1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3  *
4  *   SMB/CIFS session setup handling routines
5  *
6  *   Copyright (c) International Business Machines  Corp., 2006, 2009
7  *   Author(s): Steve French (sfrench@us.ibm.com)
8  *
9  */
10 
11 #include "cifspdu.h"
12 #include "cifsglob.h"
13 #include "cifsproto.h"
14 #include "cifs_unicode.h"
15 #include "cifs_debug.h"
16 #include "ntlmssp.h"
17 #include "nterr.h"
18 #include <linux/utsname.h>
19 #include <linux/slab.h>
20 #include <linux/version.h>
21 #include "cifsfs.h"
22 #include "cifs_spnego.h"
23 #include "smb2proto.h"
24 #include "fs_context.h"
25 
26 static int
27 cifs_ses_add_channel(struct cifs_ses *ses,
28 		     struct cifs_server_iface *iface);
29 
30 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
31 {
32 	int i;
33 
34 	spin_lock(&ses->chan_lock);
35 	for (i = 0; i < ses->chan_count; i++) {
36 		if (ses->chans[i].iface == iface) {
37 			spin_unlock(&ses->chan_lock);
38 			return true;
39 		}
40 	}
41 	spin_unlock(&ses->chan_lock);
42 	return false;
43 }
44 
45 /* channel helper functions. assumed that chan_lock is held by caller. */
46 
47 int
48 cifs_ses_get_chan_index(struct cifs_ses *ses,
49 			struct TCP_Server_Info *server)
50 {
51 	unsigned int i;
52 
53 	/* if the channel is waiting for termination */
54 	if (server && server->terminate)
55 		return CIFS_INVAL_CHAN_INDEX;
56 
57 	for (i = 0; i < ses->chan_count; i++) {
58 		if (ses->chans[i].server == server)
59 			return i;
60 	}
61 
62 	/* If we didn't find the channel, it is likely a bug */
63 	if (server)
64 		cifs_dbg(VFS, "unable to get chan index for server: 0x%llx",
65 			 server->conn_id);
66 	return CIFS_INVAL_CHAN_INDEX;
67 }
68 
69 void
70 cifs_chan_set_in_reconnect(struct cifs_ses *ses,
71 			     struct TCP_Server_Info *server)
72 {
73 	int chan_index = cifs_ses_get_chan_index(ses, server);
74 
75 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
76 		return;
77 
78 	ses->chans[chan_index].in_reconnect = true;
79 }
80 
81 void
82 cifs_chan_clear_in_reconnect(struct cifs_ses *ses,
83 			     struct TCP_Server_Info *server)
84 {
85 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
86 
87 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
88 		return;
89 
90 	ses->chans[chan_index].in_reconnect = false;
91 }
92 
93 void
94 cifs_chan_set_need_reconnect(struct cifs_ses *ses,
95 			     struct TCP_Server_Info *server)
96 {
97 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
98 
99 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
100 		return;
101 
102 	set_bit(chan_index, &ses->chans_need_reconnect);
103 	cifs_dbg(FYI, "Set reconnect bitmask for chan %u; now 0x%lx\n",
104 		 chan_index, ses->chans_need_reconnect);
105 }
106 
107 void
108 cifs_chan_clear_need_reconnect(struct cifs_ses *ses,
109 			       struct TCP_Server_Info *server)
110 {
111 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
112 
113 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
114 		return;
115 
116 	clear_bit(chan_index, &ses->chans_need_reconnect);
117 	cifs_dbg(FYI, "Cleared reconnect bitmask for chan %u; now 0x%lx\n",
118 		 chan_index, ses->chans_need_reconnect);
119 }
120 
121 bool
122 cifs_chan_needs_reconnect(struct cifs_ses *ses,
123 			  struct TCP_Server_Info *server)
124 {
125 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
126 
127 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
128 		return true;	/* err on the safer side */
129 
130 	return CIFS_CHAN_NEEDS_RECONNECT(ses, chan_index);
131 }
132 
133 bool
134 cifs_chan_is_iface_active(struct cifs_ses *ses,
135 			  struct TCP_Server_Info *server)
136 {
137 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
138 
139 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
140 		return true;	/* err on the safer side */
141 
142 	return ses->chans[chan_index].iface &&
143 		ses->chans[chan_index].iface->is_active;
144 }
145 
146 /* returns number of channels added */
147 int cifs_try_adding_channels(struct cifs_ses *ses)
148 {
149 	struct TCP_Server_Info *server = ses->server;
150 	int old_chan_count, new_chan_count;
151 	int left;
152 	int rc = 0;
153 	int tries = 0;
154 	size_t iface_weight = 0, iface_min_speed = 0;
155 	struct cifs_server_iface *iface = NULL, *niface = NULL;
156 	struct cifs_server_iface *last_iface = NULL;
157 
158 	spin_lock(&ses->chan_lock);
159 
160 	new_chan_count = old_chan_count = ses->chan_count;
161 	left = ses->chan_max - ses->chan_count;
162 
163 	if (left <= 0) {
164 		spin_unlock(&ses->chan_lock);
165 		cifs_dbg(FYI,
166 			 "ses already at max_channels (%zu), nothing to open\n",
167 			 ses->chan_max);
168 		return 0;
169 	}
170 
171 	if (server->dialect < SMB30_PROT_ID) {
172 		spin_unlock(&ses->chan_lock);
173 		cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
174 		return 0;
175 	}
176 
177 	if (!(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
178 		spin_unlock(&ses->chan_lock);
179 		cifs_server_dbg(VFS, "no multichannel support\n");
180 		return 0;
181 	}
182 	spin_unlock(&ses->chan_lock);
183 
184 	while (left > 0) {
185 
186 		tries++;
187 		if (tries > 3*ses->chan_max) {
188 			cifs_dbg(VFS, "too many channel open attempts (%d channels left to open)\n",
189 				 left);
190 			break;
191 		}
192 
193 		spin_lock(&ses->iface_lock);
194 		if (!ses->iface_count) {
195 			spin_unlock(&ses->iface_lock);
196 			cifs_dbg(ONCE, "server %s does not advertise interfaces\n",
197 				      ses->server->hostname);
198 			break;
199 		}
200 
201 		if (!iface)
202 			iface = list_first_entry(&ses->iface_list, struct cifs_server_iface,
203 						 iface_head);
204 		last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
205 					     iface_head);
206 		iface_min_speed = last_iface->speed;
207 
208 		list_for_each_entry_safe_from(iface, niface, &ses->iface_list,
209 				    iface_head) {
210 			/* do not mix rdma and non-rdma interfaces */
211 			if (iface->rdma_capable != ses->server->rdma)
212 				continue;
213 
214 			/* skip ifaces that are unusable */
215 			if (!iface->is_active ||
216 			    (is_ses_using_iface(ses, iface) &&
217 			     !iface->rss_capable))
218 				continue;
219 
220 			/* check if we already allocated enough channels */
221 			iface_weight = iface->speed / iface_min_speed;
222 
223 			if (iface->weight_fulfilled >= iface_weight)
224 				continue;
225 
226 			/* take ref before unlock */
227 			kref_get(&iface->refcount);
228 
229 			spin_unlock(&ses->iface_lock);
230 			rc = cifs_ses_add_channel(ses, iface);
231 			spin_lock(&ses->iface_lock);
232 
233 			if (rc) {
234 				cifs_dbg(VFS, "failed to open extra channel on iface:%pIS rc=%d\n",
235 					 &iface->sockaddr,
236 					 rc);
237 				kref_put(&iface->refcount, release_iface);
238 				/* failure to add chan should increase weight */
239 				iface->weight_fulfilled++;
240 				continue;
241 			}
242 
243 			iface->num_channels++;
244 			iface->weight_fulfilled++;
245 			cifs_info("successfully opened new channel on iface:%pIS\n",
246 				 &iface->sockaddr);
247 			break;
248 		}
249 
250 		/* reached end of list. reset weight_fulfilled and start over */
251 		if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
252 			list_for_each_entry(iface, &ses->iface_list, iface_head)
253 				iface->weight_fulfilled = 0;
254 			spin_unlock(&ses->iface_lock);
255 			iface = NULL;
256 			continue;
257 		}
258 		spin_unlock(&ses->iface_lock);
259 
260 		left--;
261 		new_chan_count++;
262 	}
263 
264 	return new_chan_count - old_chan_count;
265 }
266 
267 /*
268  * called when multichannel is disabled by the server.
