xref: /linux/fs/smb/client/sess.c (revision b1a54551dd9ed5ef1763b97b35a0999ca002b95c)
1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3  *
4  *   SMB/CIFS session setup handling routines
5  *
6  *   Copyright (c) International Business Machines  Corp., 2006, 2009
7  *   Author(s): Steve French (sfrench@us.ibm.com)
8  *
9  */
10 
11 #include "cifspdu.h"
12 #include "cifsglob.h"
13 #include "cifsproto.h"
14 #include "cifs_unicode.h"
15 #include "cifs_debug.h"
16 #include "ntlmssp.h"
17 #include "nterr.h"
18 #include <linux/utsname.h>
19 #include <linux/slab.h>
20 #include <linux/version.h>
21 #include "cifsfs.h"
22 #include "cifs_spnego.h"
23 #include "smb2proto.h"
24 #include "fs_context.h"
25 
26 static int
27 cifs_ses_add_channel(struct cifs_ses *ses,
28 		     struct cifs_server_iface *iface);
29 
30 bool
31 is_server_using_iface(struct TCP_Server_Info *server,
32 		      struct cifs_server_iface *iface)
33 {
34 	struct sockaddr_in *i4 = (struct sockaddr_in *)&iface->sockaddr;
35 	struct sockaddr_in6 *i6 = (struct sockaddr_in6 *)&iface->sockaddr;
36 	struct sockaddr_in *s4 = (struct sockaddr_in *)&server->dstaddr;
37 	struct sockaddr_in6 *s6 = (struct sockaddr_in6 *)&server->dstaddr;
38 
39 	if (server->dstaddr.ss_family != iface->sockaddr.ss_family)
40 		return false;
41 	if (server->dstaddr.ss_family == AF_INET) {
42 		if (s4->sin_addr.s_addr != i4->sin_addr.s_addr)
43 			return false;
44 	} else if (server->dstaddr.ss_family == AF_INET6) {
45 		if (memcmp(&s6->sin6_addr, &i6->sin6_addr,
46 			   sizeof(i6->sin6_addr)) != 0)
47 			return false;
48 	} else {
49 		/* unknown family.. */
50 		return false;
51 	}
52 	return true;
53 }
54 
55 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
56 {
57 	int i;
58 
59 	spin_lock(&ses->chan_lock);
60 	for (i = 0; i < ses->chan_count; i++) {
61 		if (ses->chans[i].iface == iface) {
62 			spin_unlock(&ses->chan_lock);
63 			return true;
64 		}
65 	}
66 	spin_unlock(&ses->chan_lock);
67 	return false;
68 }
69 
70 /* channel helper functions. assumed that chan_lock is held by caller. */
71 
72 int
73 cifs_ses_get_chan_index(struct cifs_ses *ses,
74 			struct TCP_Server_Info *server)
75 {
76 	unsigned int i;
77 
78 	for (i = 0; i < ses->chan_count; i++) {
79 		if (ses->chans[i].server == server)
80 			return i;
81 	}
82 
83 	/* If we didn't find the channel, it is likely a bug */
84 	if (server)
85 		cifs_dbg(VFS, "unable to get chan index for server: 0x%llx",
86 			 server->conn_id);
87 	WARN_ON(1);
88 	return CIFS_INVAL_CHAN_INDEX;
89 }
90 
91 void
92 cifs_chan_set_in_reconnect(struct cifs_ses *ses,
93 			     struct TCP_Server_Info *server)
94 {
95 	int chan_index = cifs_ses_get_chan_index(ses, server);
96 
97 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
98 		return;
99 
100 	ses->chans[chan_index].in_reconnect = true;
101 }
102 
103 void
104 cifs_chan_clear_in_reconnect(struct cifs_ses *ses,
105 			     struct TCP_Server_Info *server)
106 {
107 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
108 
109 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
110 		return;
111 
112 	ses->chans[chan_index].in_reconnect = false;
113 }
114 
115 bool
116 cifs_chan_in_reconnect(struct cifs_ses *ses,
117 			  struct TCP_Server_Info *server)
118 {
119 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
120 
121 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
122 		return true;	/* err on the safer side */
123 
124 	return CIFS_CHAN_IN_RECONNECT(ses, chan_index);
125 }
126 
127 void
128 cifs_chan_set_need_reconnect(struct cifs_ses *ses,
129 			     struct TCP_Server_Info *server)
130 {
131 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
132 
133 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
134 		return;
135 
136 	set_bit(chan_index, &ses->chans_need_reconnect);
137 	cifs_dbg(FYI, "Set reconnect bitmask for chan %u; now 0x%lx\n",
138 		 chan_index, ses->chans_need_reconnect);
139 }
140 
141 void
142 cifs_chan_clear_need_reconnect(struct cifs_ses *ses,
143 			       struct TCP_Server_Info *server)
144 {
145 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
146 
147 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
148 		return;
149 
150 	clear_bit(chan_index, &ses->chans_need_reconnect);
151 	cifs_dbg(FYI, "Cleared reconnect bitmask for chan %u; now 0x%lx\n",
152 		 chan_index, ses->chans_need_reconnect);
153 }
154 
155 bool
156 cifs_chan_needs_reconnect(struct cifs_ses *ses,
157 			  struct TCP_Server_Info *server)
158 {
159 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
160 
161 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
162 		return true;	/* err on the safer side */
163 
164 	return CIFS_CHAN_NEEDS_RECONNECT(ses, chan_index);
165 }
166 
167 bool
168 cifs_chan_is_iface_active(struct cifs_ses *ses,
169 			  struct TCP_Server_Info *server)
170 {
171 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
172 
173 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
174 		return true;	/* err on the safer side */
175 
176 	return ses->chans[chan_index].iface &&
177 		ses->chans[chan_index].iface->is_active;
178 }
179 
180 /* returns number of channels added */
181 int cifs_try_adding_channels(struct cifs_ses *ses)
182 {
183 	struct TCP_Server_Info *server = ses->server;
184 	int old_chan_count, new_chan_count;
185 	int left;
186 	int rc = 0;
187 	int tries = 0;
188 	size_t iface_weight = 0, iface_min_speed = 0;
189 	struct cifs_server_iface *iface = NULL, *niface = NULL;
190 	struct cifs_server_iface *last_iface = NULL;
191 
192 	spin_lock(&ses->chan_lock);
193 
194 	new_chan_count = old_chan_count = ses->chan_count;
195 	left = ses->chan_max - ses->chan_count;
196 
197 	if (left <= 0) {
198 		spin_unlock(&ses->chan_lock);
199 		cifs_dbg(FYI,
200 			 "ses already at max_channels (%zu), nothing to open\n",
201 			 ses->chan_max);
202 		return 0;
203 	}
204 
205 	if (server->dialect < SMB30_PROT_ID) {
206 		spin_unlock(&ses->chan_lock);
207 		cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
208 		return 0;
209 	}
210 
211 	if (!(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
212 		spin_unlock(&ses->chan_lock);
213 		cifs_server_dbg(VFS, "no multichannel support\n");
214 		return 0;
215 	}
216 	spin_unlock(&ses->chan_lock);
217 
218 	while (left > 0) {
219 
220 		tries++;
221 		if (tries > 3*ses->chan_max) {
222 			cifs_dbg(VFS, "too many channel open attempts (%d channels left to open)\n",
223 				 left);
224 			break;
225 		}
226 
227 		spin_lock(&ses->iface_lock);
228 		if (!ses->iface_count) {
229 			spin_unlock(&ses->iface_lock);
230 			cifs_dbg(VFS, "server %s does not advertise interfaces\n",
231 				      ses->server->hostname);
232 			break;
233 		}
234 
235 		if (!iface)
236 			iface = list_first_entry(&ses->iface_list, struct cifs_server_iface,
237 						 iface_head);
238 		last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
239 					     iface_head);
240 		iface_min_speed = last_iface->speed;
241 
242 		list_for_each_entry_safe_from(iface, niface, &ses->iface_list,
243 				    iface_head) {
244 			/* do not mix rdma and non-rdma interfaces */
245 			if (iface->rdma_capable != ses->server->rdma)
246 				continue;
247 
248 			/* skip ifaces that are unusable */
249 			if (!iface->is_active ||
250 			    (is_ses_using_iface(ses, iface) &&
251 			     !iface->rss_capable))
252 				continue;
253 
254 			/* check if we already allocated enough channels */
255 			iface_weight = iface->speed / iface_min_speed;
256 
257 			if (iface->weight_fulfilled >= iface_weight)
258 				continue;
259 
260 			/* take ref before unlock */
261 			kref_get(&iface->refcount);
262 
263 			spin_unlock(&ses->iface_lock);
264 			rc = cifs_ses_add_channel(ses, iface);
265 			spin_lock(&ses->iface_lock);
266 
267 			if (rc) {
268 				cifs_dbg(VFS, "failed to open extra channel on iface:%pIS rc=%d\n",
269 					 &iface->sockaddr,
270 					 rc);
271 				kref_put(&iface->refcount, release_iface);
272 				continue;
273 			}
274 
275 			iface->num_channels++;
276 			iface->weight_fulfilled++;
277 			cifs_dbg(VFS, "successfully opened new channel on iface:%pIS\n",
278 				 &iface->sockaddr);
279 			break;
280 		}
281 
282 		/* reached end of list. reset weight_fulfilled and start over */
283 		if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
284 			list_for_each_entry(iface, &ses->iface_list, iface_head)
285 				iface->weight_fulfilled = 0;
286 			spin_unlock(&ses->iface_lock);
287 			iface = NULL;
288 			continue;
289 		}
290 		spin_unlock(&ses->iface_lock);
291 
292 		left--;
293 		new_chan_count++;
294 	}
295 
296 	return new_chan_count - old_chan_count;
297 }
298 
299 /*
300  * called when multichannel is disabled by the server.
