1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3 *
4 * Encryption and hashing operations relating to NTLM, NTLMv2. See MS-NLMP
5 * for more detailed information
6 *
7 * Copyright (C) International Business Machines Corp., 2005,2013
8 * Author(s): Steve French (sfrench@us.ibm.com)
9 *
10 */
11
12 #include <linux/fs.h>
13 #include <linux/slab.h>
14 #include "cifspdu.h"
15 #include "cifsglob.h"
16 #include "cifs_debug.h"
17 #include "cifs_unicode.h"
18 #include "cifsproto.h"
19 #include "ntlmssp.h"
20 #include <linux/ctype.h>
21 #include <linux/random.h>
22 #include <linux/highmem.h>
23 #include <linux/fips.h>
24 #include "../common/arc4.h"
25 #include <crypto/aead.h>
26
27 /*
28 * Hash data from a BVEC-type iterator.
29 */
cifs_shash_bvec(const struct iov_iter * iter,ssize_t maxsize,struct shash_desc * shash)30 static int cifs_shash_bvec(const struct iov_iter *iter, ssize_t maxsize,
31 struct shash_desc *shash)
32 {
33 const struct bio_vec *bv = iter->bvec;
34 unsigned long start = iter->iov_offset;
35 unsigned int i;
36 void *p;
37 int ret;
38
39 for (i = 0; i < iter->nr_segs; i++) {
40 size_t off, len;
41
42 len = bv[i].bv_len;
43 if (start >= len) {
44 start -= len;
45 continue;
46 }
47
48 len = min_t(size_t, maxsize, len - start);
49 off = bv[i].bv_offset + start;
50
51 p = kmap_local_page(bv[i].bv_page);
52 ret = crypto_shash_update(shash, p + off, len);
53 kunmap_local(p);
54 if (ret < 0)
55 return ret;
56
57 maxsize -= len;
58 if (maxsize <= 0)
59 break;
60 start = 0;
61 }
62
63 return 0;
64 }
65
66 /*
67 * Hash data from a KVEC-type iterator.
68 */
cifs_shash_kvec(const struct iov_iter * iter,ssize_t maxsize,struct shash_desc * shash)69 static int cifs_shash_kvec(const struct iov_iter *iter, ssize_t maxsize,
70 struct shash_desc *shash)
71 {
72 const struct kvec *kv = iter->kvec;
73 unsigned long start = iter->iov_offset;
74 unsigned int i;
75 int ret;
76
77 for (i = 0; i < iter->nr_segs; i++) {
78 size_t len;
79
80 len = kv[i].iov_len;
81 if (start >= len) {
82 start -= len;
83 continue;
84 }
85
86 len = min_t(size_t, maxsize, len - start);
87 ret = crypto_shash_update(shash, kv[i].iov_base + start, len);
88 if (ret < 0)
89 return ret;
90 maxsize -= len;
91
92 if (maxsize <= 0)
93 break;
94 start = 0;
95 }
96
97 return 0;
98 }
99
100 /*
101 * Hash data from an XARRAY-type iterator.
102 */
cifs_shash_xarray(const struct iov_iter * iter,ssize_t maxsize,struct shash_desc * shash)103 static ssize_t cifs_shash_xarray(const struct iov_iter *iter, ssize_t maxsize,
104 struct shash_desc *shash)
105 {
106 struct folio *folios[16], *folio;
107 unsigned int nr, i, j, npages;
108 loff_t start = iter->xarray_start + iter->iov_offset;
109 pgoff_t last, index = start / PAGE_SIZE;
110 ssize_t ret = 0;
111 size_t len, offset, foffset;
112 void *p;
113
114 if (maxsize == 0)
115 return 0;
116
117 last = (start + maxsize - 1) / PAGE_SIZE;
118 do {
119 nr = xa_extract(iter->xarray, (void **)folios, index, last,
120 ARRAY_SIZE(folios), XA_PRESENT);
121 if (nr == 0)
122 return -EIO;
123
124 for (i = 0; i < nr; i++) {
125 folio = folios[i];
126 npages = folio_nr_pages(folio);
127 foffset = start - folio_pos(folio);
128 offset = foffset % PAGE_SIZE;
129 for (j = foffset / PAGE_SIZE; j < npages; j++) {
130 len = min_t(size_t, maxsize, PAGE_SIZE - offset);
131 p = kmap_local_page(folio_page(folio, j));
132 ret = crypto_shash_update(shash, p, len);
133 kunmap_local(p);
134 if (ret < 0)
135 return ret;
136 maxsize -= len;
137 if (maxsize <= 0)
138 return 0;
139 start += len;
140 offset = 0;
141 index++;
142 }
143 }
144 } while (nr == ARRAY_SIZE(folios));
145 return 0;
146 }
147
148 /*
149 * Pass the data from an iterator into a hash.
