *iface;
278 
279 	spin_lock(&ses->chan_lock);
280 	chan_count = ses->chan_count;
281 	if (chan_count == 1)
282 		goto done;
283 
284 	ses->chan_count = 1;
285 
286 	/* for all secondary channels reset the need reconnect bit */
287 	ses->chans_need_reconnect &= 1;
288 
289 	for (i = 1; i < chan_count; i++) {
290 		iface = ses->chans[i].iface;
291 		server = ses->chans[i].server;
292 
293 		/*
294 		 * remove these references first, since we need to unlock
295 		 * the chan_lock here, since iface_lock is a higher lock
296 		 */
297 		ses->chans[i].iface = NULL;
298 		ses->chans[i].server = NULL;
299 		spin_unlock(&ses->chan_lock);
300 
301 		if (iface) {
302 			spin_lock(&ses->iface_lock);
303 			iface->num_channels--;
304 			if (iface->weight_fulfilled)
305 				iface->weight_fulfilled--;
306 			kref_put(&iface->refcount, release_iface);
307 			spin_unlock(&ses->iface_lock);
308 		}
309 
310 		if (server) {
311 			if (!server->terminate) {
312 				server->terminate = true;
313 				cifs_signal_cifsd_for_reconnect(server, false);
314 			}
315 			cifs_put_tcp_session(server, false);
316 		}
317 
318 		spin_lock(&ses->chan_lock);
319 	}
320 
321 done:
322 	spin_unlock(&ses->chan_lock);
323 }
324 
325 /* update the iface for the channel if necessary. */
326 void
cifs_chan_update_iface(struct cifs_ses * ses,struct TCP_Server_Info * server)327 cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server)
328 {
329 	unsigned int chan_index;
330 	size_t iface_weight = 0, iface_min_speed = 0;
331 	struct cifs_server_iface *iface = NULL;
332 	struct cifs_server_iface *old_iface = NULL;
333 	struct cifs_server_iface *last_iface = NULL;
334 	struct sockaddr_storage ss;
335 
336 	spin_lock(&ses->chan_lock);
337 	chan_index = cifs_ses_get_chan_index(ses, server);
338 	if (chan_index == CIFS_INVAL_CHAN_INDEX) {
339 		spin_unlock(&ses->chan_lock);
340 		return;
341 	}
342 
343 	if (ses->chans[chan_index].iface) {
344 		old_iface = ses->chans[chan_index].iface;
345 		if (old_iface->is_active) {
346 			spin_unlock(&ses->chan_lock);
347 			return;
348 		}
349 	}
350 	spin_unlock(&ses->chan_lock);
351 
352 	spin_lock(&server->srv_lock);
353 	ss = server->dstaddr;
354 	spin_unlock(&server->srv_lock);
355 
356 	spin_lock(&ses->iface_lock);
357 	if (!ses->iface_count) {
358 		spin_unlock(&ses->iface_lock);
359 		cifs_dbg(ONCE, "server %s does not advertise interfaces\n", ses->server->hostname);
360 		return;
361 	}
362 
363 	last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
364 				     iface_head);
365 	iface_min_speed = last_iface->speed;
366 
367 	/* then look for a new one */
368 	list_for_each_entry(iface, &ses->iface_list, iface_head) {
369 		if (!chan_index) {
370 			/* if we're trying to get the updated iface for primary channel */
371 			if (!cifs_match_ipaddr((struct sockaddr *) &ss,
372 					       (struct sockaddr *) &iface->sockaddr))
373 				continue;
374 
375 			kref_get(&iface->refcount);
376 			break;
377 		}
378 
379 		/* do not mix rdma and non-rdma interfaces */
380 		if (iface->rdma_capable != server->rdma)
381 			continue;
382 
383 		if (!iface->is_active ||
384 		    (is_ses_using_iface(ses, iface) &&
385 		     !iface->rss_capable)) {
386 			continue;
387 		}
388 
389 		/* check if we already allocated enough channels */
390 		iface_weight = iface->speed / iface_min_speed;
391 
392 		if (iface->weight_fulfilled >= iface_weight)
393 			continue;
394 
395 		kref_get(&iface->refcount);
396 		break;
397 	}
398 
399 	if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
400 		iface = NULL;
401 		cifs_dbg(FYI, "unable to find a suitable iface\n");
402 	}
403 
404 	if (!iface) {
405 		if (!chan_index)
406 			cifs_dbg(FYI, "unable to get the interface matching: %pIS\n",
407 				 &ss);
408 		else {
409 			cifs_dbg(FYI, "unable to find another interface to replace: %pIS\n",
410 				 &old_iface->sockaddr);
411 		}
412 
413 		spin_unlock(&ses->iface_lock);
414 		return;
415 	}
416 
417 	/* now drop the ref to the current iface */
418 	if (old_iface) {
419 		cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n",
420 			 &old_iface->sockaddr,
421 			 &iface->sockaddr);
422 
423 		old_iface->num_channels--;
424 		if (old_iface->weight_fulfilled)
425 			old_iface->weight_fulfilled--;
426 		iface->num_channels++;
427 		iface->weight_fulfilled++;
428 
429 		kref_put(&old_iface->refcount, release_iface);
430 	} else if (!chan_index) {
431 		/* special case: update interface for primary channel */
432 		cifs_dbg(FYI, "referencing primary channel iface: %pIS\n",
433 			 &iface->sockaddr);
434 		iface->num_channels++;
435 		iface->weight_fulfilled++;
436 	}
437 	spin_unlock(&ses->iface_lock);
438 
439 	spin_lock(&ses->chan_lock);
440 	chan_index = cifs_ses_get_chan_index(ses, server);
441 	if (chan_index == CIFS_INVAL_CHAN_INDEX) {
442 		spin_unlock(&ses->chan_lock);
443 		return;
444 	}
445 
446 	ses->chans[chan_index].iface = iface;
447 	spin_unlock(&ses->chan_lock);
448 }
449 
450 static int
cifs_ses_add_channel(struct cifs_ses * ses,struct cifs_server_iface * iface)451 cifs_ses_add_channel(struct cifs_ses *ses,
452 		     struct cifs_server_iface *iface)
453 {
454 	struct TCP_Server_Info *chan_server;
455 	struct cifs_chan *chan;
456 	struct smb3_fs_context *ctx;
457 	static const char unc_fmt[] = "\\%s\\foo";
458 	struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
459 	struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
460 	size_t len;
461 	int rc;
462 	unsigned int xid = get_xid();
463 
464 	if (iface->sockaddr.ss_family == AF_INET)
465 		cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
466 			 ses, iface->speed, str_yes_no(iface->rdma_capable),
467 			 &ipv4->sin_addr);
468 	else
469 		cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI6)\n",
470 			 ses, iface->speed, str_yes_no(iface->rdma_capable),
471 			 &ipv6->sin6_addr);
472 
473 	/*
474 	 * Setup a ctx with mostly the same info as the existing
475 	 * session and overwrite it with the requested iface data.
476 	 *
477 	 * We need to setup at least the fields used for negprot and
478 	 * sesssetup.
479 	 *
480 	 * We only need the ctx here, so we can reuse memory from
481 	 * the session and server without caring about memory
482 	 * management.
