4 * SMB/CIFS session setup handling routines
6 * Copyright (c) International Business Machines Corp., 2006, 2009
7 * Author(s): Steve French (sfrench@us.ibm.com)
9 * This library is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU Lesser General Public License as published
11 * by the Free Software Foundation; either version 2.1 of the License, or
12 * (at your option) any later version.
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
17 * the GNU Lesser General Public License for more details.
19 * You should have received a copy of the GNU Lesser General Public License
20 * along with this library; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
26 #include "cifsproto.h"
27 #include "cifs_unicode.h"
28 #include "cifs_debug.h"
31 #include <linux/utsname.h>
32 #include <linux/slab.h>
33 #include "cifs_spnego.h"
34 #include "smb2proto.h"
35 #include "fs_context.h"
38 is_server_using_iface(struct TCP_Server_Info
*server
,
39 struct cifs_server_iface
*iface
)
41 struct sockaddr_in
*i4
= (struct sockaddr_in
*)&iface
->sockaddr
;
42 struct sockaddr_in6
*i6
= (struct sockaddr_in6
*)&iface
->sockaddr
;
43 struct sockaddr_in
*s4
= (struct sockaddr_in
*)&server
->dstaddr
;
44 struct sockaddr_in6
*s6
= (struct sockaddr_in6
*)&server
->dstaddr
;
46 if (server
->dstaddr
.ss_family
!= iface
->sockaddr
.ss_family
)
48 if (server
->dstaddr
.ss_family
== AF_INET
) {
49 if (s4
->sin_addr
.s_addr
!= i4
->sin_addr
.s_addr
)
51 } else if (server
->dstaddr
.ss_family
== AF_INET6
) {
52 if (memcmp(&s6
->sin6_addr
, &i6
->sin6_addr
,
53 sizeof(i6
->sin6_addr
)) != 0)
56 /* unknown family.. */
62 bool is_ses_using_iface(struct cifs_ses
*ses
, struct cifs_server_iface
*iface
)
66 for (i
= 0; i
< ses
->chan_count
; i
++) {
67 if (is_server_using_iface(ses
->chans
[i
].server
, iface
))
73 /* returns number of channels added */
74 int cifs_try_adding_channels(struct cifs_ses
*ses
)
76 int old_chan_count
= ses
->chan_count
;
77 int left
= ses
->chan_max
- ses
->chan_count
;
81 struct cifs_server_iface
*ifaces
= NULL
;
86 "ses already at max_channels (%zu), nothing to open\n",
91 if (ses
->server
->dialect
< SMB30_PROT_ID
) {
92 cifs_dbg(VFS
, "multichannel is not supported on this protocol version, use 3.0 or above\n");
97 * Make a copy of the iface list at the time and use that
98 * instead so as to not hold the iface spinlock for opening
101 spin_lock(&ses
->iface_lock
);
102 iface_count
= ses
->iface_count
;
103 if (iface_count
<= 0) {
104 spin_unlock(&ses
->iface_lock
);
105 cifs_dbg(VFS
, "no iface list available to open channels\n");
108 ifaces
= kmemdup(ses
->iface_list
, iface_count
*sizeof(*ifaces
),
111 spin_unlock(&ses
->iface_lock
);
114 spin_unlock(&ses
->iface_lock
);
117 * Keep connecting to same, fastest, iface for all channels as
118 * long as its RSS. Try next fastest one if not RSS or channel
122 struct cifs_server_iface
*iface
;
125 if (tries
> 3*ses
->chan_max
) {
126 cifs_dbg(FYI
, "too many channel open attempts (%d channels left to open)\n",
132 if (is_ses_using_iface(ses
, iface
) && !iface
->rss_capable
) {
133 i
= (i
+1) % iface_count
;
137 rc
= cifs_ses_add_channel(ses
, iface
);
139 cifs_dbg(FYI
, "failed to open extra channel on iface#%d rc=%d\n",
141 i
= (i
+1) % iface_count
;
145 cifs_dbg(FYI
, "successfully opened new channel on iface#%d\n",
151 return ses
->chan_count
- old_chan_count
;
155 * If server is a channel of ses, return the corresponding enclosing
156 * cifs_chan otherwise return NULL.
159 cifs_ses_find_chan(struct cifs_ses
*ses
, struct TCP_Server_Info
*server
)
163 for (i
= 0; i
< ses
->chan_count
; i
++) {
164 if (ses
->chans
[i
].server
== server
)
165 return &ses
->chans
[i
];
171 cifs_ses_add_channel(struct cifs_ses
*ses
, struct cifs_server_iface
*iface
)
173 struct cifs_chan
*chan
;
174 struct smb3_fs_context ctx
= {NULL
};
175 static const char unc_fmt
[] = "\\%s\\foo";
176 char unc
[sizeof(unc_fmt
)+SERVER_NAME_LEN_WITH_NULL
] = {0};
177 struct sockaddr_in
*ipv4
= (struct sockaddr_in
*)&iface
->sockaddr
;
178 struct sockaddr_in6
*ipv6
= (struct sockaddr_in6
*)&iface
->sockaddr
;
180 unsigned int xid
= get_xid();
182 if (iface
->sockaddr
.ss_family
== AF_INET
)
183 cifs_dbg(FYI
, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
184 ses
, iface
->speed
, iface
->rdma_capable
? "yes" : "no",
187 cifs_dbg(FYI
, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
188 ses
, iface
->speed
, iface
->rdma_capable
? "yes" : "no",
192 * Setup a ctx with mostly the same info as the existing
193 * session and overwrite it with the requested iface data.
195 * We need to setup at least the fields used for negprot and
198 * We only need the volume here, so we can reuse memory from
199 * the session and server without caring about memory
203 /* Always make new connection for now (TODO?) */
204 ctx
.nosharesock
= true;
207 ctx
.domainauto
= ses
->domainAuto
;
208 ctx
.domainname
= ses
->domainName
;
209 ctx
.username
= ses
->user_name
;
210 ctx
.password
= ses
->password
;
211 ctx
.sectype
= ses
->sectype
;
212 ctx
.sign
= ses
->sign
;
215 /* XXX: Use ses->server->hostname? */
216 sprintf(unc
, unc_fmt
, ses
->serverName
);
220 /* Reuse same version as master connection */
221 ctx
.vals
= ses
->server
->vals
;
222 ctx
.ops
= ses
->server
->ops
;
224 ctx
.noblocksnd
= ses
->server
->noblocksnd
;
225 ctx
.noautotune
= ses
->server
->noautotune
;
226 ctx
.sockopt_tcp_nodelay
= ses
->server
->tcp_nodelay
;
227 ctx
.echo_interval
= ses
->server
->echo_interval
/ HZ
;
230 * This will be used for encoding/decoding user/domain/pw
231 * during sess setup auth.
233 * XXX: We use the default for simplicity but the proper way
234 * would be to use the one that ses used, which is not
235 * stored. This might break when dealing with non-ascii
238 ctx
.local_nls
= load_nls_default();
240 /* Use RDMA if possible */
241 ctx
.rdma
= iface
->rdma_capable
;
242 memcpy(&ctx
.dstaddr
, &iface
->sockaddr
, sizeof(struct sockaddr_storage
));
244 /* reuse master con client guid */
245 memcpy(&ctx
.client_guid
, ses
->server
->client_guid
,
246 SMB2_CLIENT_GUID_SIZE
);
247 ctx
.use_client_guid
= true;
249 mutex_lock(&ses
->session_mutex
);
251 chan
= ses
->binding_chan
= &ses
->chans
[ses
->chan_count
];
252 chan
->server
= cifs_get_tcp_session(&ctx
);
253 if (IS_ERR(chan
->server
)) {
254 rc
= PTR_ERR(chan
->server
);
258 spin_lock(&cifs_tcp_ses_lock
);
259 chan
->server
->is_channel
= true;
260 spin_unlock(&cifs_tcp_ses_lock
);
263 * We need to allocate the server crypto now as we will need
264 * to sign packets before we generate the channel signing key
265 * (we sign with the session key)
267 rc
= smb311_crypto_shash_allocate(chan
->server
);
269 cifs_dbg(VFS
, "%s: crypto alloc failed\n", __func__
);
274 rc
= cifs_negotiate_protocol(xid
, ses
);
278 rc
= cifs_setup_session(xid
, ses
, ctx
.local_nls
);
282 /* success, put it on the list
283 * XXX: sharing ses between 2 tcp servers is not possible, the
284 * way "internal" linked lists works in linux makes element
285 * only able to belong to one list
287 * the binding session is already established so the rest of
288 * the code should be able to look it up, no need to add the
289 * ses to the new server.
