1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3  *
4  *   SMB/CIFS session setup handling routines
5  *
6  *   Copyright (c) International Business Machines  Corp., 2006, 2009
7  *   Author(s): Steve French (sfrench@us.ibm.com)
8  *
9  */
10 
11 #include "cifspdu.h"
12 #include "cifsglob.h"
13 #include "cifsproto.h"
14 #include "cifs_unicode.h"
15 #include "cifs_debug.h"
16 #include "ntlmssp.h"
17 #include "nterr.h"
18 #include <linux/utsname.h>
19 #include <linux/slab.h>
20 #include <linux/version.h>
21 #include "cifsfs.h"
22 #include "cifs_spnego.h"
23 #include "smb2proto.h"
24 #include "fs_context.h"
25 
26 static int
27 cifs_ses_add_channel(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses,
28 		     struct cifs_server_iface *iface);
29 
30 bool
is_server_using_iface(struct TCP_Server_Info * server,struct cifs_server_iface * iface)31 is_server_using_iface(struct TCP_Server_Info *server,
32 		      struct cifs_server_iface *iface)
33 {
34 	struct sockaddr_in *i4 = (struct sockaddr_in *)&iface->sockaddr;
35 	struct sockaddr_in6 *i6 = (struct sockaddr_in6 *)&iface->sockaddr;
36 	struct sockaddr_in *s4 = (struct sockaddr_in *)&server->dstaddr;
37 	struct sockaddr_in6 *s6 = (struct sockaddr_in6 *)&server->dstaddr;
38 
39 	if (server->dstaddr.ss_family != iface->sockaddr.ss_family)
40 		return false;
41 	if (server->dstaddr.ss_family == AF_INET) {
42 		if (s4->sin_addr.s_addr != i4->sin_addr.s_addr)
43 			return false;
44 	} else if (server->dstaddr.ss_family == AF_INET6) {
45 		if (memcmp(&s6->sin6_addr, &i6->sin6_addr,
46 			   sizeof(i6->sin6_addr)) != 0)
47 			return false;
48 	} else {
49 		/* unknown family.. */
50 		return false;
51 	}
52 	return true;
53 }
54 
is_ses_using_iface(struct cifs_ses * ses,struct cifs_server_iface * iface)55 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
56 {
57 	int i;
58 
59 	spin_lock(&ses->chan_lock);
60 	for (i = 0; i < ses->chan_count; i++) {
61 		if (ses->chans[i].iface == iface) {
62 			spin_unlock(&ses->chan_lock);
63 			return true;
64 		}
65 	}
66 	spin_unlock(&ses->chan_lock);
67 	return false;
68 }
69 
70 /* channel helper functions. assumed that chan_lock is held by caller. */
71 
72 unsigned int
cifs_ses_get_chan_index(struct cifs_ses * ses,struct TCP_Server_Info * server)73 cifs_ses_get_chan_index(struct cifs_ses *ses,
74 			struct TCP_Server_Info *server)
75 {
76 	unsigned int i;
77 
78 	for (i = 0; i < ses->chan_count; i++) {
79 		if (ses->chans[i].server == server)
80 			return i;
81 	}
82 
83 	/* If we didn't find the channel, it is likely a bug */
84 	if (server)
85 		cifs_dbg(VFS, "unable to get chan index for server: 0x%llx",
86 			 server->conn_id);
87 	WARN_ON(1);
88 	return 0;
89 }
90 
91 void
cifs_chan_set_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)92 cifs_chan_set_in_reconnect(struct cifs_ses *ses,
93 			     struct TCP_Server_Info *server)
94 {
95 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
96 
97 	ses->chans[chan_index].in_reconnect = true;
98 }
99 
100 void
cifs_chan_clear_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)101 cifs_chan_clear_in_reconnect(struct cifs_ses *ses,
102 			     struct TCP_Server_Info *server)
103 {
104 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
105 
106 	ses->chans[chan_index].in_reconnect = false;
107 }
108 
109 bool
cifs_chan_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)110 cifs_chan_in_reconnect(struct cifs_ses *ses,
111 			  struct TCP_Server_Info *server)
112 {
113 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
114 
115 	return CIFS_CHAN_IN_RECONNECT(ses, chan_index);
116 }
117 
118 void
cifs_chan_set_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)119 cifs_chan_set_need_reconnect(struct cifs_ses *ses,
120 			     struct TCP_Server_Info *server)
121 {
122 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
123 
124 	set_bit(chan_index, &ses->chans_need_reconnect);
125 	cifs_dbg(FYI, "Set reconnect bitmask for chan %u; now 0x%lx\n",
126 		 chan_index, ses->chans_need_reconnect);
127 }
128 
129 void
cifs_chan_clear_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)130 cifs_chan_clear_need_reconnect(struct cifs_ses *ses,
131 			       struct TCP_Server_Info *server)
132 {
133 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
134 
135 	clear_bit(chan_index, &ses->chans_need_reconnect);
136 	cifs_dbg(FYI, "Cleared reconnect bitmask for chan %u; now 0x%lx\n",
137 		 chan_index, ses->chans_need_reconnect);
138 }
139 
140 bool
cifs_chan_needs_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)141 cifs_chan_needs_reconnect(struct cifs_ses *ses,
142 			  struct TCP_Server_Info *server)
143 {
144 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
145 
146 	return CIFS_CHAN_NEEDS_RECONNECT(ses, chan_index);
147 }
148 
149 bool
cifs_chan_is_iface_active(struct cifs_ses * ses,struct TCP_Server_Info * server)150 cifs_chan_is_iface_active(struct cifs_ses *ses,
151 			  struct TCP_Server_Info *server)
152 {
153 	unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
154 
155 	return ses->chans[chan_index].iface &&
156 		ses->chans[chan_index].iface->is_active;
157 }
158 
159 /* returns number of channels added */
cifs_try_adding_channels(struct cifs_sb_info * cifs_sb,struct cifs_ses * ses)160 int cifs_try_adding_channels(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses)
161 {
162 	int old_chan_count, new_chan_count;
163 	int left;
164 	int rc = 0;
165 	int tries = 0;
166 	struct cifs_server_iface *iface = NULL, *niface = NULL;
167 
168 	spin_lock(&ses->chan_lock);
169 
170 	new_chan_count = old_chan_count = ses->chan_count;
171 	left = ses->chan_max - ses->chan_count;
172 
173 	if (left <= 0) {
174 		spin_unlock(&ses->chan_lock);
175 		cifs_dbg(FYI,
176 			 "ses already at max_channels (%zu), nothing to open\n",
177 			 ses->chan_max);
178 		return 0;
179 	}
180 
181 	if (ses->server->dialect < SMB30_PROT_ID) {
182 		spin_unlock(&ses->chan_lock);
183 		cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
184 		return 0;
185 	}
186 
187 	if (!(ses->server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
188 		ses->chan_max = 1;
189 		spin_unlock(&ses->chan_lock);
190 		cifs_dbg(VFS, "server %s does not support multichannel\n", ses->server->hostname);
191 		return 0;
192 	}
193 	spin_unlock(&ses->chan_lock);
194 
195 	/*
196 	 * Keep connecting to same, fastest, iface for all channels as
197 	 * long as its RSS. Try next fastest one if not RSS or channel
198 	 * creation fails.