301  * this always gets called from smb2_reconnect
302  * and cannot get called in parallel threads.
303  */
304 void
305 cifs_disable_secondary_channels(struct cifs_ses *ses)
306 {
307 	int i, chan_count;
308 	struct TCP_Server_Info *server;
309 	struct cifs_server_iface *iface;
310 
311 	spin_lock(&ses->chan_lock);
312 	chan_count = ses->chan_count;
313 	if (chan_count == 1)
314 		goto done;
315 
316 	ses->chan_count = 1;
317 
318 	/* for all secondary channels reset the need reconnect bit */
319 	ses->chans_need_reconnect &= 1;
320 
321 	for (i = 1; i < chan_count; i++) {
322 		iface = ses->chans[i].iface;
323 		server = ses->chans[i].server;
324 
325 		/*
326 		 * remove these references first, since we need to unlock
327 		 * the chan_lock here, since iface_lock is a higher lock
328 		 */
329 		ses->chans[i].iface = NULL;
330 		ses->chans[i].server = NULL;
331 		spin_unlock(&ses->chan_lock);
332 
333 		if (iface) {
334 			spin_lock(&ses->iface_lock);
335 			iface->num_channels--;
336 			if (iface->weight_fulfilled)
337 				iface->weight_fulfilled--;
338 			kref_put(&iface->refcount, release_iface);
339 			spin_unlock(&ses->iface_lock);
340 		}
341 
342 		if (server) {
343 			if (!server->terminate) {
344 				server->terminate = true;
345 				cifs_signal_cifsd_for_reconnect(server, false);
346 			}
347 			cifs_put_tcp_session(server, false);
348 		}
349 
350 		spin_lock(&ses->chan_lock);
351 	}
352 
353 done:
354 	spin_unlock(&ses->chan_lock);
355 }
356 
357 /*
358  * update the iface for the channel if necessary.
359  * Must be called with chan_lock held.
360  */
361 void
362 cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server)
363 {
364 	unsigned int chan_index;
365 	size_t iface_weight = 0, iface_min_speed = 0;
366 	struct cifs_server_iface *iface = NULL;
367 	struct cifs_server_iface *old_iface = NULL;
368 	struct cifs_server_iface *last_iface = NULL;
369 	struct sockaddr_storage ss;
370 
371 	spin_lock(&ses->chan_lock);
372 	chan_index = cifs_ses_get_chan_index(ses, server);
373 	if (chan_index == CIFS_INVAL_CHAN_INDEX) {
374 		spin_unlock(&ses->chan_lock);
375 		return;
376 	}
377 
378 	if (ses->chans[chan_index].iface) {
379 		old_iface = ses->chans[chan_index].iface;
380 		if (old_iface->is_active) {
381 			spin_unlock(&ses->chan_lock);
382 			return;
383 		}
384 	}
385 	spin_unlock(&ses->chan_lock);
386 
387 	spin_lock(&server->srv_lock);
388 	ss = server->dstaddr;
389 	spin_unlock(&server->srv_lock);
390 
391 	spin_lock(&ses->iface_lock);
392 	if (!ses->iface_count) {
393 		spin_unlock(&ses->iface_lock);
394 		cifs_dbg(VFS, "server %s does not advertise interfaces\n", ses->server->hostname);
395 		return;
396 	}
397 
398 	last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
399 				     iface_head);
400 	iface_min_speed = last_iface->speed;
401 
402 	/* then look for a new one */
403 	list_for_each_entry(iface, &ses->iface_list, iface_head) {
404 		if (!chan_index) {
405 			/* if we're trying to get the updated iface for primary channel */
406 			if (!cifs_match_ipaddr((struct sockaddr *) &ss,
407 					       (struct sockaddr *) &iface->sockaddr))
408 				continue;
409 
410 			kref_get(&iface->refcount);
411 			break;
412 		}
413 
414 		/* do not mix rdma and non-rdma interfaces */
415 		if (iface->rdma_capable != server->rdma)
416 			continue;
417 
418 		if (!iface->is_active ||
419 		    (is_ses_using_iface(ses, iface) &&
420 		     !iface->rss_capable)) {
421 			continue;
422 		}
423 
424 		/* check if we already allocated enough channels */
425 		iface_weight = iface->speed / iface_min_speed;
426 
427 		if (iface->weight_fulfilled >= iface_weight)
428 			continue;
429 
430 		kref_get(&iface->refcount);
431 		break;
432 	}
433 
434 	if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
435 		iface = NULL;
436 		cifs_dbg(FYI, "unable to find a suitable iface\n");
437 	}
438 
439 	if (!iface) {
440 		if (!chan_index)
441 			cifs_dbg(FYI, "unable to get the interface matching: %pIS\n",
442 				 &ss);
443 		else {
444 			cifs_dbg(FYI, "unable to find another interface to replace: %pIS\n",
445 				 &old_iface->sockaddr);
446 		}
447 
448 		spin_unlock(&ses->iface_lock);
449 		return;
450 	}
451 
452 	/* now drop the ref to the current iface */
453 	if (old_iface) {
454 		cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n",
455 			 &old_iface->sockaddr,
456 			 &iface->sockaddr);
457 
458 		old_iface->num_channels--;
459 		if (old_iface->weight_fulfilled)
460 			old_iface->weight_fulfilled--;
461 		iface->num_channels++;
462 		iface->weight_fulfilled++;
463 
464 		kref_put(&old_iface->refcount, release_iface);
465 	} else if (!chan_index) {
466 		/* special case: update interface for primary channel */
467 		cifs_dbg(FYI, "referencing primary channel iface: %pIS\n",
468 			 &iface->sockaddr);
469 		iface->num_channels++;
470 		iface->weight_fulfilled++;
471 	}
472 	spin_unlock(&ses->iface_lock);
473 
474 	spin_lock(&ses->chan_lock);
475 	chan_index = cifs_ses_get_chan_index(ses, server);
476 	if (chan_index == CIFS_INVAL_CHAN_INDEX) {
477 		spin_unlock(&ses->chan_lock);
478 		return;
479 	}
480 
481 	ses->chans[chan_index].iface = iface;
482 	spin_unlock(&ses->chan_lock);
483 }
484 
485 /*
486  * If server is a channel of ses, return the corresponding enclosing
487  * cifs_chan otherwise return NULL.
488  */
489 struct cifs_chan *
490 cifs_ses_find_chan(struct cifs_ses *ses, struct TCP_Server_Info *server)
491 {
492 	int i;
493 
494 	spin_lock(&ses->chan_lock);
495 	for (i = 0; i < ses->chan_count; i++) {
496 		if (ses->chans[i].server == server) {
497 			spin_unlock(&ses->chan_lock);
498 			return &ses->chans[i];
499 		}
500 	}
501 	spin_unlock(&ses->chan_lock);
502 	return NULL;
503 }
504 
505 static int
506 cifs_ses_add_channel(struct cifs_ses *ses,
507 		     struct cifs_server_iface *iface)
508 {
509 	struct TCP_Server_Info *chan_server;
510 	struct cifs_chan *chan;
511 	struct smb3_fs_context *ctx;
512 	static const char unc_fmt[] = "\\%s\\foo";
513 	struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
514 	struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
515 	size_t len;
516 	int rc;
517 	unsigned int xid = get_xid();
518 
519 	if (iface->sockaddr.ss_family == AF_INET)
520 		cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
521 			 ses, iface->speed, iface->rdma_capable ? "yes" : "no",
522 			 &ipv4->sin_addr);
523 	else
524 		cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI6)\n",
525 			 ses, iface->speed, iface->rdma_capable ? "yes" : "no",
526 			 &ipv6->sin6_addr);
527 
528 	/*
529 	 * Setup a ctx with mostly the same info as the existing
530 	 * session and overwrite it with the requested iface data.
