sess.c revision 3f618223dc0bdcbc8d510350e78ee2195ff93768
1/* 2 * fs/cifs/sess.c 3 * 4 * SMB/CIFS session setup handling routines 5 * 6 * Copyright (c) International Business Machines Corp., 2006, 2009 7 * Author(s): Steve French (sfrench@us.ibm.com) 8 * 9 * This library is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU Lesser General Public License as published 11 * by the Free Software Foundation; either version 2.1 of the License, or 12 * (at your option) any later version. 13 * 14 * This library is distributed in the hope that it will be useful, 15 * but WITHOUT ANY WARRANTY; without even the implied warranty of 16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See 17 * the GNU Lesser General Public License for more details. 18 * 19 * You should have received a copy of the GNU Lesser General Public License 20 * along with this library; if not, write to the Free Software 21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 22 */ 23 24#include "cifspdu.h" 25#include "cifsglob.h" 26#include "cifsproto.h" 27#include "cifs_unicode.h" 28#include "cifs_debug.h" 29#include "ntlmssp.h" 30#include "nterr.h" 31#include <linux/utsname.h> 32#include <linux/slab.h> 33#include "cifs_spnego.h" 34 35/* 36 * Checks if this is the first smb session to be reconnected after 37 * the socket has been reestablished (so we know whether to use vc 0). 38 * Called while holding the cifs_tcp_ses_lock, so do not block 39 */ 40static bool is_first_ses_reconnect(struct cifs_ses *ses) 41{ 42 struct list_head *tmp; 43 struct cifs_ses *tmp_ses; 44 45 list_for_each(tmp, &ses->server->smb_ses_list) { 46 tmp_ses = list_entry(tmp, struct cifs_ses, 47 smb_ses_list); 48 if (tmp_ses->need_reconnect == false) 49 return false; 50 } 51 /* could not find a session that was already connected, 52 this must be the first one we are reconnecting */ 53 return true; 54} 55 56/* 57 * vc number 0 is treated specially by some servers, and should be the 58 * first one we request. After that we can use vcnumbers up to maxvcs, 59 * one for each smb session (some Windows versions set maxvcs incorrectly 60 * so maxvc=1 can be ignored). If we have too many vcs, we can reuse 61 * any vc but zero (some servers reset the connection on vcnum zero) 62 * 63 */ 64static __le16 get_next_vcnum(struct cifs_ses *ses) 65{ 66 __u16 vcnum = 0; 67 struct list_head *tmp; 68 struct cifs_ses *tmp_ses; 69 __u16 max_vcs = ses->server->max_vcs; 70 __u16 i; 71 int free_vc_found = 0; 72 73 /* Quoting the MS-SMB specification: "Windows-based SMB servers set this 74 field to one but do not enforce this limit, which allows an SMB client 75 to establish more virtual circuits than allowed by this value ... but 76 other server implementations can enforce this limit." */ 77 if (max_vcs < 2) 78 max_vcs = 0xFFFF; 79 80 spin_lock(&cifs_tcp_ses_lock); 81 if ((ses->need_reconnect) && is_first_ses_reconnect(ses)) 82 goto get_vc_num_exit; /* vcnum will be zero */ 83 for (i = ses->server->srv_count - 1; i < max_vcs; i++) { 84 if (i == 0) /* this is the only connection, use vc 0 */ 85 break; 86 87 free_vc_found = 1; 88 89 list_for_each(tmp, &ses->server->smb_ses_list) { 90 tmp_ses = list_entry(tmp, struct cifs_ses, 91 smb_ses_list); 92 if (tmp_ses->vcnum == i) { 93 free_vc_found = 0; 94 break; /* found duplicate, try next vcnum */ 95 } 96 } 97 if (free_vc_found) 98 break; /* we found a vcnumber that will work - use it */ 99 } 100 101 if (i == 0) 102 vcnum = 0; /* for most common case, ie if one smb session, use 103 vc zero. Also for case when no free vcnum, zero 104 is safest to send (some clients only send zero) */ 105 else if (free_vc_found == 0) 106 vcnum = 1; /* we can not reuse vc=0 safely, since some servers 107 reset all uids on that, but 1 is ok. */ 108 else 109 vcnum = i; 110 ses->vcnum = vcnum; 111get_vc_num_exit: 112 spin_unlock(&cifs_tcp_ses_lock); 113 114 return cpu_to_le16(vcnum); 115} 116 117static __u32 cifs_ssetup_hdr(struct cifs_ses *ses, SESSION_SETUP_ANDX *pSMB) 118{ 119 __u32 capabilities = 0; 120 121 /* init fields common to all