1 // SPDX-License-Identifier: LGPL-2.1 2 /* 3 * 4 * SMB/CIFS session setup handling routines 5 * 6 * Copyright (c) International Business Machines Corp., 2006, 2009 7 * Author(s): Steve French (sfrench@us.ibm.com) 8 * 9 */ 10 11 #include "cifspdu.h" 12 #include "cifsglob.h" 13 #include "cifsproto.h" 14 #include "cifs_unicode.h" 15 #include "cifs_debug.h" 16 #include "ntlmssp.h" 17 #include "nterr.h" 18 #include <linux/utsname.h> 19 #include <linux/slab.h> 20 #include <linux/version.h> 21 #include "cifsfs.h" 22 #include "cifs_spnego.h" 23 #include "smb2proto.h" 24 #include "fs_context.h" 25 26 static int 27 cifs_ses_add_channel(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses, 28 struct cifs_server_iface *iface); 29 30 bool 31 is_server_using_iface(struct TCP_Server_Info *server, 32 struct cifs_server_iface *iface) 33 { 34 struct sockaddr_in *i4 = (struct sockaddr_in *)&iface->sockaddr; 35 struct sockaddr_in6 *i6 = (struct sockaddr_in6 *)&iface->sockaddr; 36 struct sockaddr_in *s4 = (struct sockaddr_in *)&server->dstaddr; 37 struct sockaddr_in6 *s6 = (struct sockaddr_in6 *)&server->dstaddr; 38 39 if (server->dstaddr.ss_family != iface->sockaddr.ss_family) 40 return false; 41 if (server->dstaddr.ss_family == AF_INET) { 42 if (s4->sin_addr.s_addr != i4->sin_addr.s_addr) 43 return false; 44 } else if (server->dstaddr.ss_family == AF_INET6) { 45 if (memcmp(&s6->sin6_addr, &i6->sin6_addr, 46 sizeof(i6->sin6_addr)) != 0) 47 return false; 48 } else { 49 /* unknown family.. */ 50 return false; 51 } 52 return true; 53 } 54 55 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface) 56 { 57 int i; 58 59 spin_lock(&ses->chan_lock); 60 for (i = 0; i < ses->chan_count; i++) { 61 if (ses->chans[i].iface == iface) { 62 spin_unlock(&ses->chan_lock); 63 return true; 64 } 65 } 66 spin_unlock(&ses->chan_lock); 67 return false; 68 } 69 70 /* channel helper functions. assumed that chan_lock is held by caller. */ 71 72 unsigned int 73 cifs_ses_get_chan_index(struct cifs_ses *ses, 74 struct TCP_Server_Info *server) 75 { 76 unsigned int i; 77 78 for (i = 0; i < ses->chan_count; i++) { 79 if (ses->chans[i].server == server) 80 return i; 81 } 82 83 /* If we didn't find the channel, it is likely a bug */ 84 if (server) 85 cifs_dbg(VFS, "unable to get chan index for server: 0x%llx", 86 server->conn_id); 87 WARN_ON(1); 88 return 0; 89 } 90 91 void 92 cifs_chan_set_in_reconnect(struct cifs_ses *ses, 93 struct TCP_Server_Info *server) 94 { 95 unsigned int chan_index = cifs_ses_get_chan_index(ses, server); 96 97 ses->chans[chan_index].in_reconnect = true; 98 } 99 100 void 101 cifs_chan_clear_in_reconnect(struct cifs_ses *ses, 102 struct TCP_Server_Info *server) 103 { 104 unsigned int chan_index = cifs_ses_get_chan_index(ses, server); 105 106 ses->chans[chan_index].in_reconnect = false; 107 } 108 109 bool 110 cifs_chan_in_reconnect(struct cifs_ses *ses, 111 struct TCP_Server_Info *server) 112 { 113 unsigned int chan_index = cifs_ses_get_chan_index(ses, server); 114 115 return CIFS_CHAN_IN_RECONNECT(ses, chan_index); 116 } 117 118 void 119 cifs_chan_set_need_reconnect(struct cifs_ses *ses, 120 struct TCP_Server_Info *server) 121 { 122 unsigned int chan_index = cifs_ses_get_chan_index(ses, server); 123 124 set_bit(chan_index, &ses->chans_need_reconnect); 125 cifs_dbg(FYI, "Set reconnect bitmask for chan %u; now 0x%lx\n", 126 chan_index, ses->chans_need_reconnect); 127 } 128 129 void 130 cifs_chan_clear_need_reconnect(struct cifs_ses *ses, 131 struct TCP_Server_Info *server) 132 { 133 unsigned int chan_index = cifs_ses_get_chan_index(ses, server); 134 135 clear_bit(chan_index, &ses->chans_need_reconnect); 136 cifs_dbg(FYI, "Cleared reconnect bitmask for chan %u; now 0x%lx\n", 137 chan_index, ses->chans_need_reconnect); 138 } 139 140 bool 141 cifs_chan_needs_reconnect(struct cifs_ses *ses, 142 struct TCP_Server_Info *server) 143 { 144 unsigned int chan_index = cifs_ses_get_chan_index(ses, server); 145 146 return CIFS_CHAN_NEEDS_RECONNECT(ses, chan_index); 147 } 148 149 bool 150 cifs_chan_is_iface_active(struct cifs_ses *ses, 151 struct TCP_Server_Info *server) 152 { 153 unsigned int chan_index = cifs_ses_get_chan_index(ses, server); 154 155 return ses->chans[chan_index].iface && 156 ses->chans[chan_index].iface->is_active; 157 } 158 159 /* returns number of channels added */ 160 int cifs_try_adding_channels(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses) 161 { 162 struct TCP_Server_Info *server = ses->server; 163 int old_chan_count, new_chan_count; 164 int left; 165 int rc = 0; 166 int tries = 0; 167 struct cifs_server_iface *iface = NULL, *niface = NULL; 168 169 spin_lock(&ses->chan_lock); 170 171 new_chan_count = old_chan_count = ses->chan_count; 172 left = ses->chan_max - ses->chan_count; 173 174 if (left <= 0) { 175 spin_unlock(&ses->chan_lock); 176 cifs_dbg(FYI, 177 "ses already at max_channels (%zu), nothing to open\n", 178 ses->chan_max); 179 return 0; 180 } 181 182 if (server->dialect < SMB30_PROT_ID) { 183 spin_unlock(&ses->chan_lock); 184 cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n"); 185 return 0; 186 } 187 188 if (!(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) { 189 ses->chan_max = 1; 190 spin_unlock(&ses->chan_lock); 191 cifs_server_dbg(VFS, "no multichannel support\n"); 192 return 0; 193 } 194 spin_unlock(&ses->chan_lock); 195 196 /* 197 * Keep connecting to same, fastest, iface for all channels as 198 * long as its RSS. Try next fastest one if not RSS or channel 199 * creation fails. 200 */ 201 spin_lock(&ses->iface_lock); 202 iface = list_first_entry(&ses->iface_list, struct cifs_server_iface, 203 iface_head); 204 spin_unlock(&ses->iface_lock); 205 206 while (left > 0) { 207 208 tries++; 209 if (tries > 3*ses->chan_max) { 210 cifs_dbg(FYI, "too many channel open attempts (%d channels left to open)\n", 211 left); 212 break; 213 } 214 215 spin_lock(&ses->iface_lock); 216 if (!ses->iface_count) { 217 spin_unlock(&ses->iface_lock); 218 break; 219 } 220 221 list_for_each_entry_safe_from(iface, niface, &ses->iface_list, 222 iface_head) { 223 /* skip ifaces that are unusable */ 224 if (!iface->is_active || 225 (is_ses_using_iface(ses, iface) && 226 !iface->rss_capable)) { 227 continue; 228 } 229 230 /* take ref before unlock */ 231 kref_get(&iface->refcount); 232 233 spin_unlock(&ses->iface_lock); 234 rc = cifs_ses_add_channel(cifs_sb, ses, iface); 235 spin_lock(&ses->iface_lock); 236 237 if (rc) { 238 cifs_dbg(VFS, "failed to open extra channel on iface:%pIS rc=%d\n", 239 &iface->sockaddr, 240 rc); 241 kref_put(&iface->refcount, release_iface); 242 continue; 243 } 244 245 cifs_dbg(FYI, "successfully opened new channel on iface:%pIS\n", 246 &iface->sockaddr); 247 break; 248 } 249 spin_unlock(&ses->iface_lock); 250 251 left--; 252 new_chan_count++; 253 } 254 255 return new_chan_count - old_chan_count; 256 } 257 258 /* 259 * update the iface for the channel if necessary. 