1 // SPDX-License-Identifier: LGPL-2.1
4 * SMB/CIFS session setup handling routines
6 * Copyright (c) International Business Machines Corp., 2006, 2009
7 * Author(s): Steve French (sfrench@us.ibm.com)
13 #include "cifsproto.h"
14 #include "cifs_unicode.h"
15 #include "cifs_debug.h"
18 #include <linux/utsname.h>
19 #include <linux/slab.h>
20 #include "cifs_spnego.h"
21 #include "smb2proto.h"
22 #include "fs_context.h"
25 cifs_ses_add_channel(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses,
26 struct cifs_server_iface *iface);
29 is_server_using_iface(struct TCP_Server_Info *server,
30 struct cifs_server_iface *iface)
32 struct sockaddr_in *i4 = (struct sockaddr_in *)&iface->sockaddr;
33 struct sockaddr_in6 *i6 = (struct sockaddr_in6 *)&iface->sockaddr;
34 struct sockaddr_in *s4 = (struct sockaddr_in *)&server->dstaddr;
35 struct sockaddr_in6 *s6 = (struct sockaddr_in6 *)&server->dstaddr;
37 if (server->dstaddr.ss_family != iface->sockaddr.ss_family)
39 if (server->dstaddr.ss_family == AF_INET) {
40 if (s4->sin_addr.s_addr != i4->sin_addr.s_addr)
42 } else if (server->dstaddr.ss_family == AF_INET6) {
43 if (memcmp(&s6->sin6_addr, &i6->sin6_addr,
44 sizeof(i6->sin6_addr)) != 0)
47 /* unknown family.. */
53 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
57 spin_lock(&ses->chan_lock);
58 for (i = 0; i < ses->chan_count; i++) {
59 if (is_server_using_iface(ses->chans[i].server, iface)) {
60 spin_unlock(&ses->chan_lock);
64 spin_unlock(&ses->chan_lock);
68 /* returns number of channels added */
69 int cifs_try_adding_channels(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses)
71 int old_chan_count, new_chan_count;
76 struct cifs_server_iface *ifaces = NULL;
79 spin_lock(&ses->chan_lock);
81 new_chan_count = old_chan_count = ses->chan_count;
82 left = ses->chan_max - ses->chan_count;
86 "ses already at max_channels (%zu), nothing to open\n",
88 spin_unlock(&ses->chan_lock);
92 if (ses->server->dialect < SMB30_PROT_ID) {
93 spin_unlock(&ses->chan_lock);
94 cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
98 if (!(ses->server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
99 cifs_dbg(VFS, "server %s does not support multichannel\n", ses->server->hostname);
101 spin_unlock(&ses->chan_lock);
104 spin_unlock(&ses->chan_lock);
107 * Make a copy of the iface list at the time and use that
108 * instead so as to not hold the iface spinlock for opening
111 spin_lock(&ses->iface_lock);
112 iface_count = ses->iface_count;
113 if (iface_count <= 0) {
114 spin_unlock(&ses->iface_lock);
115 cifs_dbg(VFS, "no iface list available to open channels\n");
118 ifaces = kmemdup(ses->iface_list, iface_count*sizeof(*ifaces),
121 spin_unlock(&ses->iface_lock);
124 spin_unlock(&ses->iface_lock);
127 * Keep connecting to same, fastest, iface for all channels as
128 * long as its RSS. Try next fastest one if not RSS or channel
132 struct cifs_server_iface *iface;
135 if (tries > 3*ses->chan_max) {
136 cifs_dbg(FYI, "too many channel open attempts (%d channels left to open)\n",
142 if (is_ses_using_iface(ses, iface) && !iface->rss_capable) {
143 i = (i+1) % iface_count;
147 rc = cifs_ses_add_channel(cifs_sb, ses, iface);
149 cifs_dbg(FYI, "failed to open extra channel on iface#%d rc=%d\n",
151 i = (i+1) % iface_count;
155 cifs_dbg(FYI, "successfully opened new channel on iface#%d\n",
162 return new_chan_count - old_chan_count;
166 * If server is a channel of ses, return the corresponding enclosing
167 * cifs_chan otherwise return NULL.