531 	 *
532 	 * We need to setup at least the fields used for negprot and
533 	 * sesssetup.
534 	 *
535 	 * We only need the ctx here, so we can reuse memory from
536 	 * the session and server without caring about memory
537 	 * management.
538 	 */
539 	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
540 	if (!ctx) {
541 		rc = -ENOMEM;
542 		goto out_free_xid;
543 	}
544 
545 	/* Always make new connection for now (TODO?) */
546 	ctx->nosharesock = true;
547 
548 	/* Auth */
549 	ctx->domainauto = ses->domainAuto;
550 	ctx->domainname = ses->domainName;
551 
552 	/* no hostname for extra channels */
553 	ctx->server_hostname = "";
554 
555 	ctx->username = ses->user_name;
556 	ctx->password = ses->password;
557 	ctx->sectype = ses->sectype;
558 	ctx->sign = ses->sign;
559 
560 	/* UNC and paths */
561 	/* XXX: Use ses->server->hostname? */
562 	len = sizeof(unc_fmt) + SERVER_NAME_LEN_WITH_NULL;
563 	ctx->UNC = kzalloc(len, GFP_KERNEL);
564 	if (!ctx->UNC) {
565 		rc = -ENOMEM;
566 		goto out_free_ctx;
567 	}
568 	scnprintf(ctx->UNC, len, unc_fmt, ses->ip_addr);
569 	ctx->prepath = "";
570 
571 	/* Reuse same version as master connection */
572 	ctx->vals = ses->server->vals;
573 	ctx->ops = ses->server->ops;
574 
575 	ctx->noblocksnd = ses->server->noblocksnd;
576 	ctx->noautotune = ses->server->noautotune;
577 	ctx->sockopt_tcp_nodelay = ses->server->tcp_nodelay;
578 	ctx->echo_interval = ses->server->echo_interval / HZ;
579 	ctx->max_credits = ses->server->max_credits;
580 
581 	/*
582 	 * This will be used for encoding/decoding user/domain/pw
583 	 * during sess setup auth.
584 	 */
585 	ctx->local_nls = ses->local_nls;
586 
587 	/* Use RDMA if possible */
588 	ctx->rdma = iface->rdma_capable;
589 	memcpy(&ctx->dstaddr, &iface->sockaddr, sizeof(ctx->dstaddr));
590 
591 	/* reuse master con client guid */
592 	memcpy(&ctx->client_guid, ses->server->client_guid,
593 	       sizeof(ctx->client_guid));
594 	ctx->use_client_guid = true;
595 
596 	chan_server = cifs_get_tcp_session(ctx, ses->server);
597 
598 	spin_lock(&ses->chan_lock);
599 	chan = &ses->chans[ses->chan_count];
600 	chan->server = chan_server;
601 	if (IS_ERR(chan->server)) {
602 		rc = PTR_ERR(chan->server);
603 		chan->server = NULL;
604 		spin_unlock(&ses->chan_lock);
605 		goto out;
606 	}
607 	chan->iface = iface;
608 	ses->chan_count++;
609 	atomic_set(&ses->chan_seq, 0);
610 
611 	/* Mark this channel as needing connect/setup */
612 	cifs_chan_set_need_reconnect(ses, chan->server);
613 
614 	spin_unlock(&ses->chan_lock);
615 
616 	mutex_lock(&ses->session_mutex);
617 	/*
618 	 * We need to allocate the server crypto now as we will need
619 	 * to sign packets before we generate the channel signing key
620 	 * (we sign with the session key)
621 	 */
622 	rc = smb311_crypto_shash_allocate(chan->server);
623 	if (rc) {
624 		cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
625 		mutex_unlock(&ses->session_mutex);
626 		goto out;
627 	}
628 
629 	rc = cifs_negotiate_protocol(xid, ses, chan->server);
630 	if (!rc)
631 		rc = cifs_setup_session(xid, ses, chan->server, ses->local_nls);
632 
633 	mutex_unlock(&ses->session_mutex);
634 
635 out:
636 	if (rc && chan->server) {
637 		cifs_put_tcp_session(chan->server, 0);
638 
639 		spin_lock(&ses->chan_lock);
640 
641 		/* we rely on all bits beyond chan_count to be clear */
642 		cifs_chan_clear_need_reconnect(ses, chan->server);
643 		ses->chan_count--;
644 		/*
645 		 * chan_count should never reach 0 as at least the primary
646 		 * channel is always allocated
647 		 */
648 		WARN_ON(ses->chan_count < 1);
649 		spin_unlock(&ses->chan_lock);
650 	}
651 
652 	kfree(ctx->UNC);
653 out_free_ctx:
654 	kfree(ctx);
655 out_free_xid:
656 	free_xid(xid);
657 	return rc;
658 }
659 
660 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
661 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses,
662 			     struct TCP_Server_Info *server,
663 			     SESSION_SETUP_ANDX *pSMB)
664 {
665 	__u32 capabilities = 0;
666 
667 	/* init fields common to all four types of SessSetup */
668 	/* Note that offsets for first seven fields in req struct are same  */
669 	/*	in CIFS Specs so does not matter which of 3 forms of struct */
670 	/*	that we use in next few lines                               */
671 	/* Note that header is initialized to zero in header_assemble */
672 	pSMB->req.AndXCommand = 0xFF;
673 	pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
674 					CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
675 					USHRT_MAX));
676 	pSMB->req.MaxMpxCount = cpu_to_le16(server->maxReq);
677 	pSMB->req.VcNumber = cpu_to_le16(1);
678 
679 	/* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
680 
681 	/* BB verify whether signing required on neg or just auth frame (and NTLM case) */
682 
683 	capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
684 			CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
685 
686 	if (server->sign)
687 		pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
688 
689 	if (ses->capabilities & CAP_UNICODE) {
690 		pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
691 		capabilities |= CAP_UNICODE;
692 	}
693 	if (ses->capabilities & CAP_STATUS32) {
694 		pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
695 		capabilities |= CAP_STATUS32;
696 	}
697 	if (ses->capabilities & CAP_DFS) {
698 		pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
699 		capabilities |= CAP_DFS;
700 	}
701 	if (ses->capabilities & CAP_UNIX)
702 		capabilities |= CAP_UNIX;
703 
704 	return capabilities;
705 }
706 
707 static void
708 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
709 {
710 	char *bcc_ptr = *pbcc_area;
711 	int bytes_ret = 0;
712 
713 	/* Copy OS version */
714 	bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
715 				    nls_cp);
716 	bcc_ptr += 2 * bytes_ret;
717 	bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
718 				    32, nls_cp);
719 	bcc_ptr += 2 * bytes_ret;
720 	bcc_ptr += 2; /* trailing null */
721 
722 	bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
723 				    32, nls_cp);
724 	bcc_ptr += 2 * bytes_ret;
725 	bcc_ptr += 2; /* trailing null */
726 
727 	*pbcc_area = bcc_ptr;
728 }
729 
730 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
731 				   const struct nls_table *nls_cp)
732 {
733 	char *bcc_ptr = *pbcc_area;
734 	int bytes_ret = 0;
735 
736 	/* copy domain */
737 	if (ses->domainName == NULL) {
738 		/*
739 		 * Sending null domain better than using a bogus domain name (as
740 		 * we did briefly in 2.6.18) since server will use its default
741 		 */
742 		*bcc_ptr = 0;
743 		*(bcc_ptr+1) = 0;
744 		bytes_ret = 0;
745 	} else
746 		bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
747 					    CIFS_MAX_DOMAINNAME_LEN, nls_cp);
748 	bcc_ptr += 2 * bytes_ret;
749 	bcc_ptr += 2;  /* account for null terminator */
750 
751 	*pbcc_area = bcc_ptr;
752 }
753 
754 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
755 				   const struct nls_table *nls_cp)
756 {
757 	char *bcc_ptr = *pbcc_area;
758 	int bytes_ret = 0;
759 
760 	/* BB FIXME add check that strings less than 335 or will need to send as arrays */
761 
762 	/* copy user */
763 	if (ses->user_name == NULL) {
764 		/* null user mount */
765 		*bcc_ptr = 0;
766 		*(bcc_ptr+1) = 0;
767 	} else {
768 		bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
769 					    CIFS_MAX_USERNAME_LEN, nls_cp);
770 	}
771 	bcc_ptr += 2 * bytes_ret;
772 	bcc_ptr += 2; /* account for null termination */
773 
774 	unicode_domain_string(&bcc_ptr, ses, nls_cp);
775 	unicode_oslm_strings(&bcc_ptr, nls_cp);
776 
777 	*pbcc_area = bcc_ptr;
778 }
779 
780 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