four types of SessSetup */ 122 /* Note that offsets for first seven fields in req struct are same */ 123 /* in CIFS Specs so does not matter which of 3 forms of struct */ 124 /* that we use in next few lines */ 125 /* Note that header is initialized to zero in header_assemble */ 126 pSMB->req.AndXCommand = 0xFF; 127 pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32, 128 CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4, 129 USHRT_MAX)); 130 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq); 131 pSMB->req.VcNumber = get_next_vcnum(ses); 132 133 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */ 134 135 /* BB verify whether signing required on neg or just on auth frame 136 (and NTLM case) */ 137 138 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS | 139 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X; 140 141 if (ses->server->sign) 142 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE; 143 144 if (ses->capabilities & CAP_UNICODE) { 145 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE; 146 capabilities |= CAP_UNICODE; 147 } 148 if (ses->capabilities & CAP_STATUS32) { 149 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS; 150 capabilities |= CAP_STATUS32; 151 } 152 if (ses->capabilities & CAP_DFS) { 153 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS; 154 capabilities |= CAP_DFS; 155 } 156 if (ses->capabilities & CAP_UNIX) 157 capabilities |= CAP_UNIX; 158 159 return capabilities; 160} 161 162static void 163unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp) 164{ 165 char *bcc_ptr = *pbcc_area; 166 int bytes_ret = 0; 167 168 /* Copy OS version */ 169 bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32, 170 nls_cp); 171 bcc_ptr += 2 * bytes_ret; 172 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release, 173 32, nls_cp); 174 bcc_ptr += 2 * bytes_ret; 175 bcc_ptr += 2; /* trailing null */ 176 177 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS, 178 32, nls_cp); 179 bcc_ptr += 2 * bytes_ret; 180 bcc_ptr += 2; /* trailing null */ 181 182 *pbcc_area = bcc_ptr; 183} 184 185static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses, 186 const struct nls_table *nls_cp) 187{ 188 char *bcc_ptr = *pbcc_area; 189 int bytes_ret = 0; 190 191 /* copy domain */ 192 if (ses->domainName == NULL) { 193 /* Sending null domain better than using a bogus domain name (as 194 we did briefly in 2.6.18) since server will use its default */ 195 *bcc_ptr = 0; 196 *(bcc_ptr+1) = 0; 197 bytes_ret = 0; 198 } else 199 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName, 200 256, nls_cp); 201 bcc_ptr += 2 * bytes_ret; 202 bcc_ptr += 2; /* account for null terminator */ 203 204 *pbcc_area = bcc_ptr; 205} 206 207 208static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses, 209 const struct nls_table *nls_cp) 210{ 211 char *bcc_ptr = *pbcc_area; 212 int bytes_ret = 0; 213 214 /* BB FIXME add check that strings total less 215 than 335 or will need to send them as arrays */ 216 217 /* unicode strings, must be word aligned before the call */ 218/* if ((long) bcc_ptr % 2) { 219 *bcc_ptr = 0; 220 bcc_ptr++; 221 } */ 222 /* copy user */ 223 if (ses->user_name == NULL) { 224 /* null user mount */ 225 *bcc_ptr = 0; 226 *(bcc_ptr+1) = 0; 227 } else { 228 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name, 229 MAX_USERNAME_SIZE, nls_cp); 230 } 231 bcc_ptr += 2 * bytes_ret; 232 bcc_ptr += 2; /* account for null termination */ 233 234 unicode_domain_string(&bcc_ptr, ses, nls_cp); 235 unicode_oslm_strings(&bcc_ptr, nls_cp); 236 237 *pbcc_area = bcc_ptr; 238} 239 240static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses, 241 const struct nls_table *nls_cp) 242{ 243 char *bcc_ptr = *pbcc_area; 244 245 /* copy user */ 246 /* BB what about null user mounts - check that we do this BB */ 247 /* copy user */ 248 if (ses->user_name != NULL) { 249 strncpy(bcc_ptr, ses->user_name, MAX_USERNAME_SIZE); 250 bcc_ptr += strnlen(ses->user_name, MAX_USERNAME_SIZE); 251 } 252 /* else null user mount */ 253 *bcc_ptr = 0; 254 