4 * SMB/CIFS session setup handling routines
6 * Copyright (c) International Business Machines Corp., 2006, 2009
7 * Author(s): Steve French (sfrench@us.ibm.com)
9 * This library is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU Lesser General Public License as published
11 * by the Free Software Foundation; either version 2.1 of the License, or
12 * (at your option) any later version.
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
17 * the GNU Lesser General Public License for more details.
19 * You should have received a copy of the GNU Lesser General Public License
20 * along with this library; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
26 #include "cifsproto.h"
27 #include "cifs_unicode.h"
28 #include "cifs_debug.h"
31 #include <linux/utsname.h>
32 #include <linux/slab.h>
33 #include "cifs_spnego.h"
35 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses, SESSION_SETUP_ANDX *pSMB)
37 __u32 capabilities = 0;
39 /* init fields common to all four types of SessSetup */
40 /* Note that offsets for first seven fields in req struct are same */
41 /* in CIFS Specs so does not matter which of 3 forms of struct */
42 /* that we use in next few lines */
43 /* Note that header is initialized to zero in header_assemble */
44 pSMB->req.AndXCommand = 0xFF;
45 pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
46 CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
48 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
49 pSMB->req.VcNumber = cpu_to_le16(1);
51 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
53 /* BB verify whether signing required on neg or just on auth frame
56 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
57 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
59 if (ses->server->sign)
60 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
62 if (ses->capabilities & CAP_UNICODE) {
63 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
64 capabilities |= CAP_UNICODE;
66 if (ses->capabilities & CAP_STATUS32) {
67 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
68 capabilities |= CAP_STATUS32;
70 if (ses->capabilities & CAP_DFS) {
71 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
72 capabilities |= CAP_DFS;
74 if (ses->capabilities & CAP_UNIX)
75 capabilities |= CAP_UNIX;
81 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
83 char *bcc_ptr = *pbcc_area;
87 bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
89 bcc_ptr += 2 * bytes_ret;
90 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
92 bcc_ptr += 2 * bytes_ret;
93 bcc_ptr += 2; /* trailing null */
95 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
97 bcc_ptr += 2 * bytes_ret;
98 bcc_ptr += 2; /* trailing null */
100 *pbcc_area = bcc_ptr;
103 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
104 const struct nls_table *nls_cp)
106 char *bcc_ptr = *pbcc_area;
110 if (ses->domainName == NULL) {
111 /* Sending null domain better than using a bogus domain name (as
112 we did briefly in 2.6.18) since server will use its default */
117 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
118 CIFS_MAX_DOMAINNAME_LEN, nls_cp);
119 bcc_ptr += 2 * bytes_ret;
120 bcc_ptr += 2; /* account for null terminator */
122 *pbcc_area = bcc_ptr;
126 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
127 const struct nls_table *nls_cp)
129 char *bcc_ptr = *pbcc_area;
132 /* BB FIXME add check that strings total less
133 than 335 or will need to send them as arrays */
135 /* unicode strings, must be word aligned before the call */
136 /* if ((long) bcc_ptr % 2) {
141 if (ses->user_name == NULL) {
142 /* null user mount */
146 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
147 CIFS_MAX_USERNAME_LEN, nls_cp);
149 bcc_ptr += 2 * bytes_ret;
150 bcc_ptr += 2; /* account for null termination */
152 unicode_domain_string(&bcc_ptr, ses, nls_cp);
153 unicode_oslm_strings(&bcc_ptr, nls_cp);
155 *pbcc_area = bcc_ptr;
158 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
159 const struct nls_table *nls_cp)
161 char *bcc_ptr = *pbcc_area;
164 /* BB what about null user mounts - check that we do this BB */
166 if (ses->user_name != NULL) {
167 strncpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
168 bcc_ptr += strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
170 /* else null user mount */
172 bcc_ptr++; /* account for null termination */
175 if (ses->domainName != NULL) {
176 strncpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
177 bcc_ptr += strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
178 } /* else we will send a null domain name
179 so the server will default to its own domain */
183 /* BB check for overflow here */
185 strcpy(bcc_ptr, "Linux version ");
186 bcc_ptr += strlen("Linux version ");
187 strcpy(bcc_ptr, init_utsname()->release);
188 bcc_ptr += strlen(init_utsname()->release) + 1;
190 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
191 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
