sess.c revision f7c5445a9deecffea8a4fffc0163bf582411ac8a
1/* 2 * fs/cifs/sess.c 3 * 4 * SMB/CIFS session setup handling routines 5 * 6 * Copyright (c) International Business Machines Corp., 2006, 2009 7 * Author(s): Steve French (sfrench@us.ibm.com) 8 * 9 * This library is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU Lesser General Public License as published 11 * by the Free Software Foundation; either version 2.1 of the License, or 12 * (at your option) any later version. 13 * 14 * This library is distributed in the hope that it will be useful, 15 * but WITHOUT ANY WARRANTY; without even the implied warranty of 16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See 17 * the GNU Lesser General Public License for more details. 18 * 19 * You should have received a copy of the GNU Lesser General Public License 20 * along with this library; if not, write to the Free Software 21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 22 */ 23 24#include "cifspdu.h" 25#include "cifsglob.h" 26#include "cifsproto.h" 27#include "cifs_unicode.h" 28#include "cifs_debug.h" 29#include "ntlmssp.h" 30#include "nterr.h" 31#include <linux/utsname.h> 32#include <linux/slab.h> 33#include "cifs_spnego.h" 34 35/* 36 * Checks if this is the first smb session to be reconnected after 37 * the socket has been reestablished (so we know whether to use vc 0). 38 * Called while holding the cifs_tcp_ses_lock, so do not block 39 */ 40static bool is_first_ses_reconnect(struct cifsSesInfo *ses) 41{ 42 struct list_head *tmp; 43 struct cifsSesInfo *tmp_ses; 44 45 list_for_each(tmp, &ses->server->smb_ses_list) { 46 tmp_ses = list_entry(tmp, struct cifsSesInfo, 47 smb_ses_list); 48 if (tmp_ses->need_reconnect == false) 49 return false; 50 } 51 /* could not find a session that was already connected, 52 this must be the first one we are reconnecting */ 53 return true; 54} 55 56/* 57 * vc number 0 is treated specially by some servers, and should be the 58 * first one we request. After that we can use vcnumbers up to maxvcs, 59 * one for each smb session (some Windows versions set maxvcs incorrectly 60 * so maxvc=1 can be ignored). If we have too many vcs, we can reuse 61 * any vc but zero (some servers reset the connection on vcnum zero) 62 * 63 */ 64static __le16 get_next_vcnum(struct cifsSesInfo *ses) 65{ 66 __u16 vcnum = 0; 67 struct list_head *tmp; 68 struct cifsSesInfo *tmp_ses; 69 __u16 max_vcs = ses->server->max_vcs; 70 __u16 i; 71 int free_vc_found = 0; 72 73 /* Quoting the MS-SMB specification: "Windows-based SMB servers set this 74 field to one but do not enforce this limit, which allows an SMB client 75 to establish more virtual circuits than allowed by this value ... but 76 other server implementations can enforce this limit." */ 77 if (max_vcs < 2) 78 max_vcs = 0xFFFF; 79 80 spin_lock(&cifs_tcp_ses_lock); 81 if ((ses->need_reconnect) && is_first_ses_reconnect(ses)) 82 goto get_vc_num_exit; /* vcnum will be zero */ 83 for (i = ses->server->srv_count - 1; i < max_vcs; i++) { 84 if (i == 0) /* this is the only connection, use vc 0 */ 85 break; 86 87 free_vc_found = 1; 88 89 list_for_each(tmp, &ses->server->smb_ses_list) { 90 tmp_ses = list_entry(tmp, struct cifsSesInfo, 91 smb_ses_list); 92 if (tmp_ses->vcnum == i) { 93 free_vc_found = 0; 94 break; /* found duplicate, try next vcnum */ 95 } 96 } 97 if (free_vc_found) 98 break; /* we found a vcnumber that will work - use it */ 99 } 100 101 if (i == 0) 102 vcnum = 0; /* for most common case, ie if one smb session, use 103 vc zero. Also for case when no free vcnum, zero 104 is safest to send (some clients only send zero) */ 105 else if (free_vc_found == 0) 106 vcnum = 1; /* we can not reuse vc=0 safely, since some servers 107 reset all uids on that, but 1 is ok. */ 108 else 109 vcnum = i; 110 ses->vcnum = vcnum; 111get_vc_num_exit: 112 spin_unlock(&cifs_tcp_ses_lock); 113 114 return cpu_to_le16(vcnum); 