Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 1 | /* |
| 2 | * fs/cifs/sess.c |
| 3 | * |
| 4 | * SMB/CIFS session setup handling routines |
| 5 | * |
Steve French | d185cda | 2009-04-30 17:45:10 +0000 | [diff] [blame] | 6 | * Copyright (c) International Business Machines Corp., 2006, 2009 |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 7 | * Author(s): Steve French (sfrench@us.ibm.com) |
| 8 | * |
| 9 | * This library is free software; you can redistribute it and/or modify |
| 10 | * it under the terms of the GNU Lesser General Public License as published |
| 11 | * by the Free Software Foundation; either version 2.1 of the License, or |
| 12 | * (at your option) any later version. |
| 13 | * |
| 14 | * This library is distributed in the hope that it will be useful, |
| 15 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 16 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See |
| 17 | * the GNU Lesser General Public License for more details. |
| 18 | * |
| 19 | * You should have received a copy of the GNU Lesser General Public License |
| 20 | * along with this library; if not, write to the Free Software |
| 21 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
| 22 | */ |
| 23 | |
| 24 | #include "cifspdu.h" |
| 25 | #include "cifsglob.h" |
| 26 | #include "cifsproto.h" |
| 27 | #include "cifs_unicode.h" |
| 28 | #include "cifs_debug.h" |
| 29 | #include "ntlmssp.h" |
| 30 | #include "nterr.h" |
Steve French | 9c53588 | 2006-06-01 05:09:10 +0000 | [diff] [blame] | 31 | #include <linux/utsname.h> |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 32 | #include <linux/slab.h> |
Steve French | 2442421 | 2007-11-16 23:37:35 +0000 | [diff] [blame] | 33 | #include "cifs_spnego.h" |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 34 | |
Jeff Layton | ebe6aa5 | 2010-04-24 07:57:47 -0400 | [diff] [blame] | 35 | /* |
| 36 | * Checks if this is the first smb session to be reconnected after |
| 37 | * the socket has been reestablished (so we know whether to use vc 0). |
| 38 | * Called while holding the cifs_tcp_ses_lock, so do not block |
| 39 | */ |
Steve French | eca6acf | 2009-02-20 05:43:09 +0000 | [diff] [blame] | 40 | static bool is_first_ses_reconnect(struct cifsSesInfo *ses) |
| 41 | { |
| 42 | struct list_head *tmp; |
| 43 | struct cifsSesInfo *tmp_ses; |
| 44 | |
| 45 | list_for_each(tmp, &ses->server->smb_ses_list) { |
| 46 | tmp_ses = list_entry(tmp, struct cifsSesInfo, |
| 47 | smb_ses_list); |
| 48 | if (tmp_ses->need_reconnect == false) |
| 49 | return false; |
| 50 | } |
| 51 | /* could not find a session that was already connected, |
| 52 | this must be the first one we are reconnecting */ |
| 53 | return true; |
| 54 | } |
| 55 | |
| 56 | /* |
| 57 | * vc number 0 is treated specially by some servers, and should be the |
| 58 | * first one we request. After that we can use vcnumbers up to maxvcs, |
| 59 | * one for each smb session (some Windows versions set maxvcs incorrectly |
| 60 | * so maxvc=1 can be ignored). If we have too many vcs, we can reuse |
| 61 | * any vc but zero (some servers reset the connection on vcnum zero) |
| 62 | * |
| 63 | */ |
| 64 | static __le16 get_next_vcnum(struct cifsSesInfo *ses) |
| 65 | { |
| 66 | __u16 vcnum = 0; |
| 67 | struct list_head *tmp; |
| 68 | struct cifsSesInfo *tmp_ses; |
| 69 | __u16 max_vcs = ses->server->max_vcs; |
| 70 | __u16 i; |
| 71 | int free_vc_found = 0; |
| 72 | |
| 73 | /* Quoting the MS-SMB specification: "Windows-based SMB servers set this |
| 74 | field to one but do not enforce this limit, which allows an SMB client |
| 75 | to establish more virtual circuits than allowed by this value ... but |
| 76 | other server implementations can enforce this limit." */ |
| 77 | if (max_vcs < 2) |
| 78 | max_vcs = 0xFFFF; |
| 79 | |
Suresh Jayaraman | 3f9bcca | 2010-10-18 23:29:37 +0530 | [diff] [blame] | 80 | spin_lock(&cifs_tcp_ses_lock); |
Steve French | eca6acf | 2009-02-20 05:43:09 +0000 | [diff] [blame] | 81 | if ((ses->need_reconnect) && is_first_ses_reconnect(ses)) |
| 82 | goto get_vc_num_exit; /* vcnum will be zero */ |
| 83 | for (i = ses->server->srv_count - 1; i < max_vcs; i++) { |
| 84 | if (i == 0) /* this is the only connection, use vc 0 */ |
| 85 | break; |
| 86 | |
| 87 | free_vc_found = 1; |
| 88 | |
| 89 | list_for_each(tmp, &ses->server->smb_ses_list) { |
| 90 | tmp_ses = list_entry(tmp, struct cifsSesInfo, |
| 91 | smb_ses_list); |
| 92 | if (tmp_ses->vcnum == i) { |
| 93 | free_vc_found = 0; |
| 94 | break; /* found duplicate, try next vcnum */ |
| 95 | } |
| 96 | } |
| 97 | if (free_vc_found) |
| 98 | break; /* we found a vcnumber that will work - use it */ |
| 99 | } |
| 100 | |
| 101 | if (i == 0) |
| 102 | vcnum = 0; /* for most common case, ie if one smb session, use |
| 103 | vc zero. Also for case when no free vcnum, zero |
| 104 | is safest to send (some clients only send zero) */ |
| 105 | else if (free_vc_found == 0) |
| 106 | vcnum = 1; /* we can not reuse vc=0 safely, since some servers |
| 107 | reset all uids on that, but 1 is ok. */ |
| 108 | else |
| 109 | vcnum = i; |
| 110 | ses->vcnum = vcnum; |
| 111 | get_vc_num_exit: |
Suresh Jayaraman | 3f9bcca | 2010-10-18 23:29:37 +0530 | [diff] [blame] | 112 | spin_unlock(&cifs_tcp_ses_lock); |
Steve French | eca6acf | 2009-02-20 05:43:09 +0000 | [diff] [blame] | 113 | |
Steve French | 051a2a0 | 2009-05-01 16:21:04 +0000 | [diff] [blame] | 114 | return cpu_to_le16(vcnum); |
Steve French | eca6acf | 2009-02-20 05:43:09 +0000 | [diff] [blame] | 115 | } |
| 116 | |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 117 | static __u32 cifs_ssetup_hdr(struct cifsSesInfo *ses, SESSION_SETUP_ANDX *pSMB) |
| 118 | { |
| 119 | __u32 capabilities = 0; |
| 120 | |
| 121 | /* init fields common to all four types of SessSetup */ |
Steve French | eca6acf | 2009-02-20 05:43:09 +0000 | [diff] [blame] | 122 | /* Note that offsets for first seven fields in req struct are same */ |
| 123 | /* in CIFS Specs so does not matter which of 3 forms of struct */ |
| 124 | /* that we use in next few lines */ |
| 125 | /* Note that header is initialized to zero in header_assemble */ |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 126 | pSMB->req.AndXCommand = 0xFF; |
| 127 | pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf); |
| 128 | pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq); |
Steve French | eca6acf | 2009-02-20 05:43:09 +0000 | [diff] [blame] | 129 | pSMB->req.VcNumber = get_next_vcnum(ses); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 130 | |
| 131 | /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */ |
| 132 | |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 133 | /* BB verify whether signing required on neg or just on auth frame |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 134 | (and NTLM case) */ |
| 135 | |
| 136 | capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS | |
| 137 | CAP_LARGE_WRITE_X | CAP_LARGE_READ_X; |
| 138 | |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 139 | if (ses->server->secMode & |