193 *pbcc_area = bcc_ptr;
197 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
198 const struct nls_table *nls_cp)
201 char *data = *pbcc_area;
203 cifs_dbg(FYI, "bleft %d\n", bleft);
205 kfree(ses->serverOS);
206 ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
207 cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
208 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
214 kfree(ses->serverNOS);
215 ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
216 cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
217 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
223 kfree(ses->serverDomain);
224 ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
225 cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
230 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
231 struct cifs_ses *ses,
232 const struct nls_table *nls_cp)
235 char *bcc_ptr = *pbcc_area;
237 cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
239 len = strnlen(bcc_ptr, bleft);
243 kfree(ses->serverOS);
245 ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
247 strncpy(ses->serverOS, bcc_ptr, len);
248 if (strncmp(ses->serverOS, "OS/2", 4) == 0)
249 cifs_dbg(FYI, "OS/2 server\n");
255 len = strnlen(bcc_ptr, bleft);
259 kfree(ses->serverNOS);
261 ses->serverNOS = kzalloc(len + 1, GFP_KERNEL);
263 strncpy(ses->serverNOS, bcc_ptr, len);
268 len = strnlen(bcc_ptr, bleft);
272 /* No domain field in LANMAN case. Domain is
273 returned by old servers in the SMB negprot response */
274 /* BB For newer servers which do not support Unicode,
275 but thus do return domain here we could add parsing
276 for it later, but it is not very important */
277 cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
280 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
281 struct cifs_ses *ses)
283 unsigned int tioffset; /* challenge message target info area */
284 unsigned int tilen; /* challenge message target info area length */
286 CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
288 if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
289 cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
293 if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
294 cifs_dbg(VFS, "blob signature incorrect %s\n",
298 if (pblob->MessageType != NtLmChallenge) {
299 cifs_dbg(VFS, "Incorrect message type %d\n",
304 memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
305 /* BB we could decode pblob->NegotiateFlags; some may be useful */
306 /* In particular we can examine sign flags */
307 /* BB spec says that if AvId field of MsvAvTimestamp is populated then
308 we must set the MIC field of the AUTHENTICATE_MESSAGE */
309 ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags);
310 tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
311 tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
312 if (tioffset > blob_len || tioffset + tilen > blob_len) {
313 cifs_dbg(VFS, "tioffset + tilen too high %u + %u",
318 ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
320 if (!ses->auth_key.response) {
321 cifs_dbg(VFS, "Challenge target info alloc failure");
324 ses->auth_key.len = tilen;
330 /* BB Move to ntlmssp.c eventually */
332 /* We do not malloc the blob, it is passed in pbuffer, because
333 it is fixed size, and small, making this approach cleaner */
334 void build_ntlmssp_negotiate_blob(unsigned char *pbuffer,
335 struct cifs_ses *ses)
337 NEGOTIATE_MESSAGE *sec_blob = (NEGOTIATE_MESSAGE *)pbuffer;
340 memset(pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
341 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
342 sec_blob->MessageType = NtLmNegotiate;
344 /* BB is NTLMV2 session security format easier to use here? */
345 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
346 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
347 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
348 NTLMSSP_NEGOTIATE_SEAL;
349 if (ses->server->sign)
350 flags |= NTLMSSP_NEGOTIATE_SIGN;
351 if (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
352 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
354 sec_blob->NegotiateFlags = cpu_to_le32(flags);
356 sec_blob->WorkstationName.BufferOffset = 0;
357 sec_blob->WorkstationName.Length = 0;
358 sec_blob->WorkstationName.MaximumLength = 0;
360 /* Domain name is sent on the Challenge not Negotiate NTLMSSP request */
361 sec_blob->DomainName.BufferOffset = 0;
362 sec_blob->DomainName.Length = 0;
363 sec_blob->DomainName.MaximumLength = 0;
366 static int size_of_ntlmssp_blob(struct cifs_ses *ses)
368 int sz = sizeof(AUTHENTICATE_MESSAGE) + ses->auth_key.len
369 - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
372 sz += 2 * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
377 sz += 2 * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
384 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
386 struct cifs_ses *ses,
387 const struct nls_table *nls_cp)
