1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3 *
4 * SMB/CIFS session setup handling routines
5 *
6 * Copyright (c) International Business Machines Corp., 2006, 2009
7 * Author(s): Steve French (sfrench@us.ibm.com)
8 *
9 */
10
11 #include "cifsglob.h"
12 #include "cifsproto.h"
13 #include "cifs_unicode.h"
14 #include "cifs_debug.h"
15 #include "ntlmssp.h"
16 #include "nterr.h"
17 #include <linux/utsname.h>
18 #include <linux/slab.h>
19 #include <linux/version.h>
20 #include "cifsfs.h"
21 #include "cifs_spnego.h"
22 #include "smb2proto.h"
23 #include "fs_context.h"
24
25 static int
26 cifs_ses_add_channel(struct cifs_ses *ses,
27 struct cifs_server_iface *iface);
28
is_ses_using_iface(struct cifs_ses * ses,struct cifs_server_iface * iface)29 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
30 {
31 int i;
32
33 spin_lock(&ses->chan_lock);
34 for (i = 0; i < ses->chan_count; i++) {
35 if (ses->chans[i].iface == iface) {
36 spin_unlock(&ses->chan_lock);
37 return true;
38 }
39 }
40 spin_unlock(&ses->chan_lock);
41 return false;
42 }
43
44 /* channel helper functions. assumed that chan_lock is held by caller. */
45
46 int
cifs_ses_get_chan_index(struct cifs_ses * ses,struct TCP_Server_Info * server)47 cifs_ses_get_chan_index(struct cifs_ses *ses,
48 struct TCP_Server_Info *server)
49 {
50 unsigned int i;
51
52 /* if the channel is waiting for termination */
53 if (server && server->terminate)
54 return CIFS_INVAL_CHAN_INDEX;
55
56 for (i = 0; i < ses->chan_count; i++) {
57 if (ses->chans[i].server == server)
58 return i;
59 }
60
61 /* If we didn't find the channel, it is likely a bug */
62 if (server)
63 cifs_dbg(VFS, "unable to get chan index for server: 0x%llx",
64 server->conn_id);
65 return CIFS_INVAL_CHAN_INDEX;
66 }
67
68 void
cifs_chan_set_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)69 cifs_chan_set_in_reconnect(struct cifs_ses *ses,
70 struct TCP_Server_Info *server)
71 {
72 int chan_index = cifs_ses_get_chan_index(ses, server);
73
74 if (chan_index == CIFS_INVAL_CHAN_INDEX)
75 return;
76
77 ses->chans[chan_index].in_reconnect = true;
78 }
79
80 void
cifs_chan_clear_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)81 cifs_chan_clear_in_reconnect(struct cifs_ses *ses,
82 struct TCP_Server_Info *server)
83 {
84 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
85
86 if (chan_index == CIFS_INVAL_CHAN_INDEX)
87 return;
88
89 ses->chans[chan_index].in_reconnect = false;
90 }
91
92 void
cifs_chan_set_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)93 cifs_chan_set_need_reconnect(struct cifs_ses *ses,
94 struct TCP_Server_Info *server)
95 {
96 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
97
98 if (chan_index == CIFS_INVAL_CHAN_INDEX)
99 return;
100
101 set_bit(chan_index, &ses->chans_need_reconnect);
102 cifs_dbg(FYI, "Set reconnect bitmask for chan %u; now 0x%lx\n",
103 chan_index, ses->chans_need_reconnect);
104 }
105
106 void
cifs_chan_clear_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)107 cifs_chan_clear_need_reconnect(struct cifs_ses *ses,
108 struct TCP_Server_Info *server)
109 {
110 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
111
112 if (chan_index == CIFS_INVAL_CHAN_INDEX)
113 return;
114
115 clear_bit(chan_index, &ses->chans_need_reconnect);
116 cifs_dbg(FYI, "Cleared reconnect bitmask for chan %u; now 0x%lx\n",
117 chan_index, ses->chans_need_reconnect);
118 }
119
120 bool
cifs_chan_needs_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)121 cifs_chan_needs_reconnect(struct cifs_ses *ses,
122 struct TCP_Server_Info *server)
123 {
124 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
125
126 if (chan_index == CIFS_INVAL_CHAN_INDEX)
127 return true; /* err on the safer side */
128
129 return CIFS_CHAN_NEEDS_RECONNECT(ses, chan_index);
130 }
131
132 bool
cifs_chan_is_iface_active(struct cifs_ses * ses,struct TCP_Server_Info * server)133 cifs_chan_is_iface_active(struct cifs_ses *ses,
134 struct TCP_Server_Info *server)
135 {
136 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
137
138 if (chan_index == CIFS_INVAL_CHAN_INDEX)
139 return true; /* err on the safer side */
140
141 return ses->chans[chan_index].iface &&
142 ses->chans[chan_index].iface->is_active;
143 }
144
145 /* returns number of channels added */
