1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3 *
4 * SMB/CIFS session setup handling routines
5 *
6 * Copyright (c) International Business Machines Corp., 2006, 2009
7 * Author(s): Steve French (sfrench@us.ibm.com)
8 *
9 */
10
11 #include "cifspdu.h"
12 #include "cifsglob.h"
13 #include "cifsproto.h"
14 #include "cifs_unicode.h"
15 #include "cifs_debug.h"
16 #include "ntlmssp.h"
17 #include "nterr.h"
18 #include <linux/utsname.h>
19 #include <linux/slab.h>
20 #include <linux/version.h>
21 #include "cifsfs.h"
22 #include "cifs_spnego.h"
23 #include "smb2proto.h"
24 #include "fs_context.h"
25
26 static int
27 cifs_ses_add_channel(struct cifs_ses *ses,
28 struct cifs_server_iface *iface);
29
is_ses_using_iface(struct cifs_ses * ses,struct cifs_server_iface * iface)30 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
31 {
32 int i;
33
34 spin_lock(&ses->chan_lock);
35 for (i = 0; i < ses->chan_count; i++) {
36 if (ses->chans[i].iface == iface) {
37 spin_unlock(&ses->chan_lock);
38 return true;
39 }
40 }
41 spin_unlock(&ses->chan_lock);
42 return false;
43 }
44
45 /* channel helper functions. assumed that chan_lock is held by caller. */
46
47 int
cifs_ses_get_chan_index(struct cifs_ses * ses,struct TCP_Server_Info * server)48 cifs_ses_get_chan_index(struct cifs_ses *ses,
49 struct TCP_Server_Info *server)
50 {
51 unsigned int i;
52
53 /* if the channel is waiting for termination */
54 if (server && server->terminate)
55 return CIFS_INVAL_CHAN_INDEX;
56
57 for (i = 0; i < ses->chan_count; i++) {
58 if (ses->chans[i].server == server)
59 return i;
60 }
61
62 /* If we didn't find the channel, it is likely a bug */
63 if (server)
64 cifs_dbg(VFS, "unable to get chan index for server: 0x%llx",
65 server->conn_id);
66 return CIFS_INVAL_CHAN_INDEX;
67 }
68
69 void
cifs_chan_set_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)70 cifs_chan_set_in_reconnect(struct cifs_ses *ses,
71 struct TCP_Server_Info *server)
72 {
73 int chan_index = cifs_ses_get_chan_index(ses, server);
74
75 if (chan_index == CIFS_INVAL_CHAN_INDEX)
76 return;
77
78 ses->chans[chan_index].in_reconnect = true;
79 }
80
81 void
cifs_chan_clear_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)82 cifs_chan_clear_in_reconnect(struct cifs_ses *ses,
83 struct TCP_Server_Info *server)
84 {
85 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
86
87 if (chan_index == CIFS_INVAL_CHAN_INDEX)
88 return;
89
90 ses->chans[chan_index].in_reconnect = false;
91 }
92
93 void
cifs_chan_set_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)94 cifs_chan_set_need_reconnect(struct cifs_ses *ses,
95 struct TCP_Server_Info *server)
96 {
97 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
98
99 if (chan_index == CIFS_INVAL_CHAN_INDEX)
100 return;
101
102 set_bit(chan_index, &ses->chans_need_reconnect);
103 cifs_dbg(FYI, "Set reconnect bitmask for chan %u; now 0x%lx\n",
104 chan_index, ses->chans_need_reconnect);
105 }
106
107 void
cifs_chan_clear_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)108 cifs_chan_clear_need_reconnect(struct cifs_ses *ses,
109 struct TCP_Server_Info *server)
110 {
111 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
112
113 if (chan_index == CIFS_INVAL_CHAN_INDEX)
114 return;
115
116 clear_bit(chan_index, &ses->chans_need_reconnect);
117 cifs_dbg(FYI, "Cleared reconnect bitmask for chan %u; now 0x%lx\n",
118 chan_index, ses->chans_need_reconnect);
119 }
120
121 bool
cifs_chan_needs_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)122 cifs_chan_needs_reconnect(struct cifs_ses *ses,
123 struct TCP_Server_Info *server)
124 {
125 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
126
127 if (chan_index == CIFS_INVAL_CHAN_INDEX)
128 return true; /* err on the safer side */
129
130 return CIFS_CHAN_NEEDS_RECONNECT(ses, chan_index);
131 }
132
133 bool
cifs_chan_is_iface_active(struct cifs_ses * ses,struct TCP_Server_Info * server)134 cifs_chan_is_iface_active(struct cifs_ses *ses,
135 struct TCP_Server_Info *server)
136 {
137 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
138
139 if (chan_index == CIFS_INVAL_CHAN_INDEX)
140 return true; /* err on the safer side */
141
142 return ses->chans[chan_index].iface &&
143 ses->chans[chan_index].iface->is_active;
144 }
145
146 /* returns number of channels added */
cifs_try_adding_channels(struct cifs_ses * ses)147 int cifs_try_adding_channels(struct cifs_ses *ses)
148 {
149 struct TCP_Server_Info *server = ses->server;
150 int old_chan_count, new_chan_count;
151 int left;
152 int rc = 0;
153 int tries = 0;
154 size_t iface_weight = 0, iface_min_speed = 0;
155 struct cifs_server_iface *iface = NULL, *niface = NULL;
156 struct cifs_server_iface *last_iface = NULL;
157
158 spin_lock(&ses->chan_lock);
159
160 new_chan_count = old_chan_count = ses->chan_count;
161 left = ses->chan_max - ses->chan_count;
162
163 if (left <= 0) {
164 spin_unlock(&ses->chan_lock);
165 cifs_dbg(FYI,
166 "ses already at max_channels (%zu), nothing to open\n",
167 ses->chan_max);
168 return 0;
169 }
170
171 if (server->dialect < SMB30_PROT_ID) {
172 spin_unlock(&ses->chan_lock);
173 cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
174 return 0;
175 }
176
177 if (!(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
178 spin_unlock(&ses->chan_lock);
179 cifs_server_dbg(VFS, "no multichannel support\n");
180 return 0;
181 }
182 spin_unlock(&ses->chan_lock);
183
184 while (left > 0) {
185
186 tries++;
187 if (tries > 3*ses->chan_max) {
188 cifs_dbg(VFS, "too many channel open attempts (%d channels left to open)\n",
189 left);
190 break;
191 }
192
193 spin_lock(&ses->iface_lock);
194 if (!ses->iface_count) {
195 spin_unlock(&ses->iface_lock);
196 cifs_dbg(ONCE, "server %s does not advertise interfaces\n",
197 ses->server->hostname);
198 break;
199 }
200
201 if (!iface)
202 iface = list_first_entry(&ses->iface_list, struct cifs_server_iface,
203 iface_head);
204 last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
205 iface_head);
206 iface_min_speed = last_iface->speed;
207
208 list_for_each_entry_safe_from(iface, niface, &ses->iface_list,
209 iface_head) {
210 /* do not mix rdma and non-rdma interfaces */
211 if (iface->rdma_capable != ses->server->rdma)
212 continue;
213
214 /* skip ifaces that are unusable */
215 if (!iface->is_active ||
216 (is_ses_using_iface(ses, iface) &&
217 !iface->rss_capable))
218 continue;
219
220 /* check if we already allocated enough channels */
221 iface_weight = iface->speed / iface_min_speed;
222
223 if (iface->weight_fulfilled >= iface_weight)
224 continue;
225
226 /* take ref before unlock */
227 kref_get(&iface->refcount);
228
229 spin_unlock(&ses->iface_lock);
230 rc = cifs_ses_add_channel(ses, iface);
231 spin_lock(&ses->iface_lock);
232
233 if (rc) {
234 cifs_dbg(VFS, "failed to open extra channel on iface:%pIS rc=%d\n",
235 &iface->sockaddr,
236 rc);
237 kref_put(&iface->refcount, release_iface);
238 /* failure to add chan should increase weight */
239 iface->weight_fulfilled++;
240 continue;
241 }
242
243 iface->num_channels++;
244 iface->weight_fulfilled++;
245 cifs_dbg(VFS, "successfully opened new channel on iface:%pIS\n",
246 &iface->sockaddr);
247 break;
248 }
249
250 /* reached end of list. reset weight_fulfilled and start over */
251 if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
252 list_for_each_entry(iface, &ses->iface_list, iface_head)
253 iface->weight_fulfilled = 0;
254 spin_unlock(&ses->iface_lock);
255 iface = NULL;
256 continue;
257 }
258 spin_unlock(&ses->iface_lock);
259
260 left--;
261 new_chan_count++;
262 }
263
264 return new_chan_count - old_chan_count;
265 }
266
267 /*
268 * called when multichannel is disabled by the server.