170 cifs_ses_find_chan(struct cifs_ses *ses, struct TCP_Server_Info *server)
174 spin_lock(&ses->chan_lock);
175 for (i = 0; i < ses->chan_count; i++) {
176 if (ses->chans[i].server == server) {
177 spin_unlock(&ses->chan_lock);
178 return &ses->chans[i];
181 spin_unlock(&ses->chan_lock);
186 cifs_ses_add_channel(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses,
187 struct cifs_server_iface *iface)
189 struct TCP_Server_Info *chan_server;
190 struct cifs_chan *chan;
191 struct smb3_fs_context ctx = {NULL};
192 static const char unc_fmt[] = "\\%s\\foo";
193 char unc[sizeof(unc_fmt)+SERVER_NAME_LEN_WITH_NULL] = {0};
194 struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
195 struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
197 unsigned int xid = get_xid();
199 if (iface->sockaddr.ss_family == AF_INET)
200 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
201 ses, iface->speed, iface->rdma_capable ? "yes" : "no",
204 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI6)\n",
205 ses, iface->speed, iface->rdma_capable ? "yes" : "no",
209 * Setup a ctx with mostly the same info as the existing
210 * session and overwrite it with the requested iface data.
212 * We need to setup at least the fields used for negprot and
215 * We only need the ctx here, so we can reuse memory from
216 * the session and server without caring about memory
220 /* Always make new connection for now (TODO?) */
221 ctx.nosharesock = true;
224 ctx.domainauto = ses->domainAuto;
225 ctx.domainname = ses->domainName;
226 ctx.username = ses->user_name;
227 ctx.password = ses->password;
228 ctx.sectype = ses->sectype;
229 ctx.sign = ses->sign;
232 /* XXX: Use ses->server->hostname? */
233 sprintf(unc, unc_fmt, ses->ip_addr);
237 /* Reuse same version as master connection */
238 ctx.vals = ses->server->vals;
239 ctx.ops = ses->server->ops;
241 ctx.noblocksnd = ses->server->noblocksnd;
242 ctx.noautotune = ses->server->noautotune;
243 ctx.sockopt_tcp_nodelay = ses->server->tcp_nodelay;
244 ctx.echo_interval = ses->server->echo_interval / HZ;
245 ctx.max_credits = ses->server->max_credits;
248 * This will be used for encoding/decoding user/domain/pw
249 * during sess setup auth.
251 ctx.local_nls = cifs_sb->local_nls;
253 /* Use RDMA if possible */
254 ctx.rdma = iface->rdma_capable;
255 memcpy(&ctx.dstaddr, &iface->sockaddr, sizeof(struct sockaddr_storage));
257 /* reuse master con client guid */
258 memcpy(&ctx.client_guid, ses->server->client_guid,
259 SMB2_CLIENT_GUID_SIZE);
260 ctx.use_client_guid = true;
262 chan_server = cifs_get_tcp_session(&ctx);
264 mutex_lock(&ses->session_mutex);
265 spin_lock(&ses->chan_lock);
266 chan = ses->binding_chan = &ses->chans[ses->chan_count];
267 chan->server = chan_server;
268 if (IS_ERR(chan->server)) {
269 rc = PTR_ERR(chan->server);
271 spin_unlock(&ses->chan_lock);
274 spin_unlock(&ses->chan_lock);
276 spin_lock(&cifs_tcp_ses_lock);
277 chan->server->is_channel = true;
278 spin_unlock(&cifs_tcp_ses_lock);
281 * We need to allocate the server crypto now as we will need
282 * to sign packets before we generate the channel signing key
283 * (we sign with the session key)
285 rc = smb311_crypto_shash_allocate(chan->server);
287 cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
292 rc = cifs_negotiate_protocol(xid, ses);
296 rc = cifs_setup_session(xid, ses, cifs_sb->local_nls);
300 /* success, put it on the list
301 * XXX: sharing ses between 2 tcp servers is not possible, the
302 * way "internal" linked lists works in linux makes element
303 * only able to belong to one list
305 * the binding session is already established so the rest of
306 * the code should be able to look it up, no need to add the
307 * ses to the new server.