199 	 */
200 	spin_lock(&ses->iface_lock);
201 	iface = list_first_entry(&ses->iface_list, struct cifs_server_iface,
202 				 iface_head);
203 	spin_unlock(&ses->iface_lock);
204 
205 	while (left > 0) {
206 
207 		tries++;
208 		if (tries > 3*ses->chan_max) {
209 			cifs_dbg(FYI, "too many channel open attempts (%d channels left to open)\n",
210 				 left);
211 			break;
212 		}
213 
214 		spin_lock(&ses->iface_lock);
215 		if (!ses->iface_count) {
216 			spin_unlock(&ses->iface_lock);
217 			break;
218 		}
219 
220 		list_for_each_entry_safe_from(iface, niface, &ses->iface_list,
221 				    iface_head) {
222 			/* skip ifaces that are unusable */
223 			if (!iface->is_active ||
224 			    (is_ses_using_iface(ses, iface) &&
225 			     !iface->rss_capable)) {
226 				continue;
227 			}
228 
229 			/* take ref before unlock */
230 			kref_get(&iface->refcount);
231 
232 			spin_unlock(&ses->iface_lock);
233 			rc = cifs_ses_add_channel(cifs_sb, ses, iface);
234 			spin_lock(&ses->iface_lock);
235 
236 			if (rc) {
237 				cifs_dbg(VFS, "failed to open extra channel on iface:%pIS rc=%d\n",
238 					 &iface->sockaddr,
239 					 rc);
240 				kref_put(&iface->refcount, release_iface);
241 				continue;
242 			}
243 
244 			cifs_dbg(FYI, "successfully opened new channel on iface:%pIS\n",
245 				 &iface->sockaddr);
246 			break;
247 		}
248 		spin_unlock(&ses->iface_lock);
249 
250 		left--;
251 		new_chan_count++;
252 	}
253 
254 	return new_chan_count - old_chan_count;
255 }
256 
257 /*
258  * update the iface for the channel if necessary.
259  * will return 0 when iface is updated, 1 if removed, 2 otherwise
260  * Must be called with chan_lock held.
261  */
262 int
cifs_chan_update_iface(struct cifs_ses * ses,struct TCP_Server_Info * server)263 cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server)
264 {
265 	unsigned int chan_index;
266 	struct cifs_server_iface *iface = NULL;
267 	struct cifs_server_iface *old_iface = NULL;
268 	int rc = 0;
269 
270 	spin_lock(&ses->chan_lock);
271 	chan_index = cifs_ses_get_chan_index(ses, server);
272 	if (!chan_index) {
273 		spin_unlock(&ses->chan_lock);
274 		return 0;
275 	}
276 
277 	if (ses->chans[chan_index].iface) {
278 		old_iface = ses->chans[chan_index].iface;
279 		if (old_iface->is_active) {
280 			spin_unlock(&ses->chan_lock);
281 			return 1;
282 		}
283 	}
284 	spin_unlock(&ses->chan_lock);
285 
286 	spin_lock(&ses->iface_lock);
287 	/* then look for a new one */
288 	list_for_each_entry(iface, &ses->iface_list, iface_head) {
289 		if (!iface->is_active ||
290 		    (is_ses_using_iface(ses, iface) &&
291 		     !iface->rss_capable)) {
292 			continue;
293 		}
294 		kref_get(&iface->refcount);
295 		break;
296 	}
297 
298 	if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
299 		rc = 1;
300 		iface = NULL;
301 		cifs_dbg(FYI, "unable to find a suitable iface\n");
302 	}
303 
304 	/* now drop the ref to the current iface */
305 	if (old_iface && iface) {
306 		cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n",
307 			 &old_iface->sockaddr,
308 			 &iface->sockaddr);
309 		kref_put(&old_iface->refcount, release_iface);
310 	} else if (old_iface) {
311 		cifs_dbg(FYI, "releasing ref to iface: %pIS\n",
312 			 &old_iface->sockaddr);
313 		kref_put(&old_iface->refcount, release_iface);
314 	} else {
315 		WARN_ON(!iface);
316 		cifs_dbg(FYI, "adding new iface: %pIS\n", &iface->sockaddr);
317 	}
318 	spin_unlock(&ses->iface_lock);
319 
320 	spin_lock(&ses->chan_lock);
321 	chan_index = cifs_ses_get_chan_index(ses, server);
322 	ses->chans[chan_index].iface = iface;
323 
324 	/* No iface is found. if secondary chan, drop connection */
325 	if (!iface && CIFS_SERVER_IS_CHAN(server))
326 		ses->chans[chan_index].server = NULL;
327 
328 	spin_unlock(&ses->chan_lock);
329 
330 	if (!iface && CIFS_SERVER_IS_CHAN(server))
331 		cifs_put_tcp_session(server, false);
332 
333 	return rc;
334 }
335 
336 /*
337  * If server is a channel of ses, return the corresponding enclosing
338  * cifs_chan otherwise return NULL.
339  */
340 struct cifs_chan *
cifs_ses_find_chan(struct cifs_ses * ses,struct TCP_Server_Info * server)341 cifs_ses_find_chan(struct cifs_ses *ses, struct TCP_Server_Info *server)
342 {
343 	int i;
344 
345 	spin_lock(&ses->chan_lock);
346 	for (i = 0; i < ses->chan_count; i++) {
347 		if (ses->chans[i].server == server) {
348 			spin_unlock(&ses->chan_lock);
349 			return &ses->chans[i];
350 		}
351 	}
352 	spin_unlock(&ses->chan_lock);
353 	return NULL;
354 }
355 
356 static int
cifs_ses_add_channel(struct cifs_sb_info * cifs_sb,struct cifs_ses * ses,struct cifs_server_iface * iface)357 cifs_ses_add_channel(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses,
358 		     struct cifs_server_iface *iface)
359 {
360 	struct TCP_Server_Info *chan_server;
361 	struct cifs_chan *chan;
362 	struct smb3_fs_context ctx = {NULL};
363 	static const char unc_fmt[] = "\\%s\\foo";
364 	char unc[sizeof(unc_fmt)+SERVER_NAME_LEN_WITH_NULL] = {0};
365 	struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
366 	struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
367 	int rc;
368 	unsigned int xid = get_xid();
369 
370 	if (iface->sockaddr.ss_family == AF_INET)
371 		cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
372 			 ses, iface->speed, iface->rdma_capable ? "yes" : "no",
373 			 &ipv4->sin_addr);
374 	else
375 		cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI6)\n",
376 			 ses, iface->speed, iface->rdma_capable ? "yes" : "no",
377 			 &ipv6->sin6_addr);
378 
379 	/*
380 	 * Setup a ctx with mostly the same info as the existing
381 	 * session and overwrite it with the requested iface data.
382 	 *
383 	 * We need to setup at least the fields used for negprot and
384 	 * sesssetup.
385 	 *
386 	 * We only need the ctx here, so we can reuse memory from
387 	 * the session and server without caring about memory
388 	 * management.
389 	 */
390 
391 	/* Always make new connection for now (TODO?) */
392 	ctx.nosharesock = true;
393 
394 	/* Auth */
395 	ctx.domainauto = ses->domainAuto;
396 	ctx.domainname = ses->domainName;
397 
398 	/* no hostname for extra channels */
399 	ctx.server_hostname = "";
400 
401 	ctx.username = ses->user_name;
402 	ctx.password = ses->password;
403 	ctx.sectype = ses->sectype;
404 	ctx.sign = ses->sign;
405 
406 	/* UNC and paths */
407 	/* XXX: Use ses->server->hostname? */
408 	sprintf(unc, unc_fmt, ses->ip_addr);
409 	ctx.UNC = unc;
410 	ctx.prepath = "";
411 
412 	/* Reuse same version as master connection */
413 	ctx.vals = ses->server->vals;
414 	ctx.ops = ses->server->ops;
415 
416 	ctx.noblocksnd = ses->server->noblocksnd;
417 	ctx.noautotune = ses->server->noautotune;
418 	ctx.sockopt_tcp_nodelay = ses->server->tcp_nodelay;
419 	ctx.echo_interval = ses->server->echo_interval / HZ;
420 	ctx.max_credits = ses->server->max_credits;
421 
422 	/*
423 	 * This will be used for encoding/decoding user/domain/pw
424 	 * during sess setup auth.