269 * this always gets called from smb2_reconnect
270 * and cannot get called in parallel threads.
271 */
272 void
cifs_disable_secondary_channels(struct cifs_ses * ses)273 cifs_disable_secondary_channels(struct cifs_ses *ses)
274 {
275 int i, chan_count;
276 struct TCP_Server_Info *server;
277 struct cifs_server_iface *iface;
278
279 spin_lock(&ses->chan_lock);
280 chan_count = ses->chan_count;
281 if (chan_count == 1)
282 goto done;
283
284 ses->chan_count = 1;
285
286 /* for all secondary channels reset the need reconnect bit */
287 ses->chans_need_reconnect &= 1;
288
289 for (i = 1; i < chan_count; i++) {
290 iface = ses->chans[i].iface;
291 server = ses->chans[i].server;
292
293 /*
294 * remove these references first, since we need to unlock
295 * the chan_lock here, since iface_lock is a higher lock
296 */
297 ses->chans[i].iface = NULL;
298 ses->chans[i].server = NULL;
299 spin_unlock(&ses->chan_lock);
300
301 if (iface) {
302 spin_lock(&ses->iface_lock);
303 iface->num_channels--;
304 if (iface->weight_fulfilled)
305 iface->weight_fulfilled--;
306 kref_put(&iface->refcount, release_iface);
307 spin_unlock(&ses->iface_lock);
308 }
309
310 if (server) {
311 if (!server->terminate) {
312 server->terminate = true;
313 cifs_signal_cifsd_for_reconnect(server, false);
314 }
315 cifs_put_tcp_session(server, false);
316 }
317
318 spin_lock(&ses->chan_lock);
319 }
320
321 done:
322 spin_unlock(&ses->chan_lock);
323 }
324
325 /* update the iface for the channel if necessary. */
326 void
cifs_chan_update_iface(struct cifs_ses * ses,struct TCP_Server_Info * server)327 cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server)
328 {
329 unsigned int chan_index;
330 size_t iface_weight = 0, iface_min_speed = 0;
331 struct cifs_server_iface *iface = NULL;
332 struct cifs_server_iface *old_iface = NULL;
333 struct cifs_server_iface *last_iface = NULL;
334 struct sockaddr_storage ss;
335
336 spin_lock(&ses->chan_lock);
337 chan_index = cifs_ses_get_chan_index(ses, server);
338 if (chan_index == CIFS_INVAL_CHAN_INDEX) {
339 spin_unlock(&ses->chan_lock);
340 return;
341 }
342
343 if (ses->chans[chan_index].iface) {
344 old_iface = ses->chans[chan_index].iface;
345 if (old_iface->is_active) {
346 spin_unlock(&ses->chan_lock);
347 return;
348 }
349 }
350 spin_unlock(&ses->chan_lock);
351
352 spin_lock(&server->srv_lock);
353 ss = server->dstaddr;
354 spin_unlock(&server->srv_lock);
355
356 spin_lock(&ses->iface_lock);
357 if (!ses->iface_count) {
358 spin_unlock(&ses->iface_lock);
359 cifs_dbg(ONCE, "server %s does not advertise interfaces\n", ses->server->hostname);
360 return;
361 }
362
363 last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
364 iface_head);
365 iface_min_speed = last_iface->speed;
366
367 /* then look for a new one */
368 list_for_each_entry(iface, &ses->iface_list, iface_head) {
369 if (!chan_index) {
370 /* if we're trying to get the updated iface for primary channel */
371 if (!cifs_match_ipaddr((struct sockaddr *) &ss,
372 (struct sockaddr *) &iface->sockaddr))
373 continue;
374
375 kref_get(&iface->refcount);
376 break;
377 }
378
379 /* do not mix rdma and non-rdma interfaces */
380 if (iface->rdma_capable != server->rdma)
381 continue;
382
383 if (!iface->is_active ||
384 (is_ses_using_iface(ses, iface) &&
385 !iface->rss_capable)) {
386 continue;
387 }
388
389 /* check if we already allocated enough channels */
390 iface_weight = iface->speed / iface_min_speed;
391
392 if (iface->weight_fulfilled >= iface_weight)
393 continue;
394
395 kref_get(&iface->refcount);
396 break;
397 }
398
399 if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
400 iface = NULL;
401 cifs_dbg(FYI, "unable to find a suitable iface\n");
402 }
403
404 if (!iface) {
405 if (!chan_index)
406 cifs_dbg(FYI, "unable to get the interface matching: %pIS\n",
407 &ss);
408 else {
409 cifs_dbg(FYI, "unable to find another interface to replace: %pIS\n",
410 &old_iface->sockaddr);
411 }
412
413 spin_unlock(&ses->iface_lock);
414 return;
415 }
416
417 /* now drop the ref to the current iface */
418 if (old_iface) {
419 cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n",
420 &old_iface->sockaddr,
421 &iface->sockaddr);
422
423 old_iface->num_channels--;
424 if (old_iface->weight_fulfilled)
425 old_iface->weight_fulfilled--;
426 iface->num_channels++;
427 iface->weight_fulfilled++;
428
429 kref_put(&old_iface->refcount, release_iface);
430 } else if (!chan_index) {
431 /* special case: update interface for primary channel */
432 cifs_dbg(FYI, "referencing primary channel iface: %pIS\n",
433 &iface->sockaddr);
434 iface->num_channels++;
435 iface->weight_fulfilled++;
436 }
437 spin_unlock(&ses->iface_lock);
438
439 spin_lock(&ses->chan_lock);
440 chan_index = cifs_ses_get_chan_index(ses, server);
441 if (chan_index == CIFS_INVAL_CHAN_INDEX) {
442 spin_unlock(&ses->chan_lock);
443 return;
444 }
445
446 ses->chans[chan_index].iface = iface;
447 spin_unlock(&ses->chan_lock);
448 }
449
450 static int
cifs_ses_add_channel(struct cifs_ses * ses,struct cifs_server_iface * iface)451 cifs_ses_add_channel(struct cifs_ses *ses,
452 struct cifs_server_iface *iface)
453 {
454 struct TCP_Server_Info *chan_server;
455 struct cifs_chan *chan;
456 struct smb3_fs_context *ctx;
457 static const char unc_fmt[] = "\\%s\\foo";
458 struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
459 struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
460 size_t len;
461 int rc;
462 unsigned int xid = get_xid();
463
464 if (iface->sockaddr.ss_family == AF_INET)
465 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
466 ses, iface->speed, str_yes_no(iface->rdma_capable),
467 &ipv4->sin_addr);
468 else
469 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI6)\n",
470 ses, iface->speed, str_yes_no(iface->rdma_capable),
471 &ipv6->sin6_addr);
472
473 /*
474 * Setup a ctx with mostly the same info as the existing
475 * session and overwrite it with the requested iface data.
476 *
477 * We need to setup at least the fields used for negprot and
478 * sesssetup.