781 				 const struct nls_table *nls_cp)
782 {
783 	char *bcc_ptr = *pbcc_area;
784 	int len;
785 
786 	/* copy user */
787 	/* BB what about null user mounts - check that we do this BB */
788 	/* copy user */
789 	if (ses->user_name != NULL) {
790 		len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
791 		if (WARN_ON_ONCE(len < 0))
792 			len = CIFS_MAX_USERNAME_LEN - 1;
793 		bcc_ptr += len;
794 	}
795 	/* else null user mount */
796 	*bcc_ptr = 0;
797 	bcc_ptr++; /* account for null termination */
798 
799 	/* copy domain */
800 	if (ses->domainName != NULL) {
801 		len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
802 		if (WARN_ON_ONCE(len < 0))
803 			len = CIFS_MAX_DOMAINNAME_LEN - 1;
804 		bcc_ptr += len;
805 	} /* else we send a null domain name so server will default to its own domain */
806 	*bcc_ptr = 0;
807 	bcc_ptr++;
808 
809 	/* BB check for overflow here */
810 
811 	strcpy(bcc_ptr, "Linux version ");
812 	bcc_ptr += strlen("Linux version ");
813 	strcpy(bcc_ptr, init_utsname()->release);
814 	bcc_ptr += strlen(init_utsname()->release) + 1;
815 
816 	strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
817 	bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
818 
819 	*pbcc_area = bcc_ptr;
820 }
821 
822 static void
823 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
824 		      const struct nls_table *nls_cp)
825 {
826 	int len;
827 	char *data = *pbcc_area;
828 
829 	cifs_dbg(FYI, "bleft %d\n", bleft);
830 
831 	kfree(ses->serverOS);
832 	ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
833 	cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
834 	len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
835 	data += len;
836 	bleft -= len;
837 	if (bleft <= 0)
838 		return;
839 
840 	kfree(ses->serverNOS);
841 	ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
842 	cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
843 	len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
844 	data += len;
845 	bleft -= len;
846 	if (bleft <= 0)
847 		return;
848 
849 	kfree(ses->serverDomain);
850 	ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
851 	cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
852 
853 	return;
854 }
855 
856 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
857 				struct cifs_ses *ses,
858 				const struct nls_table *nls_cp)
859 {
860 	int len;
861 	char *bcc_ptr = *pbcc_area;
862 
863 	cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
864 
865 	len = strnlen(bcc_ptr, bleft);
866 	if (len >= bleft)
867 		return;
868 
869 	kfree(ses->serverOS);
870 
871 	ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
872 	if (ses->serverOS) {
873 		memcpy(ses->serverOS, bcc_ptr, len);
874 		ses->serverOS[len] = 0;
875 		if (strncmp(ses->serverOS, "OS/2", 4) == 0)
876 			cifs_dbg(FYI, "OS/2 server\n");
877 	}
878 
879 	bcc_ptr += len + 1;
880 	bleft -= len + 1;
881 
882 	len = strnlen(bcc_ptr, bleft);
883 	if (len >= bleft)
884 		return;
885 
886 	kfree(ses->serverNOS);
887 
888 	ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
889 	if (ses->serverNOS) {
890 		memcpy(ses->serverNOS, bcc_ptr, len);
891 		ses->serverNOS[len] = 0;
892 	}
893 
894 	bcc_ptr += len + 1;
895 	bleft -= len + 1;
896 
897 	len = strnlen(bcc_ptr, bleft);
898 	if (len > bleft)
899 		return;
900 
901 	/*
902 	 * No domain field in LANMAN case. Domain is
903 	 * returned by old servers in the SMB negprot response
904 	 *
905 	 * BB For newer servers which do not support Unicode,
906 	 * but thus do return domain here, we could add parsing
907 	 * for it later, but it is not very important
908 	 */
909 	cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
910 }
911 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
912 
913 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
914 				    struct cifs_ses *ses)
915 {
916 	unsigned int tioffset; /* challenge message target info area */
917 	unsigned int tilen; /* challenge message target info area length  */
918 	CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
919 	__u32 server_flags;
920 
921 	if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
922 		cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
923 		return -EINVAL;
924 	}
925 
926 	if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
927 		cifs_dbg(VFS, "blob signature incorrect %s\n",
928 			 pblob->Signature);
929 		return -EINVAL;
930 	}
931 	if (pblob->MessageType != NtLmChallenge) {
932 		cifs_dbg(VFS, "Incorrect message type %d\n",
933 			 pblob->MessageType);
934 		return -EINVAL;
935 	}
936 
937 	server_flags = le32_to_cpu(pblob->NegotiateFlags);
938 	cifs_dbg(FYI, "%s: negotiate=0x%08x challenge=0x%08x\n", __func__,
939 		 ses->ntlmssp->client_flags, server_flags);
940 
941 	if ((ses->ntlmssp->client_flags & (NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN)) &&
942 	    (!(server_flags & NTLMSSP_NEGOTIATE_56) && !(server_flags & NTLMSSP_NEGOTIATE_128))) {
943 		cifs_dbg(VFS, "%s: requested signing/encryption but server did not return either 56-bit or 128-bit session key size\n",
944 			 __func__);
945 		return -EINVAL;
946 	}
947 	if (!(server_flags & NTLMSSP_NEGOTIATE_NTLM) && !(server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) {
948 		cifs_dbg(VFS, "%s: server does not seem to support either NTLMv1 or NTLMv2\n", __func__);
949 		return -EINVAL;
950 	}
951 	if (ses->server->sign && !(server_flags & NTLMSSP_NEGOTIATE_SIGN)) {
952 		cifs_dbg(VFS, "%s: forced packet signing but server does not seem to support it\n",
953 			 __func__);
954 		return -EOPNOTSUPP;
955 	}
956 	if ((ses->ntlmssp->client_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
957 	    !(server_flags & NTLMSSP_NEGOTIATE_KEY_XCH))
958 		pr_warn_once("%s: authentication has been weakened as server does not support key exchange\n",
959 			     __func__);
960 
961 	ses->ntlmssp->server_flags = server_flags;
962 
963 	memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
964 	/*
965 	 * In particular we can examine sign flags
966 	 *
967 	 * BB spec says that if AvId field of MsvAvTimestamp is populated then
968 	 * we must set the MIC field of the AUTHENTICATE_MESSAGE
969 	 */
970 
971 	tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
972 	tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
973 	if (tioffset > blob_len || tioffset + tilen > blob_len) {
974 		cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
975 			 tioffset, tilen);
976 		return -EINVAL;
977 	}
978 	if (tilen) {
979 		kfree_sensitive(ses->auth_key.response);
980 		ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
981 						 GFP_KERNEL);
982 		if (!ses->auth_key.response) {
983 			cifs_dbg(VFS, "Challenge target info alloc failure\n");
984 			return -ENOMEM;
985 		}
986 		ses->auth_key.len = tilen;
987 	}
988 
989 	return 0;
990 }
991 
992 static int size_of_ntlmssp_blob(struct cifs_ses *ses, int base_size)
993 {
994 	int sz = base_size + ses->auth_key.len
995 		- CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
996 
997 	if (ses->domainName)
998 		sz += sizeof(__le16) * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
999 	else
1000 		sz += sizeof(__le16);
1001 
1002 	if (ses->user_name)
1003 		sz += sizeof(__le16) * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
1004 	else
1005 		sz += sizeof(__le16);
1006 
1007 	if (ses->workstation_name[0])
1008 		sz += sizeof(__le16) * strnlen(ses->workstation_name,
1009 					       ntlmssp_workstation_name_size(ses));
1010 	else
1011 		sz += sizeof(__le16);
1012 
1013 	return sz;
1014 }
1015 
1016 static inline void cifs_security_buffer_from_str(SECURITY_BUFFER *pbuf,
1017 						 char *str_value,
1018 						 int str_length,
1019 						 unsigned char *pstart,