425 	 */
426 	ctx.local_nls = cifs_sb->local_nls;
427 
428 	/* Use RDMA if possible */
429 	ctx.rdma = iface->rdma_capable;
430 	memcpy(&ctx.dstaddr, &iface->sockaddr, sizeof(struct sockaddr_storage));
431 
432 	/* reuse master con client guid */
433 	memcpy(&ctx.client_guid, ses->server->client_guid,
434 	       SMB2_CLIENT_GUID_SIZE);
435 	ctx.use_client_guid = true;
436 
437 	chan_server = cifs_get_tcp_session(&ctx, ses->server);
438 
439 	spin_lock(&ses->chan_lock);
440 	chan = &ses->chans[ses->chan_count];
441 	chan->server = chan_server;
442 	if (IS_ERR(chan->server)) {
443 		rc = PTR_ERR(chan->server);
444 		chan->server = NULL;
445 		spin_unlock(&ses->chan_lock);
446 		goto out;
447 	}
448 	chan->iface = iface;
449 	ses->chan_count++;
450 	atomic_set(&ses->chan_seq, 0);
451 
452 	/* Mark this channel as needing connect/setup */
453 	cifs_chan_set_need_reconnect(ses, chan->server);
454 
455 	spin_unlock(&ses->chan_lock);
456 
457 	mutex_lock(&ses->session_mutex);
458 	/*
459 	 * We need to allocate the server crypto now as we will need
460 	 * to sign packets before we generate the channel signing key
461 	 * (we sign with the session key)
462 	 */
463 	rc = smb311_crypto_shash_allocate(chan->server);
464 	if (rc) {
465 		cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
466 		mutex_unlock(&ses->session_mutex);
467 		goto out;
468 	}
469 
470 	rc = cifs_negotiate_protocol(xid, ses, chan->server);
471 	if (!rc)
472 		rc = cifs_setup_session(xid, ses, chan->server, cifs_sb->local_nls);
473 
474 	mutex_unlock(&ses->session_mutex);
475 
476 out:
477 	if (rc && chan->server) {
478 		/*
479 		 * we should avoid race with these delayed works before we
480 		 * remove this channel
481 		 */
482 		cancel_delayed_work_sync(&chan->server->echo);
483 		cancel_delayed_work_sync(&chan->server->reconnect);
484 
485 		spin_lock(&ses->chan_lock);
486 		/* we rely on all bits beyond chan_count to be clear */
487 		cifs_chan_clear_need_reconnect(ses, chan->server);
488 		ses->chan_count--;
489 		/*
490 		 * chan_count should never reach 0 as at least the primary
491 		 * channel is always allocated
492 		 */
493 		WARN_ON(ses->chan_count < 1);
494 		spin_unlock(&ses->chan_lock);
495 
496 		cifs_put_tcp_session(chan->server, 0);
497 	}
498 
499 	free_xid(xid);
500 	return rc;
501 }
502 
503 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
cifs_ssetup_hdr(struct cifs_ses * ses,struct TCP_Server_Info * server,SESSION_SETUP_ANDX * pSMB)504 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses,
505 			     struct TCP_Server_Info *server,
506 			     SESSION_SETUP_ANDX *pSMB)
507 {
508 	__u32 capabilities = 0;
509 
510 	/* init fields common to all four types of SessSetup */
511 	/* Note that offsets for first seven fields in req struct are same  */
512 	/*	in CIFS Specs so does not matter which of 3 forms of struct */
513 	/*	that we use in next few lines                               */
514 	/* Note that header is initialized to zero in header_assemble */
515 	pSMB->req.AndXCommand = 0xFF;
516 	pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
517 					CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
518 					USHRT_MAX));
519 	pSMB->req.MaxMpxCount = cpu_to_le16(server->maxReq);
520 	pSMB->req.VcNumber = cpu_to_le16(1);
521 
522 	/* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
523 
524 	/* BB verify whether signing required on neg or just on auth frame
525 	   (and NTLM case) */
526 
527 	capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
528 			CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
529 
530 	if (server->sign)
531 		pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
532 
533 	if (ses->capabilities & CAP_UNICODE) {
534 		pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
535 		capabilities |= CAP_UNICODE;
536 	}
537 	if (ses->capabilities & CAP_STATUS32) {
538 		pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
539 		capabilities |= CAP_STATUS32;
540 	}
541 	if (ses->capabilities & CAP_DFS) {
542 		pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
543 		capabilities |= CAP_DFS;
544 	}
545 	if (ses->capabilities & CAP_UNIX)
546 		capabilities |= CAP_UNIX;
547 
548 	return capabilities;
549 }
550 
551 static void
unicode_oslm_strings(char ** pbcc_area,const struct nls_table * nls_cp)552 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
553 {
554 	char *bcc_ptr = *pbcc_area;
555 	int bytes_ret = 0;
556 
557 	/* Copy OS version */
558 	bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
559 				    nls_cp);
560 	bcc_ptr += 2 * bytes_ret;
561 	bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
562 				    32, nls_cp);
563 	bcc_ptr += 2 * bytes_ret;
564 	bcc_ptr += 2; /* trailing null */
565 
566 	bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
567 				    32, nls_cp);
568 	bcc_ptr += 2 * bytes_ret;
569 	bcc_ptr += 2; /* trailing null */
570 
571 	*pbcc_area = bcc_ptr;
572 }
573 
unicode_domain_string(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)574 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
575 				   const struct nls_table *nls_cp)
576 {
577 	char *bcc_ptr = *pbcc_area;
578 	int bytes_ret = 0;
579 
580 	/* copy domain */
581 	if (ses->domainName == NULL) {
582 		/* Sending null domain better than using a bogus domain name (as
583 		we did briefly in 2.6.18) since server will use its default */
584 		*bcc_ptr = 0;
585 		*(bcc_ptr+1) = 0;
586 		bytes_ret = 0;
587 	} else
588 		bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
589 					    CIFS_MAX_DOMAINNAME_LEN, nls_cp);
590 	bcc_ptr += 2 * bytes_ret;
591 	bcc_ptr += 2;  /* account for null terminator */
592 
593 	*pbcc_area = bcc_ptr;
594 }
595 
unicode_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)596 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
597 				   const struct nls_table *nls_cp)
598 {
599 	char *bcc_ptr = *pbcc_area;
600 	int bytes_ret = 0;
601 
602 	/* BB FIXME add check that strings total less
603 	than 335 or will need to send them as arrays */
604 
605 	/* copy user */
606 	if (ses->user_name == NULL) {
607 		/* null user mount */
608 		*bcc_ptr = 0;
609 		*(bcc_ptr+1) = 0;
610 	} else {
611 		bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
612 					    CIFS_MAX_USERNAME_LEN, nls_cp);
613 	}
614 	bcc_ptr += 2 * bytes_ret;
615 	bcc_ptr += 2; /* account for null termination */
616 
617 	unicode_domain_string(&bcc_ptr, ses, nls_cp);
618 	unicode_oslm_strings(&bcc_ptr, nls_cp);
619 
620 	*pbcc_area = bcc_ptr;
621 }
622 
ascii_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)623 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
624 				 const struct nls_table *nls_cp)
625 {
626 	char *bcc_ptr = *pbcc_area;
627 	int len;
628 
629 	/* copy user */
630 	/* BB what about null user mounts - check that we do this BB */
631 	/* copy user */
632 	if (ses->user_name != NULL) {
633 		len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
634 		if (WARN_ON_ONCE(len < 0))
635 			len = CIFS_MAX_USERNAME_LEN - 1;
636 		bcc_ptr += len;
637 	}
638 	/* else null user mount */
639 	*bcc_ptr = 0;
640 	bcc_ptr++; /* account for null termination */
641 
642 	/* copy domain */
643 	if (ses->domainName != NULL) {
644 		len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
645 		if (WARN_ON_ONCE(len < 0))
646 			len = CIFS_MAX_DOMAINNAME_LEN - 1;
647 		bcc_ptr += len;
648 	} /* else we will send a null domain name
649 	     so the server will default to its own domain */
650 	*bcc_ptr = 0;
651 	bcc_ptr++;
652 
653 	/* BB check for overflow here */
654 
655 	strcpy(bcc_ptr, "Linux version ");
656 	bcc_ptr += strlen("Linux version ");
657 	strcpy(bcc_ptr, init_utsname()->release);
658 	bcc_ptr += strlen(init_utsname()->release) + 1;
659 
660 	strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
661 	bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
662 
663 	*pbcc_area = bcc_ptr;
664 }
665 
666 static void
decode_unicode_ssetup(char ** pbcc_area,int bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)667 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
668 		      const struct nls_table *nls_cp)
669 {
670 	int len;
671 	char *data = *pbcc_area;
672 
673 	cifs_dbg(FYI, "bleft %d\n", bleft);
674 
675 	kfree(ses->serverOS);
676 	ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
677 	cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
678 	len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
679 	data += len;
680 	bleft -= len;
681 	if (bleft <= 0)
682 		return;
683 
684 	kfree(ses->serverNOS);
685 	ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
686 	cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
687 	len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
688 	data += len;
689 	bleft -= len;
690 	if (bleft <= 0)
691 		return;
692 
693 	kfree(ses->serverDomain);
694 	ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
