smb/client/sess.c

   1 // SPDX-License-Identifier: LGPL-2.1
   2 /*
   3  *
   4  *   SMB/CIFS session setup handling routines
   5  *
   6  *   Copyright (c) International Business Machines  Corp., 2006, 2009
   7  *   Author(s): Steve French (sfrench@us.ibm.com)
   8  *
   9  */
  10
  11 #include "cifspdu.h"
  12 #include "cifsglob.h"
  13 #include "cifsproto.h"
  14 #include "cifs_unicode.h"
  15 #include "cifs_debug.h"
  16 #include "ntlmssp.h"
  17 #include "nterr.h"
  18 #include <linux/utsname.h>
  19 #include <linux/slab.h>
  20 #include <linux/version.h>
  21 #include "cifsfs.h"
  22 #include "cifs_spnego.h"
  23 #include "smb2proto.h"
  24 #include "fs_context.h"
  25
  26 static int
  27 cifs_ses_add_channel(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses,
  28                      struct cifs_server_iface *iface);
  29
  30 bool
  31 is_server_using_iface(struct TCP_Server_Info *server,
  32                       struct cifs_server_iface *iface)
  33 {
  34         struct sockaddr_in *i4 = (struct sockaddr_in *)&iface->sockaddr;
  35         struct sockaddr_in6 *i6 = (struct sockaddr_in6 *)&iface->sockaddr;
  36         struct sockaddr_in *s4 = (struct sockaddr_in *)&server->dstaddr;
  37         struct sockaddr_in6 *s6 = (struct sockaddr_in6 *)&server->dstaddr;
  38
  39         if (server->dstaddr.ss_family != iface->sockaddr.ss_family)
  40                 return false;
  41         if (server->dstaddr.ss_family == AF_INET) {
  42                 if (s4->sin_addr.s_addr != i4->sin_addr.s_addr)
  43                         return false;
  44         } else if (server->dstaddr.ss_family == AF_INET6) {
  45                 if (memcmp(&s6->sin6_addr, &i6->sin6_addr,
  46                            sizeof(i6->sin6_addr)) != 0)
  47                         return false;
  48         } else {
  49                 /* unknown family.. */
  50                 return false;
  51         }
  52         return true;
  53 }
  54
  55 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
  56 {
  57         int i;
  58
  59         spin_lock(&ses->chan_lock);
  60         for (i = 0; i < ses->chan_count; i++) {
  61                 if (ses->chans[i].iface == iface) {
  62                         spin_unlock(&ses->chan_lock);
  63                         return true;
  64                 }
  65         }
  66         spin_unlock(&ses->chan_lock);
  67         return false;
  68 }
  69
  70 /* channel helper functions. assumed that chan_lock is held by caller. */
  71
  72 unsigned int
  73 cifs_ses_get_chan_index(struct cifs_ses *ses,
  74                         struct TCP_Server_Info *server)
  75 {
  76         unsigned int i;
  77
  78         for (i = 0; i < ses->chan_count; i++) {
  79                 if (ses->chans[i].server == server)
  80                         return i;
  81         }
  82
  83         /* If we didn't find the channel, it is likely a bug */
  84         if (server)
  85                 cifs_dbg(VFS, "unable to get chan index for server: 0x%llx",
  86                          server->conn_id);
  87         WARN_ON(1);
  88         return 0;
  89 }
  90
  91 void
  92 cifs_chan_set_in_reconnect(struct cifs_ses *ses,
  93                              struct TCP_Server_Info *server)
  94 {
  95         unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
  96
  97         ses->chans[chan_index].in_reconnect = true;
  98 }
  99
 100 void
 101 cifs_chan_clear_in_reconnect(struct cifs_ses *ses,
 102                              struct TCP_Server_Info *server)
 103 {
 104         unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
 105
 106         ses->chans[chan_index].in_reconnect = false;
 107 }
 108
 109 bool
 110 cifs_chan_in_reconnect(struct cifs_ses *ses,
 111                           struct TCP_Server_Info *server)
 112 {
 113         unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
 114
 115         return CIFS_CHAN_IN_RECONNECT(ses, chan_index);
 116 }
 117
 118 void
 119 cifs_chan_set_need_reconnect(struct cifs_ses *ses,
 120                              struct TCP_Server_Info *server)
 121 {
 122         unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
 123
 124         set_bit(chan_index, &ses->chans_need_reconnect);
 125         cifs_dbg(FYI, "Set reconnect bitmask for chan %u; now 0x%lx\n",
 126                  chan_index, ses->chans_need_reconnect);
 127 }
 128
 129 void
 130 cifs_chan_clear_need_reconnect(struct cifs_ses *ses,
 131                                struct TCP_Server_Info *server)
 132 {
 133         unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
 134
 135         clear_bit(chan_index, &ses->chans_need_reconnect);
 136         cifs_dbg(FYI, "Cleared reconnect bitmask for chan %u; now 0x%lx\n",
 137                  chan_index, ses->chans_need_reconnect);
 138 }
 139
 140 bool
 141 cifs_chan_needs_reconnect(struct cifs_ses *ses,
 142                           struct TCP_Server_Info *server)
 143 {
 144         unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
 145
 146         return CIFS_CHAN_NEEDS_RECONNECT(ses, chan_index);
 147 }
 148
 149 bool
 150 cifs_chan_is_iface_active(struct cifs_ses *ses,
 151                           struct TCP_Server_Info *server)
 152 {
 153         unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
 154
 155         return ses->chans[chan_index].iface &&
 156                 ses->chans[chan_index].iface->is_active;
 157 }
 158
 159 /* returns number of channels added */
 160 int cifs_try_adding_channels(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses)
 161 {
 162         struct TCP_Server_Info *server = ses->server;
 163         int old_chan_count, new_chan_count;
 164         int left;
 165         int rc = 0;
 166         int tries = 0;
 167         size_t iface_weight = 0, iface_min_speed = 0;
 168         struct cifs_server_iface *iface = NULL, *niface = NULL;
 169         struct cifs_server_iface *last_iface = NULL;
 170
 171         spin_lock(&ses->chan_lock);
 172
 173         new_chan_count = old_chan_count = ses->chan_count;
 174         left = ses->chan_max - ses->chan_count;
 175
 176         if (left <= 0) {
 177                 spin_unlock(&ses->chan_lock);
 178                 cifs_dbg(FYI,
 179                          "ses already at max_channels (%zu), nothing to open\n",
 180                          ses->chan_max);
 181                 return 0;
 182         }
 183
 184         if (server->dialect < SMB30_PROT_ID) {
 185                 spin_unlock(&ses->chan_lock);
 186                 cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
 187                 return 0;
 188         }
 189
 190         if (!(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
 191                 spin_unlock(&ses->chan_lock);
 192                 cifs_server_dbg(VFS, "no multichannel support\n");
 193                 return 0;
 194         }
 195         spin_unlock(&ses->chan_lock);
 196
 197         while (left > 0) {
 198
 199                 tries++;
 200                 if (tries > 3*ses->chan_max) {
 201                         cifs_dbg(VFS, "too many channel open attempts (%d channels left to open)\n",
 202                                  left);
 203                         break;
 204                 }
 205
 206                 spin_lock(&ses->iface_lock);
 207                 if (!ses->iface_count) {
 208                         spin_unlock(&ses->iface_lock);
 209                         cifs_dbg(VFS, "server %s does not advertise interfaces\n",
 210                                       ses->server->hostname);
 211                         break;
 212                 }
 213
 214                 if (!iface)
 215                         iface = list_first_entry(&ses->iface_list, struct cifs_server_iface,
 216                                                  iface_head);
 217                 last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
 218                                              iface_head);
 219                 iface_min_speed = last_iface->speed;
 220
 221                 list_for_each_entry_safe_from(iface, niface, &ses->iface_list,
 222                                     iface_head) {
 223                         /* do not mix rdma and non-rdma interfaces */
 224                         if (iface->rdma_capable != ses->server->rdma)
 225                                 continue;
 226
 227                         /* skip ifaces that are unusable */
 228                         if (!iface->is_active ||
 229                             (is_ses_using_iface(ses, iface) &&
 230                              !iface->rss_capable))
 231                                 continue;
 232
 233                         /* check if we already allocated enough channels */
 234                         iface_weight = iface->speed / iface_min_speed;
 235
 236                         if (iface->weight_fulfilled >= iface_weight)
 237                                 continue;
 238
 239                         /* take ref before unlock */
 240                         kref_get(&iface->refcount);
 241
 242                         spin_unlock(&ses->iface_lock);
 243                         rc = cifs_ses_add_channel(cifs_sb, ses, iface);
 244                         spin_lock(&ses->iface_lock);
 245
 246                         if (rc) {
 247                                 cifs_dbg(VFS, "failed to open extra channel on iface:%pIS rc=%d\n",
 248                                          &iface->sockaddr,
 249                                          rc);
 250                                 kref_put(&iface->refcount, release_iface);
 251                                 /* failure to add chan should increase weight */
 252                                 iface->weight_fulfilled++;
 253                                 continue;
 254                         }
 255
 256                         iface->num_channels++;
 257                         iface->weight_fulfilled++;
 258                         cifs_dbg(VFS, "successfully opened new channel on iface:%pIS\n",
 259                                  &iface->sockaddr);
 260                         break;
 261                 }
 262
 263                 /* reached end of list. reset weight_fulfilled and start over */
 264                 if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
 265                         list_for_each_entry(iface, &ses->iface_list, iface_head)
 266                                 iface->weight_fulfilled = 0;
 267                         spin_unlock(&ses->iface_lock);
 268                         iface = NULL;
 269                         continue;
 270                 }
 271                 spin_unlock(&ses->iface_lock);
 272
 273                 left--;
 274                 new_chan_count++;
 275         }
 276
 277         return new_chan_count - old_chan_count;
 278 }
 279
 280 /*
 281  * update the iface for the channel if necessary.