260 * will return 0 when iface is updated, 1 if removed, 2 otherwise 261 * Must be called with chan_lock held. 262 */ 263 int 264 cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) 265 { 266 unsigned int chan_index; 267 struct cifs_server_iface *iface = NULL; 268 struct cifs_server_iface *old_iface = NULL; 269 int rc = 0; 270 271 spin_lock(&ses->chan_lock); 272 chan_index = cifs_ses_get_chan_index(ses, server); 273 if (!chan_index) { 274 spin_unlock(&ses->chan_lock); 275 return 0; 276 } 277 278 if (ses->chans[chan_index].iface) { 279 old_iface = ses->chans[chan_index].iface; 280 if (old_iface->is_active) { 281 spin_unlock(&ses->chan_lock); 282 return 1; 283 } 284 } 285 spin_unlock(&ses->chan_lock); 286 287 spin_lock(&ses->iface_lock); 288 /* then look for a new one */ 289 list_for_each_entry(iface, &ses->iface_list, iface_head) { 290 if (!iface->is_active || 291 (is_ses_using_iface(ses, iface) && 292 !iface->rss_capable)) { 293 continue; 294 } 295 kref_get(&iface->refcount); 296 break; 297 } 298 299 if (list_entry_is_head(iface, &ses->iface_list, iface_head)) { 300 rc = 1; 301 iface = NULL; 302 cifs_dbg(FYI, "unable to find a suitable iface\n"); 303 } 304 305 /* now drop the ref to the current iface */ 306 if (old_iface && iface) { 307 cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n", 308 &old_iface->sockaddr, 309 &iface->sockaddr); 310 kref_put(&old_iface->refcount, release_iface); 311 } else if (old_iface) { 312 cifs_dbg(FYI, "releasing ref to iface: %pIS\n", 313 &old_iface->sockaddr); 314 kref_put(&old_iface->refcount, release_iface); 315 } else { 316 WARN_ON(!iface); 317 cifs_dbg(FYI, "adding new iface: %pIS\n", &iface->sockaddr); 318 } 319 spin_unlock(&ses->iface_lock); 320 321 spin_lock(&ses->chan_lock); 322 chan_index = cifs_ses_get_chan_index(ses, server); 323 ses->chans[chan_index].iface = iface; 324 325 /* No iface is found. if secondary chan, drop connection */ 326 if (!iface && CIFS_SERVER_IS_CHAN(server)) 327 ses->chans[chan_index].server = NULL; 328 329 spin_unlock(&ses->chan_lock); 330 331 if (!iface && CIFS_SERVER_IS_CHAN(server)) 332 cifs_put_tcp_session(server, false); 333 334 return rc; 335 } 336 337 /* 338 * If server is a channel of ses, return the corresponding enclosing 339 * cifs_chan otherwise return NULL. 340 */ 341 struct cifs_chan * 342 cifs_ses_find_chan(struct cifs_ses *ses, struct TCP_Server_Info *server) 343 { 344 int i; 345 346 spin_lock(&ses->chan_lock); 347 for (i = 0; i < ses->chan_count; i++) { 348 if (ses->chans[i].server == server) { 349 spin_unlock(&ses->chan_lock); 350 return &ses->chans[i]; 351 } 352 } 353 spin_unlock(&ses->chan_lock); 354 return NULL; 355 } 356 357 static int 358 cifs_ses_add_channel(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses, 359 struct cifs_server_iface *iface) 360 { 361 struct TCP_Server_Info *chan_server; 362 struct cifs_chan *chan; 363 struct smb3_fs_context ctx = {NULL}; 364 static const char unc_fmt[] = "\\%s\\foo"; 365 char unc[sizeof(unc_fmt)+SERVER_NAME_LEN_WITH_NULL] = {0}; 366 struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr; 367 struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr; 368 int rc; 369 unsigned int xid = get_xid(); 370 371 if (iface->sockaddr.ss_family == AF_INET) 372 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n", 373 ses, iface->speed, iface->rdma_capable ? "yes" : "no", 374 &ipv4->sin_addr); 375 else 376 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI6)\n", 377 ses, iface->speed, iface->rdma_capable ? "yes" : "no", 378 &ipv6->sin6_addr); 379 380 /* 381 * Setup a ctx with mostly the same info as the existing 382 * session and overwrite it with the requested iface data. 383 * 384 * We need to setup at least the fields used for negprot and 385 * sesssetup. 386 * 387 * We only need the ctx here, so we can reuse memory from 388 * the session and server without caring about memory 389 * management. 390 */ 391 392 /* Always make new connection for now (TODO?) */ 393 ctx.nosharesock = true; 394 395 /* Auth */ 396 ctx.domainauto = ses->domainAuto; 397 ctx.domainname = ses->domainName; 398 399 /* no hostname for extra channels */ 400 ctx.server_hostname = ""; 401 402 ctx.username = ses->user_name; 403 ctx.password = ses->password; 404 ctx.sectype = ses->sectype; 405 ctx.sign = ses->sign; 406 407 /* UNC and paths */ 408 /* XXX: Use ses->server->hostname? */ 409 sprintf(unc, unc_fmt, ses->ip_addr); 410 ctx.UNC = unc; 411 ctx.prepath = ""; 412 413 /* Reuse same version as master connection */ 414 ctx.vals = ses->server->vals; 415 ctx.ops = ses->server->ops; 416 417 ctx.noblocksnd = ses->server->noblocksnd; 418 ctx.noautotune = ses->server->noautotune; 419 ctx.sockopt_tcp_nodelay = ses->server->tcp_nodelay; 420 ctx.echo_interval = ses->server->echo_interval / HZ; 421 ctx.max_credits = ses->server->max_credits; 422 423 /* 424 * This will be used for encoding/decoding user/domain/pw 425 * during sess setup auth. 426 */ 427 ctx.local_nls = cifs_sb->local_nls; 428 429 /* Use RDMA if possible */ 430 ctx.rdma = iface->rdma_capable; 431 memcpy(&ctx.dstaddr, &iface->sockaddr, sizeof(struct sockaddr_storage)); 432 433 /* reuse master con client guid */ 434 memcpy(&ctx.client_guid, ses->server->client_guid, 435 SMB2_CLIENT_GUID_SIZE); 436 ctx.use_client_guid = true; 437 438 chan_server = cifs_get_tcp_session(&ctx, ses->server); 439 440 spin_lock(&ses->chan_lock); 441 chan = &ses->chans[ses->chan_count]; 442 chan->server = chan_server; 443 if (IS_ERR(chan->server)) { 444 rc = PTR_ERR(chan->server); 445 chan->server = NULL; 446 spin_unlock(&ses->chan_lock); 447 goto out; 448 } 449 chan->iface = iface; 450 ses->chan_count++; 451 atomic_set(&ses->chan_seq, 0); 452 453 /* Mark this channel as needing connect/setup */ 454 cifs_chan_set_need_reconnect(ses, chan->server); 455 456 spin_unlock(&ses->chan_lock); 457 458 mutex_lock(&ses->session_mutex); 459 /* 460 * We need to allocate the server crypto now as we will need 461 * to sign packets before we generate the channel signing key 462 * (we sign with the session key) 463 */ 464 rc = smb311_crypto_shash_allocate(chan->server); 465 if (rc) { 466 cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__); 467 mutex_unlock(&ses->session_mutex); 468 goto out; 469 } 470 471 rc = cifs_negotiate_protocol(xid, ses, chan->server); 472 if (!rc) 473 rc = cifs_setup_session(xid, ses, chan->server, cifs_sb->local_nls); 474 475 mutex_unlock(&ses->session_mutex); 476 477 out: 478 if (rc && chan->server) { 479 /* 480 * we should avoid race with these delayed works before we 481 * remove this channel 482 */ 483 cancel_delayed_work_sync(&chan->server->echo); 484 cancel_delayed_work_sync(&chan->server->reconnect); 485 486 spin_lock(&ses->chan_lock); 487 /* we rely on all bits beyond chan_count to be clear */ 488 cifs_chan_clear_need_reconnect(ses, chan->server); 489 ses->chan_count--; 490 /* 491 * chan_count should never reach 0 as at least the primary 492 * channel is always allocated 493 */ 494 WARN_ON(ses->chan_count < 1); 495 spin_unlock(&ses->chan_lock); 496 497 cifs_put_tcp_session(chan->server, 0); 498 } 499 500 free_xid(xid); 501 return rc; 502 } 503 504 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY 505 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses, 506 struct TCP_Server_Info *server, 507 SESSION_SETUP_ANDX *pSMB) 508 { 509 __u32 capabilities = 0; 510 511 /* init fields common to all four types of SessSetup */ 512 /* Note that offsets for first seven fields in req struct are same */ 513 /* in CIFS Specs so does not matter which of 3 forms of struct */ 514 /* that we use in next few lines */ 515 /* Note that header is initialized to zero in header_assemble */ 516 pSMB->req.AndXCommand = 0xFF; 517 pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32, 518 CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4, 519 USHRT_MAX)); 520 pSMB->req.MaxMpxCount = cpu_to_le16(server->maxReq); 521 pSMB->req.VcNumber = cpu_to_le16(1); 522 523 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */ 524 525 /* BB verify whether signing required on neg or just on auth frame 526 (and NTLM case) */ 527 528 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS | 529 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X; 530 531 if (server->sign) 532 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE; 533 534 if (ses->capabilities & CAP_UNICODE) { 535 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE; 536 capabilities |= CAP_UNICODE; 537 } 538 if (ses->capabilities & CAP_STATUS32) { 539 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS; 540 capabilities |= CAP_STATUS32; 541 } 542 if (ses->capabilities & CAP_DFS) { 543 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS; 544 capabilities |= CAP_DFS; 545 } 546 if (ses->capabilities & CAP_UNIX) 547 capabilities |= CAP_UNIX; 548 549 return capabilities; 550 } 551 552 static void 553 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp) 554 { 555 char *bcc_ptr = *pbcc_area; 556 int bytes_ret = 0; 557 558 /* Copy OS version */ 559 bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32, 560 nls_cp); 561 bcc_ptr += 2 * bytes_ret; 562 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release, 563 32, nls_cp); 564 bcc_ptr += 2 * bytes_ret; 565 bcc_ptr += 2; /* trailing null */ 566 567 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS, 568 32, nls_cp); 569 bcc_ptr += 2 * bytes_ret; 570 bcc_ptr += 2; /* trailing null */ 571 572 *pbcc_area = bcc_ptr; 573 } 574 575 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses, 576 const struct nls_table *nls_cp) 577 { 578 char *bcc_ptr = *pbcc_area; 579 int bytes_ret = 0; 580 581 /* copy domain */ 582 if (ses->domainName == NULL) { 583 /* Sending null domain better than using a bogus domain name (as 584 we did briefly in 2.6.18) since server will use its default */ 585 *bcc_ptr = 0; 586 *(bcc_ptr+1) = 0; 587 bytes_ret = 0; 588 } else 589 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName, 590 CIFS_MAX_DOMAINNAME_LEN, nls_cp); 591 bcc_ptr += 2 * bytes_ret; 592 bcc_ptr += 2; /* account for null terminator */ 593 594 *pbcc_area = bcc_ptr; 595 } 596 597 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses, 598 const struct nls_table *nls_cp) 599 { 600 char *bcc_ptr = *pbcc_area; 601 int bytes_ret = 0; 602 603 /* BB FIXME add check that strings total less 604 than 335 or will need to send them as arrays */ 605 606 /* copy user */ 607 if (ses->user_name == NULL) { 608 /* null user mount */ 609 *bcc_ptr = 0; 610 *(bcc_ptr+1) = 0; 611 } else { 612 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name, 613 CIFS_MAX_USERNAME_LEN, nls_cp); 614 } 615 bcc_ptr += 2 * bytes_ret; 616 bcc_ptr += 2; /* account for null termination */ 617 618 unicode_domain_string(&bcc_ptr, ses, nls_cp); 619 unicode_oslm_strings(&bcc_ptr, nls_cp); 620 621 *pbcc_area = bcc_ptr; 622 } 623 624 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses, 625 const struct nls_table *nls_cp) 626 { 627 char *bcc_ptr = *pbcc_area; 628 int len; 629 630 /* copy user */ 631 /* BB what about null user mounts - check that we do this BB */ 632 /* copy user */ 633 if (ses->user_name != NULL) { 634 len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN); 635 if (WARN_ON_ONCE(len < 0)) 636 len = CIFS_MAX_USERNAME_LEN - 1; 637 bcc_ptr += len; 638 } 639 /* else null user mount */ 640 *bcc_ptr = 0; 641 bcc_ptr++; /* account for null termination */ 642 643 /* copy domain */ 644 if (ses->domainName != NULL) { 645 len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN); 646 if (WARN_ON_ONCE(len < 0)) 647 len = CIFS_MAX_DOMAINNAME_LEN - 1; 648 bcc_ptr += len; 649 } /* else we will send a null domain name 650 so the server will default to its own domain */ 651 *bcc_ptr = 0; 652 bcc_ptr++; 653 654 /* BB check for overflow here */ 655 656 strcpy(bcc_ptr, "Linux version "); 657 bcc_ptr += strlen("Linux version "); 658 strcpy(bcc_ptr, init_utsname()->release); 659 bcc_ptr += strlen(init_utsname()->release) + 1; 660 661 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS); 662 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1; 663 664 *pbcc_area = bcc_ptr; 665 } 666 667 static void 668 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses, 669 const struct nls_table *nls_cp) 670 { 671 int len; 672 char *data = *pbcc_area; 673 674 cifs_dbg(FYI, "bleft %d\n", bleft); 675 676 kfree(ses->serverOS); 677 ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp); 678 cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS); 679 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2; 680 data += len; 681 bleft -= len; 682 if (bleft <= 0) 683 return; 684 685 kfree(ses->serverNOS); 686 ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp); 687 cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS); 688 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2; 689 data += len; 690 bleft -= len; 691 if (bleft <= 0) 692 return; 693 694 kfree(ses->serverDomain); 695 ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp); 696 cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain); 697 698 return; 699 } 700 701 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft, 702 struct cifs_ses *ses, 703 const struct nls_table *nls_cp) 704 { 705 int len; 706 char *bcc_ptr = *pbcc_area; 707 708 cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft); 709 710 len = strnlen(bcc_ptr, bleft); 711 if (len >= bleft) 712 return; 713 714 kfree(ses->serverOS); 715 716 ses->serverOS = kmalloc(len + 1, GFP_KERNEL); 717 if (ses->serverOS) { 718 memcpy(ses->serverOS, bcc_ptr, len); 719 ses->serverOS[len] = 0; 720 if (strncmp(ses->serverOS, "OS/2", 4) == 0) 721 cifs_dbg(FYI, "OS/2 server\n"); 722 } 723 724 bcc_ptr += len + 1; 725 bleft -= len + 1; 726 727 len = strnlen(bcc_ptr, bleft); 728 if (len >= bleft) 