1 /*
2 * fs/cifs/sess.c
3 *
4 * SMB/CIFS session setup handling routines
5 *
6 * Copyright (c) International Business Machines Corp., 2006, 2009
7 * Author(s): Steve French (sfrench@us.ibm.com)
8 *
9 * This library is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU Lesser General Public License as published
11 * by the Free Software Foundation; either version 2.1 of the License, or
12 * (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
17 * the GNU Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public License
20 * along with this library; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 */
23
24 #include "cifspdu.h"
25 #include "cifsglob.h"
26 #include "cifsproto.h"
27 #include "cifs_unicode.h"
28 #include "cifs_debug.h"
29 #include "ntlmssp.h"
30 #include "nterr.h"
31 #include <linux/utsname.h>
32 #include <linux/slab.h>
33 #include "cifs_spnego.h"
34 #include "smb2proto.h"
35
36 bool
is_server_using_iface(struct TCP_Server_Info * server,struct cifs_server_iface * iface)37 is_server_using_iface(struct TCP_Server_Info *server,
38 struct cifs_server_iface *iface)
39 {
40 struct sockaddr_in *i4 = (struct sockaddr_in *)&iface->sockaddr;
41 struct sockaddr_in6 *i6 = (struct sockaddr_in6 *)&iface->sockaddr;
42 struct sockaddr_in *s4 = (struct sockaddr_in *)&server->dstaddr;
43 struct sockaddr_in6 *s6 = (struct sockaddr_in6 *)&server->dstaddr;
44
45 if (server->dstaddr.ss_family != iface->sockaddr.ss_family)
46 return false;
47 if (server->dstaddr.ss_family == AF_INET) {
48 if (s4->sin_addr.s_addr != i4->sin_addr.s_addr)
49 return false;
50 } else if (server->dstaddr.ss_family == AF_INET6) {
51 if (memcmp(&s6->sin6_addr, &i6->sin6_addr,
52 sizeof(i6->sin6_addr)) != 0)
53 return false;
54 } else {
55 /* unknown family.. */
56 return false;
57 }
58 return true;
59 }
60
is_ses_using_iface(struct cifs_ses * ses,struct cifs_server_iface * iface)61 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
62 {
63 int i;
64
65 for (i = 0; i < ses->chan_count; i++) {
66 if (is_server_using_iface(ses->chans[i].server, iface))
67 return true;
68 }
69 return false;
70 }
71
72 /* returns number of channels added */
cifs_try_adding_channels(struct cifs_ses * ses)73 int cifs_try_adding_channels(struct cifs_ses *ses)
74 {
75 int old_chan_count = ses->chan_count;
76 int left = ses->chan_max - ses->chan_count;
77 int i = 0;
78 int rc = 0;
79 int tries = 0;
80 struct cifs_server_iface *ifaces = NULL;
81 size_t iface_count;
82
83 if (left <= 0) {
84 cifs_dbg(FYI,
85 "ses already at max_channels (%zu), nothing to open\n",
86 ses->chan_max);
87 return 0;
88 }
89
90 if (ses->server->dialect < SMB30_PROT_ID) {
91 cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
92 return 0;
93 }
94
95 if (!(ses->server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
96 cifs_dbg(VFS, "server %s does not support multichannel\n", ses->server->hostname);
97 ses->chan_max = 1;
98 return 0;
99 }
100
101 /*
102 * Make a copy of the iface list at the time and use that
103 * instead so as to not hold the iface spinlock for opening
104 * channels
105 */
106 spin_lock(&ses->iface_lock);
107 iface_count = ses->iface_count;
108 if (iface_count <= 0) {
109 spin_unlock(&ses->iface_lock);
110 cifs_dbg(VFS, "no iface list available to open channels\n");
111 return 0;
112 }
113 ifaces = kmemdup(ses->iface_list, iface_count*sizeof(*ifaces),
114 GFP_ATOMIC);
115 if (!ifaces) {
116 spin_unlock(&ses->iface_lock);
117 return 0;
118 }
119 spin_unlock(&ses->iface_lock);
120
121 /*
122 * Keep connecting to same, fastest, iface for all channels as
123 * long as its RSS. Try next fastest one if not RSS or channel
124 * creation fails.
125 */
126 while (left > 0) {
127 struct cifs_server_iface *iface;
128
129 tries++;
130 if (tries > 3*ses->chan_max) {
131 cifs_dbg(FYI, "too many channel open attempts (%d channels left to open)\n",
132 left);
133 break;
134 }
135
136 iface = &ifaces[i];
137 if (is_ses_using_iface(ses, iface) && !iface->rss_capable) {
138 i = (i+1) % iface_count;
139 continue;
140 }
141
142 rc = cifs_ses_add_channel(ses, iface);
143 if (rc) {
144 cifs_dbg(FYI, "failed to open extra channel on iface#%d rc=%d\n",
145 i, rc);
146 i = (i+1) % iface_count;
147 continue;
148 }
149
150 cifs_dbg(FYI, "successfully opened new channel on iface#%d\n",
151 i);
152 left--;
153 }
154
155 kfree(ifaces);
156 return ses->chan_count - old_chan_count;
157 }
158
159 /*
160 * If server is a channel of ses, return the corresponding enclosing
161 * cifs_chan otherwise return NULL.
162 */
163 struct cifs_chan *
cifs_ses_find_chan(struct cifs_ses * ses,struct TCP_Server_Info * server)164 cifs_ses_find_chan(struct cifs_ses *ses, struct TCP_Server_Info *server)
165 {
166 int i;
167
168 for (i = 0; i < ses->chan_count; i++) {
169 if (ses->chans[i].server == server)
170 return &ses->chans[i];
171 }
172 return NULL;
173 }
174
175 int
cifs_ses_add_channel(struct cifs_ses * ses,struct cifs_server_iface * iface)176 cifs_ses_add_channel(struct cifs_ses *ses, struct cifs_server_iface *iface)
177 {
178 struct cifs_chan *chan;
179 struct smb_vol vol = {NULL};
180 static const char unc_fmt[] = "\\%s\\foo";
181 char unc[sizeof(unc_fmt)+SERVER_NAME_LEN_WITH_NULL] = {0};
182 struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
183 struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
184 int rc;
185 unsigned int xid = get_xid();
186
187 if (iface->sockaddr.ss_family == AF_INET)
188 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
189 ses, iface->speed, iface->rdma_capable ? "yes" : "no",
190 &ipv4->sin_addr);
191 else
192 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
193 ses, iface->speed, iface->rdma_capable ? "yes" : "no",
194 &ipv6->sin6_addr);
195
196 /*
197 * Setup a smb_vol with mostly the same info as the existing
198 * session and overwrite it with the requested iface data.
199 *
200 * We need to setup at least the fields used for negprot and
201 * sesssetup.
202 *
203 * We only need the volume here, so we can reuse memory from
204 * the session and server without caring about memory
205 * management.
