1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3 *
4 * SMB/CIFS session setup handling routines
5 *
6 * Copyright (c) International Business Machines Corp., 2006, 2009
7 * Author(s): Steve French (sfrench@us.ibm.com)
8 *
9 */
10
11 #include "cifspdu.h"
12 #include "cifsglob.h"
13 #include "cifsproto.h"
14 #include "cifs_unicode.h"
15 #include "cifs_debug.h"
16 #include "ntlmssp.h"
17 #include "nterr.h"
18 #include <linux/utsname.h>
19 #include <linux/slab.h>
20 #include "cifs_spnego.h"
21 #include "smb2proto.h"
22 #include "fs_context.h"
23
24 static int
25 cifs_ses_add_channel(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses,
26 struct cifs_server_iface *iface);
27
28 bool
is_server_using_iface(struct TCP_Server_Info * server,struct cifs_server_iface * iface)29 is_server_using_iface(struct TCP_Server_Info *server,
30 struct cifs_server_iface *iface)
31 {
32 struct sockaddr_in *i4 = (struct sockaddr_in *)&iface->sockaddr;
33 struct sockaddr_in6 *i6 = (struct sockaddr_in6 *)&iface->sockaddr;
34 struct sockaddr_in *s4 = (struct sockaddr_in *)&server->dstaddr;
35 struct sockaddr_in6 *s6 = (struct sockaddr_in6 *)&server->dstaddr;
36
37 if (server->dstaddr.ss_family != iface->sockaddr.ss_family)
38 return false;
39 if (server->dstaddr.ss_family == AF_INET) {
40 if (s4->sin_addr.s_addr != i4->sin_addr.s_addr)
41 return false;
42 } else if (server->dstaddr.ss_family == AF_INET6) {
43 if (memcmp(&s6->sin6_addr, &i6->sin6_addr,
44 sizeof(i6->sin6_addr)) != 0)
45 return false;
46 } else {
47 /* unknown family.. */
48 return false;
49 }
50 return true;
51 }
52
is_ses_using_iface(struct cifs_ses * ses,struct cifs_server_iface * iface)53 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
54 {
55 int i;
56
57 spin_lock(&ses->chan_lock);
58 for (i = 0; i < ses->chan_count; i++) {
59 if (is_server_using_iface(ses->chans[i].server, iface)) {
60 spin_unlock(&ses->chan_lock);
61 return true;
62 }
63 }
64 spin_unlock(&ses->chan_lock);
65 return false;
66 }
67
68 /* returns number of channels added */
cifs_try_adding_channels(struct cifs_sb_info * cifs_sb,struct cifs_ses * ses)69 int cifs_try_adding_channels(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses)
70 {
71 int old_chan_count, new_chan_count;
72 int left;
73 int i = 0;
74 int rc = 0;
75 int tries = 0;
76 struct cifs_server_iface *ifaces = NULL;
77 size_t iface_count;
78
79 spin_lock(&ses->chan_lock);
80
81 new_chan_count = old_chan_count = ses->chan_count;
82 left = ses->chan_max - ses->chan_count;
83
84 if (left <= 0) {
85 cifs_dbg(FYI,
86 "ses already at max_channels (%zu), nothing to open\n",
87 ses->chan_max);
88 spin_unlock(&ses->chan_lock);
89 return 0;
90 }
91
92 if (ses->server->dialect < SMB30_PROT_ID) {
93 spin_unlock(&ses->chan_lock);
94 cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
95 return 0;
96 }
97
98 if (!(ses->server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
99 cifs_dbg(VFS, "server %s does not support multichannel\n", ses->server->hostname);
100 ses->chan_max = 1;
101 spin_unlock(&ses->chan_lock);
102 return 0;
103 }
104 spin_unlock(&ses->chan_lock);
105
106 /*
107 * Make a copy of the iface list at the time and use that
108 * instead so as to not hold the iface spinlock for opening
109 * channels
110 */
111 spin_lock(&ses->iface_lock);
112 iface_count = ses->iface_count;
113 if (iface_count <= 0) {
114 spin_unlock(&ses->iface_lock);
115 cifs_dbg(VFS, "no iface list available to open channels\n");
116 return 0;
117 }
118 ifaces = kmemdup(ses->iface_list, iface_count*sizeof(*ifaces),
119 GFP_ATOMIC);
120 if (!ifaces) {
121 spin_unlock(&ses->iface_lock);
122 return 0;
123 }
124 spin_unlock(&ses->iface_lock);
125
126 /*
127 * Keep connecting to same, fastest, iface for all channels as
128 * long as its RSS. Try next fastest one if not RSS or channel
129 * creation fails.
130 */
131 while (left > 0) {
132 struct cifs_server_iface *iface;
133
134 tries++;
135 if (tries > 3*ses->chan_max) {
136 cifs_dbg(FYI, "too many channel open attempts (%d channels left to open)\n",
137 left);
138 break;
139 }
140
141 iface = &ifaces[i];
142 if (is_ses_using_iface(ses, iface) && !iface->rss_capable) {
143 i = (i+1) % iface_count;
144 continue;
145 }
146
147 rc = cifs_ses_add_channel(cifs_sb, ses, iface);
148 if (rc) {
149 cifs_dbg(FYI, "failed to open extra channel on iface#%d rc=%d\n",
150 i, rc);
151 i = (i+1) % iface_count;
152 continue;
153 }
154
155 cifs_dbg(FYI, "successfully opened new channel on iface#%d\n",
156 i);
157 left--;
158 new_chan_count++;
159 }
160
161 kfree(ifaces);
162 return new_chan_count - old_chan_count;
163 }
164
165 /*
166 * If server is a channel of ses, return the corresponding enclosing
167 * cifs_chan otherwise return NULL.