1020 						 unsigned char **pcur,
1021 						 const struct nls_table *nls_cp)
1022 {
1023 	unsigned char *tmp = pstart;
1024 	int len;
1025 
1026 	if (!pbuf)
1027 		return;
1028 
1029 	if (!pcur)
1030 		pcur = &tmp;
1031 
1032 	if (!str_value) {
1033 		pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
1034 		pbuf->Length = 0;
1035 		pbuf->MaximumLength = 0;
1036 		*pcur += sizeof(__le16);
1037 	} else {
1038 		len = cifs_strtoUTF16((__le16 *)*pcur,
1039 				      str_value,
1040 				      str_length,
1041 				      nls_cp);
1042 		len *= sizeof(__le16);
1043 		pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
1044 		pbuf->Length = cpu_to_le16(len);
1045 		pbuf->MaximumLength = cpu_to_le16(len);
1046 		*pcur += len;
1047 	}
1048 }
1049 
1050 /* BB Move to ntlmssp.c eventually */
1051 
1052 int build_ntlmssp_negotiate_blob(unsigned char **pbuffer,
1053 				 u16 *buflen,
1054 				 struct cifs_ses *ses,
1055 				 struct TCP_Server_Info *server,
1056 				 const struct nls_table *nls_cp)
1057 {
1058 	int rc = 0;
1059 	NEGOTIATE_MESSAGE *sec_blob;
1060 	__u32 flags;
1061 	unsigned char *tmp;
1062 	int len;
1063 
1064 	len = size_of_ntlmssp_blob(ses, sizeof(NEGOTIATE_MESSAGE));
1065 	*pbuffer = kmalloc(len, GFP_KERNEL);
1066 	if (!*pbuffer) {
1067 		rc = -ENOMEM;
1068 		cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1069 		*buflen = 0;
1070 		goto setup_ntlm_neg_ret;
1071 	}
1072 	sec_blob = (NEGOTIATE_MESSAGE *)*pbuffer;
1073 
1074 	memset(*pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
1075 	memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1076 	sec_blob->MessageType = NtLmNegotiate;
1077 
1078 	/* BB is NTLMV2 session security format easier to use here? */
1079 	flags = NTLMSSP_NEGOTIATE_56 |	NTLMSSP_REQUEST_TARGET |
1080 		NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1081 		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1082 		NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1083 		NTLMSSP_NEGOTIATE_SIGN;
1084 	if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1085 		flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1086 
1087 	tmp = *pbuffer + sizeof(NEGOTIATE_MESSAGE);
1088 	ses->ntlmssp->client_flags = flags;
1089 	sec_blob->NegotiateFlags = cpu_to_le32(flags);
1090 
1091 	/* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1092 	cifs_security_buffer_from_str(&sec_blob->DomainName,
1093 				      NULL,
1094 				      CIFS_MAX_DOMAINNAME_LEN,
1095 				      *pbuffer, &tmp,
1096 				      nls_cp);
1097 
1098 	cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1099 				      NULL,
1100 				      CIFS_MAX_WORKSTATION_LEN,
1101 				      *pbuffer, &tmp,
1102 				      nls_cp);
1103 
1104 	*buflen = tmp - *pbuffer;
1105 setup_ntlm_neg_ret:
1106 	return rc;
1107 }
1108 
1109 /*
1110  * Build ntlmssp blob with additional fields, such as version,
1111  * supported by modern servers. For safety limit to SMB3 or later
1112  * See notes in MS-NLMP Section 2.2.2.1 e.g.
1113  */
1114 int build_ntlmssp_smb3_negotiate_blob(unsigned char **pbuffer,
1115 				 u16 *buflen,
1116 				 struct cifs_ses *ses,
1117 				 struct TCP_Server_Info *server,
1118 				 const struct nls_table *nls_cp)
1119 {
1120 	int rc = 0;
1121 	struct negotiate_message *sec_blob;
1122 	__u32 flags;
1123 	unsigned char *tmp;
1124 	int len;
1125 
1126 	len = size_of_ntlmssp_blob(ses, sizeof(struct negotiate_message));
1127 	*pbuffer = kmalloc(len, GFP_KERNEL);
1128 	if (!*pbuffer) {
1129 		rc = -ENOMEM;
1130 		cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1131 		*buflen = 0;
1132 		goto setup_ntlm_smb3_neg_ret;
1133 	}
1134 	sec_blob = (struct negotiate_message *)*pbuffer;
1135 
1136 	memset(*pbuffer, 0, sizeof(struct negotiate_message));
1137 	memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1138 	sec_blob->MessageType = NtLmNegotiate;
1139 
1140 	/* BB is NTLMV2 session security format easier to use here? */
1141 	flags = NTLMSSP_NEGOTIATE_56 |	NTLMSSP_REQUEST_TARGET |
1142 		NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1143 		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1144 		NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1145 		NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_VERSION;
1146 	if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1147 		flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1148 
1149 	sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1150 	sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1151 	sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1152 	sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1153 
1154 	tmp = *pbuffer + sizeof(struct negotiate_message);
1155 	ses->ntlmssp->client_flags = flags;
1156 	sec_blob->NegotiateFlags = cpu_to_le32(flags);
1157 
1158 	/* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1159 	cifs_security_buffer_from_str(&sec_blob->DomainName,
1160 				      NULL,
1161 				      CIFS_MAX_DOMAINNAME_LEN,
1162 				      *pbuffer, &tmp,
1163 				      nls_cp);
1164 
1165 	cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1166 				      NULL,
1167 				      CIFS_MAX_WORKSTATION_LEN,
1168 				      *pbuffer, &tmp,
1169 				      nls_cp);
1170 
1171 	*buflen = tmp - *pbuffer;
1172 setup_ntlm_smb3_neg_ret:
1173 	return rc;
1174 }
1175 
1176 
1177 /* See MS-NLMP 2.2.1.3 */
1178 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
1179 					u16 *buflen,
1180 				   struct cifs_ses *ses,
1181 				   struct TCP_Server_Info *server,
1182 				   const struct nls_table *nls_cp)
1183 {
1184 	int rc;
1185 	AUTHENTICATE_MESSAGE *sec_blob;
1186 	__u32 flags;
1187 	unsigned char *tmp;
1188 	int len;
1189 
1190 	rc = setup_ntlmv2_rsp(ses, nls_cp);
1191 	if (rc) {
1192 		cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
1193 		*buflen = 0;
1194 		goto setup_ntlmv2_ret;
1195 	}
1196 
1197 	len = size_of_ntlmssp_blob(ses, sizeof(AUTHENTICATE_MESSAGE));
1198 	*pbuffer = kmalloc(len, GFP_KERNEL);
1199 	if (!*pbuffer) {
1200 		rc = -ENOMEM;
1201 		cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1202 		*buflen = 0;
1203 		goto setup_ntlmv2_ret;
1204 	}
1205 	sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
1206 
1207 	memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1208 	sec_blob->MessageType = NtLmAuthenticate;
1209 
1210 	/* send version information in ntlmssp authenticate also */
1211 	flags = ses->ntlmssp->server_flags | NTLMSSP_REQUEST_TARGET |
1212 		NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_VERSION |
1213 		NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED;
1214 
1215 	sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1216 	sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1217 	sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1218 	sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1219 
1220 	tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
1221 	sec_blob->NegotiateFlags = cpu_to_le32(flags);
1222 
1223 	sec_blob->LmChallengeResponse.BufferOffset =
1224 				cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
1225 	sec_blob->LmChallengeResponse.Length = 0;
1226 	sec_blob->LmChallengeResponse.MaximumLength = 0;
1227 
1228 	sec_blob->NtChallengeResponse.BufferOffset =
1229 				cpu_to_le32(tmp - *pbuffer);
1230 	if (ses->user_name != NULL) {
1231 		memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1232 				ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1233 		tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1234 
1235 		sec_blob->NtChallengeResponse.Length =
1236 				cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1237 		sec_blob->NtChallengeResponse.MaximumLength =
1238 				cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1239 	} else {