206 */
207
208 /* Always make new connection for now (TODO?) */
209 vol.nosharesock = true;
210
211 /* Auth */
212 vol.domainauto = ses->domainAuto;
213 vol.domainname = ses->domainName;
214 vol.username = ses->user_name;
215 vol.password = ses->password;
216 vol.sectype = ses->sectype;
217 vol.sign = ses->sign;
218
219 /* UNC and paths */
220 /* XXX: Use ses->server->hostname? */
221 sprintf(unc, unc_fmt, ses->serverName);
222 vol.UNC = unc;
223 vol.prepath = "";
224
225 /* Reuse same version as master connection */
226 vol.vals = ses->server->vals;
227 vol.ops = ses->server->ops;
228
229 vol.noblocksnd = ses->server->noblocksnd;
230 vol.noautotune = ses->server->noautotune;
231 vol.sockopt_tcp_nodelay = ses->server->tcp_nodelay;
232 vol.echo_interval = ses->server->echo_interval / HZ;
233 vol.max_credits = ses->server->max_credits;
234
235 /*
236 * This will be used for encoding/decoding user/domain/pw
237 * during sess setup auth.
238 *
239 * XXX: We use the default for simplicity but the proper way
240 * would be to use the one that ses used, which is not
241 * stored. This might break when dealing with non-ascii
242 * strings.
243 */
244 vol.local_nls = load_nls_default();
245
246 /* Use RDMA if possible */
247 vol.rdma = iface->rdma_capable;
248 memcpy(&vol.dstaddr, &iface->sockaddr, sizeof(struct sockaddr_storage));
249
250 /* reuse master con client guid */
251 memcpy(&vol.client_guid, ses->server->client_guid,
252 SMB2_CLIENT_GUID_SIZE);
253 vol.use_client_guid = true;
254
255 mutex_lock(&ses->session_mutex);
256
257 chan = ses->binding_chan = &ses->chans[ses->chan_count];
258 chan->server = cifs_get_tcp_session(&vol);
259 if (IS_ERR(chan->server)) {
260 rc = PTR_ERR(chan->server);
261 chan->server = NULL;
262 goto out;
263 }
264 spin_lock(&cifs_tcp_ses_lock);
265 chan->server->is_channel = true;
266 spin_unlock(&cifs_tcp_ses_lock);
267
268 /*
269 * We need to allocate the server crypto now as we will need
270 * to sign packets before we generate the channel signing key
271 * (we sign with the session key)
272 */
273 rc = smb311_crypto_shash_allocate(chan->server);
274 if (rc) {
275 cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
276 goto out;
277 }
278
279 ses->binding = true;
280 rc = cifs_negotiate_protocol(xid, ses);
281 if (rc)
282 goto out;
283
284 rc = cifs_setup_session(xid, ses, vol.local_nls);
285 if (rc)
286 goto out;
287
288 /* success, put it on the list
289 * XXX: sharing ses between 2 tcp servers is not possible, the
290 * way "internal" linked lists works in linux makes element
291 * only able to belong to one list
292 *
293 * the binding session is already established so the rest of
294 * the code should be able to look it up, no need to add the
295 * ses to the new server.
296 */
297
298 ses->chan_count++;
299 atomic_set(&ses->chan_seq, 0);
300 out:
301 ses->binding = false;
302 ses->binding_chan = NULL;
303 mutex_unlock(&ses->session_mutex);
304
305 if (rc && chan->server)
306 cifs_put_tcp_session(chan->server, 0);
307 unload_nls(vol.local_nls);
308
309 return rc;
310 }
311
cifs_ssetup_hdr(struct cifs_ses * ses,SESSION_SETUP_ANDX * pSMB)312 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses, SESSION_SETUP_ANDX *pSMB)
313 {
314 __u32 capabilities = 0;
315
316 /* init fields common to all four types of SessSetup */
317 /* Note that offsets for first seven fields in req struct are same */
318 /* in CIFS Specs so does not matter which of 3 forms of struct */
319 /* that we use in next few lines */
320 /* Note that header is initialized to zero in header_assemble */
321 pSMB->req.AndXCommand = 0xFF;
322 pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
323 CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
324 USHRT_MAX));
325 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
326 pSMB->req.VcNumber = cpu_to_le16(1);
327
328 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
329
330 /* BB verify whether signing required on neg or just on auth frame
331 (and NTLM case) */
332
333 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
334 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
335
336 if (ses->server->sign)
337 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
338
339 if (ses->capabilities & CAP_UNICODE) {
340 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
341 capabilities |= CAP_UNICODE;
342 }
343 if (ses->capabilities & CAP_STATUS32) {
344 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
345 capabilities |= CAP_STATUS32;
346 }
347 if (ses->capabilities & CAP_DFS) {
348 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
349 capabilities |= CAP_DFS;
350 }
351 if (ses->capabilities & CAP_UNIX)
352 capabilities |= CAP_UNIX;
353
354 return capabilities;
355 }
356
357 static void
unicode_oslm_strings(char ** pbcc_area,const struct nls_table * nls_cp)358 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
359 {
360 char *bcc_ptr = *pbcc_area;
361 int bytes_ret = 0;
362
363 /* Copy OS version */
364 bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
365 nls_cp);
366 bcc_ptr += 2 * bytes_ret;
367 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
368 32, nls_cp);
369 bcc_ptr += 2 * bytes_ret;
370 bcc_ptr += 2; /* trailing null */
371
372 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
373 32, nls_cp);
374 bcc_ptr += 2 * bytes_ret;
375 bcc_ptr += 2; /* trailing null */
376
377 *pbcc_area = bcc_ptr;
378 }
379
unicode_domain_string(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)380 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
381 const struct nls_table *nls_cp)
382 {
383 char *bcc_ptr = *pbcc_area;
384 int bytes_ret = 0;
385
386 /* copy domain */
387 if (ses->domainName == NULL) {
388 /* Sending null domain better than using a bogus domain name (as
389 we did briefly in 2.6.18) since server will use its default */
390 *bcc_ptr = 0;
391 *(bcc_ptr+1) = 0;
392 bytes_ret = 0;
393 } else
394 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
395 CIFS_MAX_DOMAINNAME_LEN, nls_cp);
396 bcc_ptr += 2 * bytes_ret;
397 bcc_ptr += 2; /* account for null terminator */
398
399 *pbcc_area = bcc_ptr;
400 }
401
402
unicode_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)403 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
404 const struct nls_table *nls_cp)
405 {
406 char *bcc_ptr = *pbcc_area;
407 int bytes_ret = 0;
408
409 /* BB FIXME add check that strings total less
410 than 335 or will need to send them as arrays */
411
412 /* unicode strings, must be word aligned before the call */
413 /* if ((long) bcc_ptr % 2) {
414 *bcc_ptr = 0;
415 bcc_ptr++;
416 } */
417 /* copy user */
418 if (ses->user_name == NULL) {
419 /* null user mount */
420 *bcc_ptr = 0;
421 *(bcc_ptr+1) = 0;
422 } else {
423 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
424 CIFS_MAX_USERNAME_LEN, nls_cp);
425 }
426 bcc_ptr += 2 * bytes_ret;
427 bcc_ptr += 2; /* account for null termination */
428
429 unicode_domain_string(&bcc_ptr, ses, nls_cp);
430 unicode_oslm_strings(&bcc_ptr, nls_cp);
431
432 *pbcc_area = bcc_ptr;
433 }
434