390 AUTHENTICATE_MESSAGE *sec_blob;
394 rc = setup_ntlmv2_rsp(ses, nls_cp);
396 cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
398 goto setup_ntlmv2_ret;
400 *pbuffer = kmalloc(size_of_ntlmssp_blob(ses), GFP_KERNEL);
403 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
405 goto setup_ntlmv2_ret;
407 sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
409 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
410 sec_blob->MessageType = NtLmAuthenticate;
412 flags = NTLMSSP_NEGOTIATE_56 |
413 NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_TARGET_INFO |
414 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
415 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
416 NTLMSSP_NEGOTIATE_SEAL;
417 if (ses->server->sign)
418 flags |= NTLMSSP_NEGOTIATE_SIGN;
419 if (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
420 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
422 tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
423 sec_blob->NegotiateFlags = cpu_to_le32(flags);
425 sec_blob->LmChallengeResponse.BufferOffset =
426 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
427 sec_blob->LmChallengeResponse.Length = 0;
428 sec_blob->LmChallengeResponse.MaximumLength = 0;
430 sec_blob->NtChallengeResponse.BufferOffset =
431 cpu_to_le32(tmp - *pbuffer);
432 if (ses->user_name != NULL) {
433 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
434 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
435 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
437 sec_blob->NtChallengeResponse.Length =
438 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
439 sec_blob->NtChallengeResponse.MaximumLength =
440 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
443 * don't send an NT Response for anonymous access
445 sec_blob->NtChallengeResponse.Length = 0;
446 sec_blob->NtChallengeResponse.MaximumLength = 0;
449 if (ses->domainName == NULL) {
450 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
451 sec_blob->DomainName.Length = 0;
452 sec_blob->DomainName.MaximumLength = 0;
456 len = cifs_strtoUTF16((__le16 *)tmp, ses->domainName,
457 CIFS_MAX_USERNAME_LEN, nls_cp);
458 len *= 2; /* unicode is 2 bytes each */
459 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
460 sec_blob->DomainName.Length = cpu_to_le16(len);
461 sec_blob->DomainName.MaximumLength = cpu_to_le16(len);
465 if (ses->user_name == NULL) {
466 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
467 sec_blob->UserName.Length = 0;
468 sec_blob->UserName.MaximumLength = 0;
472 len = cifs_strtoUTF16((__le16 *)tmp, ses->user_name,
473 CIFS_MAX_USERNAME_LEN, nls_cp);
474 len *= 2; /* unicode is 2 bytes each */
475 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
476 sec_blob->UserName.Length = cpu_to_le16(len);
477 sec_blob->UserName.MaximumLength = cpu_to_le16(len);
481 sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
482 sec_blob->WorkstationName.Length = 0;
483 sec_blob->WorkstationName.MaximumLength = 0;
486 if (((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) ||
487 (ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC))
488 && !calc_seckey(ses)) {
489 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
490 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
491 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
492 sec_blob->SessionKey.MaximumLength =
493 cpu_to_le16(CIFS_CPHTXT_SIZE);
494 tmp += CIFS_CPHTXT_SIZE;
496 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
497 sec_blob->SessionKey.Length = 0;
498 sec_blob->SessionKey.MaximumLength = 0;
501 *buflen = tmp - *pbuffer;
507 select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
509 switch (server->negflavor) {
510 case CIFS_NEGFLAVOR_EXTENDED:
516 if (server->sec_ntlmssp &&
517 (global_secflags & CIFSSEC_MAY_NTLMSSP))
519 if ((server->sec_kerberos || server->sec_mskerberos) &&
520 (global_secflags & CIFSSEC_MAY_KRB5))
526 case CIFS_NEGFLAVOR_UNENCAP:
532 if (global_secflags & CIFSSEC_MAY_NTLMV2)
534 if (global_secflags & CIFSSEC_MAY_NTLM)
537 /* Fallthrough to attempt LANMAN authentication next */
540 case CIFS_NEGFLAVOR_LANMAN:
545 if (global_secflags & CIFSSEC_MAY_LANMAN)
558 struct cifs_ses *ses;
559 struct nls_table *nls_cp;
560 void (*func)(struct sess_data *);
563 /* we will send the SMB in three pieces:
564 * a fixed length beginning part, an optional
565 * SPNEGO blob (which can be zero length), and a
566 * last part which will include the strings
567 * and rest of bcc area. This allows us to avoid
568 * a large buffer 17K allocation
575 sess_alloc_buffer(struct sess_data *sess_data, int wct)
578 struct cifs_ses *ses = sess_data->ses;
579 struct smb_hdr *smb_buf;
581 rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
587 sess_data->iov[0].iov_base = (char *)smb_buf;
588 sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
590 * This variable will be used to clear the buffer
591 * allocated above in case of any error in the calling function.