1240 		/*
1241 		 * don't send an NT Response for anonymous access
1242 		 */
1243 		sec_blob->NtChallengeResponse.Length = 0;
1244 		sec_blob->NtChallengeResponse.MaximumLength = 0;
1245 	}
1246 
1247 	cifs_security_buffer_from_str(&sec_blob->DomainName,
1248 				      ses->domainName,
1249 				      CIFS_MAX_DOMAINNAME_LEN,
1250 				      *pbuffer, &tmp,
1251 				      nls_cp);
1252 
1253 	cifs_security_buffer_from_str(&sec_blob->UserName,
1254 				      ses->user_name,
1255 				      CIFS_MAX_USERNAME_LEN,
1256 				      *pbuffer, &tmp,
1257 				      nls_cp);
1258 
1259 	cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1260 				      ses->workstation_name,
1261 				      ntlmssp_workstation_name_size(ses),
1262 				      *pbuffer, &tmp,
1263 				      nls_cp);
1264 
1265 	if ((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
1266 	    (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) &&
1267 	    !calc_seckey(ses)) {
1268 		memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
1269 		sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1270 		sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
1271 		sec_blob->SessionKey.MaximumLength =
1272 				cpu_to_le16(CIFS_CPHTXT_SIZE);
1273 		tmp += CIFS_CPHTXT_SIZE;
1274 	} else {
1275 		sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1276 		sec_blob->SessionKey.Length = 0;
1277 		sec_blob->SessionKey.MaximumLength = 0;
1278 	}
1279 
1280 	*buflen = tmp - *pbuffer;
1281 setup_ntlmv2_ret:
1282 	return rc;
1283 }
1284 
1285 enum securityEnum
1286 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
1287 {
1288 	switch (server->negflavor) {
1289 	case CIFS_NEGFLAVOR_EXTENDED:
1290 		switch (requested) {
1291 		case Kerberos:
1292 		case RawNTLMSSP:
1293 			return requested;
1294 		case Unspecified:
1295 			if (server->sec_ntlmssp &&
1296 			    (global_secflags & CIFSSEC_MAY_NTLMSSP))
1297 				return RawNTLMSSP;
1298 			if ((server->sec_kerberos || server->sec_mskerberos) &&
1299 			    (global_secflags & CIFSSEC_MAY_KRB5))
1300 				return Kerberos;
1301 			fallthrough;
1302 		default:
1303 			return Unspecified;
1304 		}
1305 	case CIFS_NEGFLAVOR_UNENCAP:
1306 		switch (requested) {
1307 		case NTLMv2:
1308 			return requested;
1309 		case Unspecified:
1310 			if (global_secflags & CIFSSEC_MAY_NTLMV2)
1311 				return NTLMv2;
1312 			break;
1313 		default:
1314 			break;
1315 		}
1316 		fallthrough;
1317 	default:
1318 		return Unspecified;
1319 	}
1320 }
1321 
1322 struct sess_data {
1323 	unsigned int xid;
1324 	struct cifs_ses *ses;
1325 	struct TCP_Server_Info *server;
1326 	struct nls_table *nls_cp;
1327 	void (*func)(struct sess_data *);
1328 	int result;
1329 
1330 	/* we will send the SMB in three pieces:
1331 	 * a fixed length beginning part, an optional
1332 	 * SPNEGO blob (which can be zero length), and a
1333 	 * last part which will include the strings
1334 	 * and rest of bcc area. This allows us to avoid
1335 	 * a large buffer 17K allocation
1336 	 */
1337 	int buf0_type;
1338 	struct kvec iov[3];
1339 };
1340 
1341 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
1342 static int
1343 sess_alloc_buffer(struct sess_data *sess_data, int wct)
1344 {
1345 	int rc;
1346 	struct cifs_ses *ses = sess_data->ses;
1347 	struct smb_hdr *smb_buf;
1348 
1349 	rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
1350 				  (void **)&smb_buf);
1351 
1352 	if (rc)
1353 		return rc;
1354 
1355 	sess_data->iov[0].iov_base = (char *)smb_buf;
1356 	sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
1357 	/*
1358 	 * This variable will be used to clear the buffer
1359 	 * allocated above in case of any error in the calling function.
1360 	 */
1361 	sess_data->buf0_type = CIFS_SMALL_BUFFER;
1362 
1363 	/* 2000 big enough to fit max user, domain, NOS name etc. */
1364 	sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
1365 	if (!sess_data->iov[2].iov_base) {
1366 		rc = -ENOMEM;
1367 		goto out_free_smb_buf;
1368 	}
1369 
1370 	return 0;
1371 
1372 out_free_smb_buf:
1373 	cifs_small_buf_release(smb_buf);
1374 	sess_data->iov[0].iov_base = NULL;
1375 	sess_data->iov[0].iov_len = 0;
1376 	sess_data->buf0_type = CIFS_NO_BUFFER;
1377 	return rc;
1378 }
1379 
1380 static void
1381 sess_free_buffer(struct sess_data *sess_data)
1382 {
1383 	struct kvec *iov = sess_data->iov;
1384 
1385 	/*
1386 	 * Zero the session data before freeing, as it might contain sensitive info (keys, etc).
1387 	 * Note that iov[1] is already freed by caller.
1388 	 */
1389 	if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base)
1390 		memzero_explicit(iov[0].iov_base, iov[0].iov_len);
1391 
1392 	free_rsp_buf(sess_data->buf0_type, iov[0].iov_base);
1393 	sess_data->buf0_type = CIFS_NO_BUFFER;
1394 	kfree_sensitive(iov[2].iov_base);
1395 }
1396 
1397 static int
1398 sess_establish_session(struct sess_data *sess_data)
1399 {
1400 	struct cifs_ses *ses = sess_data->ses;
1401 	struct TCP_Server_Info *server = sess_data->server;
1402 
1403 	cifs_server_lock(server);
1404 	if (!server->session_estab) {
1405 		if (server->sign) {
1406 			server->session_key.response =
1407 				kmemdup(ses->auth_key.response,
1408 				ses->auth_key.len, GFP_KERNEL);
1409 			if (!server->session_key.response) {
1410 				cifs_server_unlock(server);
1411 				return -ENOMEM;
1412 			}
1413 			server->session_key.len =
1414 						ses->auth_key.len;
1415 		}
1416 		server->sequence_number = 0x2;
1417 		server->session_estab = true;
1418 	}
1419 	cifs_server_unlock(server);
1420 
1421 	cifs_dbg(FYI, "CIFS session established successfully\n");
1422 	return 0;
1423 }
1424 
1425 static int
1426 sess_sendreceive(struct sess_data *sess_data)
1427 {
1428 	int rc;
1429 	struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
1430 	__u16 count;
1431 	struct kvec rsp_iov = { NULL, 0 };
1432 
1433 	count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
1434 	be32_add_cpu(&smb_buf->smb_buf_length, count);
1435 	put_bcc(count, smb_buf);
1436 
1437 	rc = SendReceive2(sess_data->xid, sess_data->ses,
1438 			  sess_data->iov, 3 /* num_iovecs */,
1439 			  &sess_data->buf0_type,
1440 			  CIFS_LOG_ERROR, &rsp_iov);
1441 	cifs_small_buf_release(sess_data->iov[0].iov_base);
1442 	memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
1443 
1444 	return rc;
1445 }
1446 
1447 static void
1448 sess_auth_ntlmv2(struct sess_data *sess_data)
1449 {
1450 	int rc = 0;
1451 	struct smb_hdr *smb_buf;
1452 	SESSION_SETUP_ANDX *pSMB;
1453 	char *bcc_ptr;
1454 	struct cifs_ses *ses = sess_data->ses;
1455 	struct TCP_Server_Info *server = sess_data->server;
1456 	__u32 capabilities;
1457 	__u16 bytes_remaining;
1458 
1459 	/* old style NTLM sessionsetup */
1460 	/* wct = 13 */
1461 	rc = sess_alloc_buffer(sess_data, 13);
1462 	if (rc)
1463 		goto out;
1464 
1465 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1466 	bcc_ptr = sess_data->iov[2].iov_base;
1467 	capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1468 
1469 	pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1470 
1471 	/* LM2 password would be here if we supported it */
1472 	pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1473 
1474 	if (ses->user_name != NULL) {
1475 		/* calculate nlmv2 response and session key */
1476 		rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
1477 		if (rc) {
1478 			cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
1479 			goto out;
1480 		}
1481 
1482 		memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1483 				ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1484 		bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1485 
1486 		/* set case sensitive password length after tilen may get
1487 		 * assigned, tilen is 0 otherwise.