ascii_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)435 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
436 const struct nls_table *nls_cp)
437 {
438 char *bcc_ptr = *pbcc_area;
439 int len;
440
441 /* copy user */
442 /* BB what about null user mounts - check that we do this BB */
443 /* copy user */
444 if (ses->user_name != NULL) {
445 len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
446 if (WARN_ON_ONCE(len < 0))
447 len = CIFS_MAX_USERNAME_LEN - 1;
448 bcc_ptr += len;
449 }
450 /* else null user mount */
451 *bcc_ptr = 0;
452 bcc_ptr++; /* account for null termination */
453
454 /* copy domain */
455 if (ses->domainName != NULL) {
456 len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
457 if (WARN_ON_ONCE(len < 0))
458 len = CIFS_MAX_DOMAINNAME_LEN - 1;
459 bcc_ptr += len;
460 } /* else we will send a null domain name
461 so the server will default to its own domain */
462 *bcc_ptr = 0;
463 bcc_ptr++;
464
465 /* BB check for overflow here */
466
467 strcpy(bcc_ptr, "Linux version ");
468 bcc_ptr += strlen("Linux version ");
469 strcpy(bcc_ptr, init_utsname()->release);
470 bcc_ptr += strlen(init_utsname()->release) + 1;
471
472 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
473 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
474
475 *pbcc_area = bcc_ptr;
476 }
477
478 static void
decode_unicode_ssetup(char ** pbcc_area,int bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)479 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
480 const struct nls_table *nls_cp)
481 {
482 int len;
483 char *data = *pbcc_area;
484
485 cifs_dbg(FYI, "bleft %d\n", bleft);
486
487 kfree(ses->serverOS);
488 ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
489 cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
490 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
491 data += len;
492 bleft -= len;
493 if (bleft <= 0)
494 return;
495
496 kfree(ses->serverNOS);
497 ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
498 cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
499 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
500 data += len;
501 bleft -= len;
502 if (bleft <= 0)
503 return;
504
505 kfree(ses->serverDomain);
506 ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
507 cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
508
509 return;
510 }
511
decode_ascii_ssetup(char ** pbcc_area,__u16 bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)512 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
513 struct cifs_ses *ses,
514 const struct nls_table *nls_cp)
515 {
516 int len;
517 char *bcc_ptr = *pbcc_area;
518
519 cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
520
521 len = strnlen(bcc_ptr, bleft);
522 if (len >= bleft)
523 return;
524
525 kfree(ses->serverOS);
526
527 ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
528 if (ses->serverOS) {
529 memcpy(ses->serverOS, bcc_ptr, len);
530 ses->serverOS[len] = 0;
531 if (strncmp(ses->serverOS, "OS/2", 4) == 0)
532 cifs_dbg(FYI, "OS/2 server\n");
533 }
534
535 bcc_ptr += len + 1;
536 bleft -= len + 1;
537
538 len = strnlen(bcc_ptr, bleft);
539 if (len >= bleft)
540 return;
541
542 kfree(ses->serverNOS);
543
544 ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
545 if (ses->serverNOS) {
546 memcpy(ses->serverNOS, bcc_ptr, len);
547 ses->serverNOS[len] = 0;
548 }
549
550 bcc_ptr += len + 1;
551 bleft -= len + 1;
552
553 len = strnlen(bcc_ptr, bleft);
554 if (len > bleft)
555 return;
556
557 /* No domain field in LANMAN case. Domain is
558 returned by old servers in the SMB negprot response */
559 /* BB For newer servers which do not support Unicode,
560 but thus do return domain here we could add parsing
561 for it later, but it is not very important */
562 cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
563 }
564
decode_ntlmssp_challenge(char * bcc_ptr,int blob_len,struct cifs_ses * ses)565 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
566 struct cifs_ses *ses)
567 {
568 unsigned int tioffset; /* challenge message target info area */
569 unsigned int tilen; /* challenge message target info area length */
570
571 CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
572
573 if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
574 cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
575 return -EINVAL;
576 }
577
578 if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
579 cifs_dbg(VFS, "blob signature incorrect %s\n",
580 pblob->Signature);
581 return -EINVAL;
582 }
583 if (pblob->MessageType != NtLmChallenge) {
584 cifs_dbg(VFS, "Incorrect message type %d\n",
585 pblob->MessageType);
586 return -EINVAL;
587 }
588
589 memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
590 /* BB we could decode pblob->NegotiateFlags; some may be useful */
591 /* In particular we can examine sign flags */
592 /* BB spec says that if AvId field of MsvAvTimestamp is populated then
593 we must set the MIC field of the AUTHENTICATE_MESSAGE */
594 ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags);
595 tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
596 tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
597 if (tioffset > blob_len || tioffset + tilen > blob_len) {
598 cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
599 tioffset, tilen);
600 return -EINVAL;
601 }
602 if (tilen) {
603 ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
604 GFP_KERNEL);
605 if (!ses->auth_key.response) {
606 cifs_dbg(VFS, "Challenge target info alloc failure\n");
607 return -ENOMEM;
608 }
609 ses->auth_key.len = tilen;
610 }
611
612 return 0;
613 }
614
615 /* BB Move to ntlmssp.c eventually */
616
617 /* We do not malloc the blob, it is passed in pbuffer, because
618 it is fixed size, and small, making this approach cleaner */
build_ntlmssp_negotiate_blob(unsigned char * pbuffer,struct cifs_ses * ses)619 void build_ntlmssp_negotiate_blob(unsigned char *pbuffer,
620 struct cifs_ses *ses)
621 {
622 struct TCP_Server_Info *server = cifs_ses_server(ses);
623 NEGOTIATE_MESSAGE *sec_blob = (NEGOTIATE_MESSAGE *)pbuffer;
624 __u32 flags;
625
626 memset(pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
627 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
628 sec_blob->MessageType = NtLmNegotiate;
629
630 /* BB is NTLMV2 session security format easier to use here? */
631 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
632 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
633 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
634 NTLMSSP_NEGOTIATE_SEAL;
635 if (server->sign)
636 flags |= NTLMSSP_NEGOTIATE_SIGN;
637 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
638 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
639
640 sec_blob->NegotiateFlags = cpu_to_le32(flags);
641
642 sec_blob->WorkstationName.BufferOffset = 0;
643 sec_blob->WorkstationName.Length = 0;
644 sec_blob->WorkstationName.MaximumLength = 0;
645
646 /* Domain name is sent on the Challenge not Negotiate NTLMSSP request */
647 sec_blob->DomainName.BufferOffset = 0;
648 sec_blob->DomainName.Length = 0;
649 sec_blob->DomainName.MaximumLength = 0;
650 }
651