115} 116 117static __u32 cifs_ssetup_hdr(struct cifsSesInfo *ses, SESSION_SETUP_ANDX *pSMB) 118{ 119 __u32 capabilities = 0; 120 121 /* init fields common to all four types of SessSetup */ 122 /* Note that offsets for first seven fields in req struct are same */ 123 /* in CIFS Specs so does not matter which of 3 forms of struct */ 124 /* that we use in next few lines */ 125 /* Note that header is initialized to zero in header_assemble */ 126 pSMB->req.AndXCommand = 0xFF; 127 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf); 128 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq); 129 pSMB->req.VcNumber = get_next_vcnum(ses); 130 131 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */ 132 133 /* BB verify whether signing required on neg or just on auth frame 134 (and NTLM case) */ 135 136 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS | 137 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X; 138 139 if (ses->server->secMode & 140 (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) 141 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE; 142 143 if (ses->capabilities & CAP_UNICODE) { 144 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE; 145 capabilities |= CAP_UNICODE; 146 } 147 if (ses->capabilities & CAP_STATUS32) { 148 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS; 149 capabilities |= CAP_STATUS32; 150 } 151 if (ses->capabilities & CAP_DFS) { 152 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS; 153 capabilities |= CAP_DFS; 154 } 155 if (ses->capabilities & CAP_UNIX) 156 capabilities |= CAP_UNIX; 157 158 return capabilities; 159} 160 161static void 162unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp) 163{ 164 char *bcc_ptr = *pbcc_area; 165 int bytes_ret = 0; 166 167 /* Copy OS version */ 168 bytes_ret = cifs_strtoUCS((__le16 *)bcc_ptr, "Linux version ", 32, 169 nls_cp); 170 bcc_ptr += 2 * bytes_ret; 171 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, init_utsname()->release, 172 32, nls_cp); 173 bcc_ptr += 2 * bytes_ret; 174 bcc_ptr += 2; /* trailing null */ 175 176 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS, 177 32, nls_cp); 178 bcc_ptr += 2 * bytes_ret; 179 bcc_ptr += 2; /* trailing null */ 180 181 *pbcc_area = bcc_ptr; 182} 183 184static void unicode_domain_string(char **pbcc_area, struct cifsSesInfo *ses, 185 const struct nls_table *nls_cp) 186{ 187 char *bcc_ptr = *pbcc_area; 188 int bytes_ret = 0; 189 190 /* copy domain */ 191 if (ses->domainName == NULL) { 192 /* Sending null domain better than using a bogus domain name (as 193 we did briefly in 2.6.18) since server will use its default */ 194 *bcc_ptr = 0; 195 *(bcc_ptr+1) = 0; 196 bytes_ret = 0; 197 } else 198 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->domainName, 199 256, nls_cp); 200 bcc_ptr += 2 * bytes_ret; 201 bcc_ptr += 2; /* account for null terminator */ 202 203 *pbcc_area = bcc_ptr; 204} 205 206 207static void unicode_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses, 208 const struct nls_table *nls_cp) 209{ 210 char *bcc_ptr = *pbcc_area; 211 int bytes_ret = 0; 212 213 /* BB FIXME add check that strings total less 214 than 335 or will need to send them as arrays */ 215 216 /* unicode strings, must be word aligned before the call */ 217/* if ((long) bcc_ptr % 2) { 218 *bcc_ptr = 0; 219 bcc_ptr++; 220 } */ 221 /* copy user */ 222 if (ses->userName == NULL) { 223 /* null user mount */ 224 *bcc_ptr = 0; 225 *(bcc_ptr+1) = 0; 226 } else { 227 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->userName, 228 MAX_USERNAME_SIZE, nls_cp); 229 } 230 bcc_ptr += 2 * bytes_ret; 231 bcc_ptr += 2; /* account for null termination */ 232 233 unicode_domain_string(&bcc_ptr, ses, nls_cp); 234 unicode_oslm_strings(&bcc_ptr, nls_cp); 235 236 *pbcc_area = bcc_ptr; 237} 238 239static void ascii_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses, 240 const struct nls_table *nls_cp) 241{ 242 char *bcc_ptr = *pbcc_area; 243 244 /* copy user */ 245 /* BB what about null user mounts - check that we do this BB */ 246 /* copy user */ 247 if (ses->userName == NULL) { 248 /* BB what about null user mounts - check that we do this BB */ 249 } else { 250 strncpy(bcc_ptr, ses->userName, MAX_USERNAME_SIZE); 251 } 252 bcc_ptr += strnlen(ses->userName, MAX_USERNAME_SIZE); 253 *bcc_ptr = 0; 254 bcc_ptr++; /* account for null termination */ 255 256 /* copy domain */ 257 258 if (ses->domainName != NULL) { 259 strncpy(bcc_ptr, ses->domainName, 256); 260 bcc_ptr += strnlen(ses->domainName, 256); 261 } /* else we will send a null domain name 262 so the server will default to its own domain */ 263 *bcc_ptr = 0; 264 bcc_ptr++; 265 266 /* BB check for overflow here */ 267 268 strcpy(bcc_ptr, "Linux version "); 269 bcc_ptr += strlen("Linux version "); 270 strcpy(bcc_ptr, init_utsname()->release); 271 bcc_ptr += strlen(init_utsname()->release) + 1; 272 273 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS); 274 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1; 275 276 *pbcc_area = bcc_ptr; 277} 278 279static void 280decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifsSesInfo *ses, 281 const struct nls_table *nls_cp) 282{ 283 int len; 284 char *data = *pbcc_area; 285 286 cFYI(1, "bleft %d", bleft); 287 288 /* 289 * Windows servers do not always double null terminate their final 290 * Unicode string. Check to see if there are an uneven number of bytes 291 * left. If so, then add an extra NULL pad byte to the end of the 292 * response. 293 * 294 * See section 2.7.2 in "Implementing CIFS" for details 295 */ 296 if (bleft % 2) { 297 data[bleft] = 0; 298 ++bleft; 299 } 300 301 kfree(ses->serverOS); 302 ses->serverOS = cifs_strndup_from_ucs(data, bleft, true, nls_cp); 303 cFYI(1, "serverOS=%s", ses->serverOS); 304 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2; 305 data += len; 306 bleft -= len; 307 if (bleft <= 0) 308 return; 309 310 kfree(ses->serverNOS); 311 ses->serverNOS = cifs_strndup_from_ucs(data, bleft, true, nls_cp); 312 cFYI(1, "serverNOS=%s", ses->serverNOS); 313 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2; 314 data += len; 315 bleft -= len; 316 if (bleft <= 0) 317 return; 318 319 kfree(ses->serverDomain); 320 ses->serverDomain = cifs_strndup_from_ucs(data, bleft, true, nls_cp); 321 cFYI(1, "serverDomain=%s", ses->serverDomain); 322 323 return; 324} 325 326static int decode_ascii_ssetup(char **pbcc_area, int bleft, 327 struct cifsSesInfo *ses, 328 const struct nls_table *nls_cp) 329{ 330 int rc = 0; 331 int len; 332 char *bcc_ptr = *pbcc_area; 333 334 cFYI(1, "decode sessetup ascii. bleft %d", bleft); 335 336 len = strnlen(bcc_ptr, bleft); 337 if (len >= bleft) 338 return rc; 339 340 kfree(ses->serverOS); 341 342 ses->serverOS = kzalloc(len + 1, GFP_KERNEL); 343 if (ses->serverOS) 344 strncpy(ses->serverOS, bcc_ptr, len); 345 if (strncmp(ses->serverOS, "OS/2", 4) == 0) { 346 cFYI(1, "OS/2 server"); 347 ses->flags |= CIFS_SES_OS2; 348 } 349 350 bcc_ptr += len + 1; 351 bleft -= len + 1; 352 353 len = strnlen(bcc_ptr, bleft); 354 if (len >= bleft) 355 return rc; 356 357 kfree(ses->serverNOS); 358 359 ses->serverNOS = kzalloc(len + 1, GFP_KERNEL); 360 if (ses->serverNOS) 361 strncpy(ses->serverNOS, bcc_ptr, len); 362 363 bcc_ptr += len + 1; 364 bleft -= len + 1; 365 366 len = strnlen(bcc_ptr, bleft); 367 if (len > bleft) 368 return rc; 369 370 /* No domain field in LANMAN case. Domain is 371 returned by old servers in the SMB negprot response */ 372 /* BB For newer servers which do not support Unicode, 373 but thus do return domain here we could add parsing 374 for it later, but it is not very important */ 375 cFYI(1, "ascii: bytes left %d", bleft); 376 377 return rc; 378} 379 380static int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, 381 struct cifsSesInfo *ses) 382{ 383 unsigned int