xref: /openbmc/linux/fs/smb/client/sess.c (revision af9b2ff010f593d81e2f5fb04155e9fc25b9dfd0)
1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3  *
4  *   SMB/CIFS session setup handling routines
5  *
6  *   Copyright (c) International Business Machines  Corp., 2006, 2009
7  *   Author(s): Steve French (sfrench@us.ibm.com)
8  *
9  */
10 
11 #include "cifspdu.h"
12 #include "cifsglob.h"
13 #include "cifsproto.h"
14 #include "cifs_unicode.h"
15 #include "cifs_debug.h"
16 #include "ntlmssp.h"
17 #include "nterr.h"
18 #include <linux/utsname.h>
19 #include <linux/slab.h>
20 #include <linux/version.h>
21 #include "cifsfs.h"
22 #include "cifs_spnego.h"
23 #include "smb2proto.h"
24 #include "fs_context.h"
25 
26 static int
27 cifs_ses_add_channel(struct cifs_ses *ses,
28 		     struct cifs_server_iface *iface);
29 
30 bool
is_server_using_iface(struct TCP_Server_Info * server,struct cifs_server_iface * iface)31 is_server_using_iface(struct TCP_Server_Info *server,
32 		      struct cifs_server_iface *iface)
33 {
34 	struct sockaddr_in *i4 = (struct sockaddr_in *)&iface->sockaddr;
35 	struct sockaddr_in6 *i6 = (struct sockaddr_in6 *)&iface->sockaddr;
36 	struct sockaddr_in *s4 = (struct sockaddr_in *)&server->dstaddr;
37 	struct sockaddr_in6 *s6 = (struct sockaddr_in6 *)&server->dstaddr;
38 
39 	if (server->dstaddr.ss_family != iface->sockaddr.ss_family)
40 		return false;
41 	if (server->dstaddr.ss_family == AF_INET) {
42 		if (s4->sin_addr.s_addr != i4->sin_addr.s_addr)
43 			return false;
44 	} else if (server->dstaddr.ss_family == AF_INET6) {
45 		if (memcmp(&s6->sin6_addr, &i6->sin6_addr,
46 			   sizeof(i6->sin6_addr)) != 0)
47 			return false;
48 	} else {
49 		/* unknown family.. */
50 		return false;
51 	}
52 	return true;
53 }
54 
is_ses_using_iface(struct cifs_ses * ses,struct cifs_server_iface * iface)55 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
56 {
57 	int i;
58 
59 	spin_lock(&ses->chan_lock);
60 	for (i = 0; i < ses->chan_count; i++) {
61 		if (ses->chans[i].iface == iface) {
62 			spin_unlock(&ses->chan_lock);
63 			return true;
64 		}
65 	}
66 	spin_unlock(&ses->chan_lock);
67 	return false;
68 }
69 
70 /* channel helper functions. assumed that chan_lock is held by caller. */
71 
72 int
cifs_ses_get_chan_index(struct cifs_ses * ses,struct TCP_Server_Info * server)73 cifs_ses_get_chan_index(struct cifs_ses *ses,
74 			struct TCP_Server_Info *server)
75 {
76 	unsigned int i;
77 
78 	/* if the channel is waiting for termination */
79 	if (server && server->terminate)
80 		return CIFS_INVAL_CHAN_INDEX;
81 
82 	for (i = 0; i < ses->chan_count; i++) {
83 		if (ses->chans[i].server == server)
84 			return i;
85 	}
86 
87 	/* If we didn't find the channel, it is likely a bug */
88 	if (server)
89 		cifs_dbg(VFS, "unable to get chan index for server: 0x%llx",
90 			 server->conn_id);
91 	return CIFS_INVAL_CHAN_INDEX;
92 }
93 
94 void
cifs_chan_set_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)95 cifs_chan_set_in_reconnect(struct cifs_ses *ses,
96 			     struct TCP_Server_Info *server)
97 {
98 	int chan_index = cifs_ses_get_chan_index(ses, server);
99 
100 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
101 		return;
102 
103 	ses->chans[chan_index].in_reconnect = true;
104 }
105 
106 void
cifs_chan_clear_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)107 cifs_chan_clear_in_reconnect(struct cifs_ses *ses,
108 			     struct TCP_Server_Info *server)
109 {
110 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
111 
112 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
113 		return;
114 
115 	ses->chans[chan_index].in_reconnect = false;
116 }
117 
118 bool
cifs_chan_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)119 cifs_chan_in_reconnect(struct cifs_ses *ses,
120 			  struct TCP_Server_Info *server)
121 {
122 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
123 
124 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
125 		return true;	/* err on the safer side */
126 
127 	return CIFS_CHAN_IN_RECONNECT(ses, chan_index);
128 }
129 
130 void
cifs_chan_set_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)131 cifs_chan_set_need_reconnect(struct cifs_ses *ses,
132 			     struct TCP_Server_Info *server)
133 {
134 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
135 
136 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
137 		return;
138 
139 	set_bit(chan_index, &ses->chans_need_reconnect);
140 	cifs_dbg(FYI, "Set reconnect bitmask for chan %u; now 0x%lx\n",
141 		 chan_index, ses->chans_need_reconnect);
142 }
143 
144 void
cifs_chan_clear_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)145 cifs_chan_clear_need_reconnect(struct cifs_ses *ses,
146 			       struct TCP_Server_Info *server)
147 {
148 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
149 
150 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
151 		return;
152 
153 	clear_bit(chan_index, &ses->chans_need_reconnect);
154 	cifs_dbg(FYI, "Cleared reconnect bitmask for chan %u; now 0x%lx\n",
155 		 chan_index, ses->chans_need_reconnect);
156 }
157 
158 bool
cifs_chan_needs_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)159 cifs_chan_needs_reconnect(struct cifs_ses *ses,
160 			  struct TCP_Server_Info *server)
161 {
162 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
163 
164 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
165 		return true;	/* err on the safer side */
166 
167 	return CIFS_CHAN_NEEDS_RECONNECT(ses, chan_index);
168 }
169 
170 bool
cifs_chan_is_iface_active(struct cifs_ses * ses,struct TCP_Server_Info * server)171 cifs_chan_is_iface_active(struct cifs_ses *ses,
172 			  struct TCP_Server_Info *server)
173 {
174 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
175 
176 	if (chan_index == CIFS_INVAL_CHAN_INDEX)
177 		return true;	/* err on the safer side */
178 
179 	return ses->chans[chan_index].iface &&
180 		ses->chans[chan_index].iface->is_active;
181 }
182 
183 /* returns number of channels added */
cifs_try_adding_channels(struct cifs_ses * ses)184 int cifs_try_adding_channels(struct cifs_ses *ses)
185 {
186 	struct TCP_Server_Info *server = ses->server;
187 	int old_chan_count, new_chan_count;
188 	int left;
189 	int rc = 0;
190 	int tries = 0;
191 	size_t iface_weight = 0, iface_min_speed = 0;
192 	struct cifs_server_iface *iface = NULL, *niface = NULL;
193 	struct cifs_server_iface *last_iface = NULL;
194 
195 	spin_lock(&ses->chan_lock);
196 
197 	new_chan_count = old_chan_count = ses->chan_count;
198 	left = ses->chan_max - ses->chan_count;
199 
200 	if (left <= 0) {
201 		spin_unlock(&ses->chan_lock);
202 		cifs_dbg(FYI,
203 			 "ses already at max_channels (%zu), nothing to open\n",
204 			 ses->chan_max);
205 		return 0;
206 	}
207 
208 	if (server->dialect < SMB30_PROT_ID) {
209 		spin_unlock(&ses->chan_lock);
210 		cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
211 		return 0;
212 	}
213 
214 	if (!(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
215 		spin_unlock(&ses->chan_lock);
216 		cifs_server_dbg(VFS, "no multichannel support\n");
217 		return 0;
218 	}
219 	spin_unlock(&ses->chan_lock);
220 
221 	while (left > 0) {
222 
223 		tries++;
224 		if (tries > 3*ses->chan_max) {
225 			cifs_dbg(VFS, "too many channel open attempts (%d channels left to open)\n",
226 				 left);
227 			break;
228 		}
229 
230 		spin_lock(&ses->iface_lock);
231 		if (!ses->iface_count) {
232 			spin_unlock(&ses->iface_lock);
233 			cifs_dbg(ONCE, "server %s does not advertise interfaces\n",
234 				      ses->server->hostname);
235 			break;
236 		}
237 
238 		if (!iface)
239 			iface = list_first_entry(&ses->iface_list, struct cifs_server_iface,
240 						 iface_head);
241 		last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
242 					     iface_head);
243 		iface_min_speed = last_iface->speed;
244 
245 		list_for_each_entry_safe_from(iface, niface, &ses->iface_list,
246 				    iface_head) {
247 			/* do not mix rdma and non-rdma interfaces */
248 			if (iface->rdma_capable != ses->server->rdma)
249 				continue;
250 
251 			/* skip ifaces that are unusable */
252 			if (!iface->is_active ||
253 			    (is_ses_using_iface(ses, iface) &&
254 			     !iface->rss_capable))
255 				continue;
256 
257 			/* check if we already allocated enough channels */
258 			iface_weight = iface->speed / iface_min_speed;
259 
260 			if (iface->weight_fulfilled >= iface_weight)
261 				continue;
262 
263 			/* take ref before unlock */
264 			kref_get(&iface->refcount);
265 
266 			spin_unlock(&ses->iface_lock);
267 			rc = cifs_ses_add_channel(ses, iface);
268 			spin_lock(&ses->iface_lock);
269 
270 			if (rc) {
271 				cifs_dbg(VFS, "failed to open extra channel on iface:%pIS rc=%d\n",
272 					 &iface->sockaddr,
273 					 rc);
274 				kref_put(&iface->refcount, release_iface);
275 				/* failure to add chan should increase weight */
276 				iface->weight_fulfilled++;
277 				continue;
278 			}
279 
280 			iface->num_channels++;
281 			iface->weight_fulfilled++;
282 			cifs_dbg(VFS, "successfully opened new channel on iface:%pIS\n",
283 				 &iface->sockaddr);
284 			break;
285 		}
286 
287 		/* reached end of list. reset weight_fulfilled and start over */
288 		if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
289 			list_for_each_entry(iface, &ses->iface_list, iface_head)
290 				iface->weight_fulfilled = 0;
291 			spin_unlock(&ses->iface_lock);
292 			iface = NULL;
293 			continue;
294 		}
295 		spin_unlock(&ses->iface_lock);
296 
297 		left--;
298 		new_chan_count++;
299 	}
300 
301 	return new_chan_count - old_chan_count;
302 }
303 
304 /*
305  * called when multichannel is disabled by the server.