695 	cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
696 
697 	return;
698 }
699 
decode_ascii_ssetup(char ** pbcc_area,__u16 bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)700 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
701 				struct cifs_ses *ses,
702 				const struct nls_table *nls_cp)
703 {
704 	int len;
705 	char *bcc_ptr = *pbcc_area;
706 
707 	cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
708 
709 	len = strnlen(bcc_ptr, bleft);
710 	if (len >= bleft)
711 		return;
712 
713 	kfree(ses->serverOS);
714 
715 	ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
716 	if (ses->serverOS) {
717 		memcpy(ses->serverOS, bcc_ptr, len);
718 		ses->serverOS[len] = 0;
719 		if (strncmp(ses->serverOS, "OS/2", 4) == 0)
720 			cifs_dbg(FYI, "OS/2 server\n");
721 	}
722 
723 	bcc_ptr += len + 1;
724 	bleft -= len + 1;
725 
726 	len = strnlen(bcc_ptr, bleft);
727 	if (len >= bleft)
728 		return;
729 
730 	kfree(ses->serverNOS);
731 
732 	ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
733 	if (ses->serverNOS) {
734 		memcpy(ses->serverNOS, bcc_ptr, len);
735 		ses->serverNOS[len] = 0;
736 	}
737 
738 	bcc_ptr += len + 1;
739 	bleft -= len + 1;
740 
741 	len = strnlen(bcc_ptr, bleft);
742 	if (len > bleft)
743 		return;
744 
745 	/* No domain field in LANMAN case. Domain is
746 	   returned by old servers in the SMB negprot response */
747 	/* BB For newer servers which do not support Unicode,
748 	   but thus do return domain here we could add parsing
749 	   for it later, but it is not very important */
750 	cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
751 }
752 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
753 
decode_ntlmssp_challenge(char * bcc_ptr,int blob_len,struct cifs_ses * ses)754 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
755 				    struct cifs_ses *ses)
756 {
757 	unsigned int tioffset; /* challenge message target info area */
758 	unsigned int tilen; /* challenge message target info area length  */
759 	CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
760 	__u32 server_flags;
761 
762 	if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
763 		cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
764 		return -EINVAL;
765 	}
766 
767 	if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
768 		cifs_dbg(VFS, "blob signature incorrect %s\n",
769 			 pblob->Signature);
770 		return -EINVAL;
771 	}
772 	if (pblob->MessageType != NtLmChallenge) {
773 		cifs_dbg(VFS, "Incorrect message type %d\n",
774 			 pblob->MessageType);
775 		return -EINVAL;
776 	}
777 
778 	server_flags = le32_to_cpu(pblob->NegotiateFlags);
779 	cifs_dbg(FYI, "%s: negotiate=0x%08x challenge=0x%08x\n", __func__,
780 		 ses->ntlmssp->client_flags, server_flags);
781 
782 	if ((ses->ntlmssp->client_flags & (NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN)) &&
783 	    (!(server_flags & NTLMSSP_NEGOTIATE_56) && !(server_flags & NTLMSSP_NEGOTIATE_128))) {
784 		cifs_dbg(VFS, "%s: requested signing/encryption but server did not return either 56-bit or 128-bit session key size\n",
785 			 __func__);
786 		return -EINVAL;
787 	}
788 	if (!(server_flags & NTLMSSP_NEGOTIATE_NTLM) && !(server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) {
789 		cifs_dbg(VFS, "%s: server does not seem to support either NTLMv1 or NTLMv2\n", __func__);
790 		return -EINVAL;
791 	}
792 	if (ses->server->sign && !(server_flags & NTLMSSP_NEGOTIATE_SIGN)) {
793 		cifs_dbg(VFS, "%s: forced packet signing but server does not seem to support it\n",
794 			 __func__);
795 		return -EOPNOTSUPP;
796 	}
797 	if ((ses->ntlmssp->client_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
798 	    !(server_flags & NTLMSSP_NEGOTIATE_KEY_XCH))
799 		pr_warn_once("%s: authentication has been weakened as server does not support key exchange\n",
800 			     __func__);
801 
802 	ses->ntlmssp->server_flags = server_flags;
803 
804 	memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
805 	/* In particular we can examine sign flags */
806 	/* BB spec says that if AvId field of MsvAvTimestamp is populated then
807 		we must set the MIC field of the AUTHENTICATE_MESSAGE */
808 
809 	tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
810 	tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
811 	if (tioffset > blob_len || tioffset + tilen > blob_len) {
812 		cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
813 			 tioffset, tilen);
814 		return -EINVAL;
815 	}
816 	if (tilen) {
817 		kfree_sensitive(ses->auth_key.response);
818 		ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
819 						 GFP_KERNEL);
820 		if (!ses->auth_key.response) {
821 			cifs_dbg(VFS, "Challenge target info alloc failure\n");
822 			return -ENOMEM;
823 		}
824 		ses->auth_key.len = tilen;
825 	}
826 
827 	return 0;
828 }
829 
size_of_ntlmssp_blob(struct cifs_ses * ses,int base_size)830 static int size_of_ntlmssp_blob(struct cifs_ses *ses, int base_size)
831 {
832 	int sz = base_size + ses->auth_key.len
833 		- CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
834 
835 	if (ses->domainName)
836 		sz += sizeof(__le16) * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
837 	else
838 		sz += sizeof(__le16);
839 
840 	if (ses->user_name)
841 		sz += sizeof(__le16) * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
842 	else
843 		sz += sizeof(__le16);
844 
845 	if (ses->workstation_name[0])
846 		sz += sizeof(__le16) * strnlen(ses->workstation_name,
847 					       ntlmssp_workstation_name_size(ses));
848 	else
849 		sz += sizeof(__le16);
850 
851 	return sz;
852 }
853 
cifs_security_buffer_from_str(SECURITY_BUFFER * pbuf,char * str_value,int str_length,unsigned char * pstart,unsigned char ** pcur,const struct nls_table * nls_cp)854 static inline void cifs_security_buffer_from_str(SECURITY_BUFFER *pbuf,
855 						 char *str_value,
856 						 int str_length,
857 						 unsigned char *pstart,
858 						 unsigned char **pcur,
859 						 const struct nls_table *nls_cp)
860 {
861 	unsigned char *tmp = pstart;
862 	int len;
863 
864 	if (!pbuf)
865 		return;
866 
867 	if (!pcur)
868 		pcur = &tmp;
869 
870 	if (!str_value) {
871 		pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
872 		pbuf->Length = 0;
873 		pbuf->MaximumLength = 0;
874 		*pcur += sizeof(__le16);
875 	} else {
876 		len = cifs_strtoUTF16((__le16 *)*pcur,
877 				      str_value,
878 				      str_length,
879 				      nls_cp);
880 		len *= sizeof(__le16);
881 		pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
882 		pbuf->Length = cpu_to_le16(len);
883 		pbuf->MaximumLength = cpu_to_le16(len);
884 		*pcur += len;
885 	}
886 }
887 
888 /* BB Move to ntlmssp.c eventually */
889 
build_ntlmssp_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)890 int build_ntlmssp_negotiate_blob(unsigned char **pbuffer,
891 				 u16 *buflen,
892 				 struct cifs_ses *ses,
893 				 struct TCP_Server_Info *server,
894 				 const struct nls_table *nls_cp)
895 {
896 	int rc = 0;
897 	NEGOTIATE_MESSAGE *sec_blob;
898 	__u32 flags;
899 	unsigned char *tmp;
900 	int len;
901 
902 	len = size_of_ntlmssp_blob(ses, sizeof(NEGOTIATE_MESSAGE));
903 	*pbuffer = kmalloc(len, GFP_KERNEL);
904 	if (!*pbuffer) {
905 		rc = -ENOMEM;
906 		cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
907 		*buflen = 0;
908 		goto setup_ntlm_neg_ret;
909 	}
910 	sec_blob = (NEGOTIATE_MESSAGE *)*pbuffer;
911 
912 	memset(*pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
913 	memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
914 	sec_blob->MessageType = NtLmNegotiate;
915 
916 	/* BB is NTLMV2 session security format easier to use here? */
917 	flags = NTLMSSP_NEGOTIATE_56 |	NTLMSSP_REQUEST_TARGET |
918 		NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
919 		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
920 		NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
921 		NTLMSSP_NEGOTIATE_SIGN;
922 	if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
923 		flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
924 
925 	tmp = *pbuffer + sizeof(NEGOTIATE_MESSAGE);
926 	ses->ntlmssp->client_flags = flags;
927 	sec_blob->NegotiateFlags = cpu_to_le32(flags);
928 
929 	/* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
930 	cifs_security_buffer_from_str(&sec_blob->DomainName,
931 				      NULL,
932 				      CIFS_MAX_DOMAINNAME_LEN,
933 				      *pbuffer, &tmp,
934 				      nls_cp);
935 
936 	cifs_security_buffer_from_str(&sec_blob->WorkstationName,
937 				      NULL,
938 				      CIFS_MAX_WORKSTATION_LEN,
939 				      *pbuffer, &tmp,
940 				      nls_cp);
941 
942 	*buflen = tmp - *pbuffer;
943 setup_ntlm_neg_ret:
944 	return rc;
945 }
946 
947 /*
948  * Build ntlmssp blob with additional fields, such as version,
949  * supported by modern servers. For safety limit to SMB3 or later
950  * See notes in MS-NLMP Section 2.2.2.1 e.g.
