1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3 *
4 * SMB/CIFS session setup handling routines
5 *
6 * Copyright (c) International Business Machines Corp., 2006, 2009
7 * Author(s): Steve French (sfrench@us.ibm.com)
8 *
9 */
10
11 #include "cifspdu.h"
12 #include "cifsglob.h"
13 #include "cifsproto.h"
14 #include "cifs_unicode.h"
15 #include "cifs_debug.h"
16 #include "ntlmssp.h"
17 #include "nterr.h"
18 #include <linux/utsname.h>
19 #include <linux/slab.h>
20 #include <linux/version.h>
21 #include "cifsfs.h"
22 #include "cifs_spnego.h"
23 #include "smb2proto.h"
24 #include "fs_context.h"
25
26 static int
27 cifs_ses_add_channel(struct cifs_ses *ses,
28 struct cifs_server_iface *iface);
29
is_ses_using_iface(struct cifs_ses * ses,struct cifs_server_iface * iface)30 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
31 {
32 int i;
33
34 spin_lock(&ses->chan_lock);
35 for (i = 0; i < ses->chan_count; i++) {
36 if (ses->chans[i].iface == iface) {
37 spin_unlock(&ses->chan_lock);
38 return true;
39 }
40 }
41 spin_unlock(&ses->chan_lock);
42 return false;
43 }
44
45 /* channel helper functions. assumed that chan_lock is held by caller. */
46
47 int
cifs_ses_get_chan_index(struct cifs_ses * ses,struct TCP_Server_Info * server)48 cifs_ses_get_chan_index(struct cifs_ses *ses,
49 struct TCP_Server_Info *server)
50 {
51 unsigned int i;
52
53 /* if the channel is waiting for termination */
54 if (server && server->terminate)
55 return CIFS_INVAL_CHAN_INDEX;
56
57 for (i = 0; i < ses->chan_count; i++) {
58 if (ses->chans[i].server == server)
59 return i;
60 }
61
62 /* If we didn't find the channel, it is likely a bug */
63 if (server)
64 cifs_dbg(VFS, "unable to get chan index for server: 0x%llx",
65 server->conn_id);
66 return CIFS_INVAL_CHAN_INDEX;
67 }
68
69 void
cifs_chan_set_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)70 cifs_chan_set_in_reconnect(struct cifs_ses *ses,
71 struct TCP_Server_Info *server)
72 {
73 int chan_index = cifs_ses_get_chan_index(ses, server);
74
75 if (chan_index == CIFS_INVAL_CHAN_INDEX)
76 return;
77
78 ses->chans[chan_index].in_reconnect = true;
79 }
80
81 void
cifs_chan_clear_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)82 cifs_chan_clear_in_reconnect(struct cifs_ses *ses,
83 struct TCP_Server_Info *server)
84 {
85 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
86
87 if (chan_index == CIFS_INVAL_CHAN_INDEX)
88 return;
89
90 ses->chans[chan_index].in_reconnect = false;
91 }
92
93 void
cifs_chan_set_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)94 cifs_chan_set_need_reconnect(struct cifs_ses *ses,
95 struct TCP_Server_Info *server)
96 {
97 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
98
99 if (chan_index == CIFS_INVAL_CHAN_INDEX)
100 return;
101
102 set_bit(chan_index, &ses->chans_need_reconnect);
103 cifs_dbg(FYI, "Set reconnect bitmask for chan %u; now 0x%lx\n",
104 chan_index, ses->chans_need_reconnect);
105 }
106
107 void
cifs_chan_clear_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)108 cifs_chan_clear_need_reconnect(struct cifs_ses *ses,
109 struct TCP_Server_Info *server)
110 {
111 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
112
113 if (chan_index == CIFS_INVAL_CHAN_INDEX)
114 return;
115
116 clear_bit(chan_index, &ses->chans_need_reconnect);
117 cifs_dbg(FYI, "Cleared reconnect bitmask for chan %u; now 0x%lx\n",
118 chan_index, ses->chans_need_reconnect);
119 }
120
121 bool
cifs_chan_needs_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)122 cifs_chan_needs_reconnect(struct cifs_ses *ses,
123 struct TCP_Server_Info *server)
124 {
125 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
126
127 if (chan_index == CIFS_INVAL_CHAN_INDEX)
128 return true; /* err on the safer side */
129
130 return CIFS_CHAN_NEEDS_RECONNECT(ses, chan_index);
131 }
132
133 bool
cifs_chan_is_iface_active(struct cifs_ses * ses,struct TCP_Server_Info * server)134 cifs_chan_is_iface_active(struct cifs_ses *ses,
135 struct TCP_Server_Info *server)
136 {
137 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
138
139 if (chan_index == CIFS_INVAL_CHAN_INDEX)
140 return true; /* err on the safer side */
141
142 return ses->chans[chan_index].iface &&
143 ses->chans[chan_index].iface->is_active;
144 }
145
146 /* returns number of channels added */
cifs_try_adding_channels(struct cifs_ses * ses)147 int cifs_try_adding_channels(struct cifs_ses *ses)
148 {
149 struct TCP_Server_Info *server = ses->server;
150 int old_chan_count, new_chan_count;
151 int left;
152 int rc = 0;
153 int tries = 0;
154 size_t iface_weight = 0, iface_min_speed = 0;
155 struct cifs_server_iface *iface = NULL, *niface = NULL;
156 struct cifs_server_iface *last_iface = NULL;
157
158 spin_lock(&ses->chan_lock);
159
160 new_chan_count = old_chan_count = ses->chan_count;
161 left = ses->chan_max - ses->chan_count;
162
163 if (left <= 0) {
164 spin_unlock(&ses->chan_lock);
165 cifs_dbg(FYI,
166 "ses already at max_channels (%zu), nothing to open\n",
167 ses->chan_max);
168 return 0;
169 }
170
171 if (server->dialect < SMB30_PROT_ID) {
172 spin_unlock(&ses->chan_lock);
173 cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
174 return 0;
175 }
176
177 if (!(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
178 spin_unlock(&ses->chan_lock);
179 cifs_server_dbg(VFS, "no multichannel support\n");
180 return 0;
181 }
182 spin_unlock(&ses->chan_lock);
183
184 while (left > 0) {
185
186 tries++;
187 if (tries > 3*ses->chan_max) {
188 cifs_dbg(VFS, "too many channel open attempts (%d channels left to open)\n",
189 left);
190 break;
191 }
192
193 spin_lock(&ses->iface_lock);
194 if (!ses->iface_count) {
195 spin_unlock(&ses->iface_lock);
196 cifs_dbg(ONCE, "server %s does not advertise interfaces\n",
197 ses->server->hostname);
198 break;
199 }
200
201 if (!iface)
202 iface = list_first_entry(&ses->iface_list, struct cifs_server_iface,
203 iface_head);
204 last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
205 iface_head);
206 iface_min_speed = last_iface->speed;
207
208 list_for_each_entry_safe_from(iface, niface, &ses->iface_list,
209 iface_head) {
210 /* do not mix rdma and non-rdma interfaces */
211 if (iface->rdma_capable != ses->server->rdma)
212 continue;
213
214 /* skip ifaces that are unusable */
215 if (!iface->is_active ||
216 (is_ses_using_iface(ses, iface) &&
217 !iface->rss_capable))
218 continue;
219
220 /* check if we already allocated enough channels */
221 iface_weight = iface->speed / iface_min_speed;
222
223 if (iface->weight_fulfilled >= iface_weight)
224 continue;
225
226 /* take ref before unlock */
227 kref_get(&iface->refcount);
228
229 spin_unlock(&ses->iface_lock);
230 rc = cifs_ses_add_channel(ses, iface);
231 spin_lock(&ses->iface_lock);
232
233 if (rc) {
234 cifs_dbg(VFS, "failed to open extra channel on iface:%pIS rc=%d\n",
235 &iface->sockaddr,
236 rc);
237 kref_put(&iface->refcount, release_iface);
238 /* failure to add chan should increase weight */
239 iface->weight_fulfilled++;
240 continue;
241 }
242
243 iface->num_channels++;
244 iface->weight_fulfilled++;
245 cifs_info("successfully opened new channel on iface:%pIS\n",
246 &iface->sockaddr);
247 break;
248 }
249
250 /* reached end of list. reset weight_fulfilled and start over */
251 if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
252 list_for_each_entry(iface, &ses->iface_list, iface_head)
253 iface->weight_fulfilled = 0;
254 spin_unlock(&ses->iface_lock);
255 iface = NULL;
256 continue;
257 }
258 spin_unlock(&ses->iface_lock);
259
260 left--;
261 new_chan_count++;
262 }
263
264 return new_chan_count - old_chan_count;
265 }
266
267 /*
268 * called when multichannel is disabled by the server.