306  * this always gets called from smb2_reconnect
307  * and cannot get called in parallel threads.
308  */
309 void
cifs_disable_secondary_channels(struct cifs_ses * ses)310 cifs_disable_secondary_channels(struct cifs_ses *ses)
311 {
312 	int i, chan_count;
313 	struct TCP_Server_Info *server;
314 	struct cifs_server_iface *iface;
315 
316 	spin_lock(&ses->chan_lock);
317 	chan_count = ses->chan_count;
318 	if (chan_count == 1)
319 		goto done;
320 
321 	ses->chan_count = 1;
322 
323 	/* for all secondary channels reset the need reconnect bit */
324 	ses->chans_need_reconnect &= 1;
325 
326 	for (i = 1; i < chan_count; i++) {
327 		iface = ses->chans[i].iface;
328 		server = ses->chans[i].server;
329 
330 		/*
331 		 * remove these references first, since we need to unlock
332 		 * the chan_lock here, since iface_lock is a higher lock
333 		 */
334 		ses->chans[i].iface = NULL;
335 		ses->chans[i].server = NULL;
336 		spin_unlock(&ses->chan_lock);
337 
338 		if (iface) {
339 			spin_lock(&ses->iface_lock);
340 			iface->num_channels--;
341 			if (iface->weight_fulfilled)
342 				iface->weight_fulfilled--;
343 			kref_put(&iface->refcount, release_iface);
344 			spin_unlock(&ses->iface_lock);
345 		}
346 
347 		if (server) {
348 			if (!server->terminate) {
349 				server->terminate = true;
350 				cifs_signal_cifsd_for_reconnect(server, false);
351 			}
352 			cifs_put_tcp_session(server, false);
353 		}
354 
355 		spin_lock(&ses->chan_lock);
356 	}
357 
358 done:
359 	spin_unlock(&ses->chan_lock);
360 }
361 
362 /*
363  * update the iface for the channel if necessary.
364  * Must be called with chan_lock held.
365  */
366 void
cifs_chan_update_iface(struct cifs_ses * ses,struct TCP_Server_Info * server)367 cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server)
368 {
369 	unsigned int chan_index;
370 	size_t iface_weight = 0, iface_min_speed = 0;
371 	struct cifs_server_iface *iface = NULL;
372 	struct cifs_server_iface *old_iface = NULL;
373 	struct cifs_server_iface *last_iface = NULL;
374 	struct sockaddr_storage ss;
375 
376 	spin_lock(&ses->chan_lock);
377 	chan_index = cifs_ses_get_chan_index(ses, server);
378 	if (chan_index == CIFS_INVAL_CHAN_INDEX) {
379 		spin_unlock(&ses->chan_lock);
380 		return;
381 	}
382 
383 	if (ses->chans[chan_index].iface) {
384 		old_iface = ses->chans[chan_index].iface;
385 		if (old_iface->is_active) {
386 			spin_unlock(&ses->chan_lock);
387 			return;
388 		}
389 	}
390 	spin_unlock(&ses->chan_lock);
391 
392 	spin_lock(&server->srv_lock);
393 	ss = server->dstaddr;
394 	spin_unlock(&server->srv_lock);
395 
396 	spin_lock(&ses->iface_lock);
397 	if (!ses->iface_count) {
398 		spin_unlock(&ses->iface_lock);
399 		cifs_dbg(ONCE, "server %s does not advertise interfaces\n", ses->server->hostname);
400 		return;
401 	}
402 
403 	last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
404 				     iface_head);
405 	iface_min_speed = last_iface->speed;
406 
407 	/* then look for a new one */
408 	list_for_each_entry(iface, &ses->iface_list, iface_head) {
409 		if (!chan_index) {
410 			/* if we're trying to get the updated iface for primary channel */
411 			if (!cifs_match_ipaddr((struct sockaddr *) &ss,
412 					       (struct sockaddr *) &iface->sockaddr))
413 				continue;
414 
415 			kref_get(&iface->refcount);
416 			break;
417 		}
418 
419 		/* do not mix rdma and non-rdma interfaces */
420 		if (iface->rdma_capable != server->rdma)
421 			continue;
422 
423 		if (!iface->is_active ||
424 		    (is_ses_using_iface(ses, iface) &&
425 		     !iface->rss_capable)) {
426 			continue;
427 		}
428 
429 		/* check if we already allocated enough channels */
430 		iface_weight = iface->speed / iface_min_speed;
431 
432 		if (iface->weight_fulfilled >= iface_weight)
433 			continue;
434 
435 		kref_get(&iface->refcount);
436 		break;
437 	}
438 
439 	if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
440 		iface = NULL;
441 		cifs_dbg(FYI, "unable to find a suitable iface\n");
442 	}
443 
444 	if (!iface) {
445 		if (!chan_index)
446 			cifs_dbg(FYI, "unable to get the interface matching: %pIS\n",
447 				 &ss);
448 		else {
449 			cifs_dbg(FYI, "unable to find another interface to replace: %pIS\n",
450 				 &old_iface->sockaddr);
451 		}
452 
453 		spin_unlock(&ses->iface_lock);
454 		return;
455 	}
456 
457 	/* now drop the ref to the current iface */
458 	if (old_iface) {
459 		cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n",
460 			 &old_iface->sockaddr,
461 			 &iface->sockaddr);
462 
463 		old_iface->num_channels--;
464 		if (old_iface->weight_fulfilled)
465 			old_iface->weight_fulfilled--;
466 		iface->num_channels++;
467 		iface->weight_fulfilled++;
468 
469 		kref_put(&old_iface->refcount, release_iface);
470 	} else if (!chan_index) {
471 		/* special case: update interface for primary channel */
472 		cifs_dbg(FYI, "referencing primary channel iface: %pIS\n",
473 			 &iface->sockaddr);
474 		iface->num_channels++;
475 		iface->weight_fulfilled++;
476 	}
477 	spin_unlock(&ses->iface_lock);
478 
479 	spin_lock(&ses->chan_lock);
480 	chan_index = cifs_ses_get_chan_index(ses, server);
481 	if (chan_index == CIFS_INVAL_CHAN_INDEX) {
482 		spin_unlock(&ses->chan_lock);
483 		return;
484 	}
485 
486 	ses->chans[chan_index].iface = iface;
487 	spin_unlock(&ses->chan_lock);
488 
489 	spin_lock(&server->srv_lock);
490 	memcpy(&server->dstaddr, &iface->sockaddr, sizeof(server->dstaddr));
491 	spin_unlock(&server->srv_lock);
492 }
493 
494 /*
495  * If server is a channel of ses, return the corresponding enclosing
496  * cifs_chan otherwise return NULL.