150 */
cifs_shash_iter(const struct iov_iter * iter,size_t maxsize,struct shash_desc * shash)151 static int cifs_shash_iter(const struct iov_iter *iter, size_t maxsize,
152 struct shash_desc *shash)
153 {
154 if (maxsize == 0)
155 return 0;
156
157 switch (iov_iter_type(iter)) {
158 case ITER_BVEC:
159 return cifs_shash_bvec(iter, maxsize, shash);
160 case ITER_KVEC:
161 return cifs_shash_kvec(iter, maxsize, shash);
162 case ITER_XARRAY:
163 return cifs_shash_xarray(iter, maxsize, shash);
164 default:
165 pr_err("cifs_shash_iter(%u) unsupported\n", iov_iter_type(iter));
166 WARN_ON_ONCE(1);
167 return -EIO;
168 }
169 }
170
__cifs_calc_signature(struct smb_rqst * rqst,struct TCP_Server_Info * server,char * signature,struct shash_desc * shash)171 int __cifs_calc_signature(struct smb_rqst *rqst,
172 struct TCP_Server_Info *server, char *signature,
173 struct shash_desc *shash)
174 {
175 int i;
176 ssize_t rc;
177 struct kvec *iov = rqst->rq_iov;
178 int n_vec = rqst->rq_nvec;
179
180 /* iov[0] is actual data and not the rfc1002 length for SMB2+ */
181 if (!is_smb1(server)) {
182 if (iov[0].iov_len <= 4)
183 return -EIO;
184 i = 0;
185 } else {
186 if (n_vec < 2 || iov[0].iov_len != 4)
187 return -EIO;
188 i = 1; /* skip rfc1002 length */
189 }
190
191 for (; i < n_vec; i++) {
192 if (iov[i].iov_len == 0)
193 continue;
194 if (iov[i].iov_base == NULL) {
195 cifs_dbg(VFS, "null iovec entry\n");
196 return -EIO;
197 }
198
199 rc = crypto_shash_update(shash,
200 iov[i].iov_base, iov[i].iov_len);
201 if (rc) {
202 cifs_dbg(VFS, "%s: Could not update with payload\n",
203 __func__);
204 return rc;
205 }
206 }
207
208 rc = cifs_shash_iter(&rqst->rq_iter, iov_iter_count(&rqst->rq_iter), shash);
209 if (rc < 0)
210 return rc;
211
212 rc = crypto_shash_final(shash, signature);
213 if (rc)
214 cifs_dbg(VFS, "%s: Could not generate hash\n", __func__);
215
216 return rc;
217 }
218
219 /*
220 * Calculate and return the CIFS signature based on the mac key and SMB PDU.
221 * The 16 byte signature must be allocated by the caller. Note we only use the
222 * 1st eight bytes and that the smb header signature field on input contains
223 * the sequence number before this function is called. Also, this function
224 * should be called with the server->srv_mutex held.