479 *
480 * We only need the ctx here, so we can reuse memory from
481 * the session and server without caring about memory
482 * management.
483 */
484 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
485 if (!ctx) {
486 rc = -ENOMEM;
487 goto out_free_xid;
488 }
489
490 /* Always make new connection for now (TODO?) */
491 ctx->nosharesock = true;
492
493 /* Auth */
494 ctx->domainauto = ses->domainAuto;
495 ctx->domainname = ses->domainName;
496
497 /* no hostname for extra channels */
498 ctx->server_hostname = "";
499
500 ctx->username = ses->user_name;
501 ctx->password = ses->password;
502 ctx->sectype = ses->sectype;
503 ctx->sign = ses->sign;
504
505 /* UNC and paths */
506 /* XXX: Use ses->server->hostname? */
507 len = sizeof(unc_fmt) + SERVER_NAME_LEN_WITH_NULL;
508 ctx->UNC = kzalloc(len, GFP_KERNEL);
509 if (!ctx->UNC) {
510 rc = -ENOMEM;
511 goto out_free_ctx;
512 }
513 scnprintf(ctx->UNC, len, unc_fmt, ses->ip_addr);
514 ctx->prepath = "";
515
516 /* Reuse same version as master connection */
517 ctx->vals = ses->server->vals;
518 ctx->ops = ses->server->ops;
519
520 ctx->noblocksnd = ses->server->noblocksnd;
521 ctx->noautotune = ses->server->noautotune;
522 ctx->sockopt_tcp_nodelay = ses->server->tcp_nodelay;
523 ctx->echo_interval = ses->server->echo_interval / HZ;
524 ctx->max_credits = ses->server->max_credits;
525
526 /*
527 * This will be used for encoding/decoding user/domain/pw
528 * during sess setup auth.
529 */
530 ctx->local_nls = ses->local_nls;
531
532 /* Use RDMA if possible */
533 ctx->rdma = iface->rdma_capable;
534 memcpy(&ctx->dstaddr, &iface->sockaddr, sizeof(ctx->dstaddr));
535
536 /* reuse master con client guid */
537 memcpy(&ctx->client_guid, ses->server->client_guid,
538 sizeof(ctx->client_guid));
539 ctx->use_client_guid = true;
540
541 chan_server = cifs_get_tcp_session(ctx, ses->server);
542
543 spin_lock(&ses->chan_lock);
544 chan = &ses->chans[ses->chan_count];
545 chan->server = chan_server;
546 if (IS_ERR(chan->server)) {
547 rc = PTR_ERR(chan->server);
548 chan->server = NULL;
549 spin_unlock(&ses->chan_lock);
550 goto out;
551 }
552 chan->iface = iface;
553 ses->chan_count++;
554 atomic_set(&ses->chan_seq, 0);
555
556 /* Mark this channel as needing connect/setup */
557 cifs_chan_set_need_reconnect(ses, chan->server);
558
559 spin_unlock(&ses->chan_lock);
560
561 mutex_lock(&ses->session_mutex);
562 /*
563 * We need to allocate the server crypto now as we will need
564 * to sign packets before we generate the channel signing key
565 * (we sign with the session key)
566 */
567 rc = smb311_crypto_shash_allocate(chan->server);
568 if (rc) {
569 cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
570 mutex_unlock(&ses->session_mutex);
571 goto out;
572 }
573
574 rc = cifs_negotiate_protocol(xid, ses, chan->server);
575 if (!rc)
576 rc = cifs_setup_session(xid, ses, chan->server, ses->local_nls);
577
578 mutex_unlock(&ses->session_mutex);
579
580 out:
581 if (rc && chan->server) {
582 cifs_put_tcp_session(chan->server, 0);
583
584 spin_lock(&ses->chan_lock);
585
586 /* we rely on all bits beyond chan_count to be clear */
587 cifs_chan_clear_need_reconnect(ses, chan->server);
588 ses->chan_count--;
589 /*
590 * chan_count should never reach 0 as at least the primary
591 * channel is always allocated
592 */
593 WARN_ON(ses->chan_count < 1);
594 spin_unlock(&ses->chan_lock);
595 }
596
597 kfree(ctx->UNC);
598 out_free_ctx:
599 kfree(ctx);
600 out_free_xid:
601 free_xid(xid);
602 return rc;
603 }
604
605 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
cifs_ssetup_hdr(struct cifs_ses * ses,struct TCP_Server_Info * server,SESSION_SETUP_ANDX * pSMB)606 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses,
607 struct TCP_Server_Info *server,
608 SESSION_SETUP_ANDX *pSMB)
609 {
610 __u32 capabilities = 0;
611
612 /* init fields common to all four types of SessSetup */
613 /* Note that offsets for first seven fields in req struct are same */
614 /* in CIFS Specs so does not matter which of 3 forms of struct */
615 /* that we use in next few lines */
616 /* Note that header is initialized to zero in header_assemble */
617 pSMB->req.AndXCommand = 0xFF;
618 pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
619 CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
620 USHRT_MAX));
621 pSMB->req.MaxMpxCount = cpu_to_le16(server->maxReq);
622 pSMB->req.VcNumber = cpu_to_le16(1);
623
624 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
625
626 /* BB verify whether signing required on neg or just auth frame (and NTLM case) */
627
628 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
629 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
630
631 if (server->sign)
632 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
633
634 if (ses->capabilities & CAP_UNICODE) {
635 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
636 capabilities |= CAP_UNICODE;
637 }
638 if (ses->capabilities & CAP_STATUS32) {
639 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
640 capabilities |= CAP_STATUS32;
641 }
642 if (ses->capabilities & CAP_DFS) {
643 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
644 capabilities |= CAP_DFS;
645 }
646 if (ses->capabilities & CAP_UNIX)
647 capabilities |= CAP_UNIX;
648
649 return capabilities;
650 }
651
652 static void
unicode_oslm_strings(char ** pbcc_area,const struct nls_table * nls_cp)653 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
654 {
655 char *bcc_ptr = *pbcc_area;
656 int bytes_ret = 0;
657
658 /* Copy OS version */
659 bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
660 nls_cp);
661 bcc_ptr += 2 * bytes_ret;
662 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
663 32, nls_cp);
664 bcc_ptr += 2 * bytes_ret;
665 bcc_ptr += 2; /* trailing null */
666
667 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
668 32, nls_cp);
669 bcc_ptr += 2 * bytes_ret;
670 bcc_ptr += 2; /* trailing null */
671
672 *pbcc_area = bcc_ptr;
673 }
674
unicode_domain_string(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)675 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
676 const struct nls_table *nls_cp)
677 {
678 char *bcc_ptr = *pbcc_area;
679 int bytes_ret = 0;
680
681 /* copy domain */
682 if (ses->domainName == NULL) {
683 /*
684 * Sending null domain better than using a bogus domain name (as
685 * we did briefly in 2.6.18) since server will use its default
686 */
687 *bcc_ptr = 0;
688 *(bcc_ptr+1) = 0;
689 bytes_ret = 0;
690 } else
691 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
692 CIFS_MAX_DOMAINNAME_LEN, nls_cp);
693 bcc_ptr += 2 * bytes_ret;
694 bcc_ptr += 2; /* account for null terminator */
695
696 *pbcc_area = bcc_ptr;
697 }
698
unicode_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)699 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
700 const struct nls_table *nls_cp)
701 {
702 char *bcc_ptr = *pbcc_area;
703 int bytes_ret = 0;
704
705 /* BB FIXME add check that strings less than 335 or will need to send as arrays */
706
707 /* copy user */
708 if (ses->user_name == NULL) {
709 /* null user mount */
710 *bcc_ptr = 0;
711 *(bcc_ptr+1) = 0;
712 } else {
713 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
714 CIFS_MAX_USERNAME_LEN, nls_cp);
715 }
716 bcc_ptr += 2 * bytes_ret;
717 bcc_ptr += 2; /* account for null termination */
718
719 unicode_domain_string(&bcc_ptr, ses, nls_cp);
720 unicode_oslm_strings(&bcc_ptr, nls_cp);
721
722 *pbcc_area = bcc_ptr;
723 }
724
ascii_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)725 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