310 spin_lock(&ses->chan_lock);
312 atomic_set(&ses->chan_seq, 0);
313 spin_unlock(&ses->chan_lock);
316 ses->binding = false;
317 ses->binding_chan = NULL;
318 mutex_unlock(&ses->session_mutex);
320 if (rc && chan->server)
321 cifs_put_tcp_session(chan->server, 0);
327 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses, SESSION_SETUP_ANDX *pSMB)
329 __u32 capabilities = 0;
331 /* init fields common to all four types of SessSetup */
332 /* Note that offsets for first seven fields in req struct are same */
333 /* in CIFS Specs so does not matter which of 3 forms of struct */
334 /* that we use in next few lines */
335 /* Note that header is initialized to zero in header_assemble */
336 pSMB->req.AndXCommand = 0xFF;
337 pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
338 CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
340 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
341 pSMB->req.VcNumber = cpu_to_le16(1);
343 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
345 /* BB verify whether signing required on neg or just on auth frame
348 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
349 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
351 if (ses->server->sign)
352 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
354 if (ses->capabilities & CAP_UNICODE) {
355 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
356 capabilities |= CAP_UNICODE;
358 if (ses->capabilities & CAP_STATUS32) {
359 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
360 capabilities |= CAP_STATUS32;
362 if (ses->capabilities & CAP_DFS) {
363 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
364 capabilities |= CAP_DFS;
366 if (ses->capabilities & CAP_UNIX)
367 capabilities |= CAP_UNIX;
373 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
375 char *bcc_ptr = *pbcc_area;
378 /* Copy OS version */
379 bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
381 bcc_ptr += 2 * bytes_ret;
382 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
384 bcc_ptr += 2 * bytes_ret;
385 bcc_ptr += 2; /* trailing null */
387 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
389 bcc_ptr += 2 * bytes_ret;
390 bcc_ptr += 2; /* trailing null */
392 *pbcc_area = bcc_ptr;
395 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
396 const struct nls_table *nls_cp)
398 char *bcc_ptr = *pbcc_area;
402 if (ses->domainName == NULL) {
403 /* Sending null domain better than using a bogus domain name (as
404 we did briefly in 2.6.18) since server will use its default */
409 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
410 CIFS_MAX_DOMAINNAME_LEN, nls_cp);
411 bcc_ptr += 2 * bytes_ret;
412 bcc_ptr += 2; /* account for null terminator */
414 *pbcc_area = bcc_ptr;
418 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
419 const struct nls_table *nls_cp)
421 char *bcc_ptr = *pbcc_area;
424 /* BB FIXME add check that strings total less
425 than 335 or will need to send them as arrays */
427 /* unicode strings, must be word aligned before the call */
428 /* if ((long) bcc_ptr % 2) {
433 if (ses->user_name == NULL) {
434 /* null user mount */
438 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
439 CIFS_MAX_USERNAME_LEN, nls_cp);
441 bcc_ptr += 2 * bytes_ret;
442 bcc_ptr += 2; /* account for null termination */
444 unicode_domain_string(&bcc_ptr, ses, nls_cp);
445 unicode_oslm_strings(&bcc_ptr, nls_cp);
447 *pbcc_area = bcc_ptr;
450 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
451 const struct nls_table *nls_cp)
453 char *bcc_ptr = *pbcc_area;
457 /* BB what about null user mounts - check that we do this BB */
459 if (ses->user_name != NULL) {
460 len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
461 if (WARN_ON_ONCE(len < 0))
462 len = CIFS_MAX_USERNAME_LEN - 1;
465 /* else null user mount */
467 bcc_ptr++; /* account for null termination */
470 if (ses->domainName != NULL) {
471 len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
472 if (WARN_ON_ONCE(len < 0))
473 len = CIFS_MAX_DOMAINNAME_LEN - 1;
475 } /* else we will send a null domain name
476 so the server will default to its own domain */
480 /* BB check for overflow here */
482 strcpy(bcc_ptr, "Linux version ");
483 bcc_ptr += strlen("Linux version ");
484 strcpy(bcc_ptr, init_utsname()->release);
485 bcc_ptr += strlen(init_utsname()->release) + 1;
487 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
488 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
490 *pbcc_area = bcc_ptr;
494 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
495 const struct nls_table *nls_cp)
498 char *data = *pbcc_area;
500 cifs_dbg(FYI, "bleft %d\n", bleft);
502 kfree(ses->serverOS);
503 ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