225 */
cifs_calc_signature(struct smb_rqst * rqst,struct TCP_Server_Info * server,char * signature)226 static int cifs_calc_signature(struct smb_rqst *rqst,
227 struct TCP_Server_Info *server, char *signature)
228 {
229 int rc;
230
231 if (!rqst->rq_iov || !signature || !server)
232 return -EINVAL;
233
234 rc = cifs_alloc_hash("md5", &server->secmech.md5);
235 if (rc)
236 return -1;
237
238 rc = crypto_shash_init(server->secmech.md5);
239 if (rc) {
240 cifs_dbg(VFS, "%s: Could not init md5\n", __func__);
241 return rc;
242 }
243
244 rc = crypto_shash_update(server->secmech.md5,
245 server->session_key.response, server->session_key.len);
246 if (rc) {
247 cifs_dbg(VFS, "%s: Could not update with response\n", __func__);
248 return rc;
249 }
250
251 return __cifs_calc_signature(rqst, server, signature, server->secmech.md5);
252 }
253
254 /* must be called with server->srv_mutex held */
cifs_sign_rqst(struct smb_rqst * rqst,struct TCP_Server_Info * server,__u32 * pexpected_response_sequence_number)255 int cifs_sign_rqst(struct smb_rqst *rqst, struct TCP_Server_Info *server,
256 __u32 *pexpected_response_sequence_number)
257 {
258 int rc = 0;
259 char smb_signature[20];
260 struct smb_hdr *cifs_pdu = (struct smb_hdr *)rqst->rq_iov[0].iov_base;
261
262 if (rqst->rq_iov[0].iov_len != 4 ||
263 rqst->rq_iov[0].iov_base + 4 != rqst->rq_iov[1].iov_base)
264 return -EIO;
265
266 if ((cifs_pdu == NULL) || (server == NULL))
267 return -EINVAL;
268
269 spin_lock(&server->srv_lock);
270 if (!(cifs_pdu->Flags2 & SMBFLG2_SECURITY_SIGNATURE) ||
271 server->tcpStatus == CifsNeedNegotiate) {
272 spin_unlock(&server->srv_lock);
273 return rc;
274 }
275 spin_unlock(&server->srv_lock);
276
277 if (!server->session_estab) {
278 memcpy(cifs_pdu->Signature.SecuritySignature, "BSRSPYL", 8);
279 return rc;
280 }
281
282 cifs_pdu->Signature.Sequence.SequenceNumber =
283 cpu_to_le32(server->sequence_number);
284 cifs_pdu->Signature.Sequence.Reserved = 0;
285
286 *pexpected_response_sequence_number = ++server->sequence_number;
287 ++server->sequence_number;
288
289 rc = cifs_calc_signature(rqst, server, smb_signature);
290 if (rc)
291 memset(cifs_pdu->Signature.SecuritySignature, 0, 8);
292 else
293 memcpy(cifs_pdu->Signature.SecuritySignature, smb_signature, 8);
294
295 return rc;
296 }
297
cifs_sign_smbv(struct kvec * iov,int n_vec,struct TCP_Server_Info * server,__u32 * pexpected_response_sequence)298 int cifs_sign_smbv(struct kvec *iov, int n_vec, struct TCP_Server_Info *server,
299 __u32 *pexpected_response_sequence)
300 {
301 struct smb_rqst rqst = { .rq_iov = iov,
302 .rq_nvec = n_vec };
303
304 return cifs_sign_rqst(&rqst, server, pexpected_response_sequence);
305 }
306
307 /* must be called with server->srv_mutex held */
cifs_sign_smb(struct smb_hdr * cifs_pdu,struct TCP_Server_Info * server,__u32 * pexpected_response_sequence_number)308 int cifs_sign_smb(struct smb_hdr *cifs_pdu, struct TCP_Server_Info *server,
309 __u32 *pexpected_response_sequence_number)
310 {
311 struct kvec iov[2];
312
313 iov[0].iov_base = cifs_pdu;
314 iov[0].iov_len = 4;
315 iov[1].iov_base = (char *)cifs_pdu + 4;
316 iov[1].iov_len = be32_to_cpu(cifs_pdu->smb_buf_length);
317
318 return cifs_sign_smbv(iov, 2, server,
319 pexpected_response_sequence_number);
320 }
321
cifs_verify_signature(struct smb_rqst * rqst,struct TCP_Server_Info * server,__u32 expected_sequence_number)322 int cifs_verify_signature(struct smb_rqst *rqst,
323 struct TCP_Server_Info *server,
324 __u32 expected_sequence_number)
325 {
326 unsigned int rc;
327 char server_response_sig[8];
328 char what_we_think_sig_should_be[20];
329 struct smb_hdr *cifs_pdu = (struct smb_hdr *)rqst->rq_iov[0].iov_base;