726 const struct nls_table *nls_cp)
727 {
728 char *bcc_ptr = *pbcc_area;
729 int len;
730
731 /* copy user */
732 /* BB what about null user mounts - check that we do this BB */
733 /* copy user */
734 if (ses->user_name != NULL) {
735 len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
736 if (WARN_ON_ONCE(len < 0))
737 len = CIFS_MAX_USERNAME_LEN - 1;
738 bcc_ptr += len;
739 }
740 /* else null user mount */
741 *bcc_ptr = 0;
742 bcc_ptr++; /* account for null termination */
743
744 /* copy domain */
745 if (ses->domainName != NULL) {
746 len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
747 if (WARN_ON_ONCE(len < 0))
748 len = CIFS_MAX_DOMAINNAME_LEN - 1;
749 bcc_ptr += len;
750 } /* else we send a null domain name so server will default to its own domain */
751 *bcc_ptr = 0;
752 bcc_ptr++;
753
754 /* BB check for overflow here */
755
756 strcpy(bcc_ptr, "Linux version ");
757 bcc_ptr += strlen("Linux version ");
758 strcpy(bcc_ptr, init_utsname()->release);
759 bcc_ptr += strlen(init_utsname()->release) + 1;
760
761 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
762 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
763
764 *pbcc_area = bcc_ptr;
765 }
766
767 static void
decode_unicode_ssetup(char ** pbcc_area,int bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)768 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
769 const struct nls_table *nls_cp)
770 {
771 int len;
772 char *data = *pbcc_area;
773
774 cifs_dbg(FYI, "bleft %d\n", bleft);
775
776 kfree(ses->serverOS);
777 ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
778 cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
779 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
780 data += len;
781 bleft -= len;
782 if (bleft <= 0)
783 return;
784
785 kfree(ses->serverNOS);
786 ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
787 cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
788 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
789 data += len;
790 bleft -= len;
791 if (bleft <= 0)
792 return;
793
794 kfree(ses->serverDomain);
795 ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
796 cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
797
798 return;
799 }
800
decode_ascii_ssetup(char ** pbcc_area,__u16 bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)801 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
802 struct cifs_ses *ses,
803 const struct nls_table *nls_cp)
804 {
805 int len;
806 char *bcc_ptr = *pbcc_area;
807
808 cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
809
810 len = strnlen(bcc_ptr, bleft);
811 if (len >= bleft)
812 return;
813
814 kfree(ses->serverOS);
815
816 ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
817 if (ses->serverOS) {
818 memcpy(ses->serverOS, bcc_ptr, len);
819 ses->serverOS[len] = 0;
820 if (strncmp(ses->serverOS, "OS/2", 4) == 0)
821 cifs_dbg(FYI, "OS/2 server\n");
822 }
823
824 bcc_ptr += len + 1;
825 bleft -= len + 1;
826
827 len = strnlen(bcc_ptr, bleft);
828 if (len >= bleft)
829 return;
830
831 kfree(ses->serverNOS);
832
833 ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
834 if (ses->serverNOS) {
835 memcpy(ses->serverNOS, bcc_ptr, len);
836 ses->serverNOS[len] = 0;
837 }
838
839 bcc_ptr += len + 1;
840 bleft -= len + 1;
841
842 len = strnlen(bcc_ptr, bleft);
843 if (len > bleft)
844 return;
845
846 /*
847 * No domain field in LANMAN case. Domain is
848 * returned by old servers in the SMB negprot response
849 *
850 * BB For newer servers which do not support Unicode,
851 * but thus do return domain here, we could add parsing
852 * for it later, but it is not very important
853 */
854 cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
855 }
856 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
857
decode_ntlmssp_challenge(char * bcc_ptr,int blob_len,struct cifs_ses * ses)858 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
859 struct cifs_ses *ses)
860 {
861 unsigned int tioffset; /* challenge message target info area */
862 unsigned int tilen; /* challenge message target info area length */
863 CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
864 __u32 server_flags;
865
866 if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
867 cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
868 return -EINVAL;
869 }
870
871 if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
872 cifs_dbg(VFS, "blob signature incorrect %s\n",
873 pblob->Signature);
874 return -EINVAL;
875 }
876 if (pblob->MessageType != NtLmChallenge) {
877 cifs_dbg(VFS, "Incorrect message type %d\n",
878 pblob->MessageType);
879 return -EINVAL;
880 }
881
882 server_flags = le32_to_cpu(pblob->NegotiateFlags);
883 cifs_dbg(FYI, "%s: negotiate=0x%08x challenge=0x%08x\n", __func__,
884 ses->ntlmssp->client_flags, server_flags);
885
886 if ((ses->ntlmssp->client_flags & (NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN)) &&
887 (!(server_flags & NTLMSSP_NEGOTIATE_56) && !(server_flags & NTLMSSP_NEGOTIATE_128))) {
888 cifs_dbg(VFS, "%s: requested signing/encryption but server did not return either 56-bit or 128-bit session key size\n",
889 __func__);
890 return -EINVAL;
891 }
892 if (!(server_flags & NTLMSSP_NEGOTIATE_NTLM) && !(server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) {
893 cifs_dbg(VFS, "%s: server does not seem to support either NTLMv1 or NTLMv2\n", __func__);
894 return -EINVAL;
895 }
896 if (ses->server->sign && !(server_flags & NTLMSSP_NEGOTIATE_SIGN)) {
897 cifs_dbg(VFS, "%s: forced packet signing but server does not seem to support it\n",
898 __func__);
899 return -EOPNOTSUPP;
900 }
901 if ((ses->ntlmssp->client_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
902 !(server_flags & NTLMSSP_NEGOTIATE_KEY_XCH))
903 pr_warn_once("%s: authentication has been weakened as server does not support key exchange\n",
904 __func__);
905
906 ses->ntlmssp->server_flags = server_flags;
907
908 memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
909 /*
910 * In particular we can examine sign flags
911 *
912 * BB spec says that if AvId field of MsvAvTimestamp is populated then
913 * we must set the MIC field of the AUTHENTICATE_MESSAGE
914 */
915
916 tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
917 tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
918 if (tioffset > blob_len || tioffset + tilen > blob_len) {
919 cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
920 tioffset, tilen);
921 return -EINVAL;
922 }
923 if (tilen) {
924 kfree_sensitive(ses->auth_key.response);
925 ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
926 GFP_KERNEL);
927 if (!ses->auth_key.response) {
928 cifs_dbg(VFS, "Challenge target info alloc failure\n");
929 return -ENOMEM;
930 }
931 ses->auth_key.len = tilen;
932 }
933
934 return 0;
935 }
936
size_of_ntlmssp_blob(struct cifs_ses * ses,int base_size)937 static int size_of_ntlmssp_blob(struct cifs_ses *ses, int base_size)
938 {
939 int sz = base_size + ses->auth_key.len
940 - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
941
942 if (ses->domainName)
943 sz += sizeof(__le16) * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
944 else
945 sz += sizeof(__le16);
946
947 if (ses->user_name)
948 sz += sizeof(__le16) * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
949 else
950 sz += sizeof(__le16);
951
952 if (ses->workstation_name[0])
953 sz += sizeof(__le16) * strnlen(ses->workstation_name,
954 ntlmssp_workstation_name_size(ses));
955 else
956 sz += sizeof(__le16);
957
958 return sz;
959 }
960