269  * this always gets called from smb2_reconnect
270  * and cannot get called in parallel threads.
271  */
272 void
273 cifs_disable_secondary_channels(struct cifs_ses *ses)
274 {
275 	int i, chan_count;
276 	struct TCP_Server_Info *server;
277 	struct cifs_server_iface *iface;
278 
279 	spin_lock(&ses->chan_lock);
280 	chan_count = ses->chan_count;
281 	if (chan_count == 1)
282 		goto done;
283 
284 	ses->chan_count = 1;
285 
286 	/* for all secondary channels reset the need reconnect bit */
287 	ses->chans_need_reconnect &= 1;
288 
289 	for (i = 1; i < chan_count; i++) {
290 		iface = ses->chans[i].iface;
291 		server = ses->chans[i].server;
292 
293 		/*
294 		 * remove these references first, since we need to unlock
295 		 * the chan_lock here, since iface_lock is a higher lock
296 		 */
297 		ses->chans[i].iface = NULL;
298 		ses->chans[i].server = NULL;
299 		spin_unlock(&ses->chan_lock);
300 
301 		if (iface) {
302 			spin_lock(&ses->iface_lock);
303 			iface->num_channels--;
304 			if (iface->weight_fulfilled)
305 				iface->weight_fulfilled--;
306 			kref_put(&iface->refcount, release_iface);
307 			spin_unlock(&ses->iface_lock);
308 		}
309 
310 		if (server) {
311 			if (!server->terminate) {
312 				server->terminate = true;
313 				cifs_signal_cifsd_for_reconnect(server, false);
314 			}
315 			cifs_put_tcp_session(server, false);
316 		}
317 
318 		spin_lock(&ses->chan_lock);
319 	}
320 
321 done:
322 	spin_unlock(&ses->chan_lock);
323 }
324 
325 /* update the iface for the channel if necessary. */
326 void
327 cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server)
328 {
329 	unsigned int chan_index;
330 	size_t iface_weight = 0, iface_min_speed = 0;
331 	struct cifs_server_iface *iface = NULL;
332 	struct cifs_server_iface *old_iface = NULL;
333 	struct cifs_server_iface *last_iface = NULL;
334 	struct sockaddr_storage ss;
335 
336 	spin_lock(&ses->chan_lock);
337 	chan_index = cifs_ses_get_chan_index(ses, server);
338 	if (chan_index == CIFS_INVAL_CHAN_INDEX) {
339 		spin_unlock(&ses->chan_lock);
340 		return;
341 	}
342 
343 	if (ses->chans[chan_index].iface) {
344 		old_iface = ses->chans[chan_index].iface;
345 		if (old_iface->is_active) {
346 			spin_unlock(&ses->chan_lock);
347 			return;
348 		}
349 	}
350 	spin_unlock(&ses->chan_lock);
351 
352 	spin_lock(&server->srv_lock);
353 	ss = server->dstaddr;
354 	spin_unlock(&server->srv_lock);
355 
356 	spin_lock(&ses->iface_lock);
357 	if (!ses->iface_count) {
358 		spin_unlock(&ses->iface_lock);
359 		cifs_dbg(ONCE, "server %s does not advertise interfaces\n", ses->server->hostname);
360 		return;
361 	}
362 
363 	last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
364 				     iface_head);
365 	iface_min_speed = last_iface->speed;
366 
367 	/* then look for a new one */
368 	list_for_each_entry(iface, &ses->iface_list, iface_head) {
369 		if (!chan_index) {
370 			/* if we're trying to get the updated iface for primary channel */
371 			if (!cifs_match_ipaddr((struct sockaddr *) &ss,
372 					       (struct sockaddr *) &iface->sockaddr))
373 				continue;
374 
375 			kref_get(&iface->refcount);
376 			break;
377 		}
378 
379 		/* do not mix rdma and non-rdma interfaces */
380 		if (iface->rdma_capable != server->rdma)
381 			continue;
382 
383 		if (!iface->is_active ||
384 		    (is_ses_using_iface(ses, iface) &&
385 		     !iface->rss_capable)) {
386 			continue;
387 		}
388 
389 		/* check if we already allocated enough channels */
390 		iface_weight = iface->speed / iface_min_speed;
391 
392 		if (iface->weight_fulfilled >= iface_weight)
393 			continue;
394 
395 		kref_get(&iface->refcount);
396 		break;
397 	}
398 
399 	if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
400 		iface = NULL;
401 		cifs_dbg(FYI, "unable to find a suitable iface\n");
402 	}
403 
404 	if (!iface) {
405 		if (!chan_index)
406 			cifs_dbg(FYI, "unable to get the interface matching: %pIS\n",
407 				 &ss);
408 		else {
409 			cifs_dbg(FYI, "unable to find another interface to replace: %pIS\n",
410 				 &old_iface->sockaddr);
411 		}
412 
413 		spin_unlock(&ses->iface_lock);
414 		return;
415 	}
416 
417 	/* now drop the ref to the current iface */
418 	if (old_iface) {
419 		cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n",
420 			 &old_iface->sockaddr,
421 			 &iface->sockaddr);
422 
423 		old_iface->num_channels--;
424 		if (old_iface->weight_fulfilled)
425 			old_iface->weight_fulfilled--;
426 		iface->num_channels++;
427 		iface->weight_fulfilled++;
428 
429 		kref_put(&old_iface->refcount, release_iface);
430 	} else if (!chan_index) {
431 		/* special case: update interface for primary channel */
432 		cifs_dbg(FYI, "referencing primary channel iface: %pIS\n",
433 			 &iface->sockaddr);
434 		iface->num_channels++;
435 		iface->weight_fulfilled++;
436 	}
437 	spin_unlock(&ses->iface_lock);
438 
439 	spin_lock(&ses->chan_lock);
440 	chan_index = cifs_ses_get_chan_index(ses, server);
441 	if (chan_index == CIFS_INVAL_CHAN_INDEX) {
442 		spin_unlock(&ses->chan_lock);
443 		return;
444 	}
445 
446 	ses->chans[chan_index].iface = iface;
447 	spin_unlock(&ses->chan_lock);
448 
449 	spin_lock(&server->srv_lock);
450 	memcpy(&server->dstaddr, &iface->sockaddr, sizeof(server->dstaddr));
451 	spin_unlock(&server->srv_lock);
452 }
453 
454 static int
455 cifs_ses_add_channel(struct cifs_ses *ses,
456 		     struct cifs_server_iface *iface)
457 {
458 	struct TCP_Server_Info *chan_server;
459 	struct cifs_chan *chan;
460 	struct smb3_fs_context *ctx;
461 	static const char unc_fmt[] = "\\%s\\foo";
462 	struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
463 	struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
464 	size_t len;
465 	int rc;
466 	unsigned int xid = get_xid();
467 
468 	if (iface->sockaddr.ss_family == AF_INET)
469 		cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
470 			 ses, iface->speed, str_yes_no(iface->rdma_capable),
471 			 &ipv4->sin_addr);
472 	else
473 		cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI6)\n",
474 			 ses, iface->speed, str_yes_no(iface->rdma_capable),
475 			 &ipv6->sin6_addr);
476 
477 	/*
478 	 * Setup a ctx with mostly the same info as the existing
479 	 * session and overwrite it with the requested iface data.
480 	 *
481 	 * We need to setup at least the fields used for negprot and
482 	 * sesssetup.
483 	 *
484 	 * We only need the ctx here, so we can reuse memory from
485 	 * the session and server without caring about memory
486 	 * management.