| 140 | (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 141 | pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE; |
| 142 | |
| 143 | if (ses->capabilities & CAP_UNICODE) { |
| 144 | pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE; |
| 145 | capabilities |= CAP_UNICODE; |
| 146 | } |
| 147 | if (ses->capabilities & CAP_STATUS32) { |
| 148 | pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS; |
| 149 | capabilities |= CAP_STATUS32; |
| 150 | } |
| 151 | if (ses->capabilities & CAP_DFS) { |
| 152 | pSMB->req.hdr.Flags2 |= SMBFLG2_DFS; |
| 153 | capabilities |= CAP_DFS; |
| 154 | } |
Steve French | 26f5736 | 2007-08-30 22:09:15 +0000 | [diff] [blame] | 155 | if (ses->capabilities & CAP_UNIX) |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 156 | capabilities |= CAP_UNIX; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 157 | |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 158 | return capabilities; |
| 159 | } |
| 160 | |
Jeff Layton | 0d3a01f | 2007-10-16 17:32:19 +0000 | [diff] [blame] | 161 | static void |
| 162 | unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp) |
| 163 | { |
| 164 | char *bcc_ptr = *pbcc_area; |
| 165 | int bytes_ret = 0; |
| 166 | |
| 167 | /* Copy OS version */ |
| 168 | bytes_ret = cifs_strtoUCS((__le16 *)bcc_ptr, "Linux version ", 32, |
| 169 | nls_cp); |
| 170 | bcc_ptr += 2 * bytes_ret; |
| 171 | bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, init_utsname()->release, |
| 172 | 32, nls_cp); |
| 173 | bcc_ptr += 2 * bytes_ret; |
| 174 | bcc_ptr += 2; /* trailing null */ |
| 175 | |
| 176 | bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS, |
| 177 | 32, nls_cp); |
| 178 | bcc_ptr += 2 * bytes_ret; |
| 179 | bcc_ptr += 2; /* trailing null */ |
| 180 | |
| 181 | *pbcc_area = bcc_ptr; |
| 182 | } |
| 183 | |
| 184 | static void unicode_domain_string(char **pbcc_area, struct cifsSesInfo *ses, |
| 185 | const struct nls_table *nls_cp) |
| 186 | { |
| 187 | char *bcc_ptr = *pbcc_area; |
| 188 | int bytes_ret = 0; |
| 189 | |
| 190 | /* copy domain */ |
| 191 | if (ses->domainName == NULL) { |
| 192 | /* Sending null domain better than using a bogus domain name (as |
| 193 | we did briefly in 2.6.18) since server will use its default */ |
| 194 | *bcc_ptr = 0; |
| 195 | *(bcc_ptr+1) = 0; |
| 196 | bytes_ret = 0; |
| 197 | } else |
| 198 | bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->domainName, |
| 199 | 256, nls_cp); |
| 200 | bcc_ptr += 2 * bytes_ret; |
| 201 | bcc_ptr += 2; /* account for null terminator */ |
| 202 | |
| 203 | *pbcc_area = bcc_ptr; |
| 204 | } |
| 205 | |
| 206 | |
Steve French | 3870253 | 2007-07-08 15:40:40 +0000 | [diff] [blame] | 207 | static void unicode_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses, |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 208 | const struct nls_table *nls_cp) |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 209 | { |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 210 | char *bcc_ptr = *pbcc_area; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 211 | int bytes_ret = 0; |
| 212 | |
| 213 | /* BB FIXME add check that strings total less |
| 214 | than 335 or will need to send them as arrays */ |
| 215 | |
Steve French | 0223cf0 | 2006-06-27 19:50:57 +0000 | [diff] [blame] | 216 | /* unicode strings, must be word aligned before the call */ |
| 217 | /* if ((long) bcc_ptr % 2) { |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 218 | *bcc_ptr = 0; |
| 219 | bcc_ptr++; |
Steve French | 0223cf0 | 2006-06-27 19:50:57 +0000 | [diff] [blame] | 220 | } */ |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 221 | /* copy user */ |
Steve French | 8727c8a | 2011-02-25 01:11:56 -0600 | [diff] [blame] | 222 | if (ses->user_name == NULL) { |
Steve French | 6e659c6 | 2006-11-08 23:10:46 +0000 | [diff] [blame] | 223 | /* null user mount */ |
| 224 | *bcc_ptr = 0; |
| 225 | *(bcc_ptr+1) = 0; |
Steve French | 301a6a3 | 2010-02-06 07:08:53 +0000 | [diff] [blame] | 226 | } else { |
Steve French | 8727c8a | 2011-02-25 01:11:56 -0600 | [diff] [blame] | 227 | bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->user_name, |
Steve French | 301a6a3 | 2010-02-06 07:08:53 +0000 | [diff] [blame] | 228 | MAX_USERNAME_SIZE, nls_cp); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 229 | } |
| 230 | bcc_ptr += 2 * bytes_ret; |
| 231 | bcc_ptr += 2; /* account for null termination */ |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 232 | |
Jeff Layton | 0d3a01f | 2007-10-16 17:32:19 +0000 | [diff] [blame] | 233 | unicode_domain_string(&bcc_ptr, ses, nls_cp); |
| 234 | unicode_oslm_strings(&bcc_ptr, nls_cp); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 235 | |
| 236 | *pbcc_area = bcc_ptr; |
| 237 | } |
| 238 | |
Steve French | 3870253 | 2007-07-08 15:40:40 +0000 | [diff] [blame] | 239 | static void ascii_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses, |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 240 | const struct nls_table *nls_cp) |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 241 | { |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 242 | char *bcc_ptr = *pbcc_area; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 243 | |
| 244 | /* copy user */ |
| 245 | /* BB what about null user mounts - check that we do this BB */ |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 246 | /* copy user */ |
Steve French | 8727c8a | 2011-02-25 01:11:56 -0600 | [diff] [blame] | 247 | if (ses->user_name != NULL) |
| 248 | strncpy(bcc_ptr, ses->user_name, MAX_USERNAME_SIZE); |
| 249 | /* else null user mount */ |
| 250 | |
| 251 | bcc_ptr += strnlen(ses->user_name, MAX_USERNAME_SIZE); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 252 | *bcc_ptr = 0; |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 253 | bcc_ptr++; /* account for null termination */ |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 254 | |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 255 | /* copy domain */ |
| 256 | |
| 257 | if (ses->domainName != NULL) { |
| 258 | strncpy(bcc_ptr, ses->domainName, 256); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 259 | bcc_ptr += strnlen(ses->domainName, 256); |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 260 | } /* else we will send a null domain name |
Steve French | 6e659c6 | 2006-11-08 23:10:46 +0000 | [diff] [blame] | 261 | so the server will default to its own domain */ |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 262 | *bcc_ptr = 0; |
| 263 | bcc_ptr++; |
| 264 | |
| 265 | /* BB check for overflow here */ |
| 266 | |
| 267 | strcpy(bcc_ptr, "Linux version "); |
| 268 | bcc_ptr += strlen("Linux version "); |
Serge E. Hallyn | 96b644b | 2006-10-02 02:18:13 -0700 | [diff] [blame] | 269 | strcpy(bcc_ptr, init_utsname()->release); |
| 270 | bcc_ptr += strlen(init_utsname()->release) + 1; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 271 | |
| 272 | strcpy(bcc_ptr, CIFS_NETWORK_OPSYS); |
| 273 | bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1; |
| 274 | |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 275 | *pbcc_area = bcc_ptr; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 276 | } |