bcc_ptr++; /* account for null termination */ 255 256 /* copy domain */ 257 if (ses->domainName != NULL) { 258 strncpy(bcc_ptr, ses->domainName, 256); 259 bcc_ptr += strnlen(ses->domainName, 256); 260 } /* else we will send a null domain name 261 so the server will default to its own domain */ 262 *bcc_ptr = 0; 263 bcc_ptr++; 264 265 /* BB check for overflow here */ 266 267 strcpy(bcc_ptr, "Linux version "); 268 bcc_ptr += strlen("Linux version "); 269 strcpy(bcc_ptr, init_utsname()->release); 270 bcc_ptr += strlen(init_utsname()->release) + 1; 271 272 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS); 273 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1; 274 275 *pbcc_area = bcc_ptr; 276} 277 278static void 279decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses, 280 const struct nls_table *nls_cp) 281{ 282 int len; 283 char *data = *pbcc_area; 284 285 cifs_dbg(FYI, "bleft %d\n", bleft); 286 287 kfree(ses->serverOS); 288 ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp); 289 cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS); 290 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2; 291 data += len; 292 bleft -= len; 293 if (bleft <= 0) 294 return; 295 296 kfree(ses->serverNOS); 297 ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp); 298 cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS); 299 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2; 300 data += len; 301 bleft -= len; 302 if (bleft <= 0) 303 return; 304 305 kfree(ses->serverDomain); 306 ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp); 307 cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain); 308 309 return; 310} 311 312static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft, 313 struct cifs_ses *ses, 314 const struct nls_table *nls_cp) 315{ 316 int len; 317 char *bcc_ptr = *pbcc_area; 318 319 cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft); 320 321 len = strnlen(bcc_ptr, bleft); 322 if (len >= bleft) 323 return; 324 325 kfree(ses->serverOS); 326 327 ses->serverOS = kzalloc(len + 1, GFP_KERNEL); 328 if (ses->serverOS) 329 strncpy(ses->serverOS, bcc_ptr, len); 330 if (strncmp(ses->serverOS, "OS/2", 4) == 0) 331 cifs_dbg(FYI, "OS/2 server\n"); 332 333 bcc_ptr += len + 1; 334 bleft -= len + 1; 335 336 len = strnlen(bcc_ptr, bleft); 337 if (len >= bleft) 338 return; 339 340 kfree(ses->serverNOS); 341 342 ses->serverNOS = kzalloc(len + 1, GFP_KERNEL); 343 if (ses->serverNOS) 344 strncpy(ses->serverNOS, bcc_ptr, len); 345 346 bcc_ptr += len + 1; 347 bleft -= len + 1; 348 349 len = strnlen(bcc_ptr, bleft); 350 if (len > bleft) 351 return; 352 353 /* No domain field in LANMAN case. Domain is 354 returned by old servers in the SMB negprot response */ 355 /* BB For newer servers which do not support Unicode, 356 but thus do return domain here we could add parsing 357 for it later, but it is not very important */ 358 cifs_dbg(FYI, "ascii: bytes left %d\n", bleft); 359} 360 361int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, 362 struct cifs_ses *ses) 363{ 364 unsigned int tioffset; /* challenge message target info area */ 365 unsigned int tilen; /* challenge message target info area length */ 366 367 CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr; 368 369 if (blob_len < sizeof(CHALLENGE_MESSAGE)) { 370 cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len); 371 return -EINVAL; 372 } 373 374 if (memcmp(pblob->Signature, "NTLMSSP", 8)) { 375 cifs_dbg(VFS, "blob signature incorrect %s\n", 376 pblob->Signature); 377 return -EINVAL; 378 } 379 if (pblob->MessageType != NtLmChallenge) { 380 cifs_dbg(VFS, "Incorrect message type %d\n", 381 pblob->MessageType); 382 return -EINVAL; 383 } 384 385 memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE); 386 /* BB we could decode pblob->NegotiateFlags; some may be useful */ 387 /* In particular we can examine sign flags */ 388 /* BB spec says that if AvId field of MsvAvTimestamp is populated then 389 we must set the MIC field of the AUTHENTICATE_MESSAGE */ 390 ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags); 391 tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset); 392 tilen = le16_to_cpu(pblob->TargetInfoArray.Length); 393 if (tioffset > blob_len || tioffset + tilen > blob_len) { 394 cifs_dbg(VFS, "tioffset + tilen too high %u + %u", 395 tioffset, tilen); 396 return -EINVAL; 397 } 398 if (tilen) { 399 ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen, 400 GFP_KERNEL); 401 if (!ses->auth_key.response) { 402 cifs_dbg(VFS, "Challenge target info alloc failure"); 403 return -ENOMEM; 404 } 405 ses->auth_key.len = tilen; 406 } 407 408 return 0; 409} 410 411/* BB Move to ntlmssp.c eventually */ 412 413/* We do not malloc the blob, it is passed in pbuffer, because 414 it is fixed size, and small, making this approach cleaner */ 415void build_ntlmssp_negotiate_blob(unsigned char *pbuffer, 416 struct cifs_ses *ses) 417{ 418 NEGOTIATE_MESSAGE *sec_blob = (NEGOTIATE_MESSAGE *)pbuffer; 419 __u32 flags; 420 421 memset(pbuffer, 0, sizeof(NEGOTIATE_MESSAGE)); 422 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8); 423 sec_blob->MessageType = NtLmNegotiate; 424 425 /* BB is NTLMV2 session security format easier to use here? */ 426 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET | 427 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | 428 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC; 429 if (ses->server->sign) { 430 flags |= NTLMSSP_NEGOTIATE_SIGN; 431 if (!ses->server->session_estab) 432 flags |= NTLMSSP_NEGOTIATE_KEY_XCH; 433 } 434 435 sec_blob->NegotiateFlags = cpu_to_le32(flags); 436 437 sec_blob->WorkstationName.BufferOffset = 0; 438 sec_blob->WorkstationName.Length = 0; 439 sec_blob->WorkstationName.MaximumLength = 0; 440 441 /* Domain name is sent on the Challenge not Negotiate NTLMSSP request */ 442 sec_blob->DomainName.BufferOffset = 0; 443 sec_blob->DomainName.Length = 0; 444 sec_blob->DomainName.MaximumLength = 0; 445} 446 447/* We do not malloc the blob, it is passed in pbuffer, because its 448 maximum possible size is fixed and small, making this approach cleaner. 449 This function returns the length of the data in the blob */ 450int build_ntlmssp_auth_blob(unsigned char *pbuffer, 451 u16 *buflen, 452 struct cifs_ses *ses, 453 const struct nls_table *nls_cp) 454{ 455 int rc; 456 AUTHENTICATE_MESSAGE *sec_blob = (AUTHENTICATE_MESSAGE *)pbuffer; 457 __u32 flags; 458 unsigned char *tmp; 459 460 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8); 461 sec_blob->MessageType = NtLmAuthenticate; 462 463 flags = NTLMSSP_NEGOTIATE_56 | 464 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_TARGET_INFO | 465 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | 466 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC; 467 if (ses->server->sign) { 468 flags |= NTLMSSP_NEGOTIATE_SIGN; 469 if (!ses->server->session_estab) 470 flags |= NTLMSSP_NEGOTIATE_KEY_XCH; 471 } 472 473 tmp = pbuffer + sizeof(AUTHENTICATE_MESSAGE); 474 sec_blob->NegotiateFlags = cpu_to_le32(flags); 475 476 sec_blob->LmChallengeResponse.BufferOffset = 477 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE)); 478 sec_blob->LmChallengeResponse.Length = 0; 479 sec_blob->LmChallengeResponse.MaximumLength = 0; 480 481 sec_blob->NtChallengeResponse.BufferOffset = cpu_to_le32(tmp - pbuffer); 482 rc = setup_ntlmv2_rsp(ses, nls_cp); 483 if (rc) { 484 cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc); 485 goto setup_ntlmv2_ret; 486 } 487 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE, 488 ses->auth_key.len - CIFS_SESS_KEY_SIZE); 489 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE; 490 491 sec_blob->NtChallengeResponse.Length = 492 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); 493 sec_blob->NtChallengeResponse.MaximumLength = 494 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); 495 496 if (ses->domainName == NULL) { 497 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer); 498 sec_blob->DomainName.Length = 0; 499 sec_blob->DomainName.MaximumLength = 0; 500 tmp += 2; 501 } else { 502 int len; 503 len = cifs_strtoUTF16((__le16 *)tmp, ses->domainName, 504 MAX_USERNAME_SIZE, nls_cp); 505 len *= 2; /* unicode is 2 bytes each */ 506 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer); 507 sec_blob->DomainName.Length = cpu_to_le16(len); 508 sec_blob->DomainName.MaximumLength = cpu_to_le16(len); 509 tmp += len; 510 } 511 512 if (ses->user_name == NULL) { 513 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer); 514 sec_blob->UserName.Length = 0; 515 sec_blob->UserName.MaximumLength = 0; 516 tmp += 2; 517 } else { 518 int len; 519 len = cifs_strtoUTF16((__le16 *)tmp, ses->user_name, 520 MAX_USERNAME_SIZE, nls_cp); 521 len *= 2; /* unicode is 2 bytes each */ 522 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer); 523 sec_blob->UserName.Length = cpu_to_le16(len); 524 sec_blob->UserName.MaximumLength = cpu_to_le16(len); 525 tmp += len; 526 } 527 528 sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - pbuffer); 529 sec_blob->WorkstationName.Length = 0; 530 sec_blob->WorkstationName.MaximumLength = 0; 531 tmp += 2; 532 533 if (((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) || 534 (ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) 535 && !calc_seckey(ses)) { 536 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE); 537 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer); 538 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE); 539 sec_blob->SessionKey.MaximumLength = 540 cpu_to_le16(CIFS_CPHTXT_SIZE); 541 tmp += CIFS_CPHTXT_SIZE; 542 } else { 543 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer); 544 sec_blob->SessionKey.Length = 0; 545 sec_blob->SessionKey.MaximumLength = 0; 546 } 547 548setup_ntlmv2_ret: 549 *buflen = tmp - pbuffer; 550 return rc; 551} 552 553enum securityEnum 554select_sectype(struct TCP_Server_Info *server, enum securityEnum requested) 555{ 556 switch (server->negflavor) { 557 case CIFS_NEGFLAVOR_EXTENDED: 558 switch (requested) { 559 case Kerberos: 560 case RawNTLMSSP: 561 return requested; 562 case Unspecified: 563 if (server->sec_ntlmssp && 564 (global_secflags & CIFSSEC_MAY_NTLMSSP)) 565 return RawNTLMSSP; 566 if ((server->sec_kerberos || server->sec_mskerberos) && 567 (global_secflags & CIFSSEC_MAY_KRB5)) 568 return Kerberos; 569 /* Fallthrough */ 570 default: 571 return Unspecified; 572 } 573 case CIFS_NEGFLAVOR_UNENCAP: 574 switch (requested) { 575 case NTLM: 576 case NTLMv2: 577 return requested; 578 case Unspecified: 579 if (global_secflags & CIFSSEC_MAY_NTLMV2) 580 return NTLMv2; 581 if (global_secflags & CIFSSEC_MAY_NTLM) 582 return NTLM; 583 /* Fallthrough */ 584 default: 585 return Unspecified; 586 } 587 case CIFS_NEGFLAVOR_LANMAN: 588 switch (requested) { 589 case LANMAN: 590 return requested; 591 case Unspecified: 592 if (global_secflags & CIFSSEC_MAY_LANMAN) 593 return LANMAN; 594 /* Fallthrough */ 595 default: 596 return Unspecified; 597 } 598 default: 599 return Unspecified; 600 } 601} 602 603int 604CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses, 605 const struct nls_table *nls_cp) 606{ 607 int rc = 0; 608 int wct; 609 struct smb_hdr *smb_buf; 610 char *bcc_ptr; 611 char *str_area; 612 SESSION_SETUP_ANDX *pSMB; 613 __u32 capabilities; 614 __u16 count; 615 int resp_buf_type; 616 struct kvec iov[3]; 617 enum securityEnum type; 618 __u16 action, bytes_remaining; 619 struct key *spnego_key = NULL; 620 __le32 phase = NtLmNegotiate; /* NTLMSSP, if needed, is multistage */ 621 u16 blob_len; 622 char *ntlmsspblob = NULL; 623 624 if (ses == NULL) { 625 WARN(1, "%s: ses == NULL!", __func__); 626 return -EINVAL; 627 } 628 629 type = select_sectype(ses->server, ses->sectype); 630 cifs_dbg(FYI, "sess setup type %d\n", type); 631 if (type == Unspecified) { 632 cifs_dbg(VFS, "Unable to select appropriate authentication method!"); 633 return -EINVAL; 634 } 635 636 if (type == RawNTLMSSP) { 637 /* if memory allocation is successful, caller of this function 638 * frees it. 639 */ 640 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL); 641 if (!ses->ntlmssp) 642 return -ENOMEM; 643 } 644 645ssetup_ntlmssp_authenticate: 646 if (phase == NtLmChallenge) 647 phase = NtLmAuthenticate; /* if ntlmssp, now final phase */ 648 649 if (type == LANMAN) { 650#ifndef CONFIG_CIFS_WEAK_PW_HASH 651 /* LANMAN and plaintext are less secure and off by default. 