1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3 *
4 * SMB/CIFS session setup handling routines
5 *
6 * Copyright (c) International Business Machines Corp., 2006, 2009
7 * Author(s): Steve French ([email protected])
8 *
9 */
10
11 #include "cifspdu.h"
12 #include "cifsglob.h"
13 #include "cifsproto.h"
14 #include "cifs_unicode.h"
15 #include "cifs_debug.h"
16 #include "ntlmssp.h"
17 #include "nterr.h"
18 #include <linux/utsname.h>
19 #include <linux/slab.h>
20 #include <linux/version.h>
21 #include "cifsfs.h"
22 #include "cifs_spnego.h"
23 #include "smb2proto.h"
24 #include "fs_context.h"
25
26 static int
27 cifs_ses_add_channel(struct cifs_ses *ses,
28 struct cifs_server_iface *iface);
29
is_ses_using_iface(struct cifs_ses * ses,struct cifs_server_iface * iface)30 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
31 {
32 int i;
33
34 spin_lock(&ses->chan_lock);
35 for (i = 0; i < ses->chan_count; i++) {
36 if (ses->chans[i].iface == iface) {
37 spin_unlock(&ses->chan_lock);
38 return true;
39 }
40 }
41 spin_unlock(&ses->chan_lock);
42 return false;
43 }
44
45 /* channel helper functions. assumed that chan_lock is held by caller. */
46
47 int
cifs_ses_get_chan_index(struct cifs_ses * ses,struct TCP_Server_Info * server)48 cifs_ses_get_chan_index(struct cifs_ses *ses,
49 struct TCP_Server_Info *server)
50 {
51 unsigned int i;
52
53 /* if the channel is waiting for termination */
54 if (server && server->terminate)
55 return CIFS_INVAL_CHAN_INDEX;
56
57 for (i = 0; i < ses->chan_count; i++) {
58 if (ses->chans[i].server == server)
59 return i;
60 }
61
62 /* If we didn't find the channel, it is likely a bug */
63 if (server)
64 cifs_dbg(VFS, "unable to get chan index for server: 0x%llx",
65 server->conn_id);
66 return CIFS_INVAL_CHAN_INDEX;
67 }
68
69 void
cifs_chan_set_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)70 cifs_chan_set_in_reconnect(struct cifs_ses *ses,
71 struct TCP_Server_Info *server)
72 {
73 int chan_index = cifs_ses_get_chan_index(ses, server);
74
75 if (chan_index == CIFS_INVAL_CHAN_INDEX)
76 return;
77
78 ses->chans[chan_index].in_reconnect = true;
79 }
80
81 void
cifs_chan_clear_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)82 cifs_chan_clear_in_reconnect(struct cifs_ses *ses,
83 struct TCP_Server_Info *server)
84 {
85 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
86
87 if (chan_index == CIFS_INVAL_CHAN_INDEX)
88 return;
89
90 ses->chans[chan_index].in_reconnect = false;
91 }
92
93 void
cifs_chan_set_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)94 cifs_chan_set_need_reconnect(struct cifs_ses *ses,
95 struct TCP_Server_Info *server)
96 {
97 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
98
99 if (chan_index == CIFS_INVAL_CHAN_INDEX)
100 return;
101
102 set_bit(chan_index, &ses->chans_need_reconnect);
103 cifs_dbg(FYI, "Set reconnect bitmask for chan %u; now 0x%lx\n",
104 chan_index, ses->chans_need_reconnect);
105 }
106
107 void
cifs_chan_clear_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)108 cifs_chan_clear_need_reconnect(struct cifs_ses *ses,
109 struct TCP_Server_Info *server)
110 {
111 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
112
113 if (chan_index == CIFS_INVAL_CHAN_INDEX)
114 return;
115
116 clear_bit(chan_index, &ses->chans_need_reconnect);
117 cifs_dbg(FYI, "Cleared reconnect bitmask for chan %u; now 0x%lx\n",
118 chan_index, ses->chans_need_reconnect);
119 }
120
121 bool
cifs_chan_needs_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)122 cifs_chan_needs_reconnect(struct cifs_ses *ses,
123 struct TCP_Server_Info *server)
124 {
125 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
126
127 if (chan_index == CIFS_INVAL_CHAN_INDEX)
128 return true; /* err on the safer side */
129
130 return CIFS_CHAN_NEEDS_RECONNECT(ses, chan_index);
131 }
132
133 bool
cifs_chan_is_iface_active(struct cifs_ses * ses,struct TCP_Server_Info * server)134 cifs_chan_is_iface_active(struct cifs_ses *ses,
135 struct TCP_Server_Info *server)
136 {
137 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
138
139 if (chan_index == CIFS_INVAL_CHAN_INDEX)
140 return true; /* err on the safer side */
141
142 return ses->chans[chan_index].iface &&
143 ses->chans[chan_index].iface->is_active;
144 }
145
146 /* returns number of channels added */
cifs_try_adding_channels(struct cifs_ses * ses)147 int cifs_try_adding_channels(struct cifs_ses *ses)
148 {
149 struct TCP_Server_Info *server = ses->server;
150 int old_chan_count, new_chan_count;
151 int left;
152 int rc = 0;
153 int tries = 0;
154 size_t iface_weight = 0, iface_min_speed = 0;
155 struct cifs_server_iface *iface = NULL, *niface = NULL;
156 struct cifs_server_iface *last_iface = NULL;
157
158 spin_lock(&ses->chan_lock);
159
160 new_chan_count = old_chan_count = ses->chan_count;
161 left = ses->chan_max - ses->chan_count;
162
163 if (left <= 0) {
164 spin_unlock(&ses->chan_lock);
165 cifs_dbg(FYI,
166 "ses already at max_channels (%zu), nothing to open\n",
167 ses->chan_max);
168 return 0;
169 }
170
171 if (server->dialect < SMB30_PROT_ID) {
172 spin_unlock(&ses->chan_lock);
173 cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
174 return 0;
175 }
176
177 if (!(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
178 spin_unlock(&ses->chan_lock);
179 cifs_server_dbg(VFS, "no multichannel support\n");
180 return 0;
181 }
182 spin_unlock(&ses->chan_lock);
183
184 while (left > 0) {
185
186 tries++;
187 if (tries > 3*ses->chan_max) {
188 cifs_dbg(VFS, "too many channel open attempts (%d channels left to open)\n",
189 left);
190 break;
191 }
192
193 spin_lock(&ses->iface_lock);
194 if (!ses->iface_count) {
195 spin_unlock(&ses->iface_lock);
196 cifs_dbg(ONCE, "server %s does not advertise interfaces\n",
197 ses->server->hostname);
198 break;
199 }
200
201 if (!iface)
202 iface = list_first_entry(&ses->iface_list, struct cifs_server_iface,
203 iface_head);
204 last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
205 iface_head);
206 iface_min_speed = last_iface->speed;
207
208 list_for_each_entry_safe_from(iface, niface, &ses->iface_list,
209 iface_head) {
210 /* do not mix rdma and non-rdma interfaces */
211 if (iface->rdma_capable != ses->server->rdma)
212 continue;
213
214 /* skip ifaces that are unusable */
215 if (!iface->is_active ||
216 (is_ses_using_iface(ses, iface) &&
217 !iface->rss_capable))
218 continue;
219
220 /* check if we already allocated enough channels */
221 iface_weight = iface->speed / iface_min_speed;
222
223 if (iface->weight_fulfilled >= iface_weight)
224 continue;
225
226 /* take ref before unlock */
227 kref_get(&iface->refcount);
228
229 spin_unlock(&ses->iface_lock);
230 rc = cifs_ses_add_channel(ses, iface);
231 spin_lock(&ses->iface_lock);
232
233 if (rc) {
234 cifs_dbg(VFS, "failed to open extra channel on iface:%pIS rc=%d\n",
235 &iface->sockaddr,
236 rc);
237 kref_put(&iface->refcount, release_iface);
238 /* failure to add chan should increase weight */
239 iface->weight_fulfilled++;
240 continue;
241 }
242
243 iface->num_channels++;
244 iface->weight_fulfilled++;
245 cifs_dbg(VFS, "successfully opened new channel on iface:%pIS\n",
246 &iface->sockaddr);
247 break;
248 }
249
250 /* reached end of list. reset weight_fulfilled and start over */
251 if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
252 list_for_each_entry(iface, &ses->iface_list, iface_head)
253 iface->weight_fulfilled = 0;
254 spin_unlock(&ses->iface_lock);
255 iface = NULL;
256 continue;
257 }
258 spin_unlock(&ses->iface_lock);
259
260 left--;
261 new_chan_count++;
262 }
263
264 return new_chan_count - old_chan_count;
265 }
266
267 /*
268 * called when multichannel is disabled by the server.