487 	 */
488 	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
489 	if (!ctx) {
490 		rc = -ENOMEM;
491 		goto out_free_xid;
492 	}
493 
494 	/* Always make new connection for now (TODO?) */
495 	ctx->nosharesock = true;
496 
497 	/* Auth */
498 	ctx->domainauto = ses->domainAuto;
499 	ctx->domainname = ses->domainName;
500 
501 	/* no hostname for extra channels */
502 	ctx->server_hostname = "";
503 
504 	ctx->username = ses->user_name;
505 	ctx->password = ses->password;
506 	ctx->sectype = ses->sectype;
507 	ctx->sign = ses->sign;
508 	ctx->unicode = ses->unicode;
509 
510 	/* UNC and paths */
511 	/* XXX: Use ses->server->hostname? */
512 	len = sizeof(unc_fmt) + SERVER_NAME_LEN_WITH_NULL;
513 	ctx->UNC = kzalloc(len, GFP_KERNEL);
514 	if (!ctx->UNC) {
515 		rc = -ENOMEM;
516 		goto out_free_ctx;
517 	}
518 	scnprintf(ctx->UNC, len, unc_fmt, ses->ip_addr);
519 	ctx->prepath = "";
520 
521 	/* Reuse same version as master connection */
522 	ctx->vals = ses->server->vals;
523 	ctx->ops = ses->server->ops;
524 
525 	ctx->noblocksnd = ses->server->noblocksnd;
526 	ctx->noautotune = ses->server->noautotune;
527 	ctx->sockopt_tcp_nodelay = ses->server->tcp_nodelay;
528 	ctx->echo_interval = ses->server->echo_interval / HZ;
529 	ctx->max_credits = ses->server->max_credits;
530 	ctx->min_offload = ses->server->min_offload;
531 	ctx->compress = ses->server->compression.requested;
532 	ctx->dfs_conn = ses->server->dfs_conn;
533 	ctx->ignore_signature = ses->server->ignore_signature;
534 	ctx->leaf_fullpath = ses->server->leaf_fullpath;
535 	ctx->rootfs = ses->server->noblockcnt;
536 	ctx->retrans = ses->server->retrans;
537 
538 	/*
539 	 * This will be used for encoding/decoding user/domain/pw
540 	 * during sess setup auth.
541 	 */
542 	ctx->local_nls = ses->local_nls;
543 
544 	/* Use RDMA if possible */
545 	ctx->rdma = iface->rdma_capable;
546 	memcpy(&ctx->dstaddr, &iface->sockaddr, sizeof(ctx->dstaddr));
547 
548 	/* reuse master con client guid */
549 	memcpy(&ctx->client_guid, ses->server->client_guid,
550 	       sizeof(ctx->client_guid));
551 	ctx->use_client_guid = true;
552 
553 	chan_server = cifs_get_tcp_session(ctx, ses->server);
554 
555 	spin_lock(&ses->chan_lock);
556 	chan = &ses->chans[ses->chan_count];
557 	chan->server = chan_server;
558 	if (IS_ERR(chan->server)) {
559 		rc = PTR_ERR(chan->server);
560 		chan->server = NULL;
561 		spin_unlock(&ses->chan_lock);
562 		goto out;
563 	}
564 	chan->iface = iface;
565 	ses->chan_count++;
566 	atomic_set(&ses->chan_seq, 0);
567 
568 	/* Mark this channel as needing connect/setup */
569 	cifs_chan_set_need_reconnect(ses, chan->server);
570 
571 	spin_unlock(&ses->chan_lock);
572 
573 	mutex_lock(&ses->session_mutex);
574 	/*
575 	 * We need to allocate the server crypto now as we will need
576 	 * to sign packets before we generate the channel signing key
577 	 * (we sign with the session key)
578 	 */
579 	rc = smb311_crypto_shash_allocate(chan->server);
580 	if (rc) {
581 		cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
582 		mutex_unlock(&ses->session_mutex);
583 		goto out;
584 	}
585 
586 	rc = cifs_negotiate_protocol(xid, ses, chan->server);
587 	if (!rc)
588 		rc = cifs_setup_session(xid, ses, chan->server, ses->local_nls);
589 
590 	mutex_unlock(&ses->session_mutex);
591 
592 out:
593 	if (rc && chan->server) {
594 		cifs_put_tcp_session(chan->server, 0);
595 
596 		spin_lock(&ses->chan_lock);
597 
598 		/* we rely on all bits beyond chan_count to be clear */
599 		cifs_chan_clear_need_reconnect(ses, chan->server);
600 		ses->chan_count--;
601 		/*
602 		 * chan_count should never reach 0 as at least the primary
603 		 * channel is always allocated
604 		 */
605 		WARN_ON(ses->chan_count < 1);
606 		spin_unlock(&ses->chan_lock);
607 	}
608 
609 	kfree(ctx->UNC);
610 out_free_ctx:
611 	kfree(ctx);
612 out_free_xid:
613 	free_xid(xid);
614 	return rc;
615 }
616 
617 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
618 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses,
619 			     struct TCP_Server_Info *server,
620 			     SESSION_SETUP_ANDX *pSMB)
621 {
622 	__u32 capabilities = 0;
623 
624 	/* init fields common to all four types of SessSetup */
625 	/* Note that offsets for first seven fields in req struct are same  */
626 	/*	in CIFS Specs so does not matter which of 3 forms of struct */
627 	/*	that we use in next few lines                               */
628 	/* Note that header is initialized to zero in header_assemble */
629 	pSMB->req.AndXCommand = 0xFF;
630 	pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
631 					CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
632 					USHRT_MAX));
633 	pSMB->req.MaxMpxCount = cpu_to_le16(server->maxReq);
634 	pSMB->req.VcNumber = cpu_to_le16(1);
635 	pSMB->req.SessionKey = server->session_key_id;
636 
637 	/* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
638 
639 	/* BB verify whether signing required on neg or just auth frame (and NTLM case) */
640 
641 	capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
642 			CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
643 
644 	if (server->sign)
645 		pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
646 
647 	if (ses->capabilities & CAP_UNICODE) {
648 		pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
649 		capabilities |= CAP_UNICODE;
650 	}
651 	if (ses->capabilities & CAP_STATUS32) {
652 		pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
653 		capabilities |= CAP_STATUS32;
654 	}
655 	if (ses->capabilities & CAP_DFS) {
656 		pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
657 		capabilities |= CAP_DFS;
658 	}
659 	if (ses->capabilities & CAP_UNIX)
660 		capabilities |= CAP_UNIX;
661 
662 	return capabilities;
663 }
664 
665 static void
666 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
667 {
668 	char *bcc_ptr = *pbcc_area;
669 	int bytes_ret = 0;
670 
671 	/* Copy OS version */
672 	bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
673 				    nls_cp);
674 	bcc_ptr += 2 * bytes_ret;
675 	bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
676 				    32, nls_cp);
677 	bcc_ptr += 2 * bytes_ret;
678 	bcc_ptr += 2; /* trailing null */
679 
680 	bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
681 				    32, nls_cp);
682 	bcc_ptr += 2 * bytes_ret;
683 	bcc_ptr += 2; /* trailing null */
684 
685 	*pbcc_area = bcc_ptr;
686 }
687 
688 static void
689 ascii_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
690 {
691 	char *bcc_ptr = *pbcc_area;
692 
693 	strcpy(bcc_ptr, "Linux version ");
694 	bcc_ptr += strlen("Linux version ");
695 	strcpy(bcc_ptr, init_utsname()->release);
696 	bcc_ptr += strlen(init_utsname()->release) + 1;
697 
698 	strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
699 	bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
700 
701 	*pbcc_area = bcc_ptr;
702 }
703 
704 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
705 				   const struct nls_table *nls_cp)
706 {
707 	char *bcc_ptr = *pbcc_area;
708 	int bytes_ret = 0;
709 
710 	/* copy domain */
711 	if (ses->domainName == NULL) {
712 		/*
713 		 * Sending null domain better than using a bogus domain name (as
714 		 * we did briefly in 2.6.18) since server will use its default
715 		 */
716 		*bcc_ptr = 0;
717 		*(bcc_ptr+1) = 0;
718 		bytes_ret = 0;
719 	} else
720 		bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
721 					    CIFS_MAX_DOMAINNAME_LEN, nls_cp);
722 	bcc_ptr += 2 * bytes_ret;
723 	bcc_ptr += 2;  /* account for null terminator */
724 
725 	*pbcc_area = bcc_ptr;
726 }
727 
728 static void ascii_domain_string(char **pbcc_area, struct cifs_ses *ses,
729 				const struct nls_table *nls_cp)
730 {
731 	char *bcc_ptr = *pbcc_area;
732 	int len;
733 
734 	/* copy domain */
735 	if (ses->domainName != NULL) {
736 		len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