593 sess_data->buf0_type = CIFS_SMALL_BUFFER;
595 /* 2000 big enough to fit max user, domain, NOS name etc. */
596 sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
597 if (!sess_data->iov[2].iov_base) {
599 goto out_free_smb_buf;
605 cifs_small_buf_release(smb_buf);
606 sess_data->iov[0].iov_base = NULL;
607 sess_data->iov[0].iov_len = 0;
608 sess_data->buf0_type = CIFS_NO_BUFFER;
613 sess_free_buffer(struct sess_data *sess_data)
616 free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
617 sess_data->buf0_type = CIFS_NO_BUFFER;
618 kfree(sess_data->iov[2].iov_base);
622 sess_establish_session(struct sess_data *sess_data)
624 struct cifs_ses *ses = sess_data->ses;
626 mutex_lock(&ses->server->srv_mutex);
627 if (!ses->server->session_estab) {
628 if (ses->server->sign) {
629 ses->server->session_key.response =
630 kmemdup(ses->auth_key.response,
631 ses->auth_key.len, GFP_KERNEL);
632 if (!ses->server->session_key.response) {
633 mutex_unlock(&ses->server->srv_mutex);
636 ses->server->session_key.len =
639 ses->server->sequence_number = 0x2;
640 ses->server->session_estab = true;
642 mutex_unlock(&ses->server->srv_mutex);
644 cifs_dbg(FYI, "CIFS session established successfully\n");
645 spin_lock(&GlobalMid_Lock);
646 ses->status = CifsGood;
647 ses->need_reconnect = false;
648 spin_unlock(&GlobalMid_Lock);
654 sess_sendreceive(struct sess_data *sess_data)
657 struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
660 count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
661 smb_buf->smb_buf_length =
662 cpu_to_be32(be32_to_cpu(smb_buf->smb_buf_length) + count);
663 put_bcc(count, smb_buf);
665 rc = SendReceive2(sess_data->xid, sess_data->ses,
666 sess_data->iov, 3 /* num_iovecs */,
667 &sess_data->buf0_type,
674 * LANMAN and plaintext are less secure and off by default.
675 * So we make this explicitly be turned on in kconfig (in the
676 * build) and turned on at runtime (changed from the default)
677 * in proc/fs/cifs or via mount parm. Unfortunately this is
678 * needed for old Win (e.g. Win95), some obscure NAS and OS/2
680 #ifdef CONFIG_CIFS_WEAK_PW_HASH
682 sess_auth_lanman(struct sess_data *sess_data)
685 struct smb_hdr *smb_buf;
686 SESSION_SETUP_ANDX *pSMB;
688 struct cifs_ses *ses = sess_data->ses;
689 char lnm_session_key[CIFS_AUTH_RESP_SIZE];
691 __u16 bytes_remaining;
693 /* lanman 2 style sessionsetup */
695 rc = sess_alloc_buffer(sess_data, 10);
699 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
700 bcc_ptr = sess_data->iov[2].iov_base;
701 capabilities = cifs_ssetup_hdr(ses, pSMB);
703 pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE;
705 if (ses->user_name != NULL) {
706 /* no capabilities flags in old lanman negotiation */
707 pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
709 /* Calculate hash with password and copy into bcc_ptr.