269 * this always gets called from smb2_reconnect
270 * and cannot get called in parallel threads.
271 */
272 void
cifs_disable_secondary_channels(struct cifs_ses * ses)273 cifs_disable_secondary_channels(struct cifs_ses *ses)
274 {
275 int i, chan_count;
276 struct TCP_Server_Info *server;
277 struct cifs_server_iface *iface;
278
279 spin_lock(&ses->chan_lock);
280 chan_count = ses->chan_count;
281 if (chan_count == 1)
282 goto done;
283
284 ses->chan_count = 1;
285
286 /* for all secondary channels reset the need reconnect bit */
287 ses->chans_need_reconnect &= 1;
288
289 for (i = 1; i < chan_count; i++) {
290 iface = ses->chans[i].iface;
291 server = ses->chans[i].server;
292
293 /*
294 * remove these references first, since we need to unlock
295 * the chan_lock here, since iface_lock is a higher lock
296 */
297 ses->chans[i].iface = NULL;
298 ses->chans[i].server = NULL;
299 spin_unlock(&ses->chan_lock);
300
301 if (iface) {
302 spin_lock(&ses->iface_lock);
303 iface->num_channels--;
304 if (iface->weight_fulfilled)
305 iface->weight_fulfilled--;
306 kref_put(&iface->refcount, release_iface);
307 spin_unlock(&ses->iface_lock);
308 }
309
310 if (server) {
311 if (!server->terminate) {
312 server->terminate = true;
313 cifs_signal_cifsd_for_reconnect(server, false);
314 }
315 cifs_put_tcp_session(server, false);
316 }
317
318 spin_lock(&ses->chan_lock);
319 }
320
321 done:
322 spin_unlock(&ses->chan_lock);
323 }
324
325 /* update the iface for the channel if necessary. */
326 void
cifs_chan_update_iface(struct cifs_ses * ses,struct TCP_Server_Info * server)327 cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server)
328 {
329 unsigned int chan_index;
330 size_t iface_weight = 0, iface_min_speed = 0;
331 struct cifs_server_iface *iface = NULL;
332 struct cifs_server_iface *old_iface = NULL;
333 struct cifs_server_iface *last_iface = NULL;
334 struct sockaddr_storage ss;
335
336 spin_lock(&ses->chan_lock);
337 chan_index = cifs_ses_get_chan_index(ses, server);
338 if (chan_index == CIFS_INVAL_CHAN_INDEX) {
339 spin_unlock(&ses->chan_lock);
340 return;
341 }
342
343 if (ses->chans[chan_index].iface) {
344 old_iface = ses->chans[chan_index].iface;
345 if (old_iface->is_active) {
346 spin_unlock(&ses->chan_lock);
347 return;
348 }
349 }
350 spin_unlock(&ses->chan_lock);
351
352 spin_lock(&server->srv_lock);
353 ss = server->dstaddr;
354 spin_unlock(&server->srv_lock);
355
356 spin_lock(&ses->iface_lock);
357 if (!ses->iface_count) {
358 spin_unlock(&ses->iface_lock);
359 cifs_dbg(ONCE, "server %s does not advertise interfaces\n", ses->server->hostname);
360 return;
361 }
362
363 last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
364 iface_head);
365 iface_min_speed = last_iface->speed;
366
367 /* then look for a new one */
368 list_for_each_entry(iface, &ses->iface_list, iface_head) {
369 if (!chan_index) {
370 /* if we're trying to get the updated iface for primary channel */
371 if (!cifs_match_ipaddr((struct sockaddr *) &ss,
372 (struct sockaddr *) &iface->sockaddr))
373 continue;
374
375 kref_get(&iface->refcount);
376 break;
377 }
378
379 /* do not mix rdma and non-rdma interfaces */
380 if (iface->rdma_capable != server->rdma)
381 continue;
382
383 if (!iface->is_active ||
384 (is_ses_using_iface(ses, iface) &&
385 !iface->rss_capable)) {
386 continue;
387 }
388
389 /* check if we already allocated enough channels */
390 iface_weight = iface->speed / iface_min_speed;
391
392 if (iface->weight_fulfilled >= iface_weight)
393 continue;
394
395 kref_get(&iface->refcount);
396 break;
397 }
398
399 if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
400 iface = NULL;
401 cifs_dbg(FYI, "unable to find a suitable iface\n");
402 }
403
404 if (!iface) {
405 if (!chan_index)
406 cifs_dbg(FYI, "unable to get the interface matching: %pIS\n",
407 &ss);
408 else {
409 cifs_dbg(FYI, "unable to find another interface to replace: %pIS\n",
410 &old_iface->sockaddr);
411 }
412
413 spin_unlock(&ses->iface_lock);
414 return;
415 }
416
417 /* now drop the ref to the current iface */
418 if (old_iface) {
419 cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n",
420 &old_iface->sockaddr,
421 &iface->sockaddr);
422
423 old_iface->num_channels--;
424 if (old_iface->weight_fulfilled)
425 old_iface->weight_fulfilled--;
426 iface->num_channels++;
427 iface->weight_fulfilled++;
428
429 kref_put(&old_iface->refcount, release_iface);
430 } else if (!chan_index) {
431 /* special case: update interface for primary channel */
432 cifs_dbg(FYI, "referencing primary channel iface: %pIS\n",
433 &iface->sockaddr);
434 iface->num_channels++;
435 iface->weight_fulfilled++;
436 }
437 spin_unlock(&ses->iface_lock);
438
439 spin_lock(&ses->chan_lock);
440 chan_index = cifs_ses_get_chan_index(ses, server);
441 if (chan_index == CIFS_INVAL_CHAN_INDEX) {
442 spin_unlock(&ses->chan_lock);
443 return;
444 }
445
446 ses->chans[chan_index].iface = iface;
447 spin_unlock(&ses->chan_lock);
448 }
449
450 static int
cifs_ses_add_channel(struct cifs_ses * ses,struct cifs_server_iface * iface)451 cifs_ses_add_channel(struct cifs_ses *ses,
452 struct cifs_server_iface *iface)
453 {
454 struct TCP_Server_Info *chan_server;
455 struct cifs_chan *chan;
456 struct smb3_fs_context *ctx;
457 static const char unc_fmt[] = "\\%s\\foo";
458 struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
459 struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
460 size_t len;
461 int rc;
462 unsigned int xid = get_xid();
463
464 if (iface->sockaddr.ss_family == AF_INET)
465 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
466 ses, iface->speed, str_yes_no(iface->rdma_capable),
467 &ipv4->sin_addr);
468 else
469 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI6)\n",
470 ses, iface->speed, str_yes_no(iface->rdma_capable),
471 &ipv6->sin6_addr);
472
473 /*
474 * Setup a ctx with mostly the same info as the existing
475 * session and overwrite it with the requested iface data.
476 *
477 * We need to setup at least the fields used for negprot and
478 * sesssetup.
479 *
480 * We only need the ctx here, so we can reuse memory from
481 * the session and server without caring about memory
482 * management.
