projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[CIFS] Remove calls to to take f_owner.lock
[linux-2.6-block.git] / fs / cifs / sess.c
CommitLineData
3979877e
SF		 1/*
2 * fs/cifs/sess.c
3 *
4 * SMB/CIFS session setup handling routines
5 *
6 * Copyright (c) International Business Machines Corp., 2006
7 * Author(s): Steve French (sfrench@us.ibm.com)
8 *
9 * This library is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU Lesser General Public License as published
11 * by the Free Software Foundation; either version 2.1 of the License, or
12 * (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
17 * the GNU Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public License
20 * along with this library; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 */
23
24#include "cifspdu.h"
25#include "cifsglob.h"
26#include "cifsproto.h"
27#include "cifs_unicode.h"
28#include "cifs_debug.h"
29#include "ntlmssp.h"
30#include "nterr.h"
9c53588e 31#include <linux/utsname.h>
3979877e 32
3979877e
SF		 33extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
34 unsigned char *p24);
35
3979877e
SF		 36static __u32 cifs_ssetup_hdr(struct cifsSesInfo *ses, SESSION_SETUP_ANDX *pSMB)
37{
38 __u32 capabilities = 0;
39
40 /* init fields common to all four types of SessSetup */
41 /* note that header is initialized to zero in header_assemble */
42 pSMB->req.AndXCommand = 0xFF;
43 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
44 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
45
46 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
47
48 /* BB verify whether signing required on neg or just on auth frame
49 (and NTLM case) */
50
51 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
52 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
53
54 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
55 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
56
57 if (ses->capabilities & CAP_UNICODE) {
58 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
59 capabilities |= CAP_UNICODE;
60 }
61 if (ses->capabilities & CAP_STATUS32) {
62 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
63 capabilities |= CAP_STATUS32;
64 }
65 if (ses->capabilities & CAP_DFS) {
66 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
67 capabilities |= CAP_DFS;
68 }
69 if (ses->capabilities & CAP_UNIX) {
70 capabilities |= CAP_UNIX;
71 }
72
73 /* BB check whether to init vcnum BB */
74 return capabilities;
75}
76
7c7b25bc 77static void unicode_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
3979877e
SF		 78 const struct nls_table * nls_cp)
79{
80 char * bcc_ptr = *pbcc_area;
81 int bytes_ret = 0;
82
83 /* BB FIXME add check that strings total less
84 than 335 or will need to send them as arrays */
85
86 /* align unicode strings, must be word aligned */
87 if ((long) bcc_ptr % 2) {
88 *bcc_ptr = 0;
89 bcc_ptr++;
90 }
91 /* copy user */
92 if(ses->userName == NULL) {
93 /* BB what about null user mounts - check that we do this BB */
94 } else { /* 300 should be long enough for any conceivable user name */
95 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->userName,
96 300, nls_cp);
97 }
98 bcc_ptr += 2 * bytes_ret;
99 bcc_ptr += 2; /* account for null termination */