168 */
169 struct cifs_chan *
cifs_ses_find_chan(struct cifs_ses * ses,struct TCP_Server_Info * server)170 cifs_ses_find_chan(struct cifs_ses *ses, struct TCP_Server_Info *server)
171 {
172 int i;
173
174 spin_lock(&ses->chan_lock);
175 for (i = 0; i < ses->chan_count; i++) {
176 if (ses->chans[i].server == server) {
177 spin_unlock(&ses->chan_lock);
178 return &ses->chans[i];
179 }
180 }
181 spin_unlock(&ses->chan_lock);
182 return NULL;
183 }
184
185 static int
cifs_ses_add_channel(struct cifs_sb_info * cifs_sb,struct cifs_ses * ses,struct cifs_server_iface * iface)186 cifs_ses_add_channel(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses,
187 struct cifs_server_iface *iface)
188 {
189 struct TCP_Server_Info *chan_server;
190 struct cifs_chan *chan;
191 struct smb3_fs_context ctx = {NULL};
192 static const char unc_fmt[] = "\\%s\\foo";
193 char unc[sizeof(unc_fmt)+SERVER_NAME_LEN_WITH_NULL] = {0};
194 struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
195 struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
196 int rc;
197 unsigned int xid = get_xid();
198
199 if (iface->sockaddr.ss_family == AF_INET)
200 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
201 ses, iface->speed, iface->rdma_capable ? "yes" : "no",
202 &ipv4->sin_addr);
203 else
204 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI6)\n",
205 ses, iface->speed, iface->rdma_capable ? "yes" : "no",
206 &ipv6->sin6_addr);
207
208 /*
209 * Setup a ctx with mostly the same info as the existing
210 * session and overwrite it with the requested iface data.
211 *
212 * We need to setup at least the fields used for negprot and
213 * sesssetup.
214 *
215 * We only need the ctx here, so we can reuse memory from
216 * the session and server without caring about memory
217 * management.
218 */
219
220 /* Always make new connection for now (TODO?) */
221 ctx.nosharesock = true;
222
223 /* Auth */
224 ctx.domainauto = ses->domainAuto;
225 ctx.domainname = ses->domainName;
226 ctx.username = ses->user_name;
227 ctx.password = ses->password;
228 ctx.sectype = ses->sectype;
229 ctx.sign = ses->sign;
230
231 /* UNC and paths */
232 /* XXX: Use ses->server->hostname? */
233 sprintf(unc, unc_fmt, ses->ip_addr);
234 ctx.UNC = unc;
235 ctx.prepath = "";
236
237 /* Reuse same version as master connection */
238 ctx.vals = ses->server->vals;
239 ctx.ops = ses->server->ops;
240
241 ctx.noblocksnd = ses->server->noblocksnd;
242 ctx.noautotune = ses->server->noautotune;
243 ctx.sockopt_tcp_nodelay = ses->server->tcp_nodelay;
244 ctx.echo_interval = ses->server->echo_interval / HZ;
245 ctx.max_credits = ses->server->max_credits;
246
247 /*
248 * This will be used for encoding/decoding user/domain/pw
249 * during sess setup auth.
250 */
251 ctx.local_nls = cifs_sb->local_nls;
252
253 /* Use RDMA if possible */
254 ctx.rdma = iface->rdma_capable;
255 memcpy(&ctx.dstaddr, &iface->sockaddr, sizeof(struct sockaddr_storage));
256
257 /* reuse master con client guid */
258 memcpy(&ctx.client_guid, ses->server->client_guid,
259 SMB2_CLIENT_GUID_SIZE);
260 ctx.use_client_guid = true;
261
262 chan_server = cifs_get_tcp_session(&ctx);
263
264 mutex_lock(&ses->session_mutex);
265 spin_lock(&ses->chan_lock);
266 chan = ses->binding_chan = &ses->chans[ses->chan_count];
267 chan->server = chan_server;
268 if (IS_ERR(chan->server)) {
269 rc = PTR_ERR(chan->server);
270 chan->server = NULL;
271 spin_unlock(&ses->chan_lock);
272 goto out;
273 }
274 spin_unlock(&ses->chan_lock);
275
276 spin_lock(&cifs_tcp_ses_lock);
277 chan->server->is_channel = true;
278 spin_unlock(&cifs_tcp_ses_lock);
279
280 /*
281 * We need to allocate the server crypto now as we will need
282 * to sign packets before we generate the channel signing key
283 * (we sign with the session key)
284 */
285 rc = smb311_crypto_shash_allocate(chan->server);
286 if (rc) {
287 cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
288 goto out;
289 }
290
291 ses->binding = true;
292 rc = cifs_negotiate_protocol(xid, ses);
293 if (rc)
294 goto out;
295
296 rc = cifs_setup_session(xid, ses, cifs_sb->local_nls);
297 if (rc)
298 goto out;
299
300 /* success, put it on the list
301 * XXX: sharing ses between 2 tcp servers is not possible, the
302 * way "internal" linked lists works in linux makes element
303 * only able to belong to one list
304 *
305 * the binding session is already established so the rest of
306 * the code should be able to look it up, no need to add the
307 * ses to the new server.