483 	 */
484 	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
485 	if (!ctx) {
486 		rc = -ENOMEM;
487 		goto out_free_xid;
488 	}
489 
490 	/* Always make new connection for now (TODO?) */
491 	ctx->nosharesock = true;
492 
493 	/* Auth */
494 	ctx->domainauto = ses->domainAuto;
495 	ctx->domainname = ses->domainName;
496 
497 	/* no hostname for extra channels */
498 	ctx->server_hostname = "";
499 
500 	ctx->username = ses->user_name;
501 	ctx->password = ses->password;
502 	ctx->sectype = ses->sectype;
503 	ctx->sign = ses->sign;
504 
505 	/* UNC and paths */
506 	/* XXX: Use ses->server->hostname? */
507 	len = sizeof(unc_fmt) + SERVER_NAME_LEN_WITH_NULL;
508 	ctx->UNC = kzalloc(len, GFP_KERNEL);
509 	if (!ctx->UNC) {
510 		rc = -ENOMEM;
511 		goto out_free_ctx;
512 	}
513 	scnprintf(ctx->UNC, len, unc_fmt, ses->ip_addr);
514 	ctx->prepath = "";
515 
516 	/* Reuse same version as master connection */
517 	ctx->vals = ses->server->vals;
518 	ctx->ops = ses->server->ops;
519 
520 	ctx->noblocksnd = ses->server->noblocksnd;
521 	ctx->noautotune = ses->server->noautotune;
522 	ctx->sockopt_tcp_nodelay = ses->server->tcp_nodelay;
523 	ctx->echo_interval = ses->server->echo_interval / HZ;
524 	ctx->max_credits = ses->server->max_credits;
525 
526 	/*
527 	 * This will be used for encoding/decoding user/domain/pw
528 	 * during sess setup auth.
529 	 */
530 	ctx->local_nls = ses->local_nls;
531 
532 	/* Use RDMA if possible */
533 	ctx->rdma = iface->rdma_capable;
534 	memcpy(&ctx->dstaddr, &iface->sockaddr, sizeof(ctx->dstaddr));
535 
536 	/* reuse master con client guid */
537 	memcpy(&ctx->client_guid, ses->server->client_guid,
538 	       sizeof(ctx->client_guid));
539 	ctx->use_client_guid = true;
540 
541 	chan_server = cifs_get_tcp_session(ctx, ses->server);
542 
543 	spin_lock(&ses->chan_lock);
544 	chan = &ses->chans[ses->chan_count];
545 	chan->server = chan_server;
546 	if (IS_ERR(chan->server)) {
547 		rc = PTR_ERR(chan->server);
548 		chan->server = NULL;
549 		spin_unlock(&ses->chan_lock);
550 		goto out;
551 	}
552 	chan->iface = iface;
553 	ses->chan_count++;
554 	atomic_set(&ses->chan_seq, 0);
555 
556 	/* Mark this channel as needing connect/setup */
557 	cifs_chan_set_need_reconnect(ses, chan->server);
558 
559 	spin_unlock(&ses->chan_lock);
560 
561 	mutex_lock(&ses->session_mutex);
562 	/*
563 	 * We need to allocate the server crypto now as we will need
564 	 * to sign packets before we generate the channel signing key
565 	 * (we sign with the session key)
566 	 */
567 	rc = smb311_crypto_shash_allocate(chan->server);
568 	if (rc) {
569 		cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
570 		mutex_unlock(&ses->session_mutex);
571 		goto out;
572 	}
573 
574 	rc = cifs_negotiate_protocol(xid, ses, chan->server);
575 	if (!rc)
576 		rc = cifs_setup_session(xid, ses, chan->server, ses->local_nls);
577 
578 	mutex_unlock(&ses->session_mutex);
579 
580 out:
581 	if (rc && chan->server) {
582 		cifs_put_tcp_session(chan->server, 0);
583 
584 		spin_lock(&ses->chan_lock);
585 
586 		/* we rely on all bits beyond chan_count to be clear */
587 		cifs_chan_clear_need_reconnect(ses, chan->server);
588 		ses->chan_count--;
589 		/*
590 		 * chan_count should never reach 0 as at least the primary
591 		 * channel is always allocated
592 		 */
593 		WARN_ON(ses->chan_count < 1);
594 		spin_unlock(&ses->chan_lock);
595 	}
596 
597 	kfree(ctx->UNC);
598 out_free_ctx:
599 	kfree(ctx);
600 out_free_xid:
601 	free_xid(xid);
602 	return rc;
603 }
604 
605 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
cifs_ssetup_hdr(struct cifs_ses * ses,struct TCP_Server_Info * server,SESSION_SETUP_ANDX * pSMB)606 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses,
607 			     struct TCP_Server_Info *server,
608 			     SESSION_SETUP_ANDX *pSMB)
609 {
610 	__u32 capabilities = 0;
611 
612 	/* init fields common to all four types of SessSetup */
613 	/* Note that offsets for first seven fields in req struct are same  */
614 	/*	in CIFS Specs so does not matter which of 3 forms of struct */
615 	/*	that we use in next few lines                               */
616 	/* Note that header is initialized to zero in header_assemble */
617 	pSMB->req.AndXCommand = 0xFF;
618 	pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
619 					CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
620 					USHRT_MAX));
621 	pSMB->req.MaxMpxCount = cpu_to_le16(server->maxReq);
622 	pSMB->req.VcNumber = cpu_to_le16(1);
623 
624 	/* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
625 
626 	/* BB verify whether signing required on neg or just auth frame (and NTLM case) */
627 
628 	capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
629 			CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
630 
631 	if (server->sign)
632 		pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
633 
634 	if (ses->capabilities & CAP_UNICODE) {
635 		pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
636 		capabilities |= CAP_UNICODE;
637 	}
638 	if (ses->capabilities & CAP_STATUS32) {
639 		pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
640 		capabilities |= CAP_STATUS32;
641 	}
642 	if (ses->capabilities & CAP_DFS) {
643 		pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
644 		capabilities |= CAP_DFS;
645 	}
646 	if (ses->capabilities & CAP_UNIX)
647 		capabilities |= CAP_UNIX;
648 
649 	return capabilities;
650 }
651 
652 static void
unicode_oslm_strings(char ** pbcc_area,const struct nls_table * nls_cp)653 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
654 {
655 	char *bcc_ptr = *pbcc_area;
656 	int bytes_ret = 0;
657 
658 	/* Copy OS version */
659 	bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
660 				    nls_cp);
661 	bcc_ptr += 2 * bytes_ret;
662 	bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
663 				    32, nls_cp);
664 	bcc_ptr += 2 * bytes_ret;
665 	bcc_ptr += 2; /* trailing null */
666 
667 	bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
668 				    32, nls_cp);
669 	bcc_ptr += 2 * bytes_ret;
670 	bcc_ptr += 2; /* trailing null */
671 
672 	*pbcc_area = bcc_ptr;
673 }
674 
unicode_domain_string(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)675 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
676 				   const struct nls_table *nls_cp)
677 {
678 	char *bcc_ptr = *pbcc_area;