1488 		 */
1489 		pSMB->req_no_secext.CaseSensitivePasswordLength =
1490 			cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1491 	} else {
1492 		pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1493 	}
1494 
1495 	if (ses->capabilities & CAP_UNICODE) {
1496 		if (!IS_ALIGNED(sess_data->iov[0].iov_len, 2)) {
1497 			*bcc_ptr = 0;
1498 			bcc_ptr++;
1499 		}
1500 		unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1501 	} else {
1502 		ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1503 	}
1504 
1505 
1506 	sess_data->iov[2].iov_len = (long) bcc_ptr -
1507 			(long) sess_data->iov[2].iov_base;
1508 
1509 	rc = sess_sendreceive(sess_data);
1510 	if (rc)
1511 		goto out;
1512 
1513 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1514 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1515 
1516 	if (smb_buf->WordCount != 3) {
1517 		rc = -EIO;
1518 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1519 		goto out;
1520 	}
1521 
1522 	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1523 		cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1524 
1525 	ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1526 	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1527 
1528 	bytes_remaining = get_bcc(smb_buf);
1529 	bcc_ptr = pByteArea(smb_buf);
1530 
1531 	/* BB check if Unicode and decode strings */
1532 	if (bytes_remaining == 0) {
1533 		/* no string area to decode, do nothing */
1534 	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1535 		/* unicode string area must be word-aligned */
1536 		if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1537 			++bcc_ptr;
1538 			--bytes_remaining;
1539 		}
1540 		decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1541 				      sess_data->nls_cp);
1542 	} else {
1543 		decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1544 				    sess_data->nls_cp);
1545 	}
1546 
1547 	rc = sess_establish_session(sess_data);
1548 out:
1549 	sess_data->result = rc;
1550 	sess_data->func = NULL;
1551 	sess_free_buffer(sess_data);
1552 	kfree_sensitive(ses->auth_key.response);
1553 	ses->auth_key.response = NULL;
1554 }
1555 
1556 #ifdef CONFIG_CIFS_UPCALL
1557 static void
1558 sess_auth_kerberos(struct sess_data *sess_data)
1559 {
1560 	int rc = 0;
1561 	struct smb_hdr *smb_buf;
1562 	SESSION_SETUP_ANDX *pSMB;
1563 	char *bcc_ptr;
1564 	struct cifs_ses *ses = sess_data->ses;
1565 	struct TCP_Server_Info *server = sess_data->server;
1566 	__u32 capabilities;
1567 	__u16 bytes_remaining;
1568 	struct key *spnego_key = NULL;
1569 	struct cifs_spnego_msg *msg;
1570 	u16 blob_len;
1571 
1572 	/* extended security */
1573 	/* wct = 12 */
1574 	rc = sess_alloc_buffer(sess_data, 12);
1575 	if (rc)
1576 		goto out;
1577 
1578 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1579 	bcc_ptr = sess_data->iov[2].iov_base;
1580 	capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1581 
1582 	spnego_key = cifs_get_spnego_key(ses, server);
1583 	if (IS_ERR(spnego_key)) {
1584 		rc = PTR_ERR(spnego_key);
1585 		spnego_key = NULL;
1586 		goto out;
1587 	}
1588 
1589 	msg = spnego_key->payload.data[0];
1590 	/*
1591 	 * check version field to make sure that cifs.upcall is
1592 	 * sending us a response in an expected form
1593 	 */
1594 	if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1595 		cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1596 			 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1597 		rc = -EKEYREJECTED;
1598 		goto out_put_spnego_key;
1599 	}
1600 
1601 	kfree_sensitive(ses->auth_key.response);
1602 	ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1603 					 GFP_KERNEL);
1604 	if (!ses->auth_key.response) {
1605 		cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1606 			 msg->sesskey_len);
1607 		rc = -ENOMEM;
1608 		goto out_put_spnego_key;
1609 	}
1610 	ses->auth_key.len = msg->sesskey_len;
1611 
1612 	pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1613 	capabilities |= CAP_EXTENDED_SECURITY;
1614 	pSMB->req.Capabilities = cpu_to_le32(capabilities);
1615 	sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1616 	sess_data->iov[1].iov_len = msg->secblob_len;
1617 	pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1618 
1619 	if (ses->capabilities & CAP_UNICODE) {
1620 		/* unicode strings must be word aligned */
1621 		if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1622 			*bcc_ptr = 0;
1623 			bcc_ptr++;
1624 		}
1625 		unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1626 		unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1627 	} else {
1628 		/* BB: is this right? */
1629 		ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1630 	}
1631 
1632 	sess_data->iov[2].iov_len = (long) bcc_ptr -
1633 			(long) sess_data->iov[2].iov_base;
1634 
1635 	rc = sess_sendreceive(sess_data);
1636 	if (rc)
1637 		goto out_put_spnego_key;
1638 
1639 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1640 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1641 
1642 	if (smb_buf->WordCount != 4) {
1643 		rc = -EIO;
1644 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1645 		goto out_put_spnego_key;
1646 	}
1647 
1648 	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1649 		cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1650 
1651 	ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1652 	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1653 
1654 	bytes_remaining = get_bcc(smb_buf);
1655 	bcc_ptr = pByteArea(smb_buf);
1656 
1657 	blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1658 	if (blob_len > bytes_remaining) {
1659 		cifs_dbg(VFS, "bad security blob length %d\n",
1660 				blob_len);
1661 		rc = -EINVAL;
1662 		goto out_put_spnego_key;
1663 	}
1664 	bcc_ptr += blob_len;
1665 	bytes_remaining -= blob_len;
1666 
1667 	/* BB check if Unicode and decode strings */
1668 	if (bytes_remaining == 0) {
1669 		/* no string area to decode, do nothing */
1670 	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1671 		/* unicode string area must be word-aligned */
1672 		if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1673 			++bcc_ptr;
1674 			--bytes_remaining;
1675 		}
1676 		decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1677 				      sess_data->nls_cp);
1678 	} else {
1679 		decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1680 				    sess_data->nls_cp);
1681 	}
1682 
1683 	rc = sess_establish_session(sess_data);
1684 out_put_spnego_key:
1685 	key_invalidate(spnego_key);
1686 	key_put(spnego_key);
1687 out:
1688 	sess_data->result = rc;
1689 	sess_data->func = NULL;
1690 	sess_free_buffer(sess_data);
1691 	kfree_sensitive(ses->auth_key.response);
1692 	ses->auth_key.response = NULL;
1693 }
1694 
1695 #endif /* ! CONFIG_CIFS_UPCALL */
1696 
1697 /*
1698  * The required kvec buffers have to be allocated before calling this
1699  * function.
1700  */
1701 static int
1702 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1703 {
1704 	SESSION_SETUP_ANDX *pSMB;
1705 	struct cifs_ses *ses = sess_data->ses;
1706 	struct TCP_Server_Info *server = sess_data->server;
1707 	__u32 capabilities;
1708 	char *bcc_ptr;
1709 
1710 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1711 
1712 	capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1713 	if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) {
1714 		cifs_dbg(VFS, "NTLMSSP requires Unicode support\n");
1715 		return -ENOSYS;
1716 	}
1717 
1718 	pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1719 	capabilities |= CAP_EXTENDED_SECURITY;
1720 	pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1721 
1722 	bcc_ptr = sess_data->iov[2].iov_base;
1723 	/* unicode strings must be word aligned */
1724 	if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1725 		*bcc_ptr = 0;
1726 		bcc_ptr++;
1727 	}
1728 	unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1729 
1730 	sess_data->iov[2].iov_len = (long) bcc_ptr -
1731 					(long) sess_data->iov[2].iov_base;
1732 
1733 	return 0;
1734 }
1735 
1736 static void
1737 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1738 
1739 static void
1740 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1741 {
1742 	int rc;
1743 	struct smb_hdr *smb_buf;
1744 	SESSION_SETUP_ANDX *pSMB;
1745 	struct cifs_ses *ses = sess_data->ses;
1746 	struct TCP_Server_Info *server = sess_data->server;
1747 	__u16 bytes_remaining;
1748 	char *bcc_ptr;
1749 	unsigned char *ntlmsspblob = NULL;
1750 	u16 blob_len;
1751 
1752 	cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1753 
1754 	/*
1755 	 * if memory allocation is successful, caller of this function
1756 	 * frees it.
