Commit graph

75 commits

Author SHA1 Message Date
Jeff Layton
690c522fa5 cifs: use get/put_unaligned functions to access ByteCount
It's possible that when we access the ByteCount that the alignment
will be off. Most CPUs deal with that transparently, but there's
usually some performance impact. Some CPUs raise an exception on
unaligned accesses.

Fix this by accessing the byte count using the get_unaligned and
put_unaligned inlined functions. While we're at it, fix the types
of some of the variables that end up getting returns from these
functions.

Acked-by: Pavel Shilovsky <piastryyy@gmail.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2011-01-20 21:46:29 +00:00
Jeff Layton
766fdbb57f cifs: add ability to send an echo request
Reviewed-by: Suresh Jayaraman <sjayaraman@suse.de>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2011-01-20 17:46:44 +00:00
Shirish Pargaonkar
d2b915210b NTLM auth and sign - Define crypto hash functions and create and send keys needed for key exchange
Mark dependency on crypto modules in Kconfig.

Defining per structures sdesc and cifs_secmech which are used to store
crypto hash functions and contexts.  They are stored per smb connection
and used for all auth mechs to genereate hash values and signatures.

Allocate crypto hashing functions, security descriptiors, and respective
contexts when a smb/tcp connection is established.
Release them when a tcp/smb connection is taken down.

md5 and hmac-md5 are two crypto hashing functions that are used
throught the life of an smb/tcp connection by various functions that
calcualte signagure and ntlmv2 hash, HMAC etc.

structure ntlmssp_auth is defined as per smb connection.

ntlmssp_auth holds ciphertext which is genereated by rc4/arc4 encryption of
secondary key, a nonce using ntlmv2 session key and sent in the session key
field of the type 3 message sent by the client during ntlmssp
negotiation/exchange

A key is exchanged with the server if client indicates so in flags in
type 1 messsage and server agrees in flag in type 2 message of ntlmssp
negotiation.  If both client and agree, a key sent by client in
type 3 message of ntlmssp negotiation in the session key field.
The key is a ciphertext generated off of secondary key, a nonce, using
ntlmv2 hash via rc4/arc4.

Signing works for ntlmssp in this patch. The sequence number within
the server structure needs to be zero until session is established
i.e. till type 3 packet of ntlmssp exchange of a to be very first
smb session on that smb connection is sent.

Acked-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2010-10-26 18:35:31 +00:00
Shirish Pargaonkar
21e733930b NTLM auth and sign - Allocate session key/client response dynamically
Start calculating auth response within a session.  Move/Add pertinet
data structures like session key, server challenge and ntlmv2_hash in
a session structure.  We should do the calculations within a session
before copying session key and response over to server data
structures because a session setup can fail.

Only after a very first smb session succeeds, it copy/make its
session key, session key of smb connection.  This key stays with
the smb connection throughout its life.
sequence_number within server is set to 0x2.

The authentication Message Authentication Key (mak) which consists
of session key followed by client response within structure session_key
is now dynamic.  Every authentication type allocates the key + response
sized memory within its session structure and later either assigns or
frees it once the client response is sent and if session's session key
becomes connetion's session key.

ntlm/ntlmi authentication functions are rearranged.  A function
named setup_ntlm_resp(), similar to setup_ntlmv2_resp(), replaces
function cifs_calculate_session_key().

size of CIFS_SESS_KEY_SIZE is changed to 16, to reflect the byte size
of the key it holds.

Reviewed-by: Jeff Layton <jlayton@samba.org>
Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2010-10-26 18:20:10 +00:00
Shirish Pargaonkar
2b149f1197 cifs NTLMv2/NTLMSSP ntlmv2 within ntlmssp autentication code
Attribue Value (AV) pairs or Target Info (TI) pairs are part of
ntlmv2 authentication.
Structure ntlmv2_resp had only definition for two av pairs.
So removed it, and now allocation of av pairs is dynamic.
For servers like Windows 7/2008, av pairs sent by server in
challege packet (type 2 in the ntlmssp exchange/negotiation) can
vary.

Server sends them during ntlmssp negotiation. So when ntlmssp is used
as an authentication mechanism, type 2 challenge packet from server
has this information.  Pluck it and use the entire blob for
authenticaiton purpose.  If user has not specified, extract
(netbios) domain name from the av pairs which is used to calculate
ntlmv2 hash.  Servers like Windows 7 are particular about the AV pair
blob.