308 */
309
310 spin_lock(&ses->chan_lock);
311 ses->chan_count++;
312 atomic_set(&ses->chan_seq, 0);
313 spin_unlock(&ses->chan_lock);
314
315 out:
316 ses->binding = false;
317 ses->binding_chan = NULL;
318 mutex_unlock(&ses->session_mutex);
319
320 if (rc && chan->server)
321 cifs_put_tcp_session(chan->server, 0);
322
323 free_xid(xid);
324 return rc;
325 }
326
cifs_ssetup_hdr(struct cifs_ses * ses,SESSION_SETUP_ANDX * pSMB)327 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses, SESSION_SETUP_ANDX *pSMB)
328 {
329 __u32 capabilities = 0;
330
331 /* init fields common to all four types of SessSetup */
332 /* Note that offsets for first seven fields in req struct are same */
333 /* in CIFS Specs so does not matter which of 3 forms of struct */
334 /* that we use in next few lines */
335 /* Note that header is initialized to zero in header_assemble */
336 pSMB->req.AndXCommand = 0xFF;
337 pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
338 CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
339 USHRT_MAX));
340 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
341 pSMB->req.VcNumber = cpu_to_le16(1);
342
343 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
344
345 /* BB verify whether signing required on neg or just on auth frame
346 (and NTLM case) */
347
348 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
349 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
350
351 if (ses->server->sign)
352 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
353
354 if (ses->capabilities & CAP_UNICODE) {
355 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
356 capabilities |= CAP_UNICODE;
357 }
358 if (ses->capabilities & CAP_STATUS32) {
359 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
360 capabilities |= CAP_STATUS32;
361 }
362 if (ses->capabilities & CAP_DFS) {
363 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
364 capabilities |= CAP_DFS;
365 }
366 if (ses->capabilities & CAP_UNIX)
367 capabilities |= CAP_UNIX;
368
369 return capabilities;
370 }
371
372 static void
unicode_oslm_strings(char ** pbcc_area,const struct nls_table * nls_cp)373 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
374 {
375 char *bcc_ptr = *pbcc_area;
376 int bytes_ret = 0;
377
378 /* Copy OS version */
379 bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
380 nls_cp);
381 bcc_ptr += 2 * bytes_ret;
382 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
383 32, nls_cp);
384 bcc_ptr += 2 * bytes_ret;
385 bcc_ptr += 2; /* trailing null */
386
387 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
388 32, nls_cp);
389 bcc_ptr += 2 * bytes_ret;
390 bcc_ptr += 2; /* trailing null */
391
392 *pbcc_area = bcc_ptr;
393 }
394
unicode_domain_string(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)395 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
396 const struct nls_table *nls_cp)
397 {
398 char *bcc_ptr = *pbcc_area;
399 int bytes_ret = 0;
400
401 /* copy domain */
402 if (ses->domainName == NULL) {
403 /* Sending null domain better than using a bogus domain name (as
404 we did briefly in 2.6.18) since server will use its default */
405 *bcc_ptr = 0;
406 *(bcc_ptr+1) = 0;
407 bytes_ret = 0;
408 } else
409 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
410 CIFS_MAX_DOMAINNAME_LEN, nls_cp);
411 bcc_ptr += 2 * bytes_ret;
412 bcc_ptr += 2; /* account for null terminator */
413
414 *pbcc_area = bcc_ptr;
415 }
416
417
unicode_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)418 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
419 const struct nls_table *nls_cp)
420 {
421 char *bcc_ptr = *pbcc_area;
422 int bytes_ret = 0;
423
424 /* BB FIXME add check that strings total less
425 than 335 or will need to send them as arrays */
426
427 /* unicode strings, must be word aligned before the call */
428 /* if ((long) bcc_ptr % 2) {
429 *bcc_ptr = 0;
430 bcc_ptr++;
431 } */
432 /* copy user */
433 if (ses->user_name == NULL) {
434 /* null user mount */
435 *bcc_ptr = 0;
436 *(bcc_ptr+1) = 0;
437 } else {
438 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
439 CIFS_MAX_USERNAME_LEN, nls_cp);
440 }
441 bcc_ptr += 2 * bytes_ret;
442 bcc_ptr += 2; /* account for null termination */
443
444 unicode_domain_string(&bcc_ptr, ses, nls_cp);
445 unicode_oslm_strings(&bcc_ptr, nls_cp);
446
447 *pbcc_area = bcc_ptr;
448 }
449
ascii_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)450 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
451 const struct nls_table *nls_cp)
452 {
453 char *bcc_ptr = *pbcc_area;
454 int len;
455
456 /* copy user */
457 /* BB what about null user mounts - check that we do this BB */
458 /* copy user */
459 if (ses->user_name != NULL) {
460 len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
461 if (WARN_ON_ONCE(len < 0))
462 len = CIFS_MAX_USERNAME_LEN - 1;
463 bcc_ptr += len;
464 }
465 /* else null user mount */
466 *bcc_ptr = 0;
467 bcc_ptr++; /* account for null termination */
468
469 /* copy domain */
470 if (ses->domainName != NULL) {
471 len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
472 if (WARN_ON_ONCE(len < 0))
473 len = CIFS_MAX_DOMAINNAME_LEN - 1;
474 bcc_ptr += len;
475 } /* else we will send a null domain name
476 so the server will default to its own domain */
477 *bcc_ptr = 0;
478 bcc_ptr++;
479
480 /* BB check for overflow here */
481
482 strcpy(bcc_ptr, "Linux version ");
483 bcc_ptr += strlen("Linux version ");
484 strcpy(bcc_ptr, init_utsname()->release);
485 bcc_ptr += strlen(init_utsname()->release) + 1;
486
487 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
488 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
489
490 *pbcc_area = bcc_ptr;
491 }
492
493 static void
decode_unicode_ssetup(char ** pbcc_area,int bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)494 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
495 const struct nls_table *nls_cp)
496 {
497 int len;
498 char *data = *pbcc_area;
499
500 cifs_dbg(FYI, "bleft %d\n", bleft);
501
502 kfree(ses->serverOS);
503 ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