tioffset; /* challenge message target info area */ 384 unsigned int tilen; /* challenge message target info area length */ 385 386 CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr; 387 388 if (blob_len < sizeof(CHALLENGE_MESSAGE)) { 389 cERROR(1, "challenge blob len %d too small", blob_len); 390 return -EINVAL; 391 } 392 393 if (memcmp(pblob->Signature, "NTLMSSP", 8)) { 394 cERROR(1, "blob signature incorrect %s", pblob->Signature); 395 return -EINVAL; 396 } 397 if (pblob->MessageType != NtLmChallenge) { 398 cERROR(1, "Incorrect message type %d", pblob->MessageType); 399 return -EINVAL; 400 } 401 402 memcpy(ses->cryptKey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE); 403 /* BB we could decode pblob->NegotiateFlags; some may be useful */ 404 /* In particular we can examine sign flags */ 405 /* BB spec says that if AvId field of MsvAvTimestamp is populated then 406 we must set the MIC field of the AUTHENTICATE_MESSAGE */ 407 ses->ntlmssp.server_flags = le32_to_cpu(pblob->NegotiateFlags); 408 tioffset = cpu_to_le16(pblob->TargetInfoArray.BufferOffset); 409 tilen = cpu_to_le16(pblob->TargetInfoArray.Length); 410 ses->tilen = tilen; 411 if (ses->tilen) { 412 ses->tiblob = kmalloc(tilen, GFP_KERNEL); 413 if (!ses->tiblob) { 414 cERROR(1, "Challenge target info allocation failure"); 415 ses->tilen = 0; 416 return -ENOMEM; 417 } 418 memcpy(ses->tiblob, bcc_ptr + tioffset, ses->tilen); 419 } 420 421 return 0; 422} 423 424#ifdef CONFIG_CIFS_EXPERIMENTAL 425/* BB Move to ntlmssp.c eventually */ 426 427/* We do not malloc the blob, it is passed in pbuffer, because 428 it is fixed size, and small, making this approach cleaner */ 429static void build_ntlmssp_negotiate_blob(unsigned char *pbuffer, 430 struct cifsSesInfo *ses) 431{ 432 NEGOTIATE_MESSAGE *sec_blob = (NEGOTIATE_MESSAGE *)pbuffer; 433 __u32 flags; 434 435 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8); 436 sec_blob->MessageType = NtLmNegotiate; 437 438 /* BB is NTLMV2 session security format easier to use here? */ 439 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET | 440 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | 441 NTLMSSP_NEGOTIATE_NTLM; 442 if (ses->server->secMode & 443 (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) { 444 flags |= NTLMSSP_NEGOTIATE_SIGN; 445 if (!ses->server->session_estab) 446 flags |= NTLMSSP_NEGOTIATE_KEY_XCH | 447 NTLMSSP_NEGOTIATE_EXTENDED_SEC; 448 } 449 450 sec_blob->NegotiateFlags |= cpu_to_le32(flags); 451 452 sec_blob->WorkstationName.BufferOffset = 0; 453 sec_blob->WorkstationName.Length = 0; 454 sec_blob->WorkstationName.MaximumLength = 0; 455 456 /* Domain name is sent on the Challenge not Negotiate NTLMSSP request */ 457 sec_blob->DomainName.BufferOffset = 0; 458 sec_blob->DomainName.Length = 0; 459 sec_blob->DomainName.MaximumLength = 0; 460} 461 462/* We do not malloc the blob, it is passed in pbuffer, because its 463 maximum possible size is fixed and small, making this approach cleaner. 464 This function returns the length of the data in the blob */ 465static int build_ntlmssp_auth_blob(unsigned char *pbuffer, 466 u16 *buflen, 467 struct cifsSesInfo *ses, 468 const struct nls_table *nls_cp) 469{ 470 int rc; 471 AUTHENTICATE_MESSAGE *sec_blob = (AUTHENTICATE_MESSAGE *)pbuffer; 472 __u32 flags; 473 unsigned char *tmp; 474 475 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8); 476 sec_blob->MessageType = NtLmAuthenticate; 477 478 flags = NTLMSSP_NEGOTIATE_56 | 479 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_TARGET_INFO | 480 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | 481 NTLMSSP_NEGOTIATE_NTLM; 482 if (ses->server->secMode & 483 (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) 484 flags |= NTLMSSP_NEGOTIATE_SIGN; 485 if (ses->server->secMode & SECMODE_SIGN_REQUIRED) 486 flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN; 487 488 tmp = pbuffer + sizeof(AUTHENTICATE_MESSAGE); 489 sec_blob->NegotiateFlags |= cpu_to_le32(flags); 490 491 sec_blob->LmChallengeResponse.BufferOffset = 492 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE)); 493 sec_blob->LmChallengeResponse.Length = 0; 494 sec_blob->LmChallengeResponse.MaximumLength = 0; 495 496 sec_blob->NtChallengeResponse.BufferOffset = cpu_to_le32(tmp - pbuffer); 497 rc = setup_ntlmv2_rsp(ses, nls_cp); 498 if (rc) { 499 cERROR(1, "Error %d during NTLMSSP authentication", rc); 500 goto setup_ntlmv2_ret; 501 } 502 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE, 503 ses->auth_key.len - CIFS_SESS_KEY_SIZE); 504 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE; 505 506 sec_blob->NtChallengeResponse.Length = 507 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); 508 sec_blob->NtChallengeResponse.MaximumLength = 509 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); 510 511 if (ses->domainName == NULL) { 512 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer); 513 sec_blob->DomainName.Length = 0; 514 sec_blob->DomainName.MaximumLength = 0; 515 tmp += 2; 516 } else { 517 int len; 518 len = cifs_strtoUCS((__le16 *)tmp, ses->domainName, 519 MAX_USERNAME_SIZE, nls_cp); 520 len *= 2; /* unicode is 2 bytes each */ 521 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer); 522 sec_blob->DomainName.Length = cpu_to_le16(len); 523 sec_blob->DomainName.MaximumLength = cpu_to_le16(len); 524 tmp += len; 525 } 526 527 if (ses->userName == NULL) { 528 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer); 529 sec_blob->UserName.Length = 0; 530 sec_blob->UserName.MaximumLength = 0; 531 tmp += 2; 532 } else { 533 int len; 534 len = cifs_strtoUCS((__le16 *)tmp, ses->userName, 535 MAX_USERNAME_SIZE, nls_cp); 536 len *= 2; /* unicode is 2 bytes each */ 537 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer); 538 sec_blob->UserName.Length = cpu_to_le16(len); 539 sec_blob->UserName.MaximumLength = cpu_to_le16(len); 540 tmp += len; 541 } 542 543 sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - pbuffer); 544 sec_blob->WorkstationName.Length = 0; 545 sec_blob->WorkstationName.MaximumLength = 0; 546 tmp += 2; 547 548 if ((ses->ntlmssp.server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) && 549 !calc_seckey(ses)) { 550 memcpy(tmp, ses->ntlmssp.ciphertext, CIFS_CPHTXT_SIZE); 551 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer); 552 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE); 553 sec_blob->SessionKey.MaximumLength = 554 cpu_to_le16(CIFS_CPHTXT_SIZE); 555 tmp += CIFS_CPHTXT_SIZE; 556 } else { 557 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer); 558 sec_blob->SessionKey.Length = 0; 559 sec_blob->SessionKey.MaximumLength = 0; 560 } 561 562setup_ntlmv2_ret: 563 *buflen = tmp - pbuffer; 564 return rc; 565} 566 567 568static void setup_ntlmssp_neg_req(SESSION_SETUP_ANDX *pSMB, 569 struct cifsSesInfo *ses) 570{ 571 build_ntlmssp_negotiate_blob(&pSMB->req.SecurityBlob[0], ses); 572 pSMB->req.SecurityBlobLength = cpu_to_le16(sizeof(NEGOTIATE_MESSAGE)); 573 574 return; 575} 576#endif 577 578int 579CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, 580 const struct nls_table *nls_cp) 581{ 582 int rc = 0; 583 int wct; 584 struct smb_hdr *smb_buf; 585 char *bcc_ptr; 586 char *str_area; 587 SESSION_SETUP_ANDX *pSMB; 588 __u32 capabilities; 589 int count; 590 int resp_buf_type; 591 struct kvec iov[3]; 592 enum securityEnum type; 593 __u16 action; 594 int bytes_remaining; 595 struct key *spnego_key = NULL; 596 __le32 phase = NtLmNegotiate; /* NTLMSSP, if needed, is multistage */ 597 u16 blob_len; 598 char *ntlmsspblob = NULL; 599 600 if (ses == NULL) 601 return -EINVAL; 602 603 type = ses->server->secType; 604 605 cFYI(1, "sess setup type %d", type); 606ssetup_ntlmssp_authenticate: 607 if (phase == NtLmChallenge) 608 phase = NtLmAuthenticate; /* if ntlmssp, now final phase */ 609 610 if (type == LANMAN) { 611#ifndef CONFIG_CIFS_WEAK_PW_HASH 612 /* LANMAN and plaintext are less secure and off by default. 