Servers like Windows 2003, are not very strict about the contents
of av pair blob used during ntlmv2 authentication.
So when security mechanism such as ntlmv2 is used (not ntlmv2 in ntlmssp),
there is no negotiation and so genereate a minimal blob that gets
used in ntlmv2 authentication as well as gets sent.

Fields tilen and tilbob are session specific.  AV pair values are defined.

To calculate ntlmv2 response we need ti/av pair blob.

For sec mech like ntlmssp, the blob is plucked from type 2 response from
the server.  From this blob, netbios name of the domain is retrieved,
if user has not already provided, to be included in the Target String
as part of ntlmv2 hash calculations.

For sec mech like ntlmv2, create a minimal, two av pair blob.

The allocated blob is freed in case of error.  In case there is no error,
this blob is used in calculating ntlmv2 response (in CalcNTLMv2_response)
and is also copied on the response to the server, and then freed.

The type 3 ntlmssp response is prepared on a buffer,
5 * sizeof of struct _AUTHENTICATE_MESSAGE, an empirical value large
enough to hold _AUTHENTICATE_MESSAGE plus a blob with max possible
10 values as part of ntlmv2 response and lmv2 keys and domain, user,
workstation  names etc.

Also, kerberos gets selected as a default mechanism if server supports it,
over the other security mechanisms.

Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2010-09-29 19:04:29 +00:00
Steve French
c8e56f1f4f Revert "[CIFS] Fix ntlmv2 auth with ntlmssp"
This reverts commit 9fbc590860.

The change to kernel crypto and fixes to ntlvm2 and ntlmssp
series, introduced a regression.  Deferring this patch series
to 2.6.37 after Shirish fixes it.

Signed-off-by: Steve French <sfrench@us.ibm.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
CC: Shirish Pargaonkar <shirishp@us.ibm.com>
2010-09-08 21:10:58 +00:00
Steve French
9fbc590860 [CIFS] Fix ntlmv2 auth with ntlmssp
Make ntlmv2 as an authentication mechanism within ntlmssp
instead of ntlmv1.
Parse type 2 response in ntlmssp negotiation to pluck
AV pairs and use them to calculate ntlmv2 response token.
Also, assign domain name from the sever response in type 2
packet of ntlmssp and use that (netbios) domain name in
calculation of response.

Enable cifs/smb signing using rc4 and md5.

Changed name of the structure mac_key to session_key to reflect
the type of key it holds.

Use kernel crypto_shash_* APIs instead of the equivalent cifs functions.

Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2010-08-20 20:42:26 +00:00
Jeff Layton
370b41911c cifs: add parens around smb_var in BCC macros
...to remove ambiguity about how these values are interpreted when
passing in more complex values as arguments.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2010-02-23 20:45:21 +00:00
Adam Buchbinder
6070d81eb5 tree-wide: fix misspelling of "definition" in comments
"Definition" is misspelled "defintion" in several comments; this
patch fixes them. No code changes.

Signed-off-by: Adam Buchbinder <adam.buchbinder@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2009-12-04 23:41:47 +01:00
Jeff Layton
cc0bad7552 cifs: add new cifs_iget function and convert unix codepath to use it
cifs: add new cifs_iget function and convert unix codepath to use it

In order to unify some codepaths, introduce a common cifs_fattr struct
for storing inode attributes. The different codepaths (unix, legacy,
normal, etc...) can fill out this struct with inode info. It can then be
passed as an arg to a common set of routines to get and update inodes.

Add a new cifs_iget function that uses iget5_locked to identify inodes.
This will compare inodes based on the uniqueid value in a cifs_fattr
struct.

Rather than filling out an already-created inode, have
cifs_get_inode_info_unix instead fill out cifs_fattr and hand that off
to cifs_iget. cifs_iget can then properly look for hardlinked inodes.

On the readdir side, add a new cifs_readdir_lookup function that spawns
populated dentries. Redefine FILE_UNIX_INFO so that it's basically a
FILE_UNIX_BASIC_INFO that has a few fields wrapped around it. This
allows us to more easily use the same function for filling out the fattr
as the non-readdir codepath.