293 atomic_set(&ses
->chan_seq
, 0);
295 ses
->binding
= false;
296 ses
->binding_chan
= NULL
;
297 mutex_unlock(&ses
->session_mutex
);
299 if (rc
&& chan
->server
)
300 cifs_put_tcp_session(chan
->server
, 0);
301 unload_nls(ctx
.local_nls
);
306 static __u32
cifs_ssetup_hdr(struct cifs_ses
*ses
, SESSION_SETUP_ANDX
*pSMB
)
308 __u32 capabilities
= 0;
310 /* init fields common to all four types of SessSetup */
311 /* Note that offsets for first seven fields in req struct are same */
312 /* in CIFS Specs so does not matter which of 3 forms of struct */
313 /* that we use in next few lines */
314 /* Note that header is initialized to zero in header_assemble */
315 pSMB
->req
.AndXCommand
= 0xFF;
316 pSMB
->req
.MaxBufferSize
= cpu_to_le16(min_t(u32
,
317 CIFSMaxBufSize
+ MAX_CIFS_HDR_SIZE
- 4,
319 pSMB
->req
.MaxMpxCount
= cpu_to_le16(ses
->server
->maxReq
);
320 pSMB
->req
.VcNumber
= cpu_to_le16(1);
322 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
324 /* BB verify whether signing required on neg or just on auth frame
327 capabilities
= CAP_LARGE_FILES
| CAP_NT_SMBS
| CAP_LEVEL_II_OPLOCKS
|
328 CAP_LARGE_WRITE_X
| CAP_LARGE_READ_X
;
330 if (ses
->server
->sign
)
331 pSMB
->req
.hdr
.Flags2
|= SMBFLG2_SECURITY_SIGNATURE
;
333 if (ses
->capabilities
& CAP_UNICODE
) {
334 pSMB
->req
.hdr
.Flags2
|= SMBFLG2_UNICODE
;
335 capabilities
|= CAP_UNICODE
;
337 if (ses
->capabilities
& CAP_STATUS32
) {
338 pSMB
->req
.hdr
.Flags2
|= SMBFLG2_ERR_STATUS
;
339 capabilities
|= CAP_STATUS32
;
341 if (ses
->capabilities
& CAP_DFS
) {
342 pSMB
->req
.hdr
.Flags2
|= SMBFLG2_DFS
;
343 capabilities
|= CAP_DFS
;
345 if (ses
->capabilities
& CAP_UNIX
)
346 capabilities
|= CAP_UNIX
;
352 unicode_oslm_strings(char **pbcc_area
, const struct nls_table
*nls_cp
)
354 char *bcc_ptr
= *pbcc_area
;
357 /* Copy OS version */
358 bytes_ret
= cifs_strtoUTF16((__le16
*)bcc_ptr
, "Linux version ", 32,
360 bcc_ptr
+= 2 * bytes_ret
;
361 bytes_ret
= cifs_strtoUTF16((__le16
*) bcc_ptr
, init_utsname()->release
,
363 bcc_ptr
+= 2 * bytes_ret
;
364 bcc_ptr
+= 2; /* trailing null */
366 bytes_ret
= cifs_strtoUTF16((__le16
*) bcc_ptr
, CIFS_NETWORK_OPSYS
,
368 bcc_ptr
+= 2 * bytes_ret
;
369 bcc_ptr
+= 2; /* trailing null */
371 *pbcc_area
= bcc_ptr
;
374 static void unicode_domain_string(char **pbcc_area
, struct cifs_ses
*ses
,
375 const struct nls_table
*nls_cp
)
377 char *bcc_ptr
= *pbcc_area
;
381 if (ses
->domainName
== NULL
) {
382 /* Sending null domain better than using a bogus domain name (as
383 we did briefly in 2.6.18) since server will use its default */
388 bytes_ret
= cifs_strtoUTF16((__le16
*) bcc_ptr
, ses
->domainName
,
389 CIFS_MAX_DOMAINNAME_LEN
, nls_cp
);
390 bcc_ptr
+= 2 * bytes_ret
;
391 bcc_ptr
+= 2; /* account for null terminator */
393 *pbcc_area
= bcc_ptr
;
397 static void unicode_ssetup_strings(char **pbcc_area
, struct cifs_ses
*ses
,
398 const struct nls_table
*nls_cp
)
400 char *bcc_ptr
= *pbcc_area
;
403 /* BB FIXME add check that strings total less
404 than 335 or will need to send them as arrays */
406 /* unicode strings, must be word aligned before the call */
407 /* if ((long) bcc_ptr % 2) {
412 if (ses
->user_name
== NULL
) {
413 /* null user mount */
417 bytes_ret
= cifs_strtoUTF16((__le16
*) bcc_ptr
, ses
->user_name
,
418 CIFS_MAX_USERNAME_LEN
, nls_cp
);
420 bcc_ptr
+= 2 * bytes_ret
;
421 bcc_ptr
+= 2; /* account for null termination */
423 unicode_domain_string(&bcc_ptr
, ses
, nls_cp
);
424 unicode_oslm_strings(&bcc_ptr
, nls_cp
);
426 *pbcc_area
= bcc_ptr
;
429 static void ascii_ssetup_strings(char **pbcc_area
, struct cifs_ses
*ses
,
430 const struct nls_table
*nls_cp
)
432 char *bcc_ptr
= *pbcc_area
;
436 /* BB what about null user mounts - check that we do this BB */
438 if (ses
->user_name
!= NULL
) {
439 len
= strscpy(bcc_ptr
, ses
->user_name
, CIFS_MAX_USERNAME_LEN
);
440 if (WARN_ON_ONCE(len
< 0))
441 len
= CIFS_MAX_USERNAME_LEN
- 1;
444 /* else null user mount */
446 bcc_ptr
++; /* account for null termination */
449 if (ses
->domainName
!= NULL
) {
450 len
= strscpy(bcc_ptr
, ses
->domainName
, CIFS_MAX_DOMAINNAME_LEN
);
451 if (WARN_ON_ONCE(len
< 0))
452 len
= CIFS_MAX_DOMAINNAME_LEN
- 1;
454 } /* else we will send a null domain name
455 so the server will default to its own domain */
459 /* BB check for overflow here */
461 strcpy(bcc_ptr
, "Linux version ");
462 bcc_ptr
+= strlen("Linux version ");
463 strcpy(bcc_ptr
, init_utsname()->release
);
464 bcc_ptr
+= strlen(init_utsname()->release
) + 1;
466 strcpy(bcc_ptr
, CIFS_NETWORK_OPSYS
);
467 bcc_ptr
+= strlen(CIFS_NETWORK_OPSYS
) + 1;
469 *pbcc_area
= bcc_ptr
;
473 decode_unicode_ssetup(char **pbcc_area
, int bleft
, struct cifs_ses
*ses
,
474 const struct nls_table
*nls_cp
)
477 char *data
= *pbcc_area
;
479 cifs_dbg(FYI
, "bleft %d\n", bleft
);
481 kfree(ses
->serverOS
);
482 ses
->serverOS
= cifs_strndup_from_utf16(data
, bleft
, true, nls_cp
);
483 cifs_dbg(FYI
, "serverOS=%s\n", ses
->serverOS
);
484 len
= (UniStrnlen((wchar_t *) data
, bleft