504 cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
505 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
506 data += len;
507 bleft -= len;
508 if (bleft <= 0)
509 return;
510
511 kfree(ses->serverNOS);
512 ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
513 cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
514 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
515 data += len;
516 bleft -= len;
517 if (bleft <= 0)
518 return;
519
520 kfree(ses->serverDomain);
521 ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
522 cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
523
524 return;
525 }
526
decode_ascii_ssetup(char ** pbcc_area,__u16 bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)527 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
528 struct cifs_ses *ses,
529 const struct nls_table *nls_cp)
530 {
531 int len;
532 char *bcc_ptr = *pbcc_area;
533
534 cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
535
536 len = strnlen(bcc_ptr, bleft);
537 if (len >= bleft)
538 return;
539
540 kfree(ses->serverOS);
541
542 ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
543 if (ses->serverOS) {
544 memcpy(ses->serverOS, bcc_ptr, len);
545 ses->serverOS[len] = 0;
546 if (strncmp(ses->serverOS, "OS/2", 4) == 0)
547 cifs_dbg(FYI, "OS/2 server\n");
548 }
549
550 bcc_ptr += len + 1;
551 bleft -= len + 1;
552
553 len = strnlen(bcc_ptr, bleft);
554 if (len >= bleft)
555 return;
556
557 kfree(ses->serverNOS);
558
559 ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
560 if (ses->serverNOS) {
561 memcpy(ses->serverNOS, bcc_ptr, len);
562 ses->serverNOS[len] = 0;
563 }
564
565 bcc_ptr += len + 1;
566 bleft -= len + 1;
567
568 len = strnlen(bcc_ptr, bleft);
569 if (len > bleft)
570 return;
571
572 /* No domain field in LANMAN case. Domain is
573 returned by old servers in the SMB negprot response */
574 /* BB For newer servers which do not support Unicode,
575 but thus do return domain here we could add parsing
576 for it later, but it is not very important */
577 cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
578 }
579
decode_ntlmssp_challenge(char * bcc_ptr,int blob_len,struct cifs_ses * ses)580 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
581 struct cifs_ses *ses)
582 {
583 unsigned int tioffset; /* challenge message target info area */
584 unsigned int tilen; /* challenge message target info area length */
585
586 CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
587
588 if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
589 cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
590 return -EINVAL;
591 }
592
593 if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
594 cifs_dbg(VFS, "blob signature incorrect %s\n",
595 pblob->Signature);
596 return -EINVAL;
597 }
598 if (pblob->MessageType != NtLmChallenge) {
599 cifs_dbg(VFS, "Incorrect message type %d\n",
600 pblob->MessageType);
601 return -EINVAL;
602 }
603
604 memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
605 /* BB we could decode pblob->NegotiateFlags; some may be useful */
606 /* In particular we can examine sign flags */
607 /* BB spec says that if AvId field of MsvAvTimestamp is populated then
608 we must set the MIC field of the AUTHENTICATE_MESSAGE */
609 ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags);
610 tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
611 tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
612 if (tioffset > blob_len || tioffset + tilen > blob_len) {
613 cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
614 tioffset, tilen);
615 return -EINVAL;
616 }
617 if (tilen) {
618 ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
619 GFP_KERNEL);
620 if (!ses->auth_key.response) {
621 cifs_dbg(VFS, "Challenge target info alloc failure\n");
622 return -ENOMEM;
623 }
624 ses->auth_key.len = tilen;
625 }
626
627 return 0;
628 }
629
630 /* BB Move to ntlmssp.c eventually */
631
632 /* We do not malloc the blob, it is passed in pbuffer, because
633 it is fixed size, and small, making this approach cleaner */
build_ntlmssp_negotiate_blob(unsigned char * pbuffer,struct cifs_ses * ses)634 void build_ntlmssp_negotiate_blob(unsigned char *pbuffer,
635 struct cifs_ses *ses)
636 {
637 struct TCP_Server_Info *server = cifs_ses_server(ses);
638 NEGOTIATE_MESSAGE *sec_blob = (NEGOTIATE_MESSAGE *)pbuffer;
639 __u32 flags;
640
641 memset(pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
642 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
643 sec_blob->MessageType = NtLmNegotiate;
644
645 /* BB is NTLMV2 session security format easier to use here? */
646 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
647 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
648 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
649 NTLMSSP_NEGOTIATE_SEAL;
650 if (server->sign)
651 flags |= NTLMSSP_NEGOTIATE_SIGN;
652 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
653 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
654
655 sec_blob->NegotiateFlags = cpu_to_le32(flags);
656
657 sec_blob->WorkstationName.BufferOffset = 0;
658 sec_blob->WorkstationName.Length = 0;
659 sec_blob->WorkstationName.MaximumLength = 0;
660
661 /* Domain name is sent on the Challenge not Negotiate NTLMSSP request */
662 sec_blob->DomainName.BufferOffset = 0;
663 sec_blob->DomainName.Length = 0;
664 sec_blob->DomainName.MaximumLength = 0;
665 }
666
size_of_ntlmssp_blob(struct cifs_ses * ses)667 static int size_of_ntlmssp_blob(struct cifs_ses *ses)
668 {
669 int sz = sizeof(AUTHENTICATE_MESSAGE) + ses->auth_key.len
670 - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
671
672 if (ses->domainName)
673 sz += 2 * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
674 else
675 sz += 2;
676
677 if (ses->user_name)
678 sz += 2 * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
679 else
680 sz += 2;
681
682 return sz;
683 }
684
build_ntlmssp_auth_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,const struct nls_table * nls_cp)685 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
686 u16 *buflen,
687 struct cifs_ses *ses,