269 * this always gets called from smb2_reconnect
270 * and cannot get called in parallel threads.
271 */
272 void
cifs_disable_secondary_channels(struct cifs_ses * ses)273 cifs_disable_secondary_channels(struct cifs_ses *ses)
274 {
275 int i, chan_count;
276 struct TCP_Server_Info *server;
277 struct cifs_server_iface *iface;
278
279 spin_lock(&ses->chan_lock);
280 chan_count = ses->chan_count;
281 if (chan_count == 1)
282 goto done;
283
284 ses->chan_count = 1;
285
286 /* for all secondary channels reset the need reconnect bit */
287 ses->chans_need_reconnect &= 1;
288
289 for (i = 1; i < chan_count; i++) {
290 iface = ses->chans[i].iface;
291 server = ses->chans[i].server;
292
293 /*
294 * remove these references first, since we need to unlock
295 * the chan_lock here, since iface_lock is a higher lock
296 */
297 ses->chans[i].iface = NULL;
298 ses->chans[i].server = NULL;
299 spin_unlock(&ses->chan_lock);
300
301 if (iface) {
302 spin_lock(&ses->iface_lock);
303 iface->num_channels--;
304 if (iface->weight_fulfilled)
305 iface->weight_fulfilled--;
306 kref_put(&iface->refcount, release_iface);
307 spin_unlock(&ses->iface_lock);
308 }
309
310 if (server) {
311 if (!server->terminate) {
312 server->terminate = true;
313 cifs_signal_cifsd_for_reconnect(server, false);
314 }
315 cifs_put_tcp_session(server, false);
316 }
317
318 spin_lock(&ses->chan_lock);
319 }
320
321 done:
322 spin_unlock(&ses->chan_lock);
323 }
324
325 /* update the iface for the channel if necessary. */
326 void
cifs_chan_update_iface(struct cifs_ses * ses,struct TCP_Server_Info * server)327 cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server)
328 {
329 unsigned int chan_index;
330 size_t iface_weight = 0, iface_min_speed = 0;
331 struct cifs_server_iface *iface = NULL;
332 struct cifs_server_iface *old_iface = NULL;
333 struct cifs_server_iface *last_iface = NULL;
334 struct sockaddr_storage ss;
335
336 spin_lock(&ses->chan_lock);
337 chan_index = cifs_ses_get_chan_index(ses, server);
338 if (chan_index == CIFS_INVAL_CHAN_INDEX) {
339 spin_unlock(&ses->chan_lock);
340 return;
341 }
342
343 if (ses->chans[chan_index].iface) {
344 old_iface = ses->chans[chan_index].iface;
345 if (old_iface->is_active) {
346 spin_unlock(&ses->chan_lock);
347 return;
348 }
349 }
350 spin_unlock(&ses->chan_lock);
351
352 spin_lock(&server->srv_lock);
353 ss = server->dstaddr;
354 spin_unlock(&server->srv_lock);
355
356 spin_lock(&ses->iface_lock);
357 if (!ses->iface_count) {
358 spin_unlock(&ses->iface_lock);
359 cifs_dbg(ONCE, "server %s does not advertise interfaces\n", ses->server->hostname);
360 return;
361 }
362
363 last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
364 iface_head);
365 iface_min_speed = last_iface->speed;
366
367 /* then look for a new one */
368 list_for_each_entry(iface, &ses->iface_list, iface_head) {
369 if (!chan_index) {
370 /* if we're trying to get the updated iface for primary channel */
371 if (!cifs_match_ipaddr((struct sockaddr *) &ss,
372 (struct sockaddr *) &iface->sockaddr))
373 continue;
374
375 kref_get(&iface->refcount);
376 break;
377 }
378
379 /* do not mix rdma and non-rdma interfaces */
380 if (iface->rdma_capable != server->rdma)
381 continue;
382
383 if (!iface->is_active ||
384 (is_ses_using_iface(ses, iface) &&
385 !iface->rss_capable)) {
386 continue;
387 }
388
389 /* check if we already allocated enough channels */
390 iface_weight = iface->speed / iface_min_speed;
391
392 if (iface->weight_fulfilled >= iface_weight)
393 continue;
394
395 kref_get(&iface->refcount);
396 break;
397 }
398
399 if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
400 iface = NULL;
401 cifs_dbg(FYI, "unable to find a suitable iface\n");
402 }
403
404 if (!iface) {
405 if (!chan_index)
406 cifs_dbg(FYI, "unable to get the interface matching: %pIS\n",
407 &ss);
408 else {
409 cifs_dbg(FYI, "unable to find another interface to replace: %pIS\n",
410 &old_iface->sockaddr);
411 }
412
413 spin_unlock(&ses->iface_lock);
414 return;
415 }
416
417 /* now drop the ref to the current iface */
418 if (old_iface) {
419 cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n",
420 &old_iface->sockaddr,
421 &iface->sockaddr);
422
423 old_iface->num_channels--;
424 if (old_iface->weight_fulfilled)
425 old_iface->weight_fulfilled--;
426 iface->num_channels++;
427 iface->weight_fulfilled++;
428
429 kref_put(&old_iface->refcount, release_iface);
430 } else if (!chan_index) {
431 /* special case: update interface for primary channel */
432 cifs_dbg(FYI, "referencing primary channel iface: %pIS\n",
433 &iface->sockaddr);
434 iface->num_channels++;
435 iface->weight_fulfilled++;
436 }
437 spin_unlock(&ses->iface_lock);
438
439 spin_lock(&ses->chan_lock);
440 chan_index = cifs_ses_get_chan_index(ses, server);
441 if (chan_index == CIFS_INVAL_CHAN_INDEX) {
442 spin_unlock(&ses->chan_lock);
443 return;
444 }
445
446 ses->chans[chan_index].iface = iface;
447 spin_unlock(&ses->chan_lock);
448 }
449
450 static int
cifs_ses_add_channel(struct cifs_ses * ses,struct cifs_server_iface * iface)451 cifs_ses_add_channel(struct cifs_ses *ses,
452 struct cifs_server_iface *iface)
453 {
454 struct TCP_Server_Info *chan_server;
455 struct cifs_chan *chan;
456 struct smb3_fs_context *ctx;
457 static const char unc_fmt[] = "\\%s\\foo";
458 struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
459 struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
460 size_t len;
461 int rc;
462 unsigned int xid = get_xid();
463
464 if (iface->sockaddr.ss_family == AF_INET)
465 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
466 ses, iface->speed, str_yes_no(iface->rdma_capable),
467 &ipv4->sin_addr);
468 else
469 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI6)\n",
470 ses, iface->speed, str_yes_no(iface->rdma_capable),
471 &ipv6->sin6_addr);
472
473 /*
474 * Setup a ctx with mostly the same info as the existing
475 * session and overwrite it with the requested iface data.
476 *
477 * We need to setup at least the fields used for negprot and
478 * sesssetup.
479 *
480 * We only need the ctx here, so we can reuse memory from
481 * the session and server without caring about memory
482 * management.