size_of_ntlmssp_blob(struct cifs_ses * ses)652 static int size_of_ntlmssp_blob(struct cifs_ses *ses)
653 {
654 int sz = sizeof(AUTHENTICATE_MESSAGE) + ses->auth_key.len
655 - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
656
657 if (ses->domainName)
658 sz += 2 * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
659 else
660 sz += 2;
661
662 if (ses->user_name)
663 sz += 2 * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
664 else
665 sz += 2;
666
667 return sz;
668 }
669
build_ntlmssp_auth_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,const struct nls_table * nls_cp)670 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
671 u16 *buflen,
672 struct cifs_ses *ses,
673 const struct nls_table *nls_cp)
674 {
675 int rc;
676 AUTHENTICATE_MESSAGE *sec_blob;
677 __u32 flags;
678 unsigned char *tmp;
679
680 rc = setup_ntlmv2_rsp(ses, nls_cp);
681 if (rc) {
682 cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
683 *buflen = 0;
684 goto setup_ntlmv2_ret;
685 }
686 *pbuffer = kmalloc(size_of_ntlmssp_blob(ses), GFP_KERNEL);
687 if (!*pbuffer) {
688 rc = -ENOMEM;
689 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
690 *buflen = 0;
691 goto setup_ntlmv2_ret;
692 }
693 sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
694
695 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
696 sec_blob->MessageType = NtLmAuthenticate;
697
698 flags = NTLMSSP_NEGOTIATE_56 |
699 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_TARGET_INFO |
700 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
701 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
702 NTLMSSP_NEGOTIATE_SEAL;
703 if (ses->server->sign)
704 flags |= NTLMSSP_NEGOTIATE_SIGN;
705 if (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
706 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
707
708 tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
709 sec_blob->NegotiateFlags = cpu_to_le32(flags);
710
711 sec_blob->LmChallengeResponse.BufferOffset =
712 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
713 sec_blob->LmChallengeResponse.Length = 0;
714 sec_blob->LmChallengeResponse.MaximumLength = 0;
715
716 sec_blob->NtChallengeResponse.BufferOffset =
717 cpu_to_le32(tmp - *pbuffer);
718 if (ses->user_name != NULL) {
719 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
720 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
721 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
722
723 sec_blob->NtChallengeResponse.Length =
724 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
725 sec_blob->NtChallengeResponse.MaximumLength =
726 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
727 } else {
728 /*
729 * don't send an NT Response for anonymous access
730 */
731 sec_blob->NtChallengeResponse.Length = 0;
732 sec_blob->NtChallengeResponse.MaximumLength = 0;
733 }
734
735 if (ses->domainName == NULL) {
736 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
737 sec_blob->DomainName.Length = 0;
738 sec_blob->DomainName.MaximumLength = 0;
739 tmp += 2;
740 } else {
741 int len;
742 len = cifs_strtoUTF16((__le16 *)tmp, ses->domainName,
743 CIFS_MAX_DOMAINNAME_LEN, nls_cp);
744 len *= 2; /* unicode is 2 bytes each */
745 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
746 sec_blob->DomainName.Length = cpu_to_le16(len);
747 sec_blob->DomainName.MaximumLength = cpu_to_le16(len);
748 tmp += len;
749 }
750
751 if (ses->user_name == NULL) {
752 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
753 sec_blob->UserName.Length = 0;
754 sec_blob->UserName.MaximumLength = 0;
755 tmp += 2;
756 } else {
757 int len;
758 len = cifs_strtoUTF16((__le16 *)tmp, ses->user_name,
759 CIFS_MAX_USERNAME_LEN, nls_cp);
760 len *= 2; /* unicode is 2 bytes each */
761 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
762 sec_blob->UserName.Length = cpu_to_le16(len);
763 sec_blob->UserName.MaximumLength = cpu_to_le16(len);
764 tmp += len;
765 }
766
767 sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
768 sec_blob->WorkstationName.Length = 0;
769 sec_blob->WorkstationName.MaximumLength = 0;
770 tmp += 2;
771
772 if (((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) ||
773 (ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC))
774 && !calc_seckey(ses)) {
775 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
776 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
777 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
778 sec_blob->SessionKey.MaximumLength =
779 cpu_to_le16(CIFS_CPHTXT_SIZE);
780 tmp += CIFS_CPHTXT_SIZE;
781 } else {
782 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
783 sec_blob->SessionKey.Length = 0;
784 sec_blob->SessionKey.MaximumLength = 0;
785 }
786
787 *buflen = tmp - *pbuffer;
788 setup_ntlmv2_ret:
789 return rc;
790 }
791
792 enum securityEnum
cifs_select_sectype(struct TCP_Server_Info * server,enum securityEnum requested)793 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
794 {
795 switch (server->negflavor) {
796 case CIFS_NEGFLAVOR_EXTENDED:
797 switch (requested) {
798 case Kerberos:
799 case RawNTLMSSP:
800 return requested;
801 case Unspecified:
802 if (server->sec_ntlmssp &&
803 (global_secflags & CIFSSEC_MAY_NTLMSSP))
804 return RawNTLMSSP;
805 if ((server->sec_kerberos || server->sec_mskerberos) &&
806 (global_secflags & CIFSSEC_MAY_KRB5))
807 return Kerberos;
808 fallthrough;
809 default:
810 return Unspecified;
811 }
812 case CIFS_NEGFLAVOR_UNENCAP:
813 switch (requested) {
814 case NTLM:
815 case NTLMv2:
816 return requested;
817 case Unspecified:
818 if (global_secflags & CIFSSEC_MAY_NTLMV2)
819 return NTLMv2;
820 if (global_secflags & CIFSSEC_MAY_NTLM)
821 return NTLM;
822 default:
823 break;
824 }
825 fallthrough; /* to attempt LANMAN authentication next */
826 case CIFS_NEGFLAVOR_LANMAN:
827 switch (requested) {
828 case LANMAN:
829 return requested;
830 case Unspecified:
831 if (global_secflags & CIFSSEC_MAY_LANMAN)
832 return LANMAN;
833 fallthrough;
834 default:
835 return Unspecified;
836 }
837 default:
838 return Unspecified;
839 }
840 }
841
842 struct sess_data {
843 unsigned int xid;
844 struct cifs_ses *ses;
845 struct nls_table *nls_cp;
846 void (*func)(struct sess_data *);
847 int result;
848
849 /* we will send the SMB in three pieces:
850 * a fixed length beginning part, an optional
851 * SPNEGO blob (which can be zero length), and a
852 * last part which will include the strings
853 * and rest of bcc area. This allows us to avoid
854 * a large buffer 17K allocation
855 */
856 int buf0_type;
857 struct kvec iov[3];
858 };
859
860 static int
sess_alloc_buffer(struct sess_data * sess_data,int wct)861 sess_alloc_buffer(struct sess_data *sess_data, int wct)
862 {
863 int rc;
864 struct cifs_ses *ses = sess_data->ses;
865 struct smb_hdr *smb_buf;
866
867 rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
868 (void **)&smb_buf);
869
870 if (rc)
871 return rc;
872
873 sess_data->iov[0].iov_base = (char *)smb_buf;
874 sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
875 /*
876 * This variable will be used to clear the buffer
877 * allocated above in case of any error in the calling function.