100 /* copy domain */
101 if(ses->domainName == NULL)
102 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr,
103 "CIFS_LINUX_DOM", 32, nls_cp);
104 else
105 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->domainName,
106 256, nls_cp);
107 bcc_ptr += 2 * bytes_ret;
108 bcc_ptr += 2; /* account for null terminator */
109
110 /* Copy OS version */
111 bytes_ret = cifs_strtoUCS((__le16 *)bcc_ptr, "Linux version ", 32,
112 nls_cp);
113 bcc_ptr += 2 * bytes_ret;
114 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, system_utsname.release,
115 32, nls_cp);
116 bcc_ptr += 2 * bytes_ret;
117 bcc_ptr += 2; /* trailing null */
118
119 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
120 32, nls_cp);
121 bcc_ptr += 2 * bytes_ret;
122 bcc_ptr += 2; /* trailing null */
123
124 *pbcc_area = bcc_ptr;
125}
126
7c7b25bc 127static void ascii_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
3979877e
SF		 128 const struct nls_table * nls_cp)
129{
130 char * bcc_ptr = *pbcc_area;
131
132 /* copy user */
133 /* BB what about null user mounts - check that we do this BB */
134 /* copy user */
135 if(ses->userName == NULL) {
136 /* BB what about null user mounts - check that we do this BB */
137 } else { /* 300 should be long enough for any conceivable user name */
138 strncpy(bcc_ptr, ses->userName, 300);
139 }
140 /* BB improve check for overflow */
141 bcc_ptr += strnlen(ses->userName, 200);
142 *bcc_ptr = 0;
143 bcc_ptr++; /* account for null termination */
144
145 /* copy domain */
146
147 if(ses->domainName == NULL) {
148 strcpy(bcc_ptr, "CIFS_LINUX_DOM");
149 bcc_ptr += 14; /* strlen(CIFS_LINUX_DOM) */
150 } else {
151 strncpy(bcc_ptr, ses->domainName, 256);
152 bcc_ptr += strnlen(ses->domainName, 256);
153 }
154 *bcc_ptr = 0;
155 bcc_ptr++;
156
157 /* BB check for overflow here */
158
159 strcpy(bcc_ptr, "Linux version ");
160 bcc_ptr += strlen("Linux version ");
161 strcpy(bcc_ptr, system_utsname.release);
162 bcc_ptr += strlen(system_utsname.release) + 1;
163
164 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
165 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
166
167 *pbcc_area = bcc_ptr;
168}
169
7c7b25bc 170static int decode_unicode_ssetup(char ** pbcc_area, int bleft, struct cifsSesInfo *ses,
3979877e
SF		 171 const struct nls_table * nls_cp)
172{
173 int rc = 0;
174 int words_left, len;
175 char * data = *pbcc_area;
176
177
178
179 cFYI(1,("bleft %d",bleft));
180
181
182 /* word align, if bytes remaining is not even */
183 if(bleft % 2) {
184 bleft--;
185 data++;
186 }
187 words_left = bleft / 2;
188
189 /* save off server operating system */
190 len = UniStrnlen((wchar_t *) data, words_left);
191
192/* We look for obvious messed up bcc or strings in response so we do not go off
193 the end since (at least) WIN2K and Windows XP have a major bug in not null
194 terminating last Unicode string in response */
195 if(len >= words_left)
196 return rc;
197
198 if(ses->serverOS)
199 kfree(ses->serverOS);
200 /* UTF-8 string will not grow more than four times as big as UCS-16 */
201 ses->serverOS = kzalloc(4 * len, GFP_KERNEL);
202 if(ses->serverOS != NULL) {
203 cifs_strfromUCS_le(ses->serverOS, (__le16 *)data, len,
204 nls_cp);
205 }