729 return; 730 731 kfree(ses->serverNOS); 732 733 ses->serverNOS = kmalloc(len + 1, GFP_KERNEL); 734 if (ses->serverNOS) { 735 memcpy(ses->serverNOS, bcc_ptr, len); 736 ses->serverNOS[len] = 0; 737 } 738 739 bcc_ptr += len + 1; 740 bleft -= len + 1; 741 742 len = strnlen(bcc_ptr, bleft); 743 if (len > bleft) 744 return; 745 746 /* No domain field in LANMAN case. Domain is 747 returned by old servers in the SMB negprot response */ 748 /* BB For newer servers which do not support Unicode, 749 but thus do return domain here we could add parsing 750 for it later, but it is not very important */ 751 cifs_dbg(FYI, "ascii: bytes left %d\n", bleft); 752 } 753 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */ 754 755 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, 756 struct cifs_ses *ses) 757 { 758 unsigned int tioffset; /* challenge message target info area */ 759 unsigned int tilen; /* challenge message target info area length */ 760 CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr; 761 __u32 server_flags; 762 763 if (blob_len < sizeof(CHALLENGE_MESSAGE)) { 764 cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len); 765 return -EINVAL; 766 } 767 768 if (memcmp(pblob->Signature, "NTLMSSP", 8)) { 769 cifs_dbg(VFS, "blob signature incorrect %s\n", 770 pblob->Signature); 771 return -EINVAL; 772 } 773 if (pblob->MessageType != NtLmChallenge) { 774 cifs_dbg(VFS, "Incorrect message type %d\n", 775 pblob->MessageType); 776 return -EINVAL; 777 } 778 779 server_flags = le32_to_cpu(pblob->NegotiateFlags); 780 cifs_dbg(FYI, "%s: negotiate=0x%08x challenge=0x%08x\n", __func__, 781 ses->ntlmssp->client_flags, server_flags); 782 783 if ((ses->ntlmssp->client_flags & (NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN)) && 784 (!(server_flags & NTLMSSP_NEGOTIATE_56) && !(server_flags & NTLMSSP_NEGOTIATE_128))) { 785 cifs_dbg(VFS, "%s: requested signing/encryption but server did not return either 56-bit or 128-bit session key size\n", 786 __func__); 787 return -EINVAL; 788 } 789 if (!(server_flags & NTLMSSP_NEGOTIATE_NTLM) && !(server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) { 790 cifs_dbg(VFS, "%s: server does not seem to support either NTLMv1 or NTLMv2\n", __func__); 791 return -EINVAL; 792 } 793 if (ses->server->sign && !(server_flags & NTLMSSP_NEGOTIATE_SIGN)) { 794 cifs_dbg(VFS, "%s: forced packet signing but server does not seem to support it\n", 795 __func__); 796 return -EOPNOTSUPP; 797 } 798 if ((ses->ntlmssp->client_flags & NTLMSSP_NEGOTIATE_KEY_XCH) && 799 !(server_flags & NTLMSSP_NEGOTIATE_KEY_XCH)) 800 pr_warn_once("%s: authentication has been weakened as server does not support key exchange\n", 801 __func__); 802 803 ses->ntlmssp->server_flags = server_flags; 804 805 memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE); 806 /* In particular we can examine sign flags */ 807 /* BB spec says that if AvId field of MsvAvTimestamp is populated then 808 we must set the MIC field of the AUTHENTICATE_MESSAGE */ 809 810 tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset); 811 tilen = le16_to_cpu(pblob->TargetInfoArray.Length); 812 if (tioffset > blob_len || tioffset + tilen > blob_len) { 813 cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n", 814 tioffset, tilen); 815 return -EINVAL; 816 } 817 if (tilen) { 818 kfree_sensitive(ses->auth_key.response); 819 ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen, 820 GFP_KERNEL); 821 if (!ses->auth_key.response) { 822 cifs_dbg(VFS, "Challenge target info alloc failure\n"); 823 return -ENOMEM; 824 } 825 ses->auth_key.len = tilen; 826 } 827 828 return 0; 829 } 830 831 static int size_of_ntlmssp_blob(struct cifs_ses *ses, int base_size) 832 { 833 int sz = base_size + ses->auth_key.len 834 - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2; 835 836 if (ses->domainName) 837 sz += sizeof(__le16) * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN); 838 else 839 sz += sizeof(__le16); 840 841 if (ses->user_name) 842 sz += sizeof(__le16) * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN); 843 else 844 sz += sizeof(__le16); 845 846 if (ses->workstation_name[0]) 847 sz += sizeof(__le16) * strnlen(ses->workstation_name, 848 ntlmssp_workstation_name_size(ses)); 849 else 850 sz += sizeof(__le16); 851 852 return sz; 853 } 854 855 static inline void cifs_security_buffer_from_str(SECURITY_BUFFER *pbuf, 856 char *str_value, 857 int str_length, 858 unsigned char *pstart, 859 unsigned char **pcur, 860 const struct nls_table *nls_cp) 861 { 862 unsigned char *tmp = pstart; 863 int len; 864 865 if (!pbuf) 866 return; 867 868 if (!pcur) 869 pcur = &tmp; 870 871 if (!str_value) { 872 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart); 873 pbuf->Length = 0; 874 pbuf->MaximumLength = 0; 875 *pcur += sizeof(__le16); 876 } else { 877 len = cifs_strtoUTF16((__le16 *)*pcur, 878 str_value, 879 str_length, 880 nls_cp); 881 len *= sizeof(__le16); 882 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart); 883 pbuf->Length = cpu_to_le16(len); 884 pbuf->MaximumLength = cpu_to_le16(len); 885 *pcur += len; 886 } 887 } 888 889 /* BB Move to ntlmssp.c eventually */ 890 891 int build_ntlmssp_negotiate_blob(unsigned char **pbuffer, 892 u16 *buflen, 893 struct cifs_ses *ses, 894 struct TCP_Server_Info *server, 895 const struct nls_table *nls_cp) 896 { 897 int rc = 0; 898 NEGOTIATE_MESSAGE *sec_blob; 899 __u32 flags; 900 unsigned char *tmp; 901 int len; 902 903 len = size_of_ntlmssp_blob(ses, sizeof(NEGOTIATE_MESSAGE)); 904 *pbuffer = kmalloc(len, GFP_KERNEL); 905 if (!*pbuffer) { 906 rc = -ENOMEM; 907 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc); 908 *buflen = 0; 909 goto setup_ntlm_neg_ret; 910 } 911 sec_blob = (NEGOTIATE_MESSAGE *)*pbuffer; 912 913 memset(*pbuffer, 0, sizeof(NEGOTIATE_MESSAGE)); 914 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8); 915 sec_blob->MessageType = NtLmNegotiate; 916 917 /* BB is NTLMV2 session security format easier to use here? */ 918 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET | 919 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | 920 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC | 921 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL | 922 NTLMSSP_NEGOTIATE_SIGN; 923 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess) 924 flags |= NTLMSSP_NEGOTIATE_KEY_XCH; 925 926 tmp = *pbuffer + sizeof(NEGOTIATE_MESSAGE); 927 ses->ntlmssp->client_flags = flags; 928 sec_blob->NegotiateFlags = cpu_to_le32(flags); 929 930 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */ 931 cifs_security_buffer_from_str(&sec_blob->DomainName, 932 NULL, 933 CIFS_MAX_DOMAINNAME_LEN, 934 *pbuffer, &tmp, 935 nls_cp); 936 937 cifs_security_buffer_from_str(&sec_blob->WorkstationName, 938 NULL, 939 CIFS_MAX_WORKSTATION_LEN, 940 *pbuffer, &tmp, 941 nls_cp); 942 943 *buflen = tmp - *pbuffer; 944 setup_ntlm_neg_ret: 945 return rc; 946 } 947 948 /* 949 * Build ntlmssp blob with additional fields, such as version, 950 * supported by modern servers. For safety limit to SMB3 or later 951 * See notes in MS-NLMP Section 2.2.2.1 e.g. 952 */ 953 int build_ntlmssp_smb3_negotiate_blob(unsigned char **pbuffer, 954 u16 *buflen, 955 struct cifs_ses *ses, 956 struct TCP_Server_Info *server, 957 const struct nls_table *nls_cp) 958 { 959 int rc = 0; 960 struct negotiate_message *sec_blob; 961 __u32 flags; 962 unsigned char *tmp; 963 int len; 964 965 len = size_of_ntlmssp_blob(ses, sizeof(struct negotiate_message)); 966 *pbuffer = kmalloc(len, GFP_KERNEL); 967 if (!