cifs_try_adding_channels(struct cifs_ses * ses)146 int cifs_try_adding_channels(struct cifs_ses *ses)
147 {
148 struct TCP_Server_Info *server = ses->server;
149 int old_chan_count, new_chan_count;
150 int left;
151 int rc = 0;
152 int tries = 0, attempts;
153 size_t iface_weight = 0, iface_min_speed = 0;
154 struct cifs_server_iface *iface = NULL, *candidate = NULL;
155 struct cifs_server_iface *last_iface = NULL;
156
157 spin_lock(&ses->chan_lock);
158
159 new_chan_count = old_chan_count = ses->chan_count;
160 left = ses->chan_max - ses->chan_count;
161
162 if (left <= 0) {
163 spin_unlock(&ses->chan_lock);
164 cifs_dbg(FYI,
165 "ses already at max_channels (%zu), nothing to open\n",
166 ses->chan_max);
167 return 0;
168 }
169
170 if (server->dialect < SMB30_PROT_ID) {
171 spin_unlock(&ses->chan_lock);
172 cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
173 return 0;
174 }
175
176 if (!(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
177 spin_unlock(&ses->chan_lock);
178 cifs_server_dbg(VFS, "no multichannel support\n");
179 return 0;
180 }
181 spin_unlock(&ses->chan_lock);
182
183 while (left > 0) {
184
185 tries++;
186 if (tries > 3*ses->chan_max) {
187 cifs_dbg(VFS, "too many channel open attempts (%d channels left to open)\n",
188 left);
189 break;
190 }
191
192 spin_lock(&ses->iface_lock);
193 if (!ses->iface_count) {
194 spin_unlock(&ses->iface_lock);
195 cifs_dbg(ONCE, "server %s does not advertise interfaces\n",
196 ses->server->hostname);
197 break;
198 }
199
200 last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
201 iface_head);
202 iface_min_speed = last_iface->speed;
203 spin_unlock(&ses->iface_lock);
204
205 attempts = 0;
206 while (left > 0) {
207 spin_lock(&ses->iface_lock);
208
209 /*
210 * iface_lock must be dropped while opening a channel,
211 * and a concurrent interface refresh may remove and
212 * free entries during that window, so no list entry
213 * may be kept across it without a reference. Scan
214 * the list from the beginning each time and only pass
215 * a referenced candidate to cifs_ses_add_channel();
216 * weight_fulfilled tracks the progress so that no
217 * iface is selected beyond its weight.
218 */
219 candidate = NULL;
220 list_for_each_entry(iface, &ses->iface_list, iface_head) {
221 /* do not mix rdma and non-rdma interfaces */
222 if (iface->rdma_capable != ses->server->rdma)
223 continue;
224
225 /* skip ifaces that are unusable */
226 if (!iface->is_active ||
227 (is_ses_using_iface(ses, iface) &&
228 !iface->rss_capable))
229 continue;
230
231 /* check if we already allocated enough channels */
232 iface_weight = iface->speed / iface_min_speed;
233
234 if (iface->weight_fulfilled >= iface_weight)
235 continue;
236
237 /* take ref before unlock */
238 kref_get(&iface->refcount);
239 candidate = iface;
240 break;
241 }
242
243 if (!candidate) {
244 /* no usable iface. reset weight_fulfilled and start over */
245 list_for_each_entry(iface, &ses->iface_list, iface_head)
246 iface->weight_fulfilled = 0;
247 spin_unlock(&ses->iface_lock);
248 break;
249 }
250
251 attempts++;
252 if (attempts > 3 * ses->chan_max) {
253 kref_put(&candidate->refcount, release_iface);
254 spin_unlock(&ses->iface_lock);
255 break;
256 }
257
258 spin_unlock(&ses->iface_lock);
259 rc = cifs_ses_add_channel(ses, candidate);
260 spin_lock(&ses->iface_lock);
261
262 if (rc) {
263 cifs_dbg(VFS, "failed to open extra channel on iface:%pIS rc=%d\n",
264 &candidate->sockaddr,
265 rc);
266 /* failure to add chan should increase weight */
267 candidate->weight_fulfilled++;
268 kref_put(&candidate->refcount, release_iface);
269 spin_unlock(&ses->iface_lock);
270 continue;
271 }
272
273 candidate->num_channels++;
274 candidate->weight_fulfilled++;
275 cifs_info("successfully opened new channel on iface:%pIS\n",
276 &candidate->sockaddr);
277 spin_unlock(&ses->iface_lock);
278
279 left--;
280 new_chan_count++;
281 break;
282 }
283 }
284
285 return new_chan_count - old_chan_count;
286 }
287
288 /*
289 * cifs_decrease_secondary_channels - Reduce the number of active secondary channels
290 * @ses: pointer to the CIFS session structure
291 * @disable_mchan: if true, reduce to a single channel; if false, reduce to chan_max
292 *
293 * This function disables and cleans up extra secondary channels for a CIFS session.