206 data += 2 * (len + 1);
207 words_left -= len + 1;
208
209 /* save off server network operating system */
210 len = UniStrnlen((wchar_t *) data, words_left);
211
212 if(len >= words_left)
213 return rc;
214
215 if(ses->serverNOS)
216 kfree(ses->serverNOS);
217 ses->serverNOS = kzalloc(4 * len, GFP_KERNEL); /* BB this is wrong length FIXME BB */
218 if(ses->serverNOS != NULL) {
219 cifs_strfromUCS_le(ses->serverNOS, (__le16 *)data, len,
220 nls_cp);
221 if(strncmp(ses->serverNOS, "NT LAN Manager 4",16) == 0) {
222 cFYI(1,("NT4 server"));
223 ses->flags |= CIFS_SES_NT4;
224 }
225 }
226 data += 2 * (len + 1);
227 words_left -= len + 1;
228
229 /* save off server domain */
230 len = UniStrnlen((wchar_t *) data, words_left);
231
232 if(len > words_left)
233 return rc;
234
235 if(ses->serverDomain)
236 kfree(ses->serverDomain);
237 ses->serverDomain = kzalloc(2 * (len + 1), GFP_KERNEL); /* BB FIXME wrong length */
238 if(ses->serverDomain != NULL) {
239 cifs_strfromUCS_le(ses->serverDomain, (__le16 *)data, len,
240 nls_cp);
241 ses->serverDomain[2*len] = 0;
242 ses->serverDomain[(2*len) + 1] = 0;
243 }
244 data += 2 * (len + 1);
245 words_left -= len + 1;
246
247 cFYI(1,("words left: %d",words_left));
248
249 return rc;
250}
251
7c7b25bc 252static int decode_ascii_ssetup(char ** pbcc_area, int bleft, struct cifsSesInfo *ses,
3979877e
SF		 253 const struct nls_table * nls_cp)
254{
255 int rc = 0;
256 int len;
257 char * bcc_ptr = *pbcc_area;
258
259 cFYI(1,("decode sessetup ascii. bleft %d", bleft));
260
261 len = strnlen(bcc_ptr, bleft);
262 if(len >= bleft)
263 return rc;
264
265 if(ses->serverOS)
266 kfree(ses->serverOS);
267
268 ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
269 if(ses->serverOS)
270 strncpy(ses->serverOS, bcc_ptr, len);
271
272 bcc_ptr += len + 1;
273 bleft -= len + 1;
274
275 len = strnlen(bcc_ptr, bleft);
276 if(len >= bleft)
277 return rc;
278
279 if(ses->serverNOS)
280 kfree(ses->serverNOS);
281
282 ses->serverNOS = kzalloc(len + 1, GFP_KERNEL);
283 if(ses->serverNOS)
284 strncpy(ses->serverNOS, bcc_ptr, len);
285
286 bcc_ptr += len + 1;
287 bleft -= len + 1;
288
289 len = strnlen(bcc_ptr, bleft);
290 if(len > bleft)
291 return rc;
292
293 if(ses->serverDomain)
294 kfree(ses->serverDomain);
295
296 ses->serverDomain = kzalloc(len + 1, GFP_KERNEL);
297 if(ses->serverOS)
298 strncpy(ses->serverOS, bcc_ptr, len);
299
300 bcc_ptr += len + 1;
301 bleft -= len + 1;
302
303 cFYI(1,("ascii: bytes left %d",bleft));
304
305 return rc;
306}
307
308int
309CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
310 const struct nls_table *nls_cp)
311{
312 int rc = 0;
313 int wct;
3979877e
SF		 314 struct smb_hdr *smb_buf;
315 char *bcc_ptr;
316 SESSION_SETUP_ANDX *pSMB;
317 __u32 capabilities;
318 int count;
319 int resp_buf_type = 0;
189acaae 320 struct kvec iov[2]; /* BB split variable length info into 2nd iovec */
3979877e
SF		 321 enum securityEnum type;
322 __u16 action;
323 int bytes_remaining;
254e55ed
SF		 324
325 cFYI(1,("new sess setup"));
3979877e
SF		 326 if(ses == NULL)
327 return -EINVAL;
328
329 type = ses->server->secType;
330 if(type == LANMAN) {
331#ifndef CONFIG_CIFS_WEAK_PW_HASH
332 /* LANMAN and plaintext are less secure and off by default.