679 	int bytes_ret = 0;
680 
681 	/* copy domain */
682 	if (ses->domainName == NULL) {
683 		/*
684 		 * Sending null domain better than using a bogus domain name (as
685 		 * we did briefly in 2.6.18) since server will use its default
686 		 */
687 		*bcc_ptr = 0;
688 		*(bcc_ptr+1) = 0;
689 		bytes_ret = 0;
690 	} else
691 		bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
692 					    CIFS_MAX_DOMAINNAME_LEN, nls_cp);
693 	bcc_ptr += 2 * bytes_ret;
694 	bcc_ptr += 2;  /* account for null terminator */
695 
696 	*pbcc_area = bcc_ptr;
697 }
698 
unicode_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)699 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
700 				   const struct nls_table *nls_cp)
701 {
702 	char *bcc_ptr = *pbcc_area;
703 	int bytes_ret = 0;
704 
705 	/* BB FIXME add check that strings less than 335 or will need to send as arrays */
706 
707 	/* copy user */
708 	if (ses->user_name == NULL) {
709 		/* null user mount */
710 		*bcc_ptr = 0;
711 		*(bcc_ptr+1) = 0;
712 	} else {
713 		bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
714 					    CIFS_MAX_USERNAME_LEN, nls_cp);
715 	}
716 	bcc_ptr += 2 * bytes_ret;
717 	bcc_ptr += 2; /* account for null termination */
718 
719 	unicode_domain_string(&bcc_ptr, ses, nls_cp);
720 	unicode_oslm_strings(&bcc_ptr, nls_cp);
721 
722 	*pbcc_area = bcc_ptr;
723 }
724 
ascii_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)725 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
726 				 const struct nls_table *nls_cp)
727 {
728 	char *bcc_ptr = *pbcc_area;
729 	int len;
730 
731 	/* copy user */
732 	/* BB what about null user mounts - check that we do this BB */
733 	/* copy user */
734 	if (ses->user_name != NULL) {
735 		len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
736 		if (WARN_ON_ONCE(len < 0))
737 			len = CIFS_MAX_USERNAME_LEN - 1;
738 		bcc_ptr += len;
739 	}
740 	/* else null user mount */
741 	*bcc_ptr = 0;
742 	bcc_ptr++; /* account for null termination */
743 
744 	/* copy domain */
745 	if (ses->domainName != NULL) {
746 		len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
747 		if (WARN_ON_ONCE(len < 0))
748 			len = CIFS_MAX_DOMAINNAME_LEN - 1;
749 		bcc_ptr += len;
750 	} /* else we send a null domain name so server will default to its own domain */
751 	*bcc_ptr = 0;
752 	bcc_ptr++;
753 
754 	/* BB check for overflow here */
755 
756 	strcpy(bcc_ptr, "Linux version ");
757 	bcc_ptr += strlen("Linux version ");
758 	strcpy(bcc_ptr, init_utsname()->release);
759 	bcc_ptr += strlen(init_utsname()->release) + 1;
760 
761 	strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
762 	bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
763 
764 	*pbcc_area = bcc_ptr;
765 }
766 
767 static void
decode_unicode_ssetup(char ** pbcc_area,int bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)768 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
769 		      const struct nls_table *nls_cp)
770 {
771 	int len;
772 	char *data = *pbcc_area;
773 
774 	cifs_dbg(FYI, "bleft %d\n", bleft);
775 
776 	kfree(ses->serverOS);
777 	ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
778 	cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
779 	len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
780 	data += len;
781 	bleft -= len;
782 	if (bleft <= 0)
783 		return;
784 
785 	kfree(ses->serverNOS);
786 	ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
787 	cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
788 	len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
789 	data += len;
790 	bleft -= len;
791 	if (bleft <= 0)
792 		return;
793 
794 	kfree(ses->serverDomain);
795 	ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
796 	cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
797 
798 	return;
799 }
800 
decode_ascii_ssetup(char ** pbcc_area,__u16 bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)801 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
802 				struct cifs_ses *ses,
803 				const struct nls_table *nls_cp)
804 {
805 	int len;
806 	char *bcc_ptr = *pbcc_area;
807 
808 	cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
809 
810 	len = strnlen(bcc_ptr, bleft);
811 	if (len >= bleft)
812 		return;
813 
814 	kfree(ses->serverOS);
815 
816 	ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
817 	if (ses->serverOS) {
818 		memcpy(ses->serverOS, bcc_ptr, len);
819 		ses->serverOS[len] = 0;
820 		if (strncmp(ses->serverOS, "OS/2", 4) == 0)
821 			cifs_dbg(FYI, "OS/2 server\n");
822 	}
823 
824 	bcc_ptr += len + 1;
825 	bleft -= len + 1;
826 
827 	len = strnlen(bcc_ptr, bleft);
828 	if (len >= bleft)
829 		return;
830 
831 	kfree(ses->serverNOS);
832 
833 	ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
834 	if (ses->serverNOS) {
835 		memcpy(ses->serverNOS, bcc_ptr, len);
836 		ses->serverNOS[len] = 0;
837 	}
838 
839 	bcc_ptr += len + 1;
840 	bleft -= len + 1;
841 
842 	len = strnlen(bcc_ptr, bleft);
843 	if (len > bleft)
844 		return;
845 
846 	/*
847 	 * No domain field in LANMAN case. Domain is
848 	 * returned by old servers in the SMB negprot response
849 	 *
850 	 * BB For newer servers which do not support Unicode,
851 	 * but thus do return domain here, we could add parsing
852 	 * for it later, but it is not very important
853 	 */
854 	cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
855 }
856 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
857 
decode_ntlmssp_challenge(char * bcc_ptr,int blob_len,struct cifs_ses * ses)858 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
859 				    struct cifs_ses *ses)
860 {
861 	unsigned int tioffset; /* challenge message target info area */
862 	unsigned int tilen; /* challenge message target info area length  */
863 	CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
864 	__u32 server_flags;
865 
866 	if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
867 		cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
868 		return -EINVAL;
869 	}
870 
871 	if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
872 		cifs_dbg(VFS, "blob signature incorrect %s\n",
873 			 pblob->Signature);
874 		return -EINVAL;
875 	}
876 	if (pblob->MessageType != NtLmChallenge) {
877 		cifs_dbg(VFS, "Incorrect message type %d\n",
878 			 pblob->MessageType);
879 		return -EINVAL;
880 	}
881 