504 cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
505 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
511 kfree(ses->serverNOS);
512 ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
513 cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
514 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
520 kfree(ses->serverDomain);
521 ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
522 cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
527 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
528 struct cifs_ses *ses,
529 const struct nls_table *nls_cp)
532 char *bcc_ptr = *pbcc_area;
534 cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
536 len = strnlen(bcc_ptr, bleft);
540 kfree(ses->serverOS);
542 ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
544 memcpy(ses->serverOS, bcc_ptr, len);
545 ses->serverOS[len] = 0;
546 if (strncmp(ses->serverOS, "OS/2", 4) == 0)
547 cifs_dbg(FYI, "OS/2 server\n");
553 len = strnlen(bcc_ptr, bleft);
557 kfree(ses->serverNOS);
559 ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
560 if (ses->serverNOS) {
561 memcpy(ses->serverNOS, bcc_ptr, len);
562 ses->serverNOS[len] = 0;
568 len = strnlen(bcc_ptr, bleft);
572 /* No domain field in LANMAN case. Domain is
573 returned by old servers in the SMB negprot response */
574 /* BB For newer servers which do not support Unicode,
575 but thus do return domain here we could add parsing
576 for it later, but it is not very important */
577 cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
580 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
581 struct cifs_ses *ses)
583 unsigned int tioffset; /* challenge message target info area */
584 unsigned int tilen; /* challenge message target info area length */
586 CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
588 if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
589 cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
593 if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
594 cifs_dbg(VFS, "blob signature incorrect %s\n",
598 if (pblob->MessageType != NtLmChallenge) {
599 cifs_dbg(VFS, "Incorrect message type %d\n",
604 memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
605 /* BB we could decode pblob->NegotiateFlags; some may be useful */
606 /* In particular we can examine sign flags */
607 /* BB spec says that if AvId field of MsvAvTimestamp is populated then
608 we must set the MIC field of the AUTHENTICATE_MESSAGE */
609 ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags);
610 tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
611 tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
612 if (tioffset > blob_len || tioffset + tilen > blob_len) {
613 cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
618 ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
620 if (!ses->auth_key.response) {
621 cifs_dbg(VFS, "Challenge target info alloc failure\n");
624 ses->auth_key.len = tilen;
630 /* BB Move to ntlmssp.c eventually */
632 /* We do not malloc the blob, it is passed in pbuffer, because
633 it is fixed size, and small, making this approach cleaner */
634 void build_ntlmssp_negotiate_blob(unsigned char *pbuffer,
635 struct cifs_ses *ses)
637 struct TCP_Server_Info *server = cifs_ses_server(ses);
638 NEGOTIATE_MESSAGE *sec_blob = (NEGOTIATE_MESSAGE *)pbuffer;
641 memset(pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
642 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
643 sec_blob->MessageType = NtLmNegotiate;
645 /* BB is NTLMV2 session security format easier to use here? */
646 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
647 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
648 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
649 NTLMSSP_NEGOTIATE_SEAL;
651 flags |= NTLMSSP_NEGOTIATE_SIGN;
652 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
653 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
655 sec_blob->NegotiateFlags = cpu_to_le32(flags);
657 sec_blob->WorkstationName.BufferOffset = 0;
658 sec_blob->WorkstationName.Length = 0;
659 sec_blob->WorkstationName.MaximumLength = 0;
661 /* Domain name is sent on the Challenge not Negotiate NTLMSSP request */
662 sec_blob->DomainName.BufferOffset = 0;
663 sec_blob->DomainName.Length = 0;
664 sec_blob->DomainName.MaximumLength = 0;
667 static int size_of_ntlmssp_blob(struct cifs_ses *ses)
669 int sz = sizeof(AUTHENTICATE_MESSAGE) + ses->auth_key.len
670 - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
673 sz += 2 * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
678 sz += 2 * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
685 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
687 struct cifs_ses *ses,
688 const struct nls_table *nls_cp)
691 AUTHENTICATE_MESSAGE *sec_blob;