333 So we make this explicitly be turned on in kconfig (in the
334 build) and turned on at runtime (changed from the default)
335 in proc/fs/cifs or via mount parm. Unfortunately this is
336 needed for old Win (e.g. Win95), some obscure NAS and OS/2 */
337 return -EOPNOTSUPP;
338#endif
339 wct = 10; /* lanman 2 style sessionsetup */
9312f675
SF		 340 } else if((type == NTLM) || (type == NTLMv2)) {
341 /* For NTLMv2 failures eventually may need to retry NTLM */
3979877e 342 wct = 13; /* old style NTLM sessionsetup */
9312f675 343 } else /* same size for negotiate or auth, NTLMSSP or extended security */
3979877e
SF		 344 wct = 12;
345
346 rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
347 (void **)&smb_buf);
348 if(rc)
349 return rc;
350
351 pSMB = (SESSION_SETUP_ANDX *)smb_buf;
352
353 capabilities = cifs_ssetup_hdr(ses, pSMB);
354 bcc_ptr = pByteArea(smb_buf);
355
356 if(type == LANMAN) {
357#ifdef CONFIG_CIFS_WEAK_PW_HASH
7c7b25bc 358 char lnm_session_key[CIFS_SESS_KEY_SIZE];
3979877e
SF		 359
360 /* no capabilities flags in old lanman negotiation */
361
7c7b25bc 362 pSMB->old_req.PasswordLength = CIFS_SESS_KEY_SIZE;
3979877e
SF		 363 /* BB calculate hash with password */
364 /* and copy into bcc */
365
7c7b25bc 366 calc_lanman_hash(ses, lnm_session_key);
3979877e
SF		 367
368#ifdef CONFIG_CIFS_DEBUG2
369 cifs_dump_mem("cryptkey: ",ses->server->cryptKey,
7c7b25bc 370 CIFS_SESS_KEY_SIZE);
3979877e 371#endif
7c7b25bc
SF		 372 memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_SESS_KEY_SIZE);
373 bcc_ptr += CIFS_SESS_KEY_SIZE;
3979877e
SF		 374
375 /* can not sign if LANMAN negotiated so no need
376 to calculate signing key? but what if server
377 changed to do higher than lanman dialect and
378 we reconnected would we ever calc signing_key? */
379
380 cERROR(1,("Negotiating LANMAN setting up strings"));
381 /* Unicode not allowed for LANMAN dialects */
382 ascii_ssetup_strings(&bcc_ptr, ses, nls_cp);
383#endif
384 } else if (type == NTLM) {
7c7b25bc 385 char ntlm_session_key[CIFS_SESS_KEY_SIZE];
3979877e
SF		 386
387 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
388 pSMB->req_no_secext.CaseInsensitivePasswordLength =
7c7b25bc 389 cpu_to_le16(CIFS_SESS_KEY_SIZE);
3979877e 390 pSMB->req_no_secext.CaseSensitivePasswordLength =
7c7b25bc 391 cpu_to_le16(CIFS_SESS_KEY_SIZE);
3979877e
SF		 392
393 /* calculate session key */
394 SMBNTencrypt(ses->password, ses->server->cryptKey,
395 ntlm_session_key);
396
397 if(first_time) /* should this be moved into common code
398 with similar ntlmv2 path? */
7c7b25bc 399 cifs_calculate_mac_key( ses->server->mac_signing_key,
3979877e
SF		 400 ntlm_session_key, ses->password);
401 /* copy session key */
402
7c7b25bc
SF		 403 memcpy(bcc_ptr, (char *)ntlm_session_key,CIFS_SESS_KEY_SIZE);
404 bcc_ptr += CIFS_SESS_KEY_SIZE;
405 memcpy(bcc_ptr, (char *)ntlm_session_key,CIFS_SESS_KEY_SIZE);
406 bcc_ptr += CIFS_SESS_KEY_SIZE;
407 if(ses->capabilities & CAP_UNICODE)
408 unicode_ssetup_strings(&bcc_ptr, ses, nls_cp);
409 else
410 ascii_ssetup_strings(&bcc_ptr, ses, nls_cp);
411 } else if (type == NTLMv2) {
6d027cfd
SF		 412 char * v2_sess_key =
413 kmalloc(sizeof(struct ntlmv2_resp), GFP_KERNEL);
f64b23ae
SF		 414
415 /* BB FIXME change all users of v2_sess_key to
416 struct ntlmv2_resp */
7c7b25bc
SF		 417
418 if(v2_sess_key == NULL) {
419 cifs_small_buf_release(smb_buf);
420 return -ENOMEM;
421 }
422
423 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
424
425 /* LM2 password would be here if we supported it */