/ 2) * 2) + 2;
490 kfree(ses
->serverNOS
);
491 ses
->serverNOS
= cifs_strndup_from_utf16(data
, bleft
, true, nls_cp
);
492 cifs_dbg(FYI
, "serverNOS=%s\n", ses
->serverNOS
);
493 len
= (UniStrnlen((wchar_t *) data
, bleft
/ 2) * 2) + 2;
499 kfree(ses
->serverDomain
);
500 ses
->serverDomain
= cifs_strndup_from_utf16(data
, bleft
, true, nls_cp
);
501 cifs_dbg(FYI
, "serverDomain=%s\n", ses
->serverDomain
);
506 static void decode_ascii_ssetup(char **pbcc_area
, __u16 bleft
,
507 struct cifs_ses
*ses
,
508 const struct nls_table
*nls_cp
)
511 char *bcc_ptr
= *pbcc_area
;
513 cifs_dbg(FYI
, "decode sessetup ascii. bleft %d\n", bleft
);
515 len
= strnlen(bcc_ptr
, bleft
);
519 kfree(ses
->serverOS
);
521 ses
->serverOS
= kmalloc(len
+ 1, GFP_KERNEL
);
523 memcpy(ses
->serverOS
, bcc_ptr
, len
);
524 ses
->serverOS
[len
] = 0;
525 if (strncmp(ses
->serverOS
, "OS/2", 4) == 0)
526 cifs_dbg(FYI
, "OS/2 server\n");
532 len
= strnlen(bcc_ptr
, bleft
);
536 kfree(ses
->serverNOS
);
538 ses
->serverNOS
= kmalloc(len
+ 1, GFP_KERNEL
);
539 if (ses
->serverNOS
) {
540 memcpy(ses
->serverNOS
, bcc_ptr
, len
);
541 ses
->serverNOS
[len
] = 0;
547 len
= strnlen(bcc_ptr
, bleft
);
551 /* No domain field in LANMAN case. Domain is
552 returned by old servers in the SMB negprot response */
553 /* BB For newer servers which do not support Unicode,
554 but thus do return domain here we could add parsing
555 for it later, but it is not very important */
556 cifs_dbg(FYI
, "ascii: bytes left %d\n", bleft
);
559 int decode_ntlmssp_challenge(char *bcc_ptr
, int blob_len
,
560 struct cifs_ses
*ses
)
562 unsigned int tioffset
; /* challenge message target info area */
563 unsigned int tilen
; /* challenge message target info area length */
565 CHALLENGE_MESSAGE
*pblob
= (CHALLENGE_MESSAGE
*)bcc_ptr
;
567 if (blob_len
< sizeof(CHALLENGE_MESSAGE
)) {
568 cifs_dbg(VFS
, "challenge blob len %d too small\n", blob_len
);
572 if (memcmp(pblob
->Signature
, "NTLMSSP", 8)) {
573 cifs_dbg(VFS
, "blob signature incorrect %s\n",
577 if (pblob
->MessageType
!= NtLmChallenge
) {
578 cifs_dbg(VFS
, "Incorrect message type %d\n",
583 memcpy(ses
->ntlmssp
->cryptkey
, pblob
->Challenge
, CIFS_CRYPTO_KEY_SIZE
);
584 /* BB we could decode pblob->NegotiateFlags; some may be useful */
585 /* In particular we can examine sign flags */
586 /* BB spec says that if AvId field of MsvAvTimestamp is populated then
587 we must set the MIC field of the AUTHENTICATE_MESSAGE */
588 ses
->ntlmssp
->server_flags
= le32_to_cpu(pblob
->NegotiateFlags
);
589 tioffset
= le32_to_cpu(pblob
->TargetInfoArray
.BufferOffset
);
590 tilen
= le16_to_cpu(pblob
->TargetInfoArray
.Length
);
591 if (tioffset
> blob_len
|| tioffset
+ tilen
> blob_len
) {
592 cifs_dbg(VFS
, "tioffset + tilen too high %u + %u\n",
597 ses
->auth_key
.response
= kmemdup(bcc_ptr
+ tioffset
, tilen
,
599 if (!ses
->auth_key
.response
) {
600 cifs_dbg(VFS
, "Challenge target info alloc failure\n");
603 ses
->auth_key
.len
= tilen
;
609 /* BB Move to ntlmssp.c eventually */
611 /* We do not malloc the blob, it is passed in pbuffer, because
612 it is fixed size, and small, making this approach cleaner */
613 void build_ntlmssp_negotiate_blob(unsigned char *pbuffer
,
614 struct cifs_ses
*ses
)
616 struct TCP_Server_Info
*server
= cifs_ses_server(ses
);
617 NEGOTIATE_MESSAGE
*sec_blob
= (NEGOTIATE_MESSAGE
*)pbuffer
;
620 memset(pbuffer
, 0, sizeof(NEGOTIATE_MESSAGE
));
621 memcpy(sec_blob
->Signature
, NTLMSSP_SIGNATURE
, 8);
622 sec_blob
->MessageType
= NtLmNegotiate
;
624 /* BB is NTLMV2 session security format easier to use here? */
625 flags
= NTLMSSP_NEGOTIATE_56
| NTLMSSP_REQUEST_TARGET
|
626 NTLMSSP_NEGOTIATE_128
| NTLMSSP_NEGOTIATE_UNICODE
|
627 NTLMSSP_NEGOTIATE_NTLM
| NTLMSSP_NEGOTIATE_EXTENDED_SEC
|
628 NTLMSSP_NEGOTIATE_SEAL
;
630 flags
|= NTLMSSP_NEGOTIATE_SIGN
;
631 if (!server
->session_estab
|| ses
->ntlmssp
->sesskey_per_smbsess
)
632 flags
|= NTLMSSP_NEGOTIATE_KEY_XCH
;
634 sec_blob
->NegotiateFlags
= cpu_to_le32(flags
);
636 sec_blob
->WorkstationName
.BufferOffset
= 0;
637 sec_blob
->WorkstationName
.Length
= 0;
638 sec_blob
->WorkstationName
.MaximumLength
= 0;
640 /* Domain name is sent on the Challenge not Negotiate NTLMSSP request */
641 sec_blob
->DomainName
.BufferOffset
= 0;
642 sec_blob
->DomainName
.Length
= 0;
643 sec_blob
->DomainName
.MaximumLength
= 0;
646 static int size_of_ntlmssp_blob(struct cifs_ses
*ses
)
648 int sz
= sizeof(AUTHENTICATE_MESSAGE
) + ses
->auth_key
.len
649 - CIFS_SESS_KEY_SIZE
+ CIFS_CPHTXT_SIZE
+ 2;
652 sz
+= 2 * strnlen(ses
->domainName
, CIFS_MAX_DOMAINNAME_LEN
);
657 sz
+= 2 * strnlen(ses
->user_name
, CIFS_MAX_USERNAME_LEN
);
664 int build_ntlmssp_auth_blob(unsigned char **pbuffer
,
666 struct cifs_ses
*ses
,
667 const struct nls_table
*nls_cp
)
670 AUTHENTICATE_MESSAGE
*sec_blob
;
674 rc
= setup_ntlmv2_rsp(ses
, nls_cp
);
676 cifs_dbg(VFS
, "Error %d during NTLMSSP authentication\n", rc
);
678 goto setup_ntlmv2_ret
;
680 *pbuffer
= kmalloc(size_of_ntlmssp_blob(ses