613 So we make this explicitly be turned on in kconfig (in the 614 build) and turned on at runtime (changed from the default) 615 in proc/fs/cifs or via mount parm. Unfortunately this is 616 needed for old Win (e.g. Win95), some obscure NAS and OS/2 */ 617 return -EOPNOTSUPP; 618#endif 619 wct = 10; /* lanman 2 style sessionsetup */ 620 } else if ((type == NTLM) || (type == NTLMv2)) { 621 /* For NTLMv2 failures eventually may need to retry NTLM */ 622 wct = 13; /* old style NTLM sessionsetup */ 623 } else /* same size: negotiate or auth, NTLMSSP or extended security */ 624 wct = 12; 625 626 rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses, 627 (void **)&smb_buf); 628 if (rc) 629 return rc; 630 631 pSMB = (SESSION_SETUP_ANDX *)smb_buf; 632 633 capabilities = cifs_ssetup_hdr(ses, pSMB); 634 635 /* we will send the SMB in three pieces: 636 a fixed length beginning part, an optional 637 SPNEGO blob (which can be zero length), and a 638 last part which will include the strings 639 and rest of bcc area. This allows us to avoid 640 a large buffer 17K allocation */ 641 iov[0].iov_base = (char *)pSMB; 642 iov[0].iov_len = smb_buf->smb_buf_length + 4; 643 644 /* setting this here allows the code at the end of the function 645 to free the request buffer if there's an error */ 646 resp_buf_type = CIFS_SMALL_BUFFER; 647 648 /* 2000 big enough to fit max user, domain, NOS name etc. */ 649 str_area = kmalloc(2000, GFP_KERNEL); 650 if (str_area == NULL) { 651 rc = -ENOMEM; 652 goto ssetup_exit; 653 } 654 bcc_ptr = str_area; 655 656 ses->flags &= ~CIFS_SES_LANMAN; 657 658 iov[1].iov_base = NULL; 659 iov[1].iov_len = 0; 660 661 if (type == LANMAN) { 662#ifdef CONFIG_CIFS_WEAK_PW_HASH 663 char lnm_session_key[CIFS_SESS_KEY_SIZE]; 664 665 pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE; 666 667 /* no capabilities flags in old lanman negotiation */ 668 669 pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE); 670 /* BB calculate hash with password */ 671 /* and copy into bcc */ 672 673 calc_lanman_hash(ses->password, ses->cryptKey, 674 ses->server->secMode & SECMODE_PW_ENCRYPT ? 675 true : false, lnm_session_key); 676 677 ses->flags |= CIFS_SES_LANMAN; 678 memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_SESS_KEY_SIZE); 679 bcc_ptr += CIFS_SESS_KEY_SIZE; 680 681 /* can not sign if LANMAN negotiated so no need 682 to calculate signing key? but what if server 683 changed to do higher than lanman dialect and 684 we reconnected would we ever calc signing_key? */ 685 686 cFYI(1, "Negotiating LANMAN setting up strings"); 687 /* Unicode not allowed for LANMAN dialects */ 688 ascii_ssetup_strings(&bcc_ptr, ses, nls_cp); 689#endif 690 } else if (type == NTLM) { 691 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities); 692 pSMB->req_no_secext.CaseInsensitivePasswordLength = 693 cpu_to_le16(CIFS_AUTH_RESP_SIZE); 694 pSMB->req_no_secext.CaseSensitivePasswordLength = 695 cpu_to_le16(CIFS_AUTH_RESP_SIZE); 696 697 /* calculate ntlm response and session key */ 698 rc = setup_ntlm_response(ses); 699 if (rc) { 700 cERROR(1, "Error %d during NTLM authentication", rc); 701 goto ssetup_exit; 702 } 703 704 /* copy ntlm response */ 705 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, 706 CIFS_AUTH_RESP_SIZE); 707 bcc_ptr += CIFS_AUTH_RESP_SIZE; 708 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, 709 CIFS_AUTH_RESP_SIZE); 710 bcc_ptr += CIFS_AUTH_RESP_SIZE; 711 712 if (ses->capabilities & CAP_UNICODE) { 713 /* unicode strings must be word aligned */ 714 if (iov[0].iov_len % 2) { 715 *bcc_ptr = 0; 716 bcc_ptr++; 717 } 718 unicode_ssetup_strings(&bcc_ptr, ses, nls_cp); 719 } else 720 ascii_ssetup_strings(&bcc_ptr, ses, nls_cp); 721 } else if (type == NTLMv2) { 722 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities); 