*pbuffer) { 968 rc = -ENOMEM; 969 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc); 970 *buflen = 0; 971 goto setup_ntlm_smb3_neg_ret; 972 } 973 sec_blob = (struct negotiate_message *)*pbuffer; 974 975 memset(*pbuffer, 0, sizeof(struct negotiate_message)); 976 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8); 977 sec_blob->MessageType = NtLmNegotiate; 978 979 /* BB is NTLMV2 session security format easier to use here? */ 980 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET | 981 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | 982 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC | 983 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL | 984 NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_VERSION; 985 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess) 986 flags |= NTLMSSP_NEGOTIATE_KEY_XCH; 987 988 sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR; 989 sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL; 990 sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD); 991 sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3; 992 993 tmp = *pbuffer + sizeof(struct negotiate_message); 994 ses->ntlmssp->client_flags = flags; 995 sec_blob->NegotiateFlags = cpu_to_le32(flags); 996 997 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */ 998 cifs_security_buffer_from_str(&sec_blob->DomainName, 999 NULL, 1000 CIFS_MAX_DOMAINNAME_LEN, 1001 *pbuffer, &tmp, 1002 nls_cp); 1003 1004 cifs_security_buffer_from_str(&sec_blob->WorkstationName, 1005 NULL, 1006 CIFS_MAX_WORKSTATION_LEN, 1007 *pbuffer, &tmp, 1008 nls_cp); 1009 1010 *buflen = tmp - *pbuffer; 1011 setup_ntlm_smb3_neg_ret: 1012 return rc; 1013 } 1014 1015 1016 int build_ntlmssp_auth_blob(unsigned char **pbuffer, 1017 u16 *buflen, 1018 struct cifs_ses *ses, 1019 struct TCP_Server_Info *server, 1020 const struct nls_table *nls_cp) 1021 { 1022 int rc; 1023 AUTHENTICATE_MESSAGE *sec_blob; 1024 __u32 flags; 1025 unsigned char *tmp; 1026 int len; 1027 1028 rc = setup_ntlmv2_rsp(ses, nls_cp); 1029 if (rc) { 1030 cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc); 1031 *buflen = 0; 1032 goto setup_ntlmv2_ret; 1033 } 1034 1035 len = size_of_ntlmssp_blob(ses, sizeof(AUTHENTICATE_MESSAGE)); 1036 *pbuffer = kmalloc(len, GFP_KERNEL); 1037 if (!*pbuffer) { 1038 rc = -ENOMEM; 1039 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc); 1040 *buflen = 0; 1041 goto setup_ntlmv2_ret; 1042 } 1043 sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer; 1044 1045 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8); 1046 sec_blob->MessageType = NtLmAuthenticate; 1047 1048 flags = ses->ntlmssp->server_flags | NTLMSSP_REQUEST_TARGET | 1049 NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED; 1050 1051 tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE); 1052 sec_blob->NegotiateFlags = cpu_to_le32(flags); 1053 1054 sec_blob->LmChallengeResponse.BufferOffset = 1055 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE)); 1056 sec_blob->LmChallengeResponse.Length = 0; 1057 sec_blob->LmChallengeResponse.MaximumLength = 0; 1058 1059 sec_blob->NtChallengeResponse.BufferOffset = 1060 cpu_to_le32(tmp - *pbuffer); 1061 if (ses->user_name != NULL) { 1062 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE, 1063 ses->auth_key.len - CIFS_SESS_KEY_SIZE); 1064 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE; 1065 1066 sec_blob->NtChallengeResponse.Length = 1067 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); 1068 sec_blob->NtChallengeResponse.MaximumLength = 1069 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); 1070 } else { 1071 /* 1072 * don't send an NT Response for anonymous access 1073 */ 1074 sec_blob->NtChallengeResponse.Length = 0; 1075 sec_blob->NtChallengeResponse.MaximumLength = 0; 1076 } 1077 1078 cifs_security_buffer_from_str(&sec_blob->DomainName, 1079 ses->domainName, 1080 CIFS_MAX_DOMAINNAME_LEN, 1081 *pbuffer, &tmp, 1082 nls_cp); 1083 1084 cifs_security_buffer_from_str(&sec_blob->UserName, 1085 ses->user_name, 1086 CIFS_MAX_USERNAME_LEN, 1087 *pbuffer, &tmp, 1088 nls_cp); 1089 1090 cifs_security_buffer_from_str(&sec_blob->WorkstationName, 1091 ses->workstation_name, 1092 ntlmssp_workstation_name_size(ses), 1093 *pbuffer, &tmp, 1094 nls_cp); 1095 1096 if ((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) && 1097 (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) && 1098 !calc_seckey(ses)) { 1099 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE); 1100 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer); 1101 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE); 1102 sec_blob->SessionKey.MaximumLength = 1103 cpu_to_le16(CIFS_CPHTXT_SIZE); 1104 tmp += CIFS_CPHTXT_SIZE; 1105 } else { 1106 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer); 1107 sec_blob->SessionKey.Length = 0; 1108 sec_blob->SessionKey.MaximumLength = 0; 1109 } 1110 1111 *buflen = tmp - *pbuffer; 1112 setup_ntlmv2_ret: 1113 return rc; 1114 } 1115 1116 enum securityEnum 1117 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested) 1118 { 1119 switch (server->negflavor) { 1120 case CIFS_NEGFLAVOR_EXTENDED: 1121 switch (requested) { 1122 case Kerberos: 1123 case RawNTLMSSP: 1124 return requested; 1125 case Unspecified: 1126 if (server->sec_ntlmssp && 1127 (global_secflags & CIFSSEC_MAY_NTLMSSP)) 1128 return RawNTLMSSP; 1129 if ((server->sec_kerberos || server->sec_mskerberos) && 1130 (global_secflags & CIFSSEC_MAY_KRB5)) 1131 return Kerberos; 1132 fallthrough; 1133 default: 1134 return Unspecified; 1135 } 1136 case CIFS_NEGFLAVOR_UNENCAP: 1137 switch (requested) { 1138 case NTLMv2: 1139 return requested; 1140 case Unspecified: 1141 if (global_secflags & CIFSSEC_MAY_NTLMV2) 1142 return NTLMv2; 1143 break; 1144 default: 1145 break; 1146 } 1147 fallthrough; 1148 default: 1149 return Unspecified; 1150 } 1151 } 1152 1153 struct sess_data { 1154 unsigned int xid; 1155 struct cifs_ses *ses; 1156 struct TCP_Server_Info *server; 1157 struct nls_table *nls_cp; 1158 void (*func)(struct sess_data *); 1159 int result; 1160 1161 /* we will send the SMB in three pieces: 1162 * a fixed length beginning part, an optional 1163 * SPNEGO blob (which can be zero length), and a 1164 * last part which will include the strings 1165 * and rest of bcc area. This allows us to avoid 1166 * a large buffer 17K allocation 1167 */ 1168 int buf0_type; 1169 struct kvec iov[3]; 1170 }; 1171 1172 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY 1173 static int 1174 sess_alloc_buffer(struct sess_data *sess_data, int wct) 1175 { 1176 int rc; 1177 struct cifs_ses *ses = sess_data->ses; 1178 struct smb_hdr *smb_buf; 1179 1180 rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses, 1181 (void **)&smb_buf); 1182 1183 if (rc) 1184 return rc; 1185 1186 sess_data->iov[0].iov_base = (char *)smb_buf; 1187 sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4; 1188 /* 1189 * This variable will be used to clear the buffer 1190 * allocated above in case of any error in the calling function. 