483 */
484 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
485 if (!ctx) {
486 rc = -ENOMEM;
487 goto out_free_xid;
488 }
489
490 /* Always make new connection for now (TODO?) */
491 ctx->nosharesock = true;
492
493 /* Auth */
494 ctx->domainauto = ses->domainAuto;
495 ctx->domainname = ses->domainName;
496
497 /* no hostname for extra channels */
498 ctx->server_hostname = "";
499
500 ctx->username = ses->user_name;
501 ctx->password = ses->password;
502 ctx->sectype = ses->sectype;
503 ctx->sign = ses->sign;
504
505 /* UNC and paths */
506 /* XXX: Use ses->server->hostname? */
507 len = sizeof(unc_fmt) + SERVER_NAME_LEN_WITH_NULL;
508 ctx->UNC = kzalloc(len, GFP_KERNEL);
509 if (!ctx->UNC) {
510 rc = -ENOMEM;
511 goto out_free_ctx;
512 }
513 scnprintf(ctx->UNC, len, unc_fmt, ses->ip_addr);
514 ctx->prepath = "";
515
516 /* Reuse same version as master connection */
517 ctx->vals = ses->server->vals;
518 ctx->ops = ses->server->ops;
519
520 ctx->noblocksnd = ses->server->noblocksnd;
521 ctx->noautotune = ses->server->noautotune;
522 ctx->sockopt_tcp_nodelay = ses->server->tcp_nodelay;
523 ctx->echo_interval = ses->server->echo_interval / HZ;
524 ctx->max_credits = ses->server->max_credits;
525 ctx->min_offload = ses->server->min_offload;
526 ctx->compress = ses->server->compression.requested;
527 ctx->dfs_conn = ses->server->dfs_conn;
528 ctx->ignore_signature = ses->server->ignore_signature;
529 ctx->leaf_fullpath = ses->server->leaf_fullpath;
530 ctx->rootfs = ses->server->noblockcnt;
531 ctx->retrans = ses->server->retrans;
532
533 /*
534 * This will be used for encoding/decoding user/domain/pw
535 * during sess setup auth.
536 */
537 ctx->local_nls = ses->local_nls;
538
539 /* Use RDMA if possible */
540 ctx->rdma = iface->rdma_capable;
541 memcpy(&ctx->dstaddr, &iface->sockaddr, sizeof(ctx->dstaddr));
542
543 /* reuse master con client guid */
544 memcpy(&ctx->client_guid, ses->server->client_guid,
545 sizeof(ctx->client_guid));
546 ctx->use_client_guid = true;
547
548 chan_server = cifs_get_tcp_session(ctx, ses->server);
549
550 spin_lock(&ses->chan_lock);
551 chan = &ses->chans[ses->chan_count];
552 chan->server = chan_server;
553 if (IS_ERR(chan->server)) {
554 rc = PTR_ERR(chan->server);
555 chan->server = NULL;
556 spin_unlock(&ses->chan_lock);
557 goto out;
558 }
559 chan->iface = iface;
560 ses->chan_count++;
561 atomic_set(&ses->chan_seq, 0);
562
563 /* Mark this channel as needing connect/setup */
564 cifs_chan_set_need_reconnect(ses, chan->server);
565
566 spin_unlock(&ses->chan_lock);
567
568 mutex_lock(&ses->session_mutex);
569 /*
570 * We need to allocate the server crypto now as we will need
571 * to sign packets before we generate the channel signing key
572 * (we sign with the session key)
573 */
574 rc = smb311_crypto_shash_allocate(chan->server);
575 if (rc) {
576 cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
577 mutex_unlock(&ses->session_mutex);
578 goto out;
579 }
580
581 rc = cifs_negotiate_protocol(xid, ses, chan->server);
582 if (!rc)
583 rc = cifs_setup_session(xid, ses, chan->server, ses->local_nls);
584
585 mutex_unlock(&ses->session_mutex);
586
587 out:
588 if (rc && chan->server) {
589 cifs_put_tcp_session(chan->server, 0);
590
591 spin_lock(&ses->chan_lock);
592
593 /* we rely on all bits beyond chan_count to be clear */
594 cifs_chan_clear_need_reconnect(ses, chan->server);
595 ses->chan_count--;
596 /*
597 * chan_count should never reach 0 as at least the primary
598 * channel is always allocated
599 */
600 WARN_ON(ses->chan_count < 1);
601 spin_unlock(&ses->chan_lock);
602 }
603
604 kfree(ctx->UNC);
605 out_free_ctx:
606 kfree(ctx);
607 out_free_xid:
608 free_xid(xid);
609 return rc;
610 }
611
612 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
cifs_ssetup_hdr(struct cifs_ses * ses,struct TCP_Server_Info * server,SESSION_SETUP_ANDX * pSMB)613 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses,
614 struct TCP_Server_Info *server,
615 SESSION_SETUP_ANDX *pSMB)
616 {
617 __u32 capabilities = 0;
618
619 /* init fields common to all four types of SessSetup */
620 /* Note that offsets for first seven fields in req struct are same */
621 /* in CIFS Specs so does not matter which of 3 forms of struct */
622 /* that we use in next few lines */
623 /* Note that header is initialized to zero in header_assemble */
624 pSMB->req.AndXCommand = 0xFF;
625 pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
626 CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
627 USHRT_MAX));
628 pSMB->req.MaxMpxCount = cpu_to_le16(server->maxReq);
629 pSMB->req.VcNumber = cpu_to_le16(1);
630
631 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
632
633 /* BB verify whether signing required on neg or just auth frame (and NTLM case) */
634
635 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
636 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
637
638 if (server->sign)
639 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
640
641 if (ses->capabilities & CAP_UNICODE) {
642 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
643 capabilities |= CAP_UNICODE;
644 }
645 if (ses->capabilities & CAP_STATUS32) {
646 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
647 capabilities |= CAP_STATUS32;
648 }
649 if (ses->capabilities & CAP_DFS) {
650 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
651 capabilities |= CAP_DFS;
652 }
653 if (ses->capabilities & CAP_UNIX)
654 capabilities |= CAP_UNIX;
655
656 return capabilities;
657 }
658
659 static void
unicode_oslm_strings(char ** pbcc_area,const struct nls_table * nls_cp)660 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
661 {
662 char *bcc_ptr = *pbcc_area;
663 int bytes_ret = 0;
664
665 /* Copy OS version */
666 bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
667 nls_cp);
668 bcc_ptr += 2 * bytes_ret;
669 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
670 32, nls_cp);
671 bcc_ptr += 2 * bytes_ret;
672 bcc_ptr += 2; /* trailing null */
673
674 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
675 32, nls_cp);
676 bcc_ptr += 2 * bytes_ret;
677 bcc_ptr += 2; /* trailing null */
678
679 *pbcc_area = bcc_ptr;
680 }
681
unicode_domain_string(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)682 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
683 const struct nls_table *nls_cp)
684 {
685 char *bcc_ptr = *pbcc_area;
686 int bytes_ret = 0;
687
688 /* copy domain */
689 if (ses->domainName == NULL) {
690 /*
691 * Sending null domain better than using a bogus domain name (as
692 * we did briefly in 2.6.18) since server will use its default
693 */
694 *bcc_ptr = 0;
695 *(bcc_ptr+1) = 0;
696 bytes_ret = 0;
697 } else
698 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
699 CIFS_MAX_DOMAINNAME_LEN, nls_cp);
700 bcc_ptr += 2 * bytes_ret;
701 bcc_ptr += 2; /* account for null terminator */
702
703 *pbcc_area = bcc_ptr;
704 }
705
unicode_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)706 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
707 const struct nls_table *nls_cp)
708 {
709 char *bcc_ptr = *pbcc_area;
710 int bytes_ret = 0;
711
712 /* BB FIXME add check that strings less than 335 or will need to send as arrays */
713
714 /* copy user */
715 if (ses->user_name == NULL) {
716 /* null user mount */
717 *bcc_ptr = 0;
718 *(bcc_ptr+1) = 0;
719 } else {
720 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
721 CIFS_MAX_USERNAME_LEN, nls_cp);
722 }
723 bcc_ptr += 2 * bytes_ret;
724 bcc_ptr += 2; /* account for null termination */
725
726 unicode_domain_string(&bcc_ptr, ses, nls_cp);
727 unicode_oslm_strings(&bcc_ptr, nls_cp);
728