294 * If called during reconfiguration, it reduces the channel count to the new maximum (chan_max).
295 * Otherwise, it disables all but the primary channel.
296 */
297 void
cifs_decrease_secondary_channels(struct cifs_ses * ses,bool disable_mchan)298 cifs_decrease_secondary_channels(struct cifs_ses *ses, bool disable_mchan)
299 {
300 int i, chan_count;
301 struct TCP_Server_Info *server;
302 struct cifs_server_iface *iface;
303
304 spin_lock(&ses->chan_lock);
305 chan_count = ses->chan_count;
306 if (chan_count == 1)
307 goto done;
308
309 /* Update the chan_count to the new maximum */
310 if (disable_mchan) {
311 cifs_dbg(FYI, "server does not support multichannel anymore.\n");
312 ses->chan_count = 1;
313 } else {
314 ses->chan_count = ses->chan_max;
315 }
316
317 /* Disable all secondary channels beyond the new chan_count */
318 for (i = ses->chan_count ; i < chan_count; i++) {
319 iface = ses->chans[i].iface;
320 server = ses->chans[i].server;
321
322 /*
323 * remove these references first, since we need to unlock
324 * the chan_lock here, since iface_lock is a higher lock
325 */
326 ses->chans[i].iface = NULL;
327 ses->chans[i].server = NULL;
328 spin_unlock(&ses->chan_lock);
329
330 if (iface) {
331 spin_lock(&ses->iface_lock);
332 iface->num_channels--;
333 if (iface->weight_fulfilled)
334 iface->weight_fulfilled--;
335 kref_put(&iface->refcount, release_iface);
336 spin_unlock(&ses->iface_lock);
337 }
338
339 if (server) {
340 if (!server->terminate) {
341 server->terminate = true;
342 cifs_signal_cifsd_for_reconnect(server, false);
343 }
344 cifs_put_tcp_session(server, false);
345 }
346
347 spin_lock(&ses->chan_lock);
348 }
349
350 /* For extra secondary channels, reset the need reconnect bit */
351 if (ses->chan_count == 1) {
352 cifs_dbg(VFS, "Disable all secondary channels\n");
353 ses->chans_need_reconnect &= 1;
354 } else {
355 cifs_dbg(VFS, "Disable extra secondary channels\n");
356 ses->chans_need_reconnect &= ((1UL << ses->chan_max) - 1);
357 }
358
359 done:
360 spin_unlock(&ses->chan_lock);
361 }
362
363 /* update the iface for the channel if necessary. */
364 void
cifs_chan_update_iface(struct cifs_ses * ses,struct TCP_Server_Info * server)365 cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server)
366 {
367 unsigned int chan_index;
368 size_t iface_weight = 0, iface_min_speed = 0;
369 struct cifs_server_iface *iface = NULL;
370 struct cifs_server_iface *old_iface = NULL;
371 struct cifs_server_iface *last_iface = NULL;
372 struct sockaddr_storage ss;
373 int retry = 0;
374
375 spin_lock(&ses->chan_lock);
376 chan_index = cifs_ses_get_chan_index(ses, server);
377 if (chan_index == CIFS_INVAL_CHAN_INDEX) {
378 spin_unlock(&ses->chan_lock);
379 return;
380 }
381
382 if (ses->chans[chan_index].iface) {
383 old_iface = ses->chans[chan_index].iface;
384 if (old_iface->is_active) {
385 spin_unlock(&ses->chan_lock);
386 return;
387 }
388 }
389 spin_unlock(&ses->chan_lock);
390
391 spin_lock(&server->srv_lock);
392 ss = server->dstaddr;
393 spin_unlock(&server->srv_lock);
394
395 spin_lock(&ses->iface_lock);
396 if (!ses->iface_count) {
397 spin_unlock(&ses->iface_lock);
398 cifs_dbg(ONCE, "server %s does not advertise interfaces\n", ses->server->hostname);
399 return;
400 }
401
402 try_again:
403 last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
404 iface_head);
405 iface_min_speed = last_iface->speed;
406
407 /* then look for a new one */
408 list_for_each_entry(iface, &ses->iface_list, iface_head) {
409 if (!chan_index) {
410 /* if we're trying to get the updated iface for primary channel */