 282  * will return 0 when iface is updated, 1 if removed, 2 otherwise
 283  * Must be called with chan_lock held.
 284  */
 285 int
 286 cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server)
 287 {
 288         unsigned int chan_index;
 289         size_t iface_weight = 0, iface_min_speed = 0;
 290         struct cifs_server_iface *iface = NULL;
 291         struct cifs_server_iface *old_iface = NULL;
 292         struct cifs_server_iface *last_iface = NULL;
 293         struct sockaddr_storage ss;
 294         int rc = 0;
 295
 296         spin_lock(&ses->chan_lock);
 297         chan_index = cifs_ses_get_chan_index(ses, server);
 298         if (!chan_index) {
 299                 spin_unlock(&ses->chan_lock);
 300                 return 0;
 301         }
 302
 303         if (ses->chans[chan_index].iface) {
 304                 old_iface = ses->chans[chan_index].iface;
 305                 if (old_iface->is_active) {
 306                         spin_unlock(&ses->chan_lock);
 307                         return 1;
 308                 }
 309         }
 310         spin_unlock(&ses->chan_lock);
 311
 312         spin_lock(&server->srv_lock);
 313         ss = server->dstaddr;
 314         spin_unlock(&server->srv_lock);
 315
 316         spin_lock(&ses->iface_lock);
 317         if (!ses->iface_count) {
 318                 spin_unlock(&ses->iface_lock);
 319                 cifs_dbg(VFS, "server %s does not advertise interfaces\n", ses->server->hostname);
 320                 return 0;
 321         }
 322
 323         last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
 324                                      iface_head);
 325         iface_min_speed = last_iface->speed;
 326
 327         /* then look for a new one */
 328         list_for_each_entry(iface, &ses->iface_list, iface_head) {
 329                 if (!chan_index) {
 330                         /* if we're trying to get the updated iface for primary channel */
 331                         if (!cifs_match_ipaddr((struct sockaddr *) &ss,
 332                                                (struct sockaddr *) &iface->sockaddr))
 333                                 continue;
 334
 335                         kref_get(&iface->refcount);
 336                         break;
 337                 }
 338
 339                 /* do not mix rdma and non-rdma interfaces */
 340                 if (iface->rdma_capable != server->rdma)
 341                         continue;
 342
 343                 if (!iface->is_active ||
 344                     (is_ses_using_iface(ses, iface) &&
 345                      !iface->rss_capable)) {
 346                         continue;
 347                 }
 348
 349                 /* check if we already allocated enough channels */
 350                 iface_weight = iface->speed / iface_min_speed;
 351
 352                 if (iface->weight_fulfilled >= iface_weight)
 353                         continue;
 354
 355                 kref_get(&iface->refcount);
 356                 break;
 357         }
 358
 359         if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
 360                 rc = 1;
 361                 iface = NULL;
 362                 cifs_dbg(FYI, "unable to find a suitable iface\n");
 363         }
 364
 365         if (!chan_index && !iface) {
 366                 cifs_dbg(FYI, "unable to get the interface matching: %pIS\n",
 367                          &ss);
 368                 spin_unlock(&ses->iface_lock);
 369                 return 0;
 370         }
 371
 372         /* now drop the ref to the current iface */
 373         if (old_iface && iface) {
 374                 cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n",
 375                          &old_iface->sockaddr,
 376                          &iface->sockaddr);
 377
 378                 old_iface->num_channels--;
 379                 if (old_iface->weight_fulfilled)
 380                         old_iface->weight_fulfilled--;
 381                 iface->num_channels++;
 382                 iface->weight_fulfilled++;
 383
 384                 kref_put(&old_iface->refcount, release_iface);
 385         } else if (old_iface) {
 386                 cifs_dbg(FYI, "releasing ref to iface: %pIS\n",
 387                          &old_iface->sockaddr);
 388
 389                 old_iface->num_channels--;
 390                 if (old_iface->weight_fulfilled)
 391                         old_iface->weight_fulfilled--;
 392
 393                 kref_put(&old_iface->refcount, release_iface);
 394         } else if (!chan_index) {
 395                 /* special case: update interface for primary channel */
 396                 cifs_dbg(FYI, "referencing primary channel iface: %pIS\n",
 397                          &iface->sockaddr);
 398                 iface->num_channels++;
 399                 iface->weight_fulfilled++;
 400         } else {
 401                 WARN_ON(!iface);
 402                 cifs_dbg(FYI, "adding new iface: %pIS\n", &iface->sockaddr);
 403         }
 404         spin_unlock(&ses->iface_lock);
 405
 406         spin_lock(&ses->chan_lock);
 407         chan_index = cifs_ses_get_chan_index(ses, server);
 408         ses->chans[chan_index].iface = iface;
 409
 410         /* No iface is found. if secondary chan, drop connection */
 411         if (!iface && CIFS_SERVER_IS_CHAN(server))
 412                 ses->chans[chan_index].server = NULL;
 413
 414         spin_unlock(&ses->chan_lock);
 415
 416         if (!iface && CIFS_SERVER_IS_CHAN(server))
 417                 cifs_put_tcp_session(server, false);
 418
 419         return rc;
 420 }
 421
 422 /*
 423  * If server is a channel of ses, return the corresponding enclosing
 424  * cifs_chan otherwise return NULL.
 425  */
 426 struct cifs_chan *
 427 cifs_ses_find_chan(struct cifs_ses *ses, struct TCP_Server_Info *server)
 428 {
 429         int i;
 430
 431         spin_lock(&ses->chan_lock);
 432         for (i = 0; i < ses->chan_count; i++) {
 433                 if (ses->chans[i].server == server) {
 434                         spin_unlock(&ses->chan_lock);
 435                         return &ses->chans[i];
 436                 }
 437         }
 438         spin_unlock(&ses->chan_lock);
 439         return NULL;
 440 }
 441
 442 static int
 443 cifs_ses_add_channel(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses,
 444                      struct cifs_server_iface *iface)
 445 {
 446         struct TCP_Server_Info *chan_server;
 447         struct cifs_chan *chan;
 448         struct smb3_fs_context ctx = {NULL};
 449         static const char unc_fmt[] = "\\%s\\foo";
 450         char unc[sizeof(unc_fmt)+SERVER_NAME_LEN_WITH_NULL] = {0};
 451         struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
 452         struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
 453         int rc;
 454         unsigned int xid = get_xid();
 455
 456         if (iface->sockaddr.ss_family == AF_INET)
 457                 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
 458                          ses, iface->speed, iface->rdma_capable ? "yes" : "no",
 459                          &ipv4->sin_addr);
 460         else
 461                 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI6)\n",
 462                          ses, iface->speed, iface->rdma_capable ? "yes" : "no",
 463                          &ipv6->sin6_addr);
 464
 465         /*
 466          * Setup a ctx with mostly the same info as the existing
 467          * session and overwrite it with the requested iface data.
