4 * SMB/CIFS session setup handling routines
6 * Copyright (c) International Business Machines Corp., 2006
7 * Author(s): Steve French (sfrench@us.ibm.com)
9 * This library is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU Lesser General Public License as published
11 * by the Free Software Foundation; either version 2.1 of the License, or
12 * (at your option) any later version.
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
17 * the GNU Lesser General Public License for more details.
19 * You should have received a copy of the GNU Lesser General Public License
20 * along with this library; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
26 #include "cifsproto.h"
27 #include "cifs_unicode.h"
28 #include "cifs_debug.h"
31 #include <linux/utsname.h>
33 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
36 static __u32 cifs_ssetup_hdr(struct cifsSesInfo *ses, SESSION_SETUP_ANDX *pSMB)
38 __u32 capabilities = 0;
40 /* init fields common to all four types of SessSetup */
41 /* note that header is initialized to zero in header_assemble */
42 pSMB->req.AndXCommand = 0xFF;
43 pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
44 pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
46 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
48 /* BB verify whether signing required on neg or just on auth frame
51 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
52 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
54 if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
55 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
57 if (ses->capabilities & CAP_UNICODE) {
58 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
59 capabilities |= CAP_UNICODE;
61 if (ses->capabilities & CAP_STATUS32) {
62 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
63 capabilities |= CAP_STATUS32;
65 if (ses->capabilities & CAP_DFS) {
66 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
67 capabilities |= CAP_DFS;
69 if (ses->capabilities & CAP_UNIX) {
70 capabilities |= CAP_UNIX;
73 /* BB check whether to init vcnum BB */
77 static void unicode_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
78 const struct nls_table * nls_cp)
80 char * bcc_ptr = *pbcc_area;
83 /* BB FIXME add check that strings total less
84 than 335 or will need to send them as arrays */
86 /* align unicode strings, must be word aligned */
87 if ((long) bcc_ptr % 2) {
92 if(ses->userName == NULL) {
93 /* BB what about null user mounts - check that we do this BB */
94 } else { /* 300 should be long enough for any conceivable user name */
95 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->userName,
98 bcc_ptr += 2 * bytes_ret;
99 bcc_ptr += 2; /* account for null termination */
101 if(ses->domainName == NULL)
102 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr,
103 "CIFS_LINUX_DOM", 32, nls_cp);
105 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->domainName,
107 bcc_ptr += 2 * bytes_ret;
108 bcc_ptr += 2; /* account for null terminator */
110 /* Copy OS version */
111 bytes_ret = cifs_strtoUCS((__le16 *)bcc_ptr, "Linux version ", 32,
113 bcc_ptr += 2 * bytes_ret;
114 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, system_utsname.release,
116 bcc_ptr += 2 * bytes_ret;
117 bcc_ptr += 2; /* trailing null */
119 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
121 bcc_ptr += 2 * bytes_ret;
122 bcc_ptr += 2; /* trailing null */
124 *pbcc_area = bcc_ptr;
127 static void ascii_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
128 const struct nls_table * nls_cp)
130 char * bcc_ptr = *pbcc_area;
133 /* BB what about null user mounts - check that we do this BB */
135 if(ses->userName == NULL) {
136 /* BB what about null user mounts - check that we do this BB */
137 } else { /* 300 should be long enough for any conceivable user name */