652 So we make this explicitly be turned on in kconfig (in the 653 build) and turned on at runtime (changed from the default) 654 in proc/fs/cifs or via mount parm. Unfortunately this is 655 needed for old Win (e.g. Win95), some obscure NAS and OS/2 */ 656 return -EOPNOTSUPP; 657#endif 658 wct = 10; /* lanman 2 style sessionsetup */ 659 } else if ((type == NTLM) || (type == NTLMv2)) { 660 /* For NTLMv2 failures eventually may need to retry NTLM */ 661 wct = 13; /* old style NTLM sessionsetup */ 662 } else /* same size: negotiate or auth, NTLMSSP or extended security */ 663 wct = 12; 664 665 rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses, 666 (void **)&smb_buf); 667 if (rc) 668 return rc; 669 670 pSMB = (SESSION_SETUP_ANDX *)smb_buf; 671 672 capabilities = cifs_ssetup_hdr(ses, pSMB); 673 674 /* we will send the SMB in three pieces: 675 a fixed length beginning part, an optional 676 SPNEGO blob (which can be zero length), and a 677 last part which will include the strings 678 and rest of bcc area. This allows us to avoid 679 a large buffer 17K allocation */ 680 iov[0].iov_base = (char *)pSMB; 681 iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4; 682 683 /* setting this here allows the code at the end of the function 684 to free the request buffer if there's an error */ 685 resp_buf_type = CIFS_SMALL_BUFFER; 686 687 /* 2000 big enough to fit max user, domain, NOS name etc. */ 688 str_area = kmalloc(2000, GFP_KERNEL); 689 if (str_area == NULL) { 690 rc = -ENOMEM; 691 goto ssetup_exit; 692 } 693 bcc_ptr = str_area; 694 695 iov[1].iov_base = NULL; 696 iov[1].iov_len = 0; 697 698 if (type == LANMAN) { 699#ifdef CONFIG_CIFS_WEAK_PW_HASH 700 char lnm_session_key[CIFS_AUTH_RESP_SIZE]; 701 702 pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE; 703 704 /* no capabilities flags in old lanman negotiation */ 705 706 pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE); 707 708 /* Calculate hash with password and copy into bcc_ptr. 709 * Encryption Key (stored as in cryptkey) gets used if the 710 * security mode bit in Negottiate Protocol response states 711 * to use challenge/response method (i.e. Password bit is 1). 712 */ 713 714 rc = calc_lanman_hash(ses->password, ses->server->cryptkey, 715 ses->server->sec_mode & SECMODE_PW_ENCRYPT ? 716 true : false, lnm_session_key); 717 718 memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE); 719 bcc_ptr += CIFS_AUTH_RESP_SIZE; 720 721 /* can not sign if LANMAN negotiated so no need 722 to calculate signing key? but what if server 723 changed to do higher than lanman dialect and 724 we reconnected would we ever calc signing_key? */ 725 726 cifs_dbg(FYI, "Negotiating LANMAN setting up strings\n"); 727 /* Unicode not allowed for LANMAN dialects */ 728 ascii_ssetup_strings(&bcc_ptr, ses, nls_cp); 729#endif 730 } else if (type == NTLM) { 731 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities); 732 pSMB->req_no_secext.CaseInsensitivePasswordLength = 733 cpu_to_le16(CIFS_AUTH_RESP_SIZE); 734 pSMB->req_no_secext.CaseSensitivePasswordLength = 735 cpu_to_le16(CIFS_AUTH_RESP_SIZE); 736 737 /* calculate ntlm response and session key */ 738 rc = setup_ntlm_response(ses, nls_cp); 739 if (rc) { 740 cifs_dbg(VFS, "Error %d during NTLM authentication\n", 741 rc); 742 goto ssetup_exit; 743 } 744 745 /* copy ntlm response */ 746 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, 747 CIFS_AUTH_RESP_SIZE); 748 bcc_ptr += CIFS_AUTH_RESP_SIZE; 749 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, 750 CIFS_AUTH_RESP_SIZE); 751 bcc_ptr += CIFS_AUTH_RESP_SIZE; 752 753 if (ses->capabilities & CAP_UNICODE) { 754 /* unicode strings must be word aligned */ 755 if (iov[0].iov_len % 2) { 756 *bcc_ptr = 0; 757 bcc_ptr++; 758 } 759 unicode_ssetup_strings(&bcc_ptr, ses, nls_cp); 760 } else 761 ascii_ssetup_strings(&bcc_ptr, ses, nls_cp); 762 } else if (type == NTLMv2) { 763 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities); 764 765 /* LM2 password would be here if we supported it */ 766 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0; 767 768 /* calculate nlmv2 response and session key */ 769 rc = setup_ntlmv2_rsp(ses, nls_cp); 770 if (rc) { 771 cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", 772 rc); 773 goto ssetup_exit; 774 } 775 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, 776 ses->auth_key.len - CIFS_SESS_KEY_SIZE); 777 bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE; 778 779 /* set case sensitive password length after tilen may get 780 * assigned, tilen is 0 otherwise. 781 */ 782 pSMB->req_no_secext.CaseSensitivePasswordLength = 783 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); 784 785 if (ses->capabilities & CAP_UNICODE) { 786 if (iov[0].iov_len % 2) { 787 *bcc_ptr = 0; 788 bcc_ptr++; 789 } 790 unicode_ssetup_strings(&bcc_ptr, ses, nls_cp); 791 } else 792 ascii_ssetup_strings(&bcc_ptr, ses, nls_cp); 793 } else if (type == Kerberos) { 794#ifdef CONFIG_CIFS_UPCALL 795 struct cifs_spnego_msg *msg; 796 797 spnego_key = cifs_get_spnego_key(ses); 798 if (IS_ERR(spnego_key)) { 799 rc = PTR_ERR(spnego_key); 800 spnego_key = NULL; 801 goto ssetup_exit; 802 } 803 804 msg = spnego_key->payload.data; 805 /* check version field to make sure that cifs.upcall is 806 sending us a response in an expected form */ 807 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) { 808 cifs_dbg(VFS, "incorrect version of cifs.upcall " 809 "expected %d but got %d)", 810 CIFS_SPNEGO_UPCALL_VERSION, msg->version); 811 rc = -EKEYREJECTED; 812 goto ssetup_exit; 813 } 814 815 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len, 816 GFP_KERNEL); 817 if (!ses->auth_key.response) { 818 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory", 819 msg->sesskey_len); 820 rc = -ENOMEM; 821 goto ssetup_exit; 822 } 823 ses->auth_key.len = msg->sesskey_len; 824 825 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC; 826 capabilities |= CAP_EXTENDED_SECURITY; 827 pSMB->req.Capabilities = cpu_to_le32(capabilities); 828 iov[1].iov_base = msg->data + msg->sesskey_len; 829 iov[1].iov_len = msg->secblob_len; 830 pSMB->req.SecurityBlobLength = cpu_to_le16(iov[1].iov_len); 831 832 if (ses->capabilities & CAP_UNICODE) { 833 /* unicode strings must be word aligned */ 834 if ((iov[0].iov_len + iov[1].iov_len) % 2) { 835 *bcc_ptr = 0; 836 bcc_ptr++; 837 } 838 unicode_oslm_strings(&bcc_ptr, nls_cp); 839 unicode_domain_string(&bcc_ptr, ses, nls_cp); 840 } else 841 /* BB: is this right? */ 842 ascii_ssetup_strings(&bcc_ptr, ses, nls_cp); 843#else /* ! CONFIG_CIFS_UPCALL */ 844 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n"); 845 rc = -ENOSYS; 846 goto ssetup_exit; 847#endif /* CONFIG_CIFS_UPCALL */ 848 } else if (type == RawNTLMSSP) { 849 if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) { 850 cifs_dbg(VFS, "NTLMSSP requires Unicode support\n"); 851 rc = -ENOSYS; 852 goto ssetup_exit; 853 } 854 855 cifs_dbg(FYI, "ntlmssp session setup phase %d\n", phase); 856 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC; 857 capabilities |= CAP_EXTENDED_SECURITY; 858 pSMB->req.Capabilities |= cpu_to_le32(capabilities); 859 switch(phase) { 860 case NtLmNegotiate: 861 build_ntlmssp_negotiate_blob( 862 pSMB->req.SecurityBlob, ses); 863 iov[1].iov_len = sizeof(NEGOTIATE_MESSAGE); 864 iov[1].iov_base = pSMB->req.SecurityBlob; 865 pSMB->req.SecurityBlobLength = 866 cpu_to_le16(sizeof(NEGOTIATE_MESSAGE)); 867 break; 868 case NtLmAuthenticate: 869 /* 870 * 5 is an empirical value, large enough to hold 871 * authenticate message plus max 10 of av paris, 872 * domain, user, workstation names, flags, etc. 873 */ 874 ntlmsspblob = kzalloc( 875 5*sizeof(struct _AUTHENTICATE_MESSAGE), 876 GFP_KERNEL); 877 if (!ntlmsspblob) { 878 rc = -ENOMEM; 879 goto ssetup_exit; 880 } 881 882 rc = build_ntlmssp_auth_blob(ntlmsspblob, 883 &blob_len, ses, nls_cp); 