497  */
498 struct cifs_chan *
cifs_ses_find_chan(struct cifs_ses * ses,struct TCP_Server_Info * server)499 cifs_ses_find_chan(struct cifs_ses *ses, struct TCP_Server_Info *server)
500 {
501 	int i;
502 
503 	spin_lock(&ses->chan_lock);
504 	for (i = 0; i < ses->chan_count; i++) {
505 		if (ses->chans[i].server == server) {
506 			spin_unlock(&ses->chan_lock);
507 			return &ses->chans[i];
508 		}
509 	}
510 	spin_unlock(&ses->chan_lock);
511 	return NULL;
512 }
513 
514 static int
cifs_ses_add_channel(struct cifs_ses * ses,struct cifs_server_iface * iface)515 cifs_ses_add_channel(struct cifs_ses *ses,
516 		     struct cifs_server_iface *iface)
517 {
518 	struct TCP_Server_Info *chan_server;
519 	struct cifs_chan *chan;
520 	struct smb3_fs_context *ctx;
521 	static const char unc_fmt[] = "\\%s\\foo";
522 	struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
523 	struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
524 	size_t len;
525 	int rc;
526 	unsigned int xid = get_xid();
527 
528 	if (iface->sockaddr.ss_family == AF_INET)
529 		cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
530 			 ses, iface->speed, iface->rdma_capable ? "yes" : "no",
531 			 &ipv4->sin_addr);
532 	else
533 		cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI6)\n",
534 			 ses, iface->speed, iface->rdma_capable ? "yes" : "no",
535 			 &ipv6->sin6_addr);
536 
537 	/*
538 	 * Setup a ctx with mostly the same info as the existing
539 	 * session and overwrite it with the requested iface data.
540 	 *
541 	 * We need to setup at least the fields used for negprot and
542 	 * sesssetup.
543 	 *
544 	 * We only need the ctx here, so we can reuse memory from
545 	 * the session and server without caring about memory
546 	 * management.
547 	 */
548 	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
549 	if (!ctx) {
550 		rc = -ENOMEM;
551 		goto out_free_xid;
552 	}
553 
554 	/* Always make new connection for now (TODO?) */
555 	ctx->nosharesock = true;
556 
557 	/* Auth */
558 	ctx->domainauto = ses->domainAuto;
559 	ctx->domainname = ses->domainName;
560 
561 	ctx->server_hostname = ses->server->hostname;
562 
563 	ctx->username = ses->user_name;
564 	ctx->password = ses->password;
565 	ctx->sectype = ses->sectype;
566 	ctx->sign = ses->sign;
567 
568 	/* UNC and paths */
569 	/* XXX: Use ses->server->hostname? */
570 	len = sizeof(unc_fmt) + SERVER_NAME_LEN_WITH_NULL;
571 	ctx->UNC = kzalloc(len, GFP_KERNEL);
572 	if (!ctx->UNC) {
573 		rc = -ENOMEM;
574 		goto out_free_ctx;
575 	}
576 	scnprintf(ctx->UNC, len, unc_fmt, ses->ip_addr);
577 	ctx->prepath = "";
578 
579 	/* Reuse same version as master connection */
580 	ctx->vals = ses->server->vals;
581 	ctx->ops = ses->server->ops;
582 
583 	ctx->noblocksnd = ses->server->noblocksnd;
584 	ctx->noautotune = ses->server->noautotune;
585 	ctx->sockopt_tcp_nodelay = ses->server->tcp_nodelay;
586 	ctx->echo_interval = ses->server->echo_interval / HZ;
587 	ctx->max_credits = ses->server->max_credits;
588 
589 	/*
590 	 * This will be used for encoding/decoding user/domain/pw
591 	 * during sess setup auth.
592 	 */
593 	ctx->local_nls = ses->local_nls;
594 
595 	/* Use RDMA if possible */
596 	ctx->rdma = iface->rdma_capable;
597 	memcpy(&ctx->dstaddr, &iface->sockaddr, sizeof(ctx->dstaddr));
598 
599 	/* reuse master con client guid */
600 	memcpy(&ctx->client_guid, ses->server->client_guid,
601 	       sizeof(ctx->client_guid));
602 	ctx->use_client_guid = true;
603 
604 	chan_server = cifs_get_tcp_session(ctx, ses->server);
605 
606 	spin_lock(&ses->chan_lock);
607 	chan = &ses->chans[ses->chan_count];
608 	chan->server = chan_server;
609 	if (IS_ERR(chan->server)) {
610 		rc = PTR_ERR(chan->server);
611 		chan->server = NULL;
612 		spin_unlock(&ses->chan_lock);
613 		goto out;
614 	}
615 	chan->iface = iface;
616 	ses->chan_count++;
617 	atomic_set(&ses->chan_seq, 0);
618 
619 	/* Mark this channel as needing connect/setup */
620 	cifs_chan_set_need_reconnect(ses, chan->server);
621 
622 	spin_unlock(&ses->chan_lock);
623 
624 	mutex_lock(&ses->session_mutex);
625 	/*
626 	 * We need to allocate the server crypto now as we will need
627 	 * to sign packets before we generate the channel signing key
628 	 * (we sign with the session key)
629 	 */
630 	rc = smb311_crypto_shash_allocate(chan->server);
631 	if (rc) {
632 		cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
633 		mutex_unlock(&ses->session_mutex);
634 		goto out;
635 	}
636 
637 	rc = cifs_negotiate_protocol(xid, ses, chan->server);
638 	if (!rc)
639 		rc = cifs_setup_session(xid, ses, chan->server, ses->local_nls);
640 
641 	mutex_unlock(&ses->session_mutex);
642 
643 out:
644 	if (rc && chan->server) {
645 		cifs_put_tcp_session(chan->server, 0);
646 
647 		spin_lock(&ses->chan_lock);
648 
649 		/* we rely on all bits beyond chan_count to be clear */
650 		cifs_chan_clear_need_reconnect(ses, chan->server);
651 		ses->chan_count--;
652 		/*
653 		 * chan_count should never reach 0 as at least the primary
654 		 * channel is always allocated
655 		 */
656 		WARN_ON(ses->chan_count < 1);
657 		spin_unlock(&ses->chan_lock);
658 	}
659 
660 	kfree(ctx->UNC);
661 out_free_ctx:
662 	kfree(ctx);
663 out_free_xid:
664 	free_xid(xid);
665 	return rc;
666 }
667 
668 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
cifs_ssetup_hdr(struct cifs_ses * ses,struct TCP_Server_Info * server,SESSION_SETUP_ANDX * pSMB)669 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses,
670 			     struct TCP_Server_Info *server,
671 			     SESSION_SETUP_ANDX *pSMB)
672 {
673 	__u32 capabilities = 0;
674 
675 	/* init fields common to all four types of SessSetup */
676 	/* Note that offsets for first seven fields in req struct are same  */
677 	/*	in CIFS Specs so does not matter which of 3 forms of struct */
678 	/*	that we use in next few lines                               */
679 	/* Note that header is initialized to zero in header_assemble */
680 	pSMB->req.AndXCommand = 0xFF;
681 	pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
682 					CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
683 					USHRT_MAX));
684 	pSMB->req.MaxMpxCount = cpu_to_le16(server->maxReq);
685 	pSMB->req.VcNumber = cpu_to_le16(1);
686 
687 	/* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
688 
689 	/* BB verify whether signing required on neg or just auth frame (and NTLM case) */
690 
691 	capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
692 			CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
693 
694 	if (server->sign)
695 		pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
696 
697 	if (ses->capabilities & CAP_UNICODE) {
698 		pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
699 		capabilities |= CAP_UNICODE;
700 	}
701 	if (ses->capabilities & CAP_STATUS32) {
702 		pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
703 		capabilities |= CAP_STATUS32;
704 	}
705 	if (ses->capabilities & CAP_DFS) {
706 		pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
707 		capabilities |= CAP_DFS;
708 	}
709 	if (ses->capabilities & CAP_UNIX)
710 		capabilities |= CAP_UNIX;
711 
712 	return capabilities;
713 }
714 
715 static void
unicode_oslm_strings(char ** pbcc_area,const struct nls_table * nls_cp)716 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
717 {
718 	char *bcc_ptr = *pbcc_area;
719 	int bytes_ret = 0;
720 
721 	/* Copy OS version */
722 	bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
723 				    nls_cp);
724 	bcc_ptr += 2 * bytes_ret;
725 	bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
726 				    32, nls_cp);
727 	bcc_ptr += 2 * bytes_ret;
728 	bcc_ptr += 2; /* trailing null */
729 
730 	bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
731 				    32, nls_cp);
732 	bcc_ptr += 2 * bytes_ret;
733 	bcc_ptr += 2; /* trailing null */
734 
735 	*pbcc_area = bcc_ptr;
736 }
737 
738 static void
ascii_oslm_strings(char ** pbcc_area,const struct nls_table * nls_cp)739 ascii_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
740 {
741 	char *bcc_ptr = *pbcc_area;
742 
743 	strcpy(bcc_ptr, "Linux version ");
744 	bcc_ptr += strlen("Linux version ");
745 	strcpy(bcc_ptr, init_utsname()->release);
746 	bcc_ptr += strlen(init_utsname()->release) + 1;
747 
748 	strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
749 	bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
750 
751 	*pbcc_area = bcc_ptr;
752 }
753 
unicode_domain_string(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)754 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
755 				   const struct nls_table *nls_cp)
756 {