483 */
484 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
485 if (!ctx) {
486 rc = -ENOMEM;
487 goto out_free_xid;
488 }
489
490 /* Always make new connection for now (TODO?) */
491 ctx->nosharesock = true;
492
493 /* Auth */
494 ctx->domainauto = ses->domainAuto;
495 ctx->domainname = ses->domainName;
496
497 /* no hostname for extra channels */
498 ctx->server_hostname = "";
499
500 ctx->username = ses->user_name;
501 ctx->password = ses->password;
502 ctx->sectype = ses->sectype;
503 ctx->sign = ses->sign;
504 ctx->unicode = ses->unicode;
505
506 /* UNC and paths */
507 /* XXX: Use ses->server->hostname? */
508 len = sizeof(unc_fmt) + SERVER_NAME_LEN_WITH_NULL;
509 ctx->UNC = kzalloc(len, GFP_KERNEL);
510 if (!ctx->UNC) {
511 rc = -ENOMEM;
512 goto out_free_ctx;
513 }
514 scnprintf(ctx->UNC, len, unc_fmt, ses->ip_addr);
515 ctx->prepath = "";
516
517 /* Reuse same version as master connection */
518 ctx->vals = ses->server->vals;
519 ctx->ops = ses->server->ops;
520
521 ctx->noblocksnd = ses->server->noblocksnd;
522 ctx->noautotune = ses->server->noautotune;
523 ctx->sockopt_tcp_nodelay = ses->server->tcp_nodelay;
524 ctx->echo_interval = ses->server->echo_interval / HZ;
525 ctx->max_credits = ses->server->max_credits;
526 ctx->min_offload = ses->server->min_offload;
527 ctx->compress = ses->server->compression.requested;
528 ctx->dfs_conn = ses->server->dfs_conn;
529 ctx->ignore_signature = ses->server->ignore_signature;
530 ctx->leaf_fullpath = ses->server->leaf_fullpath;
531 ctx->rootfs = ses->server->noblockcnt;
532 ctx->retrans = ses->server->retrans;
533
534 /*
535 * This will be used for encoding/decoding user/domain/pw
536 * during sess setup auth.
537 */
538 ctx->local_nls = ses->local_nls;
539
540 /* Use RDMA if possible */
541 ctx->rdma = iface->rdma_capable;
542 memcpy(&ctx->dstaddr, &iface->sockaddr, sizeof(ctx->dstaddr));
543
544 /* reuse master con client guid */
545 memcpy(&ctx->client_guid, ses->server->client_guid,
546 sizeof(ctx->client_guid));
547 ctx->use_client_guid = true;
548
549 chan_server = cifs_get_tcp_session(ctx, ses->server);
550
551 spin_lock(&ses->chan_lock);
552 chan = &ses->chans[ses->chan_count];
553 chan->server = chan_server;
554 if (IS_ERR(chan->server)) {
555 rc = PTR_ERR(chan->server);
556 chan->server = NULL;
557 spin_unlock(&ses->chan_lock);
558 goto out;
559 }
560 chan->iface = iface;
561 ses->chan_count++;
562 atomic_set(&ses->chan_seq, 0);
563
564 /* Mark this channel as needing connect/setup */
565 cifs_chan_set_need_reconnect(ses, chan->server);
566
567 spin_unlock(&ses->chan_lock);
568
569 mutex_lock(&ses->session_mutex);
570 /*
571 * We need to allocate the server crypto now as we will need
572 * to sign packets before we generate the channel signing key
573 * (we sign with the session key)
574 */
575 rc = smb311_crypto_shash_allocate(chan->server);
576 if (rc) {
577 cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
578 mutex_unlock(&ses->session_mutex);
579 goto out;
580 }
581
582 rc = cifs_negotiate_protocol(xid, ses, chan->server);
583 if (!rc)
584 rc = cifs_setup_session(xid, ses, chan->server, ses->local_nls);
585
586 mutex_unlock(&ses->session_mutex);
587
588 out:
589 if (rc && chan->server) {
590 cifs_put_tcp_session(chan->server, 0);
591
592 spin_lock(&ses->chan_lock);
593
594 /* we rely on all bits beyond chan_count to be clear */
595 cifs_chan_clear_need_reconnect(ses, chan->server);
596 ses->chan_count--;
597 /*
598 * chan_count should never reach 0 as at least the primary
599 * channel is always allocated
600 */
601 WARN_ON(ses->chan_count < 1);
602 spin_unlock(&ses->chan_lock);
603 }
604
605 kfree(ctx->UNC);
606 out_free_ctx:
607 kfree(ctx);
608 out_free_xid:
609 free_xid(xid);
610 return rc;
611 }
612
613 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
cifs_ssetup_hdr(struct cifs_ses * ses,struct TCP_Server_Info * server,SESSION_SETUP_ANDX * pSMB)614 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses,
615 struct TCP_Server_Info *server,
616 SESSION_SETUP_ANDX *pSMB)
617 {
618 __u32 capabilities = 0;
619
620 /* init fields common to all four types of SessSetup */
621 /* Note that offsets for first seven fields in req struct are same */
622 /* in CIFS Specs so does not matter which of 3 forms of struct */
623 /* that we use in next few lines */
624 /* Note that header is initialized to zero in header_assemble */
625 pSMB->req.AndXCommand = 0xFF;
626 pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
627 CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
628 USHRT_MAX));
629 pSMB->req.MaxMpxCount = cpu_to_le16(server->maxReq);
630 pSMB->req.VcNumber = cpu_to_le16(1);
631
632 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
633
634 /* BB verify whether signing required on neg or just auth frame (and NTLM case) */
635
636 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
637 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
638
639 if (server->sign)
640 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
641
642 if (ses->capabilities & CAP_UNICODE) {
643 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
644 capabilities |= CAP_UNICODE;
645 }
646 if (ses->capabilities & CAP_STATUS32) {
647 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
648 capabilities |= CAP_STATUS32;
649 }
650 if (ses->capabilities & CAP_DFS) {
651 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
652 capabilities |= CAP_DFS;
653 }
654 if (ses->capabilities & CAP_UNIX)
655 capabilities |= CAP_UNIX;
656
657 return capabilities;
658 }
659
660 static void
unicode_oslm_strings(char ** pbcc_area,const struct nls_table * nls_cp)661 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
662 {
663 char *bcc_ptr = *pbcc_area;
664 int bytes_ret = 0;
665
666 /* Copy OS version */
667 bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
668 nls_cp);
669 bcc_ptr += 2 * bytes_ret;
670 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
671 32, nls_cp);
672 bcc_ptr += 2 * bytes_ret;
673 bcc_ptr += 2; /* trailing null */
674
675 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
676 32, nls_cp);
677 bcc_ptr += 2 * bytes_ret;
678 bcc_ptr += 2; /* trailing null */
679
680 *pbcc_area = bcc_ptr;
681 }
682
683 static void
ascii_oslm_strings(char ** pbcc_area,const struct nls_table * nls_cp)684 ascii_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
685 {
686 char *bcc_ptr = *pbcc_area;
687
688 strcpy(bcc_ptr, "Linux version ");
689 bcc_ptr += strlen("Linux version ");
690 strcpy(bcc_ptr, init_utsname()->release);
691 bcc_ptr += strlen(init_utsname()->release) + 1;
692
693 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
694 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
695
696 *pbcc_area = bcc_ptr;
697 }
698
unicode_domain_string(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)699 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
700 const struct nls_table *nls_cp)
701 {
702 char *bcc_ptr = *pbcc_area;
703 int bytes_ret = 0;
704
705 /* copy domain */
706 if (ses->domainName == NULL) {
707 /*
708 * Sending null domain better than using a bogus domain name (as
709 * we did briefly in 2.6.18) since server will use its default
710 */
711 *bcc_ptr = 0;
712 *(bcc_ptr+1) = 0;
713 bytes_ret = 0;
714 } else
715 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
716 CIFS_MAX_DOMAINNAME_LEN, nls_cp);
717 bcc_ptr += 2 * bytes_ret;
718 bcc_ptr += 2; /* account for null terminator */
719
720 *pbcc_area = bcc_ptr;
721 }
722
ascii_domain_string(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)723 static void ascii_domain_string(char **pbcc_area, struct cifs_ses *ses,
724 const struct nls_table *nls_cp)
725 {
726 char *bcc_ptr = *pbcc_area;
727 int len;
728
729 /* copy domain */
730 if (ses->domainName != NULL) {
731 len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