688 const struct nls_table *nls_cp)
689 {
690 int rc;
691 AUTHENTICATE_MESSAGE *sec_blob;
692 __u32 flags;
693 unsigned char *tmp;
694
695 rc = setup_ntlmv2_rsp(ses, nls_cp);
696 if (rc) {
697 cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
698 *buflen = 0;
699 goto setup_ntlmv2_ret;
700 }
701 *pbuffer = kmalloc(size_of_ntlmssp_blob(ses), GFP_KERNEL);
702 if (!*pbuffer) {
703 rc = -ENOMEM;
704 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
705 *buflen = 0;
706 goto setup_ntlmv2_ret;
707 }
708 sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
709
710 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
711 sec_blob->MessageType = NtLmAuthenticate;
712
713 flags = NTLMSSP_NEGOTIATE_56 |
714 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_TARGET_INFO |
715 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
716 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
717 NTLMSSP_NEGOTIATE_SEAL;
718 if (ses->server->sign)
719 flags |= NTLMSSP_NEGOTIATE_SIGN;
720 if (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
721 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
722
723 tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
724 sec_blob->NegotiateFlags = cpu_to_le32(flags);
725
726 sec_blob->LmChallengeResponse.BufferOffset =
727 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
728 sec_blob->LmChallengeResponse.Length = 0;
729 sec_blob->LmChallengeResponse.MaximumLength = 0;
730
731 sec_blob->NtChallengeResponse.BufferOffset =
732 cpu_to_le32(tmp - *pbuffer);
733 if (ses->user_name != NULL) {
734 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
735 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
736 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
737
738 sec_blob->NtChallengeResponse.Length =
739 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
740 sec_blob->NtChallengeResponse.MaximumLength =
741 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
742 } else {
743 /*
744 * don't send an NT Response for anonymous access
745 */
746 sec_blob->NtChallengeResponse.Length = 0;
747 sec_blob->NtChallengeResponse.MaximumLength = 0;
748 }
749
750 if (ses->domainName == NULL) {
751 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
752 sec_blob->DomainName.Length = 0;
753 sec_blob->DomainName.MaximumLength = 0;
754 tmp += 2;
755 } else {
756 int len;
757 len = cifs_strtoUTF16((__le16 *)tmp, ses->domainName,
758 CIFS_MAX_DOMAINNAME_LEN, nls_cp);
759 len *= 2; /* unicode is 2 bytes each */
760 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
761 sec_blob->DomainName.Length = cpu_to_le16(len);
762 sec_blob->DomainName.MaximumLength = cpu_to_le16(len);
763 tmp += len;
764 }
765
766 if (ses->user_name == NULL) {
767 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
768 sec_blob->UserName.Length = 0;
769 sec_blob->UserName.MaximumLength = 0;
770 tmp += 2;
771 } else {
772 int len;
773 len = cifs_strtoUTF16((__le16 *)tmp, ses->user_name,
774 CIFS_MAX_USERNAME_LEN, nls_cp);
775 len *= 2; /* unicode is 2 bytes each */
776 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
777 sec_blob->UserName.Length = cpu_to_le16(len);
778 sec_blob->UserName.MaximumLength = cpu_to_le16(len);
779 tmp += len;
780 }
781
782 sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
783 sec_blob->WorkstationName.Length = 0;
784 sec_blob->WorkstationName.MaximumLength = 0;
785 tmp += 2;
786
787 if (((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) ||
788 (ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC))
789 && !calc_seckey(ses)) {
790 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
791 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
792 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
793 sec_blob->SessionKey.MaximumLength =
794 cpu_to_le16(CIFS_CPHTXT_SIZE);
795 tmp += CIFS_CPHTXT_SIZE;
796 } else {
797 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
798 sec_blob->SessionKey.Length = 0;
799 sec_blob->SessionKey.MaximumLength = 0;
800 }
801
802 *buflen = tmp - *pbuffer;
803 setup_ntlmv2_ret:
804 return rc;
805 }
806
807 enum securityEnum
cifs_select_sectype(struct TCP_Server_Info * server,enum securityEnum requested)808 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
809 {
810 switch (server->negflavor) {
811 case CIFS_NEGFLAVOR_EXTENDED:
812 switch (requested) {
813 case Kerberos:
814 case RawNTLMSSP:
815 return requested;
816 case Unspecified:
817 if (server->sec_ntlmssp &&
818 (global_secflags & CIFSSEC_MAY_NTLMSSP))
819 return RawNTLMSSP;
820 if ((server->sec_kerberos || server->sec_mskerberos) &&
821 (global_secflags & CIFSSEC_MAY_KRB5))
822 return Kerberos;
823 fallthrough;
824 default:
825 return Unspecified;
826 }
827 case CIFS_NEGFLAVOR_UNENCAP:
828 switch (requested) {
829 case NTLMv2:
830 return requested;
831 case Unspecified:
832 if (global_secflags & CIFSSEC_MAY_NTLMV2)
833 return NTLMv2;
834 break;
835 default:
836 break;
837 }
838 fallthrough;
839 default:
840 return Unspecified;
841 }
842 }
843
844 struct sess_data {
845 unsigned int xid;
846 struct cifs_ses *ses;
847 struct nls_table *nls_cp;
848 void (*func)(struct sess_data *);
849 int result;
850
851 /* we will send the SMB in three pieces:
852 * a fixed length beginning part, an optional
853 * SPNEGO blob (which can be zero length), and a
854 * last part which will include the strings
855 * and rest of bcc area. This allows us to avoid
856 * a large buffer 17K allocation
857 */
858 int buf0_type;
859 struct kvec iov[3];
860 };
861
862 static int
sess_alloc_buffer(struct sess_data * sess_data,int wct)863 sess_alloc_buffer(struct sess_data *sess_data, int wct)
864 {
865 int rc;
866 struct cifs_ses *ses = sess_data->ses;
867 struct smb_hdr *smb_buf;
868
869 rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
870 (void **)&smb_buf);
871
872 if (rc)
873 return rc;
874
875 sess_data->iov[0].iov_base = (char *)smb_buf;
876 sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
877 /*
878 * This variable will be used to clear the buffer
879 * allocated above in case of any error in the calling function.