882 	server_flags = le32_to_cpu(pblob->NegotiateFlags);
883 	cifs_dbg(FYI, "%s: negotiate=0x%08x challenge=0x%08x\n", __func__,
884 		 ses->ntlmssp->client_flags, server_flags);
885 
886 	if ((ses->ntlmssp->client_flags & (NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN)) &&
887 	    (!(server_flags & NTLMSSP_NEGOTIATE_56) && !(server_flags & NTLMSSP_NEGOTIATE_128))) {
888 		cifs_dbg(VFS, "%s: requested signing/encryption but server did not return either 56-bit or 128-bit session key size\n",
889 			 __func__);
890 		return -EINVAL;
891 	}
892 	if (!(server_flags & NTLMSSP_NEGOTIATE_NTLM) && !(server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) {
893 		cifs_dbg(VFS, "%s: server does not seem to support either NTLMv1 or NTLMv2\n", __func__);
894 		return -EINVAL;
895 	}
896 	if (ses->server->sign && !(server_flags & NTLMSSP_NEGOTIATE_SIGN)) {
897 		cifs_dbg(VFS, "%s: forced packet signing but server does not seem to support it\n",
898 			 __func__);
899 		return -EOPNOTSUPP;
900 	}
901 	if ((ses->ntlmssp->client_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
902 	    !(server_flags & NTLMSSP_NEGOTIATE_KEY_XCH))
903 		pr_warn_once("%s: authentication has been weakened as server does not support key exchange\n",
904 			     __func__);
905 
906 	ses->ntlmssp->server_flags = server_flags;
907 
908 	memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
909 	/*
910 	 * In particular we can examine sign flags
911 	 *
912 	 * BB spec says that if AvId field of MsvAvTimestamp is populated then
913 	 * we must set the MIC field of the AUTHENTICATE_MESSAGE
914 	 */
915 
916 	tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
917 	tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
918 	if (tioffset > blob_len || tioffset + tilen > blob_len) {
919 		cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
920 			 tioffset, tilen);
921 		return -EINVAL;
922 	}
923 	if (tilen) {
924 		kfree_sensitive(ses->auth_key.response);
925 		ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
926 						 GFP_KERNEL);
927 		if (!ses->auth_key.response) {
928 			cifs_dbg(VFS, "Challenge target info alloc failure\n");
929 			return -ENOMEM;
930 		}
931 		ses->auth_key.len = tilen;
932 	}
933 
934 	return 0;
935 }
936 
size_of_ntlmssp_blob(struct cifs_ses * ses,int base_size)937 static int size_of_ntlmssp_blob(struct cifs_ses *ses, int base_size)
938 {
939 	int sz = base_size + ses->auth_key.len
940 		- CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
941 
942 	if (ses->domainName)
943 		sz += sizeof(__le16) * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
944 	else
945 		sz += sizeof(__le16);
946 
947 	if (ses->user_name)
948 		sz += sizeof(__le16) * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
949 	else
950 		sz += sizeof(__le16);
951 
952 	if (ses->workstation_name[0])
953 		sz += sizeof(__le16) * strnlen(ses->workstation_name,
954 					       ntlmssp_workstation_name_size(ses));
955 	else
956 		sz += sizeof(__le16);
957 
958 	return sz;
959 }
960 
cifs_security_buffer_from_str(SECURITY_BUFFER * pbuf,char * str_value,int str_length,unsigned char * pstart,unsigned char ** pcur,const struct nls_table * nls_cp)961 static inline void cifs_security_buffer_from_str(SECURITY_BUFFER *pbuf,
962 						 char *str_value,
963 						 int str_length,
964 						 unsigned char *pstart,
965 						 unsigned char **pcur,
966 						 const struct nls_table *nls_cp)
967 {
968 	unsigned char *tmp = pstart;
969 	int len;
970 
971 	if (!pbuf)
972 		return;
973 
974 	if (!pcur)
975 		pcur = &tmp;
976 
977 	if (!str_value) {
978 		pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
979 		pbuf->Length = 0;
980 		pbuf->MaximumLength = 0;
981 		*pcur += sizeof(__le16);
982 	} else {
983 		len = cifs_strtoUTF16((__le16 *)*pcur,
984 				      str_value,
985 				      str_length,
986 				      nls_cp);
987 		len *= sizeof(__le16);
988 		pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
989 		pbuf->Length = cpu_to_le16(len);
990 		pbuf->MaximumLength = cpu_to_le16(len);
991 		*pcur += len;
992 	}
993 }
994 
995 /* BB Move to ntlmssp.c eventually */
996 
build_ntlmssp_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)997 int build_ntlmssp_negotiate_blob(unsigned char **pbuffer,
998 				 u16 *buflen,
999 				 struct cifs_ses *ses,
1000 				 struct TCP_Server_Info *server,
1001 				 const struct nls_table *nls_cp)
1002 {
1003 	int rc = 0;
1004 	NEGOTIATE_MESSAGE *sec_blob;
1005 	__u32 flags;
1006 	unsigned char *tmp;
1007 	int len;
1008 
1009 	len = size_of_ntlmssp_blob(ses, sizeof(NEGOTIATE_MESSAGE));
1010 	*pbuffer = kmalloc(len, GFP_KERNEL);
1011 	if (!*pbuffer) {
1012 		rc = -ENOMEM;
1013 		cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1014 		*buflen = 0;
1015 		goto setup_ntlm_neg_ret;
1016 	}
1017 	sec_blob = (NEGOTIATE_MESSAGE *)*pbuffer;
1018 
1019 	memset(*pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
1020 	memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1021 	sec_blob->MessageType = NtLmNegotiate;
1022 
1023 	/* BB is NTLMV2 session security format easier to use here? */
1024 	flags = NTLMSSP_NEGOTIATE_56 |	NTLMSSP_REQUEST_TARGET |
1025 		NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1026 		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1027 		NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1028 		NTLMSSP_NEGOTIATE_SIGN;
1029 	if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1030 		flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1031 
1032 	tmp = *pbuffer + sizeof(NEGOTIATE_MESSAGE);
1033 	ses->ntlmssp->client_flags = flags;
1034 	sec_blob->NegotiateFlags = cpu_to_le32(flags);
1035 
1036 	/* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1037 	cifs_security_buffer_from_str(&sec_blob->DomainName,
1038 				      NULL,
1039 				      CIFS_MAX_DOMAINNAME_LEN,
1040 				      *pbuffer, &tmp,
1041 				      nls_cp);
1042 
1043 	cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1044 				      NULL,
1045 				      CIFS_MAX_WORKSTATION_LEN,
1046 				      *pbuffer, &tmp,
1047 				      nls_cp);
1048 
1049 	*buflen = tmp - *pbuffer;
1050 setup_ntlm_neg_ret:
1051 	return rc;
1052 }
1053 
1054 /*
1055  * Build ntlmssp blob with additional fields, such as version,
1056  * supported by modern servers. For safety limit to SMB3 or later
1057  * See notes in MS-NLMP Section 2.2.2.1 e.g.