695 rc = setup_ntlmv2_rsp(ses, nls_cp);
697 cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
699 goto setup_ntlmv2_ret;
701 *pbuffer = kmalloc(size_of_ntlmssp_blob(ses), GFP_KERNEL);
704 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
706 goto setup_ntlmv2_ret;
708 sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
710 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
711 sec_blob->MessageType = NtLmAuthenticate;
713 flags = NTLMSSP_NEGOTIATE_56 |
714 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_TARGET_INFO |
715 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
716 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
717 NTLMSSP_NEGOTIATE_SEAL;
718 if (ses->server->sign)
719 flags |= NTLMSSP_NEGOTIATE_SIGN;
720 if (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
721 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
723 tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
724 sec_blob->NegotiateFlags = cpu_to_le32(flags);
726 sec_blob->LmChallengeResponse.BufferOffset =
727 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
728 sec_blob->LmChallengeResponse.Length = 0;
729 sec_blob->LmChallengeResponse.MaximumLength = 0;
731 sec_blob->NtChallengeResponse.BufferOffset =
732 cpu_to_le32(tmp - *pbuffer);
733 if (ses->user_name != NULL) {
734 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
735 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
736 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
738 sec_blob->NtChallengeResponse.Length =
739 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
740 sec_blob->NtChallengeResponse.MaximumLength =
741 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
744 * don't send an NT Response for anonymous access
746 sec_blob->NtChallengeResponse.Length = 0;
747 sec_blob->NtChallengeResponse.MaximumLength = 0;
750 if (ses->domainName == NULL) {
751 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
752 sec_blob->DomainName.Length = 0;
753 sec_blob->DomainName.MaximumLength = 0;
757 len = cifs_strtoUTF16((__le16 *)tmp, ses->domainName,
758 CIFS_MAX_DOMAINNAME_LEN, nls_cp);
759 len *= 2; /* unicode is 2 bytes each */
760 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
761 sec_blob->DomainName.Length = cpu_to_le16(len);
762 sec_blob->DomainName.MaximumLength = cpu_to_le16(len);
766 if (ses->user_name == NULL) {
767 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
768 sec_blob->UserName.Length = 0;
769 sec_blob->UserName.MaximumLength = 0;
773 len = cifs_strtoUTF16((__le16 *)tmp, ses->user_name,
774 CIFS_MAX_USERNAME_LEN, nls_cp);
775 len *= 2; /* unicode is 2 bytes each */
776 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
777 sec_blob->UserName.Length = cpu_to_le16(len);
778 sec_blob->UserName.MaximumLength = cpu_to_le16(len);
782 sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
783 sec_blob->WorkstationName.Length = 0;
784 sec_blob->WorkstationName.MaximumLength = 0;
787 if (((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) ||
788 (ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC))
789 && !calc_seckey(ses)) {
790 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
791 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
792 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
793 sec_blob->SessionKey.MaximumLength =
794 cpu_to_le16(CIFS_CPHTXT_SIZE);
795 tmp += CIFS_CPHTXT_SIZE;
797 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
798 sec_blob->SessionKey.Length = 0;
799 sec_blob->SessionKey.MaximumLength = 0;
802 *buflen = tmp - *pbuffer;
808 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
810 switch (server->negflavor) {
811 case CIFS_NEGFLAVOR_EXTENDED:
817 if (server->sec_ntlmssp &&
818 (global_secflags & CIFSSEC_MAY_NTLMSSP))
820 if ((server->sec_kerberos || server->sec_mskerberos) &&
821 (global_secflags & CIFSSEC_MAY_KRB5))
827 case CIFS_NEGFLAVOR_UNENCAP:
832 if (global_secflags & CIFSSEC_MAY_NTLMV2)
846 struct cifs_ses *ses;
847 struct nls_table *nls_cp;
848 void (*func)(struct sess_data *);
851 /* we will send the SMB in three pieces:
852 * a fixed length beginning part, an optional
853 * SPNEGO blob (which can be zero length), and a
854 * last part which will include the strings
855 * and rest of bcc area. This allows us to avoid
856 * a large buffer 17K allocation
863 sess_alloc_buffer(struct sess_data *sess_data, int wct)
866 struct cifs_ses *ses = sess_data->ses;
867 struct smb_hdr *smb_buf;
869 rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
875 sess_data->iov[0].iov_base = (char *)smb_buf;
876 sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
878 * This variable will be used to clear the buffer
879 * allocated above in case of any error in the calling function.