1191 */ 1192 sess_data->buf0_type = CIFS_SMALL_BUFFER; 1193 1194 /* 2000 big enough to fit max user, domain, NOS name etc. */ 1195 sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL); 1196 if (!sess_data->iov[2].iov_base) { 1197 rc = -ENOMEM; 1198 goto out_free_smb_buf; 1199 } 1200 1201 return 0; 1202 1203 out_free_smb_buf: 1204 cifs_small_buf_release(smb_buf); 1205 sess_data->iov[0].iov_base = NULL; 1206 sess_data->iov[0].iov_len = 0; 1207 sess_data->buf0_type = CIFS_NO_BUFFER; 1208 return rc; 1209 } 1210 1211 static void 1212 sess_free_buffer(struct sess_data *sess_data) 1213 { 1214 struct kvec *iov = sess_data->iov; 1215 1216 /* 1217 * Zero the session data before freeing, as it might contain sensitive info (keys, etc). 1218 * Note that iov[1] is already freed by caller. 1219 */ 1220 if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base) 1221 memzero_explicit(iov[0].iov_base, iov[0].iov_len); 1222 1223 free_rsp_buf(sess_data->buf0_type, iov[0].iov_base); 1224 sess_data->buf0_type = CIFS_NO_BUFFER; 1225 kfree_sensitive(iov[2].iov_base); 1226 } 1227 1228 static int 1229 sess_establish_session(struct sess_data *sess_data) 1230 { 1231 struct cifs_ses *ses = sess_data->ses; 1232 struct TCP_Server_Info *server = sess_data->server; 1233 1234 cifs_server_lock(server); 1235 if (!server->session_estab) { 1236 if (server->sign) { 1237 server->session_key.response = 1238 kmemdup(ses->auth_key.response, 1239 ses->auth_key.len, GFP_KERNEL); 1240 if (!server->session_key.response) { 1241 cifs_server_unlock(server); 1242 return -ENOMEM; 1243 } 1244 server->session_key.len = 1245 ses->auth_key.len; 1246 } 1247 server->sequence_number = 0x2; 1248 server->session_estab = true; 1249 } 1250 cifs_server_unlock(server); 1251 1252 cifs_dbg(FYI, "CIFS session established successfully\n"); 1253 return 0; 1254 } 1255 1256 static int 1257 sess_sendreceive(struct sess_data *sess_data) 1258 { 1259 int rc; 1260 struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base; 1261 __u16 count; 1262 struct kvec rsp_iov = { NULL, 0 }; 1263 1264 count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len; 1265 be32_add_cpu(&smb_buf->smb_buf_length, count); 1266 put_bcc(count, smb_buf); 1267 1268 rc = SendReceive2(sess_data->xid, sess_data->ses, 1269 sess_data->iov, 3 /* num_iovecs */, 1270 &sess_data->buf0_type, 1271 CIFS_LOG_ERROR, &rsp_iov); 1272 cifs_small_buf_release(sess_data->iov[0].iov_base); 1273 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec)); 1274 1275 return rc; 1276 } 1277 1278 static void 1279 sess_auth_ntlmv2(struct sess_data *sess_data) 1280 { 1281 int rc = 0; 1282 struct smb_hdr *smb_buf; 1283 SESSION_SETUP_ANDX *pSMB; 1284 char *bcc_ptr; 1285 struct cifs_ses *ses = sess_data->ses; 1286 struct TCP_Server_Info *server = sess_data->server; 1287 __u32 capabilities; 1288 __u16 bytes_remaining; 1289 1290 /* old style NTLM sessionsetup */ 1291 /* wct = 13 */ 1292 rc = sess_alloc_buffer(sess_data, 13); 1293 if (rc) 1294 goto out; 1295 1296 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base; 1297 bcc_ptr = sess_data->iov[2].iov_base; 1298 capabilities = cifs_ssetup_hdr(ses, server, pSMB); 1299 1300 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities); 1301 1302 /* LM2 password would be here if we supported it */ 1303 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0; 1304 1305 if (ses->user_name != NULL) { 1306 /* calculate nlmv2 response and session key */ 1307 rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp); 1308 if (rc) { 1309 cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc); 1310 goto out; 1311 } 1312 1313 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, 1314 ses->auth_key.len - CIFS_SESS_KEY_SIZE); 1315 bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE; 1316 1317 /* set case sensitive password length after tilen may get 1318 * assigned, tilen is 0 otherwise. 1319 */ 1320 pSMB->req_no_secext.CaseSensitivePasswordLength = 1321 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); 1322 } else { 1323 pSMB->req_no_secext.CaseSensitivePasswordLength = 0; 1324 } 1325 1326 if (ses->capabilities & CAP_UNICODE) { 1327 if (!IS_ALIGNED(sess_data->iov[0].iov_len, 2)) { 1328 *bcc_ptr = 0; 1329 bcc_ptr++; 1330 } 1331 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp); 1332 } else { 1333 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp); 1334 } 1335 1336 1337 sess_data->iov[2].iov_len = (long) bcc_ptr - 1338 (long) sess_data->iov[2].iov_base; 1339 1340 rc = sess_sendreceive(sess_data); 1341 if (rc) 1342 goto out; 1343 1344 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base; 1345 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base; 1346 1347 if (smb_buf->WordCount != 3) { 1348 rc = -EIO; 1349 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount); 1350 goto out; 1351 } 1352 1353 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN) 1354 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */ 1355 1356 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */ 1357 cifs_dbg(FYI, "UID = %llu\n", ses->Suid); 1358 1359 bytes_remaining = get_bcc(smb_buf); 1360 bcc_ptr = pByteArea(smb_buf); 1361 1362 /* BB check if Unicode and decode strings */ 1363 if (bytes_remaining == 0) { 1364 /* no string area to decode, do nothing */ 1365 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) { 1366 /* unicode string area must be word-aligned */ 1367 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) { 1368 ++bcc_ptr; 1369 --bytes_remaining; 1370 } 1371 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses, 1372 sess_data->nls_cp); 1373 } else { 1374 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses, 1375 sess_data->nls_cp); 1376 } 1377 1378 rc = sess_establish_session(sess_data); 1379 out: 1380 sess_data->result = rc; 1381 sess_data->func = NULL; 1382 sess_free_buffer(sess_data); 1383 kfree_sensitive(ses->auth_key.response); 1384 ses->auth_key.response = NULL; 1385 } 1386 1387 #ifdef CONFIG_CIFS_UPCALL 1388 static void 1389 sess_auth_kerberos(struct sess_data *sess_data) 1390 { 1391 int rc = 0; 1392 struct smb_hdr *smb_buf; 1393 SESSION_SETUP_ANDX *pSMB; 1394 char *bcc_ptr; 1395 