710 * Encryption Key (stored as in cryptkey) gets used if the
711 * security mode bit in Negottiate Protocol response states
712 * to use challenge/response method (i.e. Password bit is 1).
714 rc = calc_lanman_hash(ses->password, ses->server->cryptkey,
715 ses->server->sec_mode & SECMODE_PW_ENCRYPT ?
716 true : false, lnm_session_key);
718 memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE);
719 bcc_ptr += CIFS_AUTH_RESP_SIZE;
721 pSMB->old_req.PasswordLength = 0;
725 * can not sign if LANMAN negotiated so no need
726 * to calculate signing key? but what if server
727 * changed to do higher than lanman dialect and
728 * we reconnected would we ever calc signing_key?
731 cifs_dbg(FYI, "Negotiating LANMAN setting up strings\n");
732 /* Unicode not allowed for LANMAN dialects */
733 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
735 sess_data->iov[2].iov_len = (long) bcc_ptr -
736 (long) sess_data->iov[2].iov_base;
738 rc = sess_sendreceive(sess_data);
742 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
743 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
745 /* lanman response has a word count of 3 */
746 if (smb_buf->WordCount != 3) {
748 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
752 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
753 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
755 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
756 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
758 bytes_remaining = get_bcc(smb_buf);
759 bcc_ptr = pByteArea(smb_buf);
761 /* BB check if Unicode and decode strings */
762 if (bytes_remaining == 0) {
763 /* no string area to decode, do nothing */
764 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
765 /* unicode string area must be word-aligned */
766 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
770 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
773 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
777 rc = sess_establish_session(sess_data);
779 sess_data->result = rc;
780 sess_data->func = NULL;
781 sess_free_buffer(sess_data);
787 sess_auth_ntlm(struct sess_data *sess_data)
790 struct smb_hdr *smb_buf;
791 SESSION_SETUP_ANDX *pSMB;
793 struct cifs_ses *ses = sess_data->ses;
795 __u16 bytes_remaining;
797 /* old style NTLM sessionsetup */
799 rc = sess_alloc_buffer(sess_data, 13);
803 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
804 bcc_ptr = sess_data->iov[2].iov_base;
805 capabilities = cifs_ssetup_hdr(ses, pSMB);
807 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
808 if (ses->user_name != NULL) {
809 pSMB->req_no_secext.CaseInsensitivePasswordLength =
810 cpu_to_le16(CIFS_AUTH_RESP_SIZE);
811 pSMB->req_no_secext.CaseSensitivePasswordLength =
812 cpu_to_le16(CIFS_AUTH_RESP_SIZE);
814 /* calculate ntlm response and session key */
815 rc = setup_ntlm_response(ses, sess_data->nls_cp);
817 cifs_dbg(VFS, "Error %d during NTLM authentication\n",
822 /* copy ntlm response */
823 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
824 CIFS_AUTH_RESP_SIZE);
825 bcc_ptr += CIFS_AUTH_RESP_SIZE;
826 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
827 CIFS_AUTH_RESP_SIZE);
828 bcc_ptr += CIFS_AUTH_RESP_SIZE;
830 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
831 pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
834 if (ses->capabilities & CAP_UNICODE) {
835 /* unicode strings must be word aligned */
836 if (sess_data->iov[0].iov_len % 2) {
840 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
842 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
846 sess_data->iov[2].iov_len = (long) bcc_ptr -
847 (long) sess_data->iov[2].iov_base;
849 rc = sess_sendreceive(sess_data);
853 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
854 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
856 if (smb_buf->WordCount != 3) {
858 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
862 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
863 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
865 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
866 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
868 bytes_remaining = get_bcc(smb_buf);
869 bcc_ptr = pByteArea(smb_buf);
871 /* BB check if Unicode and decode strings */
872 if (bytes_remaining == 0) {
873 /* no string area to decode, do nothing */
874 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
875 /* unicode string area must be word-aligned */
876 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
880 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
883 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
887 rc = sess_establish_session(sess_data);
889 sess_data->result = rc;
890 sess_data->func = NULL;
891 sess_free_buffer(sess_data);
892 kfree(ses->auth_key.response);
893 ses->auth_key.response = NULL;
897 sess_auth_ntlmv2(struct sess_data *sess_data)
900 struct smb_hdr *smb_buf;
901 SESSION_SETUP_ANDX *pSMB;
903 struct cifs_ses *ses = sess_data->ses;
905 __u16 bytes_remaining;
907 /* old style NTLM sessionsetup */
909 rc = sess_alloc_buffer(sess_data, 13);
913 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
914 bcc_ptr = sess_data->iov[2].iov_base;
915 capabilities = cifs_ssetup_hdr(ses, pSMB);
917 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
919 /* LM2 password would be here if we supported it */
920 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
922 if (ses->user_name != NULL) {
923 /* calculate nlmv2 response and session key */
924 rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
926 cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
930 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
931 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
932 bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
934 /* set case sensitive password length after tilen may get
935 * assigned, tilen is 0 otherwise.