881 sess_data->buf0_type = CIFS_SMALL_BUFFER;
883 /* 2000 big enough to fit max user, domain, NOS name etc. */
884 sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
885 if (!sess_data->iov[2].iov_base) {
887 goto out_free_smb_buf;
893 cifs_small_buf_release(smb_buf);
894 sess_data->iov[0].iov_base = NULL;
895 sess_data->iov[0].iov_len = 0;
896 sess_data->buf0_type = CIFS_NO_BUFFER;
901 sess_free_buffer(struct sess_data *sess_data)
904 free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
905 sess_data->buf0_type = CIFS_NO_BUFFER;
906 kfree(sess_data->iov[2].iov_base);
910 sess_establish_session(struct sess_data *sess_data)
912 struct cifs_ses *ses = sess_data->ses;
914 mutex_lock(&ses->server->srv_mutex);
915 if (!ses->server->session_estab) {
916 if (ses->server->sign) {
917 ses->server->session_key.response =
918 kmemdup(ses->auth_key.response,
919 ses->auth_key.len, GFP_KERNEL);
920 if (!ses->server->session_key.response) {
921 mutex_unlock(&ses->server->srv_mutex);
924 ses->server->session_key.len =
927 ses->server->sequence_number = 0x2;
928 ses->server->session_estab = true;
930 mutex_unlock(&ses->server->srv_mutex);
932 cifs_dbg(FYI, "CIFS session established successfully\n");
933 spin_lock(&GlobalMid_Lock);
934 ses->status = CifsGood;
935 ses->need_reconnect = false;
936 spin_unlock(&GlobalMid_Lock);
942 sess_sendreceive(struct sess_data *sess_data)
945 struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
947 struct kvec rsp_iov = { NULL, 0 };
949 count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
950 be32_add_cpu(&smb_buf->smb_buf_length, count);
951 put_bcc(count, smb_buf);
953 rc = SendReceive2(sess_data->xid, sess_data->ses,
954 sess_data->iov, 3 /* num_iovecs */,
955 &sess_data->buf0_type,
956 CIFS_LOG_ERROR, &rsp_iov);
957 cifs_small_buf_release(sess_data->iov[0].iov_base);
958 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
964 sess_auth_ntlmv2(struct sess_data *sess_data)
967 struct smb_hdr *smb_buf;
968 SESSION_SETUP_ANDX *pSMB;
970 struct cifs_ses *ses = sess_data->ses;
972 __u16 bytes_remaining;
974 /* old style NTLM sessionsetup */
976 rc = sess_alloc_buffer(sess_data, 13);
980 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
981 bcc_ptr = sess_data->iov[2].iov_base;
982 capabilities = cifs_ssetup_hdr(ses, pSMB);
984 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
986 /* LM2 password would be here if we supported it */
987 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
989 if (ses->user_name != NULL) {
990 /* calculate nlmv2 response and session key */
991 rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
993 cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
997 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
998 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
999 bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1001 /* set case sensitive password length after tilen may get
1002 * assigned, tilen is 0 otherwise.
1004 pSMB->req_no_secext.CaseSensitivePasswordLength =
1005 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1007 pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1010 if (ses->capabilities & CAP_UNICODE) {
1011 if (sess_data->iov[0].iov_len % 2) {
1015 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1017 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1021 sess_data->iov[2].iov_len = (long) bcc_ptr -
1022 (long) sess_data->iov[2].iov_base;
1024 rc = sess_sendreceive(sess_data);
1028 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1029 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1031 if (smb_buf->WordCount != 3) {
1033 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1037 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1038 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1040 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1041 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1043 bytes_remaining = get_bcc(smb_buf);
1044 bcc_ptr = pByteArea(smb_buf);
1046 /* BB check if Unicode and decode strings */
1047 if (bytes_remaining == 0) {
1048 /* no string area to decode, do nothing */
1049 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1050 /* unicode string area must be word-aligned */
1051 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1055 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1058 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1062 rc = sess_establish_session(sess_data);
1064 sess_data->result = rc;
1065 sess_data->func = NULL;
1066 sess_free_buffer(sess_data);
1067 kfree(ses->auth_key.response);
1068 ses->auth_key.response = NULL;
1071 #ifdef CONFIG_CIFS_UPCALL
1073 sess_auth_kerberos(struct sess_data *sess_data)
1076 struct smb_hdr *smb_buf;
1077 SESSION_SETUP_ANDX *pSMB;
1079 struct cifs_ses *ses = sess_data->ses;
1081 __u16 bytes_remaining;
1082 struct key *spnego_key = NULL;
1083 struct cifs_spnego_msg *msg;
1086 /* extended security */
1088 rc = sess_alloc_buffer(sess_data, 12);