struct cifs_ses *ses = sess_data->ses; 1396 struct TCP_Server_Info *server = sess_data->server; 1397 __u32 capabilities; 1398 __u16 bytes_remaining; 1399 struct key *spnego_key = NULL; 1400 struct cifs_spnego_msg *msg; 1401 u16 blob_len; 1402 1403 /* extended security */ 1404 /* wct = 12 */ 1405 rc = sess_alloc_buffer(sess_data, 12); 1406 if (rc) 1407 goto out; 1408 1409 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base; 1410 bcc_ptr = sess_data->iov[2].iov_base; 1411 capabilities = cifs_ssetup_hdr(ses, server, pSMB); 1412 1413 spnego_key = cifs_get_spnego_key(ses, server); 1414 if (IS_ERR(spnego_key)) { 1415 rc = PTR_ERR(spnego_key); 1416 spnego_key = NULL; 1417 goto out; 1418 } 1419 1420 msg = spnego_key->payload.data[0]; 1421 /* 1422 * check version field to make sure that cifs.upcall is 1423 * sending us a response in an expected form 1424 */ 1425 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) { 1426 cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n", 1427 CIFS_SPNEGO_UPCALL_VERSION, msg->version); 1428 rc = -EKEYREJECTED; 1429 goto out_put_spnego_key; 1430 } 1431 1432 kfree_sensitive(ses->auth_key.response); 1433 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len, 1434 GFP_KERNEL); 1435 if (!ses->auth_key.response) { 1436 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n", 1437 msg->sesskey_len); 1438 rc = -ENOMEM; 1439 goto out_put_spnego_key; 1440 } 1441 ses->auth_key.len = msg->sesskey_len; 1442 1443 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC; 1444 capabilities |= CAP_EXTENDED_SECURITY; 1445 pSMB->req.Capabilities = cpu_to_le32(capabilities); 1446 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len; 1447 sess_data->iov[1].iov_len = msg->secblob_len; 1448 pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len); 1449 1450 if (ses->capabilities & CAP_UNICODE) { 1451 /* unicode strings must be word aligned */ 1452 if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) { 1453 *bcc_ptr = 0; 1454 bcc_ptr++; 1455 } 1456 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp); 1457 unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp); 1458 } else { 1459 /* BB: is this right? */ 1460 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp); 1461 } 1462 1463 sess_data->iov[2].iov_len = (long) bcc_ptr - 1464 (long) sess_data->iov[2].iov_base; 1465 1466 rc = sess_sendreceive(sess_data); 1467 if (rc) 1468 goto out_put_spnego_key; 1469 1470 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base; 1471 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base; 1472 1473 if (smb_buf->WordCount != 4) { 1474 rc = -EIO; 1475 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount); 1476 goto out_put_spnego_key; 1477 } 1478 1479 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN) 1480 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */ 1481 1482 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */ 1483 cifs_dbg(FYI, "UID = %llu\n", ses->Suid); 1484 1485 bytes_remaining = get_bcc(smb_buf); 1486 bcc_ptr = pByteArea(smb_buf); 1487 1488 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength); 1489 if (blob_len > bytes_remaining) { 1490 cifs_dbg(VFS, "bad security blob length %d\n", 1491 blob_len); 1492 rc = -EINVAL; 1493 goto out_put_spnego_key; 1494 } 1495 bcc_ptr += blob_len; 1496 bytes_remaining -= blob_len; 1497 1498 /* BB check if Unicode and decode strings */ 1499 if (bytes_remaining == 0) { 1500 /* no string area to decode, do nothing */ 1501 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) { 1502 /* unicode string area must be word-aligned */ 1503 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) { 1504 ++bcc_ptr; 1505 --bytes_remaining; 1506 } 1507 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses, 1508 sess_data->nls_cp); 1509 } else { 1510 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses, 1511 sess_data->nls_cp); 1512 } 1513 1514 rc = sess_establish_session(sess_data); 1515 out_put_spnego_key: 1516 key_invalidate(spnego_key); 1517 key_put(spnego_key); 1518 out: 1519 sess_data->result = rc; 1520 sess_data->func = NULL; 1521 sess_free_buffer(sess_data); 1522 kfree_sensitive(ses->auth_key.response); 1523 ses->auth_key.response = NULL; 1524 } 1525 1526 #endif /* ! CONFIG_CIFS_UPCALL */ 1527 1528 /* 1529 * The required kvec buffers have to be allocated before calling this 1530 * function. 1531 */ 1532 static int 1533 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data) 1534 { 1535 SESSION_SETUP_ANDX *pSMB; 1536 struct cifs_ses *ses = sess_data->ses; 1537 struct TCP_Server_Info *server = sess_data->server; 1538 __u32 capabilities; 1539 char *bcc_ptr; 1540 1541 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base; 1542 1543 capabilities = cifs_ssetup_hdr(ses, server, pSMB); 1544 if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) { 1545 cifs_dbg(VFS, "NTLMSSP requires Unicode support\n"); 1546 return -ENOSYS; 1547 } 1548 1549 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC; 1550 capabilities |= CAP_EXTENDED_SECURITY; 1551 pSMB->req.Capabilities |= cpu_to_le32(capabilities); 1552 1553 bcc_ptr = sess_data->iov[2].iov_base; 1554 /* unicode strings must be word aligned */ 1555 if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) { 1556 *bcc_ptr = 0; 1557 bcc_ptr++; 1558 } 1559 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp); 1560 1561 sess_data->iov[2].iov_len = (long) bcc_ptr - 1562 (long) sess_data->iov[2].iov_base; 1563 1564 return 0; 1565 } 1566 1567 static void 1568 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data); 1569 1570 static void 1571 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data) 1572 { 1573 int rc; 1574 struct smb_hdr *smb_buf; 1575 SESSION_SETUP_ANDX *pSMB; 1576 struct cifs_ses *ses = sess_data->ses; 1577 struct TCP_Server_Info *server = sess_data->server; 1578 __u16 bytes_remaining; 1579 char *bcc_ptr; 1580 unsigned char *ntlmsspblob = NULL; 1581 u16 blob_len; 1582 1583 cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n"); 1584 1585 /* 1586 * if memory allocation is successful, caller of this function 1587 * frees it. 1588 */ 1589 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL); 1590 if (!ses->ntlmssp) { 1591 rc = -ENOMEM; 1592 goto out; 1593 } 1594 ses->ntlmssp->sesskey_per_smbsess = false; 1595 1596 /* wct = 12 */ 1597 rc = sess_alloc_buffer(sess_data, 12); 1598 if (rc) 1599 goto out; 1600 1601 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base; 1602 1603 /* Build security blob before we assemble the request */ 1604 rc = build_ntlmssp_negotiate_blob(&ntlmsspblob, 1605 &blob_len, ses, server, 1606 sess_data->nls_cp); 1607 if (rc) 1608 goto out_free_ntlmsspblob; 1609 1610 sess_data->iov[1].iov_len = blob_len; 1611 sess_data->iov[1].iov_base = ntlmsspblob; 1612 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len); 1613 1614 rc = _sess_auth_rawntlmssp_assemble_req(sess_data); 1615 if (rc) 1616 goto out_free_ntlmsspblob; 1617 1618 rc = sess_sendreceive(sess_data); 1619 1620 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base; 1621 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base; 1622 1623 /* If true, rc here is expected and not an error */ 1624 if (sess_data->buf0_type != CIFS_NO_BUFFER && 1625 smb_buf->Status.CifsError == 1626 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED)) 1627 rc = 0; 1628 1629 if (rc) 1630 goto out_free_ntlmsspblob; 1631 1632 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n"); 1633 1634 if (smb_buf->WordCount != 4) { 1635 rc = -EIO; 1636 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount); 1637 goto out_free_ntlmsspblob; 1638 } 1639 1640 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */ 1641 cifs_dbg(FYI, "UID = %llu\n", ses->Suid); 1642 1643 bytes_remaining = get_bcc(smb_buf); 1644 bcc_ptr = pByteArea(smb_buf); 1645 1646 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength); 1647 if (blob_len > bytes_remaining) { 1648 cifs_dbg(VFS, "bad security blob length %d\n", 1649 blob_len); 1650 rc = -EINVAL; 1651 goto out_free_ntlmsspblob; 1652 } 1653 1654 rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses); 1655 1656 out_free_ntlmsspblob: 1657 kfree_sensitive(ntlmsspblob); 1658 out: 1659 sess_free_buffer(sess_data); 1660 1661 if (!rc) { 1662 sess_data->func = sess_auth_rawntlmssp_authenticate; 1663 return; 1664 } 1665 1666 /* Else error. Cleanup */ 1667 kfree_sensitive(ses->auth_key.response); 1668 ses->auth_key.response = NULL; 1669 kfree_sensitive(ses->ntlmssp); 1670 ses->ntlmssp = NULL; 1671 1672 sess_data->func = NULL; 1673 sess_data->result = rc; 1674 } 1675 1676 static void 1677 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data) 1678 { 1679 int rc; 1680 struct smb_hdr *smb_buf; 1681 SESSION_SETUP_ANDX *pSMB; 1682 struct cifs_ses *ses = sess_data->ses; 1683 struct TCP_Server_Info *server = sess_data->server; 1684 __u16 bytes_remaining; 1685 char *bcc_ptr; 1686 unsigned char *ntlmsspblob = NULL; 1687 u16 blob_len; 1688 1689 cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n"); 1690 1691 /* wct = 12 */ 1692 rc = sess_alloc_buffer(sess_data, 12); 1693 if (rc) 1694 goto out; 1695 1696 /* Build security blob before we assemble the request */ 1697 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base; 1698 smb_buf = (struct smb_hdr *)pSMB; 1699 rc = build_ntlmssp_auth_blob(&ntlmsspblob, 1700 &blob_len, ses, server, 1701 sess_data->nls_cp); 1702 if (rc) 1703 goto out_free_ntlmsspblob; 1704 sess_data->iov[1].iov_len = blob_len; 1705 sess_data->iov[1].iov_base = ntlmsspblob; 1706 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len); 1707 /* 1708 * Make sure that we tell the server that we are using 1709 * the uid that it just gave us back on the response 1710 * (challenge) 1711 */ 1712 smb_buf->Uid = ses->Suid; 1713 1714 rc = _sess_auth_rawntlmssp_assemble_req(sess_data); 1715 if (rc) 1716 goto out_free_ntlmsspblob; 1717 1718 rc = sess_sendreceive(sess_data); 1719 if (rc) 1720 goto out_free_ntlmsspblob; 1721 1722 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base; 1723 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base; 1724 if (smb_buf->WordCount != 4) { 1725 rc = -EIO; 1726 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount); 1727 goto out_free_ntlmsspblob; 1728 } 1729 1730 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN) 1731 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */ 1732 1733 if (ses->Suid != smb_buf->Uid) { 1734 ses->Suid = smb_buf->Uid; 1735 cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid); 1736 } 1737 1738 bytes_remaining = get_bcc(smb_buf); 1739 bcc_ptr = pByteArea(smb_buf); 1740 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength); 1741 if (blob_len > bytes_remaining) { 1742 cifs_dbg(VFS, "bad security blob length %d\n", 1743 blob_len); 1744 rc = -EINVAL; 1745 goto out_free_ntlmsspblob; 1746 } 1747 bcc_ptr += blob_len; 1748 bytes_remaining -= blob_len; 1749 1750 1751 /* BB check if Unicode and decode strings */ 1752 if (bytes_remaining == 0) { 1753 /* no string area to decode, do nothing */ 1754 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) { 1755 /* unicode string area must be word-aligned */ 1756 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) { 1757 ++bcc_ptr; 1758 --bytes_remaining; 1759 } 1760 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses, 1761 sess_data->nls_cp); 1762 } else { 1763 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses, 1764 sess_data->nls_cp); 1765 } 1766 1767 out_free_ntlmsspblob: 1768 kfree_sensitive(ntlmsspblob); 1769 out: 1770 sess_free_buffer(sess_data); 1771 1772 if (!rc) 1773 rc = sess_establish_session(sess_data); 1774 1775 /* Cleanup */ 1776 kfree_sensitive(ses->auth_key.response); 1777 ses->auth_key.response = NULL; 1778 kfree_sensitive(ses->ntlmssp); 1779 ses->ntlmssp = NULL; 1780 1781 sess_data->func = NULL; 1782 sess_data->result = rc; 1783 } 1784 1785 static int select_sec(struct sess_data *sess_data) 1786 { 1787 int type; 1788 struct cifs_ses *ses = sess_data->ses; 1789 struct TCP_Server_Info *server = sess_data->server; 1790 1791 type = cifs_select_sectype(server, ses->sectype); 1792 cifs_dbg(FYI, "sess setup type %d\n", type); 1793 if (type == Unspecified) { 1794 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n"); 1795 return -EINVAL; 1796 } 1797 1798 switch (type) { 1799 case NTLMv2: 1800 sess_data->func = sess_auth_ntlmv2; 1801 break; 1802 case Kerberos: 1803 #ifdef CONFIG_CIFS_UPCALL 1804 sess_data->func = sess_auth_kerberos; 1805 break; 1806 #else 1807 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n"); 1808 return -ENOSYS; 1809 #endif /* CONFIG_CIFS_UPCALL */ 1810 case RawNTLMSSP: 1811 sess_data->func = sess_auth_rawntlmssp_negotiate; 1812 break; 1813 default: 1814 cifs_dbg(VFS, "secType %d not supported!\n", type); 1815 return -ENOSYS; 1816 } 1817 1818 return 0; 1819 } 1820 1821 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses, 1822 struct TCP_Server_Info *server, 1823 const struct nls_table *nls_cp) 1824 { 1825 int rc = 0; 1826 struct sess_data *sess_data; 1827 1828 if (ses == NULL) { 1829 WARN(1, "%s: ses == NULL!", __func__); 1830 return -EINVAL; 1831 } 1832 1833 sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL); 1834 if (!sess_data) 1835 return -ENOMEM; 1836 1837 sess_data->xid = xid; 1838 sess_data->ses = ses; 1839 sess_data->server = server; 1840 sess_data->buf0_type = CIFS_NO_BUFFER; 1841 sess_data->nls_cp = (struct nls_table *) nls_cp; 1842 1843 rc = select_sec(sess_data); 1844 if (rc) 1845 goto out; 1846 1847 while (sess_data->func) 1848 sess_data->func(sess_data); 1849 1850 /* Store result before we free sess_data */ 1851 rc = sess_data->result; 1852 1853 out: 1854 kfree_sensitive(sess_data); 1855 return rc; 1856 } 1857 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */ 1858