729 *pbcc_area = bcc_ptr;
730 }
731
ascii_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)732 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
733 const struct nls_table *nls_cp)
734 {
735 char *bcc_ptr = *pbcc_area;
736 int len;
737
738 /* copy user */
739 /* BB what about null user mounts - check that we do this BB */
740 /* copy user */
741 if (ses->user_name != NULL) {
742 len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
743 if (WARN_ON_ONCE(len < 0))
744 len = CIFS_MAX_USERNAME_LEN - 1;
745 bcc_ptr += len;
746 }
747 /* else null user mount */
748 *bcc_ptr = 0;
749 bcc_ptr++; /* account for null termination */
750
751 /* copy domain */
752 if (ses->domainName != NULL) {
753 len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
754 if (WARN_ON_ONCE(len < 0))
755 len = CIFS_MAX_DOMAINNAME_LEN - 1;
756 bcc_ptr += len;
757 } /* else we send a null domain name so server will default to its own domain */
758 *bcc_ptr = 0;
759 bcc_ptr++;
760
761 /* BB check for overflow here */
762
763 strcpy(bcc_ptr, "Linux version ");
764 bcc_ptr += strlen("Linux version ");
765 strcpy(bcc_ptr, init_utsname()->release);
766 bcc_ptr += strlen(init_utsname()->release) + 1;
767
768 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
769 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
770
771 *pbcc_area = bcc_ptr;
772 }
773
774 static void
decode_unicode_ssetup(char ** pbcc_area,int bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)775 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
776 const struct nls_table *nls_cp)
777 {
778 int len;
779 char *data = *pbcc_area;
780
781 cifs_dbg(FYI, "bleft %d\n", bleft);
782
783 kfree(ses->serverOS);
784 ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
785 cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
786 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
787 data += len;
788 bleft -= len;
789 if (bleft <= 0)
790 return;
791
792 kfree(ses->serverNOS);
793 ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
794 cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
795 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
796 data += len;
797 bleft -= len;
798 if (bleft <= 0)
799 return;
800
801 kfree(ses->serverDomain);
802 ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
803 cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
804
805 return;
806 }
807
decode_ascii_ssetup(char ** pbcc_area,__u16 bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)808 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
809 struct cifs_ses *ses,
810 const struct nls_table *nls_cp)
811 {
812 int len;
813 char *bcc_ptr = *pbcc_area;
814
815 cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
816
817 len = strnlen(bcc_ptr, bleft);
818 if (len >= bleft)
819 return;
820
821 kfree(ses->serverOS);
822
823 ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
824 if (ses->serverOS) {
825 memcpy(ses->serverOS, bcc_ptr, len);
826 ses->serverOS[len] = 0;
827 if (strncmp(ses->serverOS, "OS/2", 4) == 0)
828 cifs_dbg(FYI, "OS/2 server\n");
829 }
830
831 bcc_ptr += len + 1;
832 bleft -= len + 1;
833
834 len = strnlen(bcc_ptr, bleft);
835 if (len >= bleft)
836 return;
837
838 kfree(ses->serverNOS);
839
840 ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
841 if (ses->serverNOS) {
842 memcpy(ses->serverNOS, bcc_ptr, len);
843 ses->serverNOS[len] = 0;
844 }
845
846 bcc_ptr += len + 1;
847 bleft -= len + 1;
848
849 len = strnlen(bcc_ptr, bleft);
850 if (len > bleft)
851 return;
852
853 /*
854 * No domain field in LANMAN case. Domain is
855 * returned by old servers in the SMB negprot response
856 *
857 * BB For newer servers which do not support Unicode,
858 * but thus do return domain here, we could add parsing
859 * for it later, but it is not very important
860 */
861 cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
862 }
863 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
864
decode_ntlmssp_challenge(char * bcc_ptr,int blob_len,struct cifs_ses * ses)865 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
866 struct cifs_ses *ses)
867 {
868 unsigned int tioffset; /* challenge message target info area */
869 unsigned int tilen; /* challenge message target info area length */
870 CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
871 __u32 server_flags;
872
873 if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
874 cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
875 return -EINVAL;
876 }
877
878 if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
879 cifs_dbg(VFS, "blob signature incorrect %s\n",
880 pblob->Signature);
881 return -EINVAL;
882 }
883 if (pblob->MessageType != NtLmChallenge) {
884 cifs_dbg(VFS, "Incorrect message type %d\n",
885 pblob->MessageType);
886 return -EINVAL;
887 }
888
889 server_flags = le32_to_cpu(pblob->NegotiateFlags);
890 cifs_dbg(FYI, "%s: negotiate=0x%08x challenge=0x%08x\n", __func__,
891 ses->ntlmssp->client_flags, server_flags);
892
893 if ((ses->ntlmssp->client_flags & (NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN)) &&
894 (!(server_flags & NTLMSSP_NEGOTIATE_56) && !(server_flags & NTLMSSP_NEGOTIATE_128))) {
895 cifs_dbg(VFS, "%s: requested signing/encryption but server did not return either 56-bit or 128-bit session key size\n",
896 __func__);
897 return -EINVAL;
898 }
899 if (!(server_flags & NTLMSSP_NEGOTIATE_NTLM) && !(server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) {
900 cifs_dbg(VFS, "%s: server does not seem to support either NTLMv1 or NTLMv2\n", __func__);
901 return -EINVAL;
902 }
903 if (ses->server->sign && !(server_flags & NTLMSSP_NEGOTIATE_SIGN)) {
904 cifs_dbg(VFS, "%s: forced packet signing but server does not seem to support it\n",
905 __func__);
906 return -EOPNOTSUPP;
907 }
908 if ((ses->ntlmssp->client_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
909 !(server_flags & NTLMSSP_NEGOTIATE_KEY_XCH))
910 pr_warn_once("%s: authentication has been weakened as server does not support key exchange\n",
911 __func__);
912
913 ses->ntlmssp->server_flags = server_flags;
914
915 memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
916 /*
917 * In particular we can examine sign flags
918 *
919 * BB spec says that if AvId field of MsvAvTimestamp is populated then
920 * we must set the MIC field of the AUTHENTICATE_MESSAGE
921 */
922
923 tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
924 tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
925 if (tioffset > blob_len || tioffset + tilen > blob_len) {
926 cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
927 tioffset, tilen);
928 return -EINVAL;
929 }
930 if (tilen) {
931 kfree_sensitive(ses->auth_key.response);
932 ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
933 GFP_KERNEL);
934 if (!ses->auth_key.response) {
935 cifs_dbg(VFS, "Challenge target info alloc failure\n");
936 return -ENOMEM;
937 }
938 ses->auth_key.len = tilen;
939 }
940
941 return 0;
942 }
943
size_of_ntlmssp_blob(struct cifs_ses * ses,int base_size)944 static int size_of_ntlmssp_blob(struct cifs_ses *ses, int base_size)
945 {
946 int sz = base_size + ses->auth_key.len
947 - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
948
949 if (ses->domainName)
950 sz += sizeof(__le16) * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
951 else
952 sz += sizeof(__le16);
953
954 if (ses->user_name)
955 sz += sizeof(__le16) * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
956 else
957 sz += sizeof(__le16);
958
959 if (ses->workstation_name[0])
960 sz += sizeof(__le16) * strnlen(ses->workstation_name,
961 ntlmssp_workstation_name_size(ses));
962 else
963 sz += sizeof(__le16);
964