cifs_security_buffer_from_str(SECURITY_BUFFER * pbuf,char * str_value,int str_length,unsigned char * pstart,unsigned char ** pcur,const struct nls_table * nls_cp)961 static inline void cifs_security_buffer_from_str(SECURITY_BUFFER *pbuf,
962 char *str_value,
963 int str_length,
964 unsigned char *pstart,
965 unsigned char **pcur,
966 const struct nls_table *nls_cp)
967 {
968 unsigned char *tmp = pstart;
969 int len;
970
971 if (!pbuf)
972 return;
973
974 if (!pcur)
975 pcur = &tmp;
976
977 if (!str_value) {
978 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
979 pbuf->Length = 0;
980 pbuf->MaximumLength = 0;
981 *pcur += sizeof(__le16);
982 } else {
983 len = cifs_strtoUTF16((__le16 *)*pcur,
984 str_value,
985 str_length,
986 nls_cp);
987 len *= sizeof(__le16);
988 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
989 pbuf->Length = cpu_to_le16(len);
990 pbuf->MaximumLength = cpu_to_le16(len);
991 *pcur += len;
992 }
993 }
994
995 /* BB Move to ntlmssp.c eventually */
996
build_ntlmssp_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)997 int build_ntlmssp_negotiate_blob(unsigned char **pbuffer,
998 u16 *buflen,
999 struct cifs_ses *ses,
1000 struct TCP_Server_Info *server,
1001 const struct nls_table *nls_cp)
1002 {
1003 int rc = 0;
1004 NEGOTIATE_MESSAGE *sec_blob;
1005 __u32 flags;
1006 unsigned char *tmp;
1007 int len;
1008
1009 len = size_of_ntlmssp_blob(ses, sizeof(NEGOTIATE_MESSAGE));
1010 *pbuffer = kmalloc(len, GFP_KERNEL);
1011 if (!*pbuffer) {
1012 rc = -ENOMEM;
1013 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1014 *buflen = 0;
1015 goto setup_ntlm_neg_ret;
1016 }
1017 sec_blob = (NEGOTIATE_MESSAGE *)*pbuffer;
1018
1019 memset(*pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
1020 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1021 sec_blob->MessageType = NtLmNegotiate;
1022
1023 /* BB is NTLMV2 session security format easier to use here? */
1024 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
1025 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1026 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1027 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1028 NTLMSSP_NEGOTIATE_SIGN;
1029 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1030 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1031
1032 tmp = *pbuffer + sizeof(NEGOTIATE_MESSAGE);
1033 ses->ntlmssp->client_flags = flags;
1034 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1035
1036 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1037 cifs_security_buffer_from_str(&sec_blob->DomainName,
1038 NULL,
1039 CIFS_MAX_DOMAINNAME_LEN,
1040 *pbuffer, &tmp,
1041 nls_cp);
1042
1043 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1044 NULL,
1045 CIFS_MAX_WORKSTATION_LEN,
1046 *pbuffer, &tmp,
1047 nls_cp);
1048
1049 *buflen = tmp - *pbuffer;
1050 setup_ntlm_neg_ret:
1051 return rc;
1052 }
1053
1054 /*
1055 * Build ntlmssp blob with additional fields, such as version,
1056 * supported by modern servers. For safety limit to SMB3 or later
1057 * See notes in MS-NLMP Section 2.2.2.1 e.g.
1058 */
build_ntlmssp_smb3_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1059 int build_ntlmssp_smb3_negotiate_blob(unsigned char **pbuffer,
1060 u16 *buflen,
1061 struct cifs_ses *ses,
1062 struct TCP_Server_Info *server,
1063 const struct nls_table *nls_cp)
1064 {
1065 int rc = 0;
1066 struct negotiate_message *sec_blob;
1067 __u32 flags;
1068 unsigned char *tmp;
1069 int len;
1070
1071 len = size_of_ntlmssp_blob(ses, sizeof(struct negotiate_message));
1072 *pbuffer = kmalloc(len, GFP_KERNEL);
1073 if (!*pbuffer) {
1074 rc = -ENOMEM;
1075 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1076 *buflen = 0;
1077 goto setup_ntlm_smb3_neg_ret;
1078 }
1079 sec_blob = (struct negotiate_message *)*pbuffer;
1080
1081 memset(*pbuffer, 0, sizeof(struct negotiate_message));
1082 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1083 sec_blob->MessageType = NtLmNegotiate;
1084
1085 /* BB is NTLMV2 session security format easier to use here? */
1086 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
1087 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1088 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1089 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1090 NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_VERSION;
1091 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1092 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1093
1094 sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1095 sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1096 sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1097 sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1098
1099 tmp = *pbuffer + sizeof(struct negotiate_message);
1100 ses->ntlmssp->client_flags = flags;
1101 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1102
1103 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1104 cifs_security_buffer_from_str(&sec_blob->DomainName,
1105 NULL,
1106 CIFS_MAX_DOMAINNAME_LEN,
1107 *pbuffer, &tmp,
1108 nls_cp);
1109
1110 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1111 NULL,
1112 CIFS_MAX_WORKSTATION_LEN,
1113 *pbuffer, &tmp,
1114 nls_cp);
1115
1116 *buflen = tmp - *pbuffer;
1117 setup_ntlm_smb3_neg_ret:
1118 return rc;
1119 }
1120
1121
1122 /* See MS-NLMP 2.2.1.3 */
build_ntlmssp_auth_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1123 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
1124 u16 *buflen,
1125 struct cifs_ses *ses,
1126 struct TCP_Server_Info *server,
1127 const struct nls_table *nls_cp)
1128 {
1129 int rc;
1130 AUTHENTICATE_MESSAGE *sec_blob;
1131 __u32 flags;
1132 unsigned char *tmp;
1133 int len;
1134
1135 rc = setup_ntlmv2_rsp(ses, nls_cp);
1136 if (rc) {
1137 cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
1138 *buflen = 0;
1139 goto setup_ntlmv2_ret;
1140 }
1141
1142 len = size_of_ntlmssp_blob(ses, sizeof(AUTHENTICATE_MESSAGE));
1143 *pbuffer = kmalloc(len, GFP_KERNEL);
1144 if (!*pbuffer) {
1145 rc = -ENOMEM;
1146 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1147 *buflen = 0;
1148 goto setup_ntlmv2_ret;
1149 }
1150 sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
1151
1152 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1153 sec_blob->MessageType = NtLmAuthenticate;
1154
1155 /* send version information in ntlmssp authenticate also */
1156 flags = ses->ntlmssp->server_flags | NTLMSSP_REQUEST_TARGET |
1157 NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_VERSION |
1158 NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED;
1159
1160 sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1161 sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1162 sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1163 sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1164
1165 tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
1166 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1167
1168 sec_blob->LmChallengeResponse.BufferOffset =
1169 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
1170 sec_blob->LmChallengeResponse.Length = 0;
1171 sec_blob->LmChallengeResponse.MaximumLength = 0;
1172
1173 sec_blob->NtChallengeResponse.BufferOffset =
1174 cpu_to_le32(tmp - *pbuffer);
1175 if (ses->user_name != NULL) {
1176 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1177 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1178 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1179
1180 sec_blob->NtChallengeResponse.Length =
1181 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1182 sec_blob->NtChallengeResponse.MaximumLength =
1183 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1184 } else {