| 277 | |
Jeff Layton | 5914079 | 2009-04-30 07:16:21 -0400 | [diff] [blame] | 278 | static void |
Jeff Layton | 690c522 | 2011-01-20 13:36:51 -0500 | [diff] [blame] | 279 | decode_unicode_ssetup(char **pbcc_area, __u16 bleft, struct cifsSesInfo *ses, |
Jeff Layton | 5914079 | 2009-04-30 07:16:21 -0400 | [diff] [blame] | 280 | const struct nls_table *nls_cp) |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 281 | { |
Jeff Layton | 5914079 | 2009-04-30 07:16:21 -0400 | [diff] [blame] | 282 | int len; |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 283 | char *data = *pbcc_area; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 284 | |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 285 | cFYI(1, "bleft %d", bleft); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 286 | |
Jeff Layton | 27b87fe | 2009-04-14 11:00:53 -0400 | [diff] [blame] | 287 | /* |
| 288 | * Windows servers do not always double null terminate their final |
| 289 | * Unicode string. Check to see if there are an uneven number of bytes |
| 290 | * left. If so, then add an extra NULL pad byte to the end of the |
| 291 | * response. |
| 292 | * |
| 293 | * See section 2.7.2 in "Implementing CIFS" for details |
| 294 | */ |
| 295 | if (bleft % 2) { |
| 296 | data[bleft] = 0; |
| 297 | ++bleft; |
| 298 | } |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 299 | |
Steve French | 26f5736 | 2007-08-30 22:09:15 +0000 | [diff] [blame] | 300 | kfree(ses->serverOS); |
Steve French | d185cda | 2009-04-30 17:45:10 +0000 | [diff] [blame] | 301 | ses->serverOS = cifs_strndup_from_ucs(data, bleft, true, nls_cp); |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 302 | cFYI(1, "serverOS=%s", ses->serverOS); |
Jeff Layton | 5914079 | 2009-04-30 07:16:21 -0400 | [diff] [blame] | 303 | len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2; |
| 304 | data += len; |
| 305 | bleft -= len; |
| 306 | if (bleft <= 0) |
| 307 | return; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 308 | |
Steve French | 26f5736 | 2007-08-30 22:09:15 +0000 | [diff] [blame] | 309 | kfree(ses->serverNOS); |
Steve French | d185cda | 2009-04-30 17:45:10 +0000 | [diff] [blame] | 310 | ses->serverNOS = cifs_strndup_from_ucs(data, bleft, true, nls_cp); |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 311 | cFYI(1, "serverNOS=%s", ses->serverNOS); |
Jeff Layton | 5914079 | 2009-04-30 07:16:21 -0400 | [diff] [blame] | 312 | len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2; |
| 313 | data += len; |
| 314 | bleft -= len; |
| 315 | if (bleft <= 0) |
| 316 | return; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 317 | |
Steve French | 26f5736 | 2007-08-30 22:09:15 +0000 | [diff] [blame] | 318 | kfree(ses->serverDomain); |
Steve French | d185cda | 2009-04-30 17:45:10 +0000 | [diff] [blame] | 319 | ses->serverDomain = cifs_strndup_from_ucs(data, bleft, true, nls_cp); |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 320 | cFYI(1, "serverDomain=%s", ses->serverDomain); |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 321 | |
Jeff Layton | 5914079 | 2009-04-30 07:16:21 -0400 | [diff] [blame] | 322 | return; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 323 | } |
| 324 | |
Jeff Layton | 690c522 | 2011-01-20 13:36:51 -0500 | [diff] [blame] | 325 | static int decode_ascii_ssetup(char **pbcc_area, __u16 bleft, |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 326 | struct cifsSesInfo *ses, |
| 327 | const struct nls_table *nls_cp) |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 328 | { |
| 329 | int rc = 0; |
| 330 | int len; |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 331 | char *bcc_ptr = *pbcc_area; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 332 | |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 333 | cFYI(1, "decode sessetup ascii. bleft %d", bleft); |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 334 | |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 335 | len = strnlen(bcc_ptr, bleft); |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 336 | if (len >= bleft) |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 337 | return rc; |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 338 | |
Steve French | 26f5736 | 2007-08-30 22:09:15 +0000 | [diff] [blame] | 339 | kfree(ses->serverOS); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 340 | |
| 341 | ses->serverOS = kzalloc(len + 1, GFP_KERNEL); |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 342 | if (ses->serverOS) |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 343 | strncpy(ses->serverOS, bcc_ptr, len); |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 344 | if (strncmp(ses->serverOS, "OS/2", 4) == 0) { |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 345 | cFYI(1, "OS/2 server"); |
Steve French | 9ac00b7 | 2006-09-30 04:13:17 +0000 | [diff] [blame] | 346 | ses->flags |= CIFS_SES_OS2; |
| 347 | } |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 348 | |
| 349 | bcc_ptr += len + 1; |
| 350 | bleft -= len + 1; |
| 351 | |
| 352 | len = strnlen(bcc_ptr, bleft); |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 353 | if (len >= bleft) |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 354 | return rc; |
| 355 | |
Steve French | 26f5736 | 2007-08-30 22:09:15 +0000 | [diff] [blame] | 356 | kfree(ses->serverNOS); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 357 | |
| 358 | ses->serverNOS = kzalloc(len + 1, GFP_KERNEL); |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 359 | if (ses->serverNOS) |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 360 | strncpy(ses->serverNOS, bcc_ptr, len); |
| 361 | |
| 362 | bcc_ptr += len + 1; |
| 363 | bleft -= len + 1; |
| 364 | |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 365 | len = strnlen(bcc_ptr, bleft); |
| 366 | if (len > bleft) |
| 367 | return rc; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 368 | |
Steve French | 9ac00b7 | 2006-09-30 04:13:17 +0000 | [diff] [blame] | 369 | /* No domain field in LANMAN case. Domain is |
| 370 | returned by old servers in the SMB negprot response */ |
| 371 | /* BB For newer servers which do not support Unicode, |
| 372 | but thus do return domain here we could add parsing |
| 373 | for it later, but it is not very important */ |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 374 | cFYI(1, "ascii: bytes left %d", bleft); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 375 | |
| 376 | return rc; |
| 377 | } |
| 378 | |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 379 | static int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, |
| 380 | struct cifsSesInfo *ses) |
| 381 | { |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 382 | unsigned int tioffset; /* challenge message target info area */ |
| 383 | unsigned int tilen; /* challenge message target info area length */ |
| 384 | |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 385 | CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr; |
| 386 | |