732 if (WARN_ON_ONCE(len < 0))
733 len = CIFS_MAX_DOMAINNAME_LEN - 1;
734 bcc_ptr += len;
735 } /* else we send a null domain name so server will default to its own domain */
736 *bcc_ptr = 0;
737 bcc_ptr++;
738
739 *pbcc_area = bcc_ptr;
740 }
741
unicode_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)742 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
743 const struct nls_table *nls_cp)
744 {
745 char *bcc_ptr = *pbcc_area;
746 int bytes_ret = 0;
747
748 /* BB FIXME add check that strings less than 335 or will need to send as arrays */
749
750 /* copy user */
751 if (ses->user_name == NULL) {
752 /* null user mount */
753 *bcc_ptr = 0;
754 *(bcc_ptr+1) = 0;
755 } else {
756 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
757 CIFS_MAX_USERNAME_LEN, nls_cp);
758 }
759 bcc_ptr += 2 * bytes_ret;
760 bcc_ptr += 2; /* account for null termination */
761
762 unicode_domain_string(&bcc_ptr, ses, nls_cp);
763 unicode_oslm_strings(&bcc_ptr, nls_cp);
764
765 *pbcc_area = bcc_ptr;
766 }
767
ascii_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)768 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
769 const struct nls_table *nls_cp)
770 {
771 char *bcc_ptr = *pbcc_area;
772 int len;
773
774 /* copy user */
775 /* BB what about null user mounts - check that we do this BB */
776 /* copy user */
777 if (ses->user_name != NULL) {
778 len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
779 if (WARN_ON_ONCE(len < 0))
780 len = CIFS_MAX_USERNAME_LEN - 1;
781 bcc_ptr += len;
782 }
783 /* else null user mount */
784 *bcc_ptr = 0;
785 bcc_ptr++; /* account for null termination */
786
787 /* BB check for overflow here */
788
789 ascii_domain_string(&bcc_ptr, ses, nls_cp);
790 ascii_oslm_strings(&bcc_ptr, nls_cp);
791
792 *pbcc_area = bcc_ptr;
793 }
794
795 static void
decode_unicode_ssetup(char ** pbcc_area,int bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)796 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
797 const struct nls_table *nls_cp)
798 {
799 int len;
800 char *data = *pbcc_area;
801
802 cifs_dbg(FYI, "bleft %d\n", bleft);
803
804 kfree(ses->serverOS);
805 ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
806 cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
807 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
808 data += len;
809 bleft -= len;
810 if (bleft <= 0)
811 return;
812
813 kfree(ses->serverNOS);
814 ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
815 cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
816 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
817 data += len;
818 bleft -= len;
819 if (bleft <= 0)
820 return;
821
822 kfree(ses->serverDomain);
823 ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
824 cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
825
826 return;
827 }
828
decode_ascii_ssetup(char ** pbcc_area,__u16 bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)829 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
830 struct cifs_ses *ses,
831 const struct nls_table *nls_cp)
832 {
833 int len;
834 char *bcc_ptr = *pbcc_area;
835
836 cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
837
838 len = strnlen(bcc_ptr, bleft);
839 if (len >= bleft)
840 return;
841
842 kfree(ses->serverOS);
843
844 ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
845 if (ses->serverOS) {
846 memcpy(ses->serverOS, bcc_ptr, len);
847 ses->serverOS[len] = 0;
848 if (strncmp(ses->serverOS, "OS/2", 4) == 0)
849 cifs_dbg(FYI, "OS/2 server\n");
850 }
851
852 bcc_ptr += len + 1;
853 bleft -= len + 1;
854
855 len = strnlen(bcc_ptr, bleft);
856 if (len >= bleft)
857 return;
858
859 kfree(ses->serverNOS);
860
861 ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
862 if (ses->serverNOS) {
863 memcpy(ses->serverNOS, bcc_ptr, len);
864 ses->serverNOS[len] = 0;
865 }
866
867 bcc_ptr += len + 1;
868 bleft -= len + 1;
869
870 len = strnlen(bcc_ptr, bleft);
871 if (len > bleft)
872 return;
873
874 /*
875 * No domain field in LANMAN case. Domain is
876 * returned by old servers in the SMB negprot response
877 *
878 * BB For newer servers which do not support Unicode,
879 * but thus do return domain here, we could add parsing
880 * for it later, but it is not very important
881 */
882 cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
883 }
884 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
885
decode_ntlmssp_challenge(char * bcc_ptr,int blob_len,struct cifs_ses * ses)886 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
887 struct cifs_ses *ses)
888 {
889 unsigned int tioffset; /* challenge message target info area */
890 unsigned int tilen; /* challenge message target info area length */
891 CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
892 __u32 server_flags;
893
894 if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
895 cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
896 return -EINVAL;
897 }
898
899 if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
900 cifs_dbg(VFS, "blob signature incorrect %s\n",
901 pblob->Signature);
902 return -EINVAL;
903 }
904 if (pblob->MessageType != NtLmChallenge) {
905 cifs_dbg(VFS, "Incorrect message type %d\n",
906 pblob->MessageType);
907 return -EINVAL;
908 }
909
910 server_flags = le32_to_cpu(pblob->NegotiateFlags);
911 cifs_dbg(FYI, "%s: negotiate=0x%08x challenge=0x%08x\n", __func__,
912 ses->ntlmssp->client_flags, server_flags);
913
914 if ((ses->ntlmssp->client_flags & (NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN)) &&
915 (!(server_flags & NTLMSSP_NEGOTIATE_56) && !(server_flags & NTLMSSP_NEGOTIATE_128))) {
916 cifs_dbg(VFS, "%s: requested signing/encryption but server did not return either 56-bit or 128-bit session key size\n",
917 __func__);
918 return -EINVAL;
919 }
920 if (!(server_flags & NTLMSSP_NEGOTIATE_NTLM) && !(server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) {
921 cifs_dbg(VFS, "%s: server does not seem to support either NTLMv1 or NTLMv2\n", __func__);
922 return -EINVAL;
923 }
924 if (ses->server->sign && !(server_flags & NTLMSSP_NEGOTIATE_SIGN)) {
925 cifs_dbg(VFS, "%s: forced packet signing but server does not seem to support it\n",
926 __func__);
927 return -EOPNOTSUPP;
928 }
929 if ((ses->ntlmssp->client_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
930 !(server_flags & NTLMSSP_NEGOTIATE_KEY_XCH))
931 pr_warn_once("%s: authentication has been weakened as server does not support key exchange\n",
932 __func__);
933
934 ses->ntlmssp->server_flags = server_flags;
935
936 memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
937 /*
938 * In particular we can examine sign flags
939 *
940 * BB spec says that if AvId field of MsvAvTimestamp is populated then
941 * we must set the MIC field of the AUTHENTICATE_MESSAGE
942 */
943
944 tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
945 tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
946 if (tioffset > blob_len || tioffset + tilen > blob_len) {
947 cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
948 tioffset, tilen);
949 return -EINVAL;
950 }
951 if (tilen) {
952 kfree_sensitive(ses->auth_key.response);
953 ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
954 GFP_KERNEL);
955 if (!ses->auth_key.response) {
956 cifs_dbg(VFS, "Challenge target info alloc failure\n");
957 return -ENOMEM;
958 }
959 ses->auth_key.len = tilen;
960 }
961
962 return 0;
963 }
964
size_of_ntlmssp_blob(struct cifs_ses * ses,int base_size)965 static int size_of_ntlmssp_blob(struct cifs_ses *ses, int base_size)
966 {
967 int sz = base_size + ses->auth_key.len
968 - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
969
970 if (ses->domainName)
971 sz += sizeof(__le16) * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
972 else
973 sz += sizeof(__le16);
974
975 if (ses->user_name)