880 */
881 sess_data->buf0_type = CIFS_SMALL_BUFFER;
882
883 /* 2000 big enough to fit max user, domain, NOS name etc. */
884 sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
885 if (!sess_data->iov[2].iov_base) {
886 rc = -ENOMEM;
887 goto out_free_smb_buf;
888 }
889
890 return 0;
891
892 out_free_smb_buf:
893 cifs_small_buf_release(smb_buf);
894 sess_data->iov[0].iov_base = NULL;
895 sess_data->iov[0].iov_len = 0;
896 sess_data->buf0_type = CIFS_NO_BUFFER;
897 return rc;
898 }
899
900 static void
sess_free_buffer(struct sess_data * sess_data)901 sess_free_buffer(struct sess_data *sess_data)
902 {
903
904 free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
905 sess_data->buf0_type = CIFS_NO_BUFFER;
906 kfree(sess_data->iov[2].iov_base);
907 }
908
909 static int
sess_establish_session(struct sess_data * sess_data)910 sess_establish_session(struct sess_data *sess_data)
911 {
912 struct cifs_ses *ses = sess_data->ses;
913
914 mutex_lock(&ses->server->srv_mutex);
915 if (!ses->server->session_estab) {
916 if (ses->server->sign) {
917 ses->server->session_key.response =
918 kmemdup(ses->auth_key.response,
919 ses->auth_key.len, GFP_KERNEL);
920 if (!ses->server->session_key.response) {
921 mutex_unlock(&ses->server->srv_mutex);
922 return -ENOMEM;
923 }
924 ses->server->session_key.len =
925 ses->auth_key.len;
926 }
927 ses->server->sequence_number = 0x2;
928 ses->server->session_estab = true;
929 }
930 mutex_unlock(&ses->server->srv_mutex);
931
932 cifs_dbg(FYI, "CIFS session established successfully\n");
933 spin_lock(&GlobalMid_Lock);
934 ses->status = CifsGood;
935 ses->need_reconnect = false;
936 spin_unlock(&GlobalMid_Lock);
937
938 return 0;
939 }
940
941 static int
sess_sendreceive(struct sess_data * sess_data)942 sess_sendreceive(struct sess_data *sess_data)
943 {
944 int rc;
945 struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
946 __u16 count;
947 struct kvec rsp_iov = { NULL, 0 };
948
949 count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
950 be32_add_cpu(&smb_buf->smb_buf_length, count);
951 put_bcc(count, smb_buf);
952
953 rc = SendReceive2(sess_data->xid, sess_data->ses,
954 sess_data->iov, 3 /* num_iovecs */,
955 &sess_data->buf0_type,
956 CIFS_LOG_ERROR, &rsp_iov);
957 cifs_small_buf_release(sess_data->iov[0].iov_base);
958 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
959
960 return rc;
961 }
962
963 static void
sess_auth_ntlmv2(struct sess_data * sess_data)964 sess_auth_ntlmv2(struct sess_data *sess_data)
965 {
966 int rc = 0;
967 struct smb_hdr *smb_buf;
968 SESSION_SETUP_ANDX *pSMB;
969 char *bcc_ptr;
970 struct cifs_ses *ses = sess_data->ses;
971 __u32 capabilities;
972 __u16 bytes_remaining;
973
974 /* old style NTLM sessionsetup */
975 /* wct = 13 */
976 rc = sess_alloc_buffer(sess_data, 13);
977 if (rc)
978 goto out;
979
980 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
981 bcc_ptr = sess_data->iov[2].iov_base;
982 capabilities = cifs_ssetup_hdr(ses, pSMB);
983
984 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
985
986 /* LM2 password would be here if we supported it */
987 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
988
989 if (ses->user_name != NULL) {
990 /* calculate nlmv2 response and session key */
991 rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
992 if (rc) {
993 cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
994 goto out;
995 }
996
997 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
998 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
999 bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1000
1001 /* set case sensitive password length after tilen may get
1002 * assigned, tilen is 0 otherwise.
1003 */
1004 pSMB->req_no_secext.CaseSensitivePasswordLength =
1005 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1006 } else {
1007 pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1008 }
1009
1010 if (ses->capabilities & CAP_UNICODE) {
1011 if (sess_data->iov[0].iov_len % 2) {
1012 *bcc_ptr = 0;
1013 bcc_ptr++;
1014 }
1015 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1016 } else {
1017 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1018 }
1019
1020
1021 sess_data->iov[2].iov_len = (long) bcc_ptr -
1022 (long) sess_data->iov[2].iov_base;
1023
1024 rc = sess_sendreceive(sess_data);
1025 if (rc)
1026 goto out;
1027
1028 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1029 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1030
1031 if (smb_buf->WordCount != 3) {
1032 rc = -EIO;
1033 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1034 goto out;
1035 }
1036
1037 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1038 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1039
1040 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1041 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1042
1043 bytes_remaining = get_bcc(smb_buf);
1044 bcc_ptr = pByteArea(smb_buf);
1045
1046 /* BB check if Unicode and decode strings */
1047 if (bytes_remaining == 0) {
1048 /* no string area to decode, do nothing */
1049 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1050 /* unicode string area must be word-aligned */
1051 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1052 ++bcc_ptr;
1053 --bytes_remaining;
1054 }
1055 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1056 sess_data->nls_cp);
1057 } else {
1058 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1059 sess_data->nls_cp);
1060 }
1061
1062 rc = sess_establish_session(sess_data);
1063 out:
1064 sess_data->result = rc;
1065 sess_data->func = NULL;
1066 sess_free_buffer(sess_data);
1067 kfree(ses->auth_key.response);
1068 ses->auth_key.response = NULL;
1069 }
1070
1071 #ifdef CONFIG_CIFS_UPCALL
1072 static void
sess_auth_kerberos(struct sess_data * sess_data)1073 sess_auth_kerberos(struct sess_data *sess_data)
1074 {
1075 int rc = 0;
1076 struct smb_hdr *smb_buf;