411 if (!cifs_match_ipaddr((struct sockaddr *) &ss,
412 (struct sockaddr *) &iface->sockaddr))
413 continue;
414
415 kref_get(&iface->refcount);
416 break;
417 }
418
419 /* do not mix rdma and non-rdma interfaces */
420 if (iface->rdma_capable != server->rdma)
421 continue;
422
423 if (!iface->is_active ||
424 (is_ses_using_iface(ses, iface) &&
425 !iface->rss_capable)) {
426 continue;
427 }
428
429 /* check if we already allocated enough channels */
430 iface_weight = iface->speed / iface_min_speed;
431
432 if (iface->weight_fulfilled >= iface_weight)
433 continue;
434
435 kref_get(&iface->refcount);
436 break;
437 }
438
439 if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
440 list_for_each_entry(iface, &ses->iface_list, iface_head)
441 iface->weight_fulfilled = 0;
442
443 /* see if it can be satisfied in second attempt */
444 if (!retry++)
445 goto try_again;
446
447 iface = NULL;
448 cifs_dbg(FYI, "unable to find a suitable iface\n");
449 }
450
451 if (!iface) {
452 if (!chan_index)
453 cifs_dbg(FYI, "unable to get the interface matching: %pIS\n",
454 &ss);
455 else {
456 cifs_dbg(FYI, "unable to find another interface to replace: %pIS\n",
457 &old_iface->sockaddr);
458 }
459
460 spin_unlock(&ses->iface_lock);
461 return;
462 }
463
464 /* now drop the ref to the current iface */
465 if (old_iface) {
466 cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n",
467 &old_iface->sockaddr,
468 &iface->sockaddr);
469
470 old_iface->num_channels--;
471 if (old_iface->weight_fulfilled)
472 old_iface->weight_fulfilled--;
473 iface->num_channels++;
474 iface->weight_fulfilled++;
475
476 kref_put(&old_iface->refcount, release_iface);
477 } else if (!chan_index) {
478 /* special case: update interface for primary channel */
479 cifs_dbg(FYI, "referencing primary channel iface: %pIS\n",
480 &iface->sockaddr);
481 iface->num_channels++;
482 iface->weight_fulfilled++;
483 }
484 spin_unlock(&ses->iface_lock);
485
486 spin_lock(&ses->chan_lock);
487 chan_index = cifs_ses_get_chan_index(ses, server);
488 if (chan_index == CIFS_INVAL_CHAN_INDEX) {
489 spin_unlock(&ses->chan_lock);
490 return;
491 }
492
493 ses->chans[chan_index].iface = iface;
494 spin_unlock(&ses->chan_lock);
495
496 spin_lock(&server->srv_lock);
497 memcpy(&server->dstaddr, &iface->sockaddr, sizeof(server->dstaddr));
498 spin_unlock(&server->srv_lock);
499 }
500
501 static int
cifs_ses_add_channel(struct cifs_ses * ses,struct cifs_server_iface * iface)502 cifs_ses_add_channel(struct cifs_ses *ses,
503 struct cifs_server_iface *iface)
504 {
505 struct TCP_Server_Info *chan_server;
506 struct cifs_chan *chan;
507 struct smb3_fs_context *ctx;
508 static const char unc_fmt[] = "\\%s\\foo";
509 struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
510 struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
511 size_t len;
512 int rc;
513 unsigned int xid = get_xid();
514
515 if (iface->sockaddr.ss_family == AF_INET)
516 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
517 ses, iface->speed, str_yes_no(iface->rdma_capable),
518 &ipv4->sin_addr);
519 else
520 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI6)\n",
521 ses, iface->speed, str_yes_no(iface->rdma_capable),
522 &ipv6->sin6_addr);
523
524 /*
525 * Setup a ctx with mostly the same info as the existing
526 * session and overwrite it with the requested iface data.
527 *
528 * We need to setup at least the fields used for negprot and
529 * sesssetup.
530 *
531 * We only need the ctx here, so we can reuse memory from
532 * the session and server without caring about memory
533 * management.