With this, we should then have proper hardlink detection and can
eventually get rid of some nasty CIFS-specific hacks for handing them.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2009-07-01 21:26:42 +00:00
Steve French
85a6dac54a [CIFS] Endian convert UniqueId when reporting inode numbers from server files
Jeff made a good point that we should endian convert the UniqueId when we use
it to set i_ino Even though this value is opaque to the client, when comparing
the inode numbers of the same server file from two different clients (one
big endian, one little endian) or when we compare a big endian client's view
of i_ino with what the server thinks - we should get the same value

Signed-off-by: Steve French <sfrench@us.ibm.com>
2009-04-17 01:26:48 +00:00
Steve French
0382457744 [CIFS] Add definitions for remoteably fsctl calls
There are about 60 fsctl calls which Windows claims would be able
to be sent remotely and handled by the server. This adds the #defines
for them.  A few of them look immediately useful, but need to also
add the structure definitions for them so they can be sent as SMBs.

Signed-off-by: Steve French <sfrench@us.ibm.com>
2009-03-12 01:36:21 +00:00
Steve French
10e70afa75 [CIFS] DFS no longer experimental
Also updates some DFS flag definitions

Signed-off-by: Steve French <sfrench@us.ibm.com>
2009-03-12 01:36:20 +00:00
Steve French
b298f22355 [CIFS] Send SMB flush in cifs_fsync
In contrast to the now-obsolete smbfs, cifs does not send SMB_COM_FLUSH
in response to an explicit fsync(2) to guarantee that all volatile data
is written to stable storage on the server side, provided the server
honors the request (which, to my knowledge, is true for Windows and
Samba with 'strict sync' enabled).
This patch modifies the cifs_fsync implementation to restore the
fsync-behavior of smbfs by triggering SMB_COM_FLUSH after sending
outstanding data on the client side to the server.

Signed-off-by: Horst Reiterer <horst.reiterer@gmail.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2009-03-12 01:36:20 +00:00
Steve French
61e7480158 [CIFS] various minor cleanups pointed out by checkpatch script
Signed-off-by: Steve French <sfrench@us.ibm.com>
2008-12-26 02:29:10 +00:00
Jeff Layton
4e1e7fb9e8 bundle up Unix SET_PATH_INFO args into a struct and change name
We'd like to be able to use the unix SET_PATH_INFO_BASIC args to set
file times as well, but that makes the argument list rather long. Bundle
up the args for unix SET_PATH_INFO call into a struct. For now, we don't
actually use the times fields anywhere. That will be done in a follow-on
patch.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2008-08-06 04:17:20 +00:00
Shirish Pargaonkar
ef571cadd5 [CIFS] Fix warnings from checkpatch
Signed-off-by: Steve French <sfrench@us.ibm.com>
2008-07-24 15:56:05 +00:00
Steve French
b7206153f6 [CIFS] Correct incorrect obscure open flag
Also add defines for pipe subcommand codes

Signed-off-by: Steve French <sfrench@us.ibm.com>
2008-05-23 20:35:07 +00:00
Steve French
a1fe78f16e [CIFS] Add missing defines for DFS
Also has minor cleanup of previous patch

CC: Igor Mammedov <niallain@gmail.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2008-05-16 18:48:38 +00:00
Igor Mammedov
fec4585fd7 CIFSGetDFSRefer cleanup + dfs_referral_level_3 fixed to conform REFERRAL_V3 the MS-DFSC spec.
Signed-off-by: Igor Mammedov <niallain@gmail.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2008-05-16 18:41:43 +00:00
Jeff Layton
67750fb9e0 [CIFS] when not using unix extensions, check for and set ATTR_READONLY on create and mkdir
When creating a directory on a CIFS share without POSIX extensions,
and the given mode has no write bits set, set the ATTR_READONLY bit.

When creating a file, set ATTR_READONLY if the create mode has no write
bits set and we're not using unix extensions.

There are some comments about this being problematic due to the VFS
splitting creates into 2 parts. I'm not sure what that's actually
talking about, but I'm assuming that it has something to do with how
mknod is implemented. In the simple case where we have no unix
extensions and we're just creating a regular file, there's no reason
we can't set ATTR_READONLY.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2008-05-11 17:45:43 +00:00
Steve French
0206e61b46 [CIFS] Fix spelling mistake
Noticed by Joe Perches

Signed-off-by: Steve French <sfrench@us.ibm.com>
2008-04-25 18:19:40 +00:00
Steve French
a7f796a60b [CIFS] Fix typo in previous commit
Signed-off-by: Steve French <sfrench@us.ibm.com>
2008-04-24 16:39:07 +00:00
Steve French
ee4987ab5c [CIFS] Fix define for new proxy cap to match documentation
The transport encryption capability and new SetFSInfo level were missing, and the
new proxy capability (which Samba server is implementing) and proxy setfsinfo needed
to be moved down to not collide with Samba's transport encryption capability.