1077 SESSION_SETUP_ANDX *pSMB;
1078 char *bcc_ptr;
1079 struct cifs_ses *ses = sess_data->ses;
1080 __u32 capabilities;
1081 __u16 bytes_remaining;
1082 struct key *spnego_key = NULL;
1083 struct cifs_spnego_msg *msg;
1084 u16 blob_len;
1085
1086 /* extended security */
1087 /* wct = 12 */
1088 rc = sess_alloc_buffer(sess_data, 12);
1089 if (rc)
1090 goto out;
1091
1092 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1093 bcc_ptr = sess_data->iov[2].iov_base;
1094 capabilities = cifs_ssetup_hdr(ses, pSMB);
1095
1096 spnego_key = cifs_get_spnego_key(ses);
1097 if (IS_ERR(spnego_key)) {
1098 rc = PTR_ERR(spnego_key);
1099 spnego_key = NULL;
1100 goto out;
1101 }
1102
1103 msg = spnego_key->payload.data[0];
1104 /*
1105 * check version field to make sure that cifs.upcall is
1106 * sending us a response in an expected form
1107 */
1108 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1109 cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1110 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1111 rc = -EKEYREJECTED;
1112 goto out_put_spnego_key;
1113 }
1114
1115 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1116 GFP_KERNEL);
1117 if (!ses->auth_key.response) {
1118 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1119 msg->sesskey_len);
1120 rc = -ENOMEM;
1121 goto out_put_spnego_key;
1122 }
1123 ses->auth_key.len = msg->sesskey_len;
1124
1125 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1126 capabilities |= CAP_EXTENDED_SECURITY;
1127 pSMB->req.Capabilities = cpu_to_le32(capabilities);
1128 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1129 sess_data->iov[1].iov_len = msg->secblob_len;
1130 pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1131
1132 if (ses->capabilities & CAP_UNICODE) {
1133 /* unicode strings must be word aligned */
1134 if ((sess_data->iov[0].iov_len
1135 + sess_data->iov[1].iov_len) % 2) {
1136 *bcc_ptr = 0;
1137 bcc_ptr++;
1138 }
1139 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1140 unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1141 } else {
1142 /* BB: is this right? */
1143 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1144 }
1145
1146 sess_data->iov[2].iov_len = (long) bcc_ptr -
1147 (long) sess_data->iov[2].iov_base;
1148
1149 rc = sess_sendreceive(sess_data);
1150 if (rc)
1151 goto out_put_spnego_key;
1152
1153 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1154 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1155
1156 if (smb_buf->WordCount != 4) {
1157 rc = -EIO;
1158 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1159 goto out_put_spnego_key;
1160 }
1161
1162 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1163 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1164
1165 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1166 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1167
1168 bytes_remaining = get_bcc(smb_buf);
1169 bcc_ptr = pByteArea(smb_buf);
1170
1171 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1172 if (blob_len > bytes_remaining) {
1173 cifs_dbg(VFS, "bad security blob length %d\n",
1174 blob_len);
1175 rc = -EINVAL;
1176 goto out_put_spnego_key;
1177 }
1178 bcc_ptr += blob_len;
1179 bytes_remaining -= blob_len;
1180
1181 /* BB check if Unicode and decode strings */
1182 if (bytes_remaining == 0) {
1183 /* no string area to decode, do nothing */
1184 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1185 /* unicode string area must be word-aligned */
1186 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1187 ++bcc_ptr;
1188 --bytes_remaining;
1189 }
1190 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1191 sess_data->nls_cp);
1192 } else {
1193 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1194 sess_data->nls_cp);
1195 }
1196
1197 rc = sess_establish_session(sess_data);
1198 out_put_spnego_key:
1199 key_invalidate(spnego_key);
1200 key_put(spnego_key);
1201 out:
1202 sess_data->result = rc;
1203 sess_data->func = NULL;
1204 sess_free_buffer(sess_data);
1205 kfree(ses->auth_key.response);
1206 ses->auth_key.response = NULL;
1207 }
1208
1209 #endif /* ! CONFIG_CIFS_UPCALL */
1210
1211 /*
1212 * The required kvec buffers have to be allocated before calling this
1213 * function.
1214 */
1215 static int
_sess_auth_rawntlmssp_assemble_req(struct sess_data * sess_data)1216 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1217 {
1218 SESSION_SETUP_ANDX *pSMB;
1219 struct cifs_ses *ses = sess_data->ses;
1220 __u32 capabilities;
1221 char *bcc_ptr;
1222
1223 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1224
1225 capabilities = cifs_ssetup_hdr(ses, pSMB);
1226 if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) {
1227 cifs_dbg(VFS, "NTLMSSP requires Unicode support\n");
1228 return -ENOSYS;
1229 }
1230
1231 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1232 capabilities |= CAP_EXTENDED_SECURITY;
1233 pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1234
1235 bcc_ptr = sess_data->iov[2].iov_base;
1236 /* unicode strings must be word aligned */
1237 if ((sess_data->iov[0].iov_len + sess_data->iov[1].iov_len) % 2) {
1238 *bcc_ptr = 0;
1239 bcc_ptr++;
1240 }
1241 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1242
1243 sess_data->iov[2].iov_len = (long) bcc_ptr -
1244 (long) sess_data->iov[2].iov_base;
1245
1246 return 0;
1247 }
1248
1249 static void
1250 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1251
1252 static void
sess_auth_rawntlmssp_negotiate(struct sess_data * sess_data)1253 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1254 {
1255 int rc;
1256 struct smb_hdr *smb_buf;
1257 SESSION_SETUP_ANDX *pSMB;
1258 struct cifs_ses *ses = sess_data->ses;
1259 __u16 bytes_remaining;
1260 char *bcc_ptr;
1261 u16 blob_len;
1262
1263 cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1264
1265 /*
1266 * if memory allocation is successful, caller of this function
1267 * frees it.