976 sz += sizeof(__le16) * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
977 else
978 sz += sizeof(__le16);
979
980 if (ses->workstation_name[0])
981 sz += sizeof(__le16) * strnlen(ses->workstation_name,
982 ntlmssp_workstation_name_size(ses));
983 else
984 sz += sizeof(__le16);
985
986 return sz;
987 }
988
cifs_security_buffer_from_str(SECURITY_BUFFER * pbuf,char * str_value,int str_length,unsigned char * pstart,unsigned char ** pcur,const struct nls_table * nls_cp)989 static inline void cifs_security_buffer_from_str(SECURITY_BUFFER *pbuf,
990 char *str_value,
991 int str_length,
992 unsigned char *pstart,
993 unsigned char **pcur,
994 const struct nls_table *nls_cp)
995 {
996 unsigned char *tmp = pstart;
997 int len;
998
999 if (!pbuf)
1000 return;
1001
1002 if (!pcur)
1003 pcur = &tmp;
1004
1005 if (!str_value) {
1006 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
1007 pbuf->Length = 0;
1008 pbuf->MaximumLength = 0;
1009 *pcur += sizeof(__le16);
1010 } else {
1011 len = cifs_strtoUTF16((__le16 *)*pcur,
1012 str_value,
1013 str_length,
1014 nls_cp);
1015 len *= sizeof(__le16);
1016 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
1017 pbuf->Length = cpu_to_le16(len);
1018 pbuf->MaximumLength = cpu_to_le16(len);
1019 *pcur += len;
1020 }
1021 }
1022
1023 /* BB Move to ntlmssp.c eventually */
1024
build_ntlmssp_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1025 int build_ntlmssp_negotiate_blob(unsigned char **pbuffer,
1026 u16 *buflen,
1027 struct cifs_ses *ses,
1028 struct TCP_Server_Info *server,
1029 const struct nls_table *nls_cp)
1030 {
1031 int rc = 0;
1032 NEGOTIATE_MESSAGE *sec_blob;
1033 __u32 flags;
1034 unsigned char *tmp;
1035 int len;
1036
1037 len = size_of_ntlmssp_blob(ses, sizeof(NEGOTIATE_MESSAGE));
1038 *pbuffer = kmalloc(len, GFP_KERNEL);
1039 if (!*pbuffer) {
1040 rc = -ENOMEM;
1041 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1042 *buflen = 0;
1043 goto setup_ntlm_neg_ret;
1044 }
1045 sec_blob = (NEGOTIATE_MESSAGE *)*pbuffer;
1046
1047 memset(*pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
1048 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1049 sec_blob->MessageType = NtLmNegotiate;
1050
1051 /* BB is NTLMV2 session security format easier to use here? */
1052 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
1053 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1054 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1055 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1056 NTLMSSP_NEGOTIATE_SIGN;
1057 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1058 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1059
1060 tmp = *pbuffer + sizeof(NEGOTIATE_MESSAGE);
1061 ses->ntlmssp->client_flags = flags;
1062 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1063
1064 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1065 cifs_security_buffer_from_str(&sec_blob->DomainName,
1066 NULL,
1067 CIFS_MAX_DOMAINNAME_LEN,
1068 *pbuffer, &tmp,
1069 nls_cp);
1070
1071 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1072 NULL,
1073 CIFS_MAX_WORKSTATION_LEN,
1074 *pbuffer, &tmp,
1075 nls_cp);
1076
1077 *buflen = tmp - *pbuffer;
1078 setup_ntlm_neg_ret:
1079 return rc;
1080 }
1081
1082 /*
1083 * Build ntlmssp blob with additional fields, such as version,
1084 * supported by modern servers. For safety limit to SMB3 or later
1085 * See notes in MS-NLMP Section 2.2.2.1 e.g.
1086 */
build_ntlmssp_smb3_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1087 int build_ntlmssp_smb3_negotiate_blob(unsigned char **pbuffer,
1088 u16 *buflen,
1089 struct cifs_ses *ses,
1090 struct TCP_Server_Info *server,
1091 const struct nls_table *nls_cp)
1092 {
1093 int rc = 0;
1094 struct negotiate_message *sec_blob;
1095 __u32 flags;
1096 unsigned char *tmp;
1097 int len;
1098
1099 len = size_of_ntlmssp_blob(ses, sizeof(struct negotiate_message));
1100 *pbuffer = kmalloc(len, GFP_KERNEL);
1101 if (!*pbuffer) {
1102 rc = -ENOMEM;
1103 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1104 *buflen = 0;
1105 goto setup_ntlm_smb3_neg_ret;
1106 }
1107 sec_blob = (struct negotiate_message *)*pbuffer;
1108
1109 memset(*pbuffer, 0, sizeof(struct negotiate_message));
1110 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1111 sec_blob->MessageType = NtLmNegotiate;
1112
1113 /* BB is NTLMV2 session security format easier to use here? */
1114 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
1115 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1116 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1117 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1118 NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_VERSION;
1119 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1120 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1121
1122 sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1123 sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1124 sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1125 sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1126
1127 tmp = *pbuffer + sizeof(struct negotiate_message);
1128 ses->ntlmssp->client_flags = flags;
1129 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1130
1131 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1132 cifs_security_buffer_from_str(&sec_blob->DomainName,
1133 NULL,
1134 CIFS_MAX_DOMAINNAME_LEN,
1135 *pbuffer, &tmp,
1136 nls_cp);
1137
1138 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1139 NULL,
1140 CIFS_MAX_WORKSTATION_LEN,
1141 *pbuffer, &tmp,
1142 nls_cp);
1143
1144 *buflen = tmp - *pbuffer;
1145 setup_ntlm_smb3_neg_ret:
1146 return rc;
1147 }
1148
1149
1150 /* See MS-NLMP 2.2.1.3 */
build_ntlmssp_auth_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1151 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
1152 u16 *buflen,
1153 struct cifs_ses *ses,
1154 struct TCP_Server_Info *server,
1155 const struct nls_table *nls_cp)
1156 {
1157 int rc;
1158 AUTHENTICATE_MESSAGE *sec_blob;
1159 __u32 flags;
1160 unsigned char *tmp;
1161 int len;
1162
1163 rc = setup_ntlmv2_rsp(ses, nls_cp);
1164 if (rc) {
1165 cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
1166 *buflen = 0;
1167 goto setup_ntlmv2_ret;
1168 }
1169
1170 len = size_of_ntlmssp_blob(ses, sizeof(AUTHENTICATE_MESSAGE));
1171 *pbuffer = kmalloc(len, GFP_KERNEL);
1172 if (!*pbuffer) {
1173 rc = -ENOMEM;
1174 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1175 *buflen = 0;
1176 goto setup_ntlmv2_ret;
1177 }
1178 sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
1179
1180 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1181 sec_blob->MessageType = NtLmAuthenticate;
1182
1183 /* send version information in ntlmssp authenticate also */
1184 flags = ses->ntlmssp->server_flags | NTLMSSP_REQUEST_TARGET |
1185 NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_VERSION |
1186 NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED;
1187
1188 sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1189 sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1190 sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1191 sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1192
1193 tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
1194 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1195
1196 sec_blob->LmChallengeResponse.BufferOffset =
1197 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
1198 sec_blob->LmChallengeResponse.Length = 0;
1199 sec_blob->LmChallengeResponse.MaximumLength = 0;
1200
1201 sec_blob->NtChallengeResponse.BufferOffset =
1202 cpu_to_le32(tmp - *pbuffer);
1203 if (ses->user_name != NULL) {
1204 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1205 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1206 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1207