1185 /*
1186 * don't send an NT Response for anonymous access
1187 */
1188 sec_blob->NtChallengeResponse.Length = 0;
1189 sec_blob->NtChallengeResponse.MaximumLength = 0;
1190 }
1191
1192 cifs_security_buffer_from_str(&sec_blob->DomainName,
1193 ses->domainName,
1194 CIFS_MAX_DOMAINNAME_LEN,
1195 *pbuffer, &tmp,
1196 nls_cp);
1197
1198 cifs_security_buffer_from_str(&sec_blob->UserName,
1199 ses->user_name,
1200 CIFS_MAX_USERNAME_LEN,
1201 *pbuffer, &tmp,
1202 nls_cp);
1203
1204 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1205 ses->workstation_name,
1206 ntlmssp_workstation_name_size(ses),
1207 *pbuffer, &tmp,
1208 nls_cp);
1209
1210 if ((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
1211 (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) &&
1212 !calc_seckey(ses)) {
1213 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
1214 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1215 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
1216 sec_blob->SessionKey.MaximumLength =
1217 cpu_to_le16(CIFS_CPHTXT_SIZE);
1218 tmp += CIFS_CPHTXT_SIZE;
1219 } else {
1220 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1221 sec_blob->SessionKey.Length = 0;
1222 sec_blob->SessionKey.MaximumLength = 0;
1223 }
1224
1225 *buflen = tmp - *pbuffer;
1226 setup_ntlmv2_ret:
1227 return rc;
1228 }
1229
1230 enum securityEnum
cifs_select_sectype(struct TCP_Server_Info * server,enum securityEnum requested)1231 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
1232 {
1233 switch (server->negflavor) {
1234 case CIFS_NEGFLAVOR_EXTENDED:
1235 switch (requested) {
1236 case Kerberos:
1237 case RawNTLMSSP:
1238 case IAKerb:
1239 return requested;
1240 case Unspecified:
1241 if (server->sec_ntlmssp &&
1242 (global_secflags & CIFSSEC_MAY_NTLMSSP))
1243 return RawNTLMSSP;
1244 if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) &&
1245 (global_secflags & CIFSSEC_MAY_KRB5))
1246 return Kerberos;
1247 fallthrough;
1248 default:
1249 return Unspecified;
1250 }
1251 case CIFS_NEGFLAVOR_UNENCAP:
1252 switch (requested) {
1253 case NTLMv2:
1254 return requested;
1255 case Unspecified:
1256 if (global_secflags & CIFSSEC_MAY_NTLMV2)
1257 return NTLMv2;
1258 break;
1259 default:
1260 break;
1261 }
1262 fallthrough;
1263 default:
1264 return Unspecified;
1265 }
1266 }
1267
1268 struct sess_data {
1269 unsigned int xid;
1270 struct cifs_ses *ses;
1271 struct TCP_Server_Info *server;
1272 struct nls_table *nls_cp;
1273 void (*func)(struct sess_data *);
1274 int result;
1275
1276 /* we will send the SMB in three pieces:
1277 * a fixed length beginning part, an optional
1278 * SPNEGO blob (which can be zero length), and a
1279 * last part which will include the strings
1280 * and rest of bcc area. This allows us to avoid
1281 * a large buffer 17K allocation
1282 */
1283 int buf0_type;
1284 struct kvec iov[3];
1285 };
1286
1287 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
1288 static int
sess_alloc_buffer(struct sess_data * sess_data,int wct)1289 sess_alloc_buffer(struct sess_data *sess_data, int wct)
1290 {
1291 int rc;
1292 struct cifs_ses *ses = sess_data->ses;
1293 struct smb_hdr *smb_buf;
1294
1295 rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
1296 (void **)&smb_buf);
1297
1298 if (rc)
1299 return rc;
1300
1301 sess_data->iov[0].iov_base = (char *)smb_buf;
1302 sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
1303 /*
1304 * This variable will be used to clear the buffer
1305 * allocated above in case of any error in the calling function.
1306 */
1307 sess_data->buf0_type = CIFS_SMALL_BUFFER;
1308
1309 /* 2000 big enough to fit max user, domain, NOS name etc. */
1310 sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
1311 if (!sess_data->iov[2].iov_base) {
1312 rc = -ENOMEM;
1313 goto out_free_smb_buf;
1314 }
1315
1316 return 0;
1317
1318 out_free_smb_buf:
1319 cifs_small_buf_release(smb_buf);
1320 sess_data->iov[0].iov_base = NULL;
1321 sess_data->iov[0].iov_len = 0;
1322 sess_data->buf0_type = CIFS_NO_BUFFER;
1323 return rc;
1324 }
1325
1326 static void
sess_free_buffer(struct sess_data * sess_data)1327 sess_free_buffer(struct sess_data *sess_data)
1328 {
1329 struct kvec *iov = sess_data->iov;
1330
1331 /*
1332 * Zero the session data before freeing, as it might contain sensitive info (keys, etc).
1333 * Note that iov[1] is already freed by caller.
1334 */
1335 if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base)
1336 memzero_explicit(iov[0].iov_base, iov[0].iov_len);
1337
1338 free_rsp_buf(sess_data->buf0_type, iov[0].iov_base);
1339 sess_data->buf0_type = CIFS_NO_BUFFER;
1340 kfree_sensitive(iov[2].iov_base);
1341 }
1342
1343 static int
sess_establish_session(struct sess_data * sess_data)1344 sess_establish_session(struct sess_data *sess_data)
1345 {
1346 struct cifs_ses *ses = sess_data->ses;
1347 struct TCP_Server_Info *server = sess_data->server;
1348
1349 cifs_server_lock(server);
1350 if (!server->session_estab) {
1351 if (server->sign) {
1352 server->session_key.response =
1353 kmemdup(ses->auth_key.response,
1354 ses->auth_key.len, GFP_KERNEL);
1355 if (!server->session_key.response) {
1356 cifs_server_unlock(server);
1357 return -ENOMEM;
1358 }
1359 server->session_key.len =
1360 ses->auth_key.len;
1361 }
1362 server->sequence_number = 0x2;
1363 server->session_estab = true;
1364 }
1365 cifs_server_unlock(server);
1366
1367 cifs_dbg(FYI, "CIFS session established successfully\n");
1368 return 0;
1369 }
1370
1371 static int
sess_sendreceive(struct sess_data * sess_data)1372 sess_sendreceive(struct sess_data *sess_data)
1373 {
1374 int rc;
1375 struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
1376 __u16 count;
1377 struct kvec rsp_iov = { NULL, 0 };
1378
1379 count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
1380 be32_add_cpu(&smb_buf->smb_buf_length, count);
1381 put_bcc(count, smb_buf);
1382
1383 rc = SendReceive2(sess_data->xid, sess_data->ses,
1384 sess_data->iov, 3 /* num_iovecs */,
1385 &sess_data->buf0_type,
1386 CIFS_LOG_ERROR, &rsp_iov);
1387 cifs_small_buf_release(sess_data->iov[0].iov_base);
1388 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
1389
1390 return rc;
1391 }
1392
1393 static void
sess_auth_ntlmv2(struct sess_data * sess_data)1394 sess_auth_ntlmv2(struct sess_data *sess_data)
1395 {
1396 int rc = 0;
1397 struct smb_hdr *smb_buf;
1398 SESSION_SETUP_ANDX *pSMB;
1399 char *bcc_ptr;
1400 struct cifs_ses *ses = sess_data->ses;
1401 struct TCP_Server_Info *server = sess_data->server;
1402 __u32 capabilities;
1403 __u16 bytes_remaining;
1404
1405 /* old style NTLM sessionsetup */
1406 /* wct = 13 */
1407 rc = sess_alloc_buffer(sess_data, 13);
1408 if (rc)
1409 goto out;
1410
1411 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1412 bcc_ptr = sess_data->iov[2].iov_base;
1413 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1414
1415 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1416
1417 /* LM2 password would be here if we supported it */
1418 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1419
1420 if (ses->user_name != NULL) {
1421 /* calculate nlmv2 response and session key */
1422 rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
1423 if (rc) {
1424 cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
1425 goto out;
1426 }
1427
1428 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1429 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1430 bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1431
1432 /* set case sensitive password length after tilen may get
1433 * assigned, tilen is 0 otherwise.