330
331 if (rqst->rq_iov[0].iov_len != 4 ||
332 rqst->rq_iov[0].iov_base + 4 != rqst->rq_iov[1].iov_base)
333 return -EIO;
334
335 if (cifs_pdu == NULL || server == NULL)
336 return -EINVAL;
337
338 if (!server->session_estab)
339 return 0;
340
341 if (cifs_pdu->Command == SMB_COM_LOCKING_ANDX) {
342 struct smb_com_lock_req *pSMB =
343 (struct smb_com_lock_req *)cifs_pdu;
344 if (pSMB->LockType & LOCKING_ANDX_OPLOCK_RELEASE)
345 return 0;
346 }
347
348 /* BB what if signatures are supposed to be on for session but
349 server does not send one? BB */
350
351 /* Do not need to verify session setups with signature "BSRSPYL " */
352 if (memcmp(cifs_pdu->Signature.SecuritySignature, "BSRSPYL ", 8) == 0)
353 cifs_dbg(FYI, "dummy signature received for smb command 0x%x\n",
354 cifs_pdu->Command);
355
356 /* save off the origiginal signature so we can modify the smb and check
357 its signature against what the server sent */
358 memcpy(server_response_sig, cifs_pdu->Signature.SecuritySignature, 8);
359
360 cifs_pdu->Signature.Sequence.SequenceNumber =
361 cpu_to_le32(expected_sequence_number);
362 cifs_pdu->Signature.Sequence.Reserved = 0;
363
364 cifs_server_lock(server);
365 rc = cifs_calc_signature(rqst, server, what_we_think_sig_should_be);
366 cifs_server_unlock(server);
367
368 if (rc)
369 return rc;
370
371 /* cifs_dump_mem("what we think it should be: ",
372 what_we_think_sig_should_be, 16); */
373
374 if (memcmp(server_response_sig, what_we_think_sig_should_be, 8))
375 return -EACCES;
376 else
377 return 0;
378
379 }
380
381 /* Build a proper attribute value/target info pairs blob.
382 * Fill in netbios and dns domain name and workstation name
383 * and client time (total five av pairs and + one end of fields indicator.
384 * Allocate domain name which gets freed when session struct is deallocated.
385 */
386 static int
build_avpair_blob(struct cifs_ses * ses,const struct nls_table * nls_cp)387 build_avpair_blob(struct cifs_ses *ses, const struct nls_table *nls_cp)
388 {
389 unsigned int dlen;
390 unsigned int size = 2 * sizeof(struct ntlmssp2_name);
391 char *defdmname = "WORKGROUP";
392 unsigned char *blobptr;
393 struct ntlmssp2_name *attrptr;
394
395 if (!ses->domainName) {
396 ses->domainName = kstrdup(defdmname, GFP_KERNEL);
397 if (!ses->domainName)
398 return -ENOMEM;
399 }
400
401 dlen = strlen(ses->domainName);
402
403 /*
404 * The length of this blob is two times the size of a
405 * structure (av pair) which holds name/size
406 * ( for NTLMSSP_AV_NB_DOMAIN_NAME followed by NTLMSSP_AV_EOL ) +
407 * unicode length of a netbios domain name
408 */
409 kfree_sensitive(ses->auth_key.response);
410 ses->auth_key.len = size + 2 * dlen;
411 ses->auth_key.response = kzalloc(ses->auth_key.len, GFP_KERNEL);
412 if (!ses->auth_key.response) {
413 ses->auth_key.len = 0;
414 return -ENOMEM;
415 }
416
417 blobptr = ses->auth_key.response;
418 attrptr = (struct ntlmssp2_name *) blobptr;
419
420 /*
421 * As defined in MS-NTLM 3.3.2, just this av pair field
422 * is sufficient as part of the temp
423 */
424 attrptr->type = cpu_to_le16(NTLMSSP_AV_NB_DOMAIN_NAME);
425 attrptr->length = cpu_to_le16(2 * dlen);
426 blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
427 cifs_strtoUTF16((__le16 *)blobptr, ses->domainName, dlen, nls_cp);
428
429 return 0;
430 }
431
432 /* Server has provided av pairs/target info in the type 2 challenge
433 * packet and we have plucked it and stored within smb session.
434 * We parse that blob here to find netbios domain name to be used
435 * as part of ntlmv2 authentication (in Target String), if not already
436 * specified on the command line.