1208 sec_blob->NtChallengeResponse.Length =
1209 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1210 sec_blob->NtChallengeResponse.MaximumLength =
1211 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1212 } else {
1213 /*
1214 * don't send an NT Response for anonymous access
1215 */
1216 sec_blob->NtChallengeResponse.Length = 0;
1217 sec_blob->NtChallengeResponse.MaximumLength = 0;
1218 }
1219
1220 cifs_security_buffer_from_str(&sec_blob->DomainName,
1221 ses->domainName,
1222 CIFS_MAX_DOMAINNAME_LEN,
1223 *pbuffer, &tmp,
1224 nls_cp);
1225
1226 cifs_security_buffer_from_str(&sec_blob->UserName,
1227 ses->user_name,
1228 CIFS_MAX_USERNAME_LEN,
1229 *pbuffer, &tmp,
1230 nls_cp);
1231
1232 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1233 ses->workstation_name,
1234 ntlmssp_workstation_name_size(ses),
1235 *pbuffer, &tmp,
1236 nls_cp);
1237
1238 if ((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
1239 (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) &&
1240 !calc_seckey(ses)) {
1241 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
1242 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1243 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
1244 sec_blob->SessionKey.MaximumLength =
1245 cpu_to_le16(CIFS_CPHTXT_SIZE);
1246 tmp += CIFS_CPHTXT_SIZE;
1247 } else {
1248 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1249 sec_blob->SessionKey.Length = 0;
1250 sec_blob->SessionKey.MaximumLength = 0;
1251 }
1252
1253 *buflen = tmp - *pbuffer;
1254 setup_ntlmv2_ret:
1255 return rc;
1256 }
1257
1258 enum securityEnum
cifs_select_sectype(struct TCP_Server_Info * server,enum securityEnum requested)1259 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
1260 {
1261 switch (server->negflavor) {
1262 case CIFS_NEGFLAVOR_EXTENDED:
1263 switch (requested) {
1264 case Kerberos:
1265 case RawNTLMSSP:
1266 case IAKerb:
1267 return requested;
1268 case Unspecified:
1269 if (server->sec_ntlmssp &&
1270 (global_secflags & CIFSSEC_MAY_NTLMSSP))
1271 return RawNTLMSSP;
1272 if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) &&
1273 (global_secflags & CIFSSEC_MAY_KRB5))
1274 return Kerberos;
1275 fallthrough;
1276 default:
1277 return Unspecified;
1278 }
1279 case CIFS_NEGFLAVOR_UNENCAP:
1280 switch (requested) {
1281 case NTLMv2:
1282 return requested;
1283 case Unspecified:
1284 if (global_secflags & CIFSSEC_MAY_NTLMV2)
1285 return NTLMv2;
1286 break;
1287 default:
1288 break;
1289 }
1290 fallthrough;
1291 default:
1292 return Unspecified;
1293 }
1294 }
1295
1296 struct sess_data {
1297 unsigned int xid;
1298 struct cifs_ses *ses;
1299 struct TCP_Server_Info *server;
1300 struct nls_table *nls_cp;
1301 void (*func)(struct sess_data *);
1302 int result;
1303
1304 /* we will send the SMB in three pieces:
1305 * a fixed length beginning part, an optional
1306 * SPNEGO blob (which can be zero length), and a
1307 * last part which will include the strings
1308 * and rest of bcc area. This allows us to avoid
1309 * a large buffer 17K allocation
1310 */
1311 int buf0_type;
1312 struct kvec iov[3];
1313 };
1314
1315 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
1316 static int
sess_alloc_buffer(struct sess_data * sess_data,int wct)1317 sess_alloc_buffer(struct sess_data *sess_data, int wct)
1318 {
1319 int rc;
1320 struct cifs_ses *ses = sess_data->ses;
1321 struct smb_hdr *smb_buf;
1322
1323 rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
1324 (void **)&smb_buf);
1325
1326 if (rc)
1327 return rc;
1328
1329 sess_data->iov[0].iov_base = (char *)smb_buf;
1330 sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
1331 /*
1332 * This variable will be used to clear the buffer
1333 * allocated above in case of any error in the calling function.
1334 */
1335 sess_data->buf0_type = CIFS_SMALL_BUFFER;
1336
1337 /* 2000 big enough to fit max user, domain, NOS name etc. */
1338 sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
1339 if (!sess_data->iov[2].iov_base) {
1340 rc = -ENOMEM;
1341 goto out_free_smb_buf;
1342 }
1343
1344 return 0;
1345
1346 out_free_smb_buf:
1347 cifs_small_buf_release(smb_buf);
1348 sess_data->iov[0].iov_base = NULL;
1349 sess_data->iov[0].iov_len = 0;
1350 sess_data->buf0_type = CIFS_NO_BUFFER;
1351 return rc;
1352 }
1353
1354 static void
sess_free_buffer(struct sess_data * sess_data)1355 sess_free_buffer(struct sess_data *sess_data)
1356 {
1357 struct kvec *iov = sess_data->iov;
1358
1359 /*
1360 * Zero the session data before freeing, as it might contain sensitive info (keys, etc).
1361 * Note that iov[1] is already freed by caller.
1362 */
1363 if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base)
1364 memzero_explicit(iov[0].iov_base, iov[0].iov_len);
1365
1366 free_rsp_buf(sess_data->buf0_type, iov[0].iov_base);
1367 sess_data->buf0_type = CIFS_NO_BUFFER;
1368 kfree_sensitive(iov[2].iov_base);
1369 }
1370
1371 static int
sess_establish_session(struct sess_data * sess_data)1372 sess_establish_session(struct sess_data *sess_data)
1373 {
1374 struct cifs_ses *ses = sess_data->ses;
1375 struct TCP_Server_Info *server = sess_data->server;
1376
1377 cifs_server_lock(server);
1378 if (!server->session_estab) {
1379 if (server->sign) {
1380 server->session_key.response =
1381 kmemdup(ses->auth_key.response,
1382 ses->auth_key.len, GFP_KERNEL);
1383 if (!server->session_key.response) {
1384 cifs_server_unlock(server);
1385 return -ENOMEM;
1386 }
1387 server->session_key.len =
1388 ses->auth_key.len;
1389 }
1390 server->sequence_number = 0x2;
1391 server->session_estab = true;
1392 }
1393 cifs_server_unlock(server);
1394
1395 cifs_dbg(FYI, "CIFS session established successfully\n");
1396 return 0;
1397 }
1398
1399 static int
sess_sendreceive(struct sess_data * sess_data)1400 sess_sendreceive(struct sess_data *sess_data)
1401 {
1402 int rc;
1403 struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
1404 __u16 count;
1405 struct kvec rsp_iov = { NULL, 0 };
1406
1407 count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
1408 be32_add_cpu(&smb_buf->smb_buf_length, count);
1409 put_bcc(count, smb_buf);
1410
1411 rc = SendReceive2(sess_data->xid, sess_data->ses,
1412 sess_data->iov, 3 /* num_iovecs */,
1413 &sess_data->buf0_type,
1414 CIFS_LOG_ERROR, &rsp_iov);
1415 cifs_small_buf_release(sess_data->iov[0].iov_base);
1416 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
1417
1418 return rc;
1419 }
1420
1421 static void
sess_auth_ntlmv2(struct sess_data * sess_data)1422 sess_auth_ntlmv2(struct sess_data *sess_data)
1423 {
1424 int rc = 0;
1425 struct smb_hdr *smb_buf;
1426 SESSION_SETUP_ANDX *pSMB;
1427 char *bcc_ptr;
1428 struct cifs_ses *ses = sess_data->ses;
1429 struct TCP_Server_Info *server = sess_data->server;
1430 __u32 capabilities;
1431 __u16 bytes_remaining;
1432
1433 /* old style NTLM sessionsetup */
1434 /* wct = 13 */
1435 rc = sess_alloc_buffer(sess_data, 13);
1436 if (rc)
1437 goto out;
1438
1439 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1440 bcc_ptr = sess_data->iov[2].iov_base;
1441 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1442
1443 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1444
1445 /* LM2 password would be here if we supported it */
1446 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1447
1448 if (ses->user_name != NULL) {
1449 /* calculate nlmv2 response and session key */
1450 rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
1451 if (rc) {
1452 cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
1453 goto out;
1454 }
1455
1456 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1457 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1458 bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1459
1460 /* set case sensitive password length after tilen may get
1461 * assigned, tilen is 0 otherwise.