CC: Jeremy Allison <jra@samba.org>
CC: Sam Liddicott <sam@lidicott.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2008-04-24 16:31:12 +00:00
Steve French
2302aca850 [CIFS] Reserve new proxy cap for WAFS
New WAFS filer uses ioctls which are shown to be available
on a share by querying this info level

Acked-by: Sam Liddicott <sam@liddicott.com>
Signed-off-by: Stevef French <sfrench@us.ibm.com>
2008-04-18 16:40:32 +00:00
Steve French
675c46796d [CIFS] Add various missing flags and defintions
Signed-off-by: Steve French <sfrench@us.ibm.com>
2008-04-17 23:41:01 +00:00
Steve French
97837582bc [CIFS] Allow setting mode via cifs acl
Requires cifsacl mount flag to be on and CIFS_EXPERIMENTAL enabled

CC: Shirish Pargaonkar <shirishp@us.ibm.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2007-12-31 07:47:21 +00:00
Steve French
7505e0525c [CIFS] If no Access Control Entries, set mode perm bits to zero
Also clean up ACL code

Acked-by: Shirish Pargaonkar <shirishp@us.ibm.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2007-11-01 18:03:01 +00:00
Steve French
953f868138 [CIFS] Don't request too much permission when reading an ACL
We were requesting GENERIC_READ but that fails when  we do not have
read permission on the file (even if we could read the ACL).

Also move the dump access control entry code into debug ifdef.

Signed-off-by: Steve French <sfrench@us.ibm.com>
2007-10-31 04:54:42 +00:00
Steve French
a750e77c21 [CIFS] acl support part 4
Signed-off-by: Steve French <sfrench@us.ibm.com>
2007-10-17 22:50:39 +00:00
Steve French
92ad9b93cd [CIFS] named pipe support (part 2)
Also fixes typo which could cause build break

Signed-off-by: Steve French <sfrench@us.ibm.com>
2007-09-29 05:21:58 +00:00
Steve French
26f57364d7 [CIFS] formatting cleanup found by checkpatch
Signed-off-by: Steve French <sfrench@us.ibm.com>
2007-08-30 22:09:15 +00:00
Steve French
2d785a50a8 [CIFS] Add support for new POSIX unlink
In the cleanup phase of the dbench test, we were noticing sharing
violation followed by failed directory removals when dbench
did not close the test files before the cleanup phase started.
Using the new POSIX unlink, which Samba has supported for a few
months, avoids this.

Signed-off-by: Steve French <sfrench@us.ibm.com>
2007-07-15 01:48:57 +00:00
Steve French
50c2f75388 [CIFS] whitespace/formatting fixes
This should be the last big batch of whitespace/formatting fixes.
checkpatch warnings for the cifs directory are down about 90% and
many of the remaining ones are harder to remove or make the code
harder to read.

Signed-off-by: Steve French <sfrench@us.ibm.com>
2007-07-13 00:33:32 +00:00
Steve French
75865f8cc8 [CIFS] Add in some missing flags and cifs README and TODO corrections
Signed-off-by: Steve French <sfrench@us.ibm.com>
2007-06-24 18:30:48 +00:00
Steve French
2dd29d3133 [CIFS] New CIFS POSIX mkdir performance improvement
Signed-off-by: Steve French <sfrench@us.ibm.com>
2007-04-23 22:07:35 +00:00
Linus Torvalds
12998096cc Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
  [CIFS] Allow reset of file to ATTR_NORMAL when archive bit not set
  [CIFS] Do not negotiate new POSIX_PATH_OPERATIONS_CAP yet
  [CIFS] reset mode when client notices that ATTR_READONLY is no longer set
2007-03-22 19:47:09 -07:00
Steve French
38e2aff670 [CIFS] Do not negotiate new POSIX_PATH_OPERATIONS_CAP yet
Samba server now expects that clients which send the new
POSIX_PATH_OPERATIONS_CAP send all opens with this new
SMB - and expects that clients that could send the new
posix open/create but don't as indicating that they really
want Windows semantics on that handle (which allows Samba
to support clients which want to support both types of
behaviors on different handles on the same mount)

We will put this capability back in the SetFSInfo
negotiation with servers like Samba when the
new POSIXCreate (create/open/mkdir) code is finished.