878 */
879 sess_data->buf0_type = CIFS_SMALL_BUFFER;
880
881 /* 2000 big enough to fit max user, domain, NOS name etc. */
882 sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
883 if (!sess_data->iov[2].iov_base) {
884 rc = -ENOMEM;
885 goto out_free_smb_buf;
886 }
887
888 return 0;
889
890 out_free_smb_buf:
891 cifs_small_buf_release(smb_buf);
892 sess_data->iov[0].iov_base = NULL;
893 sess_data->iov[0].iov_len = 0;
894 sess_data->buf0_type = CIFS_NO_BUFFER;
895 return rc;
896 }
897
898 static void
sess_free_buffer(struct sess_data * sess_data)899 sess_free_buffer(struct sess_data *sess_data)
900 {
901
902 free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
903 sess_data->buf0_type = CIFS_NO_BUFFER;
904 kfree(sess_data->iov[2].iov_base);
905 }
906
907 static int
sess_establish_session(struct sess_data * sess_data)908 sess_establish_session(struct sess_data *sess_data)
909 {
910 struct cifs_ses *ses = sess_data->ses;
911
912 mutex_lock(&ses->server->srv_mutex);
913 if (!ses->server->session_estab) {
914 if (ses->server->sign) {
915 ses->server->session_key.response =
916 kmemdup(ses->auth_key.response,
917 ses->auth_key.len, GFP_KERNEL);
918 if (!ses->server->session_key.response) {
919 mutex_unlock(&ses->server->srv_mutex);
920 return -ENOMEM;
921 }
922 ses->server->session_key.len =
923 ses->auth_key.len;
924 }
925 ses->server->sequence_number = 0x2;
926 ses->server->session_estab = true;
927 }
928 mutex_unlock(&ses->server->srv_mutex);
929
930 cifs_dbg(FYI, "CIFS session established successfully\n");
931 spin_lock(&GlobalMid_Lock);
932 ses->status = CifsGood;
933 ses->need_reconnect = false;
934 spin_unlock(&GlobalMid_Lock);
935
936 return 0;
937 }
938
939 static int
sess_sendreceive(struct sess_data * sess_data)940 sess_sendreceive(struct sess_data *sess_data)
941 {
942 int rc;
943 struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
944 __u16 count;
945 struct kvec rsp_iov = { NULL, 0 };
946
947 count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
948 be32_add_cpu(&smb_buf->smb_buf_length, count);
949 put_bcc(count, smb_buf);
950
951 rc = SendReceive2(sess_data->xid, sess_data->ses,
952 sess_data->iov, 3 /* num_iovecs */,
953 &sess_data->buf0_type,
954 CIFS_LOG_ERROR, &rsp_iov);
955 cifs_small_buf_release(sess_data->iov[0].iov_base);
956 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
957
958 return rc;
959 }
960
961 /*
962 * LANMAN and plaintext are less secure and off by default.
963 * So we make this explicitly be turned on in kconfig (in the
964 * build) and turned on at runtime (changed from the default)
965 * in proc/fs/cifs or via mount parm. Unfortunately this is
966 * needed for old Win (e.g. Win95), some obscure NAS and OS/2
967 */
968 #ifdef CONFIG_CIFS_WEAK_PW_HASH
969 static void
sess_auth_lanman(struct sess_data * sess_data)970 sess_auth_lanman(struct sess_data *sess_data)
971 {
972 int rc = 0;
973 struct smb_hdr *smb_buf;
974 SESSION_SETUP_ANDX *pSMB;
975 char *bcc_ptr;
976 struct cifs_ses *ses = sess_data->ses;
977 char lnm_session_key[CIFS_AUTH_RESP_SIZE];
978 __u16 bytes_remaining;
979
980 /* lanman 2 style sessionsetup */
981 /* wct = 10 */
982 rc = sess_alloc_buffer(sess_data, 10);
983 if (rc)
984 goto out;
985
986 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
987 bcc_ptr = sess_data->iov[2].iov_base;
988 (void)cifs_ssetup_hdr(ses, pSMB);
989
990 pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE;
991
992 if (ses->user_name != NULL) {
993 /* no capabilities flags in old lanman negotiation */
994 pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
995
996 /* Calculate hash with password and copy into bcc_ptr.
997 * Encryption Key (stored as in cryptkey) gets used if the
998 * security mode bit in Negotiate Protocol response states
999 * to use challenge/response method (i.e. Password bit is 1).
1000 */
1001 rc = calc_lanman_hash(ses->password, ses->server->cryptkey,
1002 ses->server->sec_mode & SECMODE_PW_ENCRYPT ?
1003 true : false, lnm_session_key);
1004 if (rc)
1005 goto out;
1006
1007 memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE);
1008 bcc_ptr += CIFS_AUTH_RESP_SIZE;
1009 } else {
1010 pSMB->old_req.PasswordLength = 0;
1011 }
1012
1013 /*
1014 * can not sign if LANMAN negotiated so no need
1015 * to calculate signing key? but what if server
1016 * changed to do higher than lanman dialect and
1017 * we reconnected would we ever calc signing_key?