1058  */
build_ntlmssp_smb3_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1059 int build_ntlmssp_smb3_negotiate_blob(unsigned char **pbuffer,
1060 				 u16 *buflen,
1061 				 struct cifs_ses *ses,
1062 				 struct TCP_Server_Info *server,
1063 				 const struct nls_table *nls_cp)
1064 {
1065 	int rc = 0;
1066 	struct negotiate_message *sec_blob;
1067 	__u32 flags;
1068 	unsigned char *tmp;
1069 	int len;
1070 
1071 	len = size_of_ntlmssp_blob(ses, sizeof(struct negotiate_message));
1072 	*pbuffer = kmalloc(len, GFP_KERNEL);
1073 	if (!*pbuffer) {
1074 		rc = -ENOMEM;
1075 		cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1076 		*buflen = 0;
1077 		goto setup_ntlm_smb3_neg_ret;
1078 	}
1079 	sec_blob = (struct negotiate_message *)*pbuffer;
1080 
1081 	memset(*pbuffer, 0, sizeof(struct negotiate_message));
1082 	memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1083 	sec_blob->MessageType = NtLmNegotiate;
1084 
1085 	/* BB is NTLMV2 session security format easier to use here? */
1086 	flags = NTLMSSP_NEGOTIATE_56 |	NTLMSSP_REQUEST_TARGET |
1087 		NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1088 		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1089 		NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1090 		NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_VERSION;
1091 	if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1092 		flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1093 
1094 	sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1095 	sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1096 	sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1097 	sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1098 
1099 	tmp = *pbuffer + sizeof(struct negotiate_message);
1100 	ses->ntlmssp->client_flags = flags;
1101 	sec_blob->NegotiateFlags = cpu_to_le32(flags);
1102 
1103 	/* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1104 	cifs_security_buffer_from_str(&sec_blob->DomainName,
1105 				      NULL,
1106 				      CIFS_MAX_DOMAINNAME_LEN,
1107 				      *pbuffer, &tmp,
1108 				      nls_cp);
1109 
1110 	cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1111 				      NULL,
1112 				      CIFS_MAX_WORKSTATION_LEN,
1113 				      *pbuffer, &tmp,
1114 				      nls_cp);
1115 
1116 	*buflen = tmp - *pbuffer;
1117 setup_ntlm_smb3_neg_ret:
1118 	return rc;
1119 }
1120 
1121 
1122 /* See MS-NLMP 2.2.1.3 */
build_ntlmssp_auth_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1123 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
1124 					u16 *buflen,
1125 				   struct cifs_ses *ses,
1126 				   struct TCP_Server_Info *server,
1127 				   const struct nls_table *nls_cp)
1128 {
1129 	int rc;
1130 	AUTHENTICATE_MESSAGE *sec_blob;
1131 	__u32 flags;
1132 	unsigned char *tmp;
1133 	int len;
1134 
1135 	rc = setup_ntlmv2_rsp(ses, nls_cp);
1136 	if (rc) {
1137 		cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
1138 		*buflen = 0;
1139 		goto setup_ntlmv2_ret;
1140 	}
1141 
1142 	len = size_of_ntlmssp_blob(ses, sizeof(AUTHENTICATE_MESSAGE));
1143 	*pbuffer = kmalloc(len, GFP_KERNEL);
1144 	if (!*pbuffer) {
1145 		rc = -ENOMEM;
1146 		cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1147 		*buflen = 0;
1148 		goto setup_ntlmv2_ret;
1149 	}
1150 	sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
1151 
1152 	memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1153 	sec_blob->MessageType = NtLmAuthenticate;
1154 
1155 	/* send version information in ntlmssp authenticate also */
1156 	flags = ses->ntlmssp->server_flags | NTLMSSP_REQUEST_TARGET |
1157 		NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_VERSION |
1158 		NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED;
1159 
1160 	sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1161 	sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1162 	sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1163 	sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1164 
1165 	tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
1166 	sec_blob->NegotiateFlags = cpu_to_le32(flags);
1167 
1168 	sec_blob->LmChallengeResponse.BufferOffset =
1169 				cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
1170 	sec_blob->LmChallengeResponse.Length = 0;
1171 	sec_blob->LmChallengeResponse.MaximumLength = 0;
1172 
1173 	sec_blob->NtChallengeResponse.BufferOffset =
1174 				cpu_to_le32(tmp - *pbuffer);
1175 	if (ses->user_name != NULL) {
1176 		memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1177 				ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1178 		tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1179 
1180 		sec_blob->NtChallengeResponse.Length =
1181 				cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1182 		sec_blob->NtChallengeResponse.MaximumLength =
1183 				cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1184 	} else {
1185 		/*
1186 		 * don't send an NT Response for anonymous access
1187 		 */
1188 		sec_blob->NtChallengeResponse.Length = 0;
1189 		sec_blob->NtChallengeResponse.MaximumLength = 0;
1190 	}
1191 
1192 	cifs_security_buffer_from_str(&sec_blob->DomainName,
1193 				      ses->domainName,
1194 				      CIFS_MAX_DOMAINNAME_LEN,
1195 				      *pbuffer, &tmp,
1196 				      nls_cp);
1197 
1198 	cifs_security_buffer_from_str(&sec_blob->UserName,
1199 				      ses->user_name,
1200 				      CIFS_MAX_USERNAME_LEN,
1201 				      *pbuffer, &tmp,
1202 				      nls_cp);
1203 
1204 	cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1205 				      ses->workstation_name,
1206 				      ntlmssp_workstation_name_size(ses),
1207 				      *pbuffer, &tmp,
1208 				      nls_cp);
1209 
1210 	if ((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
1211 	    (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) &&
1212 	    !calc_seckey(ses)) {
1213 		memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
1214 		sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1215 		sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
1216 		sec_blob->SessionKey.MaximumLength =
1217 				cpu_to_le16(CIFS_CPHTXT_SIZE);
1218 		tmp += CIFS_CPHTXT_SIZE;
1219 	} else {
1220 		sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1221 		sec_blob->SessionKey.Length = 0;
1222 		sec_blob->SessionKey.MaximumLength = 0;
1223 	}
1224 
1225 	*buflen = tmp - *pbuffer;
1226 setup_ntlmv2_ret:
1227 	return rc;
1228 }
1229 
1230 enum securityEnum
cifs_select_sectype(struct TCP_Server_Info * server,enum securityEnum requested)1231 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
1232 {
1233 	switch (server->negflavor) {
1234 	case CIFS_NEGFLAVOR_EXTENDED:
1235 		switch (requested) {
1236 		case Kerberos:
1237 		case RawNTLMSSP:
1238 		case IAKerb:
1239 			return requested;
1240 		case Unspecified:
1241 			if (server->sec_ntlmssp &&
1242 			    (global_secflags & CIFSSEC_MAY_NTLMSSP))
1243 				return RawNTLMSSP;
1244 			if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) &&
1245 			    (global_secflags & CIFSSEC_MAY_KRB5))
1246 				return Kerberos;
1247 			fallthrough;
1248 		default:
1249 			return Unspecified;
1250 		}
1251 	case CIFS_NEGFLAVOR_UNENCAP:
1252 		switch (requested) {
1253 		case NTLMv2:
1254 			return requested;
1255 		case Unspecified:
1256 			if (global_secflags & CIFSSEC_MAY_NTLMV2)
1257 				return NTLMv2;
1258 			break;
1259 		default:
1260 			break;
1261 		}
1262 		fallthrough;
1263 	default:
1264 		return Unspecified;
1265 	}
1266 }
1267 
1268 struct sess_data {
1269 	unsigned int xid;
1270 	struct cifs_ses *ses;
1271 	struct TCP_Server_Info *server;
1272 	struct nls_table *nls_cp;
1273 	void (*func)(struct sess_data *);
1274 	int result;
1275 
1276 	/* we will send the SMB in three pieces:
1277 	 * a fixed length beginning part, an optional
1278 	 * SPNEGO blob (which can be zero length), and a
1279 	 * last part which will include the strings
1280 	 * and rest of bcc area. This allows us to avoid
1281 	 * a large buffer 17K allocation
1282 	 */
1283 	int buf0_type;
1284 	struct kvec iov[3];
1285 };
1286 
1287 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
1288 static int
sess_alloc_buffer(struct sess_data * sess_data,int wct)1289 sess_alloc_buffer(struct sess_data *sess_data, int wct)
1290 {
1291 	int rc;
1292 	struct cifs_ses *ses = sess_data->ses;
1293 	struct smb_hdr *smb_buf;
1294 
1295 	rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
1296 				  (void **)&smb_buf);
1297 
1298 	if (rc)
1299 		return rc;
1300 
1301 	sess_data->iov[0].iov_base = (char *)smb_buf;
1302 	sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
1303 	/*
1304 	 * This variable will be used to clear the buffer
1305 	 * allocated above in case of any error in the calling function.