951  */
build_ntlmssp_smb3_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)952 int build_ntlmssp_smb3_negotiate_blob(unsigned char **pbuffer,
953 				 u16 *buflen,
954 				 struct cifs_ses *ses,
955 				 struct TCP_Server_Info *server,
956 				 const struct nls_table *nls_cp)
957 {
958 	int rc = 0;
959 	struct negotiate_message *sec_blob;
960 	__u32 flags;
961 	unsigned char *tmp;
962 	int len;
963 
964 	len = size_of_ntlmssp_blob(ses, sizeof(struct negotiate_message));
965 	*pbuffer = kmalloc(len, GFP_KERNEL);
966 	if (!*pbuffer) {
967 		rc = -ENOMEM;
968 		cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
969 		*buflen = 0;
970 		goto setup_ntlm_smb3_neg_ret;
971 	}
972 	sec_blob = (struct negotiate_message *)*pbuffer;
973 
974 	memset(*pbuffer, 0, sizeof(struct negotiate_message));
975 	memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
976 	sec_blob->MessageType = NtLmNegotiate;
977 
978 	/* BB is NTLMV2 session security format easier to use here? */
979 	flags = NTLMSSP_NEGOTIATE_56 |	NTLMSSP_REQUEST_TARGET |
980 		NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
981 		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
982 		NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
983 		NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_VERSION;
984 	if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
985 		flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
986 
987 	sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
988 	sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
989 	sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
990 	sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
991 
992 	tmp = *pbuffer + sizeof(struct negotiate_message);
993 	ses->ntlmssp->client_flags = flags;
994 	sec_blob->NegotiateFlags = cpu_to_le32(flags);
995 
996 	/* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
997 	cifs_security_buffer_from_str(&sec_blob->DomainName,
998 				      NULL,
999 				      CIFS_MAX_DOMAINNAME_LEN,
1000 				      *pbuffer, &tmp,
1001 				      nls_cp);
1002 
1003 	cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1004 				      NULL,
1005 				      CIFS_MAX_WORKSTATION_LEN,
1006 				      *pbuffer, &tmp,
1007 				      nls_cp);
1008 
1009 	*buflen = tmp - *pbuffer;
1010 setup_ntlm_smb3_neg_ret:
1011 	return rc;
1012 }
1013 
1014 
build_ntlmssp_auth_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1015 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
1016 					u16 *buflen,
1017 				   struct cifs_ses *ses,
1018 				   struct TCP_Server_Info *server,
1019 				   const struct nls_table *nls_cp)
1020 {
1021 	int rc;
1022 	AUTHENTICATE_MESSAGE *sec_blob;
1023 	__u32 flags;
1024 	unsigned char *tmp;
1025 	int len;
1026 
1027 	rc = setup_ntlmv2_rsp(ses, nls_cp);
1028 	if (rc) {
1029 		cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
1030 		*buflen = 0;
1031 		goto setup_ntlmv2_ret;
1032 	}
1033 
1034 	len = size_of_ntlmssp_blob(ses, sizeof(AUTHENTICATE_MESSAGE));
1035 	*pbuffer = kmalloc(len, GFP_KERNEL);
1036 	if (!*pbuffer) {
1037 		rc = -ENOMEM;
1038 		cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1039 		*buflen = 0;
1040 		goto setup_ntlmv2_ret;
1041 	}
1042 	sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
1043 
1044 	memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1045 	sec_blob->MessageType = NtLmAuthenticate;
1046 
1047 	flags = ses->ntlmssp->server_flags | NTLMSSP_REQUEST_TARGET |
1048 		NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED;
1049 
1050 	tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
1051 	sec_blob->NegotiateFlags = cpu_to_le32(flags);
1052 
1053 	sec_blob->LmChallengeResponse.BufferOffset =
1054 				cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
1055 	sec_blob->LmChallengeResponse.Length = 0;
1056 	sec_blob->LmChallengeResponse.MaximumLength = 0;
1057 
1058 	sec_blob->NtChallengeResponse.BufferOffset =
1059 				cpu_to_le32(tmp - *pbuffer);
1060 	if (ses->user_name != NULL) {
1061 		memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1062 				ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1063 		tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1064 
1065 		sec_blob->NtChallengeResponse.Length =
1066 				cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1067 		sec_blob->NtChallengeResponse.MaximumLength =
1068 				cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1069 	} else {
1070 		/*
1071 		 * don't send an NT Response for anonymous access
1072 		 */
1073 		sec_blob->NtChallengeResponse.Length = 0;
1074 		sec_blob->NtChallengeResponse.MaximumLength = 0;
1075 	}
1076 
1077 	cifs_security_buffer_from_str(&sec_blob->DomainName,
1078 				      ses->domainName,
1079 				      CIFS_MAX_DOMAINNAME_LEN,
1080 				      *pbuffer, &tmp,
1081 				      nls_cp);
1082 
1083 	cifs_security_buffer_from_str(&sec_blob->UserName,
1084 				      ses->user_name,
1085 				      CIFS_MAX_USERNAME_LEN,
1086 				      *pbuffer, &tmp,
1087 				      nls_cp);
1088 
1089 	cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1090 				      ses->workstation_name,
1091 				      ntlmssp_workstation_name_size(ses),
1092 				      *pbuffer, &tmp,
1093 				      nls_cp);
1094 
1095 	if ((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
1096 	    (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) &&
1097 	    !calc_seckey(ses)) {
1098 		memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
1099 		sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1100 		sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
1101 		sec_blob->SessionKey.MaximumLength =
1102 				cpu_to_le16(CIFS_CPHTXT_SIZE);
1103 		tmp += CIFS_CPHTXT_SIZE;
1104 	} else {
1105 		sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1106 		sec_blob->SessionKey.Length = 0;
1107 		sec_blob->SessionKey.MaximumLength = 0;
1108 	}
1109 
1110 	*buflen = tmp - *pbuffer;
1111 setup_ntlmv2_ret:
1112 	return rc;
1113 }
1114 
1115 enum securityEnum
cifs_select_sectype(struct TCP_Server_Info * server,enum securityEnum requested)1116 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
1117 {
1118 	switch (server->negflavor) {
1119 	case CIFS_NEGFLAVOR_EXTENDED:
1120 		switch (requested) {
1121 		case Kerberos:
1122 		case RawNTLMSSP:
1123 			return requested;
1124 		case Unspecified:
1125 			if (server->sec_ntlmssp &&
1126 			    (global_secflags & CIFSSEC_MAY_NTLMSSP))
1127 				return RawNTLMSSP;
1128 			if ((server->sec_kerberos || server->sec_mskerberos) &&
1129 			    (global_secflags & CIFSSEC_MAY_KRB5))
1130 				return Kerberos;
1131 			fallthrough;
1132 		default:
1133 			return Unspecified;
1134 		}
1135 	case CIFS_NEGFLAVOR_UNENCAP:
1136 		switch (requested) {
1137 		case NTLMv2:
1138 			return requested;
1139 		case Unspecified:
1140 			if (global_secflags & CIFSSEC_MAY_NTLMV2)
1141 				return NTLMv2;
1142 			break;
1143 		default:
1144 			break;
1145 		}
1146 		fallthrough;
1147 	default:
1148 		return Unspecified;
1149 	}
1150 }
1151 
1152 struct sess_data {
1153 	unsigned int xid;
1154 	struct cifs_ses *ses;
1155 	struct TCP_Server_Info *server;
1156 	struct nls_table *nls_cp;
1157 	void (*func)(struct sess_data *);
1158 	int result;
1159 
1160 	/* we will send the SMB in three pieces:
1161 	 * a fixed length beginning part, an optional
1162 	 * SPNEGO blob (which can be zero length), and a
1163 	 * last part which will include the strings
1164 	 * and rest of bcc area. This allows us to avoid
1165 	 * a large buffer 17K allocation
1166 	 */
1167 	int buf0_type;
1168 	struct kvec iov[3];
1169 };
1170 
1171 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
1172 static int
sess_alloc_buffer(struct sess_data * sess_data,int wct)1173 sess_alloc_buffer(struct sess_data *sess_data, int wct)
1174 {
1175 	int rc;
1176 	struct cifs_ses *ses = sess_data->ses;
1177 	struct smb_hdr *smb_buf;
1178 
1179 	rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
1180 				  (void **)&smb_buf);
1181 
1182 	if (rc)
1183 		return rc;
1184 
1185 	sess_data->iov[0].iov_base = (char *)smb_buf;
1186 	sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
1187 	/*
1188 	 * This variable will be used to clear the buffer
1189 	 * allocated above in case of any error in the calling function.