1018 */
1019
1020 cifs_dbg(FYI, "Negotiating LANMAN setting up strings\n");
1021 /* Unicode not allowed for LANMAN dialects */
1022 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1023
1024 sess_data->iov[2].iov_len = (long) bcc_ptr -
1025 (long) sess_data->iov[2].iov_base;
1026
1027 rc = sess_sendreceive(sess_data);
1028 if (rc)
1029 goto out;
1030
1031 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1032 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1033
1034 /* lanman response has a word count of 3 */
1035 if (smb_buf->WordCount != 3) {
1036 rc = -EIO;
1037 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1038 goto out;
1039 }
1040
1041 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1042 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1043
1044 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1045 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1046
1047 bytes_remaining = get_bcc(smb_buf);
1048 bcc_ptr = pByteArea(smb_buf);
1049
1050 /* BB check if Unicode and decode strings */
1051 if (bytes_remaining == 0) {
1052 /* no string area to decode, do nothing */
1053 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1054 /* unicode string area must be word-aligned */
1055 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1056 ++bcc_ptr;
1057 --bytes_remaining;
1058 }
1059 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1060 sess_data->nls_cp);
1061 } else {
1062 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1063 sess_data->nls_cp);
1064 }
1065
1066 rc = sess_establish_session(sess_data);
1067 out:
1068 sess_data->result = rc;
1069 sess_data->func = NULL;
1070 sess_free_buffer(sess_data);
1071 }
1072
1073 #endif
1074
1075 static void
sess_auth_ntlm(struct sess_data * sess_data)1076 sess_auth_ntlm(struct sess_data *sess_data)
1077 {
1078 int rc = 0;
1079 struct smb_hdr *smb_buf;
1080 SESSION_SETUP_ANDX *pSMB;
1081 char *bcc_ptr;
1082 struct cifs_ses *ses = sess_data->ses;
1083 __u32 capabilities;
1084 __u16 bytes_remaining;
1085
1086 /* old style NTLM sessionsetup */
1087 /* wct = 13 */
1088 rc = sess_alloc_buffer(sess_data, 13);
1089 if (rc)
1090 goto out;
1091
1092 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1093 bcc_ptr = sess_data->iov[2].iov_base;
1094 capabilities = cifs_ssetup_hdr(ses, pSMB);
1095
1096 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1097 if (ses->user_name != NULL) {
1098 pSMB->req_no_secext.CaseInsensitivePasswordLength =
1099 cpu_to_le16(CIFS_AUTH_RESP_SIZE);
1100 pSMB->req_no_secext.CaseSensitivePasswordLength =
1101 cpu_to_le16(CIFS_AUTH_RESP_SIZE);
1102
1103 /* calculate ntlm response and session key */
1104 rc = setup_ntlm_response(ses, sess_data->nls_cp);
1105 if (rc) {
1106 cifs_dbg(VFS, "Error %d during NTLM authentication\n",
1107 rc);
1108 goto out;
1109 }
1110
1111 /* copy ntlm response */
1112 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1113 CIFS_AUTH_RESP_SIZE);
1114 bcc_ptr += CIFS_AUTH_RESP_SIZE;
1115 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1116 CIFS_AUTH_RESP_SIZE);
1117 bcc_ptr += CIFS_AUTH_RESP_SIZE;
1118 } else {
1119 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1120 pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1121 }
1122
1123 if (ses->capabilities & CAP_UNICODE) {
1124 /* unicode strings must be word aligned */
1125 if (sess_data->iov[0].iov_len % 2) {
1126 *bcc_ptr = 0;
1127 bcc_ptr++;
1128 }
1129 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1130 } else {
1131 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1132 }
1133
1134
1135 sess_data->iov[2].iov_len = (long) bcc_ptr -
1136 (long) sess_data->iov[2].iov_base;
1137
1138 rc = sess_sendreceive(sess_data);
1139 if (rc)
1140 goto out;
1141
1142 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1143 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1144
1145 if (smb_buf->WordCount != 3) {
1146 rc = -EIO;
1147 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1148 goto out;
1149 }
1150
1151 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1152 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1153
1154 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1155 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1156
1157 bytes_remaining = get_bcc(smb_buf);
1158 bcc_ptr = pByteArea(smb_buf);
1159
1160 /* BB check if Unicode and decode strings */
1161 if (bytes_remaining == 0) {
1162 /* no string area to decode, do nothing */
1163 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1164 /* unicode string area must be word-aligned */
1165 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1166 ++bcc_ptr;
1167 --bytes_remaining;
1168 }
1169 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1170 sess_data->nls_cp);
1171 } else {
1172 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1173 sess_data->nls_cp);
1174 }
1175
1176 rc = sess_establish_session(sess_data);
1177 out:
1178 sess_data->result = rc;
1179 sess_data->func = NULL;
1180 sess_free_buffer(sess_data);
1181 kfree(ses->auth_key.response);
1182 ses->auth_key.response = NULL;
1183 }
1184
1185 static void
sess_auth_ntlmv2(struct sess_data * sess_data)1186 sess_auth_ntlmv2(struct sess_data *sess_data)
1187 {
1188 int rc = 0;
1189 struct smb_hdr *smb_buf;
1190 SESSION_SETUP_ANDX *pSMB;
1191 char *bcc_ptr;
1192 struct cifs_ses *ses = sess_data->ses;
1193 __u32 capabilities;
1194 __u16 bytes_remaining;
1195
1196 /* old style NTLM sessionsetup */
1197 /* wct = 13 */
1198 rc = sess_alloc_buffer(sess_data, 13);
1199 if (rc)
1200 goto out;
1201
1202 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1203 bcc_ptr = sess_data->iov[2].iov_base;
1204 capabilities = cifs_ssetup_hdr(ses, pSMB);
1205
1206 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1207
1208 /* LM2 password would be here if we supported it */
1209 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1210
1211 if (ses->user_name != NULL) {
1212 /* calculate nlmv2 response and session key */
1213 rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
1214 if (rc) {
1215 cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
1216 goto out;
1217 }
1218
1219 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1220 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1221 bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1222
1223 /* set case sensitive password length after tilen may get
1224 * assigned, tilen is 0 otherwise.
1225 */
1226 pSMB->req_no_secext.CaseSensitivePasswordLength =
1227 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1228 } else {
1229 pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1230 }
1231
1232 if (ses->capabilities & CAP_UNICODE) {
1233 if (sess_data->iov[0].iov_len % 2) {
1234 *bcc_ptr = 0;
1235 bcc_ptr++;
1236 }
1237 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1238 } else {
1239 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1240 }
1241
1242
1243 sess_data->iov[2].iov_len = (long) bcc_ptr -
1244 (long) sess_data->iov[2].iov_base;
1245
1246 rc = sess_sendreceive(sess_data);
1247 if (rc)
1248 goto out;
1249
1250 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1251 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1252
1253 if (smb_buf->WordCount != 3) {
1254 rc = -EIO;