 468          *
 469          * We need to setup at least the fields used for negprot and
 470          * sesssetup.
 471          *
 472          * We only need the ctx here, so we can reuse memory from
 473          * the session and server without caring about memory
 474          * management.
 475          */
 476
 477         /* Always make new connection for now (TODO?) */
 478         ctx.nosharesock = true;
 479
 480         /* Auth */
 481         ctx.domainauto = ses->domainAuto;
 482         ctx.domainname = ses->domainName;
 483
 484         /* no hostname for extra channels */
 485         ctx.server_hostname = "";
 486
 487         ctx.username = ses->user_name;
 488         ctx.password = ses->password;
 489         ctx.sectype = ses->sectype;
 490         ctx.sign = ses->sign;
 491
 492         /* UNC and paths */
 493         /* XXX: Use ses->server->hostname? */
 494         sprintf(unc, unc_fmt, ses->ip_addr);
 495         ctx.UNC = unc;
 496         ctx.prepath = "";
 497
 498         /* Reuse same version as master connection */
 499         ctx.vals = ses->server->vals;
 500         ctx.ops = ses->server->ops;
 501
 502         ctx.noblocksnd = ses->server->noblocksnd;
 503         ctx.noautotune = ses->server->noautotune;
 504         ctx.sockopt_tcp_nodelay = ses->server->tcp_nodelay;
 505         ctx.echo_interval = ses->server->echo_interval / HZ;
 506         ctx.max_credits = ses->server->max_credits;
 507
 508         /*
 509          * This will be used for encoding/decoding user/domain/pw
 510          * during sess setup auth.
 511          */
 512         ctx.local_nls = cifs_sb->local_nls;
 513
 514         /* Use RDMA if possible */
 515         ctx.rdma = iface->rdma_capable;
 516         memcpy(&ctx.dstaddr, &iface->sockaddr, sizeof(struct sockaddr_storage));
 517
 518         /* reuse master con client guid */
 519         memcpy(&ctx.client_guid, ses->server->client_guid,
 520                SMB2_CLIENT_GUID_SIZE);
 521         ctx.use_client_guid = true;
 522
 523         chan_server = cifs_get_tcp_session(&ctx, ses->server);
 524
 525         spin_lock(&ses->chan_lock);
 526         chan = &ses->chans[ses->chan_count];
 527         chan->server = chan_server;
 528         if (IS_ERR(chan->server)) {
 529                 rc = PTR_ERR(chan->server);
 530                 chan->server = NULL;
 531                 spin_unlock(&ses->chan_lock);
 532                 goto out;
 533         }
 534         chan->iface = iface;
 535         ses->chan_count++;
 536         atomic_set(&ses->chan_seq, 0);
 537
 538         /* Mark this channel as needing connect/setup */
 539         cifs_chan_set_need_reconnect(ses, chan->server);
 540
 541         spin_unlock(&ses->chan_lock);
 542
 543         mutex_lock(&ses->session_mutex);
 544         /*
 545          * We need to allocate the server crypto now as we will need
 546          * to sign packets before we generate the channel signing key
 547          * (we sign with the session key)
 548          */
 549         rc = smb311_crypto_shash_allocate(chan->server);
 550         if (rc) {
 551                 cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
 552                 mutex_unlock(&ses->session_mutex);
 553                 goto out;
 554         }
 555
 556         rc = cifs_negotiate_protocol(xid, ses, chan->server);
 557         if (!rc)
 558                 rc = cifs_setup_session(xid, ses, chan->server, cifs_sb->local_nls);
 559
 560         mutex_unlock(&ses->session_mutex);
 561
 562 out:
 563         if (rc && chan->server) {
 564                 /*
 565                  * we should avoid race with these delayed works before we
 566                  * remove this channel
 567                  */
 568                 cancel_delayed_work_sync(&chan->server->echo);
 569                 cancel_delayed_work_sync(&chan->server->resolve);
 570                 cancel_delayed_work_sync(&chan->server->reconnect);
 571
 572                 spin_lock(&ses->chan_lock);
 573                 /* we rely on all bits beyond chan_count to be clear */
 574                 cifs_chan_clear_need_reconnect(ses, chan->server);
 575                 ses->chan_count--;
 576                 /*
 577                  * chan_count should never reach 0 as at least the primary
 578                  * channel is always allocated
 579                  */
 580                 WARN_ON(ses->chan_count < 1);
 581                 spin_unlock(&ses->chan_lock);
 582
 583                 cifs_put_tcp_session(chan->server, 0);
 584         }
 585
 586         free_xid(xid);
 587         return rc;
 588 }
 589
 590 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
 591 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses,
 592                              struct TCP_Server_Info *server,
 593                              SESSION_SETUP_ANDX *pSMB)
 594 {
 595         __u32 capabilities = 0;
 596
 597         /* init fields common to all four types of SessSetup */
 598         /* Note that offsets for first seven fields in req struct are same  */
 599         /*      in CIFS Specs so does not matter which of 3 forms of struct */
 600         /*      that we use in next few lines                               */
 601         /* Note that header is initialized to zero in header_assemble */
 602         pSMB->req.AndXCommand = 0xFF;
 603         pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
 604                                         CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
 605                                         USHRT_MAX));
 606         pSMB->req.MaxMpxCount = cpu_to_le16(server->maxReq);
 607         pSMB->req.VcNumber = cpu_to_le16(1);
 608
 609         /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
 610
 611         /* BB verify whether signing required on neg or just on auth frame
 612            (and NTLM case) */
 613
 614         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
 615                         CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
 616
 617         if (server->sign)
 618                 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
 619
 620         if (ses->capabilities & CAP_UNICODE) {
 621                 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
 622                 capabilities |= CAP_UNICODE;
 623         }
 624         if (ses->capabilities & CAP_STATUS32) {
 625                 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
 626                 capabilities |= CAP_STATUS32;
 627         }
 628         if (ses->capabilities & CAP_DFS) {
 629                 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
 630                 capabilities |= CAP_DFS;
 631         }
 632         if (ses->capabilities & CAP_UNIX)
 633                 capabilities |= CAP_UNIX;
 634
 635         return capabilities;
 636 }
 637
 638 static void
 639 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
 640 {
 641         char *bcc_ptr = *pbcc_area;
 642         int bytes_ret = 0;
 643
 644         /* Copy OS version */
 645         bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
 646                                     nls_cp);
 647         bcc_ptr += 2 * bytes_ret;
 648         bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
 649                                     32, nls_cp);
 650         bcc_ptr += 2 * bytes_ret;
 651         bcc_ptr += 2; /* trailing null */
 652
 653         bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
 654                                     32, nls_cp);
 655         bcc_ptr += 2 * bytes_ret;
 656         bcc_ptr += 2; /* trailing null */
 657
 658         *pbcc_area = bcc_ptr;
 659 }
 660
 661 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
 662                                    const struct nls_table *nls_cp)
 663 {
 664         char *bcc_ptr = *pbcc_area;
 665         int bytes_ret = 0;
 666
 667         /* copy domain */
 668         if (ses->domainName == NULL) {
 669                 /* Sending null domain better than using a bogus domain name (as
 670                 we did briefly in 2.6.18) since server will use its default */
 671                 *bcc_ptr = 0;
 672                 *(bcc_ptr+1) = 0;
 673                 bytes_ret = 0;
 674         } else
 675                 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
 676                                             CIFS_MAX_DOMAINNAME_LEN, nls_cp);
 677         bcc_ptr += 2 * bytes_ret;
 678         bcc_ptr += 2;  /* account for null terminator */
 679
 680         *pbcc_area = bcc_ptr;
 681 }
 682
 683 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
 684                                    const struct nls_table *nls_cp)
 685 {
 686         char *bcc_ptr = *pbcc_area;
 687         int bytes_ret = 0;
 688
 689         /* BB FIXME add check that strings total less
 690         than 335 or will need to send them as arrays */
 691
 692         /* copy user */
 693         if (ses->user_name == NULL) {
 694                 /* null user mount */
 695                 *bcc_ptr = 0;
 696                 *(bcc_ptr+1) = 0;
 697         } else {
 698                 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
 699                                             CIFS_MAX_USERNAME_LEN, nls_cp);
 700         }
 701         bcc_ptr += 2 * bytes_ret;
 702         bcc_ptr += 2; /* account for null termination */
 703
 704         unicode_domain_string(&bcc_ptr, ses, nls_cp);
 705         unicode_oslm_strings(&bcc_ptr, nls_cp);
 706
 707         *pbcc_area = bcc_ptr;
 708 }
 709
 710 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
 711                                  const struct nls_table *nls_cp)
 712 {
 713         char *bcc_ptr = *pbcc_area;
 714         int len;