937 pSMB->req_no_secext.CaseSensitivePasswordLength =
938 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
940 pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
943 if (ses->capabilities & CAP_UNICODE) {
944 if (sess_data->iov[0].iov_len % 2) {
948 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
950 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
954 sess_data->iov[2].iov_len = (long) bcc_ptr -
955 (long) sess_data->iov[2].iov_base;
957 rc = sess_sendreceive(sess_data);
961 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
962 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
964 if (smb_buf->WordCount != 3) {
966 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
970 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
971 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
973 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
974 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
976 bytes_remaining = get_bcc(smb_buf);
977 bcc_ptr = pByteArea(smb_buf);
979 /* BB check if Unicode and decode strings */
980 if (bytes_remaining == 0) {
981 /* no string area to decode, do nothing */
982 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
983 /* unicode string area must be word-aligned */
984 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
988 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
991 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
995 rc = sess_establish_session(sess_data);
997 sess_data->result = rc;
998 sess_data->func = NULL;
999 sess_free_buffer(sess_data);
1000 kfree(ses->auth_key.response);
1001 ses->auth_key.response = NULL;
1004 #ifdef CONFIG_CIFS_UPCALL
1006 sess_auth_kerberos(struct sess_data *sess_data)
1009 struct smb_hdr *smb_buf;
1010 SESSION_SETUP_ANDX *pSMB;
1012 struct cifs_ses *ses = sess_data->ses;
1014 __u16 bytes_remaining;
1015 struct key *spnego_key = NULL;
1016 struct cifs_spnego_msg *msg;
1019 /* extended security */
1021 rc = sess_alloc_buffer(sess_data, 12);
1025 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1026 bcc_ptr = sess_data->iov[2].iov_base;
1027 capabilities = cifs_ssetup_hdr(ses, pSMB);
1029 spnego_key = cifs_get_spnego_key(ses);
1030 if (IS_ERR(spnego_key)) {
1031 rc = PTR_ERR(spnego_key);
1036 msg = spnego_key->payload.data[0];
1038 * check version field to make sure that cifs.upcall is
1039 * sending us a response in an expected form
1041 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1043 "incorrect version of cifs.upcall (expected %d but got %d)",
1044 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1046 goto out_put_spnego_key;
1049 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1051 if (!ses->auth_key.response) {
1052 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory",
1055 goto out_put_spnego_key;
1057 ses->auth_key.len = msg->sesskey_len;
1059 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1060 capabilities |= CAP_EXTENDED_SECURITY;
1061 pSMB->req.Capabilities = cpu_to_le32(capabilities);
1062 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1063 sess_data->iov[1].iov_len = msg->secblob_len;
1064 pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1066 if (ses->capabilities & CAP_UNICODE) {
1067 /* unicode strings must be word aligned */
1068 if ((sess_data->iov[0].iov_len
1069 + sess_data->iov[1].iov_len) % 2) {
1073 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1074 unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1076 /* BB: is this right? */
1077 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1080 sess_data->iov[2].iov_len = (long) bcc_ptr -
1081 (long) sess_data->iov[2].iov_base;
1083 rc = sess_sendreceive(sess_data);
1085 goto out_put_spnego_key;
1087 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1088 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1090 if (smb_buf->WordCount != 4) {
1092 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1093 goto out_put_spnego_key;
1096 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1097 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1099 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1100 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1102 bytes_remaining = get_bcc(smb_buf);