1190 	 */
1191 	sess_data->buf0_type = CIFS_SMALL_BUFFER;
1192 
1193 	/* 2000 big enough to fit max user, domain, NOS name etc. */
1194 	sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
1195 	if (!sess_data->iov[2].iov_base) {
1196 		rc = -ENOMEM;
1197 		goto out_free_smb_buf;
1198 	}
1199 
1200 	return 0;
1201 
1202 out_free_smb_buf:
1203 	cifs_small_buf_release(smb_buf);
1204 	sess_data->iov[0].iov_base = NULL;
1205 	sess_data->iov[0].iov_len = 0;
1206 	sess_data->buf0_type = CIFS_NO_BUFFER;
1207 	return rc;
1208 }
1209 
1210 static void
sess_free_buffer(struct sess_data * sess_data)1211 sess_free_buffer(struct sess_data *sess_data)
1212 {
1213 	struct kvec *iov = sess_data->iov;
1214 
1215 	/*
1216 	 * Zero the session data before freeing, as it might contain sensitive info (keys, etc).
1217 	 * Note that iov[1] is already freed by caller.
1218 	 */
1219 	if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base)
1220 		memzero_explicit(iov[0].iov_base, iov[0].iov_len);
1221 
1222 	free_rsp_buf(sess_data->buf0_type, iov[0].iov_base);
1223 	sess_data->buf0_type = CIFS_NO_BUFFER;
1224 	kfree_sensitive(iov[2].iov_base);
1225 }
1226 
1227 static int
sess_establish_session(struct sess_data * sess_data)1228 sess_establish_session(struct sess_data *sess_data)
1229 {
1230 	struct cifs_ses *ses = sess_data->ses;
1231 	struct TCP_Server_Info *server = sess_data->server;
1232 
1233 	cifs_server_lock(server);
1234 	if (!server->session_estab) {
1235 		if (server->sign) {
1236 			server->session_key.response =
1237 				kmemdup(ses->auth_key.response,
1238 				ses->auth_key.len, GFP_KERNEL);
1239 			if (!server->session_key.response) {
1240 				cifs_server_unlock(server);
1241 				return -ENOMEM;
1242 			}
1243 			server->session_key.len =
1244 						ses->auth_key.len;
1245 		}
1246 		server->sequence_number = 0x2;
1247 		server->session_estab = true;
1248 	}
1249 	cifs_server_unlock(server);
1250 
1251 	cifs_dbg(FYI, "CIFS session established successfully\n");
1252 	return 0;
1253 }
1254 
1255 static int
sess_sendreceive(struct sess_data * sess_data)1256 sess_sendreceive(struct sess_data *sess_data)
1257 {
1258 	int rc;
1259 	struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
1260 	__u16 count;
1261 	struct kvec rsp_iov = { NULL, 0 };
1262 
1263 	count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
1264 	be32_add_cpu(&smb_buf->smb_buf_length, count);
1265 	put_bcc(count, smb_buf);
1266 
1267 	rc = SendReceive2(sess_data->xid, sess_data->ses,
1268 			  sess_data->iov, 3 /* num_iovecs */,
1269 			  &sess_data->buf0_type,
1270 			  CIFS_LOG_ERROR, &rsp_iov);
1271 	cifs_small_buf_release(sess_data->iov[0].iov_base);
1272 	memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
1273 
1274 	return rc;
1275 }
1276 
1277 static void
sess_auth_ntlmv2(struct sess_data * sess_data)1278 sess_auth_ntlmv2(struct sess_data *sess_data)
1279 {
1280 	int rc = 0;
1281 	struct smb_hdr *smb_buf;
1282 	SESSION_SETUP_ANDX *pSMB;
1283 	char *bcc_ptr;
1284 	struct cifs_ses *ses = sess_data->ses;
1285 	struct TCP_Server_Info *server = sess_data->server;
1286 	__u32 capabilities;
1287 	__u16 bytes_remaining;
1288 
1289 	/* old style NTLM sessionsetup */
1290 	/* wct = 13 */
1291 	rc = sess_alloc_buffer(sess_data, 13);
1292 	if (rc)
1293 		goto out;
1294 
1295 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1296 	bcc_ptr = sess_data->iov[2].iov_base;
1297 	capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1298 
1299 	pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1300 
1301 	/* LM2 password would be here if we supported it */
1302 	pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1303 
1304 	if (ses->user_name != NULL) {
1305 		/* calculate nlmv2 response and session key */
1306 		rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
1307 		if (rc) {
1308 			cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
1309 			goto out;
1310 		}
1311 
1312 		memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1313 				ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1314 		bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1315 
1316 		/* set case sensitive password length after tilen may get
1317 		 * assigned, tilen is 0 otherwise.