723 724 /* LM2 password would be here if we supported it */ 725 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0; 726 727 /* calculate nlmv2 response and session key */ 728 rc = setup_ntlmv2_rsp(ses, nls_cp); 729 if (rc) { 730 cERROR(1, "Error %d during NTLMv2 authentication", rc); 731 goto ssetup_exit; 732 } 733 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, 734 ses->auth_key.len - CIFS_SESS_KEY_SIZE); 735 bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE; 736 737 /* set case sensitive password length after tilen may get 738 * assigned, tilen is 0 otherwise. 739 */ 740 pSMB->req_no_secext.CaseSensitivePasswordLength = 741 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); 742 743 if (ses->capabilities & CAP_UNICODE) { 744 if (iov[0].iov_len % 2) { 745 *bcc_ptr = 0; 746 bcc_ptr++; 747 } 748 unicode_ssetup_strings(&bcc_ptr, ses, nls_cp); 749 } else 750 ascii_ssetup_strings(&bcc_ptr, ses, nls_cp); 751 } else if (type == Kerberos) { 752#ifdef CONFIG_CIFS_UPCALL 753 struct cifs_spnego_msg *msg; 754 755 spnego_key = cifs_get_spnego_key(ses); 756 if (IS_ERR(spnego_key)) { 757 rc = PTR_ERR(spnego_key); 758 spnego_key = NULL; 759 goto ssetup_exit; 760 } 761 762 msg = spnego_key->payload.data; 763 /* check version field to make sure that cifs.upcall is 764 sending us a response in an expected form */ 765 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) { 766 cERROR(1, "incorrect version of cifs.upcall (expected" 767 " %d but got %d)", 768 CIFS_SPNEGO_UPCALL_VERSION, msg->version); 769 rc = -EKEYREJECTED; 770 goto ssetup_exit; 771 } 772 773 ses->auth_key.response = kmalloc(msg->sesskey_len, GFP_KERNEL); 774 if (!ses->auth_key.response) { 775 cERROR(1, "Kerberos can't allocate (%u bytes) memory", 776 msg->sesskey_len); 777 rc = -ENOMEM; 778 goto ssetup_exit; 779 } 780 memcpy(ses->auth_key.response, msg->data, msg->sesskey_len); 781 ses->auth_key.len = msg->sesskey_len; 782 783 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC; 784 capabilities |= CAP_EXTENDED_SECURITY; 785 pSMB->req.Capabilities = cpu_to_le32(capabilities); 786 iov[1].iov_base = msg->data + msg->sesskey_len; 787 iov[1].iov_len = msg->secblob_len; 788 pSMB->req.SecurityBlobLength = cpu_to_le16(iov[1].iov_len); 789 790 if (ses->capabilities & CAP_UNICODE) { 791 /* unicode strings must be word aligned */ 792 if ((iov[0].iov_len + iov[1].iov_len) % 2) { 793 *bcc_ptr = 0; 794 bcc_ptr++; 795 } 796 unicode_oslm_strings(&bcc_ptr, nls_cp); 797 unicode_domain_string(&bcc_ptr, ses, nls_cp); 798 } else 799 /* BB: is this right? */ 800 ascii_ssetup_strings(&bcc_ptr, ses, nls_cp); 801#else /* ! CONFIG_CIFS_UPCALL */ 802 cERROR(1, "Kerberos negotiated but upcall support disabled!"); 803 rc = -ENOSYS; 804 goto ssetup_exit; 805#endif /* CONFIG_CIFS_UPCALL */ 806 } else { 807#ifdef CONFIG_CIFS_EXPERIMENTAL 808 if (type == RawNTLMSSP) { 809 if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) { 810 cERROR(1, "NTLMSSP requires Unicode support"); 811 rc = -ENOSYS; 812 goto ssetup_exit; 813 } 814 815 cFYI(1, "ntlmssp session setup phase %d", phase); 816 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC; 817 capabilities |= CAP_EXTENDED_SECURITY; 818 pSMB->req.Capabilities |= cpu_to_le32(capabilities); 819 if (phase == NtLmNegotiate) { 820 setup_ntlmssp_neg_req(pSMB, ses); 821 iov[1].iov_len = sizeof(NEGOTIATE_MESSAGE); 822 iov[1].iov_base = &pSMB->req.SecurityBlob[0]; 823 } else if (phase == NtLmAuthenticate) { 824 /* 5 is an empirical value, large enought to 825 * hold authenticate message, max 10 of 826 * av paris, doamin,user,workstation mames, 827 * flags etc.. 828 */ 829 ntlmsspblob = kmalloc( 830 5*sizeof(struct _AUTHENTICATE_MESSAGE), 831 GFP_KERNEL); 832 if (!ntlmsspblob) { 833 cERROR(1, "Can't allocate NTLMSSP"); 834 rc = -ENOMEM; 835 goto ssetup_exit; 836 } 837 838 rc = build_ntlmssp_auth_blob(ntlmsspblob, 839 &blob_len, ses, nls_cp); 840 