Signed-off-by: Steve French <sfrench@us.ibm.com>
2007-03-16 05:12:53 +00:00
Al Viro
82c05a13c9 [PATCH] cifs endianness annotations
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-03-14 15:27:50 -07:00
Steve French
c7af1857ef [CIFS] Fix set file size to zero when doing chmod to Samba 3.0.26pre
In fixing a bug Samba 3.0.26pre allowed some clients (including Linux cifs
client) to change file size to zero in SET_FILE_UNIX_BASIC (which Linux cifs
client uses for chmod).

The server has been "fixed" now but that also fixes the client to net send
file size zero on chmod.

Fixes Samba bugzilla bug # 4418.

Fixed with help from Jeremy Allison

Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2007-03-01 04:11:22 +00:00
Steve French
c14e894bd4 [CIFS] fix &&/& typo in cifs_setattr()
Thanks to Dirk for pointing this out.

Signed-off-by: Dirk Mueller <dmueller@suse.de>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2007-02-15 01:33:18 +00:00
Steve French
8af1897158 [CIFS] on reconnect to Samba - reset the unix capabilities
After temporary server or network failure and reconneciton, we were not
resending the unix capabilities via SetFSInfo - which confused Samba posix
byte range locking code.

Discovered by jra

Signed-off-by: Steve French <sfrench@us.ibm.com>
2007-02-14 04:42:51 +00:00
Steve French
595dcfecf6 [CIFS] POSIX CIFS Extensions (continued) - POSIX Open
Signed-off-by: Steve French <sfrench@us.ibm.com>
2007-02-08 18:11:42 +00:00
Steve French
87f440e70e [CIFS] Additional POSIX CIFS Extensions infolevels
also includes cleanup of whitespace/80 columns

Signed-off-by: Steve French <sfrench@us.ibm.com>
2007-02-07 00:29:46 +00:00
Steve French
33ec32fae0 [CIFS] Fix NTLMv2 mounts to Windows servers
Windows servers are pickier about NTLMv2 than Samba.
This enables more secure mounts to Windows (not just Samba)
ie when "sec=ntlmv2" is specified on the mount.

Signed-off-by: Steve French <sfrench@us.ibm.com>
2006-12-08 04:14:28 +00:00
Steve French
b815f1e559 [CIFS] Allow for 15 minute TZs (e.g. Nepal) and be more explicit about
not setting time on close

Signed-off-by: Guenter Kukkukk <linux@kukkukk.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2006-10-02 05:53:29 +00:00
Steve French
9ac00b7d96 [CIFS] Do not send newer QFSInfo to legacy servers which can not support it
Fix dialect negotiation to save off when we have negotiated lanman.
This allows us to avoid sending some somewhat newer requests that the server
can not handle and go directly to the older version (infolevel) of the same
call. Make sure we try to negotiate a level which allows us to get the
server OS (which we check so we can detect Win9x vs. other legacy servers
and eventually work around the Win9x DOS time bug (they reverse date/time
fields).

Signed-off-by: Steve French <sfrench@us.ibm.com>
2006-09-30 04:13:17 +00:00
Steve French
175ec9e11c [CIFS] Rename server time zone field
Server time zone is not really a time zone, rather a time adjustement
in seconds.

CC: Guenter Kukkukk <linux@kukkukk.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
2006-09-30 01:07:38 +00:00
Steve French
2fe87f02a0 [CIFS] Support deep tree mounts (e.g. mounts to //server/share/path)
Samba bugzilla #4040

Signed-off-by: Steve French <sfrench@us.ibm.com>
2006-09-21 07:02:52 +00:00
Steve French
5bafd76593 [CIFS] Add support for readdir to legacy servers
Fixes oops to OS/2 on ls and removes redundant NTCreateX calls to servers
which do not support NT SMBs.  Key operations to OS/2 work.

Signed-off-by: Steve French <sfrench@us.ibm.com>
2006-06-07 00:18:43 +00:00