1306 	 */
1307 	sess_data->buf0_type = CIFS_SMALL_BUFFER;
1308 
1309 	/* 2000 big enough to fit max user, domain, NOS name etc. */
1310 	sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
1311 	if (!sess_data->iov[2].iov_base) {
1312 		rc = -ENOMEM;
1313 		goto out_free_smb_buf;
1314 	}
1315 
1316 	return 0;
1317 
1318 out_free_smb_buf:
1319 	cifs_small_buf_release(smb_buf);
1320 	sess_data->iov[0].iov_base = NULL;
1321 	sess_data->iov[0].iov_len = 0;
1322 	sess_data->buf0_type = CIFS_NO_BUFFER;
1323 	return rc;
1324 }
1325 
1326 static void
sess_free_buffer(struct sess_data * sess_data)1327 sess_free_buffer(struct sess_data *sess_data)
1328 {
1329 	struct kvec *iov = sess_data->iov;
1330 
1331 	/*
1332 	 * Zero the session data before freeing, as it might contain sensitive info (keys, etc).
1333 	 * Note that iov[1] is already freed by caller.
1334 	 */
1335 	if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base)
1336 		memzero_explicit(iov[0].iov_base, iov[0].iov_len);
1337 
1338 	free_rsp_buf(sess_data->buf0_type, iov[0].iov_base);
1339 	sess_data->buf0_type = CIFS_NO_BUFFER;
1340 	kfree_sensitive(iov[2].iov_base);
1341 }
1342 
1343 static int
sess_establish_session(struct sess_data * sess_data)1344 sess_establish_session(struct sess_data *sess_data)
1345 {
1346 	struct cifs_ses *ses = sess_data->ses;
1347 	struct TCP_Server_Info *server = sess_data->server;
1348 
1349 	cifs_server_lock(server);
1350 	if (!server->session_estab) {
1351 		if (server->sign) {
1352 			server->session_key.response =
1353 				kmemdup(ses->auth_key.response,
1354 				ses->auth_key.len, GFP_KERNEL);
1355 			if (!server->session_key.response) {
1356 				cifs_server_unlock(server);
1357 				return -ENOMEM;
1358 			}
1359 			server->session_key.len =
1360 						ses->auth_key.len;
1361 		}
1362 		server->sequence_number = 0x2;
1363 		server->session_estab = true;
1364 	}
1365 	cifs_server_unlock(server);
1366 
1367 	cifs_dbg(FYI, "CIFS session established successfully\n");
1368 	return 0;
1369 }
1370 
1371 static int
sess_sendreceive(struct sess_data * sess_data)1372 sess_sendreceive(struct sess_data *sess_data)
1373 {
1374 	int rc;
1375 	struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
1376 	__u16 count;
1377 	struct kvec rsp_iov = { NULL, 0 };
1378 
1379 	count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
1380 	be32_add_cpu(&smb_buf->smb_buf_length, count);
1381 	put_bcc(count, smb_buf);
1382 
1383 	rc = SendReceive2(sess_data->xid, sess_data->ses,
1384 			  sess_data->iov, 3 /* num_iovecs */,
1385 			  &sess_data->buf0_type,
1386 			  CIFS_LOG_ERROR, &rsp_iov);
1387 	cifs_small_buf_release(sess_data->iov[0].iov_base);
1388 	memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
1389 
1390 	return rc;
1391 }
1392 
1393 static void
sess_auth_ntlmv2(struct sess_data * sess_data)1394 sess_auth_ntlmv2(struct sess_data *sess_data)
1395 {
1396 	int rc = 0;
1397 	struct smb_hdr *smb_buf;
1398 	SESSION_SETUP_ANDX *pSMB;
1399 	char *bcc_ptr;
1400 	struct cifs_ses *ses = sess_data->ses;
1401 	struct TCP_Server_Info *server = sess_data->server;
1402 	__u32 capabilities;
1403 	__u16 bytes_remaining;
1404 
1405 	/* old style NTLM sessionsetup */
1406 	/* wct = 13 */
1407 	rc = sess_alloc_buffer(sess_data, 13);
1408 	if (rc)
1409 		goto out;
1410 
1411 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1412 	bcc_ptr = sess_data->iov[2].iov_base;
1413 	capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1414 
1415 	pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1416 
1417 	/* LM2 password would be here if we supported it */
1418 	pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1419 
1420 	if (ses->user_name != NULL) {
1421 		/* calculate nlmv2 response and session key */
1422 		rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
1423 		if (rc) {
1424 			cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
1425 			goto out;
1426 		}
1427 
1428 		memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1429 				ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1430 		bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1431 
1432 		/* set case sensitive password length after tilen may get
1433 		 * assigned, tilen is 0 otherwise.
1434 		 */
1435 		pSMB->req_no_secext.CaseSensitivePasswordLength =
1436 			cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1437 	} else {
1438 		pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1439 	}
1440 
1441 	if (ses->capabilities & CAP_UNICODE) {
1442 		if (!IS_ALIGNED(sess_data->iov[0].iov_len, 2)) {
1443 			*bcc_ptr = 0;
1444 			bcc_ptr++;
1445 		}
1446 		unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1447 	} else {
1448 		ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1449 	}
1450 
1451 
1452 	sess_data->iov[2].iov_len = (long) bcc_ptr -
1453 			(long) sess_data->iov[2].iov_base;
1454 
1455 	rc = sess_sendreceive(sess_data);
1456 	if (rc)
1457 		goto out;
1458 
1459 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1460 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1461 
1462 	if (smb_buf->WordCount != 3) {
1463 		rc = -EIO;
1464 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1465 		goto out;
1466 	}
1467 
1468 	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1469 		cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1470 
1471 	ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1472 	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1473 
1474 	bytes_remaining = get_bcc(smb_buf);
1475 	bcc_ptr = pByteArea(smb_buf);
1476 
1477 	/* BB check if Unicode and decode strings */
1478 	if (bytes_remaining == 0) {
1479 		/* no string area to decode, do nothing */
1480 	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1481 		/* unicode string area must be word-aligned */
1482 		if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1483 			++bcc_ptr;
1484 			--bytes_remaining;
1485 		}
1486 		decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1487 				      sess_data->nls_cp);
1488 	} else {
1489 		decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1490 				    sess_data->nls_cp);
1491 	}
1492 
1493 	rc = sess_establish_session(sess_data);
1494 out:
1495 	sess_data->result = rc;
1496 	sess_data->func = NULL;
1497 	sess_free_buffer(sess_data);
1498 	kfree_sensitive(ses->auth_key.response);
1499 	ses->auth_key.response = NULL;
1500 }
1501 
1502 #ifdef CONFIG_CIFS_UPCALL
1503 static void
sess_auth_kerberos(struct sess_data * sess_data)1504 sess_auth_kerberos(struct sess_data *sess_data)