if (rc) 841 goto ssetup_exit; 842 iov[1].iov_len = blob_len; 843 iov[1].iov_base = ntlmsspblob; 844 pSMB->req.SecurityBlobLength = 845 cpu_to_le16(blob_len); 846 /* Make sure that we tell the server that we 847 are using the uid that it just gave us back 848 on the response (challenge) */ 849 smb_buf->Uid = ses->Suid; 850 } else { 851 cERROR(1, "invalid phase %d", phase); 852 rc = -ENOSYS; 853 goto ssetup_exit; 854 } 855 /* unicode strings must be word aligned */ 856 if ((iov[0].iov_len + iov[1].iov_len) % 2) { 857 *bcc_ptr = 0; 858 bcc_ptr++; 859 } 860 unicode_oslm_strings(&bcc_ptr, nls_cp); 861 } else { 862 cERROR(1, "secType %d not supported!", type); 863 rc = -ENOSYS; 864 goto ssetup_exit; 865 } 866#else 867 cERROR(1, "secType %d not supported!", type); 868 rc = -ENOSYS; 869 goto ssetup_exit; 870#endif 871 } 872 873 iov[2].iov_base = str_area; 874 iov[2].iov_len = (long) bcc_ptr - (long) str_area; 875 876 count = iov[1].iov_len + iov[2].iov_len; 877 smb_buf->smb_buf_length += count; 878 879 BCC_LE(smb_buf) = cpu_to_le16(count); 880 881 rc = SendReceive2(xid, ses, iov, 3 /* num_iovecs */, &resp_buf_type, 882 CIFS_STD_OP /* not long */ | CIFS_LOG_ERROR); 883 /* SMB request buf freed in SendReceive2 */ 884 885 pSMB = (SESSION_SETUP_ANDX *)iov[0].iov_base; 886 smb_buf = (struct smb_hdr *)iov[0].iov_base; 887 888 if ((type == RawNTLMSSP) && (smb_buf->Status.CifsError == 889 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))) { 890 if (phase != NtLmNegotiate) { 891 cERROR(1, "Unexpected more processing error"); 892 goto ssetup_exit; 893 } 894 /* NTLMSSP Negotiate sent now processing challenge (response) */ 895 phase = NtLmChallenge; /* process ntlmssp challenge */ 896 rc = 0; /* MORE_PROC rc is not an error here, but expected */ 897 } 898 if (rc) 899 goto ssetup_exit; 900 901 if ((smb_buf->WordCount != 3) && (smb_buf->WordCount != 4)) { 902 rc = -EIO; 903 cERROR(1, "bad word count %d", smb_buf->WordCount); 904 goto ssetup_exit; 905 } 906 action = le16_to_cpu(pSMB->resp.Action); 907 if (action & GUEST_LOGIN) 908 cFYI(1, "Guest login"); /* BB mark SesInfo struct? */ 909 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */ 910 cFYI(1, "UID = %d ", ses->Suid); 911 /* response can have either 3 or 4 word count - Samba sends 3 */ 912 /* and lanman response is 3 */ 913 bytes_remaining = BCC(smb_buf); 914 bcc_ptr = pByteArea(smb_buf); 915 916 if (smb_buf->WordCount == 4) { 917 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength); 918 if (blob_len > bytes_remaining) { 919 cERROR(1, "bad security blob length %d", blob_len); 920 rc = -EINVAL; 921 goto ssetup_exit; 922 } 923 if (phase == NtLmChallenge) { 924 rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses); 925 /* now goto beginning for ntlmssp authenticate phase */ 926 if (rc) 927 goto ssetup_exit; 928 } 929 bcc_ptr += blob_len; 930 bytes_remaining -= blob_len; 931 } 932 933 /* BB check if Unicode and decode strings */ 934 if (smb_buf->Flags2 & SMBFLG2_UNICODE) { 935 /* unicode string area must be word-aligned */ 936 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) { 937 ++bcc_ptr; 938 --bytes_remaining; 939 } 940 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses, nls_cp); 941 } else { 942 rc = decode_ascii_ssetup(&bcc_ptr, bytes_remaining, 943 ses, nls_cp); 944 } 945 946ssetup_exit: 947 if (spnego_key) { 948 key_revoke(spnego_key); 949 key_put(spnego_key); 950 } 951 kfree(str_area); 952 kfree(ntlmsspblob); 953 ntlmsspblob = NULL; 954 if (resp_buf_type == CIFS_SMALL_BUFFER) { 955 cFYI(1, "ssetup freeing small buf %p", iov[0].iov_base); 956 cifs_small_buf_release(iov[0].iov_base); 957 } else if (resp_buf_type == CIFS_LARGE_BUFFER) 958 cifs_buf_release(iov[0].iov_base); 959 960 /* if ntlmssp, and negotiate succeeded, proceed to authenticate phase */ 961 if ((phase == NtLmChallenge) && (rc == 0)) 962 goto ssetup_ntlmssp_authenticate; 963 964 return rc; 965} 966