1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3 *
4 * Copyright (C) International Business Machines Corp., 2002, 2011
5 * Etersoft, 2012
6 * Author(s): Steve French (sfrench@us.ibm.com)
7 * Jeremy Allison (jra@samba.org) 2006
8 * Pavel Shilovsky (pshilovsky@samba.org) 2012
9 *
10 */
11
12 #include <linux/fs.h>
13 #include <linux/list.h>
14 #include <linux/wait.h>
15 #include <linux/net.h>
16 #include <linux/delay.h>
17 #include <linux/uaccess.h>
18 #include <asm/processor.h>
19 #include <linux/mempool.h>
20 #include <linux/highmem.h>
21 #include <crypto/aead.h>
22 #include "cifsglob.h"
23 #include "cifsproto.h"
24 #include "smb2proto.h"
25 #include "cifs_debug.h"
26 #include "smb2status.h"
27 #include "smb2glob.h"
28
29 static int
smb3_crypto_shash_allocate(struct TCP_Server_Info * server)30 smb3_crypto_shash_allocate(struct TCP_Server_Info *server)
31 {
32 struct cifs_secmech *p = &server->secmech;
33 int rc;
34
35 rc = cifs_alloc_hash("hmac(sha256)", &p->hmacsha256);
36 if (rc)
37 goto err;
38
39 rc = cifs_alloc_hash("cmac(aes)", &p->aes_cmac);
40 if (rc)
41 goto err;
42
43 return 0;
44 err:
45 cifs_free_hash(&p->hmacsha256);
46 return rc;
47 }
48
49 int
smb311_crypto_shash_allocate(struct TCP_Server_Info * server)50 smb311_crypto_shash_allocate(struct TCP_Server_Info *server)
51 {
52 struct cifs_secmech *p = &server->secmech;
53 int rc = 0;
54
55 rc = cifs_alloc_hash("hmac(sha256)", &p->hmacsha256);
56 if (rc)
57 return rc;
58
59 rc = cifs_alloc_hash("cmac(aes)", &p->aes_cmac);
60 if (rc)
61 goto err;
62
63 rc = cifs_alloc_hash("sha512", &p->sha512);
64 if (rc)
65 goto err;
66
67 return 0;
68
69 err:
70 cifs_free_hash(&p->aes_cmac);
71 cifs_free_hash(&p->hmacsha256);
72 return rc;
73 }
74
75
76 static
smb2_get_sign_key(__u64 ses_id,struct TCP_Server_Info * server,u8 * key)77 int smb2_get_sign_key(__u64 ses_id, struct TCP_Server_Info *server, u8 *key)
78 {
79 struct cifs_chan *chan;
80 struct TCP_Server_Info *pserver;
81 struct cifs_ses *ses = NULL;
82 int i;
83 int rc = 0;
84
85 spin_lock(&cifs_tcp_ses_lock);
86
87 /* If server is a channel, select the primary channel */
88 pserver = CIFS_SERVER_IS_CHAN(server) ? server->primary_server : server;
89
90 list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) {
91 if (ses->Suid == ses_id)
92 goto found;
93 }
94 cifs_server_dbg(VFS, "%s: Could not find session 0x%llx\n",
95 __func__, ses_id);
96 rc = -ENOENT;
97 goto out;
98
99 found:
100 spin_lock(&ses->chan_lock);
101 if (cifs_chan_needs_reconnect(ses, server) &&
102 !CIFS_ALL_CHANS_NEED_RECONNECT(ses)) {
103 /*
104 * If we are in the process of binding a new channel
105 * to an existing session, use the master connection
106 * session key
107 */
108 memcpy(key, ses->smb3signingkey, SMB3_SIGN_KEY_SIZE);
109 spin_unlock(&ses->chan_lock);
110 goto out;
111 }
112
113 /*
114 * Otherwise, use the channel key.