), GFP_KERNEL
);
683 cifs_dbg(VFS
, "Error %d during NTLMSSP allocation\n", rc
);
685 goto setup_ntlmv2_ret
;
687 sec_blob
= (AUTHENTICATE_MESSAGE
*)*pbuffer
;
689 memcpy(sec_blob
->Signature
, NTLMSSP_SIGNATURE
, 8);
690 sec_blob
->MessageType
= NtLmAuthenticate
;
692 flags
= NTLMSSP_NEGOTIATE_56
|
693 NTLMSSP_REQUEST_TARGET
| NTLMSSP_NEGOTIATE_TARGET_INFO
|
694 NTLMSSP_NEGOTIATE_128
| NTLMSSP_NEGOTIATE_UNICODE
|
695 NTLMSSP_NEGOTIATE_NTLM
| NTLMSSP_NEGOTIATE_EXTENDED_SEC
|
696 NTLMSSP_NEGOTIATE_SEAL
;
697 if (ses
->server
->sign
)
698 flags
|= NTLMSSP_NEGOTIATE_SIGN
;
699 if (!ses
->server
->session_estab
|| ses
->ntlmssp
->sesskey_per_smbsess
)
700 flags
|= NTLMSSP_NEGOTIATE_KEY_XCH
;
702 tmp
= *pbuffer
+ sizeof(AUTHENTICATE_MESSAGE
);
703 sec_blob
->NegotiateFlags
= cpu_to_le32(flags
);
705 sec_blob
->LmChallengeResponse
.BufferOffset
=
706 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE
));
707 sec_blob
->LmChallengeResponse
.Length
= 0;
708 sec_blob
->LmChallengeResponse
.MaximumLength
= 0;
710 sec_blob
->NtChallengeResponse
.BufferOffset
=
711 cpu_to_le32(tmp
- *pbuffer
);
712 if (ses
->user_name
!= NULL
) {
713 memcpy(tmp
, ses
->auth_key
.response
+ CIFS_SESS_KEY_SIZE
,
714 ses
->auth_key
.len
- CIFS_SESS_KEY_SIZE
);
715 tmp
+= ses
->auth_key
.len
- CIFS_SESS_KEY_SIZE
;
717 sec_blob
->NtChallengeResponse
.Length
=
718 cpu_to_le16(ses
->auth_key
.len
- CIFS_SESS_KEY_SIZE
);
719 sec_blob
->NtChallengeResponse
.MaximumLength
=
720 cpu_to_le16(ses
->auth_key
.len
- CIFS_SESS_KEY_SIZE
);
723 * don't send an NT Response for anonymous access
725 sec_blob
->NtChallengeResponse
.Length
= 0;
726 sec_blob
->NtChallengeResponse
.MaximumLength
= 0;
729 if (ses
->domainName
== NULL
) {
730 sec_blob
->DomainName
.BufferOffset
= cpu_to_le32(tmp
- *pbuffer
);
731 sec_blob
->DomainName
.Length
= 0;
732 sec_blob
->DomainName
.MaximumLength
= 0;
736 len
= cifs_strtoUTF16((__le16
*)tmp
, ses
->domainName
,
737 CIFS_MAX_DOMAINNAME_LEN
, nls_cp
);
738 len
*= 2; /* unicode is 2 bytes each */
739 sec_blob
->DomainName
.BufferOffset
= cpu_to_le32(tmp
- *pbuffer
);
740 sec_blob
->DomainName
.Length
= cpu_to_le16(len
);
741 sec_blob
->DomainName
.MaximumLength
= cpu_to_le16(len
);
745 if (ses
->user_name
== NULL
) {
746 sec_blob
->UserName
.BufferOffset
= cpu_to_le32(tmp
- *pbuffer
);
747 sec_blob
->UserName
.Length
= 0;
748 sec_blob
->UserName
.MaximumLength
= 0;
752 len
= cifs_strtoUTF16((__le16
*)tmp
, ses
->user_name
,
753 CIFS_MAX_USERNAME_LEN
, nls_cp
);
754 len
*= 2; /* unicode is 2 bytes each */
755 sec_blob
->UserName
.BufferOffset
= cpu_to_le32(tmp
- *pbuffer
);
756 sec_blob
->UserName
.Length
= cpu_to_le16(len
);
757 sec_blob
->UserName
.MaximumLength
= cpu_to_le16(len
);
761 sec_blob
->WorkstationName
.BufferOffset
= cpu_to_le32(tmp
- *pbuffer
);
762 sec_blob
->WorkstationName
.Length
= 0;
763 sec_blob
->WorkstationName
.MaximumLength
= 0;
766 if (((ses
->ntlmssp
->server_flags
& NTLMSSP_NEGOTIATE_KEY_XCH
) ||
767 (ses
->ntlmssp
->server_flags
& NTLMSSP_NEGOTIATE_EXTENDED_SEC
))
768 && !calc_seckey(ses
)) {
769 memcpy(tmp
, ses
->ntlmssp
->ciphertext
, CIFS_CPHTXT_SIZE
);
770 sec_blob
->SessionKey
.BufferOffset
= cpu_to_le32(tmp
- *pbuffer
);
771 sec_blob
->SessionKey
.Length
= cpu_to_le16(CIFS_CPHTXT_SIZE
);
772 sec_blob
->SessionKey
.MaximumLength
=
773 cpu_to_le16(CIFS_CPHTXT_SIZE
);
774 tmp
+= CIFS_CPHTXT_SIZE
;
776 sec_blob
->SessionKey
.BufferOffset
= cpu_to_le32(tmp
- *pbuffer
);
777 sec_blob
->SessionKey
.Length
= 0;
778 sec_blob
->SessionKey
.MaximumLength
= 0;
781 *buflen
= tmp
- *pbuffer
;
787 cifs_select_sectype(struct TCP_Server_Info
*server
, enum securityEnum requested
)
789 switch (server
->negflavor
) {
790 case CIFS_NEGFLAVOR_EXTENDED
:
796 if (server
->sec_ntlmssp
&&
797 (global_secflags
& CIFSSEC_MAY_NTLMSSP
))
799 if ((server
->sec_kerberos
|| server
->sec_mskerberos
) &&
800 (global_secflags
& CIFSSEC_MAY_KRB5
))
806 case CIFS_NEGFLAVOR_UNENCAP
:
812 if (global_secflags
& CIFSSEC_MAY_NTLMV2
)
814 if (global_secflags
& CIFSSEC_MAY_NTLM
)
820 fallthrough
; /* to attempt LANMAN authentication next */
821 case CIFS_NEGFLAVOR_LANMAN
:
826 if (global_secflags
& CIFSSEC_MAY_LANMAN
)
839 struct cifs_ses
*ses
;
840 struct nls_table
*nls_cp
;
841 void (*func
)(struct sess_data
*);
844 /* we will send the SMB in three pieces:
845 * a fixed length beginning part, an optional
846 * SPNEGO blob (which can be zero length), and a
847 * last part which will include the strings
848 * and rest of bcc area. This allows us to avoid
849 * a large buffer 17K allocation
856 sess_alloc_buffer(struct sess_data
*sess_data
, int wct
)
859 struct cifs_ses
*ses
= sess_data
->ses
;
860 struct smb_hdr
*smb_buf
;
862 rc
= small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX
, wct
, ses
,
868 sess_data
->iov
[0].iov_base
= (char *)smb_buf
;
869 sess_data
->iov
[0].iov_len
= be32_to_cpu(smb_buf
->smb_buf_length
) + 4;
871 * This variable will be used to clear the buffer
872 * allocated above in case of any error in the calling function.