757 	char *bcc_ptr = *pbcc_area;
758 	int bytes_ret = 0;
759 
760 	/* copy domain */
761 	if (ses->domainName == NULL) {
762 		/*
763 		 * Sending null domain better than using a bogus domain name (as
764 		 * we did briefly in 2.6.18) since server will use its default
765 		 */
766 		*bcc_ptr = 0;
767 		*(bcc_ptr+1) = 0;
768 		bytes_ret = 0;
769 	} else
770 		bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
771 					    CIFS_MAX_DOMAINNAME_LEN, nls_cp);
772 	bcc_ptr += 2 * bytes_ret;
773 	bcc_ptr += 2;  /* account for null terminator */
774 
775 	*pbcc_area = bcc_ptr;
776 }
777 
ascii_domain_string(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)778 static void ascii_domain_string(char **pbcc_area, struct cifs_ses *ses,
779 				const struct nls_table *nls_cp)
780 {
781 	char *bcc_ptr = *pbcc_area;
782 	int len;
783 
784 	/* copy domain */
785 	if (ses->domainName != NULL) {
786 		len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
787 		if (WARN_ON_ONCE(len < 0))
788 			len = CIFS_MAX_DOMAINNAME_LEN - 1;
789 		bcc_ptr += len;
790 	} /* else we send a null domain name so server will default to its own domain */
791 	*bcc_ptr = 0;
792 	bcc_ptr++;
793 
794 	*pbcc_area = bcc_ptr;
795 }
796 
unicode_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)797 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
798 				   const struct nls_table *nls_cp)
799 {
800 	char *bcc_ptr = *pbcc_area;
801 	int bytes_ret = 0;
802 
803 	/* BB FIXME add check that strings less than 335 or will need to send as arrays */
804 
805 	/* copy user */
806 	if (ses->user_name == NULL) {
807 		/* null user mount */
808 		*bcc_ptr = 0;
809 		*(bcc_ptr+1) = 0;
810 	} else {
811 		bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
812 					    CIFS_MAX_USERNAME_LEN, nls_cp);
813 	}
814 	bcc_ptr += 2 * bytes_ret;
815 	bcc_ptr += 2; /* account for null termination */
816 
817 	unicode_domain_string(&bcc_ptr, ses, nls_cp);
818 	unicode_oslm_strings(&bcc_ptr, nls_cp);
819 
820 	*pbcc_area = bcc_ptr;
821 }
822 
ascii_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)823 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
824 				 const struct nls_table *nls_cp)
825 {
826 	char *bcc_ptr = *pbcc_area;
827 	int len;
828 
829 	/* copy user */
830 	/* BB what about null user mounts - check that we do this BB */
831 	/* copy user */
832 	if (ses->user_name != NULL) {
833 		len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
834 		if (WARN_ON_ONCE(len < 0))
835 			len = CIFS_MAX_USERNAME_LEN - 1;
836 		bcc_ptr += len;
837 	}
838 	/* else null user mount */
839 	*bcc_ptr = 0;
840 	bcc_ptr++; /* account for null termination */
841 
842 	/* BB check for overflow here */
843 
844 	ascii_domain_string(&bcc_ptr, ses, nls_cp);
845 	ascii_oslm_strings(&bcc_ptr, nls_cp);
846 
847 	*pbcc_area = bcc_ptr;
848 }
849 
850 static void
decode_unicode_ssetup(char ** pbcc_area,int bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)851 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
852 		      const struct nls_table *nls_cp)
853 {
854 	int len;
855 	char *data = *pbcc_area;
856 
857 	cifs_dbg(FYI, "bleft %d\n", bleft);
858 
859 	kfree(ses->serverOS);
860 	ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
861 	cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
862 	len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
863 	data += len;
864 	bleft -= len;
865 	if (bleft <= 0)
866 		return;
867 
868 	kfree(ses->serverNOS);
869 	ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
870 	cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
871 	len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
872 	data += len;
873 	bleft -= len;
874 	if (bleft <= 0)
875 		return;
876 
877 	kfree(ses->serverDomain);
878 	ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
879 	cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
880 
881 	return;
882 }
883 
decode_ascii_ssetup(char ** pbcc_area,__u16 bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)884 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
885 				struct cifs_ses *ses,
886 				const struct nls_table *nls_cp)
887 {
888 	int len;
889 	char *bcc_ptr = *pbcc_area;
890 
891 	cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
892 
893 	len = strnlen(bcc_ptr, bleft);
894 	if (len >= bleft)
895 		return;
896 
897 	kfree(ses->serverOS);
898 
899 	ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
900 	if (ses->serverOS) {
901 		memcpy(ses->serverOS, bcc_ptr, len);
902 		ses->serverOS[len] = 0;
903 		if (strncmp(ses->serverOS, "OS/2", 4) == 0)
904 			cifs_dbg(FYI, "OS/2 server\n");
905 	}
906 
907 	bcc_ptr += len + 1;
908 	bleft -= len + 1;
909 
910 	len = strnlen(bcc_ptr, bleft);
911 	if (len >= bleft)
912 		return;
913 
914 	kfree(ses->serverNOS);
915 
916 	ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
917 	if (ses->serverNOS) {
918 		memcpy(ses->serverNOS, bcc_ptr, len);
919 		ses->serverNOS[len] = 0;
920 	}
921 
922 	bcc_ptr += len + 1;
923 	bleft -= len + 1;
924 
925 	len = strnlen(bcc_ptr, bleft);
926 	if (len > bleft)
927 		return;
928 
929 	/*
930 	 * No domain field in LANMAN case. Domain is
931 	 * returned by old servers in the SMB negprot response
932 	 *
933 	 * BB For newer servers which do not support Unicode,
934 	 * but thus do return domain here, we could add parsing
935 	 * for it later, but it is not very important
936 	 */
937 	cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
938 }
939 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
940 
decode_ntlmssp_challenge(char * bcc_ptr,int blob_len,struct cifs_ses * ses)941 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
942 				    struct cifs_ses *ses)
943 {
944 	unsigned int tioffset; /* challenge message target info area */
945 	unsigned int tilen; /* challenge message target info area length  */
946 	CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
947 	__u32 server_flags;
948 
949 	if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
950 		cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
951 		return -EINVAL;
952 	}
953 
954 	if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
955 		cifs_dbg(VFS, "blob signature incorrect %s\n",
956 			 pblob->Signature);
957 		return -EINVAL;
958 	}
959 	if (pblob->MessageType != NtLmChallenge) {
960 		cifs_dbg(VFS, "Incorrect message type %d\n",
961 			 pblob->MessageType);
962 		return -EINVAL;
963 	}
964 
965 	server_flags = le32_to_cpu(pblob->NegotiateFlags);
966 	cifs_dbg(FYI, "%s: negotiate=0x%08x challenge=0x%08x\n", __func__,
967 		 ses->ntlmssp->client_flags, server_flags);
968 
969 	if ((ses->ntlmssp->client_flags & (NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN)) &&
970 	    (!(server_flags & NTLMSSP_NEGOTIATE_56) && !(server_flags & NTLMSSP_NEGOTIATE_128))) {
971 		cifs_dbg(VFS, "%s: requested signing/encryption but server did not return either 56-bit or 128-bit session key size\n",
972 			 __func__);
973 		return -EINVAL;
974 	}
975 	if (!(server_flags & NTLMSSP_NEGOTIATE_NTLM) && !(server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) {
976 		cifs_dbg(VFS, "%s: server does not seem to support either NTLMv1 or NTLMv2\n", __func__);
977 		return -EINVAL;
978 	}
979 	if (ses->server->sign && !(server_flags & NTLMSSP_NEGOTIATE_SIGN)) {
980 		cifs_dbg(VFS, "%s: forced packet signing but server does not seem to support it\n",
981 			 __func__);
982 		return -EOPNOTSUPP;
983 	}
984 	if ((ses->ntlmssp->client_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
985 	    !(server_flags & NTLMSSP_NEGOTIATE_KEY_XCH))
986 		pr_warn_once("%s: authentication has been weakened as server does not support key exchange\n",
987 			     __func__);
988 
989 	ses->ntlmssp->server_flags = server_flags;
990 
991 	memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
992 	/*
993 	 * In particular we can examine sign flags
994 	 *
995 	 * BB spec says that if AvId field of MsvAvTimestamp is populated then
996 	 * we must set the MIC field of the AUTHENTICATE_MESSAGE
997 	 */
998 
999 	tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
1000 	tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
1001 	if (tioffset > blob_len || tioffset + tilen > blob_len) {
1002 		cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
1003 			 tioffset, tilen);
1004 		return -EINVAL;
1005 	}
1006 	if (tilen) {
1007 		kfree_sensitive(ses->auth_key.response);
1008 		ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
1009 						 GFP_KERNEL);
1010 		if (!ses->auth_key.response) {
1011 			cifs_dbg(VFS, "Challenge target info alloc failure\n");
1012 			return -ENOMEM;