1318 		 */
1319 		pSMB->req_no_secext.CaseSensitivePasswordLength =
1320 			cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1321 	} else {
1322 		pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1323 	}
1324 
1325 	if (ses->capabilities & CAP_UNICODE) {
1326 		if (!IS_ALIGNED(sess_data->iov[0].iov_len, 2)) {
1327 			*bcc_ptr = 0;
1328 			bcc_ptr++;
1329 		}
1330 		unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1331 	} else {
1332 		ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1333 	}
1334 
1335 
1336 	sess_data->iov[2].iov_len = (long) bcc_ptr -
1337 			(long) sess_data->iov[2].iov_base;
1338 
1339 	rc = sess_sendreceive(sess_data);
1340 	if (rc)
1341 		goto out;
1342 
1343 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1344 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1345 
1346 	if (smb_buf->WordCount != 3) {
1347 		rc = -EIO;
1348 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1349 		goto out;
1350 	}
1351 
1352 	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1353 		cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1354 
1355 	ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1356 	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1357 
1358 	bytes_remaining = get_bcc(smb_buf);
1359 	bcc_ptr = pByteArea(smb_buf);
1360 
1361 	/* BB check if Unicode and decode strings */
1362 	if (bytes_remaining == 0) {
1363 		/* no string area to decode, do nothing */
1364 	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1365 		/* unicode string area must be word-aligned */
1366 		if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1367 			++bcc_ptr;
1368 			--bytes_remaining;
1369 		}
1370 		decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1371 				      sess_data->nls_cp);
1372 	} else {
1373 		decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1374 				    sess_data->nls_cp);
1375 	}
1376 
1377 	rc = sess_establish_session(sess_data);
1378 out:
1379 	sess_data->result = rc;
1380 	sess_data->func = NULL;
1381 	sess_free_buffer(sess_data);
1382 	kfree_sensitive(ses->auth_key.response);
1383 	ses->auth_key.response = NULL;
1384 }
1385 
1386 #ifdef CONFIG_CIFS_UPCALL
1387 static void
sess_auth_kerberos(struct sess_data * sess_data)1388 sess_auth_kerberos(struct sess_data *sess_data)
1389 {
1390 	int rc = 0;
1391 	struct smb_hdr *smb_buf;
1392 	SESSION_SETUP_ANDX *pSMB;
1393 	char *bcc_ptr;
1394 	struct cifs_ses *ses = sess_data->ses;
1395 	struct TCP_Server_Info *server = sess_data->server;
1396 	__u32 capabilities;
1397 	__u16 bytes_remaining;
1398 	struct key *spnego_key = NULL;
1399 	struct cifs_spnego_msg *msg;
1400 	u16 blob_len;
1401 
1402 	/* extended security */
1403 	/* wct = 12 */
1404 	rc = sess_alloc_buffer(sess_data, 12);
1405 	if (rc)
1406 		goto out;
1407 
1408 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1409 	bcc_ptr = sess_data->iov[2].iov_base;
1410 	capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1411 
1412 	spnego_key = cifs_get_spnego_key(ses, server);
1413 	if (IS_ERR(spnego_key)) {
1414 		rc = PTR_ERR(spnego_key);
1415 		spnego_key = NULL;
1416 		goto out;
1417 	}
1418 
1419 	msg = spnego_key->payload.data[0];
1420 	/*
1421 	 * check version field to make sure that cifs.upcall is
1422 	 * sending us a response in an expected form
1423 	 */
1424 	if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1425 		cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1426 			 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1427 		rc = -EKEYREJECTED;
1428 		goto out_put_spnego_key;
1429 	}
1430 
1431 	kfree_sensitive(ses->auth_key.response);
1432 	ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1433 					 GFP_KERNEL);
1434 	if (!ses->auth_key.response) {
1435 		cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1436 			 msg->sesskey_len);
1437 		rc = -ENOMEM;
1438 		goto out_put_spnego_key;
1439 	}
1440 	ses->auth_key.len = msg->sesskey_len;
1441 
1442 	pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1443 	capabilities |= CAP_EXTENDED_SECURITY;
1444 	pSMB->req.Capabilities = cpu_to_le32(capabilities);
1445 	sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1446 	sess_data->iov[1].iov_len = msg->secblob_len;
1447 	pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1448 
1449 	if (ses->capabilities & CAP_UNICODE) {
1450 		/* unicode strings must be word aligned */
1451 		if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1452 			*bcc_ptr = 0;
1453 			bcc_ptr++;
1454 		}
1455 		unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1456 		unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1457 	} else {
1458 		/* BB: is this right? */
1459 		ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1460 	}
1461 
1462 	sess_data->iov[2].iov_len = (long) bcc_ptr -
1463 			(long) sess_data->iov[2].iov_base;
1464 
1465 	rc = sess_sendreceive(sess_data);
1466 	if (rc)
1467 		goto out_put_spnego_key;
1468 
1469 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1470 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1471 
1472 	if (smb_buf->WordCount != 4) {
1473 		rc = -EIO;
1474 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1475 		goto out_put_spnego_key;
1476 	}
1477 
1478 	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1479 		cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1480 
1481 	ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1482 	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1483 
1484 	bytes_remaining = get_bcc(smb_buf);
1485 	bcc_ptr = pByteArea(smb_buf);
1486 
1487 	blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1488 	if (blob_len > bytes_remaining) {
1489 		cifs_dbg(VFS, "bad security blob length %d\n",
1490 				blob_len);
1491 		rc = -EINVAL;
1492 		goto out_put_spnego_key;
1493 	}
1494 	bcc_ptr += blob_len;
1495 	bytes_remaining -= blob_len;
1496 
1497 	/* BB check if Unicode and decode strings */
1498 	if (bytes_remaining == 0) {
1499 		/* no string area to decode, do nothing */
1500 	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1501 		/* unicode string area must be word-aligned */
1502 		if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1503 			++bcc_ptr;
1504 			--bytes_remaining;
1505 		}
1506 		decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1507 				      sess_data->nls_cp);
1508 	} else {
1509 		decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1510 				    sess_data->nls_cp);
1511 	}
1512 
1513 	rc = sess_establish_session(sess_data);
1514 out_put_spnego_key:
1515 	key_invalidate(spnego_key);
1516 	key_put(spnego_key);
1517 out:
1518 	sess_data->result = rc;
1519 	sess_data->func = NULL;
1520 	sess_free_buffer(sess_data);
1521 	kfree_sensitive(ses->auth_key.response);
1522 	ses->auth_key.response = NULL;
1523 }
1524 
1525 #endif /* ! CONFIG_CIFS_UPCALL */
1526 
1527 /*
1528  * The required kvec buffers have to be allocated before calling this
1529  * function.
1530  */
1531 static int
_sess_auth_rawntlmssp_assemble_req(struct sess_data * sess_data)1532 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1533 {
1534 	SESSION_SETUP_ANDX *pSMB;
1535 	struct cifs_ses *ses = sess_data->ses;
1536 	struct TCP_Server_Info *server = sess_data->server;
1537 	__u32 capabilities;
1538 	char *bcc_ptr;
1539 
1540 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1541 
1542 	capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1543 	if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) {
1544 		cifs_dbg(VFS, "NTLMSSP requires Unicode support\n");
1545 		return -ENOSYS;
1546 	}
1547 
1548 	pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1549 	capabilities |= CAP_EXTENDED_SECURITY;
1550 	pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1551 
1552 	bcc_ptr = sess_data->iov[2].iov_base;
1553 	/* unicode strings must be word aligned */
1554 	if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1555 		*bcc_ptr = 0;
1556 		bcc_ptr++;
1557 	}
1558 	unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1559 
1560 	sess_data->iov[2].iov_len = (long) bcc_ptr -
1561 					(long) sess_data->iov[2].iov_base;
1562 
1563 	return 0;
1564 }
1565 
1566 static void
1567 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1568 
1569 static void
sess_auth_rawntlmssp_negotiate(struct sess_data * sess_data)1570 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1571 {
1572 	int rc;
1573 	struct smb_hdr *smb_buf;
1574 	SESSION_SETUP_ANDX *pSMB;
1575 	struct cifs_ses *ses = sess_data->ses;
1576 	struct TCP_Server_Info *server = sess_data->server;
1577 	__u16 bytes_remaining;
1578 	char *bcc_ptr;
1579 	unsigned char *ntlmsspblob = NULL;
1580 	u16 blob_len;
1581 
1582 	cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1583 
1584 	/*
1585 	 * if memory allocation is successful, caller of this function
1586 	 * frees it.