| 387 | if (blob_len < sizeof(CHALLENGE_MESSAGE)) { |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 388 | cERROR(1, "challenge blob len %d too small", blob_len); |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 389 | return -EINVAL; |
| 390 | } |
| 391 | |
| 392 | if (memcmp(pblob->Signature, "NTLMSSP", 8)) { |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 393 | cERROR(1, "blob signature incorrect %s", pblob->Signature); |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 394 | return -EINVAL; |
| 395 | } |
| 396 | if (pblob->MessageType != NtLmChallenge) { |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 397 | cERROR(1, "Incorrect message type %d", pblob->MessageType); |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 398 | return -EINVAL; |
| 399 | } |
| 400 | |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 401 | memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE); |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 402 | /* BB we could decode pblob->NegotiateFlags; some may be useful */ |
| 403 | /* In particular we can examine sign flags */ |
| 404 | /* BB spec says that if AvId field of MsvAvTimestamp is populated then |
| 405 | we must set the MIC field of the AUTHENTICATE_MESSAGE */ |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 406 | ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags); |
Steve French | 5443d13 | 2011-03-13 05:08:25 +0000 | [diff] [blame] | 407 | tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset); |
| 408 | tilen = le16_to_cpu(pblob->TargetInfoArray.Length); |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 409 | if (tilen) { |
| 410 | ses->auth_key.response = kmalloc(tilen, GFP_KERNEL); |
| 411 | if (!ses->auth_key.response) { |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 412 | cERROR(1, "Challenge target info allocation failure"); |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 413 | return -ENOMEM; |
| 414 | } |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 415 | memcpy(ses->auth_key.response, bcc_ptr + tioffset, tilen); |
| 416 | ses->auth_key.len = tilen; |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 417 | } |
| 418 | |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 419 | return 0; |
| 420 | } |
| 421 | |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 422 | /* BB Move to ntlmssp.c eventually */ |
| 423 | |
| 424 | /* We do not malloc the blob, it is passed in pbuffer, because |
| 425 | it is fixed size, and small, making this approach cleaner */ |
| 426 | static void build_ntlmssp_negotiate_blob(unsigned char *pbuffer, |
| 427 | struct cifsSesInfo *ses) |
| 428 | { |
| 429 | NEGOTIATE_MESSAGE *sec_blob = (NEGOTIATE_MESSAGE *)pbuffer; |
| 430 | __u32 flags; |
| 431 | |
Shirish Pargaonkar | df8fbc24 | 2010-12-11 14:19:22 -0600 | [diff] [blame] | 432 | memset(pbuffer, 0, sizeof(NEGOTIATE_MESSAGE)); |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 433 | memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8); |
| 434 | sec_blob->MessageType = NtLmNegotiate; |
| 435 | |
| 436 | /* BB is NTLMV2 session security format easier to use here? */ |
| 437 | flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET | |
| 438 | NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | |
Shirish Pargaonkar | df8fbc24 | 2010-12-11 14:19:22 -0600 | [diff] [blame] | 439 | NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC; |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 440 | if (ses->server->secMode & |
Shirish Pargaonkar | d2b9152 | 2010-10-21 14:25:08 -0500 | [diff] [blame] | 441 | (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) { |
Steve French | 745e507 | 2010-09-08 21:09:27 +0000 | [diff] [blame] | 442 | flags |= NTLMSSP_NEGOTIATE_SIGN; |
Shirish Pargaonkar | d2b9152 | 2010-10-21 14:25:08 -0500 | [diff] [blame] | 443 | if (!ses->server->session_estab) |
| 444 | flags |= NTLMSSP_NEGOTIATE_KEY_XCH | |
| 445 | NTLMSSP_NEGOTIATE_EXTENDED_SEC; |
| 446 | } |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 447 | |
Shirish Pargaonkar | df8fbc24 | 2010-12-11 14:19:22 -0600 | [diff] [blame] | 448 | sec_blob->NegotiateFlags = cpu_to_le32(flags); |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 449 | |
| 450 | sec_blob->WorkstationName.BufferOffset = 0; |
| 451 | sec_blob->WorkstationName.Length = 0; |
| 452 | sec_blob->WorkstationName.MaximumLength = 0; |
| 453 | |
| 454 | /* Domain name is sent on the Challenge not Negotiate NTLMSSP request */ |
| 455 | sec_blob->DomainName.BufferOffset = 0; |
| 456 | sec_blob->DomainName.Length = 0; |
| 457 | sec_blob->DomainName.MaximumLength = 0; |
| 458 | } |
| 459 | |
| 460 | /* We do not malloc the blob, it is passed in pbuffer, because its |
| 461 | maximum possible size is fixed and small, making this approach cleaner. |
| 462 | This function returns the length of the data in the blob */ |
| 463 | static int build_ntlmssp_auth_blob(unsigned char *pbuffer, |
Shirish Pargaonkar | 89f150f | 2010-10-19 11:47:52 -0500 | [diff] [blame] | 464 | u16 *buflen, |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 465 | struct cifsSesInfo *ses, |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 466 | const struct nls_table *nls_cp) |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 467 | { |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 468 | int rc; |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 469 | AUTHENTICATE_MESSAGE *sec_blob = (AUTHENTICATE_MESSAGE *)pbuffer; |
| 470 | __u32 flags; |
| 471 | unsigned char *tmp; |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 472 | |
| 473 | memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8); |
| 474 | sec_blob->MessageType = NtLmAuthenticate; |
| 475 | |
| 476 | flags = NTLMSSP_NEGOTIATE_56 | |
| 477 | NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_TARGET_INFO | |
| 478 | NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | |
Shirish Pargaonkar | df8fbc24 | 2010-12-11 14:19:22 -0600 | [diff] [blame] | 479 | NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC; |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 480 | if (ses->server->secMode & |
| 481 | (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) |
| 482 | flags |= NTLMSSP_NEGOTIATE_SIGN; |
| 483 | if (ses->server->secMode & SECMODE_SIGN_REQUIRED) |
| 484 | flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN; |
| 485 | |
| 486 | tmp = pbuffer + sizeof(AUTHENTICATE_MESSAGE); |
Shirish Pargaonkar | df8fbc24 | 2010-12-11 14:19:22 -0600 | [diff] [blame] | 487 | sec_blob->NegotiateFlags = cpu_to_le32(flags); |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 488 | |
| 489 | sec_blob->LmChallengeResponse.BufferOffset = |
| 490 | cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE)); |
| 491 | sec_blob->LmChallengeResponse.Length = 0; |
| 492 | sec_blob->LmChallengeResponse.MaximumLength = 0; |
| 493 | |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 494 | sec_blob->NtChallengeResponse.BufferOffset = cpu_to_le32(tmp - pbuffer); |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 495 | rc = setup_ntlmv2_rsp(ses, nls_cp); |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 496 | if (rc) { |