138 strncpy(bcc_ptr, ses->userName, 300);
140 /* BB improve check for overflow */
141 bcc_ptr += strnlen(ses->userName, 300);
143 bcc_ptr++; /* account for null termination */
147 if(ses->domainName == NULL) {
148 strcpy(bcc_ptr, "CIFS_LINUX_DOM");
149 bcc_ptr += 14; /* strlen(CIFS_LINUX_DOM) */
151 strncpy(bcc_ptr, ses->domainName, 256);
152 bcc_ptr += strnlen(ses->domainName, 256);
157 /* BB check for overflow here */
159 strcpy(bcc_ptr, "Linux version ");
160 bcc_ptr += strlen("Linux version ");
161 strcpy(bcc_ptr, system_utsname.release);
162 bcc_ptr += strlen(system_utsname.release) + 1;
164 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
165 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
167 *pbcc_area = bcc_ptr;
170 static int decode_unicode_ssetup(char ** pbcc_area, int bleft, struct cifsSesInfo *ses,
171 const struct nls_table * nls_cp)
175 char * data = *pbcc_area;
179 cFYI(1,("bleft %d",bleft));
182 /* word align, if bytes remaining is not even */
187 words_left = bleft / 2;
189 /* save off server operating system */
190 len = UniStrnlen((wchar_t *) data, words_left);
192 /* We look for obvious messed up bcc or strings in response so we do not go off
193 the end since (at least) WIN2K and Windows XP have a major bug in not null
194 terminating last Unicode string in response */
195 if(len >= words_left)
199 kfree(ses->serverOS);
200 /* UTF-8 string will not grow more than four times as big as UCS-16 */
201 ses->serverOS = kzalloc(4 * len, GFP_KERNEL);
202 if(ses->serverOS != NULL) {
203 cifs_strfromUCS_le(ses->serverOS, (__le16 *)data, len,
206 data += 2 * (len + 1);
207 words_left -= len + 1;
209 /* save off server network operating system */
210 len = UniStrnlen((wchar_t *) data, words_left);
212 if(len >= words_left)
216 kfree(ses->serverNOS);
217 ses->serverNOS = kzalloc(4 * len, GFP_KERNEL); /* BB this is wrong length FIXME BB */
218 if(ses->serverNOS != NULL) {
219 cifs_strfromUCS_le(ses->serverNOS, (__le16 *)data, len,
221 if(strncmp(ses->serverNOS, "NT LAN Manager 4",16) == 0) {
222 cFYI(1,("NT4 server"));
223 ses->flags |= CIFS_SES_NT4;
226 data += 2 * (len + 1);
227 words_left -= len + 1;
229 /* save off server domain */
230 len = UniStrnlen((wchar_t *) data, words_left);
235 if(ses->serverDomain)
236 kfree(ses->serverDomain);
237 ses->serverDomain = kzalloc(2 * (len + 1), GFP_KERNEL); /* BB FIXME wrong length */
238 if(ses->serverDomain != NULL) {
239 cifs_strfromUCS_le(ses->serverDomain, (__le16 *)data, len,
241 ses->serverDomain[2*len] = 0;
242 ses->serverDomain[(2*len) + 1] = 0;
244 data += 2 * (len + 1);
245 words_left -= len + 1;
247 cFYI(1,("words left: %d",words_left));
252 static int decode_ascii_ssetup(char ** pbcc_area, int bleft, struct cifsSesInfo *ses,
253 const struct nls_table * nls_cp)
257 char * bcc_ptr = *pbcc_area;
259 cFYI(1,("decode sessetup ascii. bleft %d", bleft));
261 len = strnlen(bcc_ptr, bleft);
266 kfree(ses->serverOS);
268 ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
270 strncpy(ses->serverOS, bcc_ptr, len);
275 len = strnlen(bcc_ptr, bleft);
280 kfree(ses->serverNOS);
282 ses->serverNOS = kzalloc(len + 1, GFP_KERNEL);
284 strncpy(ses->serverNOS, bcc_ptr, len);
289 len = strnlen(bcc_ptr, bleft);
293 if(ses->serverDomain)
294 kfree(ses->serverDomain);
296 ses->serverDomain = kzalloc(len + 1, GFP_KERNEL);
298 strncpy(ses->serverOS, bcc_ptr, len);
303 cFYI(1,("ascii: bytes left %d",bleft));
309 CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
310 const struct nls_table *nls_cp)
314 struct smb_hdr *smb_buf;
317 SESSION_SETUP_ANDX *pSMB;
320 int resp_buf_type = 0;
322 enum securityEnum type;
326 cFYI(1,("new sess setup"));
330 type = ses->server->secType;
332 #ifndef CONFIG_CIFS_WEAK_PW_HASH
333 /* LANMAN and plaintext are less secure and off by default.