115 */
116
117 for (i = 0; i < ses->chan_count; i++) {
118 chan = ses->chans + i;
119 if (chan->server == server) {
120 memcpy(key, chan->signkey, SMB3_SIGN_KEY_SIZE);
121 spin_unlock(&ses->chan_lock);
122 goto out;
123 }
124 }
125 spin_unlock(&ses->chan_lock);
126
127 cifs_dbg(VFS,
128 "%s: Could not find channel signing key for session 0x%llx\n",
129 __func__, ses_id);
130 rc = -ENOENT;
131
132 out:
133 spin_unlock(&cifs_tcp_ses_lock);
134 return rc;
135 }
136
137 static struct cifs_ses *
smb2_find_smb_ses_unlocked(struct TCP_Server_Info * server,__u64 ses_id)138 smb2_find_smb_ses_unlocked(struct TCP_Server_Info *server, __u64 ses_id)
139 {
140 struct TCP_Server_Info *pserver;
141 struct cifs_ses *ses;
142
143 /* If server is a channel, select the primary channel */
144 pserver = CIFS_SERVER_IS_CHAN(server) ? server->primary_server : server;
145
146 list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) {
147 if (ses->Suid != ses_id)
148 continue;
149 ++ses->ses_count;
150 return ses;
151 }
152
153 return NULL;
154 }
155
156 struct cifs_ses *
smb2_find_smb_ses(struct TCP_Server_Info * server,__u64 ses_id)157 smb2_find_smb_ses(struct TCP_Server_Info *server, __u64 ses_id)
158 {
159 struct cifs_ses *ses;
160
161 spin_lock(&cifs_tcp_ses_lock);
162 ses = smb2_find_smb_ses_unlocked(server, ses_id);
163 spin_unlock(&cifs_tcp_ses_lock);
164
165 return ses;
166 }
167
168 static struct cifs_tcon *
smb2_find_smb_sess_tcon_unlocked(struct cifs_ses * ses,__u32 tid)169 smb2_find_smb_sess_tcon_unlocked(struct cifs_ses *ses, __u32 tid)
170 {
171 struct cifs_tcon *tcon;
172
173 list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
174 if (tcon->tid != tid)
175 continue;
176 ++tcon->tc_count;
177 return tcon;
178 }
179
180 return NULL;
181 }
182
183 /*
184 * Obtain tcon corresponding to the tid in the given
185 * cifs_ses
186 */
187
188 struct cifs_tcon *
smb2_find_smb_tcon(struct TCP_Server_Info * server,__u64 ses_id,__u32 tid)189 smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32 tid)
190 {
191 struct cifs_ses *ses;
192 struct cifs_tcon *tcon;
193
194 spin_lock(&cifs_tcp_ses_lock);
195 ses = smb2_find_smb_ses_unlocked(server, ses_id);
196 if (!ses) {
197 spin_unlock(&cifs_tcp_ses_lock);
198 return NULL;
199 }
200 tcon = smb2_find_smb_sess_tcon_unlocked(ses, tid);
201 if (!tcon) {
202 cifs_put_smb_ses(ses);
203 spin_unlock(&cifs_tcp_ses_lock);
204 return NULL;
205 }
206 spin_unlock(&cifs_tcp_ses_lock);
207 /* tcon already has a ref to ses, so we don't need ses anymore */
208 cifs_put_smb_ses(ses);
209
210 return tcon;
211 }
212
213 int
smb2_calc_signature(struct smb_rqst * rqst,struct TCP_Server_Info * server,bool allocate_crypto)214 smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server,
215 bool allocate_crypto)
216 {
217 int rc;
218 unsigned char smb2_signature[SMB2_HMACSHA256_SIZE];
219 unsigned char *sigptr = smb2_signature;
220 struct kvec *iov = rqst->rq_iov;
221 struct smb2_hdr *shdr = (struct smb2_hdr *)iov[0].iov_base;
222 struct cifs_ses *ses;
223 struct shash_desc *shash = NULL;
224 struct smb_rqst drqst;
225
226 ses = smb2_find_smb_ses(server, le64_to_cpu(shdr->SessionId));
227 if (unlikely(!ses)) {
228 cifs_server_dbg(VFS, "%s: Could not find session\n", __func__);
229 return -ENOENT;
230 }
231
232 memset(smb2_signature, 0x0, SMB2_HMACSHA256_SIZE);
233 memset(shdr->Signature, 0x0, SMB2_SIGNATURE_SIZE);
234
235 if (allocate_crypto) {
236 rc = cifs_alloc_hash("hmac(sha256)", &shash);
237 if (rc) {
238 cifs_server_dbg(VFS,
239 "%s: sha256 alloc failed\n", __func__);
240 goto out;
241 }
242 } else {
243 shash = server->secmech.hmacsha256;
244 }
245
246 rc = crypto_shash_setkey(shash->tfm, ses->auth_key.response,
247 SMB2_NTLMV2_SESSKEY_SIZE);
248 if (rc) {
249 cifs_server_dbg(VFS,
250 "%s: Could not update with response\n",
251 __func__);
252 goto out;
253 }
254
255 rc = crypto_shash_init(shash);
256 if (rc) {
257 cifs_server_dbg(VFS, "%s: Could not init sha256", __func__);
258 goto out;
259 }
260
261 /*
262 * For SMB2+, __cifs_calc_signature() expects to sign only the actual
263 * data, that is, iov[0] should not contain a rfc1002 length.
264 *
265 * Sign the rfc1002 length prior to passing the data (iov[1-N]) down to
266 * __cifs_calc_signature().