884 if (rc) 885 goto ssetup_exit; 886 iov[1].iov_len = blob_len; 887 iov[1].iov_base = ntlmsspblob; 888 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len); 889 /* 890 * Make sure that we tell the server that we are using 891 * the uid that it just gave us back on the response 892 * (challenge) 893 */ 894 smb_buf->Uid = ses->Suid; 895 break; 896 default: 897 cifs_dbg(VFS, "invalid phase %d\n", phase); 898 rc = -ENOSYS; 899 goto ssetup_exit; 900 } 901 /* unicode strings must be word aligned */ 902 if ((iov[0].iov_len + iov[1].iov_len) % 2) { 903 *bcc_ptr = 0; 904 bcc_ptr++; 905 } 906 unicode_oslm_strings(&bcc_ptr, nls_cp); 907 } else { 908 cifs_dbg(VFS, "secType %d not supported!\n", type); 909 rc = -ENOSYS; 910 goto ssetup_exit; 911 } 912 913 iov[2].iov_base = str_area; 914 iov[2].iov_len = (long) bcc_ptr - (long) str_area; 915 916 count = iov[1].iov_len + iov[2].iov_len; 917 smb_buf->smb_buf_length = 918 cpu_to_be32(be32_to_cpu(smb_buf->smb_buf_length) + count); 919 920 put_bcc(count, smb_buf); 921 922 rc = SendReceive2(xid, ses, iov, 3 /* num_iovecs */, &resp_buf_type, 923 CIFS_LOG_ERROR); 924 /* SMB request buf freed in SendReceive2 */ 925 926 pSMB = (SESSION_SETUP_ANDX *)iov[0].iov_base; 927 smb_buf = (struct smb_hdr *)iov[0].iov_base; 928 929 if ((type == RawNTLMSSP) && (resp_buf_type != CIFS_NO_BUFFER) && 930 (smb_buf->Status.CifsError == 931 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))) { 932 if (phase != NtLmNegotiate) { 933 cifs_dbg(VFS, "Unexpected more processing error\n"); 934 goto ssetup_exit; 935 } 936 /* NTLMSSP Negotiate sent now processing challenge (response) */ 937 phase = NtLmChallenge; /* process ntlmssp challenge */ 938 rc = 0; /* MORE_PROC rc is not an error here, but expected */ 939 } 940 if (rc) 941 goto ssetup_exit; 942 943 if ((smb_buf->WordCount != 3) && (smb_buf->WordCount != 4)) { 944 rc = -EIO; 945 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount); 946 goto ssetup_exit; 947 } 948 action = le16_to_cpu(pSMB->resp.Action); 949 if (action & GUEST_LOGIN) 950 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */ 951 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */ 952 cifs_dbg(FYI, "UID = %llu\n", ses->Suid); 953 /* response can have either 3 or 4 word count - Samba sends 3 */ 954 /* and lanman response is 3 */ 955 bytes_remaining = get_bcc(smb_buf); 956 bcc_ptr = pByteArea(smb_buf); 957 958 if (smb_buf->WordCount == 4) { 959 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength); 960 if (blob_len > bytes_remaining) { 961 cifs_dbg(VFS, "bad security blob length %d\n", 962 blob_len); 963 rc = -EINVAL; 964 goto ssetup_exit; 965 } 966 if (phase == NtLmChallenge) { 967 rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses); 968 /* now goto beginning for ntlmssp authenticate phase */ 969 if (rc) 970 goto ssetup_exit; 971 } 972 bcc_ptr += blob_len; 973 bytes_remaining -= blob_len; 974 } 975 976 /* BB check if Unicode and decode strings */ 977 if (bytes_remaining == 0) { 978 /* no string area to decode, do nothing */ 979 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) { 980 /* unicode string area must be word-aligned */ 981 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) { 982 ++bcc_ptr; 983 --bytes_remaining; 984 } 985 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses, nls_cp); 986 } else { 987 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses, nls_cp); 988 } 989 990ssetup_exit: 991 if (spnego_key) { 992 key_invalidate(spnego_key); 993 key_put(spnego_key); 994 } 995 kfree(str_area); 996 kfree(ntlmsspblob); 997 ntlmsspblob = NULL; 998 if (resp_buf_type == CIFS_SMALL_BUFFER) { 999 cifs_dbg(FYI, "ssetup freeing small buf %p\n", iov[0].iov_base); 1000 cifs_small_buf_release(iov[0].iov_base); 1001 } else if (resp_buf_type == CIFS_LARGE_BUFFER) 1002 cifs_buf_release(iov[0].iov_base); 1003 1004 /* if ntlmssp, and negotiate succeeded, proceed to authenticate phase */ 1005 if ((phase == NtLmChallenge) && (rc == 0)) 1006 goto ssetup_ntlmssp_authenticate; 1007 1008 return rc; 1009} 1010