| 497 | cERROR(1, "Error %d during NTLMSSP authentication", rc); |
| 498 | goto setup_ntlmv2_ret; |
| 499 | } |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 500 | memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE, |
| 501 | ses->auth_key.len - CIFS_SESS_KEY_SIZE); |
| 502 | tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE; |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 503 | |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 504 | sec_blob->NtChallengeResponse.Length = |
| 505 | cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 506 | sec_blob->NtChallengeResponse.MaximumLength = |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 507 | cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 508 | |
| 509 | if (ses->domainName == NULL) { |
| 510 | sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer); |
| 511 | sec_blob->DomainName.Length = 0; |
| 512 | sec_blob->DomainName.MaximumLength = 0; |
| 513 | tmp += 2; |
| 514 | } else { |
| 515 | int len; |
| 516 | len = cifs_strtoUCS((__le16 *)tmp, ses->domainName, |
| 517 | MAX_USERNAME_SIZE, nls_cp); |
| 518 | len *= 2; /* unicode is 2 bytes each */ |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 519 | sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer); |
| 520 | sec_blob->DomainName.Length = cpu_to_le16(len); |
| 521 | sec_blob->DomainName.MaximumLength = cpu_to_le16(len); |
| 522 | tmp += len; |
| 523 | } |
| 524 | |
Steve French | 8727c8a | 2011-02-25 01:11:56 -0600 | [diff] [blame] | 525 | if (ses->user_name == NULL) { |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 526 | sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer); |
| 527 | sec_blob->UserName.Length = 0; |
| 528 | sec_blob->UserName.MaximumLength = 0; |
| 529 | tmp += 2; |
| 530 | } else { |
| 531 | int len; |
Steve French | 8727c8a | 2011-02-25 01:11:56 -0600 | [diff] [blame] | 532 | len = cifs_strtoUCS((__le16 *)tmp, ses->user_name, |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 533 | MAX_USERNAME_SIZE, nls_cp); |
| 534 | len *= 2; /* unicode is 2 bytes each */ |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 535 | sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer); |
| 536 | sec_blob->UserName.Length = cpu_to_le16(len); |
| 537 | sec_blob->UserName.MaximumLength = cpu_to_le16(len); |
| 538 | tmp += len; |
| 539 | } |
| 540 | |
| 541 | sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - pbuffer); |
| 542 | sec_blob->WorkstationName.Length = 0; |
| 543 | sec_blob->WorkstationName.MaximumLength = 0; |
| 544 | tmp += 2; |
| 545 | |
Shirish Pargaonkar | df8fbc24 | 2010-12-11 14:19:22 -0600 | [diff] [blame] | 546 | if (((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) || |
| 547 | (ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) |
| 548 | && !calc_seckey(ses)) { |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 549 | memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE); |
Shirish Pargaonkar | d2b9152 | 2010-10-21 14:25:08 -0500 | [diff] [blame] | 550 | sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer); |
| 551 | sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE); |
| 552 | sec_blob->SessionKey.MaximumLength = |
| 553 | cpu_to_le16(CIFS_CPHTXT_SIZE); |
| 554 | tmp += CIFS_CPHTXT_SIZE; |
| 555 | } else { |
| 556 | sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer); |
| 557 | sec_blob->SessionKey.Length = 0; |
| 558 | sec_blob->SessionKey.MaximumLength = 0; |
| 559 | } |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 560 | |
| 561 | setup_ntlmv2_ret: |
Shirish Pargaonkar | 89f150f | 2010-10-19 11:47:52 -0500 | [diff] [blame] | 562 | *buflen = tmp - pbuffer; |
| 563 | return rc; |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 564 | } |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 565 | |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 566 | int |
Jeff Layton | ebe6aa5 | 2010-04-24 07:57:47 -0400 | [diff] [blame] | 567 | CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, |
| 568 | const struct nls_table *nls_cp) |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 569 | { |
| 570 | int rc = 0; |
| 571 | int wct; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 572 | struct smb_hdr *smb_buf; |
| 573 | char *bcc_ptr; |
Steve French | 750d115 | 2006-06-27 06:28:30 +0000 | [diff] [blame] | 574 | char *str_area; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 575 | SESSION_SETUP_ANDX *pSMB; |
| 576 | __u32 capabilities; |
Jeff Layton | 690c522 | 2011-01-20 13:36:51 -0500 | [diff] [blame] | 577 | __u16 count; |
Steve French | 2442421 | 2007-11-16 23:37:35 +0000 | [diff] [blame] | 578 | int resp_buf_type; |
| 579 | struct kvec iov[3]; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 580 | enum securityEnum type; |
Jeff Layton | 690c522 | 2011-01-20 13:36:51 -0500 | [diff] [blame] | 581 | __u16 action, bytes_remaining; |
Steve French | 2442421 | 2007-11-16 23:37:35 +0000 | [diff] [blame] | 582 | struct key *spnego_key = NULL; |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 583 | __le32 phase = NtLmNegotiate; /* NTLMSSP, if needed, is multistage */ |
Shirish Pargaonkar | 89f150f | 2010-10-19 11:47:52 -0500 | [diff] [blame] | 584 | u16 blob_len; |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 585 | char *ntlmsspblob = NULL; |
Steve French | 254e55e | 2006-06-04 05:53:15 +0000 | [diff] [blame] | 586 | |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 587 | if (ses == NULL) |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 588 | return -EINVAL; |
| 589 | |
| 590 | type = ses->server->secType; |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 591 | cFYI(1, "sess setup type %d", type); |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 592 | if (type == RawNTLMSSP) { |
| 593 | /* if memory allocation is successful, caller of this function |
| 594 | * frees it. |
| 595 | */ |
| 596 | ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL); |
| 597 | if (!ses->ntlmssp) |
| 598 | return -ENOMEM; |
| 599 | } |
| 600 | |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 601 | ssetup_ntlmssp_authenticate: |
| 602 | if (phase == NtLmChallenge) |
| 603 | phase = NtLmAuthenticate; /* if ntlmssp, now final phase */ |
| 604 | |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 605 | if (type == LANMAN) { |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 606 | #ifndef CONFIG_CIFS_WEAK_PW_HASH |
| 607 | /* LANMAN and plaintext are less secure and off by default. |
| 608 | So we make this explicitly be turned on in kconfig (in the |
| 609 | build) and turned on at runtime (changed from the default) |
| 610 | in proc/fs/cifs or via mount parm. Unfortunately this is |
| 611 | needed for old Win (e.g. Win95), some obscure NAS and OS/2 */ |
| 612 | return -EOPNOTSUPP; |
| 613 | #endif |
| 614 | wct = 10; /* lanman 2 style sessionsetup */ |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 615 | } else if ((type == NTLM) || (type == NTLMv2)) { |