1013 		}
1014 		ses->auth_key.len = tilen;
1015 	}
1016 
1017 	return 0;
1018 }
1019 
size_of_ntlmssp_blob(struct cifs_ses * ses,int base_size)1020 static int size_of_ntlmssp_blob(struct cifs_ses *ses, int base_size)
1021 {
1022 	int sz = base_size + ses->auth_key.len
1023 		- CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
1024 
1025 	if (ses->domainName)
1026 		sz += sizeof(__le16) * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
1027 	else
1028 		sz += sizeof(__le16);
1029 
1030 	if (ses->user_name)
1031 		sz += sizeof(__le16) * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
1032 	else
1033 		sz += sizeof(__le16);
1034 
1035 	if (ses->workstation_name[0])
1036 		sz += sizeof(__le16) * strnlen(ses->workstation_name,
1037 					       ntlmssp_workstation_name_size(ses));
1038 	else
1039 		sz += sizeof(__le16);
1040 
1041 	return sz;
1042 }
1043 
cifs_security_buffer_from_str(SECURITY_BUFFER * pbuf,char * str_value,int str_length,unsigned char * pstart,unsigned char ** pcur,const struct nls_table * nls_cp)1044 static inline void cifs_security_buffer_from_str(SECURITY_BUFFER *pbuf,
1045 						 char *str_value,
1046 						 int str_length,
1047 						 unsigned char *pstart,
1048 						 unsigned char **pcur,
1049 						 const struct nls_table *nls_cp)
1050 {
1051 	unsigned char *tmp = pstart;
1052 	int len;
1053 
1054 	if (!pbuf)
1055 		return;
1056 
1057 	if (!pcur)
1058 		pcur = &tmp;
1059 
1060 	if (!str_value) {
1061 		pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
1062 		pbuf->Length = 0;
1063 		pbuf->MaximumLength = 0;
1064 		*pcur += sizeof(__le16);
1065 	} else {
1066 		len = cifs_strtoUTF16((__le16 *)*pcur,
1067 				      str_value,
1068 				      str_length,
1069 				      nls_cp);
1070 		len *= sizeof(__le16);
1071 		pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
1072 		pbuf->Length = cpu_to_le16(len);
1073 		pbuf->MaximumLength = cpu_to_le16(len);
1074 		*pcur += len;
1075 	}
1076 }
1077 
1078 /* BB Move to ntlmssp.c eventually */
1079 
build_ntlmssp_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1080 int build_ntlmssp_negotiate_blob(unsigned char **pbuffer,
1081 				 u16 *buflen,
1082 				 struct cifs_ses *ses,
1083 				 struct TCP_Server_Info *server,
1084 				 const struct nls_table *nls_cp)
1085 {
1086 	int rc = 0;
1087 	NEGOTIATE_MESSAGE *sec_blob;
1088 	__u32 flags;
1089 	unsigned char *tmp;
1090 	int len;
1091 
1092 	len = size_of_ntlmssp_blob(ses, sizeof(NEGOTIATE_MESSAGE));
1093 	*pbuffer = kmalloc(len, GFP_KERNEL);
1094 	if (!*pbuffer) {
1095 		rc = -ENOMEM;
1096 		cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1097 		*buflen = 0;
1098 		goto setup_ntlm_neg_ret;
1099 	}
1100 	sec_blob = (NEGOTIATE_MESSAGE *)*pbuffer;
1101 
1102 	memset(*pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
1103 	memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1104 	sec_blob->MessageType = NtLmNegotiate;
1105 
1106 	/* BB is NTLMV2 session security format easier to use here? */
1107 	flags = NTLMSSP_NEGOTIATE_56 |	NTLMSSP_REQUEST_TARGET |
1108 		NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1109 		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1110 		NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1111 		NTLMSSP_NEGOTIATE_SIGN;
1112 	if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1113 		flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1114 
1115 	tmp = *pbuffer + sizeof(NEGOTIATE_MESSAGE);
1116 	ses->ntlmssp->client_flags = flags;
1117 	sec_blob->NegotiateFlags = cpu_to_le32(flags);
1118 
1119 	/* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1120 	cifs_security_buffer_from_str(&sec_blob->DomainName,
1121 				      NULL,
1122 				      CIFS_MAX_DOMAINNAME_LEN,
1123 				      *pbuffer, &tmp,
1124 				      nls_cp);
1125 
1126 	cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1127 				      NULL,
1128 				      CIFS_MAX_WORKSTATION_LEN,
1129 				      *pbuffer, &tmp,
1130 				      nls_cp);
1131 
1132 	*buflen = tmp - *pbuffer;
1133 setup_ntlm_neg_ret:
1134 	return rc;
1135 }
1136 
1137 /*
1138  * Build ntlmssp blob with additional fields, such as version,
1139  * supported by modern servers. For safety limit to SMB3 or later
1140  * See notes in MS-NLMP Section 2.2.2.1 e.g.
1141  */
build_ntlmssp_smb3_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1142 int build_ntlmssp_smb3_negotiate_blob(unsigned char **pbuffer,
1143 				 u16 *buflen,
1144 				 struct cifs_ses *ses,
1145 				 struct TCP_Server_Info *server,
1146 				 const struct nls_table *nls_cp)
1147 {
1148 	int rc = 0;
1149 	struct negotiate_message *sec_blob;
1150 	__u32 flags;
1151 	unsigned char *tmp;
1152 	int len;
1153 
1154 	len = size_of_ntlmssp_blob(ses, sizeof(struct negotiate_message));
1155 	*pbuffer = kmalloc(len, GFP_KERNEL);
1156 	if (!*pbuffer) {
1157 		rc = -ENOMEM;
1158 		cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1159 		*buflen = 0;
1160 		goto setup_ntlm_smb3_neg_ret;
1161 	}
1162 	sec_blob = (struct negotiate_message *)*pbuffer;
1163 
1164 	memset(*pbuffer, 0, sizeof(struct negotiate_message));
1165 	memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1166 	sec_blob->MessageType = NtLmNegotiate;
1167 
1168 	/* BB is NTLMV2 session security format easier to use here? */
1169 	flags = NTLMSSP_NEGOTIATE_56 |	NTLMSSP_REQUEST_TARGET |
1170 		NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1171 		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1172 		NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1173 		NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_VERSION;
1174 	if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1175 		flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1176 
1177 	sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1178 	sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1179 	sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1180 	sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1181 
1182 	tmp = *pbuffer + sizeof(struct negotiate_message);
1183 	ses->ntlmssp->client_flags = flags;
1184 	sec_blob->NegotiateFlags = cpu_to_le32(flags);
1185 
1186 	/* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1187 	cifs_security_buffer_from_str(&sec_blob->DomainName,
1188 				      NULL,
1189 				      CIFS_MAX_DOMAINNAME_LEN,
1190 				      *pbuffer, &tmp,
1191 				      nls_cp);
1192 
1193 	cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1194 				      NULL,
1195 				      CIFS_MAX_WORKSTATION_LEN,
1196 				      *pbuffer, &tmp,
1197 				      nls_cp);
1198 
1199 	*buflen = tmp - *pbuffer;
1200 setup_ntlm_smb3_neg_ret:
1201 	return rc;
1202 }
1203 
1204 
1205 /* See MS-NLMP 2.2.1.3 */
build_ntlmssp_auth_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1206 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
1207 					u16 *buflen,
1208 				   struct cifs_ses *ses,
1209 				   struct TCP_Server_Info *server,
1210 				   const struct nls_table *nls_cp)
1211 {
1212 	int rc;
1213 	AUTHENTICATE_MESSAGE *sec_blob;
1214 	__u32 flags;
1215 	unsigned char *tmp;
1216 	int len;
1217 
1218 	rc = setup_ntlmv2_rsp(ses, nls_cp);
1219 	if (rc) {
1220 		cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
1221 		*buflen = 0;
1222 		goto setup_ntlmv2_ret;
1223 	}
1224 
1225 	len = size_of_ntlmssp_blob(ses, sizeof(AUTHENTICATE_MESSAGE));
1226 	*pbuffer = kmalloc(len, GFP_KERNEL);
1227 	if (!*pbuffer) {
1228 		rc = -ENOMEM;
1229 		cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1230 		*buflen = 0;
1231 		goto setup_ntlmv2_ret;
1232 	}
1233 	sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
1234 
1235 	memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1236 	sec_blob->MessageType = NtLmAuthenticate;
1237 
1238 	/* send version information in ntlmssp authenticate also */
1239 	flags = ses->ntlmssp->server_flags | NTLMSSP_REQUEST_TARGET |
1240 		NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_VERSION |
1241 		NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED;
1242 
1243 	sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1244 	sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1245 	sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1246 	sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1247 
1248 	tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
1249 	sec_blob->NegotiateFlags = cpu_to_le32(flags);
1250 
1251 	sec_blob->LmChallengeResponse.BufferOffset =
1252 				cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
1253 	sec_blob->LmChallengeResponse.Length = 0;
1254 	sec_blob->LmChallengeResponse.MaximumLength = 0;
1255 
1256 	sec_blob->NtChallengeResponse.BufferOffset =