 715
 716         /* copy user */
 717         /* BB what about null user mounts - check that we do this BB */
 718         /* copy user */
 719         if (ses->user_name != NULL) {
 720                 len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
 721                 if (WARN_ON_ONCE(len < 0))
 722                         len = CIFS_MAX_USERNAME_LEN - 1;
 723                 bcc_ptr += len;
 724         }
 725         /* else null user mount */
 726         *bcc_ptr = 0;
 727         bcc_ptr++; /* account for null termination */
 728
 729         /* copy domain */
 730         if (ses->domainName != NULL) {
 731                 len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
 732                 if (WARN_ON_ONCE(len < 0))
 733                         len = CIFS_MAX_DOMAINNAME_LEN - 1;
 734                 bcc_ptr += len;
 735         } /* else we will send a null domain name
 736              so the server will default to its own domain */
 737         *bcc_ptr = 0;
 738         bcc_ptr++;
 739
 740         /* BB check for overflow here */
 741
 742         strcpy(bcc_ptr, "Linux version ");
 743         bcc_ptr += strlen("Linux version ");
 744         strcpy(bcc_ptr, init_utsname()->release);
 745         bcc_ptr += strlen(init_utsname()->release) + 1;
 746
 747         strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
 748         bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
 749
 750         *pbcc_area = bcc_ptr;
 751 }
 752
 753 static void
 754 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
 755                       const struct nls_table *nls_cp)
 756 {
 757         int len;
 758         char *data = *pbcc_area;
 759
 760         cifs_dbg(FYI, "bleft %d\n", bleft);
 761
 762         kfree(ses->serverOS);
 763         ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
 764         cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
 765         len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
 766         data += len;
 767         bleft -= len;
 768         if (bleft <= 0)
 769                 return;
 770
 771         kfree(ses->serverNOS);
 772         ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
 773         cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
 774         len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
 775         data += len;
 776         bleft -= len;
 777         if (bleft <= 0)
 778                 return;
 779
 780         kfree(ses->serverDomain);
 781         ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
 782         cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
 783
 784         return;
 785 }
 786
 787 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
 788                                 struct cifs_ses *ses,
 789                                 const struct nls_table *nls_cp)
 790 {
 791         int len;
 792         char *bcc_ptr = *pbcc_area;
 793
 794         cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
 795
 796         len = strnlen(bcc_ptr, bleft);
 797         if (len >= bleft)
 798                 return;
 799
 800         kfree(ses->serverOS);
 801
 802         ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
 803         if (ses->serverOS) {
 804                 memcpy(ses->serverOS, bcc_ptr, len);
 805                 ses->serverOS[len] = 0;
 806                 if (strncmp(ses->serverOS, "OS/2", 4) == 0)
 807                         cifs_dbg(FYI, "OS/2 server\n");
 808         }
 809
 810         bcc_ptr += len + 1;
 811         bleft -= len + 1;
 812
 813         len = strnlen(bcc_ptr, bleft);
 814         if (len >= bleft)
 815                 return;
 816
 817         kfree(ses->serverNOS);
 818
 819         ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
 820         if (ses->serverNOS) {
 821                 memcpy(ses->serverNOS, bcc_ptr, len);
 822                 ses->serverNOS[len] = 0;
 823         }
 824
 825         bcc_ptr += len + 1;
 826         bleft -= len + 1;
 827
 828         len = strnlen(bcc_ptr, bleft);
 829         if (len > bleft)
 830                 return;
 831
 832         /* No domain field in LANMAN case. Domain is
 833            returned by old servers in the SMB negprot response */
 834         /* BB For newer servers which do not support Unicode,
 835            but thus do return domain here we could add parsing
 836            for it later, but it is not very important */
 837         cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
 838 }
 839 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
 840
 841 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
 842                                     struct cifs_ses *ses)
 843 {
 844         unsigned int tioffset; /* challenge message target info area */
 845         unsigned int tilen; /* challenge message target info area length  */
 846         CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
 847         __u32 server_flags;
 848
 849         if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
 850                 cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
 851                 return -EINVAL;
 852         }
 853
 854         if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
 855                 cifs_dbg(VFS, "blob signature incorrect %s\n",
 856                          pblob->Signature);
 857                 return -EINVAL;
 858         }
 859         if (pblob->MessageType != NtLmChallenge) {
 860                 cifs_dbg(VFS, "Incorrect message type %d\n",
 861                          pblob->MessageType);
 862                 return -EINVAL;
 863         }
 864
 865         server_flags = le32_to_cpu(pblob->NegotiateFlags);
 866         cifs_dbg(FYI, "%s: negotiate=0x%08x challenge=0x%08x\n", __func__,
 867                  ses->ntlmssp->client_flags, server_flags);
 868
 869         if ((ses->ntlmssp->client_flags & (NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN)) &&
 870             (!(server_flags & NTLMSSP_NEGOTIATE_56) && !(server_flags & NTLMSSP_NEGOTIATE_128))) {
 871                 cifs_dbg(VFS, "%s: requested signing/encryption but server did not return either 56-bit or 128-bit session key size\n",
 872                          __func__);
 873                 return -EINVAL;
 874         }
 875         if (!(server_flags & NTLMSSP_NEGOTIATE_NTLM) && !(server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) {
 876                 cifs_dbg(VFS, "%s: server does not seem to support either NTLMv1 or NTLMv2\n", __func__);
 877                 return -EINVAL;
 878         }
 879         if (ses->server->sign && !(server_flags & NTLMSSP_NEGOTIATE_SIGN)) {
 880                 cifs_dbg(VFS, "%s: forced packet signing but server does not seem to support it\n",
 881                          __func__);
 882                 return -EOPNOTSUPP;
 883         }
 884         if ((ses->ntlmssp->client_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
 885             !(server_flags & NTLMSSP_NEGOTIATE_KEY_XCH))
 886                 pr_warn_once("%s: authentication has been weakened as server does not support key exchange\n",
 887                              __func__);
 888
 889         ses->ntlmssp->server_flags = server_flags;
 890
 891         memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
 892         /* In particular we can examine sign flags */
 893         /* BB spec says that if AvId field of MsvAvTimestamp is populated then
 894                 we must set the MIC field of the AUTHENTICATE_MESSAGE */
 895
 896         tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
 897         tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
 898         if (tioffset > blob_len || tioffset + tilen > blob_len) {
 899                 cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
 900                          tioffset, tilen);
 901                 return -EINVAL;
 902         }
 903         if (tilen) {
 904                 kfree_sensitive(ses->auth_key.response);
 905                 ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
 906                                                  GFP_KERNEL);
 907                 if (!ses->auth_key.response) {
 908                         cifs_dbg(VFS, "Challenge target info alloc failure\n");
 909                         return -ENOMEM;
 910                 }
 911                 ses->auth_key.len = tilen;
 912         }
 913
 914         return 0;
 915 }
 916
 917 static int size_of_ntlmssp_blob(struct cifs_ses *ses, int base_size)
 918 {
 919         int sz = base_size + ses->auth_key.len
 920                 - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
 921
 922         if (ses->domainName)
 923                 sz += sizeof(__le16) * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
 924         else
 925                 sz += sizeof(__le16);
 926
 927         if (ses->user_name)
 928                 sz += sizeof(__le16) * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
 929         else
 930                 sz += sizeof(__le16);
 931
 932         if (ses->workstation_name[0])
 933                 sz += sizeof(__le16) * strnlen(ses->workstation_name,
 934                                                ntlmssp_workstation_name_size(ses));
 935         else
 936                 sz += sizeof(__le16);
 937
 938         return sz;
 939 }
 940
 941 static inline void cifs_security_buffer_from_str(SECURITY_BUFFER *pbuf,
 942                                                  char *str_value,
 943                                                  int str_length,
 944                                                  unsigned char *pstart,
 945                                                  unsigned char **pcur,