874 sess_data
->buf0_type
= CIFS_SMALL_BUFFER
;
876 /* 2000 big enough to fit max user, domain, NOS name etc. */
877 sess_data
->iov
[2].iov_base
= kmalloc(2000, GFP_KERNEL
);
878 if (!sess_data
->iov
[2].iov_base
) {
880 goto out_free_smb_buf
;
887 sess_data
->iov
[0].iov_base
= NULL
;
888 sess_data
->iov
[0].iov_len
= 0;
889 sess_data
->buf0_type
= CIFS_NO_BUFFER
;
894 sess_free_buffer(struct sess_data
*sess_data
)
897 free_rsp_buf(sess_data
->buf0_type
, sess_data
->iov
[0].iov_base
);
898 sess_data
->buf0_type
= CIFS_NO_BUFFER
;
899 kfree(sess_data
->iov
[2].iov_base
);
903 sess_establish_session(struct sess_data
*sess_data
)
905 struct cifs_ses
*ses
= sess_data
->ses
;
907 mutex_lock(&ses
->server
->srv_mutex
);
908 if (!ses
->server
->session_estab
) {
909 if (ses
->server
->sign
) {
910 ses
->server
->session_key
.response
=
911 kmemdup(ses
->auth_key
.response
,
912 ses
->auth_key
.len
, GFP_KERNEL
);
913 if (!ses
->server
->session_key
.response
) {
914 mutex_unlock(&ses
->server
->srv_mutex
);
917 ses
->server
->session_key
.len
=
920 ses
->server
->sequence_number
= 0x2;
921 ses
->server
->session_estab
= true;
923 mutex_unlock(&ses
->server
->srv_mutex
);
925 cifs_dbg(FYI
, "CIFS session established successfully\n");
926 spin_lock(&GlobalMid_Lock
);
927 ses
->status
= CifsGood
;
928 ses
->need_reconnect
= false;
929 spin_unlock(&GlobalMid_Lock
);
935 sess_sendreceive(struct sess_data
*sess_data
)
938 struct smb_hdr
*smb_buf
= (struct smb_hdr
*) sess_data
->iov
[0].iov_base
;
940 struct kvec rsp_iov
= { NULL
, 0 };
942 count
= sess_data
->iov
[1].iov_len
+ sess_data
->iov
[2].iov_len
;
943 be32_add_cpu(&smb_buf
->smb_buf_length
, count
);
944 put_bcc(count
, smb_buf
);
946 rc
= SendReceive2(sess_data
->xid
, sess_data
->ses
,
947 sess_data
->iov
, 3 /* num_iovecs */,
948 &sess_data
->buf0_type
,
949 CIFS_LOG_ERROR
, &rsp_iov
);
950 cifs_small_buf_release(sess_data
->iov
[0].iov_base
);
951 memcpy(&sess_data
->iov
[0], &rsp_iov
, sizeof(struct kvec
));
957 * LANMAN and plaintext are less secure and off by default.
958 * So we make this explicitly be turned on in kconfig (in the
959 * build) and turned on at runtime (changed from the default)
960 * in proc/fs/cifs or via mount parm. Unfortunately this is
961 * needed for old Win (e.g. Win95), some obscure NAS and OS/2
963 #ifdef CONFIG_CIFS_WEAK_PW_HASH
965 sess_auth_lanman(struct sess_data
*sess_data
)
968 struct smb_hdr
*smb_buf
;
969 SESSION_SETUP_ANDX
*pSMB
;
971 struct cifs_ses
*ses
= sess_data
->ses
;
972 char lnm_session_key
[CIFS_AUTH_RESP_SIZE
];
973 __u16 bytes_remaining
;
975 /* lanman 2 style sessionsetup */
977 rc
= sess_alloc_buffer(sess_data
, 10);
981 pSMB
= (SESSION_SETUP_ANDX
*)sess_data
->iov
[0].iov_base
;
982 bcc_ptr
= sess_data
->iov
[2].iov_base
;
983 (void)cifs_ssetup_hdr(ses
, pSMB
);
985 pSMB
->req
.hdr
.Flags2
&= ~SMBFLG2_UNICODE
;
987 if (ses
->user_name
!= NULL
) {
988 /* no capabilities flags in old lanman negotiation */
989 pSMB
->old_req
.PasswordLength
= cpu_to_le16(CIFS_AUTH_RESP_SIZE
);
991 /* Calculate hash with password and copy into bcc_ptr.
992 * Encryption Key (stored as in cryptkey) gets used if the
993 * security mode bit in Negotiate Protocol response states
994 * to use challenge/response method (i.e. Password bit is 1).
996 rc
= calc_lanman_hash(ses
->password
, ses
->server
->cryptkey
,
997 ses
->server
->sec_mode
& SECMODE_PW_ENCRYPT
?
998 true : false, lnm_session_key
);
1002 memcpy(bcc_ptr
, (char *)lnm_session_key
, CIFS_AUTH_RESP_SIZE
);
1003 bcc_ptr
+= CIFS_AUTH_RESP_SIZE
;
1005 pSMB
->old_req
.PasswordLength
= 0;
1009 * can not sign if LANMAN negotiated so no need
1010 * to calculate signing key? but what if server
1011 * changed to do higher than lanman dialect and
1012 * we reconnected would we ever calc signing_key?
1015 cifs_dbg(FYI
, "Negotiating LANMAN setting up strings\n");
1016 /* Unicode not allowed for LANMAN dialects */
1017 ascii_ssetup_strings(&bcc_ptr
, ses
, sess_data
->nls_cp
);
1019 sess_data
->iov
[2].iov_len
= (long) bcc_ptr
-
1020 (long) sess_data
->iov
[2].iov_base
;
1022 rc
= sess_sendreceive(sess_data
);
1026 pSMB
= (SESSION_SETUP_ANDX
*)sess_data
->iov
[0].iov_base
;
1027 smb_buf
= (struct smb_hdr
*)sess_data
->iov
[0].iov_base
;
1029 /* lanman response has a word count of 3 */
1030 if (smb_buf
->WordCount
!= 3) {
1032 cifs_dbg(VFS
, "bad word count %d\n", smb_buf
->WordCount
);
1036 if (le16_to_cpu(pSMB
->resp
.Action
) & GUEST_LOGIN
)
1037 cifs_dbg(FYI
, "Guest login\n"); /* BB mark SesInfo struct? */
1039 ses
->Suid
= smb_buf
->Uid
; /* UID left in wire format (le) */
1040 cifs_dbg(FYI
, "UID = %llu\n", ses
->Suid
);
1042 bytes_remaining
= get_bcc(smb_buf
);
1043 bcc_ptr
= pByteArea(smb_buf
);
1045 /* BB check if Unicode and decode strings */
1046 if (bytes_remaining
== 0) {
1047 /* no string area to decode, do nothing */
1048 } else if (smb_buf
->Flags2
& SMBFLG2_UNICODE
) {
1049 /* unicode string area must be word-aligned */
1050 if (((unsigned long) bcc_ptr
- (unsigned long) smb_buf
) % 2) {
1054 decode_unicode_ssetup(&bcc_ptr
, bytes_remaining
, ses
,
1057 decode_ascii_ssetup(&bcc_ptr
, bytes_remaining
, ses
,
1061 rc
= sess_establish_session(sess_data
);
1063 sess_data
->result
= rc
;
1064 sess_data
->func
= NULL
;
1065 sess_free_buffer(sess_data
);
1071 sess_auth_ntlm(struct sess_data
*sess_data
)
1074 struct smb_hdr
*smb_buf
;
1075 SESSION_SETUP_ANDX
*pSMB
;
1077 struct cifs_ses
*ses
= sess_data
->ses
;
1079 __u16 bytes_remaining
;
1081 /* old style NTLM sessionsetup */
1083 rc
= sess_alloc_buffer(sess_data
, 13);
1087 pSMB
= (SESSION_SETUP_ANDX
*)sess_data
->iov
[0].iov_base
;
1088 bcc_ptr