437 * If this function returns without any error but without fetching
438 * domain name, authentication may fail against some server but
439 * may not fail against other (those who are not very particular
440 * about target string i.e. for some, just user name might suffice.
441 */
442 static int
find_domain_name(struct cifs_ses * ses,const struct nls_table * nls_cp)443 find_domain_name(struct cifs_ses *ses, const struct nls_table *nls_cp)
444 {
445 unsigned int attrsize;
446 unsigned int type;
447 unsigned int onesize = sizeof(struct ntlmssp2_name);
448 unsigned char *blobptr;
449 unsigned char *blobend;
450 struct ntlmssp2_name *attrptr;
451
452 if (!ses->auth_key.len || !ses->auth_key.response)
453 return 0;
454
455 blobptr = ses->auth_key.response;
456 blobend = blobptr + ses->auth_key.len;
457
458 while (blobptr + onesize < blobend) {
459 attrptr = (struct ntlmssp2_name *) blobptr;
460 type = le16_to_cpu(attrptr->type);
461 if (type == NTLMSSP_AV_EOL)
462 break;
463 blobptr += 2; /* advance attr type */
464 attrsize = le16_to_cpu(attrptr->length);
465 blobptr += 2; /* advance attr size */
466 if (blobptr + attrsize > blobend)
467 break;
468 if (type == NTLMSSP_AV_NB_DOMAIN_NAME) {
469 if (!attrsize || attrsize >= CIFS_MAX_DOMAINNAME_LEN)
470 break;
471 if (!ses->domainName) {
472 ses->domainName =
473 kmalloc(attrsize + 1, GFP_KERNEL);
474 if (!ses->domainName)
475 return -ENOMEM;
476 cifs_from_utf16(ses->domainName,
477 (__le16 *)blobptr, attrsize, attrsize,
478 nls_cp, NO_MAP_UNI_RSVD);
479 break;
480 }
481 }
482 blobptr += attrsize; /* advance attr value */
483 }
484
485 return 0;
486 }
487
488 /* Server has provided av pairs/target info in the type 2 challenge
489 * packet and we have plucked it and stored within smb session.
490 * We parse that blob here to find the server given timestamp
491 * as part of ntlmv2 authentication (or local current time as
492 * default in case of failure)
493 */
494 static __le64
find_timestamp(struct cifs_ses * ses)495 find_timestamp(struct cifs_ses *ses)
496 {
497 unsigned int attrsize;
498 unsigned int type;
499 unsigned int onesize = sizeof(struct ntlmssp2_name);
500 unsigned char *blobptr;
501 unsigned char *blobend;
502 struct ntlmssp2_name *attrptr;
503 struct timespec64 ts;
504
505 if (!ses->auth_key.len || !ses->auth_key.response)
506 return 0;
507
508 blobptr = ses->auth_key.response;
509 blobend = blobptr + ses->auth_key.len;
510
511 while (blobptr + onesize < blobend) {
512 attrptr = (struct ntlmssp2_name *) blobptr;
513 type = le16_to_cpu(attrptr->type);
514 if (type == NTLMSSP_AV_EOL)
515 break;
516 blobptr += 2; /* advance attr type */
517 attrsize = le16_to_cpu(attrptr->length);
518 blobptr += 2; /* advance attr size */
519 if (blobptr + attrsize > blobend)
520 break;
521 if (type == NTLMSSP_AV_TIMESTAMP) {
522 if (attrsize == sizeof(u64))
523 return *((__le64 *)blobptr);
524 }
525 blobptr += attrsize; /* advance attr value */
526 }
527
528 ktime_get_real_ts64(&ts);
529 return cpu_to_le64(cifs_UnixTimeToNT(ts));
530 }
531
calc_ntlmv2_hash(struct cifs_ses * ses,char * ntlmv2_hash,const struct nls_table * nls_cp)532 static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash,
533 const struct nls_table *nls_cp)
534 {
535 int rc = 0;
536 int len;
537 char nt_hash[CIFS_NTHASH_SIZE];
538 __le16 *user;
539 wchar_t *domain;
540 wchar_t *server;
541
542 if (!ses->server->secmech.hmacmd5) {
543 cifs_dbg(VFS, "%s: can't generate ntlmv2 hash\n", __func__);
544 return -1;
545 }
546
547 /* calculate md4 hash of password */
548 E_md4hash(ses->password, nt_hash, nls_cp);
549
550 rc = crypto_shash_setkey(ses->server->secmech.hmacmd5->tfm, nt_hash,
551 CIFS_NTHASH_SIZE);
552 if (rc) {
553 cifs_dbg(VFS, "%s: Could not set NT Hash as a key\n", __func__);
554 return rc;
555 }
556
557 rc = crypto_shash_init(ses->server->secmech.hmacmd5);
558 if (rc) {
559 cifs_dbg(VFS, "%s: Could not init hmacmd5\n", __func__);
560 return rc;
561 }
562
563 /* convert ses->user_name to unicode */
564 len = ses->user_name ? strlen(ses->user_name) : 0;
565 user = kmalloc(2 + (len * 2), GFP_KERNEL);
566 if (user == NULL) {
567 rc = -ENOMEM;
568 return rc;
569 }
570
571 if (len) {
572 len = cifs_strtoUTF16(user, ses->user_name, len, nls_cp);
573 UniStrupr(user);
574 } else {
575 *(u16 *)user = 0;
576 }
577
578 rc = crypto_shash_update(ses->server->secmech.hmacmd5,
579 (char *)user, 2 * len);
580 kfree(user);
581 if (rc) {
582 cifs_dbg(VFS, "%s: Could not update with user\n", __func__);
583 return rc;
584 }
585
586 /* convert ses->domainName to unicode and uppercase */
587 if (ses->domainName) {
588 len = strlen(ses->domainName);
589
590 domain = kmalloc(2 + (len * 2), GFP_KERNEL);
591 if (domain == NULL) {
592 rc = -ENOMEM;
593 return rc;
594 }
595 len = cifs_strtoUTF16((__le16 *)domain, ses->domainName, len,
596 nls_cp);
597 rc =
598 crypto_shash_update(ses->server->secmech.hmacmd5,
599 (char *)domain, 2 * len);
600 kfree(domain);
601 if (rc) {
602 cifs_dbg(VFS, "%s: Could not update with domain\n",
603 __func__);
604 return rc;
605 }
606 } else {
607 /* We use ses->ip_addr if no domain name available */
608 len = strlen(ses->ip_addr);
609
610 server = kmalloc(2 + (len * 2), GFP_KERNEL);
611 if (server == NULL) {
612 rc = -ENOMEM;
613 return rc;
614 }
615 len = cifs_strtoUTF16((__le16 *)server, ses->ip_addr, len,
616 nls_cp);
617 rc =
618 crypto_shash_update(ses->server->secmech.hmacmd5,
619 (char *)server, 2 * len);
620 kfree(server);
621 if (rc) {
622 cifs_dbg(VFS, "%s: Could not update with server\n",
623 __func__);
624 return rc;
625 }
626 }
627
628 rc = crypto_shash_final(ses->server->secmech.hmacmd5,
629 ntlmv2_hash);
630 if (rc)
631 cifs_dbg(VFS, "%s: Could not generate md5 hash\n", __func__);
632
633 return rc;
634 }
635
636 static int
CalcNTLMv2_response(const struct cifs_ses * ses,char * ntlmv2_hash)637 CalcNTLMv2_response(const struct cifs_ses *ses, char *ntlmv2_hash)
638 {
639 int rc;
640 struct ntlmv2_resp *ntlmv2 = (struct ntlmv2_resp *)
641 (ses->auth_key.response + CIFS_SESS_KEY_SIZE);
642 unsigned int hash_len;
643
644 /* The MD5 hash starts at challenge_key.key */
645 hash_len = ses->auth_key.len - (CIFS_SESS_KEY_SIZE +
646 offsetof(struct ntlmv2_resp, challenge.key[0]));
647
648 if (!ses->server->secmech.hmacmd5) {
649 cifs_dbg(VFS, "%s: can't generate ntlmv2 hash\n", __func__);
650 return -1;
651 }
652
653 rc = crypto_shash_setkey(ses->server->secmech.hmacmd5->tfm,
654 ntlmv2_hash, CIFS_HMAC_MD5_HASH_SIZE);
655 if (rc) {
656 cifs_dbg(VFS, "%s: Could not set NTLMV2 Hash as a key\n",
657 __func__);
658 return rc;
659 }
660
661 rc = crypto_shash_init(ses->server->secmech.hmacmd5);
662 if (rc) {
663 cifs_dbg(VFS, "%s: Could not init hmacmd5\n", __func__);
664 return rc;
665 }
666
667 if (ses->server->negflavor == CIFS_NEGFLAVOR_EXTENDED)
668 memcpy(ntlmv2->challenge.key,
669 ses->ntlmssp->cryptkey, CIFS_SERVER_CHALLENGE_SIZE);
670 else
671 memcpy(ntlmv2->challenge.key,
672 ses->server->cryptkey, CIFS_SERVER_CHALLENGE_SIZE);
673 rc = crypto_shash_update(ses->server->secmech.hmacmd5,
674 ntlmv2->challenge.key, hash_len);
675 if (rc) {
676 cifs_dbg(VFS, "%s: Could not update with response\n", __func__);
677 return rc;
678 }
679
680 /* Note that the MD5 digest over writes anon.challenge_key.key */
681 rc = crypto_shash_final(ses->server->secmech.hmacmd5,
682 ntlmv2->ntlmv2_hash);
683 if (rc)
684 cifs_dbg(VFS, "%s: Could not generate md5 hash\n", __func__);
685
686 return rc;
687 }
688
689 int
setup_ntlmv2_rsp(struct cifs_ses * ses,const struct nls_table * nls_cp)690 setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
691 {
692 int rc;
693 int baselen;
694 unsigned int tilen;
695 struct ntlmv2_resp *ntlmv2;
696 char ntlmv2_hash[16];
697 unsigned char *tiblob = NULL; /* target info blob */
698 __le64 rsp_timestamp;
699
700 if (nls_cp == NULL) {
701 cifs_dbg(VFS, "%s called with nls_cp==NULL\n", __func__);
702 return -EINVAL;
703 }
704
705 if (ses->server->negflavor == CIFS_NEGFLAVOR_EXTENDED) {
706 if (!ses->domainName) {
707 if (ses->domainAuto) {
708 rc = find_domain_name(ses, nls_cp);
709 if (rc) {
710 cifs_dbg(VFS, "error %d finding domain name\n",
711 rc);
712 goto setup_ntlmv2_rsp_ret;
713 }
714 } else {
715 ses->domainName = kstrdup("", GFP_KERNEL);
716 }
717 }
718 } else {
719 rc = build_avpair_blob(ses, nls_cp);
720 if (rc) {
721 cifs_dbg(VFS, "error %d building av pair blob\n", rc);
722 goto setup_ntlmv2_rsp_ret;
723 }
724 }
725
726 /* Must be within 5 minutes of the server (or in range +/-2h
727 * in case of Mac OS X), so simply carry over server timestamp
728 * (as Windows 7 does)
729 */
730 rsp_timestamp = find_timestamp(ses);
731
732 baselen = CIFS_SESS_KEY_SIZE + sizeof(struct ntlmv2_resp);
733 tilen = ses->auth_key.len;
734 tiblob = ses->auth_key.response;
735
736 ses->auth_key.response = kmalloc(baselen + tilen, GFP_KERNEL);
737 if (!ses->auth_key.response) {
738 rc = -ENOMEM;
739 ses->auth_key.len = 0;
740 goto setup_ntlmv2_rsp_ret;
741 }
742 ses->auth_key.len += baselen;
743
744 ntlmv2 = (struct ntlmv2_resp *)
745 (ses->auth_key.response + CIFS_SESS_KEY_SIZE);
746 ntlmv2->blob_signature = cpu_to_le32(0x00000101);
747 ntlmv2->reserved = 0;
748 ntlmv2->time = rsp_timestamp;
749
750 get_random_bytes(&ntlmv2->client_chal, sizeof(ntlmv2->client_chal));
751 ntlmv2->reserved2 = 0;
752
753 memcpy(ses->auth_key.response + baselen, tiblob, tilen);
754
755 cifs_server_lock(ses->server);
756
757 rc = cifs_alloc_hash("hmac(md5)", &ses->server->secmech.hmacmd5);
758 if (rc) {
759 goto unlock;
760 }
761
762 /* calculate ntlmv2_hash */
763 rc = calc_ntlmv2_hash(ses, ntlmv2_hash, nls_cp);
764 if (rc) {
765 cifs_dbg(VFS, "Could not get v2 hash rc %d\n", rc);
766 goto unlock;
767 }
768
769 /* calculate first part of the client response (CR1) */
770 rc = CalcNTLMv2_response(ses, ntlmv2_hash);
771 if (rc) {
772 cifs_dbg(VFS, "Could not calculate CR1 rc: %d\n", rc);
773 goto unlock;
774 }
775
776 /* now calculate the session key for NTLMv2 */
777 rc = crypto_shash_setkey(ses->server->secmech.hmacmd5->tfm,
778 ntlmv2_hash, CIFS_HMAC_MD5_HASH_SIZE);
779 if (rc) {
780 cifs_dbg(VFS, "%s: Could not set NTLMV2 Hash as a key\n",
781 __func__);
782 goto unlock;
783 }
784
785 rc = crypto_shash_init(ses->server->secmech.hmacmd5);
786 if (rc) {
787 cifs_dbg(VFS, "%s: Could not init hmacmd5\n", __func__);
788 goto unlock;
789 }
790
791 rc = crypto_shash_update(ses->server->secmech.hmacmd5,
792 ntlmv2->ntlmv2_hash,
793 CIFS_HMAC_MD5_HASH_SIZE);
794 if (rc) {
795 cifs_dbg(VFS, "%s: Could not update with response\n", __func__);
796 goto unlock;
797 }
798
799 rc = crypto_shash_final(ses->server->secmech.hmacmd5,
800 ses->auth_key.response);
801 if (rc)
802 cifs_dbg(VFS, "%s: Could not generate md5 hash\n", __func__);
803
804 unlock:
805 cifs_server_unlock(ses->server);
806 setup_ntlmv2_rsp_ret:
807 kfree_sensitive(tiblob);
808
809 return rc;
810 }
811
812 int
calc_seckey(struct cifs_ses * ses)813 calc_seckey(struct cifs_ses *ses)
814 {
815 unsigned char sec_key[CIFS_SESS_KEY_SIZE]; /* a nonce */
816 struct arc4_ctx *ctx_arc4;
817
818 if (fips_enabled)
819 return -ENODEV;
820
821 get_random_bytes(sec_key, CIFS_SESS_KEY_SIZE);
822
823 ctx_arc4 = kmalloc(sizeof(*ctx_arc4), GFP_KERNEL);
824 if (!ctx_arc4) {
825 cifs_dbg(VFS, "Could not allocate arc4 context\n");
826 return -ENOMEM;
827 }
828
829 cifs_arc4_setkey(ctx_arc4, ses->auth_key.response, CIFS_SESS_KEY_SIZE);
830 cifs_arc4_crypt(ctx_arc4, ses->ntlmssp->ciphertext, sec_key,
831 CIFS_CPHTXT_SIZE);
832
833 /* make secondary_key/nonce as session key */
834 memcpy(ses->auth_key.response, sec_key, CIFS_SESS_KEY_SIZE);
835 /* and make len as that of session key only */
836 ses->auth_key.len = CIFS_SESS_KEY_SIZE;
837
838 memzero_explicit(sec_key, CIFS_SESS_KEY_SIZE);
839 kfree_sensitive(ctx_arc4);
840 return 0;
841 }
842
843 void
cifs_crypto_secmech_release(struct TCP_Server_Info * server)844 cifs_crypto_secmech_release(struct TCP_Server_Info *server)
845 {
846 cifs_free_hash(&server->secmech.aes_cmac);
847 cifs_free_hash(&server->secmech.hmacsha256);
848 cifs_free_hash(&server->secmech.md5);
849 cifs_free_hash(&server->secmech.sha512);
850 cifs_free_hash(&server->secmech.hmacmd5);
851
852 if (server->secmech.enc) {
853 crypto_free_aead(server->secmech.enc);
854 server->secmech.enc = NULL;
855 }
856
857 if (server->secmech.dec) {
858 crypto_free_aead(server->secmech.dec);
859 server->secmech.dec = NULL;
860 }
861 }
862