965 return sz;
966 }
967
cifs_security_buffer_from_str(SECURITY_BUFFER * pbuf,char * str_value,int str_length,unsigned char * pstart,unsigned char ** pcur,const struct nls_table * nls_cp)968 static inline void cifs_security_buffer_from_str(SECURITY_BUFFER *pbuf,
969 char *str_value,
970 int str_length,
971 unsigned char *pstart,
972 unsigned char **pcur,
973 const struct nls_table *nls_cp)
974 {
975 unsigned char *tmp = pstart;
976 int len;
977
978 if (!pbuf)
979 return;
980
981 if (!pcur)
982 pcur = &tmp;
983
984 if (!str_value) {
985 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
986 pbuf->Length = 0;
987 pbuf->MaximumLength = 0;
988 *pcur += sizeof(__le16);
989 } else {
990 len = cifs_strtoUTF16((__le16 *)*pcur,
991 str_value,
992 str_length,
993 nls_cp);
994 len *= sizeof(__le16);
995 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
996 pbuf->Length = cpu_to_le16(len);
997 pbuf->MaximumLength = cpu_to_le16(len);
998 *pcur += len;
999 }
1000 }
1001
1002 /* BB Move to ntlmssp.c eventually */
1003
build_ntlmssp_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1004 int build_ntlmssp_negotiate_blob(unsigned char **pbuffer,
1005 u16 *buflen,
1006 struct cifs_ses *ses,
1007 struct TCP_Server_Info *server,
1008 const struct nls_table *nls_cp)
1009 {
1010 int rc = 0;
1011 NEGOTIATE_MESSAGE *sec_blob;
1012 __u32 flags;
1013 unsigned char *tmp;
1014 int len;
1015
1016 len = size_of_ntlmssp_blob(ses, sizeof(NEGOTIATE_MESSAGE));
1017 *pbuffer = kmalloc(len, GFP_KERNEL);
1018 if (!*pbuffer) {
1019 rc = -ENOMEM;
1020 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1021 *buflen = 0;
1022 goto setup_ntlm_neg_ret;
1023 }
1024 sec_blob = (NEGOTIATE_MESSAGE *)*pbuffer;
1025
1026 memset(*pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
1027 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1028 sec_blob->MessageType = NtLmNegotiate;
1029
1030 /* BB is NTLMV2 session security format easier to use here? */
1031 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
1032 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1033 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1034 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1035 NTLMSSP_NEGOTIATE_SIGN;
1036 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1037 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1038
1039 tmp = *pbuffer + sizeof(NEGOTIATE_MESSAGE);
1040 ses->ntlmssp->client_flags = flags;
1041 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1042
1043 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1044 cifs_security_buffer_from_str(&sec_blob->DomainName,
1045 NULL,
1046 CIFS_MAX_DOMAINNAME_LEN,
1047 *pbuffer, &tmp,
1048 nls_cp);
1049
1050 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1051 NULL,
1052 CIFS_MAX_WORKSTATION_LEN,
1053 *pbuffer, &tmp,
1054 nls_cp);
1055
1056 *buflen = tmp - *pbuffer;
1057 setup_ntlm_neg_ret:
1058 return rc;
1059 }
1060
1061 /*
1062 * Build ntlmssp blob with additional fields, such as version,
1063 * supported by modern servers. For safety limit to SMB3 or later
1064 * See notes in MS-NLMP Section 2.2.2.1 e.g.
1065 */
build_ntlmssp_smb3_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1066 int build_ntlmssp_smb3_negotiate_blob(unsigned char **pbuffer,
1067 u16 *buflen,
1068 struct cifs_ses *ses,
1069 struct TCP_Server_Info *server,
1070 const struct nls_table *nls_cp)
1071 {
1072 int rc = 0;
1073 struct negotiate_message *sec_blob;
1074 __u32 flags;
1075 unsigned char *tmp;
1076 int len;
1077
1078 len = size_of_ntlmssp_blob(ses, sizeof(struct negotiate_message));
1079 *pbuffer = kmalloc(len, GFP_KERNEL);
1080 if (!*pbuffer) {
1081 rc = -ENOMEM;
1082 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1083 *buflen = 0;
1084 goto setup_ntlm_smb3_neg_ret;
1085 }
1086 sec_blob = (struct negotiate_message *)*pbuffer;
1087
1088 memset(*pbuffer, 0, sizeof(struct negotiate_message));
1089 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1090 sec_blob->MessageType = NtLmNegotiate;
1091
1092 /* BB is NTLMV2 session security format easier to use here? */
1093 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
1094 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1095 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1096 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1097 NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_VERSION;
1098 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1099 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1100
1101 sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1102 sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1103 sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1104 sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1105
1106 tmp = *pbuffer + sizeof(struct negotiate_message);
1107 ses->ntlmssp->client_flags = flags;
1108 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1109
1110 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1111 cifs_security_buffer_from_str(&sec_blob->DomainName,
1112 NULL,
1113 CIFS_MAX_DOMAINNAME_LEN,
1114 *pbuffer, &tmp,
1115 nls_cp);
1116
1117 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1118 NULL,
1119 CIFS_MAX_WORKSTATION_LEN,
1120 *pbuffer, &tmp,
1121 nls_cp);
1122
1123 *buflen = tmp - *pbuffer;
1124 setup_ntlm_smb3_neg_ret:
1125 return rc;
1126 }
1127
1128
1129 /* See MS-NLMP 2.2.1.3 */
build_ntlmssp_auth_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1130 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
1131 u16 *buflen,
1132 struct cifs_ses *ses,
1133 struct TCP_Server_Info *server,
1134 const struct nls_table *nls_cp)
1135 {
1136 int rc;
1137 AUTHENTICATE_MESSAGE *sec_blob;
1138 __u32 flags;
1139 unsigned char *tmp;
1140 int len;
1141
1142 rc = setup_ntlmv2_rsp(ses, nls_cp);
1143 if (rc) {
1144 cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
1145 *buflen = 0;
1146 goto setup_ntlmv2_ret;
1147 }
1148
1149 len = size_of_ntlmssp_blob(ses, sizeof(AUTHENTICATE_MESSAGE));
1150 *pbuffer = kmalloc(len, GFP_KERNEL);
1151 if (!*pbuffer) {
1152 rc = -ENOMEM;
1153 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1154 *buflen = 0;
1155 goto setup_ntlmv2_ret;
1156 }
1157 sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
1158
1159 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1160 sec_blob->MessageType = NtLmAuthenticate;
1161
1162 /* send version information in ntlmssp authenticate also */
1163 flags = ses->ntlmssp->server_flags | NTLMSSP_REQUEST_TARGET |
1164 NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_VERSION |
1165 NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED;
1166
1167 sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1168 sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1169 sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1170 sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1171
1172 tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
1173 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1174
1175 sec_blob->LmChallengeResponse.BufferOffset =
1176 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
1177 sec_blob->LmChallengeResponse.Length = 0;
1178 sec_blob->LmChallengeResponse.MaximumLength = 0;
1179
1180 sec_blob->NtChallengeResponse.BufferOffset =
1181 cpu_to_le32(tmp - *pbuffer);
1182 if (ses->user_name != NULL) {
1183 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1184 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1185 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1186
1187 sec_blob->NtChallengeResponse.Length =
1188 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1189 sec_blob->NtChallengeResponse.MaximumLength =