737 		if (WARN_ON_ONCE(len < 0))
738 			len = CIFS_MAX_DOMAINNAME_LEN - 1;
739 		bcc_ptr += len;
740 	} /* else we send a null domain name so server will default to its own domain */
741 	*bcc_ptr = 0;
742 	bcc_ptr++;
743 
744 	*pbcc_area = bcc_ptr;
745 }
746 
747 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
748 				   const struct nls_table *nls_cp)
749 {
750 	char *bcc_ptr = *pbcc_area;
751 	int bytes_ret = 0;
752 
753 	/* BB FIXME add check that strings less than 335 or will need to send as arrays */
754 
755 	/* copy user */
756 	if (ses->user_name == NULL) {
757 		/* null user mount */
758 		*bcc_ptr = 0;
759 		*(bcc_ptr+1) = 0;
760 	} else {
761 		bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
762 					    CIFS_MAX_USERNAME_LEN, nls_cp);
763 	}
764 	bcc_ptr += 2 * bytes_ret;
765 	bcc_ptr += 2; /* account for null termination */
766 
767 	unicode_domain_string(&bcc_ptr, ses, nls_cp);
768 	unicode_oslm_strings(&bcc_ptr, nls_cp);
769 
770 	*pbcc_area = bcc_ptr;
771 }
772 
773 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
774 				 const struct nls_table *nls_cp)
775 {
776 	char *bcc_ptr = *pbcc_area;
777 	int len;
778 
779 	/* copy user */
780 	/* BB what about null user mounts - check that we do this BB */
781 	/* copy user */
782 	if (ses->user_name != NULL) {
783 		len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
784 		if (WARN_ON_ONCE(len < 0))
785 			len = CIFS_MAX_USERNAME_LEN - 1;
786 		bcc_ptr += len;
787 	}
788 	/* else null user mount */
789 	*bcc_ptr = 0;
790 	bcc_ptr++; /* account for null termination */
791 
792 	/* BB check for overflow here */
793 
794 	ascii_domain_string(&bcc_ptr, ses, nls_cp);
795 	ascii_oslm_strings(&bcc_ptr, nls_cp);
796 
797 	*pbcc_area = bcc_ptr;
798 }
799 
800 static void
801 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
802 		      const struct nls_table *nls_cp)
803 {
804 	int len;
805 	char *data = *pbcc_area;
806 
807 	cifs_dbg(FYI, "bleft %d\n", bleft);
808 
809 	kfree(ses->serverOS);
810 	ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
811 	cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
812 	len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
813 	data += len;
814 	bleft -= len;
815 	if (bleft <= 0)
816 		return;
817 
818 	kfree(ses->serverNOS);
819 	ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
820 	cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
821 	len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
822 	data += len;
823 	bleft -= len;
824 	if (bleft <= 0)
825 		return;
826 
827 	kfree(ses->serverDomain);
828 	ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
829 	cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
830 
831 	return;
832 }
833 
834 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
835 				struct cifs_ses *ses,
836 				const struct nls_table *nls_cp)
837 {
838 	int len;
839 	char *bcc_ptr = *pbcc_area;
840 
841 	cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
842 
843 	len = strnlen(bcc_ptr, bleft);
844 	if (len >= bleft)
845 		return;
846 
847 	kfree(ses->serverOS);
848 
849 	ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
850 	if (ses->serverOS) {
851 		memcpy(ses->serverOS, bcc_ptr, len);
852 		ses->serverOS[len] = 0;
853 		if (strncmp(ses->serverOS, "OS/2", 4) == 0)
854 			cifs_dbg(FYI, "OS/2 server\n");
855 	}
856 
857 	bcc_ptr += len + 1;
858 	bleft -= len + 1;
859 
860 	len = strnlen(bcc_ptr, bleft);
861 	if (len >= bleft)
862 		return;
863 
864 	kfree(ses->serverNOS);
865 
866 	ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
867 	if (ses->serverNOS) {
868 		memcpy(ses->serverNOS, bcc_ptr, len);
869 		ses->serverNOS[len] = 0;
870 	}
871 
872 	bcc_ptr += len + 1;
873 	bleft -= len + 1;
874 
875 	len = strnlen(bcc_ptr, bleft);
876 	if (len > bleft)
877 		return;
878 
879 	/*
880 	 * No domain field in LANMAN case. Domain is
881 	 * returned by old servers in the SMB negprot response
882 	 *
883 	 * BB For newer servers which do not support Unicode,
884 	 * but thus do return domain here, we could add parsing
885 	 * for it later, but it is not very important
886 	 */
887 	cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
888 }
889 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
890 
891 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
892 				    struct cifs_ses *ses)
893 {
894 	unsigned int tioffset; /* challenge message target info area */
895 	unsigned int tilen; /* challenge message target info area length  */
896 	CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
897 	__u32 server_flags;
898 
899 	if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
900 		cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
901 		return -EINVAL;
902 	}
903 
904 	if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
905 		cifs_dbg(VFS, "blob signature incorrect %s\n",
906 			 pblob->Signature);
907 		return -EINVAL;
908 	}
909 	if (pblob->MessageType != NtLmChallenge) {
910 		cifs_dbg(VFS, "Incorrect message type %d\n",
911 			 pblob->MessageType);
912 		return -EINVAL;
913 	}
914 
915 	server_flags = le32_to_cpu(pblob->NegotiateFlags);
916 	cifs_dbg(FYI, "%s: negotiate=0x%08x challenge=0x%08x\n", __func__,
917 		 ses->ntlmssp->client_flags, server_flags);
918 
919 	if ((ses->ntlmssp->client_flags & (NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN)) &&
920 	    (!(server_flags & NTLMSSP_NEGOTIATE_56) && !(server_flags & NTLMSSP_NEGOTIATE_128))) {
921 		cifs_dbg(VFS, "%s: requested signing/encryption but server did not return either 56-bit or 128-bit session key size\n",
922 			 __func__);
923 		return -EINVAL;
924 	}
925 	if (!(server_flags & NTLMSSP_NEGOTIATE_NTLM) && !(server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) {
926 		cifs_dbg(VFS, "%s: server does not seem to support either NTLMv1 or NTLMv2\n", __func__);
927 		return -EINVAL;
928 	}
929 	if (ses->server->sign && !(server_flags & NTLMSSP_NEGOTIATE_SIGN)) {
930 		cifs_dbg(VFS, "%s: forced packet signing but server does not seem to support it\n",
931 			 __func__);
932 		return -EOPNOTSUPP;
933 	}
934 	if ((ses->ntlmssp->client_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
935 	    !(server_flags & NTLMSSP_NEGOTIATE_KEY_XCH))
936 		pr_warn_once("%s: authentication has been weakened as server does not support key exchange\n",
937 			     __func__);
938 
939 	ses->ntlmssp->server_flags = server_flags;
940 
941 	memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
942 	/*
943 	 * In particular we can examine sign flags
944 	 *
945 	 * BB spec says that if AvId field of MsvAvTimestamp is populated then
946 	 * we must set the MIC field of the AUTHENTICATE_MESSAGE
947 	 */
948 
949 	tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
950 	tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
951 	if (tioffset > blob_len || tioffset + tilen > blob_len) {
952 		cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
953 			 tioffset, tilen);
954 		return -EINVAL;
955 	}
956 	if (tilen) {
957 		kfree_sensitive(ses->auth_key.response);
958 		ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
959 						 GFP_KERNEL);
960 		if (!ses->auth_key.response) {
961 			cifs_dbg(VFS, "Challenge target info alloc failure\n");
962 			return -ENOMEM;
963 		}
964 		ses->auth_key.len = tilen;
965 	}
966 
967 	return 0;
968 }
969 
970 static int size_of_ntlmssp_blob(struct cifs_ses *ses, int base_size)
971 {
972 	int sz = base_size + ses->auth_key.len
973 		- CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
974 
975 	if (ses->domainName)
976 		sz += sizeof(__le16) * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
977 	else
978 		sz += sizeof(__le16);
979 
980 	if (ses->user_name)
981 		sz += sizeof(__le16) * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
982 	else
983 		sz += sizeof(__le16);
984 
985 	if (ses->workstation_name[0])