1092 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1093 bcc_ptr = sess_data->iov[2].iov_base;
1094 capabilities = cifs_ssetup_hdr(ses, pSMB);
1096 spnego_key = cifs_get_spnego_key(ses);
1097 if (IS_ERR(spnego_key)) {
1098 rc = PTR_ERR(spnego_key);
1103 msg = spnego_key->payload.data[0];
1105 * check version field to make sure that cifs.upcall is
1106 * sending us a response in an expected form
1108 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1109 cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1110 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1112 goto out_put_spnego_key;
1115 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1117 if (!ses->auth_key.response) {
1118 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1121 goto out_put_spnego_key;
1123 ses->auth_key.len = msg->sesskey_len;
1125 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1126 capabilities |= CAP_EXTENDED_SECURITY;
1127 pSMB->req.Capabilities = cpu_to_le32(capabilities);
1128 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1129 sess_data->iov[1].iov_len = msg->secblob_len;
1130 pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1132 if (ses->capabilities & CAP_UNICODE) {
1133 /* unicode strings must be word aligned */
1134 if ((sess_data->iov[0].iov_len
1135 + sess_data->iov[1].iov_len) % 2) {
1139 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1140 unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1142 /* BB: is this right? */
1143 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1146 sess_data->iov[2].iov_len = (long) bcc_ptr -
1147 (long) sess_data->iov[2].iov_base;
1149 rc = sess_sendreceive(sess_data);
1151 goto out_put_spnego_key;
1153 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1154 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1156 if (smb_buf->WordCount != 4) {
1158 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1159 goto out_put_spnego_key;
1162 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1163 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1165 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1166 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1168 bytes_remaining = get_bcc(smb_buf);
1169 bcc_ptr = pByteArea(smb_buf);
1171 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1172 if (blob_len > bytes_remaining) {
1173 cifs_dbg(VFS, "bad security blob length %d\n",
1176 goto out_put_spnego_key;
1178 bcc_ptr += blob_len;
1179 bytes_remaining -= blob_len;
1181 /* BB check if Unicode and decode strings */
1182 if (bytes_remaining == 0) {
1183 /* no string area to decode, do nothing */
1184 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1185 /* unicode string area must be word-aligned */
1186 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1190 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1193 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1197 rc = sess_establish_session(sess_data);
1199 key_invalidate(spnego_key);
1200 key_put(spnego_key);
1202 sess_data->result = rc;
1203 sess_data->func = NULL;
1204 sess_free_buffer(sess_data);
1205 kfree(ses->auth_key.response);
1206 ses->auth_key.response = NULL;
1209 #endif /* ! CONFIG_CIFS_UPCALL */
1212 * The required kvec buffers have to be allocated before calling this
1216 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1218 SESSION_SETUP_ANDX *pSMB;
1219 struct cifs_ses *ses = sess_data->ses;
1223 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1225 capabilities = cifs_ssetup_hdr(ses, pSMB);
1226 if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) {
1227 cifs_dbg(VFS, "NTLMSSP requires Unicode support\n");
1231 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1232 capabilities |= CAP_EXTENDED_SECURITY;
1233 pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1235 bcc_ptr = sess_data->iov[2].iov_base;
1236 /* unicode strings must be word aligned */
1237 if ((sess_data->iov[0].iov_len + sess_data->iov[1].iov_len) % 2) {
1241 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1243 sess_data->iov[2].iov_len = (long) bcc_ptr -
1244 (long) sess_data->iov[2].iov_base;
1250 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1253 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1256 struct smb_hdr *smb_buf;
1257 SESSION_SETUP_ANDX *pSMB;
1258 struct cifs_ses *ses = sess_data->ses;
1259 __u16 bytes_remaining;
1263 cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1266 * if memory allocation is successful, caller of this function
1269 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1270 if (!ses->ntlmssp) {
1274 ses->ntlmssp->sesskey_per_smbsess = false;
1277 rc = sess_alloc_buffer(sess_data, 12);
1281 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1283 /* Build security blob before we assemble the request */
1284 build_ntlmssp_negotiate_blob(pSMB->req.SecurityBlob, ses);
1285 sess_data->iov[1].iov_len = sizeof(NEGOTIATE_MESSAGE);
1286 sess_data->iov[1].iov_base = pSMB->req.SecurityBlob;
1287 pSMB->req.SecurityBlobLength = cpu_to_le16(sizeof(NEGOTIATE_MESSAGE));