334 So we make this explicitly be turned on in kconfig (in the
335 build) and turned on at runtime (changed from the default)
336 in proc/fs/cifs or via mount parm. Unfortunately this is
337 needed for old Win (e.g. Win95), some obscure NAS and OS/2 */
340 wct = 10; /* lanman 2 style sessionsetup */
341 } else if((type == NTLM) || (type == NTLMv2)) {
342 /* For NTLMv2 failures eventually may need to retry NTLM */
343 wct = 13; /* old style NTLM sessionsetup */
344 } else /* same size for negotiate or auth, NTLMSSP or extended security */
347 rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
352 pSMB = (SESSION_SETUP_ANDX *)smb_buf;
354 capabilities = cifs_ssetup_hdr(ses, pSMB);
356 /* we will send the SMB in two pieces,
357 a fixed length beginning part, and a
358 second part which will include the strings
359 and rest of bcc area, in order to avoid having
360 to do a large buffer 17K allocation */
361 iov[0].iov_base = (char *)pSMB;
362 iov[0].iov_len = smb_buf->smb_buf_length + 4;
364 /* 2000 big enough to fit max user, domain, NOS name etc. */
365 str_area = kmalloc(2000, GFP_KERNEL);
369 #ifdef CONFIG_CIFS_WEAK_PW_HASH
370 char lnm_session_key[CIFS_SESS_KEY_SIZE];
372 /* no capabilities flags in old lanman negotiation */
374 pSMB->old_req.PasswordLength = CIFS_SESS_KEY_SIZE;
375 /* BB calculate hash with password */
376 /* and copy into bcc */
378 calc_lanman_hash(ses, lnm_session_key);
380 /* #ifdef CONFIG_CIFS_DEBUG2
381 cifs_dump_mem("cryptkey: ",ses->server->cryptKey,
384 memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_SESS_KEY_SIZE);
385 bcc_ptr += CIFS_SESS_KEY_SIZE;
387 /* can not sign if LANMAN negotiated so no need
388 to calculate signing key? but what if server
389 changed to do higher than lanman dialect and
390 we reconnected would we ever calc signing_key? */
392 cFYI(1,("Negotiating LANMAN setting up strings"));
393 /* Unicode not allowed for LANMAN dialects */
394 ascii_ssetup_strings(&bcc_ptr, ses, nls_cp);
396 } else if (type == NTLM) {
397 char ntlm_session_key[CIFS_SESS_KEY_SIZE];
399 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
400 pSMB->req_no_secext.CaseInsensitivePasswordLength =
401 cpu_to_le16(CIFS_SESS_KEY_SIZE);
402 pSMB->req_no_secext.CaseSensitivePasswordLength =
403 cpu_to_le16(CIFS_SESS_KEY_SIZE);
405 /* calculate session key */
406 SMBNTencrypt(ses->password, ses->server->cryptKey,
409 if(first_time) /* should this be moved into common code
410 with similar ntlmv2 path? */
411 cifs_calculate_mac_key(ses->server->mac_signing_key,
412 ntlm_session_key, ses->password);
413 /* copy session key */
415 memcpy(bcc_ptr, (char *)ntlm_session_key,CIFS_SESS_KEY_SIZE);
416 bcc_ptr += CIFS_SESS_KEY_SIZE;
417 memcpy(bcc_ptr, (char *)ntlm_session_key,CIFS_SESS_KEY_SIZE);
418 bcc_ptr += CIFS_SESS_KEY_SIZE;
419 if(ses->capabilities & CAP_UNICODE)
420 unicode_ssetup_strings(&bcc_ptr, ses, nls_cp);
422 ascii_ssetup_strings(&bcc_ptr, ses, nls_cp);
423 } else if (type == NTLMv2) {
425 kmalloc(sizeof(struct ntlmv2_resp), GFP_KERNEL);