986 		sz += sizeof(__le16) * strnlen(ses->workstation_name,
987 					       ntlmssp_workstation_name_size(ses));
988 	else
989 		sz += sizeof(__le16);
990 
991 	return sz;
992 }
993 
994 static inline void cifs_security_buffer_from_str(SECURITY_BUFFER *pbuf,
995 						 char *str_value,
996 						 int str_length,
997 						 unsigned char *pstart,
998 						 unsigned char **pcur,
999 						 const struct nls_table *nls_cp)
1000 {
1001 	unsigned char *tmp = pstart;
1002 	int len;
1003 
1004 	if (!pbuf)
1005 		return;
1006 
1007 	if (!pcur)
1008 		pcur = &tmp;
1009 
1010 	if (!str_value) {
1011 		pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
1012 		pbuf->Length = 0;
1013 		pbuf->MaximumLength = 0;
1014 		*pcur += sizeof(__le16);
1015 	} else {
1016 		len = cifs_strtoUTF16((__le16 *)*pcur,
1017 				      str_value,
1018 				      str_length,
1019 				      nls_cp);
1020 		len *= sizeof(__le16);
1021 		pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
1022 		pbuf->Length = cpu_to_le16(len);
1023 		pbuf->MaximumLength = cpu_to_le16(len);
1024 		*pcur += len;
1025 	}
1026 }
1027 
1028 /* BB Move to ntlmssp.c eventually */
1029 
1030 int build_ntlmssp_negotiate_blob(unsigned char **pbuffer,
1031 				 u16 *buflen,
1032 				 struct cifs_ses *ses,
1033 				 struct TCP_Server_Info *server,
1034 				 const struct nls_table *nls_cp)
1035 {
1036 	int rc = 0;
1037 	NEGOTIATE_MESSAGE *sec_blob;
1038 	__u32 flags;
1039 	unsigned char *tmp;
1040 	int len;
1041 
1042 	len = size_of_ntlmssp_blob(ses, sizeof(NEGOTIATE_MESSAGE));
1043 	*pbuffer = kmalloc(len, GFP_KERNEL);
1044 	if (!*pbuffer) {
1045 		rc = -ENOMEM;
1046 		cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1047 		*buflen = 0;
1048 		goto setup_ntlm_neg_ret;
1049 	}
1050 	sec_blob = (NEGOTIATE_MESSAGE *)*pbuffer;
1051 
1052 	memset(*pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
1053 	memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1054 	sec_blob->MessageType = NtLmNegotiate;
1055 
1056 	/* BB is NTLMV2 session security format easier to use here? */
1057 	flags = NTLMSSP_NEGOTIATE_56 |	NTLMSSP_REQUEST_TARGET |
1058 		NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1059 		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1060 		NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1061 		NTLMSSP_NEGOTIATE_SIGN;
1062 	if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1063 		flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1064 
1065 	tmp = *pbuffer + sizeof(NEGOTIATE_MESSAGE);
1066 	ses->ntlmssp->client_flags = flags;
1067 	sec_blob->NegotiateFlags = cpu_to_le32(flags);
1068 
1069 	/* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1070 	cifs_security_buffer_from_str(&sec_blob->DomainName,
1071 				      NULL,
1072 				      CIFS_MAX_DOMAINNAME_LEN,
1073 				      *pbuffer, &tmp,
1074 				      nls_cp);
1075 
1076 	cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1077 				      NULL,
1078 				      CIFS_MAX_WORKSTATION_LEN,
1079 				      *pbuffer, &tmp,
1080 				      nls_cp);
1081 
1082 	*buflen = tmp - *pbuffer;
1083 setup_ntlm_neg_ret:
1084 	return rc;
1085 }
1086 
1087 /*
1088  * Build ntlmssp blob with additional fields, such as version,
1089  * supported by modern servers. For safety limit to SMB3 or later
1090  * See notes in MS-NLMP Section 2.2.2.1 e.g.
1091  */
1092 int build_ntlmssp_smb3_negotiate_blob(unsigned char **pbuffer,
1093 				 u16 *buflen,
1094 				 struct cifs_ses *ses,
1095 				 struct TCP_Server_Info *server,
1096 				 const struct nls_table *nls_cp)
1097 {
1098 	int rc = 0;
1099 	struct negotiate_message *sec_blob;
1100 	__u32 flags;
1101 	unsigned char *tmp;
1102 	int len;
1103 
1104 	len = size_of_ntlmssp_blob(ses, sizeof(struct negotiate_message));
1105 	*pbuffer = kmalloc(len, GFP_KERNEL);
1106 	if (!*pbuffer) {
1107 		rc = -ENOMEM;
1108 		cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1109 		*buflen = 0;
1110 		goto setup_ntlm_smb3_neg_ret;
1111 	}
1112 	sec_blob = (struct negotiate_message *)*pbuffer;
1113 
1114 	memset(*pbuffer, 0, sizeof(struct negotiate_message));
1115 	memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1116 	sec_blob->MessageType = NtLmNegotiate;
1117 
1118 	/* BB is NTLMV2 session security format easier to use here? */
1119 	flags = NTLMSSP_NEGOTIATE_56 |	NTLMSSP_REQUEST_TARGET |
1120 		NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1121 		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1122 		NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1123 		NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_VERSION;
1124 	if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1125 		flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1126 
1127 	sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1128 	sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1129 	sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1130 	sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1131 
1132 	tmp = *pbuffer + sizeof(struct negotiate_message);
1133 	ses->ntlmssp->client_flags = flags;
1134 	sec_blob->NegotiateFlags = cpu_to_le32(flags);
1135 
1136 	/* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1137 	cifs_security_buffer_from_str(&sec_blob->DomainName,
1138 				      NULL,
1139 				      CIFS_MAX_DOMAINNAME_LEN,
1140 				      *pbuffer, &tmp,
1141 				      nls_cp);
1142 
1143 	cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1144 				      NULL,
1145 				      CIFS_MAX_WORKSTATION_LEN,
1146 				      *pbuffer, &tmp,
1147 				      nls_cp);
1148 
1149 	*buflen = tmp - *pbuffer;
1150 setup_ntlm_smb3_neg_ret:
1151 	return rc;
1152 }
1153 
1154 
1155 /* See MS-NLMP 2.2.1.3 */
1156 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
1157 					u16 *buflen,
1158 				   struct cifs_ses *ses,
1159 				   struct TCP_Server_Info *server,
1160 				   const struct nls_table *nls_cp)
1161 {
1162 	int rc;
1163 	AUTHENTICATE_MESSAGE *sec_blob;
1164 	__u32 flags;
1165 	unsigned char *tmp;
1166 	int len;
1167 
1168 	rc = setup_ntlmv2_rsp(ses, nls_cp);
1169 	if (rc) {
1170 		cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
1171 		*buflen = 0;
1172 		goto setup_ntlmv2_ret;
1173 	}
1174 
1175 	len = size_of_ntlmssp_blob(ses, sizeof(AUTHENTICATE_MESSAGE));
1176 	*pbuffer = kmalloc(len, GFP_KERNEL);
1177 	if (!*pbuffer) {
1178 		rc = -ENOMEM;
1179 		cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1180 		*buflen = 0;
1181 		goto setup_ntlmv2_ret;
1182 	}
1183 	sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
1184 
1185 	memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1186 	sec_blob->MessageType = NtLmAuthenticate;
1187 
1188 	/* send version information in ntlmssp authenticate also */
1189 	flags = ses->ntlmssp->server_flags | NTLMSSP_REQUEST_TARGET |
1190 		NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_VERSION |
1191 		NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED;
1192 
1193 	sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1194 	sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1195 	sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1196 	sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1197 
1198 	tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
1199 	sec_blob->NegotiateFlags = cpu_to_le32(flags);
1200 
1201 	sec_blob->LmChallengeResponse.BufferOffset =
1202 				cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
1203 	sec_blob->LmChallengeResponse.Length = 0;
1204 	sec_blob->LmChallengeResponse.MaximumLength = 0;
1205 
1206 	sec_blob->NtChallengeResponse.BufferOffset =
1207 				cpu_to_le32(tmp - *pbuffer);
1208 	if (ses->user_name != NULL) {
1209 		memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1210 				ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1211 		tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1212 
1213 		sec_blob->NtChallengeResponse.Length =