1268 */
1269 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1270 if (!ses->ntlmssp) {
1271 rc = -ENOMEM;
1272 goto out;
1273 }
1274 ses->ntlmssp->sesskey_per_smbsess = false;
1275
1276 /* wct = 12 */
1277 rc = sess_alloc_buffer(sess_data, 12);
1278 if (rc)
1279 goto out;
1280
1281 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1282
1283 /* Build security blob before we assemble the request */
1284 build_ntlmssp_negotiate_blob(pSMB->req.SecurityBlob, ses);
1285 sess_data->iov[1].iov_len = sizeof(NEGOTIATE_MESSAGE);
1286 sess_data->iov[1].iov_base = pSMB->req.SecurityBlob;
1287 pSMB->req.SecurityBlobLength = cpu_to_le16(sizeof(NEGOTIATE_MESSAGE));
1288
1289 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1290 if (rc)
1291 goto out;
1292
1293 rc = sess_sendreceive(sess_data);
1294
1295 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1296 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1297
1298 /* If true, rc here is expected and not an error */
1299 if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1300 smb_buf->Status.CifsError ==
1301 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1302 rc = 0;
1303
1304 if (rc)
1305 goto out;
1306
1307 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1308
1309 if (smb_buf->WordCount != 4) {
1310 rc = -EIO;
1311 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1312 goto out;
1313 }
1314
1315 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1316 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1317
1318 bytes_remaining = get_bcc(smb_buf);
1319 bcc_ptr = pByteArea(smb_buf);
1320
1321 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1322 if (blob_len > bytes_remaining) {
1323 cifs_dbg(VFS, "bad security blob length %d\n",
1324 blob_len);
1325 rc = -EINVAL;
1326 goto out;
1327 }
1328
1329 rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1330 out:
1331 sess_free_buffer(sess_data);
1332
1333 if (!rc) {
1334 sess_data->func = sess_auth_rawntlmssp_authenticate;
1335 return;
1336 }
1337
1338 /* Else error. Cleanup */
1339 kfree(ses->auth_key.response);
1340 ses->auth_key.response = NULL;
1341 kfree(ses->ntlmssp);
1342 ses->ntlmssp = NULL;
1343
1344 sess_data->func = NULL;
1345 sess_data->result = rc;
1346 }
1347
1348 static void
sess_auth_rawntlmssp_authenticate(struct sess_data * sess_data)1349 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1350 {
1351 int rc;
1352 struct smb_hdr *smb_buf;
1353 SESSION_SETUP_ANDX *pSMB;
1354 struct cifs_ses *ses = sess_data->ses;
1355 __u16 bytes_remaining;
1356 char *bcc_ptr;
1357 unsigned char *ntlmsspblob = NULL;
1358 u16 blob_len;
1359
1360 cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1361
1362 /* wct = 12 */
1363 rc = sess_alloc_buffer(sess_data, 12);
1364 if (rc)
1365 goto out;
1366
1367 /* Build security blob before we assemble the request */
1368 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1369 smb_buf = (struct smb_hdr *)pSMB;
1370 rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1371 &blob_len, ses, sess_data->nls_cp);
1372 if (rc)
1373 goto out_free_ntlmsspblob;
1374 sess_data->iov[1].iov_len = blob_len;
1375 sess_data->iov[1].iov_base = ntlmsspblob;
1376 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1377 /*
1378 * Make sure that we tell the server that we are using
1379 * the uid that it just gave us back on the response
1380 * (challenge)
1381 */
1382 smb_buf->Uid = ses->Suid;
1383
1384 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1385 if (rc)
1386 goto out_free_ntlmsspblob;
1387
1388 rc = sess_sendreceive(sess_data);
1389 if (rc)
1390 goto out_free_ntlmsspblob;
1391
1392 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1393 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1394 if (smb_buf->WordCount != 4) {
1395 rc = -EIO;
1396 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1397 goto out_free_ntlmsspblob;
1398 }
1399
1400 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1401 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1402
1403 if (ses->Suid != smb_buf->Uid) {
1404 ses->Suid = smb_buf->Uid;
1405 cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1406 }
1407
1408 bytes_remaining = get_bcc(smb_buf);
1409 bcc_ptr = pByteArea(smb_buf);
1410 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1411 if (blob_len > bytes_remaining) {
1412 cifs_dbg(VFS, "bad security blob length %d\n",
1413 blob_len);
1414 rc = -EINVAL;
1415 goto out_free_ntlmsspblob;
1416 }
1417 bcc_ptr += blob_len;
1418 bytes_remaining -= blob_len;
1419
1420
1421 /* BB check if Unicode and decode strings */
1422 if (bytes_remaining == 0) {
1423 /* no string area to decode, do nothing */
1424 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1425 /* unicode string area must be word-aligned */
1426 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1427 ++bcc_ptr;
1428 --bytes_remaining;
1429 }
1430 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1431 sess_data->nls_cp);
1432 } else {
1433 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1434 sess_data->nls_cp);
1435 }
1436
1437 out_free_ntlmsspblob:
1438 kfree(ntlmsspblob);
1439 out:
1440 sess_free_buffer(sess_data);
1441
1442 if (!rc)
1443 rc = sess_establish_session(sess_data);
1444
1445 /* Cleanup */
1446 kfree(ses->auth_key.response);
1447 ses->auth_key.response = NULL;
1448 kfree(ses->ntlmssp);
1449 ses->ntlmssp = NULL;
1450
1451 sess_data->func = NULL;
1452 sess_data->result = rc;
1453 }
1454
select_sec(struct cifs_ses * ses,struct sess_data * sess_data)1455 static int select_sec(struct cifs_ses *ses, struct sess_data *sess_data)
1456 {
1457 int type;
1458
1459 type = cifs_select_sectype(ses->server, ses->sectype);
1460 cifs_dbg(FYI, "sess setup type %d\n", type);
1461 if (type == Unspecified) {
1462 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1463 return -EINVAL;
1464 }
1465
1466 switch (type) {
1467 case NTLMv2:
1468 sess_data->func = sess_auth_ntlmv2;
1469 break;
1470 case Kerberos:
1471 #ifdef CONFIG_CIFS_UPCALL
1472 sess_data->func = sess_auth_kerberos;
1473 break;
1474 #else
1475 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1476 return -ENOSYS;
1477 #endif /* CONFIG_CIFS_UPCALL */
1478 case RawNTLMSSP:
1479 sess_data->func = sess_auth_rawntlmssp_negotiate;
1480 break;
1481 default:
1482 cifs_dbg(VFS, "secType %d not supported!\n", type);
1483 return -ENOSYS;
1484 }
1485
1486 return 0;
1487 }
1488
CIFS_SessSetup(const unsigned int xid,struct cifs_ses * ses,const struct nls_table * nls_cp)1489 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
1490 const struct nls_table *nls_cp)
1491 {
1492 int rc = 0;
1493 struct sess_data *sess_data;
1494
1495 if (ses == NULL) {
1496 WARN(1, "%s: ses == NULL!", __func__);
1497 return -EINVAL;
1498 }
1499
1500 sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
1501 if (!sess_data)
1502 return -ENOMEM;
1503
1504 rc = select_sec(ses, sess_data);
1505 if (rc)
1506 goto out;
1507
1508 sess_data->xid = xid;
1509 sess_data->ses = ses;
1510 sess_data->buf0_type = CIFS_NO_BUFFER;
1511 sess_data->nls_cp = (struct nls_table *) nls_cp;
1512
1513 while (sess_data->func)
1514 sess_data->func(sess_data);
1515
1516 /* Store result before we free sess_data */
1517 rc = sess_data->result;
1518
1519 out:
1520 kfree(sess_data);
1521 return rc;
1522 }
1523