1587 	 */
1588 	ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1589 	if (!ses->ntlmssp) {
1590 		rc = -ENOMEM;
1591 		goto out;
1592 	}
1593 	ses->ntlmssp->sesskey_per_smbsess = false;
1594 
1595 	/* wct = 12 */
1596 	rc = sess_alloc_buffer(sess_data, 12);
1597 	if (rc)
1598 		goto out;
1599 
1600 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1601 
1602 	/* Build security blob before we assemble the request */
1603 	rc = build_ntlmssp_negotiate_blob(&ntlmsspblob,
1604 				     &blob_len, ses, server,
1605 				     sess_data->nls_cp);
1606 	if (rc)
1607 		goto out_free_ntlmsspblob;
1608 
1609 	sess_data->iov[1].iov_len = blob_len;
1610 	sess_data->iov[1].iov_base = ntlmsspblob;
1611 	pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1612 
1613 	rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1614 	if (rc)
1615 		goto out_free_ntlmsspblob;
1616 
1617 	rc = sess_sendreceive(sess_data);
1618 
1619 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1620 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1621 
1622 	/* If true, rc here is expected and not an error */
1623 	if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1624 	    smb_buf->Status.CifsError ==
1625 			cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1626 		rc = 0;
1627 
1628 	if (rc)
1629 		goto out_free_ntlmsspblob;
1630 
1631 	cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1632 
1633 	if (smb_buf->WordCount != 4) {
1634 		rc = -EIO;
1635 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1636 		goto out_free_ntlmsspblob;
1637 	}
1638 
1639 	ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1640 	cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1641 
1642 	bytes_remaining = get_bcc(smb_buf);
1643 	bcc_ptr = pByteArea(smb_buf);
1644 
1645 	blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1646 	if (blob_len > bytes_remaining) {
1647 		cifs_dbg(VFS, "bad security blob length %d\n",
1648 				blob_len);
1649 		rc = -EINVAL;
1650 		goto out_free_ntlmsspblob;
1651 	}
1652 
1653 	rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1654 
1655 out_free_ntlmsspblob:
1656 	kfree_sensitive(ntlmsspblob);
1657 out:
1658 	sess_free_buffer(sess_data);
1659 
1660 	if (!rc) {
1661 		sess_data->func = sess_auth_rawntlmssp_authenticate;
1662 		return;
1663 	}
1664 
1665 	/* Else error. Cleanup */
1666 	kfree_sensitive(ses->auth_key.response);
1667 	ses->auth_key.response = NULL;
1668 	kfree_sensitive(ses->ntlmssp);
1669 	ses->ntlmssp = NULL;
1670 
1671 	sess_data->func = NULL;
1672 	sess_data->result = rc;
1673 }
1674 
1675 static void
sess_auth_rawntlmssp_authenticate(struct sess_data * sess_data)1676 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1677 {
1678 	int rc;
1679 	struct smb_hdr *smb_buf;
1680 	SESSION_SETUP_ANDX *pSMB;
1681 	struct cifs_ses *ses = sess_data->ses;
1682 	struct TCP_Server_Info *server = sess_data->server;
1683 	__u16 bytes_remaining;
1684 	char *bcc_ptr;
1685 	unsigned char *ntlmsspblob = NULL;
1686 	u16 blob_len;
1687 
1688 	cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1689 
1690 	/* wct = 12 */
1691 	rc = sess_alloc_buffer(sess_data, 12);
1692 	if (rc)
1693 		goto out;
1694 
1695 	/* Build security blob before we assemble the request */
1696 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1697 	smb_buf = (struct smb_hdr *)pSMB;
1698 	rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1699 					&blob_len, ses, server,
1700 					sess_data->nls_cp);
1701 	if (rc)
1702 		goto out_free_ntlmsspblob;
1703 	sess_data->iov[1].iov_len = blob_len;
1704 	sess_data->iov[1].iov_base = ntlmsspblob;
1705 	pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1706 	/*
1707 	 * Make sure that we tell the server that we are using
1708 	 * the uid that it just gave us back on the response
1709 	 * (challenge)
1710 	 */
1711 	smb_buf->Uid = ses->Suid;
1712 
1713 	rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1714 	if (rc)
1715 		goto out_free_ntlmsspblob;
1716 
1717 	rc = sess_sendreceive(sess_data);
1718 	if (rc)
1719 		goto out_free_ntlmsspblob;
1720 
1721 	pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1722 	smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1723 	if (smb_buf->WordCount != 4) {
1724 		rc = -EIO;
1725 		cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1726 		goto out_free_ntlmsspblob;
1727 	}
1728 
1729 	if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1730 		cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1731 
1732 	if (ses->Suid != smb_buf->Uid) {
1733 		ses->Suid = smb_buf->Uid;
1734 		cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1735 	}
1736 
1737 	bytes_remaining = get_bcc(smb_buf);
1738 	bcc_ptr = pByteArea(smb_buf);
1739 	blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1740 	if (blob_len > bytes_remaining) {
1741 		cifs_dbg(VFS, "bad security blob length %d\n",
1742 				blob_len);
1743 		rc = -EINVAL;
1744 		goto out_free_ntlmsspblob;
1745 	}
1746 	bcc_ptr += blob_len;
1747 	bytes_remaining -= blob_len;
1748 
1749 
1750 	/* BB check if Unicode and decode strings */
1751 	if (bytes_remaining == 0) {
1752 		/* no string area to decode, do nothing */
1753 	} else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1754 		/* unicode string area must be word-aligned */
1755 		if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1756 			++bcc_ptr;
1757 			--bytes_remaining;
1758 		}
1759 		decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1760 				      sess_data->nls_cp);
1761 	} else {
1762 		decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1763 				    sess_data->nls_cp);
1764 	}
1765 
1766 out_free_ntlmsspblob:
1767 	kfree_sensitive(ntlmsspblob);
1768 out:
1769 	sess_free_buffer(sess_data);
1770 
1771 	if (!rc)
1772 		rc = sess_establish_session(sess_data);
1773 
1774 	/* Cleanup */
1775 	kfree_sensitive(ses->auth_key.response);
1776 	ses->auth_key.response = NULL;
1777 	kfree_sensitive(ses->ntlmssp);
1778 	ses->ntlmssp = NULL;
1779 
1780 	sess_data->func = NULL;
1781 	sess_data->result = rc;
1782 }
1783 
select_sec(struct sess_data * sess_data)1784 static int select_sec(struct sess_data *sess_data)
1785 {
1786 	int type;
1787 	struct cifs_ses *ses = sess_data->ses;
1788 	struct TCP_Server_Info *server = sess_data->server;
1789 
1790 	type = cifs_select_sectype(server, ses->sectype);
1791 	cifs_dbg(FYI, "sess setup type %d\n", type);
1792 	if (type == Unspecified) {
1793 		cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1794 		return -EINVAL;
1795 	}
1796 
1797 	switch (type) {
1798 	case NTLMv2:
1799 		sess_data->func = sess_auth_ntlmv2;
1800 		break;
1801 	case Kerberos:
1802 #ifdef CONFIG_CIFS_UPCALL
1803 		sess_data->func = sess_auth_kerberos;
1804 		break;
1805 #else
1806 		cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1807 		return -ENOSYS;
1808 #endif /* CONFIG_CIFS_UPCALL */
1809 	case RawNTLMSSP:
1810 		sess_data->func = sess_auth_rawntlmssp_negotiate;
1811 		break;
1812 	default:
1813 		cifs_dbg(VFS, "secType %d not supported!\n", type);
1814 		return -ENOSYS;
1815 	}
1816 
1817 	return 0;
1818 }
1819 
CIFS_SessSetup(const unsigned int xid,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1820 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
1821 		   struct TCP_Server_Info *server,
1822 		   const struct nls_table *nls_cp)
1823 {
1824 	int rc = 0;
1825 	struct sess_data *sess_data;
1826 
1827 	if (ses == NULL) {
1828 		WARN(1, "%s: ses == NULL!", __func__);
1829 		return -EINVAL;
1830 	}
1831 
1832 	sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
1833 	if (!sess_data)
1834 		return -ENOMEM;
1835 
1836 	sess_data->xid = xid;
1837 	sess_data->ses = ses;
1838 	sess_data->server = server;
1839 	sess_data->buf0_type = CIFS_NO_BUFFER;
1840 	sess_data->nls_cp = (struct nls_table *) nls_cp;
1841 
1842 	rc = select_sec(sess_data);
1843 	if (rc)
1844 		goto out;
1845 
1846 	while (sess_data->func)
1847 		sess_data->func(sess_data);
1848 
1849 	/* Store result before we free sess_data */
1850 	rc = sess_data->result;
1851 
1852 out:
1853 	kfree_sensitive(sess_data);
1854 	return rc;
1855 }
1856 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
1857