1214 				cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1215 		sec_blob->NtChallengeResponse.MaximumLength =
1216 				cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1217 	} else {
1218 		/*
1219 		 * don't send an NT Response for anonymous access
1220 		 */
1221 		sec_blob->NtChallengeResponse.Length = 0;
1222 		sec_blob->NtChallengeResponse.MaximumLength = 0;
1223 	}
1224 
1225 	cifs_security_buffer_from_str(&sec_blob->DomainName,
1226 				      ses->domainName,
1227 				      CIFS_MAX_DOMAINNAME_LEN,
1228 				      *pbuffer, &tmp,
1229 				      nls_cp);
1230 
1231 	cifs_security_buffer_from_str(&sec_blob->UserName,
1232 				      ses->user_name,
1233 				      CIFS_MAX_USERNAME_LEN,
1234 				      *pbuffer, &tmp,
1235 				      nls_cp);
1236 
1237 	cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1238 				      ses->workstation_name,
1239 				      ntlmssp_workstation_name_size(ses),
1240 				      *pbuffer, &tmp,
1241 				      nls_cp);
1242 
1243 	if ((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
1244 	    (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) &&
1245 	    !calc_seckey(ses)) {
1246 		memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
1247 		sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1248 		sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
1249 		sec_blob->SessionKey.MaximumLength =
1250 				cpu_to_le16(CIFS_CPHTXT_SIZE);
1251 		tmp += CIFS_CPHTXT_SIZE;
1252 	} else {
1253 		sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1254 		sec_blob->SessionKey.Length = 0;
1255 		sec_blob->SessionKey.MaximumLength = 0;
1256 	}
1257 
1258 	*buflen = tmp - *pbuffer;
1259 setup_ntlmv2_ret:
1260 	return rc;
1261 }
1262 
1263 enum securityEnum
1264 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
1265 {
1266 	switch (server->negflavor) {
1267 	case CIFS_NEGFLAVOR_EXTENDED:
1268 		switch (requested) {
1269 		case Kerberos:
1270 		case RawNTLMSSP:
1271 		case IAKerb:
1272 			return requested;
1273 		case Unspecified:
1274 			if (server->sec_ntlmssp &&
1275 			    (global_secflags & CIFSSEC_MAY_NTLMSSP))
1276 				return RawNTLMSSP;
1277 			if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) &&
1278 			    (global_secflags & CIFSSEC_MAY_KRB5))
1279 				return Kerberos;
1280 			fallthrough;
1281 		default:
1282 			return Unspecified;
1283 		}
1284 	case CIFS_NEGFLAVOR_UNENCAP:
1285 		switch (requested) {
1286 		case NTLMv2:
1287 			return requested;
1288 		case Unspecified:
1289 			if (global_secflags & CIFSSEC_MAY_NTLMV2)
1290 				return NTLMv2;
1291 			break;
1292 		default:
1293 			break;
1294 		}
1295 		fallthrough;
1296 	default:
1297 		return Unspecified;
1298 	}
1299 }
1300 
1301 struct sess_data {
1302 	unsigned int xid;
1303 	struct cifs_ses *ses;
1304 	struct TCP_Server_Info *server;
1305 	struct nls_table *nls_cp;
1306 	void (*func)(struct sess_data *);
1307 	int result;
1308 
1309 	/* we will send the SMB in three pieces:
1310 	 * a fixed length beginning part, an optional
1311 	 * SPNEGO blob (which can be zero length), and a
1312 	 * last part which will include the strings
1313 	 * and rest of bcc area. This allows us to avoid
1314 	 * a large buffer 17K allocation
1315 	 */
1316 	int buf0_type;
1317 	struct kvec iov[3];
1318 };
1319 
1320 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
1321 static int
1322 sess_alloc_buffer(struct sess_data *sess_data, int wct)
1323 {
1324 	int rc;
1325 	struct cifs_ses *ses = sess_data->ses;
1326 	struct smb_hdr *smb_buf;
1327 
1328 	rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
1329 				  (void **)&smb_buf);
1330 
1331 	if (rc)
1332 		return rc;
1333 
1334 	sess_data->iov[0].iov_base = (char *)smb_buf;
1335 	sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
1336 	/*
1337 	 * This variable will be used to clear the buffer
1338 	 * allocated above in case of any error in the calling function.
1339 	 */
1340 	sess_data->buf0_type = CIFS_SMALL_BUFFER;
1341 
1342 	/* 2000 big enough to fit max user, domain, NOS name etc. */
1343 	sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
1344 	if (!sess_data->iov[2].iov_base) {
1345 		rc = -ENOMEM;
1346 		goto out_free_smb_buf;
1347 	}
1348 
1349 	return 0;
1350 
1351 out_free_smb_buf:
1352 	cifs_small_buf_release(smb_buf);
1353 	sess_data->iov[0].iov_base = NULL;
1354 	sess_data->iov[0].iov_len = 0;
1355 	sess_data->buf0_type = CIFS_NO_BUFFER;
1356 	return rc;
1357 }
1358 
1359 static void
1360 sess_free_buffer(struct sess_data *sess_data)
1361 {
1362 	struct kvec *iov = sess_data->iov;
1363 
1364 	/*
1365 	 * Zero the session data before freeing, as it might contain sensitive info (keys, etc).
1366 	 * Note that iov[1] is already freed by caller.
1367 	 */
1368 	if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base)
1369 		memzero_explicit(iov[0].iov_base, iov[0].iov_len);
1370 
1371 	free_rsp_buf(sess_data->buf0_type, iov[0].iov_base);
1372 	sess_data->buf0_type = CIFS_NO_BUFFER;
1373 	kfree_sensitive(iov[2].iov_base);
1374 }
1375 
1376 static int
1377 sess_establish_session(struct sess_data *sess_data)
1378 {
1379 	struct cifs_ses *ses = sess_data->ses;
1380 	struct TCP_Server_Info *server = sess_data->server;
1381 
1382 	cifs_server_lock(server);
1383 	if (!server->session_estab) {
1384 		if (server->sign) {
1385 			server->session_key.response =
1386 				kmemdup(ses->auth_key.response,
1387 				ses->auth_key.len, GFP_KERNEL);
1388 			if (!server->session_key.response) {
1389 				cifs_server_unlock(server);
1390 				return -ENOMEM;
1391 			}
1392 			server->session_key.len =
1393 						ses->auth_key.len;
1394 		}
1395 		server->sequence_number = 0x2;
1396 		server->session_estab = true;
1397 	}
1398 	cifs_server_unlock(server);
1399 
1400 	cifs_dbg(FYI, "CIFS session established successfully\n");
1401 	return 0;
1402 }
1403 
1404 static int
1405 sess_sendreceive(struct sess_data *sess_data)
1406 {
1407 	int rc;
1408 	struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
1409 	__u16 count;
1410 	struct kvec rsp_iov = { NULL, 0 };
1411 
1412 	count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
1413 	be32_add_cpu(&smb_buf->smb_buf_length, count);
1414 	put_bcc(count, smb_buf);
1415 
1416 	rc = SendReceive2(sess_data->xid, sess_data->ses,
1417 			  sess_data->iov, 3 /* num_iovecs */,
1418 			  &sess_data->buf0_type,
1419 			  CIFS_LOG_ERROR, &rsp_iov);
1420 	cifs_small_buf_release(sess_data->iov[0].iov_base);
1421 	memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
1422 
1423 	return rc;
1424 }
1425 
1426 static void
1427 sess_auth_ntlmv2(struct sess_data *sess_data)
1428 {
1429 	int rc = 0;
1430 	struct smb_hdr *smb_buf;
1431 	SESSION_SETUP_ANDX *pSMB;
1432 	char *bcc_ptr;
1433 	struct cifs_ses *ses = sess_data->ses;
1434 	struct TCP_Server_Info *server = sess_data->server;
1435 	__u32 capabilities;
1436 	__u16 bytes_remaining;
1437 
1438 	/* old style NTLM sessionsetup */
1439 	/* wct = 13 */
1440 	rc = sess_alloc_buffer(sess_data, 13);
1441 	if (rc)
1442 		goto out;
1443 
1444 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1445 	bcc_ptr = sess_data->iov[2].iov_base;
1446 	capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1447 
1448 	pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1449 
1450 	/* LM2 password would be here if we supported it */
1451 	pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1452 
1453 	if (ses->user_name != NULL) {
1454 		/* calculate nlmv2 response and session key */
1455 		rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
1456 		if (rc) {
1457 			cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
1458 			goto out;
1459 		}
1460 
1461 		memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1462 				ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1463 		bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1464 
1465 		/* set case sensitive password length after tilen may get
1466 		 * assigned, tilen is 0 otherwise.