Steve French | 9312f67 | 2006-06-04 22:21:07 +0000 | [diff] [blame] | 616 | /* For NTLMv2 failures eventually may need to retry NTLM */ |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 617 | wct = 13; /* old style NTLM sessionsetup */ |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 618 | } else /* same size: negotiate or auth, NTLMSSP or extended security */ |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 619 | wct = 12; |
| 620 | |
| 621 | rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses, |
| 622 | (void **)&smb_buf); |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 623 | if (rc) |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 624 | return rc; |
| 625 | |
| 626 | pSMB = (SESSION_SETUP_ANDX *)smb_buf; |
| 627 | |
| 628 | capabilities = cifs_ssetup_hdr(ses, pSMB); |
Steve French | 750d115 | 2006-06-27 06:28:30 +0000 | [diff] [blame] | 629 | |
Steve French | 2442421 | 2007-11-16 23:37:35 +0000 | [diff] [blame] | 630 | /* we will send the SMB in three pieces: |
| 631 | a fixed length beginning part, an optional |
| 632 | SPNEGO blob (which can be zero length), and a |
| 633 | last part which will include the strings |
| 634 | and rest of bcc area. This allows us to avoid |
| 635 | a large buffer 17K allocation */ |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 636 | iov[0].iov_base = (char *)pSMB; |
| 637 | iov[0].iov_len = smb_buf->smb_buf_length + 4; |
Steve French | 750d115 | 2006-06-27 06:28:30 +0000 | [diff] [blame] | 638 | |
Steve French | 2442421 | 2007-11-16 23:37:35 +0000 | [diff] [blame] | 639 | /* setting this here allows the code at the end of the function |
| 640 | to free the request buffer if there's an error */ |
| 641 | resp_buf_type = CIFS_SMALL_BUFFER; |
| 642 | |
Steve French | 750d115 | 2006-06-27 06:28:30 +0000 | [diff] [blame] | 643 | /* 2000 big enough to fit max user, domain, NOS name etc. */ |
| 644 | str_area = kmalloc(2000, GFP_KERNEL); |
Cyrill Gorcunov | 5e6e623 | 2007-08-18 00:15:20 +0000 | [diff] [blame] | 645 | if (str_area == NULL) { |
Steve French | 2442421 | 2007-11-16 23:37:35 +0000 | [diff] [blame] | 646 | rc = -ENOMEM; |
| 647 | goto ssetup_exit; |
Cyrill Gorcunov | 5e6e623 | 2007-08-18 00:15:20 +0000 | [diff] [blame] | 648 | } |
Steve French | 750d115 | 2006-06-27 06:28:30 +0000 | [diff] [blame] | 649 | bcc_ptr = str_area; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 650 | |
Steve French | 9ac00b7 | 2006-09-30 04:13:17 +0000 | [diff] [blame] | 651 | ses->flags &= ~CIFS_SES_LANMAN; |
| 652 | |
Steve French | 2442421 | 2007-11-16 23:37:35 +0000 | [diff] [blame] | 653 | iov[1].iov_base = NULL; |
| 654 | iov[1].iov_len = 0; |
| 655 | |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 656 | if (type == LANMAN) { |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 657 | #ifdef CONFIG_CIFS_WEAK_PW_HASH |
Shirish Pargaonkar | 5e64092 | 2011-02-17 14:38:31 -0600 | [diff] [blame] | 658 | char lnm_session_key[CIFS_AUTH_RESP_SIZE]; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 659 | |
Steve French | c76da9d | 2008-08-28 15:32:22 +0000 | [diff] [blame] | 660 | pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE; |
| 661 | |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 662 | /* no capabilities flags in old lanman negotiation */ |
| 663 | |
Shirish Pargaonkar | 5e64092 | 2011-02-17 14:38:31 -0600 | [diff] [blame] | 664 | pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 665 | |
Shirish Pargaonkar | d3ba50b | 2010-10-27 15:20:36 -0500 | [diff] [blame] | 666 | /* Calculate hash with password and copy into bcc_ptr. |
| 667 | * Encryption Key (stored as in cryptkey) gets used if the |
| 668 | * security mode bit in Negottiate Protocol response states |
| 669 | * to use challenge/response method (i.e. Password bit is 1). |
| 670 | */ |
| 671 | |
| 672 | calc_lanman_hash(ses->password, ses->server->cryptkey, |
Jeff Layton | 4e53a3f | 2008-12-05 20:41:21 -0500 | [diff] [blame] | 673 | ses->server->secMode & SECMODE_PW_ENCRYPT ? |
| 674 | true : false, lnm_session_key); |
| 675 | |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 676 | ses->flags |= CIFS_SES_LANMAN; |
Shirish Pargaonkar | 5e64092 | 2011-02-17 14:38:31 -0600 | [diff] [blame] | 677 | memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE); |
| 678 | bcc_ptr += CIFS_AUTH_RESP_SIZE; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 679 | |
| 680 | /* can not sign if LANMAN negotiated so no need |
| 681 | to calculate signing key? but what if server |
| 682 | changed to do higher than lanman dialect and |
| 683 | we reconnected would we ever calc signing_key? */ |
| 684 | |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 685 | cFYI(1, "Negotiating LANMAN setting up strings"); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 686 | /* Unicode not allowed for LANMAN dialects */ |
| 687 | ascii_ssetup_strings(&bcc_ptr, ses, nls_cp); |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 688 | #endif |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 689 | } else if (type == NTLM) { |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 690 | pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities); |
| 691 | pSMB->req_no_secext.CaseInsensitivePasswordLength = |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 692 | cpu_to_le16(CIFS_AUTH_RESP_SIZE); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 693 | pSMB->req_no_secext.CaseSensitivePasswordLength = |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 694 | cpu_to_le16(CIFS_AUTH_RESP_SIZE); |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 695 | |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 696 | /* calculate ntlm response and session key */ |
| 697 | rc = setup_ntlm_response(ses); |
| 698 | if (rc) { |
| 699 | cERROR(1, "Error %d during NTLM authentication", rc); |
| 700 | goto ssetup_exit; |
| 701 | } |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 702 | |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 703 | /* copy ntlm response */ |
| 704 | memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, |
| 705 | CIFS_AUTH_RESP_SIZE); |
| 706 | bcc_ptr += CIFS_AUTH_RESP_SIZE; |
| 707 | memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, |
| 708 | CIFS_AUTH_RESP_SIZE); |
| 709 | bcc_ptr += CIFS_AUTH_RESP_SIZE; |
| 710 | |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 711 | if (ses->capabilities & CAP_UNICODE) { |
Steve French | 0223cf0 | 2006-06-27 19:50:57 +0000 | [diff] [blame] | 712 | /* unicode strings must be word aligned */ |
| 713 | if (iov[0].iov_len % 2) { |
| 714 | *bcc_ptr = 0; |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 715 | bcc_ptr++; |
| 716 | } |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 717 | unicode_ssetup_strings(&bcc_ptr, ses, nls_cp); |
Steve French | 0223cf0 | 2006-06-27 19:50:57 +0000 | [diff] [blame] | 718 | } else |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 719 | ascii_ssetup_strings(&bcc_ptr, ses, nls_cp); |
| 720 | } else if (type == NTLMv2) { |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 721 | pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities); |
| 722 | |
| 723 | /* LM2 password would be here if we supported it */ |