= sess_data
->iov
[2].iov_base
;
1089 capabilities
= cifs_ssetup_hdr(ses
, pSMB
);
1091 pSMB
->req_no_secext
.Capabilities
= cpu_to_le32(capabilities
);
1092 if (ses
->user_name
!= NULL
) {
1093 pSMB
->req_no_secext
.CaseInsensitivePasswordLength
=
1094 cpu_to_le16(CIFS_AUTH_RESP_SIZE
);
1095 pSMB
->req_no_secext
.CaseSensitivePasswordLength
=
1096 cpu_to_le16(CIFS_AUTH_RESP_SIZE
);
1098 /* calculate ntlm response and session key */
1099 rc
= setup_ntlm_response(ses
, sess_data
->nls_cp
);
1101 cifs_dbg(VFS
, "Error %d during NTLM authentication\n",
1106 /* copy ntlm response */
1107 memcpy(bcc_ptr
, ses
->auth_key
.response
+ CIFS_SESS_KEY_SIZE
,
1108 CIFS_AUTH_RESP_SIZE
);
1109 bcc_ptr
+= CIFS_AUTH_RESP_SIZE
;
1110 memcpy(bcc_ptr
, ses
->auth_key
.response
+ CIFS_SESS_KEY_SIZE
,
1111 CIFS_AUTH_RESP_SIZE
);
1112 bcc_ptr
+= CIFS_AUTH_RESP_SIZE
;
1114 pSMB
->req_no_secext
.CaseInsensitivePasswordLength
= 0;
1115 pSMB
->req_no_secext
.CaseSensitivePasswordLength
= 0;
1118 if (ses
->capabilities
& CAP_UNICODE
) {
1119 /* unicode strings must be word aligned */
1120 if (sess_data
->iov
[0].iov_len
% 2) {
1124 unicode_ssetup_strings(&bcc_ptr
, ses
, sess_data
->nls_cp
);
1126 ascii_ssetup_strings(&bcc_ptr
, ses
, sess_data
->nls_cp
);
1130 sess_data
->iov
[2].iov_len
= (long) bcc_ptr
-
1131 (long) sess_data
->iov
[2].iov_base
;
1133 rc
= sess_sendreceive(sess_data
);
1137 pSMB
= (SESSION_SETUP_ANDX
*)sess_data
->iov
[0].iov_base
;
1138 smb_buf
= (struct smb_hdr
*)sess_data
->iov
[0].iov_base
;
1140 if (smb_buf
->WordCount
!= 3) {
1142 cifs_dbg(VFS
, "bad word count %d\n", smb_buf
->WordCount
);
1146 if (le16_to_cpu(pSMB
->resp
.Action
) & GUEST_LOGIN
)
1147 cifs_dbg(FYI
, "Guest login\n"); /* BB mark SesInfo struct? */
1149 ses
->Suid
= smb_buf
->Uid
; /* UID left in wire format (le) */
1150 cifs_dbg(FYI
, "UID = %llu\n", ses
->Suid
);
1152 bytes_remaining
= get_bcc(smb_buf
);
1153 bcc_ptr
= pByteArea(smb_buf
);
1155 /* BB check if Unicode and decode strings */
1156 if (bytes_remaining
== 0) {
1157 /* no string area to decode, do nothing */
1158 } else if (smb_buf
->Flags2
& SMBFLG2_UNICODE
) {
1159 /* unicode string area must be word-aligned */
1160 if (((unsigned long) bcc_ptr
- (unsigned long) smb_buf
) % 2) {
1164 decode_unicode_ssetup(&bcc_ptr
, bytes_remaining
, ses
,
1167 decode_ascii_ssetup(&bcc_ptr
, bytes_remaining
, ses
,
1171 rc
= sess_establish_session(sess_data
);
1173 sess_data
->result
= rc
;
1174 sess_data
->func
= NULL
;
1175 sess_free_buffer(sess_data
);
1176 kfree(ses
->auth_key
.response
);
1177 ses
->auth_key
.response
= NULL
;
1181 sess_auth_ntlmv2(struct sess_data
*sess_data
)
1184 struct smb_hdr
*smb_buf
;
1185 SESSION_SETUP_ANDX
*pSMB
;
1187 struct cifs_ses
*ses
= sess_data
->ses
;
1189 __u16 bytes_remaining
;
1191 /* old style NTLM sessionsetup */
1193 rc
= sess_alloc_buffer(sess_data
, 13);
1197 pSMB
= (SESSION_SETUP_ANDX
*)sess_data
->iov
[0].iov_base
;
1198 bcc_ptr
= sess_data
->iov
[2].iov_base
;
1199 capabilities
= cifs_ssetup_hdr(ses
, pSMB
);
1201 pSMB
->req_no_secext
.Capabilities
= cpu_to_le32(capabilities
);
1203 /* LM2 password would be here if we supported it */
1204 pSMB
->req_no_secext
.CaseInsensitivePasswordLength
= 0;
1206 if (ses
->user_name
!= NULL
) {
1207 /* calculate nlmv2 response and session key */
1208 rc
= setup_ntlmv2_rsp(ses
, sess_data
->nls_cp
);
1210 cifs_dbg(VFS
, "Error %d during NTLMv2 authentication\n", rc
);
1214 memcpy(bcc_ptr
, ses
->auth_key
.response
+ CIFS_SESS_KEY_SIZE
,
1215 ses
->auth_key
.len
- CIFS_SESS_KEY_SIZE
);
1216 bcc_ptr
+= ses
->auth_key
.len
- CIFS_SESS_KEY_SIZE
;
1218 /* set case sensitive password length after tilen may get
1219 * assigned, tilen is 0 otherwise.
1221 pSMB
->req_no_secext
.CaseSensitivePasswordLength
=
1222 cpu_to_le16(ses
->auth_key
.len
- CIFS_SESS_KEY_SIZE
);
1224 pSMB
->req_no_secext
.CaseSensitivePasswordLength
= 0;
1227 if (ses
->capabilities
& CAP_UNICODE
) {
1228 if (sess_data
->iov
[0].iov_len
% 2) {
1232 unicode_ssetup_strings(&bcc_ptr
, ses
, sess_data
->nls_cp
);
1234 ascii_ssetup_strings(&bcc_ptr
, ses
, sess_data
->nls_cp
);
1238 sess_data
->iov
[2].iov_len
= (long) bcc_ptr
-
1239 (long) sess_data
->iov
[2].iov_base
;
1241 rc
= sess_sendreceive(sess_data
);
1245 pSMB
= (SESSION_SETUP_ANDX
*)sess_data
->iov
[0].iov_base
;
1246 smb_buf
= (struct smb_hdr
*)sess_data
->iov
[0].iov_base
;
1248 if (smb_buf
->WordCount
!= 3) {
1250 cifs_dbg(VFS
, "bad word count %d\n", smb_buf
->WordCount
);
1254 if (le16_to_cpu(pSMB
->resp
.Action
) & GUEST_LOGIN
)
1255 cifs_dbg(FYI
, "Guest login\n"); /* BB mark SesInfo struct? */
1257 ses
->Suid
= smb_buf
->Uid
; /* UID left in wire format (le) */
1258 cifs_dbg(FYI
, "UID = %llu\n", ses
->Suid
);
1260 bytes_remaining
= get_bcc(smb_buf
);
1261 bcc_ptr
= pByteArea(smb_buf
);
1263 /* BB check if Unicode and decode strings */
1264 if (bytes_remaining
== 0) {
1265 /* no string area to decode, do nothing */
1266 } else if (smb_buf
->Flags2
& SMBFLG2_UNICODE
) {
1267 /* unicode string area must be word-aligned */
1268 if (((unsigned long) bcc_ptr
- (unsigned long) smb_buf
) % 2) {
1272 decode_unicode_ssetup(&bcc_ptr
, bytes_remaining
, ses
,
1275 decode_ascii_ssetup(&bcc_ptr
, bytes_remaining
, ses
,
1279 rc
= sess_establish_session(sess_data
);
1281 sess_data
->result
= rc
;
1282 sess_data
->func
= NULL
;
1283 sess_free_buffer(sess_data
);
1284 kfree(ses
->auth_key
.response
);
1285 ses
->auth_key
.response
= NULL
;
1288 #ifdef CONFIG_CIFS_UPCALL
1290 sess_auth_kerberos(struct sess_data
*sess_data
)
1293 struct smb_hdr
*smb_buf
;
1294 SESSION_SETUP_ANDX
*pSMB
;
1296 struct cifs_ses
*ses
= sess_data
->ses
;