1467 		 */
1468 		pSMB->req_no_secext.CaseSensitivePasswordLength =
1469 			cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1470 	} else {
1471 		pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1472 	}
1473 
1474 	if (ses->capabilities & CAP_UNICODE) {
1475 		if (!IS_ALIGNED(sess_data->iov[0].iov_len, 2)) {
1476 			*bcc_ptr = 0;
1477 			bcc_ptr++;
1478 		}
1479 		unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1480 	} else {
1481 		ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1482 	}
1483 
1484 
1485 	sess_data->iov[2].iov_len = (long) bcc_ptr -
1486 			(long) sess_data->iov[2].iov_base;
1487 
1488 	rc = sess_sendreceive(sess_data);
1489 	if (rc)
1490 		goto out;
1491 
1492 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1493 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1494 
1495 	if (smb_buf->WordCount != 3) {
1496 		rc = -EIO;
1497 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1498 		goto out;
1499 	}
1500 
1501 	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1502 		cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1503 
1504 	ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1505 	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1506 
1507 	bytes_remaining = get_bcc(smb_buf);
1508 	bcc_ptr = pByteArea(smb_buf);
1509 
1510 	/* BB check if Unicode and decode strings */
1511 	if (bytes_remaining == 0) {
1512 		/* no string area to decode, do nothing */
1513 	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1514 		/* unicode string area must be word-aligned */
1515 		if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1516 			++bcc_ptr;
1517 			--bytes_remaining;
1518 		}
1519 		decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1520 				      sess_data->nls_cp);
1521 	} else {
1522 		decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1523 				    sess_data->nls_cp);
1524 	}
1525 
1526 	rc = sess_establish_session(sess_data);
1527 out:
1528 	sess_data->result = rc;
1529 	sess_data->func = NULL;
1530 	sess_free_buffer(sess_data);
1531 	kfree_sensitive(ses->auth_key.response);
1532 	ses->auth_key.response = NULL;
1533 }
1534 
1535 #ifdef CONFIG_CIFS_UPCALL
1536 static void
1537 sess_auth_kerberos(struct sess_data *sess_data)
1538 {
1539 	int rc = 0;
1540 	struct smb_hdr *smb_buf;
1541 	SESSION_SETUP_ANDX *pSMB;
1542 	char *bcc_ptr;
1543 	struct cifs_ses *ses = sess_data->ses;
1544 	struct TCP_Server_Info *server = sess_data->server;
1545 	__u32 capabilities;
1546 	__u16 bytes_remaining;
1547 	struct key *spnego_key = NULL;
1548 	struct cifs_spnego_msg *msg;
1549 	u16 blob_len;
1550 
1551 	/* extended security */
1552 	/* wct = 12 */
1553 	rc = sess_alloc_buffer(sess_data, 12);
1554 	if (rc)
1555 		goto out;
1556 
1557 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1558 	bcc_ptr = sess_data->iov[2].iov_base;
1559 	capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1560 
1561 	spnego_key = cifs_get_spnego_key(ses, server);
1562 	if (IS_ERR(spnego_key)) {
1563 		rc = PTR_ERR(spnego_key);
1564 		spnego_key = NULL;
1565 		goto out;
1566 	}
1567 
1568 	msg = spnego_key->payload.data[0];
1569 	/*
1570 	 * check version field to make sure that cifs.upcall is
1571 	 * sending us a response in an expected form
1572 	 */
1573 	if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1574 		cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1575 			 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1576 		rc = -EKEYREJECTED;
1577 		goto out_put_spnego_key;
1578 	}
1579 
1580 	kfree_sensitive(ses->auth_key.response);
1581 	ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1582 					 GFP_KERNEL);
1583 	if (!ses->auth_key.response) {
1584 		cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1585 			 msg->sesskey_len);
1586 		rc = -ENOMEM;
1587 		goto out_put_spnego_key;
1588 	}
1589 	ses->auth_key.len = msg->sesskey_len;
1590 
1591 	pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1592 	capabilities |= CAP_EXTENDED_SECURITY;
1593 	pSMB->req.Capabilities = cpu_to_le32(capabilities);
1594 	sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1595 	sess_data->iov[1].iov_len = msg->secblob_len;
1596 	pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1597 
1598 	if (pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) {
1599 		/* unicode strings must be word aligned */
1600 		if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1601 			*bcc_ptr = 0;
1602 			bcc_ptr++;
1603 		}
1604 		unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1605 		unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1606 	} else {
1607 		ascii_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1608 		ascii_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1609 	}
1610 
1611 	sess_data->iov[2].iov_len = (long) bcc_ptr -
1612 			(long) sess_data->iov[2].iov_base;
1613 
1614 	rc = sess_sendreceive(sess_data);
1615 	if (rc)
1616 		goto out_put_spnego_key;
1617 
1618 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1619 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1620 
1621 	if (smb_buf->WordCount != 4) {
1622 		rc = -EIO;
1623 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1624 		goto out_put_spnego_key;
1625 	}
1626 
1627 	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1628 		cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1629 
1630 	ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1631 	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1632 
1633 	bytes_remaining = get_bcc(smb_buf);
1634 	bcc_ptr = pByteArea(smb_buf);
1635 
1636 	blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1637 	if (blob_len > bytes_remaining) {
1638 		cifs_dbg(VFS, "bad security blob length %d\n",
1639 				blob_len);
1640 		rc = -EINVAL;
1641 		goto out_put_spnego_key;
1642 	}
1643 	bcc_ptr += blob_len;
1644 	bytes_remaining -= blob_len;
1645 
1646 	/* BB check if Unicode and decode strings */
1647 	if (bytes_remaining == 0) {
1648 		/* no string area to decode, do nothing */
1649 	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1650 		/* unicode string area must be word-aligned */
1651 		if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1652 			++bcc_ptr;
1653 			--bytes_remaining;
1654 		}
1655 		decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1656 				      sess_data->nls_cp);
1657 	} else {
1658 		decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1659 				    sess_data->nls_cp);
1660 	}
1661 
1662 	rc = sess_establish_session(sess_data);
1663 out_put_spnego_key:
1664 	key_invalidate(spnego_key);
1665 	key_put(spnego_key);
1666 out:
1667 	sess_data->result = rc;
1668 	sess_data->func = NULL;
1669 	sess_free_buffer(sess_data);
1670 	kfree_sensitive(ses->auth_key.response);
1671 	ses->auth_key.response = NULL;
1672 }
1673 
1674 #endif /* ! CONFIG_CIFS_UPCALL */
1675 
1676 /*
1677  * The required kvec buffers have to be allocated before calling this
1678  * function.
1679  */
1680 static int
1681 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1682 {
1683 	SESSION_SETUP_ANDX *pSMB;
1684 	struct cifs_ses *ses = sess_data->ses;
1685 	struct TCP_Server_Info *server = sess_data->server;
1686 	__u32 capabilities;
1687 	char *bcc_ptr;
1688 
1689 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1690 
1691 	capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1692 	pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1693 	capabilities |= CAP_EXTENDED_SECURITY;
1694 	pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1695 
1696 	bcc_ptr = sess_data->iov[2].iov_base;
1697 
1698 	if (pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) {
1699 		/* unicode strings must be word aligned */
1700 		if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1701 			*bcc_ptr = 0;
1702 			bcc_ptr++;
1703 		}
1704 		unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1705 	} else {
1706 		ascii_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1707 	}
1708 
1709 	sess_data->iov[2].iov_len = (long) bcc_ptr -
1710 					(long) sess_data->iov[2].iov_base;
1711 
1712 	return 0;
1713 }
1714 
1715 static void
1716 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1717 
1718 static void
1719 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1720 {
1721 	int rc;
1722 	struct smb_hdr *smb_buf;
1723 	SESSION_SETUP_ANDX *pSMB;
1724 	struct cifs_ses *ses = sess_data->ses;
1725 	struct TCP_Server_Info *server = sess_data->server;
1726 	__u16 bytes_remaining;
1727 	char *bcc_ptr;
1728 	unsigned char *ntlmsspblob = NULL;
1729 	u16 blob_len;
1730 
1731 	cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1732 
1733 	/*
1734 	 * if memory allocation is successful, caller of this function
1735 	 * frees it.