1255 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1256 goto out;
1257 }
1258
1259 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1260 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1261
1262 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1263 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1264
1265 bytes_remaining = get_bcc(smb_buf);
1266 bcc_ptr = pByteArea(smb_buf);
1267
1268 /* BB check if Unicode and decode strings */
1269 if (bytes_remaining == 0) {
1270 /* no string area to decode, do nothing */
1271 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1272 /* unicode string area must be word-aligned */
1273 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1274 ++bcc_ptr;
1275 --bytes_remaining;
1276 }
1277 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1278 sess_data->nls_cp);
1279 } else {
1280 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1281 sess_data->nls_cp);
1282 }
1283
1284 rc = sess_establish_session(sess_data);
1285 out:
1286 sess_data->result = rc;
1287 sess_data->func = NULL;
1288 sess_free_buffer(sess_data);
1289 kfree(ses->auth_key.response);
1290 ses->auth_key.response = NULL;
1291 }
1292
1293 #ifdef CONFIG_CIFS_UPCALL
1294 static void
sess_auth_kerberos(struct sess_data * sess_data)1295 sess_auth_kerberos(struct sess_data *sess_data)
1296 {
1297 int rc = 0;
1298 struct smb_hdr *smb_buf;
1299 SESSION_SETUP_ANDX *pSMB;
1300 char *bcc_ptr;
1301 struct cifs_ses *ses = sess_data->ses;
1302 __u32 capabilities;
1303 __u16 bytes_remaining;
1304 struct key *spnego_key = NULL;
1305 struct cifs_spnego_msg *msg;
1306 u16 blob_len;
1307
1308 /* extended security */
1309 /* wct = 12 */
1310 rc = sess_alloc_buffer(sess_data, 12);
1311 if (rc)
1312 goto out;
1313
1314 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1315 bcc_ptr = sess_data->iov[2].iov_base;
1316 capabilities = cifs_ssetup_hdr(ses, pSMB);
1317
1318 spnego_key = cifs_get_spnego_key(ses);
1319 if (IS_ERR(spnego_key)) {
1320 rc = PTR_ERR(spnego_key);
1321 spnego_key = NULL;
1322 goto out;
1323 }
1324
1325 msg = spnego_key->payload.data[0];
1326 /*
1327 * check version field to make sure that cifs.upcall is
1328 * sending us a response in an expected form
1329 */
1330 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1331 cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1332 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1333 rc = -EKEYREJECTED;
1334 goto out_put_spnego_key;
1335 }
1336
1337 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1338 GFP_KERNEL);
1339 if (!ses->auth_key.response) {
1340 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1341 msg->sesskey_len);
1342 rc = -ENOMEM;
1343 goto out_put_spnego_key;
1344 }
1345 ses->auth_key.len = msg->sesskey_len;
1346
1347 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1348 capabilities |= CAP_EXTENDED_SECURITY;
1349 pSMB->req.Capabilities = cpu_to_le32(capabilities);
1350 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1351 sess_data->iov[1].iov_len = msg->secblob_len;
1352 pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1353
1354 if (ses->capabilities & CAP_UNICODE) {
1355 /* unicode strings must be word aligned */
1356 if ((sess_data->iov[0].iov_len
1357 + sess_data->iov[1].iov_len) % 2) {
1358 *bcc_ptr = 0;
1359 bcc_ptr++;
1360 }
1361 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1362 unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1363 } else {
1364 /* BB: is this right? */
1365 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1366 }
1367
1368 sess_data->iov[2].iov_len = (long) bcc_ptr -
1369 (long) sess_data->iov[2].iov_base;
1370
1371 rc = sess_sendreceive(sess_data);
1372 if (rc)
1373 goto out_put_spnego_key;
1374
1375 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1376 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1377
1378 if (smb_buf->WordCount != 4) {
1379 rc = -EIO;
1380 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1381 goto out_put_spnego_key;
1382 }
1383
1384 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1385 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1386
1387 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1388 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1389
1390 bytes_remaining = get_bcc(smb_buf);
1391 bcc_ptr = pByteArea(smb_buf);
1392
1393 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1394 if (blob_len > bytes_remaining) {
1395 cifs_dbg(VFS, "bad security blob length %d\n",
1396 blob_len);
1397 rc = -EINVAL;
1398 goto out_put_spnego_key;
1399 }
1400 bcc_ptr += blob_len;
1401 bytes_remaining -= blob_len;
1402
1403 /* BB check if Unicode and decode strings */
1404 if (bytes_remaining == 0) {
1405 /* no string area to decode, do nothing */
1406 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1407 /* unicode string area must be word-aligned */
1408 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1409 ++bcc_ptr;
1410 --bytes_remaining;
1411 }
1412 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1413 sess_data->nls_cp);
1414 } else {
1415 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1416 sess_data->nls_cp);
1417 }
1418
1419 rc = sess_establish_session(sess_data);
1420 out_put_spnego_key:
1421 key_invalidate(spnego_key);
1422 key_put(spnego_key);
1423 out:
1424 sess_data->result = rc;
1425 sess_data->func = NULL;
1426 sess_free_buffer(sess_data);
1427 kfree(ses->auth_key.response);
1428 ses->auth_key.response = NULL;
1429 }
1430
1431 #endif /* ! CONFIG_CIFS_UPCALL */
1432
1433 /*
1434 * The required kvec buffers have to be allocated before calling this
1435 * function.
1436 */
1437 static int
_sess_auth_rawntlmssp_assemble_req(struct sess_data * sess_data)1438 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1439 {
1440 SESSION_SETUP_ANDX *pSMB;
1441 struct cifs_ses *ses = sess_data->ses;
1442 __u32 capabilities;
1443 char *bcc_ptr;
1444
1445 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1446
1447 capabilities = cifs_ssetup_hdr(ses, pSMB);
1448 if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) {
1449 cifs_dbg(VFS, "NTLMSSP requires Unicode support\n");
1450 return -ENOSYS;
1451 }
1452
1453 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1454 capabilities |= CAP_EXTENDED_SECURITY;
1455 pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1456
1457 bcc_ptr = sess_data->iov[2].iov_base;
1458 /* unicode strings must be word aligned */
1459 if ((sess_data->iov[0].iov_len + sess_data->iov[1].iov_len) % 2) {
1460 *bcc_ptr = 0;
1461 bcc_ptr++;
1462 }
1463 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1464
1465 sess_data->iov[2].iov_len = (long) bcc_ptr -
1466 (long) sess_data->iov[2].iov_base;
1467
1468 return 0;
1469 }
1470
1471 static void
1472 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1473
1474 static void
sess_auth_rawntlmssp_negotiate(struct sess_data * sess_data)1475 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1476 {
1477 int rc;
1478 struct smb_hdr *smb_buf;
1479 SESSION_SETUP_ANDX *pSMB;
1480 struct cifs_ses *ses = sess_data->ses;
1481 __u16 bytes_remaining;
1482 char *bcc_ptr;
1483 u16 blob_len;
1484
1485 cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1486
1487 /*
1488 * if memory allocation is successful, caller of this function
1489 * frees it.