1289 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1293 rc = sess_sendreceive(sess_data);
1295 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1296 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1298 /* If true, rc here is expected and not an error */
1299 if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1300 smb_buf->Status.CifsError ==
1301 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1307 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1309 if (smb_buf->WordCount != 4) {
1311 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1315 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1316 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1318 bytes_remaining = get_bcc(smb_buf);
1319 bcc_ptr = pByteArea(smb_buf);
1321 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1322 if (blob_len > bytes_remaining) {
1323 cifs_dbg(VFS, "bad security blob length %d\n",
1329 rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1331 sess_free_buffer(sess_data);
1334 sess_data->func = sess_auth_rawntlmssp_authenticate;
1338 /* Else error. Cleanup */
1339 kfree(ses->auth_key.response);
1340 ses->auth_key.response = NULL;
1341 kfree(ses->ntlmssp);
1342 ses->ntlmssp = NULL;
1344 sess_data->func = NULL;
1345 sess_data->result = rc;
1349 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1352 struct smb_hdr *smb_buf;
1353 SESSION_SETUP_ANDX *pSMB;
1354 struct cifs_ses *ses = sess_data->ses;
1355 __u16 bytes_remaining;
1357 unsigned char *ntlmsspblob = NULL;
1360 cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1363 rc = sess_alloc_buffer(sess_data, 12);
1367 /* Build security blob before we assemble the request */
1368 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1369 smb_buf = (struct smb_hdr *)pSMB;
1370 rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1371 &blob_len, ses, sess_data->nls_cp);
1373 goto out_free_ntlmsspblob;
1374 sess_data->iov[1].iov_len = blob_len;
1375 sess_data->iov[1].iov_base = ntlmsspblob;
1376 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1378 * Make sure that we tell the server that we are using
1379 * the uid that it just gave us back on the response
1382 smb_buf->Uid = ses->Suid;
1384 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1386 goto out_free_ntlmsspblob;
1388 rc = sess_sendreceive(sess_data);
1390 goto out_free_ntlmsspblob;
1392 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1393 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1394 if (smb_buf->WordCount != 4) {
1396 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1397 goto out_free_ntlmsspblob;
1400 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1401 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1403 if (ses->Suid != smb_buf->Uid) {
1404 ses->Suid = smb_buf->Uid;
1405 cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1408 bytes_remaining = get_bcc(smb_buf);
1409 bcc_ptr = pByteArea(smb_buf);
1410 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1411 if (blob_len > bytes_remaining) {
1412 cifs_dbg(VFS, "bad security blob length %d\n",
1415 goto out_free_ntlmsspblob;
1417 bcc_ptr += blob_len;
1418 bytes_remaining -= blob_len;
1421 /* BB check if Unicode and decode strings */
1422 if (bytes_remaining == 0) {
1423 /* no string area to decode, do nothing */
1424 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1425 /* unicode string area must be word-aligned */
1426 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1430 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1433 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1437 out_free_ntlmsspblob:
1440 sess_free_buffer(sess_data);
1443 rc = sess_establish_session(sess_data);
1446 kfree(ses->auth_key.response);
1447 ses->auth_key.response = NULL;
1448 kfree(ses->ntlmssp);
1449 ses->ntlmssp = NULL;
1451 sess_data->func = NULL;
1452 sess_data->result = rc;
1455 static int select_sec(struct cifs_ses *ses, struct sess_data *sess_data)
1459 type = cifs_select_sectype(ses->server, ses->sectype);
1460 cifs_dbg(FYI, "sess setup type %d\n", type);
1461 if (type == Unspecified) {
1462 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1468 sess_data->func = sess_auth_ntlmv2;
1471 #ifdef CONFIG_CIFS_UPCALL
1472 sess_data->func = sess_auth_kerberos;
1475 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1477 #endif /* CONFIG_CIFS_UPCALL */
1479 sess_data->func = sess_auth_rawntlmssp_negotiate;
1482 cifs_dbg(VFS, "secType %d not supported!\n", type);
1489 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
1490 const struct nls_table *nls_cp)
1493 struct sess_data *sess_data;
1496 WARN(1, "%s: ses == NULL!", __func__);
1500 sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
1504 rc = select_sec(ses, sess_data);
1508 sess_data->xid = xid;
1509 sess_data->ses = ses;
1510 sess_data->buf0_type = CIFS_NO_BUFFER;
1511 sess_data->nls_cp = (struct nls_table *) nls_cp;
1513 while (sess_data->func)
1514 sess_data->func(sess_data);
1516 /* Store result before we free sess_data */
1517 rc = sess_data->result;