1103 bcc_ptr = pByteArea(smb_buf);
1105 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1106 if (blob_len > bytes_remaining) {
1107 cifs_dbg(VFS, "bad security blob length %d\n",
1110 goto out_put_spnego_key;
1112 bcc_ptr += blob_len;
1113 bytes_remaining -= blob_len;
1115 /* BB check if Unicode and decode strings */
1116 if (bytes_remaining == 0) {
1117 /* no string area to decode, do nothing */
1118 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1119 /* unicode string area must be word-aligned */
1120 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1124 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1127 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1131 rc = sess_establish_session(sess_data);
1133 key_invalidate(spnego_key);
1134 key_put(spnego_key);
1136 sess_data->result = rc;
1137 sess_data->func = NULL;
1138 sess_free_buffer(sess_data);
1139 kfree(ses->auth_key.response);
1140 ses->auth_key.response = NULL;
1143 #endif /* ! CONFIG_CIFS_UPCALL */
1146 * The required kvec buffers have to be allocated before calling this
1150 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1152 struct smb_hdr *smb_buf;
1153 SESSION_SETUP_ANDX *pSMB;
1154 struct cifs_ses *ses = sess_data->ses;
1158 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1159 smb_buf = (struct smb_hdr *)pSMB;
1161 capabilities = cifs_ssetup_hdr(ses, pSMB);
1162 if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) {
1163 cifs_dbg(VFS, "NTLMSSP requires Unicode support\n");
1167 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1168 capabilities |= CAP_EXTENDED_SECURITY;
1169 pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1171 bcc_ptr = sess_data->iov[2].iov_base;
1172 /* unicode strings must be word aligned */
1173 if ((sess_data->iov[0].iov_len + sess_data->iov[1].iov_len) % 2) {
1177 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1179 sess_data->iov[2].iov_len = (long) bcc_ptr -
1180 (long) sess_data->iov[2].iov_base;
1186 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1189 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1192 struct smb_hdr *smb_buf;
1193 SESSION_SETUP_ANDX *pSMB;
1194 struct cifs_ses *ses = sess_data->ses;
1195 __u16 bytes_remaining;
1199 cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1202 * if memory allocation is successful, caller of this function
1205 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1206 if (!ses->ntlmssp) {
1210 ses->ntlmssp->sesskey_per_smbsess = false;
1213 rc = sess_alloc_buffer(sess_data, 12);
1217 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1219 /* Build security blob before we assemble the request */
1220 build_ntlmssp_negotiate_blob(pSMB->req.SecurityBlob, ses);
1221 sess_data->iov[1].iov_len = sizeof(NEGOTIATE_MESSAGE);
1222 sess_data->iov[1].iov_base = pSMB->req.SecurityBlob;
1223 pSMB->req.SecurityBlobLength = cpu_to_le16(sizeof(NEGOTIATE_MESSAGE));
1225 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1229 rc = sess_sendreceive(sess_data);
1231 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1232 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1234 /* If true, rc here is expected and not an error */
1235 if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1236 smb_buf->Status.CifsError ==
1237 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1243 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1245 if (smb_buf->WordCount != 4) {
1247 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1251 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1252 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1254 bytes_remaining = get_bcc(smb_buf);
1255 bcc_ptr = pByteArea(smb_buf);
1257 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1258 if (blob_len > bytes_remaining) {
1259 cifs_dbg(VFS, "bad security blob length %d\n",
1265 rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1267 sess_free_buffer(sess_data);
1270 sess_data->func = sess_auth_rawntlmssp_authenticate;
1274 /* Else error. Cleanup */
1275 kfree(ses->auth_key.response);
1276 ses->auth_key.response = NULL;
1277 kfree(ses->ntlmssp);
1278 ses->ntlmssp = NULL;
1280 sess_data->func = NULL;
1281 sess_data->result = rc;
1285 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1288 struct smb_hdr *smb_buf;
1289 SESSION_SETUP_ANDX *pSMB;
1290 struct cifs_ses *ses = sess_data->ses;
1291 __u16 bytes_remaining;
1293 unsigned char *ntlmsspblob = NULL;
1296 cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1299 rc = sess_alloc_buffer(sess_data, 12);
1303 /* Build security blob before we assemble the request */
1304 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1305 smb_buf = (struct smb_hdr *)pSMB;
1306 rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1307 &blob_len, ses, sess_data->nls_cp);
1309 goto out_free_ntlmsspblob;
1310 sess_data->iov[1].iov_len = blob_len;
1311 sess_data->iov[1].iov_base = ntlmsspblob;
1312 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1314 * Make sure that we tell the server that we are using
1315 * the uid that it just gave us back on the response
1318 smb_buf->Uid = ses->Suid;
1320 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1322 goto out_free_ntlmsspblob;
1324 rc = sess_sendreceive(sess_data);
1326 goto out_free_ntlmsspblob;
1328 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1329 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1330 if (smb_buf->WordCount != 4) {
1332 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1333 goto out_free_ntlmsspblob;
1336 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1337 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1339 if (ses->Suid != smb_buf->Uid) {
1340 ses->Suid = smb_buf->Uid;
1341 cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1344 bytes_remaining = get_bcc(smb_buf);
1345 bcc_ptr = pByteArea(smb_buf);
1346 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1347 if (blob_len > bytes_remaining) {
1348 cifs_dbg(VFS, "bad security blob length %d\n",
1351 goto out_free_ntlmsspblob;
1353 bcc_ptr += blob_len;
1354 bytes_remaining -= blob_len;
1357 /* BB check if Unicode and decode strings */
1358 if (bytes_remaining == 0) {
1359 /* no string area to decode, do nothing */
1360 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1361 /* unicode string area must be word-aligned */
1362 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
1366 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1369 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1373 out_free_ntlmsspblob:
1376 sess_free_buffer(sess_data);
1379 rc = sess_establish_session(sess_data);
1382 kfree(ses->auth_key.response);
1383 ses->auth_key.response = NULL;
1384 kfree(ses->ntlmssp);
1385 ses->ntlmssp = NULL;
1387 sess_data->func = NULL;
1388 sess_data->result = rc;
1391 static int select_sec(struct cifs_ses *ses, struct sess_data *sess_data)
1395 type = select_sectype(ses->server, ses->sectype);
1396 cifs_dbg(FYI, "sess setup type %d\n", type);
1397 if (type == Unspecified) {
1399 "Unable to select appropriate authentication method!");
1405 /* LANMAN and plaintext are less secure and off by default.
1406 * So we make this explicitly be turned on in kconfig (in the
1407 * build) and turned on at runtime (changed from the default)
1408 * in proc/fs/cifs or via mount parm. Unfortunately this is
1409 * needed for old Win (e.g. Win95), some obscure NAS and OS/2 */
1410 #ifdef CONFIG_CIFS_WEAK_PW_HASH
1411 sess_data->func = sess_auth_lanman;
1417 sess_data->func = sess_auth_ntlm;
1420 sess_data->func = sess_auth_ntlmv2;
1423 #ifdef CONFIG_CIFS_UPCALL
1424 sess_data->func = sess_auth_kerberos;
1427 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1430 #endif /* CONFIG_CIFS_UPCALL */
1432 sess_data->func = sess_auth_rawntlmssp_negotiate;
1435 cifs_dbg(VFS, "secType %d not supported!\n", type);
1442 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
1443 const struct nls_table *nls_cp)
1446 struct sess_data *sess_data;
1449 WARN(1, "%s: ses == NULL!", __func__);
1453 sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
1457 rc = select_sec(ses, sess_data);
1461 sess_data->xid = xid;
1462 sess_data->ses = ses;
1463 sess_data->buf0_type = CIFS_NO_BUFFER;
1464 sess_data->nls_cp = (struct nls_table *) nls_cp;
1466 while (sess_data->func)
1467 sess_data->func(sess_data);
1469 /* Store result before we free sess_data */
1470 rc = sess_data->result;