 946                                                  const struct nls_table *nls_cp)
 947 {
 948         unsigned char *tmp = pstart;
 949         int len;
 950
 951         if (!pbuf)
 952                 return;
 953
 954         if (!pcur)
 955                 pcur = &tmp;
 956
 957         if (!str_value) {
 958                 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
 959                 pbuf->Length = 0;
 960                 pbuf->MaximumLength = 0;
 961                 *pcur += sizeof(__le16);
 962         } else {
 963                 len = cifs_strtoUTF16((__le16 *)*pcur,
 964                                       str_value,
 965                                       str_length,
 966                                       nls_cp);
 967                 len *= sizeof(__le16);
 968                 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
 969                 pbuf->Length = cpu_to_le16(len);
 970                 pbuf->MaximumLength = cpu_to_le16(len);
 971                 *pcur += len;
 972         }
 973 }
 974
 975 /* BB Move to ntlmssp.c eventually */
 976
 977 int build_ntlmssp_negotiate_blob(unsigned char **pbuffer,
 978                                  u16 *buflen,
 979                                  struct cifs_ses *ses,
 980                                  struct TCP_Server_Info *server,
 981                                  const struct nls_table *nls_cp)
 982 {
 983         int rc = 0;
 984         NEGOTIATE_MESSAGE *sec_blob;
 985         __u32 flags;
 986         unsigned char *tmp;
 987         int len;
 988
 989         len = size_of_ntlmssp_blob(ses, sizeof(NEGOTIATE_MESSAGE));
 990         *pbuffer = kmalloc(len, GFP_KERNEL);
 991         if (!*pbuffer) {
 992                 rc = -ENOMEM;
 993                 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
 994                 *buflen = 0;
 995                 goto setup_ntlm_neg_ret;
 996         }
 997         sec_blob = (NEGOTIATE_MESSAGE *)*pbuffer;
 998
 999         memset(*pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
1000         memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1001         sec_blob->MessageType = NtLmNegotiate;
1002
1003         /* BB is NTLMV2 session security format easier to use here? */
1004         flags = NTLMSSP_NEGOTIATE_56 |  NTLMSSP_REQUEST_TARGET |
1005                 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1006                 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1007                 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1008                 NTLMSSP_NEGOTIATE_SIGN;
1009         if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1010                 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1011
1012         tmp = *pbuffer + sizeof(NEGOTIATE_MESSAGE);
1013         ses->ntlmssp->client_flags = flags;
1014         sec_blob->NegotiateFlags = cpu_to_le32(flags);
1015
1016         /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1017         cifs_security_buffer_from_str(&sec_blob->DomainName,
1018                                       NULL,
1019                                       CIFS_MAX_DOMAINNAME_LEN,
1020                                       *pbuffer, &tmp,
1021                                       nls_cp);
1022
1023         cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1024                                       NULL,
1025                                       CIFS_MAX_WORKSTATION_LEN,
1026                                       *pbuffer, &tmp,
1027                                       nls_cp);
1028
1029         *buflen = tmp - *pbuffer;
1030 setup_ntlm_neg_ret:
1031         return rc;
1032 }
1033
1034 /*
1035  * Build ntlmssp blob with additional fields, such as version,
1036  * supported by modern servers. For safety limit to SMB3 or later
1037  * See notes in MS-NLMP Section 2.2.2.1 e.g.
1038  */
1039 int build_ntlmssp_smb3_negotiate_blob(unsigned char **pbuffer,
1040                                  u16 *buflen,
1041                                  struct cifs_ses *ses,
1042                                  struct TCP_Server_Info *server,
1043                                  const struct nls_table *nls_cp)
1044 {
1045         int rc = 0;
1046         struct negotiate_message *sec_blob;
1047         __u32 flags;
1048         unsigned char *tmp;
1049         int len;
1050
1051         len = size_of_ntlmssp_blob(ses, sizeof(struct negotiate_message));
1052         *pbuffer = kmalloc(len, GFP_KERNEL);
1053         if (!*pbuffer) {
1054                 rc = -ENOMEM;
1055                 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1056                 *buflen = 0;
1057                 goto setup_ntlm_smb3_neg_ret;
1058         }
1059         sec_blob = (struct negotiate_message *)*pbuffer;
1060
1061         memset(*pbuffer, 0, sizeof(struct negotiate_message));
1062         memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1063         sec_blob->MessageType = NtLmNegotiate;
1064
1065         /* BB is NTLMV2 session security format easier to use here? */
1066         flags = NTLMSSP_NEGOTIATE_56 |  NTLMSSP_REQUEST_TARGET |
1067                 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1068                 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1069                 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1070                 NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_VERSION;
1071         if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1072                 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1073
1074         sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1075         sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1076         sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1077         sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1078
1079         tmp = *pbuffer + sizeof(struct negotiate_message);
1080         ses->ntlmssp->client_flags = flags;
1081         sec_blob->NegotiateFlags = cpu_to_le32(flags);
1082
1083         /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1084         cifs_security_buffer_from_str(&sec_blob->DomainName,
1085                                       NULL,
1086                                       CIFS_MAX_DOMAINNAME_LEN,
1087                                       *pbuffer, &tmp,
1088                                       nls_cp);
1089
1090         cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1091                                       NULL,
1092                                       CIFS_MAX_WORKSTATION_LEN,
1093                                       *pbuffer, &tmp,
1094                                       nls_cp);
1095
1096         *buflen = tmp - *pbuffer;
1097 setup_ntlm_smb3_neg_ret:
1098         return rc;
1099 }
1100
1101
1102 /* See MS-NLMP 2.2.1.3 */
1103 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
1104                                         u16 *buflen,
1105                                    struct cifs_ses *ses,
1106                                    struct TCP_Server_Info *server,
1107                                    const struct nls_table *nls_cp)
1108 {
1109         int rc;
1110         AUTHENTICATE_MESSAGE *sec_blob;
1111         __u32 flags;
1112         unsigned char *tmp;
1113         int len;
1114
1115         rc = setup_ntlmv2_rsp(ses, nls_cp);
1116         if (rc) {
1117                 cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
1118                 *buflen = 0;
1119                 goto setup_ntlmv2_ret;
1120         }
1121
1122         len = size_of_ntlmssp_blob(ses, sizeof(AUTHENTICATE_MESSAGE));
1123         *pbuffer = kmalloc(len, GFP_KERNEL);
1124         if (!*pbuffer) {
1125                 rc = -ENOMEM;
1126                 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1127                 *buflen = 0;
1128                 goto setup_ntlmv2_ret;
1129         }
1130         sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
1131
1132         memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1133         sec_blob->MessageType = NtLmAuthenticate;
1134
1135         flags = ses->ntlmssp->server_flags | NTLMSSP_REQUEST_TARGET |
1136                 NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED;
1137         /* we only send version information in ntlmssp negotiate, so do not set this flag */
1138         flags = flags & ~NTLMSSP_NEGOTIATE_VERSION;
1139         tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
1140         sec_blob->NegotiateFlags = cpu_to_le32(flags);
1141
1142         sec_blob->LmChallengeResponse.BufferOffset =
1143                                 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
1144         sec_blob->LmChallengeResponse.Length = 0;
1145         sec_blob->LmChallengeResponse.MaximumLength = 0;
1146
1147         sec_blob->NtChallengeResponse.BufferOffset =
1148                                 cpu_to_le32(tmp - *pbuffer);
1149         if (ses->user_name != NULL) {
1150                 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1151                                 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1152                 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1153
1154                 sec_blob->NtChallengeResponse.Length =
1155                                 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1156                 sec_blob->NtChallengeResponse.MaximumLength =
1157                                 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1158         } else {
1159                 /*
1160                  * don't send an NT Response for anonymous access
1161                  */
1162                 sec_blob->NtChallengeResponse.Length = 0;
1163                 sec_blob->NtChallengeResponse.MaximumLength = 0;