1257 				cpu_to_le32(tmp - *pbuffer);
1258 	if (ses->user_name != NULL) {
1259 		memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1260 				ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1261 		tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1262 
1263 		sec_blob->NtChallengeResponse.Length =
1264 				cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1265 		sec_blob->NtChallengeResponse.MaximumLength =
1266 				cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1267 	} else {
1268 		/*
1269 		 * don't send an NT Response for anonymous access
1270 		 */
1271 		sec_blob->NtChallengeResponse.Length = 0;
1272 		sec_blob->NtChallengeResponse.MaximumLength = 0;
1273 	}
1274 
1275 	cifs_security_buffer_from_str(&sec_blob->DomainName,
1276 				      ses->domainName,
1277 				      CIFS_MAX_DOMAINNAME_LEN,
1278 				      *pbuffer, &tmp,
1279 				      nls_cp);
1280 
1281 	cifs_security_buffer_from_str(&sec_blob->UserName,
1282 				      ses->user_name,
1283 				      CIFS_MAX_USERNAME_LEN,
1284 				      *pbuffer, &tmp,
1285 				      nls_cp);
1286 
1287 	cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1288 				      ses->workstation_name,
1289 				      ntlmssp_workstation_name_size(ses),
1290 				      *pbuffer, &tmp,
1291 				      nls_cp);
1292 
1293 	if ((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
1294 	    (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) &&
1295 	    !calc_seckey(ses)) {
1296 		memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
1297 		sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1298 		sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
1299 		sec_blob->SessionKey.MaximumLength =
1300 				cpu_to_le16(CIFS_CPHTXT_SIZE);
1301 		tmp += CIFS_CPHTXT_SIZE;
1302 	} else {
1303 		sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1304 		sec_blob->SessionKey.Length = 0;
1305 		sec_blob->SessionKey.MaximumLength = 0;
1306 	}
1307 
1308 	*buflen = tmp - *pbuffer;
1309 setup_ntlmv2_ret:
1310 	return rc;
1311 }
1312 
1313 enum securityEnum
cifs_select_sectype(struct TCP_Server_Info * server,enum securityEnum requested)1314 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
1315 {
1316 	switch (server->negflavor) {
1317 	case CIFS_NEGFLAVOR_EXTENDED:
1318 		switch (requested) {
1319 		case Kerberos:
1320 		case RawNTLMSSP:
1321 		case IAKerb:
1322 			return requested;
1323 		case Unspecified:
1324 			if (server->sec_ntlmssp &&
1325 			    (global_secflags & CIFSSEC_MAY_NTLMSSP))
1326 				return RawNTLMSSP;
1327 			if ((server->sec_kerberos || server->sec_mskerberos || server->sec_iakerb) &&
1328 			    (global_secflags & CIFSSEC_MAY_KRB5))
1329 				return Kerberos;
1330 			fallthrough;
1331 		default:
1332 			return Unspecified;
1333 		}
1334 	case CIFS_NEGFLAVOR_UNENCAP:
1335 		switch (requested) {
1336 		case NTLMv2:
1337 			return requested;
1338 		case Unspecified:
1339 			if (global_secflags & CIFSSEC_MAY_NTLMV2)
1340 				return NTLMv2;
1341 			break;
1342 		default:
1343 			break;
1344 		}
1345 		fallthrough;
1346 	default:
1347 		return Unspecified;
1348 	}
1349 }
1350 
1351 struct sess_data {
1352 	unsigned int xid;
1353 	struct cifs_ses *ses;
1354 	struct TCP_Server_Info *server;
1355 	struct nls_table *nls_cp;
1356 	void (*func)(struct sess_data *);
1357 	int result;
1358 
1359 	/* we will send the SMB in three pieces:
1360 	 * a fixed length beginning part, an optional
1361 	 * SPNEGO blob (which can be zero length), and a
1362 	 * last part which will include the strings
1363 	 * and rest of bcc area. This allows us to avoid
1364 	 * a large buffer 17K allocation
1365 	 */
1366 	int buf0_type;
1367 	struct kvec iov[3];
1368 };
1369 
1370 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
1371 static int
sess_alloc_buffer(struct sess_data * sess_data,int wct)1372 sess_alloc_buffer(struct sess_data *sess_data, int wct)
1373 {
1374 	int rc;
1375 	struct cifs_ses *ses = sess_data->ses;
1376 	struct smb_hdr *smb_buf;
1377 
1378 	rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
1379 				  (void **)&smb_buf);
1380 
1381 	if (rc)
1382 		return rc;
1383 
1384 	sess_data->iov[0].iov_base = (char *)smb_buf;
1385 	sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
1386 	/*
1387 	 * This variable will be used to clear the buffer
1388 	 * allocated above in case of any error in the calling function.
1389 	 */
1390 	sess_data->buf0_type = CIFS_SMALL_BUFFER;
1391 
1392 	/* 2000 big enough to fit max user, domain, NOS name etc. */
1393 	sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
1394 	if (!sess_data->iov[2].iov_base) {
1395 		rc = -ENOMEM;
1396 		goto out_free_smb_buf;
1397 	}
1398 
1399 	return 0;
1400 
1401 out_free_smb_buf:
1402 	cifs_small_buf_release(smb_buf);
1403 	sess_data->iov[0].iov_base = NULL;
1404 	sess_data->iov[0].iov_len = 0;
1405 	sess_data->buf0_type = CIFS_NO_BUFFER;
1406 	return rc;
1407 }
1408 
1409 static void
sess_free_buffer(struct sess_data * sess_data)1410 sess_free_buffer(struct sess_data *sess_data)
1411 {
1412 	struct kvec *iov = sess_data->iov;
1413 
1414 	/*
1415 	 * Zero the session data before freeing, as it might contain sensitive info (keys, etc).
1416 	 * Note that iov[1] is already freed by caller.
1417 	 */
1418 	if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base)
1419 		memzero_explicit(iov[0].iov_base, iov[0].iov_len);
1420 
1421 	free_rsp_buf(sess_data->buf0_type, iov[0].iov_base);
1422 	sess_data->buf0_type = CIFS_NO_BUFFER;
1423 	kfree_sensitive(iov[2].iov_base);
1424 }
1425 
1426 static int
sess_establish_session(struct sess_data * sess_data)1427 sess_establish_session(struct sess_data *sess_data)
1428 {
1429 	struct cifs_ses *ses = sess_data->ses;
1430 	struct TCP_Server_Info *server = sess_data->server;
1431 
1432 	cifs_server_lock(server);
1433 	if (!server->session_estab) {
1434 		if (server->sign) {
1435 			server->session_key.response =
1436 				kmemdup(ses->auth_key.response,
1437 				ses->auth_key.len, GFP_KERNEL);
1438 			if (!server->session_key.response) {
1439 				cifs_server_unlock(server);
1440 				return -ENOMEM;
1441 			}
1442 			server->session_key.len =
1443 						ses->auth_key.len;
1444 		}
1445 		server->sequence_number = 0x2;
1446 		server->session_estab = true;
1447 	}
1448 	cifs_server_unlock(server);
1449 
1450 	cifs_dbg(FYI, "CIFS session established successfully\n");
1451 	return 0;
1452 }
1453 
1454 static int
sess_sendreceive(struct sess_data * sess_data)1455 sess_sendreceive(struct sess_data *sess_data)
1456 {
1457 	int rc;
1458 	struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
1459 	__u16 count;
1460 	struct kvec rsp_iov = { NULL, 0 };
1461 
1462 	count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
1463 	be32_add_cpu(&smb_buf->smb_buf_length, count);
1464 	put_bcc(count, smb_buf);
1465 
1466 	rc = SendReceive2(sess_data->xid, sess_data->ses,
1467 			  sess_data->iov, 3 /* num_iovecs */,
1468 			  &sess_data->buf0_type,
1469 			  CIFS_LOG_ERROR, &rsp_iov);
1470 	cifs_small_buf_release(sess_data->iov[0].iov_base);
1471 	memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
1472 
1473 	return rc;
1474 }
1475 
1476 static void
sess_auth_ntlmv2(struct sess_data * sess_data)1477 sess_auth_ntlmv2(struct sess_data *sess_data)
1478 {
1479 	int rc = 0;
1480 	struct smb_hdr *smb_buf;
1481 	SESSION_SETUP_ANDX *pSMB;
1482 	char *bcc_ptr;
1483 	struct cifs_ses *ses = sess_data->ses;
1484 	struct TCP_Server_Info *server = sess_data->server;
1485 	__u32 capabilities;
1486 	__u16 bytes_remaining;
1487 
1488 	/* old style NTLM sessionsetup */
1489 	/* wct = 13 */
1490 	rc = sess_alloc_buffer(sess_data, 13);
1491 	if (rc)
1492 		goto out;
1493 
1494 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1495 	bcc_ptr = sess_data->iov[2].iov_base;
1496 	capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1497 
1498 	pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1499 
1500 	/* LM2 password would be here if we supported it */
1501 	pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1502 
1503 	if (ses->user_name != NULL) {
1504 		/* calculate nlmv2 response and session key */
1505 		rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
1506 		if (rc) {
1507 			cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
1508 			goto out;
1509 		}
1510 
1511 		memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1512 				ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1513 		bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1514 
1515 		/* set case sensitive password length after tilen may get
1516 		 * assigned, tilen is 0 otherwise.