427 /* BB FIXME change all users of v2_sess_key to
428 struct ntlmv2_resp */
430 if(v2_sess_key == NULL) {
431 cifs_small_buf_release(smb_buf);
435 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
437 /* LM2 password would be here if we supported it */
438 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
439 /* cpu_to_le16(LM2_SESS_KEY_SIZE); */
441 pSMB->req_no_secext.CaseSensitivePasswordLength =
442 cpu_to_le16(sizeof(struct ntlmv2_resp));
444 /* calculate session key */
445 setup_ntlmv2_rsp(ses, v2_sess_key, nls_cp);
446 if(first_time) /* should this be moved into common code
447 with similar ntlmv2 path? */
448 /* cifs_calculate_ntlmv2_mac_key(ses->server->mac_signing_key,
449 response BB FIXME, v2_sess_key); */
451 /* copy session key */
453 /* memcpy(bcc_ptr, (char *)ntlm_session_key,LM2_SESS_KEY_SIZE);
454 bcc_ptr += LM2_SESS_KEY_SIZE; */
455 memcpy(bcc_ptr, (char *)v2_sess_key, sizeof(struct ntlmv2_resp));
456 bcc_ptr += sizeof(struct ntlmv2_resp);
458 if(ses->capabilities & CAP_UNICODE)
459 unicode_ssetup_strings(&bcc_ptr, ses, nls_cp);
461 ascii_ssetup_strings(&bcc_ptr, ses, nls_cp);
462 } else /* NTLMSSP or SPNEGO */ {
463 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
464 capabilities |= CAP_EXTENDED_SECURITY;
465 pSMB->req.Capabilities = cpu_to_le32(capabilities);
466 /* BB set password lengths */
469 count = (long) bcc_ptr - (long) str_area;
470 smb_buf->smb_buf_length += count;
472 BCC_LE(smb_buf) = cpu_to_le16(count);
474 iov[1].iov_base = str_area;
475 iov[1].iov_len = count;
476 rc = SendReceive2(xid, ses, iov, 2 /* num_iovecs */, &resp_buf_type, 0);
477 /* SMB request buf freed in SendReceive2 */
479 cFYI(1,("ssetup rc from sendrecv2 is %d",rc));
483 pSMB = (SESSION_SETUP_ANDX *)iov[0].iov_base;
484 smb_buf = (struct smb_hdr *)iov[0].iov_base;
486 if((smb_buf->WordCount != 3) && (smb_buf->WordCount != 4)) {
488 cERROR(1,("bad word count %d", smb_buf->WordCount));
491 action = le16_to_cpu(pSMB->resp.Action);
492 if (action & GUEST_LOGIN)
493 cFYI(1, ("Guest login")); /* BB mark SesInfo struct? */
494 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
495 cFYI(1, ("UID = %d ", ses->Suid));
496 /* response can have either 3 or 4 word count - Samba sends 3 */
497 /* and lanman response is 3 */
498 bytes_remaining = BCC(smb_buf);
499 bcc_ptr = pByteArea(smb_buf);
501 if(smb_buf->WordCount == 4) {
503 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
505 if(blob_len > bytes_remaining) {
506 cERROR(1,("bad security blob length %d", blob_len));
510 bytes_remaining -= blob_len;
513 /* BB check if Unicode and decode strings */
514 if(smb_buf->Flags2 & SMBFLG2_UNICODE)
515 rc = decode_unicode_ssetup(&bcc_ptr, bytes_remaining,
518 rc = decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,nls_cp);
522 if(resp_buf_type == CIFS_SMALL_BUFFER) {
523 cFYI(1,("ssetup freeing small buf %p", iov[0].iov_base));
524 cifs_small_buf_release(iov[0].iov_base);
525 } else if(resp_buf_type == CIFS_LARGE_BUFFER)
526 cifs_buf_release(iov[0].iov_base);