1190 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1191 } else {
1192 /*
1193 * don't send an NT Response for anonymous access
1194 */
1195 sec_blob->NtChallengeResponse.Length = 0;
1196 sec_blob->NtChallengeResponse.MaximumLength = 0;
1197 }
1198
1199 cifs_security_buffer_from_str(&sec_blob->DomainName,
1200 ses->domainName,
1201 CIFS_MAX_DOMAINNAME_LEN,
1202 *pbuffer, &tmp,
1203 nls_cp);
1204
1205 cifs_security_buffer_from_str(&sec_blob->UserName,
1206 ses->user_name,
1207 CIFS_MAX_USERNAME_LEN,
1208 *pbuffer, &tmp,
1209 nls_cp);
1210
1211 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1212 ses->workstation_name,
1213 ntlmssp_workstation_name_size(ses),
1214 *pbuffer, &tmp,
1215 nls_cp);
1216
1217 if ((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
1218 (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) &&
1219 !calc_seckey(ses)) {
1220 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
1221 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1222 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
1223 sec_blob->SessionKey.MaximumLength =
1224 cpu_to_le16(CIFS_CPHTXT_SIZE);
1225 tmp += CIFS_CPHTXT_SIZE;
1226 } else {
1227 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1228 sec_blob->SessionKey.Length = 0;
1229 sec_blob->SessionKey.MaximumLength = 0;
1230 }
1231
1232 *buflen = tmp - *pbuffer;
1233 setup_ntlmv2_ret:
1234 return rc;
1235 }
1236
1237 enum securityEnum
cifs_select_sectype(struct TCP_Server_Info * server,enum securityEnum requested)1238 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
1239 {
1240 switch (server->negflavor) {
1241 case CIFS_NEGFLAVOR_EXTENDED:
1242 switch (requested) {
1243 case Kerberos:
1244 case RawNTLMSSP:
1245 case IAKerb:
1246 return requested;
1247 case Unspecified:
1248 if (server->sec_ntlmssp &&
1249 (global_secflags & CIFSSEC_MAY_NTLMSSP))
1250 return RawNTLMSSP;
1251 if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) &&
1252 (global_secflags & CIFSSEC_MAY_KRB5))
1253 return Kerberos;
1254 fallthrough;
1255 default:
1256 return Unspecified;
1257 }
1258 case CIFS_NEGFLAVOR_UNENCAP:
1259 switch (requested) {
1260 case NTLMv2:
1261 return requested;
1262 case Unspecified:
1263 if (global_secflags & CIFSSEC_MAY_NTLMV2)
1264 return NTLMv2;
1265 break;
1266 default:
1267 break;
1268 }
1269 fallthrough;
1270 default:
1271 return Unspecified;
1272 }
1273 }
1274
1275 struct sess_data {
1276 unsigned int xid;
1277 struct cifs_ses *ses;
1278 struct TCP_Server_Info *server;
1279 struct nls_table *nls_cp;
1280 void (*func)(struct sess_data *);
1281 int result;
1282
1283 /* we will send the SMB in three pieces:
1284 * a fixed length beginning part, an optional
1285 * SPNEGO blob (which can be zero length), and a
1286 * last part which will include the strings
1287 * and rest of bcc area. This allows us to avoid
1288 * a large buffer 17K allocation
1289 */
1290 int buf0_type;
1291 struct kvec iov[3];
1292 };
1293
1294 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
1295 static int
sess_alloc_buffer(struct sess_data * sess_data,int wct)1296 sess_alloc_buffer(struct sess_data *sess_data, int wct)
1297 {
1298 int rc;
1299 struct cifs_ses *ses = sess_data->ses;
1300 struct smb_hdr *smb_buf;
1301
1302 rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
1303 (void **)&smb_buf);
1304
1305 if (rc)
1306 return rc;
1307
1308 sess_data->iov[0].iov_base = (char *)smb_buf;
1309 sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
1310 /*
1311 * This variable will be used to clear the buffer
1312 * allocated above in case of any error in the calling function.
1313 */
1314 sess_data->buf0_type = CIFS_SMALL_BUFFER;
1315
1316 /* 2000 big enough to fit max user, domain, NOS name etc. */
1317 sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
1318 if (!sess_data->iov[2].iov_base) {
1319 rc = -ENOMEM;
1320 goto out_free_smb_buf;
1321 }
1322
1323 return 0;
1324
1325 out_free_smb_buf:
1326 cifs_small_buf_release(smb_buf);
1327 sess_data->iov[0].iov_base = NULL;
1328 sess_data->iov[0].iov_len = 0;
1329 sess_data->buf0_type = CIFS_NO_BUFFER;
1330 return rc;
1331 }
1332
1333 static void
sess_free_buffer(struct sess_data * sess_data)1334 sess_free_buffer(struct sess_data *sess_data)
1335 {
1336 struct kvec *iov = sess_data->iov;
1337
1338 /*
1339 * Zero the session data before freeing, as it might contain sensitive info (keys, etc).
1340 * Note that iov[1] is already freed by caller.
1341 */
1342 if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base)
1343 memzero_explicit(iov[0].iov_base, iov[0].iov_len);
1344
1345 free_rsp_buf(sess_data->buf0_type, iov[0].iov_base);
1346 sess_data->buf0_type = CIFS_NO_BUFFER;
1347 kfree_sensitive(iov[2].iov_base);
1348 }
1349
1350 static int
sess_establish_session(struct sess_data * sess_data)1351 sess_establish_session(struct sess_data *sess_data)
1352 {
1353 struct cifs_ses *ses = sess_data->ses;
1354 struct TCP_Server_Info *server = sess_data->server;
1355
1356 cifs_server_lock(server);
1357 if (!server->session_estab) {
1358 if (server->sign) {
1359 server->session_key.response =
1360 kmemdup(ses->auth_key.response,
1361 ses->auth_key.len, GFP_KERNEL);
1362 if (!server->session_key.response) {
1363 cifs_server_unlock(server);
1364 return -ENOMEM;
1365 }
1366 server->session_key.len =
1367 ses->auth_key.len;
1368 }
1369 server->sequence_number = 0x2;
1370 server->session_estab = true;
1371 }
1372 cifs_server_unlock(server);
1373
1374 cifs_dbg(FYI, "CIFS session established successfully\n");
1375 return 0;
1376 }
1377
1378 static int
sess_sendreceive(struct sess_data * sess_data)1379 sess_sendreceive(struct sess_data *sess_data)
1380 {
1381 int rc;
1382 struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
1383 __u16 count;
1384 struct kvec rsp_iov = { NULL, 0 };
1385
1386 count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
1387 be32_add_cpu(&smb_buf->smb_buf_length, count);
1388 put_bcc(count, smb_buf);
1389
1390 rc = SendReceive2(sess_data->xid, sess_data->ses,
1391 sess_data->iov, 3 /* num_iovecs */,
1392 &sess_data->buf0_type,
1393 CIFS_LOG_ERROR, &rsp_iov);
1394 cifs_small_buf_release(sess_data->iov[0].iov_base);
1395 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
1396
1397 return rc;
1398 }
1399
1400 static void
sess_auth_ntlmv2(struct sess_data * sess_data)1401 sess_auth_ntlmv2(struct sess_data *sess_data)
1402 {
1403 int rc = 0;
1404 struct smb_hdr *smb_buf;
1405 SESSION_SETUP_ANDX *pSMB;
1406 char *bcc_ptr;
1407 struct cifs_ses *ses = sess_data->ses;
1408 struct TCP_Server_Info *server = sess_data->server;
1409 __u32 capabilities;
1410 __u16 bytes_remaining;
1411
1412 /* old style NTLM sessionsetup */
1413 /* wct = 13 */
1414 rc = sess_alloc_buffer(sess_data, 13);
1415 if (rc)
1416 goto out;
1417
1418 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1419 bcc_ptr = sess_data->iov[2].iov_base;
1420 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1421
1422 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1423
1424 /* LM2 password would be here if we supported it */
1425 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1426
1427 if (ses->user_name != NULL) {
1428 /* calculate nlmv2 response and session key */
1429 rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
1430 if (rc) {
1431 cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
1432 goto out;
1433 }
1434
1435 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1436 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1437 bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1438
1439 /* set case sensitive password length after tilen may get
1440 * assigned, tilen is 0 otherwise.