1164         }
1165
1166         cifs_security_buffer_from_str(&sec_blob->DomainName,
1167                                       ses->domainName,
1168                                       CIFS_MAX_DOMAINNAME_LEN,
1169                                       *pbuffer, &tmp,
1170                                       nls_cp);
1171
1172         cifs_security_buffer_from_str(&sec_blob->UserName,
1173                                       ses->user_name,
1174                                       CIFS_MAX_USERNAME_LEN,
1175                                       *pbuffer, &tmp,
1176                                       nls_cp);
1177
1178         cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1179                                       ses->workstation_name,
1180                                       ntlmssp_workstation_name_size(ses),
1181                                       *pbuffer, &tmp,
1182                                       nls_cp);
1183
1184         if ((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
1185             (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) &&
1186             !calc_seckey(ses)) {
1187                 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
1188                 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1189                 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
1190                 sec_blob->SessionKey.MaximumLength =
1191                                 cpu_to_le16(CIFS_CPHTXT_SIZE);
1192                 tmp += CIFS_CPHTXT_SIZE;
1193         } else {
1194                 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1195                 sec_blob->SessionKey.Length = 0;
1196                 sec_blob->SessionKey.MaximumLength = 0;
1197         }
1198
1199         *buflen = tmp - *pbuffer;
1200 setup_ntlmv2_ret:
1201         return rc;
1202 }
1203
1204 enum securityEnum
1205 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
1206 {
1207         switch (server->negflavor) {
1208         case CIFS_NEGFLAVOR_EXTENDED:
1209                 switch (requested) {
1210                 case Kerberos:
1211                 case RawNTLMSSP:
1212                         return requested;
1213                 case Unspecified:
1214                         if (server->sec_ntlmssp &&
1215                             (global_secflags & CIFSSEC_MAY_NTLMSSP))
1216                                 return RawNTLMSSP;
1217                         if ((server->sec_kerberos || server->sec_mskerberos) &&
1218                             (global_secflags & CIFSSEC_MAY_KRB5))
1219                                 return Kerberos;
1220                         fallthrough;
1221                 default:
1222                         return Unspecified;
1223                 }
1224         case CIFS_NEGFLAVOR_UNENCAP:
1225                 switch (requested) {
1226                 case NTLMv2:
1227                         return requested;
1228                 case Unspecified:
1229                         if (global_secflags & CIFSSEC_MAY_NTLMV2)
1230                                 return NTLMv2;
1231                         break;
1232                 default:
1233                         break;
1234                 }
1235                 fallthrough;
1236         default:
1237                 return Unspecified;
1238         }
1239 }
1240
1241 struct sess_data {
1242         unsigned int xid;
1243         struct cifs_ses *ses;
1244         struct TCP_Server_Info *server;
1245         struct nls_table *nls_cp;
1246         void (*func)(struct sess_data *);
1247         int result;
1248
1249         /* we will send the SMB in three pieces:
1250          * a fixed length beginning part, an optional
1251          * SPNEGO blob (which can be zero length), and a
1252          * last part which will include the strings
1253          * and rest of bcc area. This allows us to avoid
1254          * a large buffer 17K allocation
1255          */
1256         int buf0_type;
1257         struct kvec iov[3];
1258 };
1259
1260 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
1261 static int
1262 sess_alloc_buffer(struct sess_data *sess_data, int wct)
1263 {
1264         int rc;
1265         struct cifs_ses *ses = sess_data->ses;
1266         struct smb_hdr *smb_buf;
1267
1268         rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
1269                                   (void **)&smb_buf);
1270
1271         if (rc)
1272                 return rc;
1273
1274         sess_data->iov[0].iov_base = (char *)smb_buf;
1275         sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
1276         /*
1277          * This variable will be used to clear the buffer
1278          * allocated above in case of any error in the calling function.
1279          */
1280         sess_data->buf0_type = CIFS_SMALL_BUFFER;
1281
1282         /* 2000 big enough to fit max user, domain, NOS name etc. */
1283         sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
1284         if (!sess_data->iov[2].iov_base) {
1285                 rc = -ENOMEM;
1286                 goto out_free_smb_buf;
1287         }
1288
1289         return 0;
1290
1291 out_free_smb_buf:
1292         cifs_small_buf_release(smb_buf);
1293         sess_data->iov[0].iov_base = NULL;
1294         sess_data->iov[0].iov_len = 0;
1295         sess_data->buf0_type = CIFS_NO_BUFFER;
1296         return rc;
1297 }
1298
1299 static void
1300 sess_free_buffer(struct sess_data *sess_data)
1301 {
1302         struct kvec *iov = sess_data->iov;
1303
1304         /*
1305          * Zero the session data before freeing, as it might contain sensitive info (keys, etc).
1306          * Note that iov[1] is already freed by caller.
1307          */
1308         if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base)
1309                 memzero_explicit(iov[0].iov_base, iov[0].iov_len);
1310
1311         free_rsp_buf(sess_data->buf0_type, iov[0].iov_base);
1312         sess_data->buf0_type = CIFS_NO_BUFFER;
1313         kfree_sensitive(iov[2].iov_base);
1314 }
1315
1316 static int
1317 sess_establish_session(struct sess_data *sess_data)
1318 {
1319         struct cifs_ses *ses = sess_data->ses;
1320         struct TCP_Server_Info *server = sess_data->server;
1321
1322         cifs_server_lock(server);
1323         if (!server->session_estab) {
1324                 if (server->sign) {
1325                         server->session_key.response =
1326                                 kmemdup(ses->auth_key.response,
1327                                 ses->auth_key.len, GFP_KERNEL);
1328                         if (!server->session_key.response) {
1329                                 cifs_server_unlock(server);
1330                                 return -ENOMEM;
1331                         }
1332                         server->session_key.len =
1333                                                 ses->auth_key.len;
1334                 }
1335                 server->sequence_number = 0x2;
1336                 server->session_estab = true;
1337         }
1338         cifs_server_unlock(server);
1339
1340         cifs_dbg(FYI, "CIFS session established successfully\n");
1341         return 0;
1342 }
1343
1344 static int
1345 sess_sendreceive(struct sess_data *sess_data)
1346 {
1347         int rc;
1348         struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
1349         __u16 count;
1350         struct kvec rsp_iov = { NULL, 0 };
1351
1352         count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
1353         be32_add_cpu(&smb_buf->smb_buf_length, count);
1354         put_bcc(count, smb_buf);
1355
1356         rc = SendReceive2(sess_data->xid, sess_data->ses,
1357                           sess_data->iov, 3 /* num_iovecs */,
1358                           &sess_data->buf0_type,
1359                           CIFS_LOG_ERROR, &rsp_iov);
1360         cifs_small_buf_release(sess_data->iov[0].iov_base);
1361         memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
1362
1363         return rc;
1364 }
1365
1366 static void
1367 sess_auth_ntlmv2(struct sess_data *sess_data)
1368 {
1369         int rc = 0;
1370         struct smb_hdr *smb_buf;
1371         SESSION_SETUP_ANDX *pSMB;
1372         char *bcc_ptr;
1373         struct cifs_ses *ses = sess_data->ses;
1374         struct TCP_Server_Info *server = sess_data->server;
1375         __u32 capabilities;
1376         __u16 bytes_remaining;
1377
1378         /* old style NTLM sessionsetup */
1379         /* wct = 13 */
1380         rc = sess_alloc_buffer(sess_data, 13);
1381         if (rc)
1382                 goto out;
1383
1384         pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1385         bcc_ptr = sess_data->iov[2].iov_base;
1386         capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1387
1388         pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1389
1390         /* LM2 password would be here if we supported it */
1391         pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1392
1393         if (ses->user_name != NULL) {
1394                 /* calculate nlmv2 response and session key */
1395                 rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
1396                 if (rc) {
1397                         cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
1398                         goto out;
1399                 }
1400
1401                 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1402                                 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1403                 bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1404
1405                 /* set case sensitive password length after tilen may get
1406                  * assigned, tilen is 0 otherwise.