1462 */
1463 pSMB->req_no_secext.CaseSensitivePasswordLength =
1464 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1465 } else {
1466 pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1467 }
1468
1469 if (ses->capabilities & CAP_UNICODE) {
1470 if (!IS_ALIGNED(sess_data->iov[0].iov_len, 2)) {
1471 *bcc_ptr = 0;
1472 bcc_ptr++;
1473 }
1474 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1475 } else {
1476 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1477 }
1478
1479
1480 sess_data->iov[2].iov_len = (long) bcc_ptr -
1481 (long) sess_data->iov[2].iov_base;
1482
1483 rc = sess_sendreceive(sess_data);
1484 if (rc)
1485 goto out;
1486
1487 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1488 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1489
1490 if (smb_buf->WordCount != 3) {
1491 rc = -EIO;
1492 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1493 goto out;
1494 }
1495
1496 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1497 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1498
1499 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1500 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1501
1502 bytes_remaining = get_bcc(smb_buf);
1503 bcc_ptr = pByteArea(smb_buf);
1504
1505 /* BB check if Unicode and decode strings */
1506 if (bytes_remaining == 0) {
1507 /* no string area to decode, do nothing */
1508 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1509 /* unicode string area must be word-aligned */
1510 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1511 ++bcc_ptr;
1512 --bytes_remaining;
1513 }
1514 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1515 sess_data->nls_cp);
1516 } else {
1517 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1518 sess_data->nls_cp);
1519 }
1520
1521 rc = sess_establish_session(sess_data);
1522 out:
1523 sess_data->result = rc;
1524 sess_data->func = NULL;
1525 sess_free_buffer(sess_data);
1526 kfree_sensitive(ses->auth_key.response);
1527 ses->auth_key.response = NULL;
1528 }
1529
1530 #ifdef CONFIG_CIFS_UPCALL
1531 static void
sess_auth_kerberos(struct sess_data * sess_data)1532 sess_auth_kerberos(struct sess_data *sess_data)
1533 {
1534 int rc = 0;
1535 struct smb_hdr *smb_buf;
1536 SESSION_SETUP_ANDX *pSMB;
1537 char *bcc_ptr;
1538 struct cifs_ses *ses = sess_data->ses;
1539 struct TCP_Server_Info *server = sess_data->server;
1540 __u32 capabilities;
1541 __u16 bytes_remaining;
1542 struct key *spnego_key = NULL;
1543 struct cifs_spnego_msg *msg;
1544 u16 blob_len;
1545
1546 /* extended security */
1547 /* wct = 12 */
1548 rc = sess_alloc_buffer(sess_data, 12);
1549 if (rc)
1550 goto out;
1551
1552 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1553 bcc_ptr = sess_data->iov[2].iov_base;
1554 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1555
1556 spnego_key = cifs_get_spnego_key(ses, server);
1557 if (IS_ERR(spnego_key)) {
1558 rc = PTR_ERR(spnego_key);
1559 spnego_key = NULL;
1560 goto out;
1561 }
1562
1563 msg = spnego_key->payload.data[0];
1564 /*
1565 * check version field to make sure that cifs.upcall is
1566 * sending us a response in an expected form
1567 */
1568 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1569 cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1570 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1571 rc = -EKEYREJECTED;
1572 goto out_put_spnego_key;
1573 }
1574
1575 kfree_sensitive(ses->auth_key.response);
1576 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1577 GFP_KERNEL);
1578 if (!ses->auth_key.response) {
1579 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1580 msg->sesskey_len);
1581 rc = -ENOMEM;
1582 goto out_put_spnego_key;
1583 }
1584 ses->auth_key.len = msg->sesskey_len;
1585
1586 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1587 capabilities |= CAP_EXTENDED_SECURITY;
1588 pSMB->req.Capabilities = cpu_to_le32(capabilities);
1589 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1590 sess_data->iov[1].iov_len = msg->secblob_len;
1591 pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1592
1593 if (pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) {
1594 /* unicode strings must be word aligned */
1595 if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1596 *bcc_ptr = 0;
1597 bcc_ptr++;
1598 }
1599 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1600 unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1601 } else {
1602 ascii_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1603 ascii_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1604 }
1605
1606 sess_data->iov[2].iov_len = (long) bcc_ptr -
1607 (long) sess_data->iov[2].iov_base;
1608
1609 rc = sess_sendreceive(sess_data);
1610 if (rc)
1611 goto out_put_spnego_key;
1612
1613 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1614 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1615
1616 if (smb_buf->WordCount != 4) {
1617 rc = -EIO;
1618 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1619 goto out_put_spnego_key;
1620 }
1621
1622 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1623 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1624
1625 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1626 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1627
1628 bytes_remaining = get_bcc(smb_buf);
1629 bcc_ptr = pByteArea(smb_buf);
1630
1631 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1632 if (blob_len > bytes_remaining) {
1633 cifs_dbg(VFS, "bad security blob length %d\n",
1634 blob_len);
1635 rc = -EINVAL;
1636 goto out_put_spnego_key;
1637 }
1638 bcc_ptr += blob_len;
1639 bytes_remaining -= blob_len;
1640
1641 /* BB check if Unicode and decode strings */
1642 if (bytes_remaining == 0) {
1643 /* no string area to decode, do nothing */
1644 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1645 /* unicode string area must be word-aligned */
1646 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1647 ++bcc_ptr;
1648 --bytes_remaining;
1649 }
1650 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1651 sess_data->nls_cp);
1652 } else {
1653 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1654 sess_data->nls_cp);
1655 }
1656
1657 rc = sess_establish_session(sess_data);
1658 out_put_spnego_key:
1659 key_invalidate(spnego_key);
1660 key_put(spnego_key);
1661 out:
1662 sess_data->result = rc;
1663 sess_data->func = NULL;
1664 sess_free_buffer(sess_data);
1665 kfree_sensitive(ses->auth_key.response);
1666 ses->auth_key.response = NULL;
1667 }
1668
1669 #endif /* ! CONFIG_CIFS_UPCALL */
1670
1671 /*
1672 * The required kvec buffers have to be allocated before calling this
1673 * function.
1674 */
1675 static int
_sess_auth_rawntlmssp_assemble_req(struct sess_data * sess_data)1676 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1677 {
1678 SESSION_SETUP_ANDX *pSMB;
1679 struct cifs_ses *ses = sess_data->ses;
1680 struct TCP_Server_Info *server = sess_data->server;
1681 __u32 capabilities;
1682 char *bcc_ptr;
1683
1684 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1685
1686 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1687 if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) {
1688 cifs_dbg(VFS, "NTLMSSP requires Unicode support\n");
1689 return -ENOSYS;
1690 }
1691
1692 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1693 capabilities |= CAP_EXTENDED_SECURITY;
1694 pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1695
1696 bcc_ptr = sess_data->iov[2].iov_base;
1697 /* unicode strings must be word aligned */
1698 if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1699 *bcc_ptr = 0;
1700 bcc_ptr++;
1701 }
1702 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1703
1704 sess_data->iov[2].iov_len = (long) bcc_ptr -
1705 (long) sess_data->iov[2].iov_base;
1706
1707 return 0;
1708 }
1709
1710 static void
1711 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1712
1713 static void
sess_auth_rawntlmssp_negotiate(struct sess_data * sess_data)1714 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1715 {
1716 int rc;
1717 struct smb_hdr *smb_buf;
1718 SESSION_SETUP_ANDX *pSMB;
1719 struct cifs_ses *ses = sess_data->ses;
1720 struct TCP_Server_Info *server = sess_data->server;
1721 __u16 bytes_remaining;
1722 char *bcc_ptr;
1723 unsigned char *ntlmsspblob = NULL;
1724 u16 blob_len;
1725
1726 cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1727
1728 /*
1729 * if memory allocation is successful, caller of this function
1730 * frees it.
1731 */
1732 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1733 if (!ses->ntlmssp) {
1734 rc = -ENOMEM;
1735 goto out;
1736 }
1737 ses->ntlmssp->sesskey_per_smbsess = false;
1738
1739 /* wct = 12 */
1740 rc = sess_alloc_buffer(sess_data, 12);
1741 if (rc)
1742 goto out;
1743
1744 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1745
1746 /* Build security blob before we assemble the request */
1747 rc = build_ntlmssp_negotiate_blob(&ntlmsspblob,
1748 &blob_len, ses, server,
1749 sess_data->nls_cp);
1750 if (rc)
1751 goto out_free_ntlmsspblob;
1752
1753 sess_data->iov[1].iov_len = blob_len;
1754 sess_data->iov[1].iov_base = ntlmsspblob;
1755 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1756
1757 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1758 if (rc)
1759 goto out_free_ntlmsspblob;
1760
1761 rc = sess_sendreceive(sess_data);
1762
1763 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1764 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1765
1766 /* If true, rc here is expected and not an error */
1767 if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1768 smb_buf->Status.CifsError ==
1769 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1770 rc = 0;
1771
1772 if (rc)
1773 goto out_free_ntlmsspblob;
1774
1775 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1776
1777 if (smb_buf->WordCount != 4) {
1778 rc = -EIO;
1779 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1780 goto out_free_ntlmsspblob;
1781 }
1782
1783 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1784 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1785
1786 bytes_remaining = get_bcc(smb_buf);
1787 bcc_ptr = pByteArea(smb_buf);
1788
1789 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1790 if (blob_len > bytes_remaining) {
1791 cifs_dbg(VFS, "bad security blob length %d\n",
1792 blob_len);
1793 rc = -EINVAL;
1794 goto out_free_ntlmsspblob;
1795 }
1796
1797 rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1798
1799 out_free_ntlmsspblob:
1800 kfree_sensitive(ntlmsspblob);
1801 out:
1802 sess_free_buffer(sess_data);
1803
1804 if (!rc) {
1805 sess_data->func = sess_auth_rawntlmssp_authenticate;
1806 return;
1807 }
1808
1809 /* Else error. Cleanup */
1810 kfree_sensitive(ses->auth_key.response);
1811 ses->auth_key.response = NULL;
1812 kfree_sensitive(ses->ntlmssp);
1813 ses->ntlmssp = NULL;
1814
1815 sess_data->func = NULL;
1816 sess_data->result = rc;
1817 }
1818
1819 static void
sess_auth_rawntlmssp_authenticate(struct sess_data * sess_data)1820 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1821 {
1822 int rc;
1823 struct smb_hdr *smb_buf;
1824 SESSION_SETUP_ANDX *pSMB;
1825 struct cifs_ses *ses = sess_data->ses;
1826 struct TCP_Server_Info *server = sess_data->server;
1827 __u16 bytes_remaining;
1828 char *bcc_ptr;
1829 unsigned char *ntlmsspblob = NULL;
1830 u16 blob_len;
1831
1832 cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1833
1834 /* wct = 12 */
1835 rc = sess_alloc_buffer(sess_data, 12);
1836 if (rc)
1837 goto out;
1838
1839 /* Build security blob before we assemble the request */
1840 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1841 smb_buf = (struct smb_hdr *)pSMB;
1842 rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1843 &blob_len, ses, server,
1844 sess_data->nls_cp);
1845 if (rc)
1846 goto out_free_ntlmsspblob;
1847 sess_data->iov[1].iov_len = blob_len;
1848 sess_data->iov[1].iov_base = ntlmsspblob;
1849 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1850 /*
1851 * Make sure that we tell the server that we are using
1852 * the uid that it just gave us back on the response
1853 * (challenge)
1854 */
1855 smb_buf->Uid = ses->Suid;
1856
1857 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1858 if (rc)
1859 goto out_free_ntlmsspblob;
1860
1861 rc = sess_sendreceive(sess_data);
1862 if (rc)
1863 goto out_free_ntlmsspblob;
1864
1865 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1866 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1867 if (smb_buf->WordCount != 4) {
1868 rc = -EIO;
1869 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1870 goto out_free_ntlmsspblob;
1871 }
1872
1873 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1874 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1875
1876 if (ses->Suid != smb_buf->Uid) {
1877 ses->Suid = smb_buf->Uid;
1878 cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1879 }
1880
1881 bytes_remaining = get_bcc(smb_buf);
1882 bcc_ptr = pByteArea(smb_buf);
1883 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1884 if (blob_len > bytes_remaining) {
1885 cifs_dbg(VFS, "bad security blob length %d\n",
1886 blob_len);
1887 rc = -EINVAL;
1888 goto out_free_ntlmsspblob;
1889 }
1890 bcc_ptr += blob_len;
1891 bytes_remaining -= blob_len;
1892
1893
1894 /* BB check if Unicode and decode strings */
1895 if (bytes_remaining == 0) {
1896 /* no string area to decode, do nothing */
1897 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1898 /* unicode string area must be word-aligned */
1899 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1900 ++bcc_ptr;
1901 --bytes_remaining;
1902 }
1903 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1904 sess_data->nls_cp);
1905 } else {
1906 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1907 sess_data->nls_cp);
1908 }
1909
1910 out_free_ntlmsspblob:
1911 kfree_sensitive(ntlmsspblob);
1912 out:
1913 sess_free_buffer(sess_data);
1914
1915 if (!rc)
1916 rc = sess_establish_session(sess_data);
1917
1918 /* Cleanup */
1919 kfree_sensitive(ses->auth_key.response);
1920 ses->auth_key.response = NULL;
1921 kfree_sensitive(ses->ntlmssp);
1922 ses->ntlmssp = NULL;
1923
1924 sess_data->func = NULL;
1925 sess_data->result = rc;
1926 }
1927
select_sec(struct sess_data * sess_data)1928 static int select_sec(struct sess_data *sess_data)
1929 {
1930 int type;
1931 struct cifs_ses *ses = sess_data->ses;
1932 struct TCP_Server_Info *server = sess_data->server;
1933
1934 type = cifs_select_sectype(server, ses->sectype);
1935 cifs_dbg(FYI, "sess setup type %d\n", type);
1936 if (type == Unspecified) {
1937 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1938 return -EINVAL;
1939 }
1940
1941 switch (type) {
1942 case NTLMv2:
1943 sess_data->func = sess_auth_ntlmv2;
1944 break;
1945 case Kerberos:
1946 #ifdef CONFIG_CIFS_UPCALL
1947 sess_data->func = sess_auth_kerberos;
1948 break;
1949 #else
1950 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1951 return -ENOSYS;
1952 #endif /* CONFIG_CIFS_UPCALL */
1953 case RawNTLMSSP:
1954 sess_data->func = sess_auth_rawntlmssp_negotiate;
1955 break;
1956 default:
1957 cifs_dbg(VFS, "secType %d not supported!\n", type);
1958 return -ENOSYS;
1959 }
1960
1961 return 0;
1962 }
1963
CIFS_SessSetup(const unsigned int xid,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1964 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
1965 struct TCP_Server_Info *server,
1966 const struct nls_table *nls_cp)
1967 {
1968 int rc = 0;
1969 struct sess_data *sess_data;
1970
1971 if (ses == NULL) {
1972 WARN(1, "%s: ses == NULL!", __func__);
1973 return -EINVAL;
1974 }
1975
1976 sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
1977 if (!sess_data)
1978 return -ENOMEM;
1979
1980 sess_data->xid = xid;
1981 sess_data->ses = ses;
1982 sess_data->server = server;
1983 sess_data->buf0_type = CIFS_NO_BUFFER;
1984 sess_data->nls_cp = (struct nls_table *) nls_cp;
1985
1986 rc = select_sec(sess_data);
1987 if (rc)
1988 goto out;
1989
1990 while (sess_data->func)
1991 sess_data->func(sess_data);
1992
1993 /* Store result before we free sess_data */
1994 rc = sess_data->result;
1995
1996 out:
1997 kfree_sensitive(sess_data);
1998 return rc;
1999 }
2000 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
2001