1490 */
1491 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1492 if (!ses->ntlmssp) {
1493 rc = -ENOMEM;
1494 goto out;
1495 }
1496 ses->ntlmssp->sesskey_per_smbsess = false;
1497
1498 /* wct = 12 */
1499 rc = sess_alloc_buffer(sess_data, 12);
1500 if (rc)
1501 goto out;
1502
1503 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1504
1505 /* Build security blob before we assemble the request */
1506 build_ntlmssp_negotiate_blob(pSMB->req.SecurityBlob, ses);
1507 sess_data->iov[1].iov_len = sizeof(NEGOTIATE_MESSAGE);
1508 sess_data->iov[1].iov_base = pSMB->req.SecurityBlob;
1509 pSMB->req.SecurityBlobLength = cpu_to_le16(sizeof(NEGOTIATE_MESSAGE));
1510
1511 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1512 if (rc)
1513 goto out;
1514
1515 rc = sess_sendreceive(sess_data);
1516
1517 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1518 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1519
1520 /* If true, rc here is expected and not an error */
1521 if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1522 smb_buf->Status.CifsError ==
1523 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1524 rc = 0;
1525
1526 if (rc)
1527 goto out;
1528
1529 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1530
1531 if (smb_buf->WordCount != 4) {
1532 rc = -EIO;
1533 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1534 goto out;
1535 }
1536
1537 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1538 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1539
1540 bytes_remaining = get_bcc(smb_buf);
1541 bcc_ptr = pByteArea(smb_buf);
1542
1543 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1544 if (blob_len > bytes_remaining) {
1545 cifs_dbg(VFS, "bad security blob length %d\n",
1546 blob_len);
1547 rc = -EINVAL;
1548 goto out;
1549 }
1550
1551 rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1552 out:
1553 sess_free_buffer(sess_data);
1554
1555 if (!rc) {
1556 sess_data->func = sess_auth_rawntlmssp_authenticate;
1557 return;
1558 }
1559
1560 /* Else error. Cleanup */
1561 kfree(ses->auth_key.response);
1562 ses->auth_key.response = NULL;
1563 kfree(ses->ntlmssp);
1564 ses->ntlmssp = NULL;
1565
1566 sess_data->func = NULL;
1567 sess_data->result = rc;
1568 }
1569
1570 static void
sess_auth_rawntlmssp_authenticate(struct sess_data * sess_data)1571 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1572 {
1573 int rc;
1574 struct smb_hdr *smb_buf;
1575 SESSION_SETUP_ANDX *pSMB;
1576 struct cifs_ses *ses = sess_data->ses;
1577 __u16 bytes_remaining;
1578 char *bcc_ptr;
1579 unsigned char *ntlmsspblob = NULL;
1580 u16 blob_len;
1581
1582 cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1583
1584 /* wct = 12 */
1585 rc = sess_alloc_buffer(sess_data, 12);
1586 if (rc)
1587 goto out;
1588
1589 /* Build security blob before we assemble the request */
1590 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1591 smb_buf = (struct smb_hdr *)pSMB;
1592 rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1593 &blob_len, ses, sess_data->nls_cp);
1594 if (rc)
1595 goto out_free_ntlmsspblob;
1596 sess_data->iov[1].iov_len = blob_len;
1597 sess_data->iov[1].iov_base = ntlmsspblob;
1598 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1599 /*
1600 * Make sure that we tell the server that we are using
1601 * the uid that it just gave us back on the response
1602 * (challenge)
1603 */
1604 smb_buf->Uid = ses->Suid;
1605
1606 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1607 if (rc)
1608 goto out_free_ntlmsspblob;
1609
1610 rc = sess_sendreceive(sess_data);
1611 if (rc)
1612 goto out_free_ntlmsspblob;
1613
1614 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1615 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1616 if (smb_buf->WordCount != 4) {
1617 rc = -EIO;
1618 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1619 goto out_free_ntlmsspblob;
1620 }
1621
1622 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1623 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1624
1625 if (ses->Suid != smb_buf->Uid) {
1626 ses->Suid = smb_buf->Uid;
1627 cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1628 }
1629
1630 bytes_remaining = get_bcc(smb_buf);
1631 bcc_ptr = pByteArea(smb_buf);
1632 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1633 if (blob_len > bytes_remaining) {
1634 cifs_dbg(VFS, "bad security blob length %d\n",
1635 blob_len);
1636 rc = -EINVAL;
1637 goto out_free_ntlmsspblob;
1638 }
1639 bcc_ptr += blob_len;
1640 bytes_remaining -= blob_len;
1641
1642
1643 /* BB check if Unicode and decode strings */
1644 if (bytes_remaining == 0) {
1645 /* no string area to decode, do nothing */
1646 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1647 /* unicode string area must be word-aligned */
1648 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1649 ++bcc_ptr;
1650 --bytes_remaining;
1651 }
1652 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1653 sess_data->nls_cp);
1654 } else {
1655 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1656 sess_data->nls_cp);
1657 }
1658
1659 out_free_ntlmsspblob:
1660 kfree(ntlmsspblob);
1661 out:
1662 sess_free_buffer(sess_data);
1663
1664 if (!rc)
1665 rc = sess_establish_session(sess_data);
1666
1667 /* Cleanup */
1668 kfree(ses->auth_key.response);
1669 ses->auth_key.response = NULL;
1670 kfree(ses->ntlmssp);
1671 ses->ntlmssp = NULL;
1672
1673 sess_data->func = NULL;
1674 sess_data->result = rc;
1675 }
1676
select_sec(struct cifs_ses * ses,struct sess_data * sess_data)1677 static int select_sec(struct cifs_ses *ses, struct sess_data *sess_data)
1678 {
1679 int type;
1680
1681 type = cifs_select_sectype(ses->server, ses->sectype);
1682 cifs_dbg(FYI, "sess setup type %d\n", type);
1683 if (type == Unspecified) {
1684 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1685 return -EINVAL;
1686 }
1687
1688 switch (type) {
1689 case LANMAN:
1690 /* LANMAN and plaintext are less secure and off by default.
1691 * So we make this explicitly be turned on in kconfig (in the
1692 * build) and turned on at runtime (changed from the default)
1693 * in proc/fs/cifs or via mount parm. Unfortunately this is
1694 * needed for old Win (e.g. Win95), some obscure NAS and OS/2 */
1695 #ifdef CONFIG_CIFS_WEAK_PW_HASH
1696 sess_data->func = sess_auth_lanman;
1697 break;
1698 #else
1699 return -EOPNOTSUPP;
1700 #endif
1701 case NTLM:
1702 sess_data->func = sess_auth_ntlm;
1703 break;
1704 case NTLMv2:
1705 sess_data->func = sess_auth_ntlmv2;
1706 break;
1707 case Kerberos:
1708 #ifdef CONFIG_CIFS_UPCALL
1709 sess_data->func = sess_auth_kerberos;
1710 break;
1711 #else
1712 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1713 return -ENOSYS;
1714 #endif /* CONFIG_CIFS_UPCALL */
1715 case RawNTLMSSP:
1716 sess_data->func = sess_auth_rawntlmssp_negotiate;
1717 break;
1718 default:
1719 cifs_dbg(VFS, "secType %d not supported!\n", type);
1720 return -ENOSYS;
1721 }
1722
1723 return 0;
1724 }
1725
CIFS_SessSetup(const unsigned int xid,struct cifs_ses * ses,const struct nls_table * nls_cp)1726 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
1727 const struct nls_table *nls_cp)
1728 {
1729 int rc = 0;
1730 struct sess_data *sess_data;
1731
1732 if (ses == NULL) {
1733 WARN(1, "%s: ses == NULL!", __func__);
1734 return -EINVAL;
1735 }
1736
1737 sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
1738 if (!sess_data)
1739 return -ENOMEM;
1740
1741 rc = select_sec(ses, sess_data);
1742 if (rc)
1743 goto out;
1744
1745 sess_data->xid = xid;
1746 sess_data->ses = ses;
1747 sess_data->buf0_type = CIFS_NO_BUFFER;
1748 sess_data->nls_cp = (struct nls_table *) nls_cp;
1749
1750 while (sess_data->func)
1751 sess_data->func(sess_data);
1752
1753 /* Store result before we free sess_data */
1754 rc = sess_data->result;
1755
1756 out:
1757 kfree(sess_data);
1758 return rc;
1759 }
1760