1441 */
1442 pSMB->req_no_secext.CaseSensitivePasswordLength =
1443 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1444 } else {
1445 pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1446 }
1447
1448 if (ses->capabilities & CAP_UNICODE) {
1449 if (!IS_ALIGNED(sess_data->iov[0].iov_len, 2)) {
1450 *bcc_ptr = 0;
1451 bcc_ptr++;
1452 }
1453 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1454 } else {
1455 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1456 }
1457
1458
1459 sess_data->iov[2].iov_len = (long) bcc_ptr -
1460 (long) sess_data->iov[2].iov_base;
1461
1462 rc = sess_sendreceive(sess_data);
1463 if (rc)
1464 goto out;
1465
1466 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1467 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1468
1469 if (smb_buf->WordCount != 3) {
1470 rc = -EIO;
1471 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1472 goto out;
1473 }
1474
1475 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1476 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1477
1478 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1479 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1480
1481 bytes_remaining = get_bcc(smb_buf);
1482 bcc_ptr = pByteArea(smb_buf);
1483
1484 /* BB check if Unicode and decode strings */
1485 if (bytes_remaining == 0) {
1486 /* no string area to decode, do nothing */
1487 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1488 /* unicode string area must be word-aligned */
1489 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1490 ++bcc_ptr;
1491 --bytes_remaining;
1492 }
1493 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1494 sess_data->nls_cp);
1495 } else {
1496 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1497 sess_data->nls_cp);
1498 }
1499
1500 rc = sess_establish_session(sess_data);
1501 out:
1502 sess_data->result = rc;
1503 sess_data->func = NULL;
1504 sess_free_buffer(sess_data);
1505 kfree_sensitive(ses->auth_key.response);
1506 ses->auth_key.response = NULL;
1507 }
1508
1509 #ifdef CONFIG_CIFS_UPCALL
1510 static void
sess_auth_kerberos(struct sess_data * sess_data)1511 sess_auth_kerberos(struct sess_data *sess_data)
1512 {
1513 int rc = 0;
1514 struct smb_hdr *smb_buf;
1515 SESSION_SETUP_ANDX *pSMB;
1516 char *bcc_ptr;
1517 struct cifs_ses *ses = sess_data->ses;
1518 struct TCP_Server_Info *server = sess_data->server;
1519 __u32 capabilities;
1520 __u16 bytes_remaining;
1521 struct key *spnego_key = NULL;
1522 struct cifs_spnego_msg *msg;
1523 u16 blob_len;
1524
1525 /* extended security */
1526 /* wct = 12 */
1527 rc = sess_alloc_buffer(sess_data, 12);
1528 if (rc)
1529 goto out;
1530
1531 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1532 bcc_ptr = sess_data->iov[2].iov_base;
1533 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1534
1535 spnego_key = cifs_get_spnego_key(ses, server);
1536 if (IS_ERR(spnego_key)) {
1537 rc = PTR_ERR(spnego_key);
1538 spnego_key = NULL;
1539 goto out;
1540 }
1541
1542 msg = spnego_key->payload.data[0];
1543 /*
1544 * check version field to make sure that cifs.upcall is
1545 * sending us a response in an expected form
1546 */
1547 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1548 cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1549 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1550 rc = -EKEYREJECTED;
1551 goto out_put_spnego_key;
1552 }
1553
1554 kfree_sensitive(ses->auth_key.response);
1555 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1556 GFP_KERNEL);
1557 if (!ses->auth_key.response) {
1558 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1559 msg->sesskey_len);
1560 rc = -ENOMEM;
1561 goto out_put_spnego_key;
1562 }
1563 ses->auth_key.len = msg->sesskey_len;
1564
1565 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1566 capabilities |= CAP_EXTENDED_SECURITY;
1567 pSMB->req.Capabilities = cpu_to_le32(capabilities);
1568 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1569 sess_data->iov[1].iov_len = msg->secblob_len;
1570 pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1571
1572 if (ses->capabilities & CAP_UNICODE) {
1573 /* unicode strings must be word aligned */
1574 if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1575 *bcc_ptr = 0;
1576 bcc_ptr++;
1577 }
1578 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1579 unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1580 } else {
1581 /* BB: is this right? */
1582 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1583 }
1584
1585 sess_data->iov[2].iov_len = (long) bcc_ptr -
1586 (long) sess_data->iov[2].iov_base;
1587
1588 rc = sess_sendreceive(sess_data);
1589 if (rc)
1590 goto out_put_spnego_key;
1591
1592 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1593 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1594
1595 if (smb_buf->WordCount != 4) {
1596 rc = -EIO;
1597 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1598 goto out_put_spnego_key;
1599 }
1600
1601 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1602 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1603
1604 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1605 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1606
1607 bytes_remaining = get_bcc(smb_buf);
1608 bcc_ptr = pByteArea(smb_buf);
1609
1610 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1611 if (blob_len > bytes_remaining) {
1612 cifs_dbg(VFS, "bad security blob length %d\n",
1613 blob_len);
1614 rc = -EINVAL;
1615 goto out_put_spnego_key;
1616 }
1617 bcc_ptr += blob_len;
1618 bytes_remaining -= blob_len;
1619
1620 /* BB check if Unicode and decode strings */
1621 if (bytes_remaining == 0) {
1622 /* no string area to decode, do nothing */
1623 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1624 /* unicode string area must be word-aligned */
1625 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1626 ++bcc_ptr;
1627 --bytes_remaining;
1628 }
1629 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1630 sess_data->nls_cp);
1631 } else {
1632 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1633 sess_data->nls_cp);
1634 }
1635
1636 rc = sess_establish_session(sess_data);
1637 out_put_spnego_key:
1638 key_invalidate(spnego_key);
1639 key_put(spnego_key);
1640 out:
1641 sess_data->result = rc;
1642 sess_data->func = NULL;
1643 sess_free_buffer(sess_data);
1644 kfree_sensitive(ses->auth_key.response);
1645 ses->auth_key.response = NULL;
1646 }
1647
1648 #endif /* ! CONFIG_CIFS_UPCALL */
1649
1650 /*
1651 * The required kvec buffers have to be allocated before calling this
1652 * function.
1653 */
1654 static int
_sess_auth_rawntlmssp_assemble_req(struct sess_data * sess_data)1655 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1656 {
1657 SESSION_SETUP_ANDX *pSMB;
1658 struct cifs_ses *ses = sess_data->ses;
1659 struct TCP_Server_Info *server = sess_data->server;
1660 __u32 capabilities;
1661 char *bcc_ptr;
1662
1663 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1664
1665 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1666 if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) {
1667 cifs_dbg(VFS, "NTLMSSP requires Unicode support\n");
1668 return -ENOSYS;
1669 }
1670
1671 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1672 capabilities |= CAP_EXTENDED_SECURITY;
1673 pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1674
1675 bcc_ptr = sess_data->iov[2].iov_base;
1676 /* unicode strings must be word aligned */
1677 if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1678 *bcc_ptr = 0;
1679 bcc_ptr++;
1680 }
1681 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1682
1683 sess_data->iov[2].iov_len = (long) bcc_ptr -
1684 (long) sess_data->iov[2].iov_base;
1685
1686 return 0;
1687 }
1688
1689 static void
1690 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1691
1692 static void
sess_auth_rawntlmssp_negotiate(struct sess_data * sess_data)1693 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1694 {
1695 int rc;
1696 struct smb_hdr *smb_buf;
1697 SESSION_SETUP_ANDX *pSMB;
1698 struct cifs_ses *ses = sess_data->ses;
1699 struct TCP_Server_Info *server = sess_data->server;
1700 __u16 bytes_remaining;
1701 char *bcc_ptr;
1702 unsigned char *ntlmsspblob = NULL;
1703 u16 blob_len;
1704
1705 cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1706
1707 /*
1708 * if memory allocation is successful, caller of this function
1709 * frees it.