1505 {
1506 	int rc = 0;
1507 	struct smb_hdr *smb_buf;
1508 	SESSION_SETUP_ANDX *pSMB;
1509 	char *bcc_ptr;
1510 	struct cifs_ses *ses = sess_data->ses;
1511 	struct TCP_Server_Info *server = sess_data->server;
1512 	__u32 capabilities;
1513 	__u16 bytes_remaining;
1514 	struct key *spnego_key = NULL;
1515 	struct cifs_spnego_msg *msg;
1516 	u16 blob_len;
1517 
1518 	/* extended security */
1519 	/* wct = 12 */
1520 	rc = sess_alloc_buffer(sess_data, 12);
1521 	if (rc)
1522 		goto out;
1523 
1524 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1525 	bcc_ptr = sess_data->iov[2].iov_base;
1526 	capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1527 
1528 	spnego_key = cifs_get_spnego_key(ses, server);
1529 	if (IS_ERR(spnego_key)) {
1530 		rc = PTR_ERR(spnego_key);
1531 		spnego_key = NULL;
1532 		goto out;
1533 	}
1534 
1535 	msg = spnego_key->payload.data[0];
1536 	/*
1537 	 * check version field to make sure that cifs.upcall is
1538 	 * sending us a response in an expected form
1539 	 */
1540 	if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1541 		cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1542 			 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1543 		rc = -EKEYREJECTED;
1544 		goto out_put_spnego_key;
1545 	}
1546 
1547 	kfree_sensitive(ses->auth_key.response);
1548 	ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1549 					 GFP_KERNEL);
1550 	if (!ses->auth_key.response) {
1551 		cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1552 			 msg->sesskey_len);
1553 		rc = -ENOMEM;
1554 		goto out_put_spnego_key;
1555 	}
1556 	ses->auth_key.len = msg->sesskey_len;
1557 
1558 	pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1559 	capabilities |= CAP_EXTENDED_SECURITY;
1560 	pSMB->req.Capabilities = cpu_to_le32(capabilities);
1561 	sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1562 	sess_data->iov[1].iov_len = msg->secblob_len;
1563 	pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1564 
1565 	if (ses->capabilities & CAP_UNICODE) {
1566 		/* unicode strings must be word aligned */
1567 		if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1568 			*bcc_ptr = 0;
1569 			bcc_ptr++;
1570 		}
1571 		unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1572 		unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1573 	} else {
1574 		/* BB: is this right? */
1575 		ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1576 	}
1577 
1578 	sess_data->iov[2].iov_len = (long) bcc_ptr -
1579 			(long) sess_data->iov[2].iov_base;
1580 
1581 	rc = sess_sendreceive(sess_data);
1582 	if (rc)
1583 		goto out_put_spnego_key;
1584 
1585 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1586 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1587 
1588 	if (smb_buf->WordCount != 4) {
1589 		rc = -EIO;
1590 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1591 		goto out_put_spnego_key;
1592 	}
1593 
1594 	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1595 		cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1596 
1597 	ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1598 	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1599 
1600 	bytes_remaining = get_bcc(smb_buf);
1601 	bcc_ptr = pByteArea(smb_buf);
1602 
1603 	blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1604 	if (blob_len > bytes_remaining) {
1605 		cifs_dbg(VFS, "bad security blob length %d\n",
1606 				blob_len);
1607 		rc = -EINVAL;
1608 		goto out_put_spnego_key;
1609 	}
1610 	bcc_ptr += blob_len;
1611 	bytes_remaining -= blob_len;
1612 
1613 	/* BB check if Unicode and decode strings */
1614 	if (bytes_remaining == 0) {
1615 		/* no string area to decode, do nothing */
1616 	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1617 		/* unicode string area must be word-aligned */
1618 		if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1619 			++bcc_ptr;
1620 			--bytes_remaining;
1621 		}
1622 		decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1623 				      sess_data->nls_cp);
1624 	} else {
1625 		decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1626 				    sess_data->nls_cp);
1627 	}
1628 
1629 	rc = sess_establish_session(sess_data);
1630 out_put_spnego_key:
1631 	key_invalidate(spnego_key);
1632 	key_put(spnego_key);
1633 out:
1634 	sess_data->result = rc;
1635 	sess_data->func = NULL;
1636 	sess_free_buffer(sess_data);
1637 	kfree_sensitive(ses->auth_key.response);
1638 	ses->auth_key.response = NULL;
1639 }
1640 
1641 #endif /* ! CONFIG_CIFS_UPCALL */
1642 
1643 /*
1644  * The required kvec buffers have to be allocated before calling this
1645  * function.
1646  */
1647 static int
_sess_auth_rawntlmssp_assemble_req(struct sess_data * sess_data)1648 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1649 {
1650 	SESSION_SETUP_ANDX *pSMB;
1651 	struct cifs_ses *ses = sess_data->ses;
1652 	struct TCP_Server_Info *server = sess_data->server;
1653 	__u32 capabilities;
1654 	char *bcc_ptr;
1655 
1656 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1657 
1658 	capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1659 	if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) {
1660 		cifs_dbg(VFS, "NTLMSSP requires Unicode support\n");
1661 		return -ENOSYS;
1662 	}
1663 
1664 	pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1665 	capabilities |= CAP_EXTENDED_SECURITY;
1666 	pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1667 
1668 	bcc_ptr = sess_data->iov[2].iov_base;
1669 	/* unicode strings must be word aligned */
1670 	if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1671 		*bcc_ptr = 0;
1672 		bcc_ptr++;
1673 	}
1674 	unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1675 
1676 	sess_data->iov[2].iov_len = (long) bcc_ptr -
1677 					(long) sess_data->iov[2].iov_base;
1678 
1679 	return 0;
1680 }
1681 
1682 static void
1683 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1684 
1685 static void
sess_auth_rawntlmssp_negotiate(struct sess_data * sess_data)1686 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1687 {
1688 	int rc;
1689 	struct smb_hdr *smb_buf;
1690 	SESSION_SETUP_ANDX *pSMB;
1691 	struct cifs_ses *ses = sess_data->ses;
1692 	struct TCP_Server_Info *server = sess_data->server;
1693 	__u16 bytes_remaining;
1694 	char *bcc_ptr;
1695 	unsigned char *ntlmsspblob = NULL;
1696 	u16 blob_len;
1697 
1698 	cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1699 
1700 	/*
1701 	 * if memory allocation is successful, caller of this function
1702 	 * frees it.