1757 	 */
1758 	ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1759 	if (!ses->ntlmssp) {
1760 		rc = -ENOMEM;
1761 		goto out;
1762 	}
1763 	ses->ntlmssp->sesskey_per_smbsess = false;
1764 
1765 	/* wct = 12 */
1766 	rc = sess_alloc_buffer(sess_data, 12);
1767 	if (rc)
1768 		goto out;
1769 
1770 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1771 
1772 	/* Build security blob before we assemble the request */
1773 	rc = build_ntlmssp_negotiate_blob(&ntlmsspblob,
1774 				     &blob_len, ses, server,
1775 				     sess_data->nls_cp);
1776 	if (rc)
1777 		goto out_free_ntlmsspblob;
1778 
1779 	sess_data->iov[1].iov_len = blob_len;
1780 	sess_data->iov[1].iov_base = ntlmsspblob;
1781 	pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1782 
1783 	rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1784 	if (rc)
1785 		goto out_free_ntlmsspblob;
1786 
1787 	rc = sess_sendreceive(sess_data);
1788 
1789 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1790 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1791 
1792 	/* If true, rc here is expected and not an error */
1793 	if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1794 	    smb_buf->Status.CifsError ==
1795 			cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1796 		rc = 0;
1797 
1798 	if (rc)
1799 		goto out_free_ntlmsspblob;
1800 
1801 	cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1802 
1803 	if (smb_buf->WordCount != 4) {
1804 		rc = -EIO;
1805 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1806 		goto out_free_ntlmsspblob;
1807 	}
1808 
1809 	ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1810 	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1811 
1812 	bytes_remaining = get_bcc(smb_buf);
1813 	bcc_ptr = pByteArea(smb_buf);
1814 
1815 	blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1816 	if (blob_len > bytes_remaining) {
1817 		cifs_dbg(VFS, "bad security blob length %d\n",
1818 				blob_len);
1819 		rc = -EINVAL;
1820 		goto out_free_ntlmsspblob;
1821 	}
1822 
1823 	rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1824 
1825 out_free_ntlmsspblob:
1826 	kfree_sensitive(ntlmsspblob);
1827 out:
1828 	sess_free_buffer(sess_data);
1829 
1830 	if (!rc) {
1831 		sess_data->func = sess_auth_rawntlmssp_authenticate;
1832 		return;
1833 	}
1834 
1835 	/* Else error. Cleanup */
1836 	kfree_sensitive(ses->auth_key.response);
1837 	ses->auth_key.response = NULL;
1838 	kfree_sensitive(ses->ntlmssp);
1839 	ses->ntlmssp = NULL;
1840 
1841 	sess_data->func = NULL;
1842 	sess_data->result = rc;
1843 }
1844 
1845 static void
1846 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1847 {
1848 	int rc;
1849 	struct smb_hdr *smb_buf;
1850 	SESSION_SETUP_ANDX *pSMB;
1851 	struct cifs_ses *ses = sess_data->ses;
1852 	struct TCP_Server_Info *server = sess_data->server;
1853 	__u16 bytes_remaining;
1854 	char *bcc_ptr;
1855 	unsigned char *ntlmsspblob = NULL;
1856 	u16 blob_len;
1857 
1858 	cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1859 
1860 	/* wct = 12 */
1861 	rc = sess_alloc_buffer(sess_data, 12);
1862 	if (rc)
1863 		goto out;
1864 
1865 	/* Build security blob before we assemble the request */
1866 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1867 	smb_buf = (struct smb_hdr *)pSMB;
1868 	rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1869 					&blob_len, ses, server,
1870 					sess_data->nls_cp);
1871 	if (rc)
1872 		goto out_free_ntlmsspblob;
1873 	sess_data->iov[1].iov_len = blob_len;
1874 	sess_data->iov[1].iov_base = ntlmsspblob;
1875 	pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1876 	/*
1877 	 * Make sure that we tell the server that we are using
1878 	 * the uid that it just gave us back on the response
1879 	 * (challenge)
1880 	 */
1881 	smb_buf->Uid = ses->Suid;
1882 
1883 	rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1884 	if (rc)
1885 		goto out_free_ntlmsspblob;
1886 
1887 	rc = sess_sendreceive(sess_data);
1888 	if (rc)
1889 		goto out_free_ntlmsspblob;
1890 
1891 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1892 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1893 	if (smb_buf->WordCount != 4) {
1894 		rc = -EIO;
1895 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1896 		goto out_free_ntlmsspblob;
1897 	}
1898 
1899 	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1900 		cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1901 
1902 	if (ses->Suid != smb_buf->Uid) {
1903 		ses->Suid = smb_buf->Uid;
1904 		cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1905 	}
1906 
1907 	bytes_remaining = get_bcc(smb_buf);
1908 	bcc_ptr = pByteArea(smb_buf);
1909 	blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1910 	if (blob_len > bytes_remaining) {
1911 		cifs_dbg(VFS, "bad security blob length %d\n",
1912 				blob_len);
1913 		rc = -EINVAL;
1914 		goto out_free_ntlmsspblob;
1915 	}
1916 	bcc_ptr += blob_len;
1917 	bytes_remaining -= blob_len;
1918 
1919 
1920 	/* BB check if Unicode and decode strings */
1921 	if (bytes_remaining == 0) {
1922 		/* no string area to decode, do nothing */
1923 	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1924 		/* unicode string area must be word-aligned */
1925 		if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1926 			++bcc_ptr;
1927 			--bytes_remaining;
1928 		}
1929 		decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1930 				      sess_data->nls_cp);
1931 	} else {
1932 		decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1933 				    sess_data->nls_cp);
1934 	}
1935 
1936 out_free_ntlmsspblob:
1937 	kfree_sensitive(ntlmsspblob);
1938 out:
1939 	sess_free_buffer(sess_data);
1940 
1941 	if (!rc)
1942 		rc = sess_establish_session(sess_data);
1943 
1944 	/* Cleanup */
1945 	kfree_sensitive(ses->auth_key.response);
1946 	ses->auth_key.response = NULL;
1947 	kfree_sensitive(ses->ntlmssp);
1948 	ses->ntlmssp = NULL;
1949 
1950 	sess_data->func = NULL;
1951 	sess_data->result = rc;
1952 }
1953 
1954 static int select_sec(struct sess_data *sess_data)
1955 {
1956 	int type;
1957 	struct cifs_ses *ses = sess_data->ses;
1958 	struct TCP_Server_Info *server = sess_data->server;
1959 
1960 	type = cifs_select_sectype(server, ses->sectype);
1961 	cifs_dbg(FYI, "sess setup type %d\n", type);
1962 	if (type == Unspecified) {
1963 		cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1964 		return -EINVAL;
1965 	}
1966 
1967 	switch (type) {
1968 	case NTLMv2:
1969 		sess_data->func = sess_auth_ntlmv2;
1970 		break;
1971 	case Kerberos:
1972 #ifdef CONFIG_CIFS_UPCALL
1973 		sess_data->func = sess_auth_kerberos;
1974 		break;
1975 #else
1976 		cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1977 		return -ENOSYS;
1978 #endif /* CONFIG_CIFS_UPCALL */
1979 	case RawNTLMSSP:
1980 		sess_data->func = sess_auth_rawntlmssp_negotiate;
1981 		break;
1982 	default:
1983 		cifs_dbg(VFS, "secType %d not supported!\n", type);
1984 		return -ENOSYS;
1985 	}
1986 
1987 	return 0;
1988 }
1989 
1990 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
1991 		   struct TCP_Server_Info *server,
1992 		   const struct nls_table *nls_cp)
1993 {
1994 	int rc = 0;
1995 	struct sess_data *sess_data;
1996 
1997 	if (ses == NULL) {
1998 		WARN(1, "%s: ses == NULL!", __func__);
1999 		return -EINVAL;
2000 	}
2001 
2002 	sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
2003 	if (!sess_data)
2004 		return -ENOMEM;
2005 
2006 	sess_data->xid = xid;
2007 	sess_data->ses = ses;
2008 	sess_data->server = server;
2009 	sess_data->buf0_type = CIFS_NO_BUFFER;
2010 	sess_data->nls_cp = (struct nls_table *) nls_cp;
2011 
2012 	rc = select_sec(sess_data);
2013 	if (rc)
2014 		goto out;
2015 
2016 	while (sess_data->func)
2017 		sess_data->func(sess_data);
2018 
2019 	/* Store result before we free sess_data */
2020 	rc = sess_data->result;
2021 
2022 out:
2023 	kfree_sensitive(sess_data);
2024 	return rc;
2025 }
2026 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
2027