1407                  */
1408                 pSMB->req_no_secext.CaseSensitivePasswordLength =
1409                         cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1410         } else {
1411                 pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1412         }
1413
1414         if (ses->capabilities & CAP_UNICODE) {
1415                 if (!IS_ALIGNED(sess_data->iov[0].iov_len, 2)) {
1416                         *bcc_ptr = 0;
1417                         bcc_ptr++;
1418                 }
1419                 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1420         } else {
1421                 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1422         }
1423
1424
1425         sess_data->iov[2].iov_len = (long) bcc_ptr -
1426                         (long) sess_data->iov[2].iov_base;
1427
1428         rc = sess_sendreceive(sess_data);
1429         if (rc)
1430                 goto out;
1431
1432         pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1433         smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1434
1435         if (smb_buf->WordCount != 3) {
1436                 rc = -EIO;
1437                 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1438                 goto out;
1439         }
1440
1441         if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1442                 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1443
1444         ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1445         cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1446
1447         bytes_remaining = get_bcc(smb_buf);
1448         bcc_ptr = pByteArea(smb_buf);
1449
1450         /* BB check if Unicode and decode strings */
1451         if (bytes_remaining == 0) {
1452                 /* no string area to decode, do nothing */
1453         } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1454                 /* unicode string area must be word-aligned */
1455                 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1456                         ++bcc_ptr;
1457                         --bytes_remaining;
1458                 }
1459                 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1460                                       sess_data->nls_cp);
1461         } else {
1462                 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1463                                     sess_data->nls_cp);
1464         }
1465
1466         rc = sess_establish_session(sess_data);
1467 out:
1468         sess_data->result = rc;
1469         sess_data->func = NULL;
1470         sess_free_buffer(sess_data);
1471         kfree_sensitive(ses->auth_key.response);
1472         ses->auth_key.response = NULL;
1473 }
1474
1475 #ifdef CONFIG_CIFS_UPCALL
1476 static void
1477 sess_auth_kerberos(struct sess_data *sess_data)
1478 {
1479         int rc = 0;
1480         struct smb_hdr *smb_buf;
1481         SESSION_SETUP_ANDX *pSMB;
1482         char *bcc_ptr;
1483         struct cifs_ses *ses = sess_data->ses;
1484         struct TCP_Server_Info *server = sess_data->server;
1485         __u32 capabilities;
1486         __u16 bytes_remaining;
1487         struct key *spnego_key = NULL;
1488         struct cifs_spnego_msg *msg;
1489         u16 blob_len;
1490
1491         /* extended security */
1492         /* wct = 12 */
1493         rc = sess_alloc_buffer(sess_data, 12);
1494         if (rc)
1495                 goto out;
1496
1497         pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1498         bcc_ptr = sess_data->iov[2].iov_base;
1499         capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1500
1501         spnego_key = cifs_get_spnego_key(ses, server);
1502         if (IS_ERR(spnego_key)) {
1503                 rc = PTR_ERR(spnego_key);
1504                 spnego_key = NULL;
1505                 goto out;
1506         }
1507
1508         msg = spnego_key->payload.data[0];
1509         /*
1510          * check version field to make sure that cifs.upcall is
1511          * sending us a response in an expected form
1512          */
1513         if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1514                 cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1515                          CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1516                 rc = -EKEYREJECTED;
1517                 goto out_put_spnego_key;
1518         }
1519
1520         kfree_sensitive(ses->auth_key.response);
1521         ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1522                                          GFP_KERNEL);
1523         if (!ses->auth_key.response) {
1524                 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1525                          msg->sesskey_len);
1526                 rc = -ENOMEM;
1527                 goto out_put_spnego_key;
1528         }
1529         ses->auth_key.len = msg->sesskey_len;
1530
1531         pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1532         capabilities |= CAP_EXTENDED_SECURITY;
1533         pSMB->req.Capabilities = cpu_to_le32(capabilities);
1534         sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1535         sess_data->iov[1].iov_len = msg->secblob_len;
1536         pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1537
1538         if (ses->capabilities & CAP_UNICODE) {
1539                 /* unicode strings must be word aligned */
1540                 if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1541                         *bcc_ptr = 0;
1542                         bcc_ptr++;
1543                 }
1544                 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1545                 unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1546         } else {
1547                 /* BB: is this right? */
1548                 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1549         }
1550
1551         sess_data->iov[2].iov_len = (long) bcc_ptr -
1552                         (long) sess_data->iov[2].iov_base;
1553
1554         rc = sess_sendreceive(sess_data);
1555         if (rc)
1556                 goto out_put_spnego_key;
1557
1558         pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1559         smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1560
1561         if (smb_buf->WordCount != 4) {
1562                 rc = -EIO;
1563                 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1564                 goto out_put_spnego_key;
1565         }
1566
1567         if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1568                 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1569
1570         ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1571         cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1572
1573         bytes_remaining = get_bcc(smb_buf);
1574         bcc_ptr = pByteArea(smb_buf);
1575
1576         blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1577         if (blob_len > bytes_remaining) {
1578                 cifs_dbg(VFS, "bad security blob length %d\n",
1579                                 blob_len);
1580                 rc = -EINVAL;
1581                 goto out_put_spnego_key;
1582         }
1583         bcc_ptr += blob_len;
1584         bytes_remaining -= blob_len;
1585
1586         /* BB check if Unicode and decode strings */
1587         if (bytes_remaining == 0) {
1588                 /* no string area to decode, do nothing */
1589         } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1590                 /* unicode string area must be word-aligned */
1591                 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1592                         ++bcc_ptr;
1593                         --bytes_remaining;
1594                 }
1595                 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1596                                       sess_data->nls_cp);
1597         } else {
1598                 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1599                                     sess_data->nls_cp);
1600         }
1601
1602         rc = sess_establish_session(sess_data);
1603 out_put_spnego_key:
1604         key_invalidate(spnego_key);
1605         key_put(spnego_key);
1606 out:
1607         sess_data->result = rc;
1608         sess_data->func = NULL;
1609         sess_free_buffer(sess_data);
1610         kfree_sensitive(ses->auth_key.response);
1611         ses->auth_key.response = NULL;
1612 }
1613
1614 #endif /* ! CONFIG_CIFS_UPCALL */
1615
1616 /*
1617  * The required kvec buffers have to be allocated before calling this
1618  * function.
1619  */
1620 static int
1621 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1622 {
1623         SESSION_SETUP_ANDX *pSMB;
1624         struct cifs_ses *ses = sess_data->ses;
1625         struct TCP_Server_Info *server = sess_data->server;
1626         __u32 capabilities;
1627         char *bcc_ptr;
1628
1629         pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1630
1631         capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1632         if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) {
1633                 cifs_dbg(VFS, "NTLMSSP requires Unicode support\n");
1634                 return -ENOSYS;
1635         }
1636
1637         pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1638         capabilities |= CAP_EXTENDED_SECURITY;
1639         pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1640
1641         bcc_ptr = sess_data->iov[2].iov_base;
1642         /* unicode strings must be word aligned */
1643         if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1644                 *bcc_ptr = 0;
1645                 bcc_ptr++;
1646         }
1647         unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1648
1649         sess_data->iov[2].iov_len = (long) bcc_ptr -
1650                                         (long) sess_data->iov[2].iov_base;
1651
1652         return 0;
1653 }
1654
1655 static void
1656 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1657
1658 static void
1659 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1660 {
1661         int rc;
1662         struct smb_hdr *smb_buf;
1663         SESSION_SETUP_ANDX *pSMB;
1664         struct cifs_ses *ses = sess_data->ses;
1665         struct TCP_Server_Info *server = sess_data->server;
1666         __u16 bytes_remaining;
1667         char *bcc_ptr;
1668         unsigned char *ntlmsspblob = NULL;
1669         u16 blob_len;
1670
1671         cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1672
1673         /*
1674          * if memory allocation is successful, caller of this function
1675          * frees it.