1703 	 */
1704 	ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1705 	if (!ses->ntlmssp) {
1706 		rc = -ENOMEM;
1707 		goto out;
1708 	}
1709 	ses->ntlmssp->sesskey_per_smbsess = false;
1710 
1711 	/* wct = 12 */
1712 	rc = sess_alloc_buffer(sess_data, 12);
1713 	if (rc)
1714 		goto out;
1715 
1716 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1717 
1718 	/* Build security blob before we assemble the request */
1719 	rc = build_ntlmssp_negotiate_blob(&ntlmsspblob,
1720 				     &blob_len, ses, server,
1721 				     sess_data->nls_cp);
1722 	if (rc)
1723 		goto out_free_ntlmsspblob;
1724 
1725 	sess_data->iov[1].iov_len = blob_len;
1726 	sess_data->iov[1].iov_base = ntlmsspblob;
1727 	pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1728 
1729 	rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1730 	if (rc)
1731 		goto out_free_ntlmsspblob;
1732 
1733 	rc = sess_sendreceive(sess_data);
1734 
1735 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1736 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1737 
1738 	/* If true, rc here is expected and not an error */
1739 	if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1740 	    smb_buf->Status.CifsError ==
1741 			cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1742 		rc = 0;
1743 
1744 	if (rc)
1745 		goto out_free_ntlmsspblob;
1746 
1747 	cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1748 
1749 	if (smb_buf->WordCount != 4) {
1750 		rc = -EIO;
1751 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1752 		goto out_free_ntlmsspblob;
1753 	}
1754 
1755 	ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1756 	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1757 
1758 	bytes_remaining = get_bcc(smb_buf);
1759 	bcc_ptr = pByteArea(smb_buf);
1760 
1761 	blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1762 	if (blob_len > bytes_remaining) {
1763 		cifs_dbg(VFS, "bad security blob length %d\n",
1764 				blob_len);
1765 		rc = -EINVAL;
1766 		goto out_free_ntlmsspblob;
1767 	}
1768 
1769 	rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1770 
1771 out_free_ntlmsspblob:
1772 	kfree_sensitive(ntlmsspblob);
1773 out:
1774 	sess_free_buffer(sess_data);
1775 
1776 	if (!rc) {
1777 		sess_data->func = sess_auth_rawntlmssp_authenticate;
1778 		return;
1779 	}
1780 
1781 	/* Else error. Cleanup */
1782 	kfree_sensitive(ses->auth_key.response);
1783 	ses->auth_key.response = NULL;
1784 	kfree_sensitive(ses->ntlmssp);
1785 	ses->ntlmssp = NULL;
1786 
1787 	sess_data->func = NULL;
1788 	sess_data->result = rc;
1789 }
1790 
1791 static void
sess_auth_rawntlmssp_authenticate(struct sess_data * sess_data)1792 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1793 {
1794 	int rc;
1795 	struct smb_hdr *smb_buf;
1796 	SESSION_SETUP_ANDX *pSMB;
1797 	struct cifs_ses *ses = sess_data->ses;
1798 	struct TCP_Server_Info *server = sess_data->server;
1799 	__u16 bytes_remaining;
1800 	char *bcc_ptr;
1801 	unsigned char *ntlmsspblob = NULL;
1802 	u16 blob_len;
1803 
1804 	cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1805 
1806 	/* wct = 12 */
1807 	rc = sess_alloc_buffer(sess_data, 12);
1808 	if (rc)
1809 		goto out;
1810 
1811 	/* Build security blob before we assemble the request */
1812 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1813 	smb_buf = (struct smb_hdr *)pSMB;
1814 	rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1815 					&blob_len, ses, server,
1816 					sess_data->nls_cp);
1817 	if (rc)
1818 		goto out_free_ntlmsspblob;
1819 	sess_data->iov[1].iov_len = blob_len;
1820 	sess_data->iov[1].iov_base = ntlmsspblob;
1821 	pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1822 	/*
1823 	 * Make sure that we tell the server that we are using
1824 	 * the uid that it just gave us back on the response
1825 	 * (challenge)
1826 	 */
1827 	smb_buf->Uid = ses->Suid;
1828 
1829 	rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1830 	if (rc)
1831 		goto out_free_ntlmsspblob;
1832 
1833 	rc = sess_sendreceive(sess_data);
1834 	if (rc)
1835 		goto out_free_ntlmsspblob;
1836 
1837 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1838 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1839 	if (smb_buf->WordCount != 4) {
1840 		rc = -EIO;
1841 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1842 		goto out_free_ntlmsspblob;
1843 	}
1844 
1845 	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1846 		cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1847 
1848 	if (ses->Suid != smb_buf->Uid) {
1849 		ses->Suid = smb_buf->Uid;
1850 		cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1851 	}
1852 
1853 	bytes_remaining = get_bcc(smb_buf);
1854 	bcc_ptr = pByteArea(smb_buf);
1855 	blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1856 	if (blob_len > bytes_remaining) {
1857 		cifs_dbg(VFS, "bad security blob length %d\n",
1858 				blob_len);
1859 		rc = -EINVAL;
1860 		goto out_free_ntlmsspblob;
1861 	}
1862 	bcc_ptr += blob_len;
1863 	bytes_remaining -= blob_len;
1864 
1865 
1866 	/* BB check if Unicode and decode strings */
1867 	if (bytes_remaining == 0) {
1868 		/* no string area to decode, do nothing */
1869 	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1870 		/* unicode string area must be word-aligned */
1871 		if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1872 			++bcc_ptr;
1873 			--bytes_remaining;
1874 		}
1875 		decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1876 				      sess_data->nls_cp);
1877 	} else {
1878 		decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1879 				    sess_data->nls_cp);
1880 	}
1881 
1882 out_free_ntlmsspblob:
1883 	kfree_sensitive(ntlmsspblob);
1884 out:
1885 	sess_free_buffer(sess_data);
1886 
1887 	if (!rc)
1888 		rc = sess_establish_session(sess_data);
1889 
1890 	/* Cleanup */
1891 	kfree_sensitive(ses->auth_key.response);
1892 	ses->auth_key.response = NULL;
1893 	kfree_sensitive(ses->ntlmssp);
1894 	ses->ntlmssp = NULL;
1895 
1896 	sess_data->func = NULL;
1897 	sess_data->result = rc;
1898 }
1899 
select_sec(struct sess_data * sess_data)1900 static int select_sec(struct sess_data *sess_data)
1901 {
1902 	int type;
1903 	struct cifs_ses *ses = sess_data->ses;
1904 	struct TCP_Server_Info *server = sess_data->server;
1905 
1906 	type = cifs_select_sectype(server, ses->sectype);
1907 	cifs_dbg(FYI, "sess setup type %d\n", type);
1908 	if (type == Unspecified) {
1909 		cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1910 		return -EINVAL;
1911 	}
1912 
1913 	switch (type) {
1914 	case NTLMv2:
1915 		sess_data->func = sess_auth_ntlmv2;
1916 		break;
1917 	case Kerberos:
1918 #ifdef CONFIG_CIFS_UPCALL
1919 		sess_data->func = sess_auth_kerberos;
1920 		break;
1921 #else
1922 		cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1923 		return -ENOSYS;
1924 #endif /* CONFIG_CIFS_UPCALL */
1925 	case RawNTLMSSP:
1926 		sess_data->func = sess_auth_rawntlmssp_negotiate;
1927 		break;
1928 	default:
1929 		cifs_dbg(VFS, "secType %d not supported!\n", type);
1930 		return -ENOSYS;
1931 	}
1932 
1933 	return 0;
1934 }
1935 
CIFS_SessSetup(const unsigned int xid,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1936 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
1937 		   struct TCP_Server_Info *server,
1938 		   const struct nls_table *nls_cp)
1939 {
1940 	int rc = 0;
1941 	struct sess_data *sess_data;
1942 
1943 	if (ses == NULL) {
1944 		WARN(1, "%s: ses == NULL!", __func__);
1945 		return -EINVAL;
1946 	}
1947 
1948 	sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
1949 	if (!sess_data)
1950 		return -ENOMEM;
1951 
1952 	sess_data->xid = xid;
1953 	sess_data->ses = ses;
1954 	sess_data->server = server;
1955 	sess_data->buf0_type = CIFS_NO_BUFFER;
1956 	sess_data->nls_cp = (struct nls_table *) nls_cp;
1957 
1958 	rc = select_sec(sess_data);
1959 	if (rc)
1960 		goto out;
1961 
1962 	while (sess_data->func)
1963 		sess_data->func(sess_data);
1964 
1965 	/* Store result before we free sess_data */
1966 	rc = sess_data->result;
1967 
1968 out:
1969 	kfree_sensitive(sess_data);
1970 	return rc;
1971 }
1972 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
1973