1517 		 */
1518 		pSMB->req_no_secext.CaseSensitivePasswordLength =
1519 			cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1520 	} else {
1521 		pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1522 	}
1523 
1524 	if (ses->capabilities & CAP_UNICODE) {
1525 		if (!IS_ALIGNED(sess_data->iov[0].iov_len, 2)) {
1526 			*bcc_ptr = 0;
1527 			bcc_ptr++;
1528 		}
1529 		unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1530 	} else {
1531 		ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1532 	}
1533 
1534 
1535 	sess_data->iov[2].iov_len = (long) bcc_ptr -
1536 			(long) sess_data->iov[2].iov_base;
1537 
1538 	rc = sess_sendreceive(sess_data);
1539 	if (rc)
1540 		goto out;
1541 
1542 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1543 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1544 
1545 	if (smb_buf->WordCount != 3) {
1546 		rc = -EIO;
1547 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1548 		goto out;
1549 	}
1550 
1551 	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1552 		cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1553 
1554 	ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1555 	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1556 
1557 	bytes_remaining = get_bcc(smb_buf);
1558 	bcc_ptr = pByteArea(smb_buf);
1559 
1560 	/* BB check if Unicode and decode strings */
1561 	if (bytes_remaining == 0) {
1562 		/* no string area to decode, do nothing */
1563 	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1564 		/* unicode string area must be word-aligned */
1565 		if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1566 			++bcc_ptr;
1567 			--bytes_remaining;
1568 		}
1569 		decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1570 				      sess_data->nls_cp);
1571 	} else {
1572 		decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1573 				    sess_data->nls_cp);
1574 	}
1575 
1576 	rc = sess_establish_session(sess_data);
1577 out:
1578 	sess_data->result = rc;
1579 	sess_data->func = NULL;
1580 	sess_free_buffer(sess_data);
1581 	kfree_sensitive(ses->auth_key.response);
1582 	ses->auth_key.response = NULL;
1583 }
1584 
1585 #ifdef CONFIG_CIFS_UPCALL
1586 static void
sess_auth_kerberos(struct sess_data * sess_data)1587 sess_auth_kerberos(struct sess_data *sess_data)
1588 {
1589 	int rc = 0;
1590 	struct smb_hdr *smb_buf;
1591 	SESSION_SETUP_ANDX *pSMB;
1592 	char *bcc_ptr;
1593 	struct cifs_ses *ses = sess_data->ses;
1594 	struct TCP_Server_Info *server = sess_data->server;
1595 	__u32 capabilities;
1596 	__u16 bytes_remaining;
1597 	struct key *spnego_key = NULL;
1598 	struct cifs_spnego_msg *msg;
1599 	u16 blob_len;
1600 
1601 	/* extended security */
1602 	/* wct = 12 */
1603 	rc = sess_alloc_buffer(sess_data, 12);
1604 	if (rc)
1605 		goto out;
1606 
1607 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1608 	bcc_ptr = sess_data->iov[2].iov_base;
1609 	capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1610 
1611 	spnego_key = cifs_get_spnego_key(ses, server);
1612 	if (IS_ERR(spnego_key)) {
1613 		rc = PTR_ERR(spnego_key);
1614 		spnego_key = NULL;
1615 		goto out;
1616 	}
1617 
1618 	msg = spnego_key->payload.data[0];
1619 	/*
1620 	 * check version field to make sure that cifs.upcall is
1621 	 * sending us a response in an expected form
1622 	 */
1623 	if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1624 		cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1625 			 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1626 		rc = -EKEYREJECTED;
1627 		goto out_put_spnego_key;
1628 	}
1629 
1630 	kfree_sensitive(ses->auth_key.response);
1631 	ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1632 					 GFP_KERNEL);
1633 	if (!ses->auth_key.response) {
1634 		cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1635 			 msg->sesskey_len);
1636 		rc = -ENOMEM;
1637 		goto out_put_spnego_key;
1638 	}
1639 	ses->auth_key.len = msg->sesskey_len;
1640 
1641 	pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1642 	capabilities |= CAP_EXTENDED_SECURITY;
1643 	pSMB->req.Capabilities = cpu_to_le32(capabilities);
1644 	sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1645 	sess_data->iov[1].iov_len = msg->secblob_len;
1646 	pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1647 
1648 	if (pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) {
1649 		/* unicode strings must be word aligned */
1650 		if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1651 			*bcc_ptr = 0;
1652 			bcc_ptr++;
1653 		}
1654 		unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1655 		unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1656 	} else {
1657 		ascii_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1658 		ascii_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1659 	}
1660 
1661 	sess_data->iov[2].iov_len = (long) bcc_ptr -
1662 			(long) sess_data->iov[2].iov_base;
1663 
1664 	rc = sess_sendreceive(sess_data);
1665 	if (rc)
1666 		goto out_put_spnego_key;
1667 
1668 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1669 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1670 
1671 	if (smb_buf->WordCount != 4) {
1672 		rc = -EIO;
1673 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1674 		goto out_put_spnego_key;
1675 	}
1676 
1677 	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1678 		cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1679 
1680 	ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1681 	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1682 
1683 	bytes_remaining = get_bcc(smb_buf);
1684 	bcc_ptr = pByteArea(smb_buf);
1685 
1686 	blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1687 	if (blob_len > bytes_remaining) {
1688 		cifs_dbg(VFS, "bad security blob length %d\n",
1689 				blob_len);
1690 		rc = -EINVAL;
1691 		goto out_put_spnego_key;
1692 	}
1693 	bcc_ptr += blob_len;
1694 	bytes_remaining -= blob_len;
1695 
1696 	/* BB check if Unicode and decode strings */
1697 	if (bytes_remaining == 0) {
1698 		/* no string area to decode, do nothing */
1699 	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1700 		/* unicode string area must be word-aligned */
1701 		if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1702 			++bcc_ptr;
1703 			--bytes_remaining;
1704 		}
1705 		decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1706 				      sess_data->nls_cp);
1707 	} else {
1708 		decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1709 				    sess_data->nls_cp);
1710 	}
1711 
1712 	rc = sess_establish_session(sess_data);
1713 out_put_spnego_key:
1714 	key_invalidate(spnego_key);
1715 	key_put(spnego_key);
1716 out:
1717 	sess_data->result = rc;
1718 	sess_data->func = NULL;
1719 	sess_free_buffer(sess_data);
1720 	kfree_sensitive(ses->auth_key.response);
1721 	ses->auth_key.response = NULL;
1722 }
1723 
1724 #endif /* ! CONFIG_CIFS_UPCALL */
1725 
1726 /*
1727  * The required kvec buffers have to be allocated before calling this
1728  * function.
1729  */
1730 static int
_sess_auth_rawntlmssp_assemble_req(struct sess_data * sess_data)1731 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1732 {
1733 	SESSION_SETUP_ANDX *pSMB;
1734 	struct cifs_ses *ses = sess_data->ses;
1735 	struct TCP_Server_Info *server = sess_data->server;
1736 	__u32 capabilities;
1737 	char *bcc_ptr;
1738 
1739 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1740 
1741 	capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1742 	if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) {
1743 		cifs_dbg(VFS, "NTLMSSP requires Unicode support\n");
1744 		return -ENOSYS;
1745 	}
1746 
1747 	pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1748 	capabilities |= CAP_EXTENDED_SECURITY;
1749 	pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1750 
1751 	bcc_ptr = sess_data->iov[2].iov_base;
1752 	/* unicode strings must be word aligned */
1753 	if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1754 		*bcc_ptr = 0;
1755 		bcc_ptr++;
1756 	}
1757 	unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1758 
1759 	sess_data->iov[2].iov_len = (long) bcc_ptr -
1760 					(long) sess_data->iov[2].iov_base;
1761 
1762 	return 0;
1763 }
1764 
1765 static void
1766 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1767 
1768 static void
sess_auth_rawntlmssp_negotiate(struct sess_data * sess_data)1769 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1770 {
1771 	int rc;
1772 	struct smb_hdr *smb_buf;
1773 	SESSION_SETUP_ANDX *pSMB;
1774 	struct cifs_ses *ses = sess_data->ses;
1775 	struct TCP_Server_Info *server = sess_data->server;
1776 	__u16 bytes_remaining;
1777 	char *bcc_ptr;
1778 	unsigned char *ntlmsspblob = NULL;
1779 	u16 blob_len;
1780 
1781 	cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1782 
1783 	/*
1784 	 * if memory allocation is successful, caller of this function
1785 	 * frees it.