1676          */
1677         ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1678         if (!ses->ntlmssp) {
1679                 rc = -ENOMEM;
1680                 goto out;
1681         }
1682         ses->ntlmssp->sesskey_per_smbsess = false;
1683
1684         /* wct = 12 */
1685         rc = sess_alloc_buffer(sess_data, 12);
1686         if (rc)
1687                 goto out;
1688
1689         pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1690
1691         /* Build security blob before we assemble the request */
1692         rc = build_ntlmssp_negotiate_blob(&ntlmsspblob,
1693                                      &blob_len, ses, server,
1694                                      sess_data->nls_cp);
1695         if (rc)
1696                 goto out_free_ntlmsspblob;
1697
1698         sess_data->iov[1].iov_len = blob_len;
1699         sess_data->iov[1].iov_base = ntlmsspblob;
1700         pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1701
1702         rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1703         if (rc)
1704                 goto out_free_ntlmsspblob;
1705
1706         rc = sess_sendreceive(sess_data);
1707
1708         pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1709         smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1710
1711         /* If true, rc here is expected and not an error */
1712         if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1713             smb_buf->Status.CifsError ==
1714                         cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1715                 rc = 0;
1716
1717         if (rc)
1718                 goto out_free_ntlmsspblob;
1719
1720         cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1721
1722         if (smb_buf->WordCount != 4) {
1723                 rc = -EIO;
1724                 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1725                 goto out_free_ntlmsspblob;
1726         }
1727
1728         ses->Suid = smb_buf->Uid;   /* UID left in wire format (le) */
1729         cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1730
1731         bytes_remaining = get_bcc(smb_buf);
1732         bcc_ptr = pByteArea(smb_buf);
1733
1734         blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1735         if (blob_len > bytes_remaining) {
1736                 cifs_dbg(VFS, "bad security blob length %d\n",
1737                                 blob_len);
1738                 rc = -EINVAL;
1739                 goto out_free_ntlmsspblob;
1740         }
1741
1742         rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1743
1744 out_free_ntlmsspblob:
1745         kfree_sensitive(ntlmsspblob);
1746 out:
1747         sess_free_buffer(sess_data);
1748
1749         if (!rc) {
1750                 sess_data->func = sess_auth_rawntlmssp_authenticate;
1751                 return;
1752         }
1753
1754         /* Else error. Cleanup */
1755         kfree_sensitive(ses->auth_key.response);
1756         ses->auth_key.response = NULL;
1757         kfree_sensitive(ses->ntlmssp);
1758         ses->ntlmssp = NULL;
1759
1760         sess_data->func = NULL;
1761         sess_data->result = rc;
1762 }
1763
1764 static void
1765 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1766 {
1767         int rc;
1768         struct smb_hdr *smb_buf;
1769         SESSION_SETUP_ANDX *pSMB;
1770         struct cifs_ses *ses = sess_data->ses;
1771         struct TCP_Server_Info *server = sess_data->server;
1772         __u16 bytes_remaining;
1773         char *bcc_ptr;
1774         unsigned char *ntlmsspblob = NULL;
1775         u16 blob_len;
1776
1777         cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1778
1779         /* wct = 12 */
1780         rc = sess_alloc_buffer(sess_data, 12);
1781         if (rc)
1782                 goto out;
1783
1784         /* Build security blob before we assemble the request */
1785         pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1786         smb_buf = (struct smb_hdr *)pSMB;
1787         rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1788                                         &blob_len, ses, server,
1789                                         sess_data->nls_cp);
1790         if (rc)
1791                 goto out_free_ntlmsspblob;
1792         sess_data->iov[1].iov_len = blob_len;
1793         sess_data->iov[1].iov_base = ntlmsspblob;
1794         pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1795         /*
1796          * Make sure that we tell the server that we are using
1797          * the uid that it just gave us back on the response
1798          * (challenge)
1799          */
1800         smb_buf->Uid = ses->Suid;
1801
1802         rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1803         if (rc)
1804                 goto out_free_ntlmsspblob;
1805
1806         rc = sess_sendreceive(sess_data);
1807         if (rc)
1808                 goto out_free_ntlmsspblob;
1809
1810         pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1811         smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1812         if (smb_buf->WordCount != 4) {
1813                 rc = -EIO;
1814                 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1815                 goto out_free_ntlmsspblob;
1816         }
1817
1818         if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1819                 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1820
1821         if (ses->Suid != smb_buf->Uid) {
1822                 ses->Suid = smb_buf->Uid;
1823                 cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1824         }
1825
1826         bytes_remaining = get_bcc(smb_buf);
1827         bcc_ptr = pByteArea(smb_buf);
1828         blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1829         if (blob_len > bytes_remaining) {
1830                 cifs_dbg(VFS, "bad security blob length %d\n",
1831                                 blob_len);
1832                 rc = -EINVAL;
1833                 goto out_free_ntlmsspblob;
1834         }
1835         bcc_ptr += blob_len;
1836         bytes_remaining -= blob_len;
1837
1838
1839         /* BB check if Unicode and decode strings */
1840         if (bytes_remaining == 0) {
1841                 /* no string area to decode, do nothing */
1842         } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1843                 /* unicode string area must be word-aligned */
1844                 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1845                         ++bcc_ptr;
1846                         --bytes_remaining;
1847                 }
1848                 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1849                                       sess_data->nls_cp);
1850         } else {
1851                 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1852                                     sess_data->nls_cp);
1853         }
1854
1855 out_free_ntlmsspblob:
1856         kfree_sensitive(ntlmsspblob);
1857 out:
1858         sess_free_buffer(sess_data);
1859
1860         if (!rc)
1861                 rc = sess_establish_session(sess_data);
1862
1863         /* Cleanup */
1864         kfree_sensitive(ses->auth_key.response);
1865         ses->auth_key.response = NULL;
1866         kfree_sensitive(ses->ntlmssp);
1867         ses->ntlmssp = NULL;
1868
1869         sess_data->func = NULL;
1870         sess_data->result = rc;
1871 }
1872
1873 static int select_sec(struct sess_data *sess_data)
1874 {
1875         int type;
1876         struct cifs_ses *ses = sess_data->ses;
1877         struct TCP_Server_Info *server = sess_data->server;
1878
1879         type = cifs_select_sectype(server, ses->sectype);
1880         cifs_dbg(FYI, "sess setup type %d\n", type);
1881         if (type == Unspecified) {
1882                 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1883                 return -EINVAL;
1884         }
1885
1886         switch (type) {
1887         case NTLMv2:
1888                 sess_data->func = sess_auth_ntlmv2;
1889                 break;
1890         case Kerberos:
1891 #ifdef CONFIG_CIFS_UPCALL
1892                 sess_data->func = sess_auth_kerberos;
1893                 break;
1894 #else
1895                 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1896                 return -ENOSYS;
1897 #endif /* CONFIG_CIFS_UPCALL */
1898         case RawNTLMSSP:
1899                 sess_data->func = sess_auth_rawntlmssp_negotiate;
1900                 break;
1901         default:
1902                 cifs_dbg(VFS, "secType %d not supported!\n", type);
1903                 return -ENOSYS;
1904         }
1905
1906         return 0;
1907 }
1908
1909 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
1910                    struct TCP_Server_Info *server,
1911                    const struct nls_table *nls_cp)
1912 {
1913         int rc = 0;
1914         struct sess_data *sess_data;
1915
1916         if (ses == NULL) {
1917                 WARN(1, "%s: ses == NULL!", __func__);
1918                 return -EINVAL;
1919         }
1920
1921         sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
1922         if (!sess_data)
1923                 return -ENOMEM;
1924
1925         sess_data->xid = xid;
1926         sess_data->ses = ses;
1927         sess_data->server = server;
1928         sess_data->buf0_type = CIFS_NO_BUFFER;
1929         sess_data->nls_cp = (struct nls_table *) nls_cp;
1930
1931         rc = select_sec(sess_data);
1932         if (rc)
1933                 goto out;
1934
1935         while (sess_data->func)
1936                 sess_data->func(sess_data);
1937
1938         /* Store result before we free sess_data */
1939         rc = sess_data->result;
1940
1941 out:
1942         kfree_sensitive(sess_data);
1943         return rc;
1944 }
1945 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */