2 * fs/cifs/smb2transport.c
4 * Copyright (C) International Business Machines Corp., 2002, 2011
6 * Author(s): Steve French (sfrench@us.ibm.com)
7 * Jeremy Allison (jra@samba.org) 2006
8 * Pavel Shilovsky (pshilovsky@samba.org) 2012
10 * This library is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU Lesser General Public License as published
12 * by the Free Software Foundation; either version 2.1 of the License, or
13 * (at your option) any later version.
15 * This library is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
18 * the GNU Lesser General Public License for more details.
20 * You should have received a copy of the GNU Lesser General Public License
21 * along with this library; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
26 #include <linux/list.h>
27 #include <linux/wait.h>
28 #include <linux/net.h>
29 #include <linux/delay.h>
30 #include <linux/uaccess.h>
31 #include <asm/processor.h>
32 #include <linux/mempool.h>
33 #include <linux/highmem.h>
36 #include "cifsproto.h"
37 #include "smb2proto.h"
38 #include "cifs_debug.h"
39 #include "smb2status.h"
43 smb2_crypto_shash_allocate(struct TCP_Server_Info *server)
48 if (server->secmech.sdeschmacsha256 != NULL)
49 return 0; /* already allocated */
51 server->secmech.hmacsha256 = crypto_alloc_shash("hmac(sha256)", 0, 0);
52 if (IS_ERR(server->secmech.hmacsha256)) {
53 cifs_dbg(VFS, "could not allocate crypto hmacsha256\n");
54 rc = PTR_ERR(server->secmech.hmacsha256);
55 server->secmech.hmacsha256 = NULL;
59 size = sizeof(struct shash_desc) +
60 crypto_shash_descsize(server->secmech.hmacsha256);
61 server->secmech.sdeschmacsha256 = kmalloc(size, GFP_KERNEL);
62 if (!server->secmech.sdeschmacsha256) {
63 crypto_free_shash(server->secmech.hmacsha256);
64 server->secmech.hmacsha256 = NULL;
67 server->secmech.sdeschmacsha256->shash.tfm = server->secmech.hmacsha256;
68 server->secmech.sdeschmacsha256->shash.flags = 0x0;
74 smb3_crypto_shash_allocate(struct TCP_Server_Info *server)
79 if (server->secmech.sdesccmacaes != NULL)
80 return 0; /* already allocated */
82 rc = smb2_crypto_shash_allocate(server);
86 server->secmech.cmacaes = crypto_alloc_shash("cmac(aes)", 0, 0);
87 if (IS_ERR(server->secmech.cmacaes)) {
88 cifs_dbg(VFS, "could not allocate crypto cmac-aes");
89 kfree(server->secmech.sdeschmacsha256);
90 server->secmech.sdeschmacsha256 = NULL;
91 crypto_free_shash(server->secmech.hmacsha256);
92 server->secmech.hmacsha256 = NULL;
93 rc = PTR_ERR(server->secmech.cmacaes);
94 server->secmech.cmacaes = NULL;
98 size = sizeof(struct shash_desc) +
99 crypto_shash_descsize(server->secmech.cmacaes);
100 server->secmech.sdesccmacaes = kmalloc(size, GFP_KERNEL);
101 if (!server->secmech.sdesccmacaes) {
102 cifs_dbg(VFS, "%s: Can't alloc cmacaes\n", __func__);
103 kfree(server->secmech.sdeschmacsha256);
104 server->secmech.sdeschmacsha256 = NULL;
105 crypto_free_shash(server->secmech.hmacsha256);
106 crypto_free_shash(server->secmech.cmacaes);
107 server->secmech.hmacsha256 = NULL;
108 server->secmech.cmacaes = NULL;
111 server->secmech.sdesccmacaes->shash.tfm = server->secmech.cmacaes;
112 server->secmech.sdesccmacaes->shash.flags = 0x0;
117 static struct cifs_ses *
118 smb2_find_smb_ses(struct smb2_sync_hdr *shdr, struct TCP_Server_Info *server)
120 struct cifs_ses *ses;
122 spin_lock(&cifs_tcp_ses_lock);
123 list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
124 if (ses->Suid != shdr->SessionId)
126 spin_unlock(&cifs_tcp_ses_lock);
129 spin_unlock(&cifs_tcp_ses_lock);
135 smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
138 unsigned char smb2_signature[SMB2_HMACSHA256_SIZE];
139 unsigned char *sigptr = smb2_signature;
140 struct kvec *iov = rqst->rq_iov;
141 struct smb2_sync_hdr *shdr = get_sync_hdr(iov[0].iov_base);
142 struct cifs_ses *ses;
144 ses = smb2_find_smb_ses(shdr, server);
146 cifs_dbg(VFS, "%s: Could not find session\n", __func__);
150 memset(smb2_signature, 0x0, SMB2_HMACSHA256_SIZE);
151 memset(shdr->Signature, 0x0, SMB2_SIGNATURE_SIZE);
153 rc = smb2_crypto_shash_allocate(server);
155 cifs_dbg(VFS, "%s: shah256 alloc failed\n", __func__);
159 rc = crypto_shash_setkey(server->secmech.hmacsha256,
160 ses->auth_key.response, SMB2_NTLMV2_SESSKEY_SIZE);
162 cifs_dbg(VFS, "%s: Could not update with response\n", __func__);
166 rc = crypto_shash_init(&server->secmech.sdeschmacsha256->shash);
168 cifs_dbg(VFS, "%s: Could not init sha256", __func__);
172 rc = __cifs_calc_signature(rqst, server, sigptr,
173 &server->secmech.sdeschmacsha256->shash);
176 memcpy(shdr->Signature, sigptr, SMB2_SIGNATURE_SIZE);
181 static int generate_key(struct cifs_ses *ses, struct kvec label,
182 struct kvec context, __u8 *key, unsigned int key_size)
184 unsigned char zero = 0x0;
185 __u8 i[4] = {0, 0, 0, 1};
186 __u8 L[4] = {0, 0, 0, 128};
188 unsigned char prfhash[SMB2_HMACSHA256_SIZE];
189 unsigned char *hashptr = prfhash;
191 memset(prfhash, 0x0, SMB2_HMACSHA256_SIZE);
192 memset(key, 0x0, key_size);
194 rc = smb3_crypto_shash_allocate(ses->server);
196 cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
197 goto smb3signkey_ret;
200 rc = crypto_shash_setkey(ses->server->secmech.hmacsha256,
201 ses->auth_key.response, SMB2_NTLMV2_SESSKEY_SIZE);
203 cifs_dbg(VFS, "%s: Could not set with session key\n", __func__);
204 goto smb3signkey_ret;
207 rc = crypto_shash_init(&ses->server->secmech.sdeschmacsha256->shash);
209 cifs_dbg(VFS, "%s: Could not init sign hmac\n", __func__);
210 goto smb3signkey_ret;
213 rc = crypto_shash_update(&ses->server->secmech.sdeschmacsha256->shash,
216 cifs_dbg(VFS, "%s: Could not update with n\n", __func__);
217 goto smb3signkey_ret;
220 rc = crypto_shash_update(&ses->server->secmech.sdeschmacsha256->shash,
221 label.iov_base, label.iov_len);
223 cifs_dbg(VFS, "%s: Could not update with label\n", __func__);
224 goto smb3signkey_ret;
227 rc = crypto_shash_update(&ses->server->secmech.sdeschmacsha256->shash,
230 cifs_dbg(VFS, "%s: Could not update with zero\n", __func__);
231 goto smb3signkey_ret;
234 rc = crypto_shash_update(&ses->server->secmech.sdeschmacsha256->shash,
235 context.iov_base, context.iov_len);
237 cifs_dbg(VFS, "%s: Could not update with context\n", __func__);
238 goto smb3signkey_ret;
241 rc = crypto_shash_update(&ses->server->secmech.sdeschmacsha256->shash,
244 cifs_dbg(VFS, "%s: Could not update with L\n", __func__);
245 goto smb3signkey_ret;
248 rc = crypto_shash_final(&ses->server->secmech.sdeschmacsha256->shash,
251 cifs_dbg(VFS, "%s: Could not generate sha256 hash\n", __func__);
252 goto smb3signkey_ret;
255 memcpy(key, hashptr, key_size);
266 struct derivation_triplet {
267 struct derivation signing;
268 struct derivation encryption;
269 struct derivation decryption;
273 generate_smb3signingkey(struct cifs_ses *ses,
274 const struct derivation_triplet *ptriplet)
278 rc = generate_key(ses, ptriplet->signing.label,
279 ptriplet->signing.context, ses->smb3signingkey,
284 rc = generate_key(ses, ptriplet->encryption.label,
285 ptriplet->encryption.context, ses->smb3encryptionkey,
290 return generate_key(ses, ptriplet->decryption.label,
291 ptriplet->decryption.context,
292 ses->smb3decryptionkey, SMB3_SIGN_KEY_SIZE);
296 generate_smb30signingkey(struct cifs_ses *ses)
299 struct derivation_triplet triplet;
300 struct derivation *d;
302 d = &triplet.signing;
303 d->label.iov_base = "SMB2AESCMAC";
304 d->label.iov_len = 12;
305 d->context.iov_base = "SmbSign";
306 d->context.iov_len = 8;
308 d = &triplet.encryption;
309 d->label.iov_base = "SMB2AESCCM";
310 d->label.iov_len = 11;
311 d->context.iov_base = "ServerIn ";
312 d->context.iov_len = 10;
314 d = &triplet.decryption;
315 d->label.iov_base = "SMB2AESCCM";
316 d->label.iov_len = 11;
317 d->context.iov_base = "ServerOut";
318 d->context.iov_len = 10;
320 return generate_smb3signingkey(ses, &triplet);
324 generate_smb311signingkey(struct cifs_ses *ses)
327 struct derivation_triplet triplet;
328 struct derivation *d;
330 d = &triplet.signing;
331 d->label.iov_base = "SMB2AESCMAC";
332 d->label.iov_len = 12;
333 d->context.iov_base = "SmbSign";
334 d->context.iov_len = 8;
336 d = &triplet.encryption;
337 d->label.iov_base = "SMB2AESCCM";
338 d->label.iov_len = 11;
339 d->context.iov_base = "ServerIn ";
340 d->context.iov_len = 10;
342 d = &triplet.decryption;
343 d->label.iov_base = "SMB2AESCCM";
344 d->label.iov_len = 11;
345 d->context.iov_base = "ServerOut";
346 d->context.iov_len = 10;
348 return generate_smb3signingkey(ses, &triplet);
352 smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
355 unsigned char smb3_signature[SMB2_CMACAES_SIZE];
356 unsigned char *sigptr = smb3_signature;
357 struct kvec *iov = rqst->rq_iov;
358 struct smb2_sync_hdr *shdr = get_sync_hdr(iov[0].iov_base);
359 struct cifs_ses *ses;
361 ses = smb2_find_smb_ses(shdr, server);
363 cifs_dbg(VFS, "%s: Could not find session\n", __func__);
367 memset(smb3_signature, 0x0, SMB2_CMACAES_SIZE);
368 memset(shdr->Signature, 0x0, SMB2_SIGNATURE_SIZE);
370 rc = crypto_shash_setkey(server->secmech.cmacaes,
371 ses->smb3signingkey, SMB2_CMACAES_SIZE);
374 cifs_dbg(VFS, "%s: Could not set key for cmac aes\n", __func__);
379 * we already allocate sdesccmacaes when we init smb3 signing key,
380 * so unlike smb2 case we do not have to check here if secmech are
383 rc = crypto_shash_init(&server->secmech.sdesccmacaes->shash);
385 cifs_dbg(VFS, "%s: Could not init cmac aes\n", __func__);
389 rc = __cifs_calc_signature(rqst, server, sigptr,
390 &server->secmech.sdesccmacaes->shash);
393 memcpy(shdr->Signature, sigptr, SMB2_SIGNATURE_SIZE);
398 /* must be called with server->srv_mutex held */
400 smb2_sign_rqst(struct smb_rqst *rqst, struct TCP_Server_Info *server)
403 struct smb2_sync_hdr *shdr = get_sync_hdr(rqst->rq_iov[0].iov_base);
405 if (!(shdr->Flags & SMB2_FLAGS_SIGNED) ||
406 server->tcpStatus == CifsNeedNegotiate)
409 if (!server->session_estab) {
410 strncpy(shdr->Signature, "BSRSPYL", 8);
414 rc = server->ops->calc_signature(rqst, server);
420 smb2_verify_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
423 char server_response_sig[16];
424 struct smb2_sync_hdr *shdr = get_sync_hdr(rqst->rq_iov[0].iov_base);
426 if ((shdr->Command == SMB2_NEGOTIATE) ||
427 (shdr->Command == SMB2_SESSION_SETUP) ||
428 (shdr->Command == SMB2_OPLOCK_BREAK) ||
429 (!server->session_estab))
433 * BB what if signatures are supposed to be on for session but
434 * server does not send one? BB
437 /* Do not need to verify session setups with signature "BSRSPYL " */
438 if (memcmp(shdr->Signature, "BSRSPYL ", 8) == 0)
439 cifs_dbg(FYI, "dummy signature received for smb command 0x%x\n",
443 * Save off the origiginal signature so we can modify the smb and check
444 * our calculated signature against what the server sent.
446 memcpy(server_response_sig, shdr->Signature, SMB2_SIGNATURE_SIZE);
448 memset(shdr->Signature, 0, SMB2_SIGNATURE_SIZE);
450 mutex_lock(&server->srv_mutex);
451 rc = server->ops->calc_signature(rqst, server);
452 mutex_unlock(&server->srv_mutex);
457 if (memcmp(server_response_sig, shdr->Signature, SMB2_SIGNATURE_SIZE))
464 * Set message id for the request. Should be called after wait_for_free_request
465 * and when srv_mutex is held.
468 smb2_seq_num_into_buf(struct TCP_Server_Info *server,
469 struct smb2_sync_hdr *shdr)
471 unsigned int i, num = le16_to_cpu(shdr->CreditCharge);
473 shdr->MessageId = get_next_mid64(server);
474 /* skip message numbers according to CreditCharge field */
475 for (i = 1; i < num; i++)
476 get_next_mid(server);
479 static struct mid_q_entry *
480 smb2_mid_entry_alloc(const struct smb2_sync_hdr *shdr,
481 struct TCP_Server_Info *server)
483 struct mid_q_entry *temp;
485 if (server == NULL) {
486 cifs_dbg(VFS, "Null TCP session in smb2_mid_entry_alloc\n");
490 temp = mempool_alloc(cifs_mid_poolp, GFP_NOFS);
494 memset(temp, 0, sizeof(struct mid_q_entry));
495 temp->mid = le64_to_cpu(shdr->MessageId);
496 temp->pid = current->pid;
497 temp->command = shdr->Command; /* Always LE */
498 temp->when_alloc = jiffies;
499 temp->server = server;
502 * The default is for the mid to be synchronous, so the
503 * default callback just wakes up the current task.
505 temp->callback = cifs_wake_up_task;
506 temp->callback_data = current;
509 atomic_inc(&midCount);
510 temp->mid_state = MID_REQUEST_ALLOCATED;
515 smb2_get_mid_entry(struct cifs_ses *ses, struct smb2_sync_hdr *shdr,
516 struct mid_q_entry **mid)
518 if (ses->server->tcpStatus == CifsExiting)
521 if (ses->server->tcpStatus == CifsNeedReconnect) {
522 cifs_dbg(FYI, "tcp session dead - return to caller to retry\n");
526 if (ses->status == CifsNew) {
527 if ((shdr->Command != SMB2_SESSION_SETUP) &&
528 (shdr->Command != SMB2_NEGOTIATE))
530 /* else ok - we are setting up session */
533 if (ses->status == CifsExiting) {
534 if (shdr->Command != SMB2_LOGOFF)
536 /* else ok - we are shutting down the session */
539 *mid = smb2_mid_entry_alloc(shdr, ses->server);
542 spin_lock(&GlobalMid_Lock);
543 list_add_tail(&(*mid)->qhead, &ses->server->pending_mid_q);
544 spin_unlock(&GlobalMid_Lock);
549 smb2_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
552 unsigned int len = get_rfc1002_length(mid->resp_buf);
554 struct smb_rqst rqst = { .rq_iov = &iov,
557 iov.iov_base = (char *)mid->resp_buf;
558 iov.iov_len = get_rfc1002_length(mid->resp_buf) + 4;
560 dump_smb(mid->resp_buf, min_t(u32, 80, len));
561 /* convert the length into a more usable form */
562 if (len > 24 && server->sign) {
565 rc = smb2_verify_signature(&rqst, server);
567 cifs_dbg(VFS, "SMB signature verification returned error = %d\n",
571 return map_smb2_to_linux_error(mid->resp_buf, log_error);
575 smb2_setup_request(struct cifs_ses *ses, struct smb_rqst *rqst)
578 struct smb2_sync_hdr *shdr = get_sync_hdr(rqst->rq_iov[0].iov_base);
579 struct mid_q_entry *mid;
581 smb2_seq_num_into_buf(ses->server, shdr);
583 rc = smb2_get_mid_entry(ses, shdr, &mid);
586 rc = smb2_sign_rqst(rqst, ses->server);
588 cifs_delete_mid(mid);
595 smb2_setup_async_request(struct TCP_Server_Info *server, struct smb_rqst *rqst)
598 struct smb2_sync_hdr *shdr = get_sync_hdr(rqst->rq_iov[0].iov_base);
599 struct mid_q_entry *mid;
601 smb2_seq_num_into_buf(server, shdr);
603 mid = smb2_mid_entry_alloc(shdr, server);
605 return ERR_PTR(-ENOMEM);
607 rc = smb2_sign_rqst(rqst, server);
609 DeleteMidQEntry(mid);