534 */
535 ctx = kzalloc_obj(*ctx);
536 if (!ctx) {
537 rc = -ENOMEM;
538 goto out_free_xid;
539 }
540
541 /* Always make new connection for now (TODO?) */
542 ctx->nosharesock = true;
543
544 /* Auth */
545 ctx->domainauto = ses->domainAuto;
546 ctx->domainname = ses->domainName;
547
548 ctx->server_hostname = ses->server->hostname;
549
550 ctx->username = ses->user_name;
551 ctx->password = ses->password;
552 ctx->sectype = ses->sectype;
553 ctx->sign = ses->sign;
554 ctx->unicode = ses->unicode;
555
556 /* UNC and paths */
557 /* XXX: Use ses->server->hostname? */
558 len = sizeof(unc_fmt) + SERVER_NAME_LEN_WITH_NULL;
559 ctx->UNC = kzalloc(len, GFP_KERNEL);
560 if (!ctx->UNC) {
561 rc = -ENOMEM;
562 goto out_free_ctx;
563 }
564 scnprintf(ctx->UNC, len, unc_fmt, ses->ip_addr);
565 ctx->prepath = "";
566
567 /* Reuse same version as master connection */
568 ctx->vals = ses->server->vals;
569 ctx->ops = ses->server->ops;
570
571 ctx->noblocksnd = ses->server->noblocksnd;
572 ctx->noautotune = ses->server->noautotune;
573 ctx->sockopt_tcp_nodelay = ses->server->tcp_nodelay;
574 ctx->echo_interval = ses->server->echo_interval / HZ;
575 ctx->max_credits = ses->server->max_credits;
576 ctx->min_offload = ses->server->min_offload;
577 ctx->compress = ses->server->compression.requested;
578 ctx->dfs_conn = ses->server->dfs_conn;
579 ctx->ignore_signature = ses->server->ignore_signature;
580 ctx->leaf_fullpath = ses->server->leaf_fullpath;
581 ctx->rootfs = ses->server->noblockcnt;
582 ctx->retrans = ses->server->retrans;
583
584 /*
585 * This will be used for encoding/decoding user/domain/pw
586 * during sess setup auth.
587 */
588 ctx->local_nls = ses->local_nls;
589
590 /* Use RDMA if possible */
591 ctx->rdma = iface->rdma_capable;
592 memcpy(&ctx->dstaddr, &iface->sockaddr, sizeof(ctx->dstaddr));
593
594 /* reuse master con client guid */
595 memcpy(&ctx->client_guid, ses->server->client_guid,
596 sizeof(ctx->client_guid));
597 ctx->use_client_guid = true;
598
599 chan_server = cifs_get_tcp_session(ctx, ses->server);
600
601 spin_lock(&ses->chan_lock);
602 chan = &ses->chans[ses->chan_count];
603 chan->server = chan_server;
604 if (IS_ERR(chan->server)) {
605 rc = PTR_ERR(chan->server);
606 chan->server = NULL;
607 spin_unlock(&ses->chan_lock);
608 goto out;
609 }
610 chan->iface = iface;
611 ses->chan_count++;
612 atomic_set(&ses->chan_seq, 0);
613
614 /* Mark this channel as needing connect/setup */
615 cifs_chan_set_need_reconnect(ses, chan->server);
616
617 spin_unlock(&ses->chan_lock);
618
619 mutex_lock(&ses->session_mutex);
620
621 rc = cifs_negotiate_protocol(xid, ses, chan->server);
622 if (!rc)
623 rc = cifs_setup_session(xid, ses, chan->server, ses->local_nls);
624
625 mutex_unlock(&ses->session_mutex);
626
627 out:
628 if (rc && chan->server) {
629 cifs_put_tcp_session(chan->server, 0);
630
631 spin_lock(&ses->chan_lock);
632
633 /* we rely on all bits beyond chan_count to be clear */
634 cifs_chan_clear_need_reconnect(ses, chan->server);
635 ses->chan_count--;
636 /*
637 * chan_count should never reach 0 as at least the primary
638 * channel is always allocated
639 */
640 WARN_ON(ses->chan_count < 1);
641 spin_unlock(&ses->chan_lock);
642 }
643
644 kfree(ctx->UNC);
645 out_free_ctx:
646 kfree(ctx);
647 out_free_xid:
648 free_xid(xid);
649 return rc;
650 }
651
652
decode_ntlmssp_challenge(char * bcc_ptr,int blob_len,struct cifs_ses * ses)653 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
654 struct cifs_ses *ses)
655 {
656 unsigned int tioffset; /* challenge message target info area */
657 unsigned int tilen; /* challenge message target info area length */
658 CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
659 __u32 server_flags;
660
661 if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
662 cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
663 return -EINVAL;
664 }
665
666 if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
667 cifs_dbg(VFS, "blob signature incorrect %s\n",
668 pblob->Signature);
669 return -EINVAL;
670 }
671 if (pblob->MessageType != NtLmChallenge) {
672 cifs_dbg(VFS, "Incorrect message type %d\n",
673 pblob->MessageType);
674 return -EINVAL;
675 }
676
677 server_flags = le32_to_cpu(pblob->NegotiateFlags);
678 cifs_dbg(FYI, "%s: negotiate=0x%08x challenge=0x%08x\n", __func__,
679 ses->ntlmssp->client_flags, server_flags);
680
681 if ((ses->ntlmssp->client_flags & (NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN)) &&
682 (!(server_flags & NTLMSSP_NEGOTIATE_56) && !(server_flags & NTLMSSP_NEGOTIATE_128))) {
683 cifs_dbg(VFS, "%s: requested signing/encryption but server did not return either 56-bit or 128-bit session key size\n",
684 __func__);
685 return -EINVAL;
686 }
687 if (!(server_flags & NTLMSSP_NEGOTIATE_NTLM) && !(server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) {
688 cifs_dbg(VFS, "%s: server does not seem to support either NTLMv1 or NTLMv2\n", __func__);
689 return -EINVAL;
690 }
691 if (ses->server->sign && !(server_flags & NTLMSSP_NEGOTIATE_SIGN)) {
692 cifs_dbg(VFS, "%s: forced packet signing but server does not seem to support it\n",
693 __func__);
694 return -EOPNOTSUPP;
695 }
696 if ((ses->ntlmssp->client_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
697 !(server_flags & NTLMSSP_NEGOTIATE_KEY_XCH))
698 pr_warn_once("%s: authentication has been weakened as server does not support key exchange\n",
699 __func__);
700
701 ses->ntlmssp->server_flags = server_flags;
702
703 memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
704 /*
705 * In particular we can examine sign flags
706 *
707 * BB spec says that if AvId field of MsvAvTimestamp is populated then
708 * we must set the MIC field of the AUTHENTICATE_MESSAGE
709 */
710
711 tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
712 tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
713 if (tioffset > blob_len || tioffset + tilen > blob_len) {
714 cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
715 tioffset, tilen);
716 return -EINVAL;
717 }
718 if (tilen) {
719 kfree_sensitive(ses->auth_key.response);
720 ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
721 GFP_KERNEL);
722 if (!ses->auth_key.response) {
723 cifs_dbg(VFS, "Challenge target info alloc failure\n");
724 return -ENOMEM;
725 }
726 ses->auth_key.len = tilen;
727 }
728
729 return 0;
730 }
731
size_of_ntlmssp_blob(struct cifs_ses * ses,int base_size)732 static int size_of_ntlmssp_blob(struct cifs_ses *ses, int base_size)
733 {
734 int sz = base_size + ses->auth_key.len
735 - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
736
737 if (ses->domainName)
738 sz += sizeof(__le16) * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
739 else
740 sz += sizeof(__le16);
741
742 if (ses->user_name)
743 sz += sizeof(__le16) * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
744 else
745 sz += sizeof(__le16);
746
747 if (ses->workstation_name[0])
748 sz += sizeof(__le16) * strnlen(ses->workstation_name,
749 ntlmssp_workstation_name_size(ses));
750 else
751 sz += sizeof(__le16);
752
753 return sz;
754 }
755
cifs_security_buffer_from_str(SECURITY_BUFFER * pbuf,char * str_value,int str_length,unsigned char * pstart,unsigned char ** pcur,const struct nls_table * nls_cp)756 static inline void cifs_security_buffer_from_str(SECURITY_BUFFER *pbuf,
757 char *str_value,
758 int str_length,
759 unsigned char *pstart,
760 unsigned char **pcur,
761 const struct nls_table *nls_cp)
762 {
763 unsigned char *tmp = pstart;
764 int len;
765
766 if (!pbuf)
767 return;
768
769 if (!pcur)
770 pcur = &tmp;
771
772 if (!str_value) {
773 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
774 pbuf->Length = 0;
775 pbuf->MaximumLength = 0;
776 *pcur += sizeof(__le16);
777 } else {
778 len = cifs_strtoUTF16((__le16 *)*pcur,
779 str_value,
780 str_length,
781 nls_cp);
782 len *= sizeof(__le16);
783 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
784 pbuf->Length = cpu_to_le16(len);
785 pbuf->MaximumLength = cpu_to_le16(len);
786 *pcur += len;
787 }
788 }
789
790 /* BB Move to ntlmssp.c eventually */
791
build_ntlmssp_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)792 int build_ntlmssp_negotiate_blob(unsigned char **pbuffer,
793 u16 *buflen,
794 struct cifs_ses *ses,
795 struct TCP_Server_Info *server,
796 const struct nls_table *nls_cp)
797 {
798 int rc = 0;
799 NEGOTIATE_MESSAGE *sec_blob;
800 __u32 flags;
801 unsigned char *tmp;
802 int len;
803
804 len = size_of_ntlmssp_blob(ses, sizeof(NEGOTIATE_MESSAGE));
805 *pbuffer = kmalloc(len, GFP_KERNEL);
806 if (!*pbuffer) {
807 rc = -ENOMEM;
808 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
809 *buflen = 0;
810 goto setup_ntlm_neg_ret;
811 }
812 sec_blob = (NEGOTIATE_MESSAGE *)*pbuffer;
813
814 memset(*pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
815 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
816 sec_blob->MessageType = NtLmNegotiate;
817
818 /* BB is NTLMV2 session security format easier to use here? */
819 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
820 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
821 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
822 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
823 NTLMSSP_NEGOTIATE_SIGN;
824 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
825 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
826
827 tmp = *pbuffer + sizeof(NEGOTIATE_MESSAGE);
828 ses->ntlmssp->client_flags = flags;
829 sec_blob->NegotiateFlags = cpu_to_le32(flags);
830
831 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
832 cifs_security_buffer_from_str(&sec_blob->DomainName,
833 NULL,
834 CIFS_MAX_DOMAINNAME_LEN,
835 *pbuffer, &tmp,
836 nls_cp);
837
838 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
839 NULL,
840 CIFS_MAX_WORKSTATION_LEN,
841 *pbuffer, &tmp,
842 nls_cp);
843
844 *buflen = tmp - *pbuffer;
845 setup_ntlm_neg_ret:
846 return rc;
847 }
848
849 /*
850 * Build ntlmssp blob with additional fields, such as version,
851 * supported by modern servers. For safety limit to SMB3 or later
852 * See notes in MS-NLMP Section 2.2.2.1 e.g.
853 */
build_ntlmssp_smb3_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)854 int build_ntlmssp_smb3_negotiate_blob(unsigned char **pbuffer,
855 u16 *buflen,
856 struct cifs_ses *ses,
857 struct TCP_Server_Info *server,
858 const struct nls_table *nls_cp)
859 {
860 int rc = 0;
861 struct negotiate_message *sec_blob;
862 __u32 flags;
863 unsigned char *tmp;
864 int len;
865
866 len = size_of_ntlmssp_blob(ses, sizeof(struct negotiate_message));
867 *pbuffer = kmalloc(len, GFP_KERNEL);
868 if (!*pbuffer) {
869 rc = -ENOMEM;
870 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
871 *buflen = 0;
872 goto setup_ntlm_smb3_neg_ret;
873 }
874 sec_blob = (struct negotiate_message *)*pbuffer;
875
876 memset(*pbuffer, 0, sizeof(struct negotiate_message));
877 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
878 sec_blob->MessageType = NtLmNegotiate;
879
880 /* BB is NTLMV2 session security format easier to use here? */
881 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
882 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
883 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
884 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
885 NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_VERSION;
886 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
887 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
888
889 sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
890 sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
891 sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
892 sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
893
894 tmp = *pbuffer + sizeof(struct negotiate_message);
895 ses->ntlmssp->client_flags = flags;
896 sec_blob->NegotiateFlags = cpu_to_le32(flags);
897
898 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
899 cifs_security_buffer_from_str(&sec_blob->DomainName,
900 NULL,
901 CIFS_MAX_DOMAINNAME_LEN,
902 *pbuffer, &tmp,
903 nls_cp);
904
905 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
906 NULL,
907 CIFS_MAX_WORKSTATION_LEN,
908 *pbuffer, &tmp,
909 nls_cp);
910
911 *buflen = tmp - *pbuffer;
912 setup_ntlm_smb3_neg_ret:
913 return rc;
914 }
915
916
917 /* See MS-NLMP 2.2.1.3 */
build_ntlmssp_auth_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)918 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
919 u16 *buflen,
920 struct cifs_ses *ses,
921 struct TCP_Server_Info *server,
922 const struct nls_table *nls_cp)
923 {
924 int rc;
925 AUTHENTICATE_MESSAGE *sec_blob;
926 __u32 flags;
927 unsigned char *tmp;
928 int len;
929