1298 __u16 bytes_remaining
;
1299 struct key
*spnego_key
= NULL
;
1300 struct cifs_spnego_msg
*msg
;
1303 /* extended security */
1305 rc
= sess_alloc_buffer(sess_data
, 12);
1309 pSMB
= (SESSION_SETUP_ANDX
*)sess_data
->iov
[0].iov_base
;
1310 bcc_ptr
= sess_data
->iov
[2].iov_base
;
1311 capabilities
= cifs_ssetup_hdr(ses
, pSMB
);
1313 spnego_key
= cifs_get_spnego_key(ses
);
1314 if (IS_ERR(spnego_key
)) {
1315 rc
= PTR_ERR(spnego_key
);
1320 msg
= spnego_key
->payload
.data
[0];
1322 * check version field to make sure that cifs.upcall is
1323 * sending us a response in an expected form
1325 if (msg
->version
!= CIFS_SPNEGO_UPCALL_VERSION
) {
1326 cifs_dbg(VFS
, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1327 CIFS_SPNEGO_UPCALL_VERSION
, msg
->version
);
1329 goto out_put_spnego_key
;
1332 ses
->auth_key
.response
= kmemdup(msg
->data
, msg
->sesskey_len
,
1334 if (!ses
->auth_key
.response
) {
1335 cifs_dbg(VFS
, "Kerberos can't allocate (%u bytes) memory\n",
1338 goto out_put_spnego_key
;
1340 ses
->auth_key
.len
= msg
->sesskey_len
;
1342 pSMB
->req
.hdr
.Flags2
|= SMBFLG2_EXT_SEC
;
1343 capabilities
|= CAP_EXTENDED_SECURITY
;
1344 pSMB
->req
.Capabilities
= cpu_to_le32(capabilities
);
1345 sess_data
->iov
[1].iov_base
= msg
->data
+ msg
->sesskey_len
;
1346 sess_data
->iov
[1].iov_len
= msg
->secblob_len
;
1347 pSMB
->req
.SecurityBlobLength
= cpu_to_le16(sess_data
->iov
[1].iov_len
);
1349 if (ses
->capabilities
& CAP_UNICODE
) {
1350 /* unicode strings must be word aligned */
1351 if ((sess_data
->iov
[0].iov_len
1352 + sess_data
->iov
[1].iov_len
) % 2) {
1356 unicode_oslm_strings(&bcc_ptr
, sess_data
->nls_cp
);
1357 unicode_domain_string(&bcc_ptr
, ses
, sess_data
->nls_cp
);
1359 /* BB: is this right? */
1360 ascii_ssetup_strings(&bcc_ptr
, ses
, sess_data
->nls_cp
);
1363 sess_data
->iov
[2].iov_len
= (long) bcc_ptr
-
1364 (long) sess_data
->iov
[2].iov_base
;
1366 rc
= sess_sendreceive(sess_data
);
1368 goto out_put_spnego_key
;
1370 pSMB
= (SESSION_SETUP_ANDX
*)sess_data
->iov
[0].iov_base
;
1371 smb_buf
= (struct smb_hdr
*)sess_data
->iov
[0].iov_base
;
1373 if (smb_buf
->WordCount
!= 4) {
1375 cifs_dbg(VFS
, "bad word count %d\n", smb_buf
->WordCount
);
1376 goto out_put_spnego_key
;
1379 if (le16_to_cpu(pSMB
->resp
.Action
) & GUEST_LOGIN
)
1380 cifs_dbg(FYI
, "Guest login\n"); /* BB mark SesInfo struct? */
1382 ses
->Suid
= smb_buf
->Uid
; /* UID left in wire format (le) */
1383 cifs_dbg(FYI
, "UID = %llu\n", ses
->Suid
);
1385 bytes_remaining
= get_bcc(smb_buf
);
1386 bcc_ptr
= pByteArea(smb_buf
);
1388 blob_len
= le16_to_cpu(pSMB
->resp
.SecurityBlobLength
);
1389 if (blob_len
> bytes_remaining
) {
1390 cifs_dbg(VFS
, "bad security blob length %d\n",
1393 goto out_put_spnego_key
;
1395 bcc_ptr
+= blob_len
;
1396 bytes_remaining
-= blob_len
;
1398 /* BB check if Unicode and decode strings */
1399 if (bytes_remaining
== 0) {
1400 /* no string area to decode, do nothing */
1401 } else if (smb_buf
->Flags2
& SMBFLG2_UNICODE
) {
1402 /* unicode string area must be word-aligned */
1403 if (((unsigned long) bcc_ptr
- (unsigned long) smb_buf
) % 2) {
1407 decode_unicode_ssetup(&bcc_ptr
, bytes_remaining
, ses
,
1410 decode_ascii_ssetup(&bcc_ptr
, bytes_remaining
, ses
,
1414 rc
= sess_establish_session(sess_data
);
1416 key_invalidate(spnego_key
);
1417 key_put(spnego_key
);
1419 sess_data
->result
= rc
;
1420 sess_data
->func
= NULL
;
1421 sess_free_buffer(sess_data
);
1422 kfree(ses
->auth_key
.response
);
1423 ses
->auth_key
.response
= NULL
;
1426 #endif /* ! CONFIG_CIFS_UPCALL */
1429 * The required kvec buffers have to be allocated before calling this
1433 _sess_auth_rawntlmssp_assemble_req(struct sess_data
*sess_data
)
1435 SESSION_SETUP_ANDX
*pSMB
;
1436 struct cifs_ses
*ses
= sess_data
->ses
;
1440 pSMB
= (SESSION_SETUP_ANDX
*)sess_data
->iov
[0].iov_base
;
1442 capabilities
= cifs_ssetup_hdr(ses
, pSMB
);
1443 if ((pSMB
->req
.hdr
.Flags2
& SMBFLG2_UNICODE
) == 0) {
1444 cifs_dbg(VFS
, "NTLMSSP requires Unicode support\n");
1448 pSMB
->req
.hdr
.Flags2
|= SMBFLG2_EXT_SEC
;
1449 capabilities
|= CAP_EXTENDED_SECURITY
;
1450 pSMB
->req
.Capabilities
|= cpu_to_le32(capabilities
);
1452 bcc_ptr
= sess_data
->iov
[2].iov_base
;
1453 /* unicode strings must be word aligned */
1454 if ((sess_data
->iov
[0].iov_len
+ sess_data
->iov
[1].iov_len
) % 2) {
1458 unicode_oslm_strings(&bcc_ptr
, sess_data
->nls_cp
);
1460 sess_data
->iov
[2].iov_len
= (long) bcc_ptr
-
1461 (long) sess_data
->iov
[2].iov_base
;
1467 sess_auth_rawntlmssp_authenticate(struct sess_data
*sess_data
);
1470 sess_auth_rawntlmssp_negotiate(struct sess_data
*sess_data
)
1473 struct smb_hdr
*smb_buf
;
1474 SESSION_SETUP_ANDX
*pSMB
;
1475 struct cifs_ses
*ses
= sess_data
->ses
;
1476 __u16 bytes_remaining
;
1480 cifs_dbg(FYI
, "rawntlmssp session setup negotiate phase\n");
1483 * if memory allocation is successful, caller of this function
1486 ses
->ntlmssp
= kmalloc(sizeof(struct ntlmssp_auth
), GFP_KERNEL
);
1487 if (!ses
->ntlmssp
) {
1491 ses
->ntlmssp
->sesskey_per_smbsess
= false;
1494 rc
= sess_alloc_buffer(sess_data
, 12);
1498 pSMB
= (SESSION_SETUP_ANDX
*)sess_data
->iov
[0].iov_base
;
1500 /* Build security blob before we assemble the request */
1501 build_ntlmssp_negotiate_blob(pSMB
->req
.SecurityBlob
, ses
);
1502 sess_data
->iov
[1].iov_len
= sizeof(NEGOTIATE_MESSAGE
);
1503 sess_data
->iov
[1].iov_base
= pSMB
->req
.SecurityBlob
;
1504 pSMB
->req
.SecurityBlobLength
= cpu_to_le16(sizeof(NEGOTIATE_MESSAGE
));
1506 rc
= _sess_auth_rawntlmssp_assemble_req(sess_data
);
1510 rc
= sess_sendreceive(sess_data
);
1512 pSMB
= (SESSION_SETUP_ANDX