1434 */
1435 pSMB->req_no_secext.CaseSensitivePasswordLength =
1436 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1437 } else {
1438 pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1439 }
1440
1441 if (ses->capabilities & CAP_UNICODE) {
1442 if (!IS_ALIGNED(sess_data->iov[0].iov_len, 2)) {
1443 *bcc_ptr = 0;
1444 bcc_ptr++;
1445 }
1446 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1447 } else {
1448 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1449 }
1450
1451
1452 sess_data->iov[2].iov_len = (long) bcc_ptr -
1453 (long) sess_data->iov[2].iov_base;
1454
1455 rc = sess_sendreceive(sess_data);
1456 if (rc)
1457 goto out;
1458
1459 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1460 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1461
1462 if (smb_buf->WordCount != 3) {
1463 rc = -EIO;
1464 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1465 goto out;
1466 }
1467
1468 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1469 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1470
1471 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1472 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1473
1474 bytes_remaining = get_bcc(smb_buf);
1475 bcc_ptr = pByteArea(smb_buf);
1476
1477 /* BB check if Unicode and decode strings */
1478 if (bytes_remaining == 0) {
1479 /* no string area to decode, do nothing */
1480 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1481 /* unicode string area must be word-aligned */
1482 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1483 ++bcc_ptr;
1484 --bytes_remaining;
1485 }
1486 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1487 sess_data->nls_cp);
1488 } else {
1489 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1490 sess_data->nls_cp);
1491 }
1492
1493 rc = sess_establish_session(sess_data);
1494 out:
1495 sess_data->result = rc;
1496 sess_data->func = NULL;
1497 sess_free_buffer(sess_data);
1498 kfree_sensitive(ses->auth_key.response);
1499 ses->auth_key.response = NULL;
1500 }
1501
1502 #ifdef CONFIG_CIFS_UPCALL
1503 static void
sess_auth_kerberos(struct sess_data * sess_data)1504 sess_auth_kerberos(struct sess_data *sess_data)
1505 {
1506 int rc = 0;
1507 struct smb_hdr *smb_buf;
1508 SESSION_SETUP_ANDX *pSMB;
1509 char *bcc_ptr;
1510 struct cifs_ses *ses = sess_data->ses;
1511 struct TCP_Server_Info *server = sess_data->server;
1512 __u32 capabilities;
1513 __u16 bytes_remaining;
1514 struct key *spnego_key = NULL;
1515 struct cifs_spnego_msg *msg;
1516 u16 blob_len;
1517
1518 /* extended security */
1519 /* wct = 12 */
1520 rc = sess_alloc_buffer(sess_data, 12);
1521 if (rc)
1522 goto out;
1523
1524 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1525 bcc_ptr = sess_data->iov[2].iov_base;
1526 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1527
1528 spnego_key = cifs_get_spnego_key(ses, server);
1529 if (IS_ERR(spnego_key)) {
1530 rc = PTR_ERR(spnego_key);
1531 spnego_key = NULL;
1532 goto out;
1533 }
1534
1535 msg = spnego_key->payload.data[0];
1536 /*
1537 * check version field to make sure that cifs.upcall is
1538 * sending us a response in an expected form
1539 */
1540 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1541 cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1542 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1543 rc = -EKEYREJECTED;
1544 goto out_put_spnego_key;
1545 }
1546
1547 kfree_sensitive(ses->auth_key.response);
1548 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1549 GFP_KERNEL);
1550 if (!ses->auth_key.response) {
1551 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1552 msg->sesskey_len);
1553 rc = -ENOMEM;
1554 goto out_put_spnego_key;
1555 }
1556 ses->auth_key.len = msg->sesskey_len;
1557
1558 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1559 capabilities |= CAP_EXTENDED_SECURITY;
1560 pSMB->req.Capabilities = cpu_to_le32(capabilities);
1561 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1562 sess_data->iov[1].iov_len = msg->secblob_len;
1563 pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1564
1565 if (ses->capabilities & CAP_UNICODE) {
1566 /* unicode strings must be word aligned */
1567 if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1568 *bcc_ptr = 0;
1569 bcc_ptr++;
1570 }
1571 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1572 unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1573 } else {
1574 /* BB: is this right? */
1575 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1576 }
1577
1578 sess_data->iov[2].iov_len = (long) bcc_ptr -
1579 (long) sess_data->iov[2].iov_base;
1580
1581 rc = sess_sendreceive(sess_data);
1582 if (rc)
1583 goto out_put_spnego_key;
1584
1585 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1586 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1587
1588 if (smb_buf->WordCount != 4) {
1589 rc = -EIO;
1590 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1591 goto out_put_spnego_key;
1592 }
1593
1594 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1595 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1596
1597 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1598 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1599
1600 bytes_remaining = get_bcc(smb_buf);
1601 bcc_ptr = pByteArea(smb_buf);
1602
1603 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1604 if (blob_len > bytes_remaining) {
1605 cifs_dbg(VFS, "bad security blob length %d\n",
1606 blob_len);
1607 rc = -EINVAL;
1608 goto out_put_spnego_key;
1609 }
1610 bcc_ptr += blob_len;
1611 bytes_remaining -= blob_len;
1612
1613 /* BB check if Unicode and decode strings */
1614 if (bytes_remaining == 0) {
1615 /* no string area to decode, do nothing */
1616 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1617 /* unicode string area must be word-aligned */
1618 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1619 ++bcc_ptr;
1620 --bytes_remaining;
1621 }
1622 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1623 sess_data->nls_cp);
1624 } else {
1625 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1626 sess_data->nls_cp);
1627 }
1628
1629 rc = sess_establish_session(sess_data);
1630 out_put_spnego_key:
1631 key_invalidate(spnego_key);
1632 key_put(spnego_key);
1633 out:
1634 sess_data->result = rc;
1635 sess_data->func = NULL;
1636 sess_free_buffer(sess_data);
1637 kfree_sensitive(ses->auth_key.response);
1638 ses->auth_key.response = NULL;
1639 }
1640
1641 #endif /* ! CONFIG_CIFS_UPCALL */
1642
1643 /*
1644 * The required kvec buffers have to be allocated before calling this
1645 * function.
1646 */
1647 static int
_sess_auth_rawntlmssp_assemble_req(struct sess_data * sess_data)1648 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1649 {
1650 SESSION_SETUP_ANDX *pSMB;
1651 struct cifs_ses *ses = sess_data->ses;
1652 struct TCP_Server_Info *server = sess_data->server;
1653 __u32 capabilities;
1654 char *bcc_ptr;
1655
1656 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1657
1658 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1659 if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) {
1660 cifs_dbg(VFS, "NTLMSSP requires Unicode support\n");
1661 return -ENOSYS;
1662 }
1663
1664 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1665 capabilities |= CAP_EXTENDED_SECURITY;
1666 pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1667
1668 bcc_ptr = sess_data->iov[2].iov_base;
1669 /* unicode strings must be word aligned */
1670 if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1671 *bcc_ptr = 0;
1672 bcc_ptr++;
1673 }
1674 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1675
1676 sess_data->iov[2].iov_len = (long) bcc_ptr -
1677 (long) sess_data->iov[2].iov_base;
1678
1679 return 0;
1680 }
1681
1682 static void
1683 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1684
1685 static void
sess_auth_rawntlmssp_negotiate(struct sess_data * sess_data)1686 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1687 {
1688 int rc;
1689 struct smb_hdr *smb_buf;
1690 SESSION_SETUP_ANDX *pSMB;
1691 struct cifs_ses *ses = sess_data->ses;
1692 struct TCP_Server_Info *server = sess_data->server;
1693 __u16 bytes_remaining;
1694 char *bcc_ptr;
1695 unsigned char *ntlmsspblob = NULL;
1696 u16 blob_len;
1697
1698 cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1699
1700 /*
1701 * if memory allocation is successful, caller of this function
1702 * frees it.