1710 */
1711 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1712 if (!ses->ntlmssp) {
1713 rc = -ENOMEM;
1714 goto out;
1715 }
1716 ses->ntlmssp->sesskey_per_smbsess = false;
1717
1718 /* wct = 12 */
1719 rc = sess_alloc_buffer(sess_data, 12);
1720 if (rc)
1721 goto out;
1722
1723 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1724
1725 /* Build security blob before we assemble the request */
1726 rc = build_ntlmssp_negotiate_blob(&ntlmsspblob,
1727 &blob_len, ses, server,
1728 sess_data->nls_cp);
1729 if (rc)
1730 goto out_free_ntlmsspblob;
1731
1732 sess_data->iov[1].iov_len = blob_len;
1733 sess_data->iov[1].iov_base = ntlmsspblob;
1734 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1735
1736 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1737 if (rc)
1738 goto out_free_ntlmsspblob;
1739
1740 rc = sess_sendreceive(sess_data);
1741
1742 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1743 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1744
1745 /* If true, rc here is expected and not an error */
1746 if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1747 smb_buf->Status.CifsError ==
1748 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1749 rc = 0;
1750
1751 if (rc)
1752 goto out_free_ntlmsspblob;
1753
1754 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1755
1756 if (smb_buf->WordCount != 4) {
1757 rc = -EIO;
1758 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1759 goto out_free_ntlmsspblob;
1760 }
1761
1762 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1763 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1764
1765 bytes_remaining = get_bcc(smb_buf);
1766 bcc_ptr = pByteArea(smb_buf);
1767
1768 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1769 if (blob_len > bytes_remaining) {
1770 cifs_dbg(VFS, "bad security blob length %d\n",
1771 blob_len);
1772 rc = -EINVAL;
1773 goto out_free_ntlmsspblob;
1774 }
1775
1776 rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1777
1778 out_free_ntlmsspblob:
1779 kfree_sensitive(ntlmsspblob);
1780 out:
1781 sess_free_buffer(sess_data);
1782
1783 if (!rc) {
1784 sess_data->func = sess_auth_rawntlmssp_authenticate;
1785 return;
1786 }
1787
1788 /* Else error. Cleanup */
1789 kfree_sensitive(ses->auth_key.response);
1790 ses->auth_key.response = NULL;
1791 kfree_sensitive(ses->ntlmssp);
1792 ses->ntlmssp = NULL;
1793
1794 sess_data->func = NULL;
1795 sess_data->result = rc;
1796 }
1797
1798 static void
sess_auth_rawntlmssp_authenticate(struct sess_data * sess_data)1799 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1800 {
1801 int rc;
1802 struct smb_hdr *smb_buf;
1803 SESSION_SETUP_ANDX *pSMB;
1804 struct cifs_ses *ses = sess_data->ses;
1805 struct TCP_Server_Info *server = sess_data->server;
1806 __u16 bytes_remaining;
1807 char *bcc_ptr;
1808 unsigned char *ntlmsspblob = NULL;
1809 u16 blob_len;
1810
1811 cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1812
1813 /* wct = 12 */
1814 rc = sess_alloc_buffer(sess_data, 12);
1815 if (rc)
1816 goto out;
1817
1818 /* Build security blob before we assemble the request */
1819 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1820 smb_buf = (struct smb_hdr *)pSMB;
1821 rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1822 &blob_len, ses, server,
1823 sess_data->nls_cp);
1824 if (rc)
1825 goto out_free_ntlmsspblob;
1826 sess_data->iov[1].iov_len = blob_len;
1827 sess_data->iov[1].iov_base = ntlmsspblob;
1828 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1829 /*
1830 * Make sure that we tell the server that we are using
1831 * the uid that it just gave us back on the response
1832 * (challenge)
1833 */
1834 smb_buf->Uid = ses->Suid;
1835
1836 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1837 if (rc)
1838 goto out_free_ntlmsspblob;
1839
1840 rc = sess_sendreceive(sess_data);
1841 if (rc)
1842 goto out_free_ntlmsspblob;
1843
1844 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1845 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1846 if (smb_buf->WordCount != 4) {
1847 rc = -EIO;
1848 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1849 goto out_free_ntlmsspblob;
1850 }
1851
1852 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1853 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1854
1855 if (ses->Suid != smb_buf->Uid) {
1856 ses->Suid = smb_buf->Uid;
1857 cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1858 }
1859
1860 bytes_remaining = get_bcc(smb_buf);
1861 bcc_ptr = pByteArea(smb_buf);
1862 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1863 if (blob_len > bytes_remaining) {
1864 cifs_dbg(VFS, "bad security blob length %d\n",
1865 blob_len);
1866 rc = -EINVAL;
1867 goto out_free_ntlmsspblob;
1868 }
1869 bcc_ptr += blob_len;
1870 bytes_remaining -= blob_len;
1871
1872
1873 /* BB check if Unicode and decode strings */
1874 if (bytes_remaining == 0) {
1875 /* no string area to decode, do nothing */
1876 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1877 /* unicode string area must be word-aligned */
1878 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1879 ++bcc_ptr;
1880 --bytes_remaining;
1881 }
1882 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1883 sess_data->nls_cp);
1884 } else {
1885 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1886 sess_data->nls_cp);
1887 }
1888
1889 out_free_ntlmsspblob:
1890 kfree_sensitive(ntlmsspblob);
1891 out:
1892 sess_free_buffer(sess_data);
1893
1894 if (!rc)
1895 rc = sess_establish_session(sess_data);
1896
1897 /* Cleanup */
1898 kfree_sensitive(ses->auth_key.response);
1899 ses->auth_key.response = NULL;
1900 kfree_sensitive(ses->ntlmssp);
1901 ses->ntlmssp = NULL;
1902
1903 sess_data->func = NULL;
1904 sess_data->result = rc;
1905 }
1906
select_sec(struct sess_data * sess_data)1907 static int select_sec(struct sess_data *sess_data)
1908 {
1909 int type;
1910 struct cifs_ses *ses = sess_data->ses;
1911 struct TCP_Server_Info *server = sess_data->server;
1912
1913 type = cifs_select_sectype(server, ses->sectype);
1914 cifs_dbg(FYI, "sess setup type %d\n", type);
1915 if (type == Unspecified) {
1916 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1917 return -EINVAL;
1918 }
1919
1920 switch (type) {
1921 case NTLMv2:
1922 sess_data->func = sess_auth_ntlmv2;
1923 break;
1924 case Kerberos:
1925 #ifdef CONFIG_CIFS_UPCALL
1926 sess_data->func = sess_auth_kerberos;
1927 break;
1928 #else
1929 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1930 return -ENOSYS;
1931 #endif /* CONFIG_CIFS_UPCALL */
1932 case RawNTLMSSP:
1933 sess_data->func = sess_auth_rawntlmssp_negotiate;
1934 break;
1935 default:
1936 cifs_dbg(VFS, "secType %d not supported!\n", type);
1937 return -ENOSYS;
1938 }
1939
1940 return 0;
1941 }
1942
CIFS_SessSetup(const unsigned int xid,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1943 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
1944 struct TCP_Server_Info *server,
1945 const struct nls_table *nls_cp)
1946 {
1947 int rc = 0;
1948 struct sess_data *sess_data;
1949
1950 if (ses == NULL) {
1951 WARN(1, "%s: ses == NULL!", __func__);
1952 return -EINVAL;
1953 }
1954
1955 sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
1956 if (!sess_data)
1957 return -ENOMEM;
1958
1959 sess_data->xid = xid;
1960 sess_data->ses = ses;
1961 sess_data->server = server;
1962 sess_data->buf0_type = CIFS_NO_BUFFER;
1963 sess_data->nls_cp = (struct nls_table *) nls_cp;
1964
1965 rc = select_sec(sess_data);
1966 if (rc)
1967 goto out;
1968
1969 while (sess_data->func)
1970 sess_data->func(sess_data);
1971
1972 /* Store result before we free sess_data */
1973 rc = sess_data->result;
1974
1975 out:
1976 kfree_sensitive(sess_data);
1977 return rc;
1978 }
1979 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
1980