426 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
427 /* cpu_to_le16(LM2_SESS_KEY_SIZE); */
428
429 pSMB->req_no_secext.CaseSensitivePasswordLength =
f64b23ae 430 cpu_to_le16(sizeof(struct ntlmv2_resp));
7c7b25bc
SF		 431
432 /* calculate session key */
1717ffc5 433 setup_ntlmv2_rsp(ses, v2_sess_key, nls_cp);
7c7b25bc
SF		 434 if(first_time) /* should this be moved into common code
435 with similar ntlmv2 path? */
436 /* cifs_calculate_ntlmv2_mac_key(ses->server->mac_signing_key,
437 response BB FIXME, v2_sess_key); */
438
439 /* copy session key */
440
441 /* memcpy(bcc_ptr, (char *)ntlm_session_key,LM2_SESS_KEY_SIZE);
442 bcc_ptr += LM2_SESS_KEY_SIZE; */
f64b23ae
SF		 443 memcpy(bcc_ptr, (char *)v2_sess_key, sizeof(struct ntlmv2_resp));
444 bcc_ptr += sizeof(struct ntlmv2_resp);
445 kfree(v2_sess_key);
3979877e
SF		 446 if(ses->capabilities & CAP_UNICODE)
447 unicode_ssetup_strings(&bcc_ptr, ses, nls_cp);
448 else
449 ascii_ssetup_strings(&bcc_ptr, ses, nls_cp);
450 } else /* NTLMSSP or SPNEGO */ {
451 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
452 capabilities |= CAP_EXTENDED_SECURITY;
453 pSMB->req.Capabilities = cpu_to_le32(capabilities);
454 /* BB set password lengths */
455 }
456
457 count = (long) bcc_ptr - (long) pByteArea(smb_buf);
458 smb_buf->smb_buf_length += count;
459
460 /* if we switch to small buffers, count will need to be fewer
461 than 383 (strings less than 335 bytes) */
462
463 BCC_LE(smb_buf) = cpu_to_le16(count);
464
465
466 /* BB FIXME check for other non ntlm code paths */
467
468 /* BB check is this too big for a small smb? */
469
470 iov[0].iov_base = (char *)pSMB;
471 iov[0].iov_len = smb_buf->smb_buf_length + 4;
472
473 rc = SendReceive2(xid, ses, iov, 1 /* num_iovecs */, &resp_buf_type, 0);
474 /* SMB request buf freed in SendReceive2 */
475
476 cFYI(1,("ssetup rc from sendrecv2 is %d",rc));
477 if(rc)
478 goto ssetup_exit;
479
480 pSMB = (SESSION_SETUP_ANDX *)iov[0].iov_base;
481 smb_buf = (struct smb_hdr *)iov[0].iov_base;
482
483 if((smb_buf->WordCount != 3) && (smb_buf->WordCount != 4)) {
484 rc = -EIO;
485 cERROR(1,("bad word count %d", smb_buf->WordCount));
486 goto ssetup_exit;
487 }
488 action = le16_to_cpu(pSMB->resp.Action);
489 if (action & GUEST_LOGIN)
189acaae 490 cFYI(1, ("Guest login")); /* BB mark SesInfo struct? */
3979877e
SF		 491 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
492 cFYI(1, ("UID = %d ", ses->Suid));
493 /* response can have either 3 or 4 word count - Samba sends 3 */
494 /* and lanman response is 3 */
495 bytes_remaining = BCC(smb_buf);
496 bcc_ptr = pByteArea(smb_buf);
497
498 if(smb_buf->WordCount == 4) {
499 __u16 blob_len;
500 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
501 bcc_ptr += blob_len;
502 if(blob_len > bytes_remaining) {
503 cERROR(1,("bad security blob length %d", blob_len));
504 rc = -EINVAL;
505 goto ssetup_exit;
506 }
507 bytes_remaining -= blob_len;
508 }
509
510 /* BB check if Unicode and decode strings */
511 if(smb_buf->Flags2 & SMBFLG2_UNICODE)
512 rc = decode_unicode_ssetup(&bcc_ptr, bytes_remaining,
513 ses, nls_cp);
514 else
515 rc = decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,nls_cp);
516
517ssetup_exit:
518 if(resp_buf_type == CIFS_SMALL_BUFFER) {
519 cFYI(1,("ssetup freeing small buf %p", iov[0].iov_base));
520 cifs_small_buf_release(iov[0].iov_base);
521 } else if(resp_buf_type == CIFS_LARGE_BUFFER)
522 cifs_buf_release(iov[0].iov_base);
523
524 return rc;
525}
Linux 6.x block layer and io_uring tree(s)