1703 */
1704 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1705 if (!ses->ntlmssp) {
1706 rc = -ENOMEM;
1707 goto out;
1708 }
1709 ses->ntlmssp->sesskey_per_smbsess = false;
1710
1711 /* wct = 12 */
1712 rc = sess_alloc_buffer(sess_data, 12);
1713 if (rc)
1714 goto out;
1715
1716 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1717
1718 /* Build security blob before we assemble the request */
1719 rc = build_ntlmssp_negotiate_blob(&ntlmsspblob,
1720 &blob_len, ses, server,
1721 sess_data->nls_cp);
1722 if (rc)
1723 goto out_free_ntlmsspblob;
1724
1725 sess_data->iov[1].iov_len = blob_len;
1726 sess_data->iov[1].iov_base = ntlmsspblob;
1727 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1728
1729 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1730 if (rc)
1731 goto out_free_ntlmsspblob;
1732
1733 rc = sess_sendreceive(sess_data);
1734
1735 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1736 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1737
1738 /* If true, rc here is expected and not an error */
1739 if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1740 smb_buf->Status.CifsError ==
1741 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1742 rc = 0;
1743
1744 if (rc)
1745 goto out_free_ntlmsspblob;
1746
1747 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1748
1749 if (smb_buf->WordCount != 4) {
1750 rc = -EIO;
1751 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1752 goto out_free_ntlmsspblob;
1753 }
1754
1755 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1756 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1757
1758 bytes_remaining = get_bcc(smb_buf);
1759 bcc_ptr = pByteArea(smb_buf);
1760
1761 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1762 if (blob_len > bytes_remaining) {
1763 cifs_dbg(VFS, "bad security blob length %d\n",
1764 blob_len);
1765 rc = -EINVAL;
1766 goto out_free_ntlmsspblob;
1767 }
1768
1769 rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1770
1771 out_free_ntlmsspblob:
1772 kfree_sensitive(ntlmsspblob);
1773 out:
1774 sess_free_buffer(sess_data);
1775
1776 if (!rc) {
1777 sess_data->func = sess_auth_rawntlmssp_authenticate;
1778 return;
1779 }
1780
1781 /* Else error. Cleanup */
1782 kfree_sensitive(ses->auth_key.response);
1783 ses->auth_key.response = NULL;
1784 kfree_sensitive(ses->ntlmssp);
1785 ses->ntlmssp = NULL;
1786
1787 sess_data->func = NULL;
1788 sess_data->result = rc;
1789 }
1790
1791 static void
sess_auth_rawntlmssp_authenticate(struct sess_data * sess_data)1792 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1793 {
1794 int rc;
1795 struct smb_hdr *smb_buf;
1796 SESSION_SETUP_ANDX *pSMB;
1797 struct cifs_ses *ses = sess_data->ses;
1798 struct TCP_Server_Info *server = sess_data->server;
1799 __u16 bytes_remaining;
1800 char *bcc_ptr;
1801 unsigned char *ntlmsspblob = NULL;
1802 u16 blob_len;
1803
1804 cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1805
1806 /* wct = 12 */
1807 rc = sess_alloc_buffer(sess_data, 12);
1808 if (rc)
1809 goto out;
1810
1811 /* Build security blob before we assemble the request */
1812 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1813 smb_buf = (struct smb_hdr *)pSMB;
1814 rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1815 &blob_len, ses, server,
1816 sess_data->nls_cp);
1817 if (rc)
1818 goto out_free_ntlmsspblob;
1819 sess_data->iov[1].iov_len = blob_len;
1820 sess_data->iov[1].iov_base = ntlmsspblob;
1821 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1822 /*
1823 * Make sure that we tell the server that we are using
1824 * the uid that it just gave us back on the response
1825 * (challenge)
1826 */
1827 smb_buf->Uid = ses->Suid;
1828
1829 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1830 if (rc)
1831 goto out_free_ntlmsspblob;
1832
1833 rc = sess_sendreceive(sess_data);
1834 if (rc)
1835 goto out_free_ntlmsspblob;
1836
1837 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1838 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1839 if (smb_buf->WordCount != 4) {
1840 rc = -EIO;
1841 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1842 goto out_free_ntlmsspblob;
1843 }
1844
1845 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1846 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1847
1848 if (ses->Suid != smb_buf->Uid) {
1849 ses->Suid = smb_buf->Uid;
1850 cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1851 }
1852
1853 bytes_remaining = get_bcc(smb_buf);
1854 bcc_ptr = pByteArea(smb_buf);
1855 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1856 if (blob_len > bytes_remaining) {
1857 cifs_dbg(VFS, "bad security blob length %d\n",
1858 blob_len);
1859 rc = -EINVAL;
1860 goto out_free_ntlmsspblob;
1861 }
1862 bcc_ptr += blob_len;
1863 bytes_remaining -= blob_len;
1864
1865
1866 /* BB check if Unicode and decode strings */
1867 if (bytes_remaining == 0) {
1868 /* no string area to decode, do nothing */
1869 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1870 /* unicode string area must be word-aligned */
1871 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1872 ++bcc_ptr;
1873 --bytes_remaining;
1874 }
1875 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1876 sess_data->nls_cp);
1877 } else {
1878 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1879 sess_data->nls_cp);
1880 }
1881
1882 out_free_ntlmsspblob:
1883 kfree_sensitive(ntlmsspblob);
1884 out:
1885 sess_free_buffer(sess_data);
1886
1887 if (!rc)
1888 rc = sess_establish_session(sess_data);
1889
1890 /* Cleanup */
1891 kfree_sensitive(ses->auth_key.response);
1892 ses->auth_key.response = NULL;
1893 kfree_sensitive(ses->ntlmssp);
1894 ses->ntlmssp = NULL;
1895
1896 sess_data->func = NULL;
1897 sess_data->result = rc;
1898 }
1899
select_sec(struct sess_data * sess_data)1900 static int select_sec(struct sess_data *sess_data)
1901 {
1902 int type;
1903 struct cifs_ses *ses = sess_data->ses;
1904 struct TCP_Server_Info *server = sess_data->server;
1905
1906 type = cifs_select_sectype(server, ses->sectype);
1907 cifs_dbg(FYI, "sess setup type %d\n", type);
1908 if (type == Unspecified) {
1909 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1910 return -EINVAL;
1911 }
1912
1913 switch (type) {
1914 case NTLMv2:
1915 sess_data->func = sess_auth_ntlmv2;
1916 break;
1917 case Kerberos:
1918 #ifdef CONFIG_CIFS_UPCALL
1919 sess_data->func = sess_auth_kerberos;
1920 break;
1921 #else
1922 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1923 return -ENOSYS;
1924 #endif /* CONFIG_CIFS_UPCALL */
1925 case RawNTLMSSP:
1926 sess_data->func = sess_auth_rawntlmssp_negotiate;
1927 break;
1928 default:
1929 cifs_dbg(VFS, "secType %d not supported!\n", type);
1930 return -ENOSYS;
1931 }
1932
1933 return 0;
1934 }
1935
CIFS_SessSetup(const unsigned int xid,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1936 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
1937 struct TCP_Server_Info *server,
1938 const struct nls_table *nls_cp)
1939 {
1940 int rc = 0;
1941 struct sess_data *sess_data;
1942
1943 if (ses == NULL) {
1944 WARN(1, "%s: ses == NULL!", __func__);
1945 return -EINVAL;
1946 }
1947
1948 sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
1949 if (!sess_data)
1950 return -ENOMEM;
1951
1952 sess_data->xid = xid;
1953 sess_data->ses = ses;
1954 sess_data->server = server;
1955 sess_data->buf0_type = CIFS_NO_BUFFER;
1956 sess_data->nls_cp = (struct nls_table *) nls_cp;
1957
1958 rc = select_sec(sess_data);
1959 if (rc)
1960 goto out;
1961
1962 while (sess_data->func)
1963 sess_data->func(sess_data);
1964
1965 /* Store result before we free sess_data */
1966 rc = sess_data->result;
1967
1968 out:
1969 kfree_sensitive(sess_data);
1970 return rc;
1971 }
1972 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
1973