| 724 | pSMB->req_no_secext.CaseInsensitivePasswordLength = 0; |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 725 | |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 726 | /* calculate nlmv2 response and session key */ |
| 727 | rc = setup_ntlmv2_rsp(ses, nls_cp); |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 728 | if (rc) { |
| 729 | cERROR(1, "Error %d during NTLMv2 authentication", rc); |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 730 | goto ssetup_exit; |
| 731 | } |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 732 | memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE, |
| 733 | ses->auth_key.len - CIFS_SESS_KEY_SIZE); |
| 734 | bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE; |
| 735 | |
Shirish Pargaonkar | c9928f7 | 2010-10-04 19:56:13 -0500 | [diff] [blame] | 736 | /* set case sensitive password length after tilen may get |
| 737 | * assigned, tilen is 0 otherwise. |
| 738 | */ |
| 739 | pSMB->req_no_secext.CaseSensitivePasswordLength = |
Shirish Pargaonkar | f7c5445 | 2010-10-26 18:10:24 -0500 | [diff] [blame] | 740 | cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); |
Shirish Pargaonkar | c9928f7 | 2010-10-04 19:56:13 -0500 | [diff] [blame] | 741 | |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 742 | if (ses->capabilities & CAP_UNICODE) { |
| 743 | if (iov[0].iov_len % 2) { |
Steve French | 0223cf0 | 2006-06-27 19:50:57 +0000 | [diff] [blame] | 744 | *bcc_ptr = 0; |
Steve French | 26f5736 | 2007-08-30 22:09:15 +0000 | [diff] [blame] | 745 | bcc_ptr++; |
| 746 | } |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 747 | unicode_ssetup_strings(&bcc_ptr, ses, nls_cp); |
Steve French | 0223cf0 | 2006-06-27 19:50:57 +0000 | [diff] [blame] | 748 | } else |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 749 | ascii_ssetup_strings(&bcc_ptr, ses, nls_cp); |
Jeff Layton | 26efa0b | 2010-04-24 07:57:49 -0400 | [diff] [blame] | 750 | } else if (type == Kerberos) { |
Steve French | 2442421 | 2007-11-16 23:37:35 +0000 | [diff] [blame] | 751 | #ifdef CONFIG_CIFS_UPCALL |
| 752 | struct cifs_spnego_msg *msg; |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 753 | |
Steve French | 2442421 | 2007-11-16 23:37:35 +0000 | [diff] [blame] | 754 | spnego_key = cifs_get_spnego_key(ses); |
| 755 | if (IS_ERR(spnego_key)) { |
| 756 | rc = PTR_ERR(spnego_key); |
| 757 | spnego_key = NULL; |
| 758 | goto ssetup_exit; |
| 759 | } |
| 760 | |
| 761 | msg = spnego_key->payload.data; |
Steve French | 6ce5eec | 2008-08-26 00:37:14 +0000 | [diff] [blame] | 762 | /* check version field to make sure that cifs.upcall is |
| 763 | sending us a response in an expected form */ |
| 764 | if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) { |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 765 | cERROR(1, "incorrect version of cifs.upcall (expected" |
Steve French | 6ce5eec | 2008-08-26 00:37:14 +0000 | [diff] [blame] | 766 | " %d but got %d)", |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 767 | CIFS_SPNEGO_UPCALL_VERSION, msg->version); |
Steve French | 6ce5eec | 2008-08-26 00:37:14 +0000 | [diff] [blame] | 768 | rc = -EKEYREJECTED; |
| 769 | goto ssetup_exit; |
| 770 | } |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 771 | |
| 772 | ses->auth_key.response = kmalloc(msg->sesskey_len, GFP_KERNEL); |
| 773 | if (!ses->auth_key.response) { |
| 774 | cERROR(1, "Kerberos can't allocate (%u bytes) memory", |
| 775 | msg->sesskey_len); |
| 776 | rc = -ENOMEM; |
Steve French | 2442421 | 2007-11-16 23:37:35 +0000 | [diff] [blame] | 777 | goto ssetup_exit; |
| 778 | } |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 779 | memcpy(ses->auth_key.response, msg->data, msg->sesskey_len); |
Shirish Pargaonkar | 5d0d288 | 2010-10-13 18:15:00 -0500 | [diff] [blame] | 780 | ses->auth_key.len = msg->sesskey_len; |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 781 | |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 782 | pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC; |
| 783 | capabilities |= CAP_EXTENDED_SECURITY; |
| 784 | pSMB->req.Capabilities = cpu_to_le32(capabilities); |
Steve French | 2442421 | 2007-11-16 23:37:35 +0000 | [diff] [blame] | 785 | iov[1].iov_base = msg->data + msg->sesskey_len; |
| 786 | iov[1].iov_len = msg->secblob_len; |
| 787 | pSMB->req.SecurityBlobLength = cpu_to_le16(iov[1].iov_len); |
| 788 | |
| 789 | if (ses->capabilities & CAP_UNICODE) { |
| 790 | /* unicode strings must be word aligned */ |
Jeff Layton | 28c5a02 | 2007-12-31 04:56:21 +0000 | [diff] [blame] | 791 | if ((iov[0].iov_len + iov[1].iov_len) % 2) { |
Steve French | 2442421 | 2007-11-16 23:37:35 +0000 | [diff] [blame] | 792 | *bcc_ptr = 0; |
| 793 | bcc_ptr++; |
| 794 | } |
| 795 | unicode_oslm_strings(&bcc_ptr, nls_cp); |
| 796 | unicode_domain_string(&bcc_ptr, ses, nls_cp); |
| 797 | } else |
| 798 | /* BB: is this right? */ |
| 799 | ascii_ssetup_strings(&bcc_ptr, ses, nls_cp); |
| 800 | #else /* ! CONFIG_CIFS_UPCALL */ |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 801 | cERROR(1, "Kerberos negotiated but upcall support disabled!"); |
Steve French | 2442421 | 2007-11-16 23:37:35 +0000 | [diff] [blame] | 802 | rc = -ENOSYS; |
| 803 | goto ssetup_exit; |
| 804 | #endif /* CONFIG_CIFS_UPCALL */ |
Jeff Layton | b4d6fcf | 2011-01-07 11:30:28 -0500 | [diff] [blame] | 805 | } else if (type == RawNTLMSSP) { |
| 806 | if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) { |
| 807 | cERROR(1, "NTLMSSP requires Unicode support"); |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 808 | rc = -ENOSYS; |
| 809 | goto ssetup_exit; |
| 810 | } |
Jeff Layton | b4d6fcf | 2011-01-07 11:30:28 -0500 | [diff] [blame] | 811 | |
| 812 | cFYI(1, "ntlmssp session setup phase %d", phase); |
| 813 | pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC; |
| 814 | capabilities |= CAP_EXTENDED_SECURITY; |
| 815 | pSMB->req.Capabilities |= cpu_to_le32(capabilities); |
| 816 | switch(phase) { |
| 817 | case NtLmNegotiate: |
| 818 | build_ntlmssp_negotiate_blob( |
| 819 | pSMB->req.SecurityBlob, ses); |
| 820 | iov[1].iov_len = sizeof(NEGOTIATE_MESSAGE); |
| 821 | iov[1].iov_base = pSMB->req.SecurityBlob; |
| 822 | pSMB->req.SecurityBlobLength = |
| 823 | cpu_to_le16(sizeof(NEGOTIATE_MESSAGE)); |
| 824 | break; |
| 825 | case NtLmAuthenticate: |
| 826 | /* |
| 827 | * 5 is an empirical value, large enough to hold |
| 828 | * authenticate message plus max 10 of av paris, |
| 829 | * domain, user, workstation names, flags, etc. |
| 830 | */ |
| 831 | ntlmsspblob = kzalloc( |
| 832 | 5*sizeof(struct _AUTHENTICATE_MESSAGE), |
| 833 | GFP_KERNEL); |
| 834 | if (!ntlmsspblob) { |
| 835 | cERROR(1, "Can't allocate NTLMSSP blob"); |
| 836 | rc = -ENOMEM; |
| 837 | goto ssetup_exit; |
| 838 | } |
| 839 | |
| 840 | rc = build_ntlmssp_auth_blob(ntlmsspblob, |
| 841 | &blob_len, ses, nls_cp); |
| 842 | if (rc) |
| 843 | goto ssetup_exit; |
| 844 | iov[1].iov_len = blob_len; |
| 845 | iov[1].iov_base = ntlmsspblob; |
| 846 | pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len); |
| 847 | /* |
| 848 | * Make sure that we tell the server that we are using |
| 849 | * the uid that it just gave us back on the response |