*)sess_data
->iov
[0].iov_base
;
1513 smb_buf
= (struct smb_hdr
*)sess_data
->iov
[0].iov_base
;
1515 /* If true, rc here is expected and not an error */
1516 if (sess_data
->buf0_type
!= CIFS_NO_BUFFER
&&
1517 smb_buf
->Status
.CifsError
==
1518 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED
))
1524 cifs_dbg(FYI
, "rawntlmssp session setup challenge phase\n");
1526 if (smb_buf
->WordCount
!= 4) {
1528 cifs_dbg(VFS
, "bad word count %d\n", smb_buf
->WordCount
);
1532 ses
->Suid
= smb_buf
->Uid
; /* UID left in wire format (le) */
1533 cifs_dbg(FYI
, "UID = %llu\n", ses
->Suid
);
1535 bytes_remaining
= get_bcc(smb_buf
);
1536 bcc_ptr
= pByteArea(smb_buf
);
1538 blob_len
= le16_to_cpu(pSMB
->resp
.SecurityBlobLength
);
1539 if (blob_len
> bytes_remaining
) {
1540 cifs_dbg(VFS
, "bad security blob length %d\n",
1546 rc
= decode_ntlmssp_challenge(bcc_ptr
, blob_len
, ses
);
1548 sess_free_buffer(sess_data
);
1551 sess_data
->func
= sess_auth_rawntlmssp_authenticate
;
1555 /* Else error. Cleanup */
1556 kfree(ses
->auth_key
.response
);
1557 ses
->auth_key
.response
= NULL
;
1558 kfree(ses
->ntlmssp
);
1559 ses
->ntlmssp
= NULL
;
1561 sess_data
->func
= NULL
;
1562 sess_data
->result
= rc
;
1566 sess_auth_rawntlmssp_authenticate(struct sess_data
*sess_data
)
1569 struct smb_hdr
*smb_buf
;
1570 SESSION_SETUP_ANDX
*pSMB
;
1571 struct cifs_ses
*ses
= sess_data
->ses
;
1572 __u16 bytes_remaining
;
1574 unsigned char *ntlmsspblob
= NULL
;
1577 cifs_dbg(FYI
, "rawntlmssp session setup authenticate phase\n");
1580 rc
= sess_alloc_buffer(sess_data
, 12);
1584 /* Build security blob before we assemble the request */
1585 pSMB
= (SESSION_SETUP_ANDX
*)sess_data
->iov
[0].iov_base
;
1586 smb_buf
= (struct smb_hdr
*)pSMB
;
1587 rc
= build_ntlmssp_auth_blob(&ntlmsspblob
,
1588 &blob_len
, ses
, sess_data
->nls_cp
);
1590 goto out_free_ntlmsspblob
;
1591 sess_data
->iov
[1].iov_len
= blob_len
;
1592 sess_data
->iov
[1].iov_base
= ntlmsspblob
;
1593 pSMB
->req
.SecurityBlobLength
= cpu_to_le16(blob_len
);
1595 * Make sure that we tell the server that we are using
1596 * the uid that it just gave us back on the response
1599 smb_buf
->Uid
= ses
->Suid
;
1601 rc
= _sess_auth_rawntlmssp_assemble_req(sess_data
);
1603 goto out_free_ntlmsspblob
;
1605 rc
= sess_sendreceive(sess_data
);
1607 goto out_free_ntlmsspblob
;
1609 pSMB
= (SESSION_SETUP_ANDX
*)sess_data
->iov
[0].iov_base
;
1610 smb_buf
= (struct smb_hdr
*)sess_data
->iov
[0].iov_base
;
1611 if (smb_buf
->WordCount
!= 4) {
1613 cifs_dbg(VFS
, "bad word count %d\n", smb_buf
->WordCount
);
1614 goto out_free_ntlmsspblob
;
1617 if (le16_to_cpu(pSMB
->resp
.Action
) & GUEST_LOGIN
)
1618 cifs_dbg(FYI
, "Guest login\n"); /* BB mark SesInfo struct? */
1620 if (ses
->Suid
!= smb_buf
->Uid
) {
1621 ses
->Suid
= smb_buf
->Uid
;
1622 cifs_dbg(FYI
, "UID changed! new UID = %llu\n", ses
->Suid
);
1625 bytes_remaining
= get_bcc(smb_buf
);
1626 bcc_ptr
= pByteArea(smb_buf
);
1627 blob_len
= le16_to_cpu(pSMB
->resp
.SecurityBlobLength
);
1628 if (blob_len
> bytes_remaining
) {
1629 cifs_dbg(VFS
, "bad security blob length %d\n",
1632 goto out_free_ntlmsspblob
;
1634 bcc_ptr
+= blob_len
;
1635 bytes_remaining
-= blob_len
;
1638 /* BB check if Unicode and decode strings */
1639 if (bytes_remaining
== 0) {
1640 /* no string area to decode, do nothing */
1641 } else if (smb_buf
->Flags2
& SMBFLG2_UNICODE
) {
1642 /* unicode string area must be word-aligned */
1643 if (((unsigned long) bcc_ptr
- (unsigned long) smb_buf
) % 2) {
1647 decode_unicode_ssetup(&bcc_ptr
, bytes_remaining
, ses
,
1650 decode_ascii_ssetup(&bcc_ptr
, bytes_remaining
, ses
,
1654 out_free_ntlmsspblob
:
1657 sess_free_buffer(sess_data
);
1660 rc
= sess_establish_session(sess_data
);
1663 kfree(ses
->auth_key
.response
);
1664 ses
->auth_key
.response
= NULL
;
1665 kfree(ses
->ntlmssp
);
1666 ses
->ntlmssp
= NULL
;
1668 sess_data
->func
= NULL
;
1669 sess_data
->result
= rc
;
1672 static int select_sec(struct cifs_ses
*ses
, struct sess_data
*sess_data
)
1676 type
= cifs_select_sectype(ses
->server
, ses
->sectype
);
1677 cifs_dbg(FYI
, "sess setup type %d\n", type
);
1678 if (type
== Unspecified
) {
1679 cifs_dbg(VFS
, "Unable to select appropriate authentication method!\n");
1685 /* LANMAN and plaintext are less secure and off by default.
1686 * So we make this explicitly be turned on in kconfig (in the
1687 * build) and turned on at runtime (changed from the default)
1688 * in proc/fs/cifs or via mount parm. Unfortunately this is
1689 * needed for old Win (e.g. Win95), some obscure NAS and OS/2 */
1690 #ifdef CONFIG_CIFS_WEAK_PW_HASH
1691 sess_data
->func
= sess_auth_lanman
;
1697 sess_data
->func
= sess_auth_ntlm
;
1700 sess_data
->func
= sess_auth_ntlmv2
;
1703 #ifdef CONFIG_CIFS_UPCALL
1704 sess_data
->func
= sess_auth_kerberos
;
1707 cifs_dbg(VFS
, "Kerberos negotiated but upcall support disabled!\n");
1709 #endif /* CONFIG_CIFS_UPCALL */
1711 sess_data
->func
= sess_auth_rawntlmssp_negotiate
;
1714 cifs_dbg(VFS
, "secType %d not supported!\n", type
);
1721 int CIFS_SessSetup(const unsigned int xid
, struct cifs_ses
*ses
,
1722 const struct nls_table
*nls_cp
)
1725 struct sess_data
*sess_data
;
1728 WARN(1, "%s: ses == NULL!", __func__
);
1732 sess_data
= kzalloc(sizeof(struct sess_data
), GFP_KERNEL
);
1736 rc
= select_sec(ses
, sess_data
);
1740 sess_data
->xid
= xid
;
1741 sess_data
->ses
= ses
;
1742 sess_data
->buf0_type
= CIFS_NO_BUFFER
;
1743 sess_data
->nls_cp
= (struct nls_table
*) nls_cp
;
1745 while (sess_data
->func
)
1746 sess_data
->func(sess_data
);
1748 /* Store result before we free sess_data */
1749 rc
= sess_data
->result
;