930 rc = setup_ntlmv2_rsp(ses, nls_cp);
931 if (rc) {
932 cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
933 *buflen = 0;
934 goto setup_ntlmv2_ret;
935 }
936
937 len = size_of_ntlmssp_blob(ses, sizeof(AUTHENTICATE_MESSAGE));
938 *pbuffer = kmalloc(len, GFP_KERNEL);
939 if (!*pbuffer) {
940 rc = -ENOMEM;
941 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
942 *buflen = 0;
943 goto setup_ntlmv2_ret;
944 }
945 sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
946
947 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
948 sec_blob->MessageType = NtLmAuthenticate;
949
950 /* send version information in ntlmssp authenticate also */
951 flags = ses->ntlmssp->server_flags | NTLMSSP_REQUEST_TARGET |
952 NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_VERSION |
953 NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED;
954
955 sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
956 sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
957 sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
958 sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
959
960 tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
961 sec_blob->NegotiateFlags = cpu_to_le32(flags);
962
963 sec_blob->LmChallengeResponse.BufferOffset =
964 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
965 sec_blob->LmChallengeResponse.Length = 0;
966 sec_blob->LmChallengeResponse.MaximumLength = 0;
967
968 sec_blob->NtChallengeResponse.BufferOffset =
969 cpu_to_le32(tmp - *pbuffer);
970 if (ses->user_name != NULL) {
971 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
972 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
973 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
974
975 sec_blob->NtChallengeResponse.Length =
976 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
977 sec_blob->NtChallengeResponse.MaximumLength =
978 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
979 } else {
980 /*
981 * don't send an NT Response for anonymous access
982 */
983 sec_blob->NtChallengeResponse.Length = 0;
984 sec_blob->NtChallengeResponse.MaximumLength = 0;
985 }
986
987 cifs_security_buffer_from_str(&sec_blob->DomainName,
988 ses->domainName,
989 CIFS_MAX_DOMAINNAME_LEN,
990 *pbuffer, &tmp,
991 nls_cp);
992
993 cifs_security_buffer_from_str(&sec_blob->UserName,
994 ses->user_name,
995 CIFS_MAX_USERNAME_LEN,
996 *pbuffer, &tmp,
997 nls_cp);
998
999 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1000 ses->workstation_name,
1001 ntlmssp_workstation_name_size(ses),
1002 *pbuffer, &tmp,
1003 nls_cp);
1004
1005 if ((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
1006 (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) &&
1007 !calc_seckey(ses)) {
1008 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
1009 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1010 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
1011 sec_blob->SessionKey.MaximumLength =
1012 cpu_to_le16(CIFS_CPHTXT_SIZE);
1013 tmp += CIFS_CPHTXT_SIZE;
1014 } else {
1015 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1016 sec_blob->SessionKey.Length = 0;
1017 sec_blob->SessionKey.MaximumLength = 0;
1018 }
1019
1020 *buflen = tmp - *pbuffer;
1021 setup_ntlmv2_ret:
1022 return rc;
1023 }
1024
1025 enum securityEnum
cifs_select_sectype(struct TCP_Server_Info * server,enum securityEnum requested)1026 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
1027 {
1028 switch (server->negflavor) {
1029 case CIFS_NEGFLAVOR_EXTENDED:
1030 switch (requested) {
1031 case Kerberos:
1032 case RawNTLMSSP:
1033 case IAKerb:
1034 return requested;
1035 case Unspecified:
1036 if (server->sec_ntlmssp &&
1037 (global_secflags & CIFSSEC_MAY_NTLMSSP))
1038 return RawNTLMSSP;
1039 if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) &&
1040 (global_secflags & CIFSSEC_MAY_KRB5))
1041 return Kerberos;
1042 fallthrough;
1043 default:
1044 return Unspecified;
1045 }
1046 case CIFS_NEGFLAVOR_UNENCAP:
1047 switch (requested) {
1048 case NTLMv2:
1049 return requested;
1050 case Unspecified:
1051 if (global_secflags & CIFSSEC_MAY_NTLMV2)
1052 return NTLMv2;
1053 break;
1054 default:
1055 break;
1056 }
1057 fallthrough;
1058 default:
1059 return Unspecified;
1060 }
1061 }
1062