| 850 | * (challenge) |
| 851 | */ |
| 852 | smb_buf->Uid = ses->Suid; |
| 853 | break; |
| 854 | default: |
| 855 | cERROR(1, "invalid phase %d", phase); |
| 856 | rc = -ENOSYS; |
| 857 | goto ssetup_exit; |
| 858 | } |
| 859 | /* unicode strings must be word aligned */ |
| 860 | if ((iov[0].iov_len + iov[1].iov_len) % 2) { |
| 861 | *bcc_ptr = 0; |
| 862 | bcc_ptr++; |
| 863 | } |
| 864 | unicode_oslm_strings(&bcc_ptr, nls_cp); |
| 865 | } else { |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 866 | cERROR(1, "secType %d not supported!", type); |
Steve French | 2442421 | 2007-11-16 23:37:35 +0000 | [diff] [blame] | 867 | rc = -ENOSYS; |
| 868 | goto ssetup_exit; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 869 | } |
| 870 | |
Steve French | 2442421 | 2007-11-16 23:37:35 +0000 | [diff] [blame] | 871 | iov[2].iov_base = str_area; |
| 872 | iov[2].iov_len = (long) bcc_ptr - (long) str_area; |
| 873 | |
| 874 | count = iov[1].iov_len + iov[2].iov_len; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 875 | smb_buf->smb_buf_length += count; |
| 876 | |
Jeff Layton | 690c522 | 2011-01-20 13:36:51 -0500 | [diff] [blame] | 877 | put_bcc_le(count, smb_buf); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 878 | |
Steve French | 2442421 | 2007-11-16 23:37:35 +0000 | [diff] [blame] | 879 | rc = SendReceive2(xid, ses, iov, 3 /* num_iovecs */, &resp_buf_type, |
Jeff Layton | 7749981 | 2011-01-11 07:24:23 -0500 | [diff] [blame] | 880 | CIFS_LOG_ERROR); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 881 | /* SMB request buf freed in SendReceive2 */ |
| 882 | |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 883 | pSMB = (SESSION_SETUP_ANDX *)iov[0].iov_base; |
| 884 | smb_buf = (struct smb_hdr *)iov[0].iov_base; |
| 885 | |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 886 | if ((type == RawNTLMSSP) && (smb_buf->Status.CifsError == |
| 887 | cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))) { |
| 888 | if (phase != NtLmNegotiate) { |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 889 | cERROR(1, "Unexpected more processing error"); |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 890 | goto ssetup_exit; |
| 891 | } |
| 892 | /* NTLMSSP Negotiate sent now processing challenge (response) */ |
| 893 | phase = NtLmChallenge; /* process ntlmssp challenge */ |
| 894 | rc = 0; /* MORE_PROC rc is not an error here, but expected */ |
| 895 | } |
| 896 | if (rc) |
| 897 | goto ssetup_exit; |
| 898 | |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 899 | if ((smb_buf->WordCount != 3) && (smb_buf->WordCount != 4)) { |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 900 | rc = -EIO; |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 901 | cERROR(1, "bad word count %d", smb_buf->WordCount); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 902 | goto ssetup_exit; |
| 903 | } |
| 904 | action = le16_to_cpu(pSMB->resp.Action); |
| 905 | if (action & GUEST_LOGIN) |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 906 | cFYI(1, "Guest login"); /* BB mark SesInfo struct? */ |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 907 | ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */ |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 908 | cFYI(1, "UID = %d ", ses->Suid); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 909 | /* response can have either 3 or 4 word count - Samba sends 3 */ |
| 910 | /* and lanman response is 3 */ |
Jeff Layton | 690c522 | 2011-01-20 13:36:51 -0500 | [diff] [blame] | 911 | bytes_remaining = get_bcc(smb_buf); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 912 | bcc_ptr = pByteArea(smb_buf); |
| 913 | |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 914 | if (smb_buf->WordCount == 4) { |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 915 | blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength); |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 916 | if (blob_len > bytes_remaining) { |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 917 | cERROR(1, "bad security blob length %d", blob_len); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 918 | rc = -EINVAL; |
| 919 | goto ssetup_exit; |
| 920 | } |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 921 | if (phase == NtLmChallenge) { |
| 922 | rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses); |
| 923 | /* now goto beginning for ntlmssp authenticate phase */ |
| 924 | if (rc) |
| 925 | goto ssetup_exit; |
| 926 | } |
| 927 | bcc_ptr += blob_len; |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 928 | bytes_remaining -= blob_len; |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 929 | } |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 930 | |
| 931 | /* BB check if Unicode and decode strings */ |
Jeff Layton | 27b87fe | 2009-04-14 11:00:53 -0400 | [diff] [blame] | 932 | if (smb_buf->Flags2 & SMBFLG2_UNICODE) { |
| 933 | /* unicode string area must be word-aligned */ |
| 934 | if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) { |
| 935 | ++bcc_ptr; |
| 936 | --bytes_remaining; |
| 937 | } |
Jeff Layton | 5914079 | 2009-04-30 07:16:21 -0400 | [diff] [blame] | 938 | decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses, nls_cp); |
Jeff Layton | 27b87fe | 2009-04-14 11:00:53 -0400 | [diff] [blame] | 939 | } else { |
Steve French | 63135e0 | 2007-07-17 17:34:02 +0000 | [diff] [blame] | 940 | rc = decode_ascii_ssetup(&bcc_ptr, bytes_remaining, |
| 941 | ses, nls_cp); |
Jeff Layton | 27b87fe | 2009-04-14 11:00:53 -0400 | [diff] [blame] | 942 | } |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 943 | |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 944 | ssetup_exit: |
Jeff Layton | dfd15c46 | 2008-09-24 11:32:59 -0400 | [diff] [blame] | 945 | if (spnego_key) { |
| 946 | key_revoke(spnego_key); |
Steve French | 2442421 | 2007-11-16 23:37:35 +0000 | [diff] [blame] | 947 | key_put(spnego_key); |
Jeff Layton | dfd15c46 | 2008-09-24 11:32:59 -0400 | [diff] [blame] | 948 | } |
Steve French | 750d115 | 2006-06-27 06:28:30 +0000 | [diff] [blame] | 949 | kfree(str_area); |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 950 | kfree(ntlmsspblob); |
| 951 | ntlmsspblob = NULL; |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 952 | if (resp_buf_type == CIFS_SMALL_BUFFER) { |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 953 | cFYI(1, "ssetup freeing small buf %p", iov[0].iov_base); |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 954 | cifs_small_buf_release(iov[0].iov_base); |
Steve French | 790fe57 | 2007-07-07 19:25:05 +0000 | [diff] [blame] | 955 | } else if (resp_buf_type == CIFS_LARGE_BUFFER) |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 956 | cifs_buf_release(iov[0].iov_base); |
| 957 | |
Steve French | 0b3cc858 | 2009-05-04 08:37:12 +0000 | [diff] [blame] | 958 | /* if ntlmssp, and negotiate succeeded, proceed to authenticate phase */ |
| 959 | if ((phase == NtLmChallenge) && (rc == 0)) |
| 960 | goto ssetup_ntlmssp_authenticate; |
| 961 | |
Steve French | 3979877 | 2006-05-31 22:40:51 +0000 | [diff] [blame] | 962 | return rc; |
| 963 | } |