1736 	 */
1737 	ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1738 	if (!ses->ntlmssp) {
1739 		rc = -ENOMEM;
1740 		goto out;
1741 	}
1742 	ses->ntlmssp->sesskey_per_smbsess = false;
1743 
1744 	/* wct = 12 */
1745 	rc = sess_alloc_buffer(sess_data, 12);
1746 	if (rc)
1747 		goto out;
1748 
1749 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1750 
1751 	/* Build security blob before we assemble the request */
1752 	rc = build_ntlmssp_negotiate_blob(&ntlmsspblob,
1753 				     &blob_len, ses, server,
1754 				     sess_data->nls_cp);
1755 	if (rc)
1756 		goto out_free_ntlmsspblob;
1757 
1758 	sess_data->iov[1].iov_len = blob_len;
1759 	sess_data->iov[1].iov_base = ntlmsspblob;
1760 	pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1761 
1762 	rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1763 	if (rc)
1764 		goto out_free_ntlmsspblob;
1765 
1766 	rc = sess_sendreceive(sess_data);
1767 
1768 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1769 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1770 
1771 	/* If true, rc here is expected and not an error */
1772 	if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1773 	    smb_buf->Status.CifsError ==
1774 			cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1775 		rc = 0;
1776 
1777 	if (rc)
1778 		goto out_free_ntlmsspblob;
1779 
1780 	cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1781 
1782 	if (smb_buf->WordCount != 4) {
1783 		rc = -EIO;
1784 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1785 		goto out_free_ntlmsspblob;
1786 	}
1787 
1788 	ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1789 	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1790 
1791 	bytes_remaining = get_bcc(smb_buf);
1792 	bcc_ptr = pByteArea(smb_buf);
1793 
1794 	blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1795 	if (blob_len > bytes_remaining) {
1796 		cifs_dbg(VFS, "bad security blob length %d\n",
1797 				blob_len);
1798 		rc = -EINVAL;
1799 		goto out_free_ntlmsspblob;
1800 	}
1801 
1802 	rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1803 
1804 out_free_ntlmsspblob:
1805 	kfree_sensitive(ntlmsspblob);
1806 out:
1807 	sess_free_buffer(sess_data);
1808 
1809 	if (!rc) {
1810 		sess_data->func = sess_auth_rawntlmssp_authenticate;
1811 		return;
1812 	}
1813 
1814 	/* Else error. Cleanup */
1815 	kfree_sensitive(ses->auth_key.response);
1816 	ses->auth_key.response = NULL;
1817 	kfree_sensitive(ses->ntlmssp);
1818 	ses->ntlmssp = NULL;
1819 
1820 	sess_data->func = NULL;
1821 	sess_data->result = rc;
1822 }
1823 
1824 static void
1825 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1826 {
1827 	int rc;
1828 	struct smb_hdr *smb_buf;
1829 	SESSION_SETUP_ANDX *pSMB;
1830 	struct cifs_ses *ses = sess_data->ses;
1831 	struct TCP_Server_Info *server = sess_data->server;
1832 	__u16 bytes_remaining;
1833 	char *bcc_ptr;
1834 	unsigned char *ntlmsspblob = NULL;
1835 	u16 blob_len;
1836 
1837 	cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1838 
1839 	/* wct = 12 */
1840 	rc = sess_alloc_buffer(sess_data, 12);
1841 	if (rc)
1842 		goto out;
1843 
1844 	/* Build security blob before we assemble the request */
1845 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1846 	smb_buf = (struct smb_hdr *)pSMB;
1847 	rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1848 					&blob_len, ses, server,
1849 					sess_data->nls_cp);
1850 	if (rc)
1851 		goto out_free_ntlmsspblob;
1852 	sess_data->iov[1].iov_len = blob_len;
1853 	sess_data->iov[1].iov_base = ntlmsspblob;
1854 	pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1855 	/*
1856 	 * Make sure that we tell the server that we are using
1857 	 * the uid that it just gave us back on the response
1858 	 * (challenge)
1859 	 */
1860 	smb_buf->Uid = ses->Suid;
1861 
1862 	rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1863 	if (rc)
1864 		goto out_free_ntlmsspblob;
1865 
1866 	rc = sess_sendreceive(sess_data);
1867 	if (rc)
1868 		goto out_free_ntlmsspblob;
1869 
1870 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1871 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1872 	if (smb_buf->WordCount != 4) {
1873 		rc = -EIO;
1874 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1875 		goto out_free_ntlmsspblob;
1876 	}
1877 
1878 	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1879 		cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1880 
1881 	if (ses->Suid != smb_buf->Uid) {
1882 		ses->Suid = smb_buf->Uid;
1883 		cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1884 	}
1885 
1886 	bytes_remaining = get_bcc(smb_buf);
1887 	bcc_ptr = pByteArea(smb_buf);
1888 	blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1889 	if (blob_len > bytes_remaining) {
1890 		cifs_dbg(VFS, "bad security blob length %d\n",
1891 				blob_len);
1892 		rc = -EINVAL;
1893 		goto out_free_ntlmsspblob;
1894 	}
1895 	bcc_ptr += blob_len;
1896 	bytes_remaining -= blob_len;
1897 
1898 
1899 	/* BB check if Unicode and decode strings */
1900 	if (bytes_remaining == 0) {
1901 		/* no string area to decode, do nothing */
1902 	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1903 		/* unicode string area must be word-aligned */
1904 		if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1905 			++bcc_ptr;
1906 			--bytes_remaining;
1907 		}
1908 		decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1909 				      sess_data->nls_cp);
1910 	} else {
1911 		decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1912 				    sess_data->nls_cp);
1913 	}
1914 
1915 out_free_ntlmsspblob:
1916 	kfree_sensitive(ntlmsspblob);
1917 out:
1918 	sess_free_buffer(sess_data);
1919 
1920 	if (!rc)
1921 		rc = sess_establish_session(sess_data);
1922 
1923 	/* Cleanup */
1924 	kfree_sensitive(ses->auth_key.response);
1925 	ses->auth_key.response = NULL;
1926 	kfree_sensitive(ses->ntlmssp);
1927 	ses->ntlmssp = NULL;
1928 
1929 	sess_data->func = NULL;
1930 	sess_data->result = rc;
1931 }
1932 
1933 static int select_sec(struct sess_data *sess_data)
1934 {
1935 	int type;
1936 	struct cifs_ses *ses = sess_data->ses;
1937 	struct TCP_Server_Info *server = sess_data->server;
1938 
1939 	type = cifs_select_sectype(server, ses->sectype);
1940 	cifs_dbg(FYI, "sess setup type %d\n", type);
1941 	if (type == Unspecified) {
1942 		cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1943 		return -EINVAL;
1944 	}
1945 
1946 	switch (type) {
1947 	case NTLMv2:
1948 		sess_data->func = sess_auth_ntlmv2;
1949 		break;
1950 	case Kerberos:
1951 #ifdef CONFIG_CIFS_UPCALL
1952 		sess_data->func = sess_auth_kerberos;
1953 		break;
1954 #else
1955 		cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1956 		return -ENOSYS;
1957 #endif /* CONFIG_CIFS_UPCALL */
1958 	case RawNTLMSSP:
1959 		sess_data->func = sess_auth_rawntlmssp_negotiate;
1960 		break;
1961 	default:
1962 		cifs_dbg(VFS, "secType %d not supported!\n", type);
1963 		return -ENOSYS;
1964 	}
1965 
1966 	return 0;
1967 }
1968 
1969 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
1970 		   struct TCP_Server_Info *server,
1971 		   const struct nls_table *nls_cp)
1972 {
1973 	int rc = 0;
1974 	struct sess_data *sess_data;
1975 
1976 	if (ses == NULL) {
1977 		WARN(1, "%s: ses == NULL!", __func__);
1978 		return -EINVAL;
1979 	}
1980 
1981 	sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
1982 	if (!sess_data)
1983 		return -ENOMEM;
1984 
1985 	sess_data->xid = xid;
1986 	sess_data->ses = ses;
1987 	sess_data->server = server;
1988 	sess_data->buf0_type = CIFS_NO_BUFFER;
1989 	sess_data->nls_cp = (struct nls_table *) nls_cp;
1990 
1991 	rc = select_sec(sess_data);
1992 	if (rc)
1993 		goto out;
1994 
1995 	while (sess_data->func)
1996 		sess_data->func(sess_data);
1997 
1998 	/* Store result before we free sess_data */
1999 	rc = sess_data->result;
2000 
2001 out:
2002 	kfree_sensitive(sess_data);
2003 	return rc;
2004 }
2005 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
2006