1786 	 */
1787 	ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1788 	if (!ses->ntlmssp) {
1789 		rc = -ENOMEM;
1790 		goto out;
1791 	}
1792 	ses->ntlmssp->sesskey_per_smbsess = false;
1793 
1794 	/* wct = 12 */
1795 	rc = sess_alloc_buffer(sess_data, 12);
1796 	if (rc)
1797 		goto out;
1798 
1799 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1800 
1801 	/* Build security blob before we assemble the request */
1802 	rc = build_ntlmssp_negotiate_blob(&ntlmsspblob,
1803 				     &blob_len, ses, server,
1804 				     sess_data->nls_cp);
1805 	if (rc)
1806 		goto out_free_ntlmsspblob;
1807 
1808 	sess_data->iov[1].iov_len = blob_len;
1809 	sess_data->iov[1].iov_base = ntlmsspblob;
1810 	pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1811 
1812 	rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1813 	if (rc)
1814 		goto out_free_ntlmsspblob;
1815 
1816 	rc = sess_sendreceive(sess_data);
1817 
1818 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1819 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1820 
1821 	/* If true, rc here is expected and not an error */
1822 	if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1823 	    smb_buf->Status.CifsError ==
1824 			cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1825 		rc = 0;
1826 
1827 	if (rc)
1828 		goto out_free_ntlmsspblob;
1829 
1830 	cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1831 
1832 	if (smb_buf->WordCount != 4) {
1833 		rc = -EIO;
1834 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1835 		goto out_free_ntlmsspblob;
1836 	}
1837 
1838 	ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1839 	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1840 
1841 	bytes_remaining = get_bcc(smb_buf);
1842 	bcc_ptr = pByteArea(smb_buf);
1843 
1844 	blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1845 	if (blob_len > bytes_remaining) {
1846 		cifs_dbg(VFS, "bad security blob length %d\n",
1847 				blob_len);
1848 		rc = -EINVAL;
1849 		goto out_free_ntlmsspblob;
1850 	}
1851 
1852 	rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1853 
1854 out_free_ntlmsspblob:
1855 	kfree_sensitive(ntlmsspblob);
1856 out:
1857 	sess_free_buffer(sess_data);
1858 
1859 	if (!rc) {
1860 		sess_data->func = sess_auth_rawntlmssp_authenticate;
1861 		return;
1862 	}
1863 
1864 	/* Else error. Cleanup */
1865 	kfree_sensitive(ses->auth_key.response);
1866 	ses->auth_key.response = NULL;
1867 	kfree_sensitive(ses->ntlmssp);
1868 	ses->ntlmssp = NULL;
1869 
1870 	sess_data->func = NULL;
1871 	sess_data->result = rc;
1872 }
1873 
1874 static void
sess_auth_rawntlmssp_authenticate(struct sess_data * sess_data)1875 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1876 {
1877 	int rc;
1878 	struct smb_hdr *smb_buf;
1879 	SESSION_SETUP_ANDX *pSMB;
1880 	struct cifs_ses *ses = sess_data->ses;
1881 	struct TCP_Server_Info *server = sess_data->server;
1882 	__u16 bytes_remaining;
1883 	char *bcc_ptr;
1884 	unsigned char *ntlmsspblob = NULL;
1885 	u16 blob_len;
1886 
1887 	cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1888 
1889 	/* wct = 12 */
1890 	rc = sess_alloc_buffer(sess_data, 12);
1891 	if (rc)
1892 		goto out;
1893 
1894 	/* Build security blob before we assemble the request */
1895 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1896 	smb_buf = (struct smb_hdr *)pSMB;
1897 	rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1898 					&blob_len, ses, server,
1899 					sess_data->nls_cp);
1900 	if (rc)
1901 		goto out_free_ntlmsspblob;
1902 	sess_data->iov[1].iov_len = blob_len;
1903 	sess_data->iov[1].iov_base = ntlmsspblob;
1904 	pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1905 	/*
1906 	 * Make sure that we tell the server that we are using
1907 	 * the uid that it just gave us back on the response
1908 	 * (challenge)
1909 	 */
1910 	smb_buf->Uid = ses->Suid;
1911 
1912 	rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1913 	if (rc)
1914 		goto out_free_ntlmsspblob;
1915 
1916 	rc = sess_sendreceive(sess_data);
1917 	if (rc)
1918 		goto out_free_ntlmsspblob;
1919 
1920 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1921 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1922 	if (smb_buf->WordCount != 4) {
1923 		rc = -EIO;
1924 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1925 		goto out_free_ntlmsspblob;
1926 	}
1927 
1928 	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1929 		cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1930 
1931 	if (ses->Suid != smb_buf->Uid) {
1932 		ses->Suid = smb_buf->Uid;
1933 		cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1934 	}
1935 
1936 	bytes_remaining = get_bcc(smb_buf);
1937 	bcc_ptr = pByteArea(smb_buf);
1938 	blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1939 	if (blob_len > bytes_remaining) {
1940 		cifs_dbg(VFS, "bad security blob length %d\n",
1941 				blob_len);
1942 		rc = -EINVAL;
1943 		goto out_free_ntlmsspblob;
1944 	}
1945 	bcc_ptr += blob_len;
1946 	bytes_remaining -= blob_len;
1947 
1948 
1949 	/* BB check if Unicode and decode strings */
1950 	if (bytes_remaining == 0) {
1951 		/* no string area to decode, do nothing */
1952 	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1953 		/* unicode string area must be word-aligned */
1954 		if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1955 			++bcc_ptr;
1956 			--bytes_remaining;
1957 		}
1958 		decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1959 				      sess_data->nls_cp);
1960 	} else {
1961 		decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1962 				    sess_data->nls_cp);
1963 	}
1964 
1965 out_free_ntlmsspblob:
1966 	kfree_sensitive(ntlmsspblob);
1967 out:
1968 	sess_free_buffer(sess_data);
1969 
1970 	if (!rc)
1971 		rc = sess_establish_session(sess_data);
1972 
1973 	/* Cleanup */
1974 	kfree_sensitive(ses->auth_key.response);
1975 	ses->auth_key.response = NULL;
1976 	kfree_sensitive(ses->ntlmssp);
1977 	ses->ntlmssp = NULL;
1978 
1979 	sess_data->func = NULL;
1980 	sess_data->result = rc;
1981 }
1982 
select_sec(struct sess_data * sess_data)1983 static int select_sec(struct sess_data *sess_data)
1984 {
1985 	int type;
1986 	struct cifs_ses *ses = sess_data->ses;
1987 	struct TCP_Server_Info *server = sess_data->server;
1988 
1989 	type = cifs_select_sectype(server, ses->sectype);
1990 	cifs_dbg(FYI, "sess setup type %d\n", type);
1991 	if (type == Unspecified) {
1992 		cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1993 		return -EINVAL;
1994 	}
1995 
1996 	switch (type) {
1997 	case NTLMv2:
1998 		sess_data->func = sess_auth_ntlmv2;
1999 		break;
2000 	case Kerberos:
2001 #ifdef CONFIG_CIFS_UPCALL
2002 		sess_data->func = sess_auth_kerberos;
2003 		break;
2004 #else
2005 		cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
2006 		return -ENOSYS;
2007 #endif /* CONFIG_CIFS_UPCALL */
2008 	case RawNTLMSSP:
2009 		sess_data->func = sess_auth_rawntlmssp_negotiate;
2010 		break;
2011 	default:
2012 		cifs_dbg(VFS, "secType %d not supported!\n", type);
2013 		return -ENOSYS;
2014 	}
2015 
2016 	return 0;
2017 }
2018 
CIFS_SessSetup(const unsigned int xid,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)2019 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
2020 		   struct TCP_Server_Info *server,
2021 		   const struct nls_table *nls_cp)
2022 {
2023 	int rc = 0;
2024 	struct sess_data *sess_data;
2025 
2026 	if (ses == NULL) {
2027 		WARN(1, "%s: ses == NULL!", __func__);
2028 		return -EINVAL;
2029 	}
2030 
2031 	sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
2032 	if (!sess_data)
2033 		return -ENOMEM;
2034 
2035 	sess_data->xid = xid;
2036 	sess_data->ses = ses;
2037 	sess_data->server = server;
2038 	sess_data->buf0_type = CIFS_NO_BUFFER;
2039 	sess_data->nls_cp = (struct nls_table *) nls_cp;
2040 
2041 	rc = select_sec(sess_data);
2042 	if (rc)
2043 		goto out;
2044 
2045 	while (sess_data->func)
2046 		sess_data->func(sess_data);
2047 
2048 	/* Store result before we free sess_data */
2049 	rc = sess_data->result;
2050 
2051 out:
2052 	kfree_sensitive(sess_data);
2053 	return rc;
2054 }
2055 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
2056