267 */
268 drqst = *rqst;
269 if (drqst.rq_nvec >= 2 && iov[0].iov_len == 4) {
270 rc = crypto_shash_update(shash, iov[0].iov_base,
271 iov[0].iov_len);
272 if (rc) {
273 cifs_server_dbg(VFS,
274 "%s: Could not update with payload\n",
275 __func__);
276 goto out;
277 }
278 drqst.rq_iov++;
279 drqst.rq_nvec--;
280 }
281
282 rc = __cifs_calc_signature(&drqst, server, sigptr, shash);
283 if (!rc)
284 memcpy(shdr->Signature, sigptr, SMB2_SIGNATURE_SIZE);
285
286 out:
287 if (allocate_crypto)
288 cifs_free_hash(&shash);
289 if (ses)
290 cifs_put_smb_ses(ses);
291 return rc;
292 }
293
generate_key(struct cifs_ses * ses,struct kvec label,struct kvec context,__u8 * key,unsigned int key_size)294 static int generate_key(struct cifs_ses *ses, struct kvec label,
295 struct kvec context, __u8 *key, unsigned int key_size)
296 {
297 unsigned char zero = 0x0;
298 __u8 i[4] = {0, 0, 0, 1};
299 __u8 L128[4] = {0, 0, 0, 128};
300 __u8 L256[4] = {0, 0, 1, 0};
301 int rc = 0;
302 unsigned char prfhash[SMB2_HMACSHA256_SIZE];
303 unsigned char *hashptr = prfhash;
304 struct TCP_Server_Info *server = ses->server;
305
306 memset(prfhash, 0x0, SMB2_HMACSHA256_SIZE);
307 memset(key, 0x0, key_size);
308
309 rc = smb3_crypto_shash_allocate(server);
310 if (rc) {
311 cifs_server_dbg(VFS, "%s: crypto alloc failed\n", __func__);
312 goto smb3signkey_ret;
313 }
314
315 rc = crypto_shash_setkey(server->secmech.hmacsha256->tfm,
316 ses->auth_key.response, SMB2_NTLMV2_SESSKEY_SIZE);
317 if (rc) {
318 cifs_server_dbg(VFS, "%s: Could not set with session key\n", __func__);
319 goto smb3signkey_ret;
320 }
321
322 rc = crypto_shash_init(server->secmech.hmacsha256);
323 if (rc) {
324 cifs_server_dbg(VFS, "%s: Could not init sign hmac\n", __func__);
325 goto smb3signkey_ret;
326 }
327
328 rc = crypto_shash_update(server->secmech.hmacsha256, i, 4);
329 if (rc) {
330 cifs_server_dbg(VFS, "%s: Could not update with n\n", __func__);
331 goto smb3signkey_ret;
332 }
333
334 rc = crypto_shash_update(server->secmech.hmacsha256, label.iov_base, label.iov_len);
335 if (rc) {
336 cifs_server_dbg(VFS, "%s: Could not update with label\n", __func__);
337 goto smb3signkey_ret;
338 }
339
340 rc = crypto_shash_update(server->secmech.hmacsha256, &zero, 1);
341 if (rc) {
342 cifs_server_dbg(VFS, "%s: Could not update with zero\n", __func__);
343 goto smb3signkey_ret;
344 }
345
346 rc = crypto_shash_update(server->secmech.hmacsha256, context.iov_base, context.iov_len);
347 if (rc) {
348 cifs_server_dbg(VFS, "%s: Could not update with context\n", __func__);
349 goto smb3signkey_ret;
350 }
351
352 if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) ||
353 (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) {
354 rc = crypto_shash_update(server->secmech.hmacsha256, L256, 4);
355 } else {
356 rc = crypto_shash_update(server->secmech.hmacsha256, L128, 4);
357 }
358 if (rc) {
359 cifs_server_dbg(VFS, "%s: Could not update with L\n", __func__);
360 goto smb3signkey_ret;
361 }
362
363 rc = crypto_shash_final(server->secmech.hmacsha256, hashptr);
364 if (rc) {
365 cifs_server_dbg(VFS, "%s: Could not generate sha256 hash\n", __func__);
366 goto smb3signkey_ret;
367 }
368
369 memcpy(key, hashptr, key_size);
370
371 smb3signkey_ret:
372 return rc;
373 }
374
375 struct derivation {
376 struct kvec label;
377 struct kvec context;
378 };
379
380 struct derivation_triplet {
381 struct derivation signing;
382 struct derivation encryption;
383 struct derivation decryption;
384 };
385
386 static int
generate_smb3signingkey(struct cifs_ses * ses,struct TCP_Server_Info * server,const struct derivation_triplet * ptriplet)387 generate_smb3signingkey(struct cifs_ses *ses,
388 struct TCP_Server_Info *server,
389 const struct derivation_triplet *ptriplet)
390 {
391 int rc;
392 bool is_binding = false;
393 int chan_index = 0;
394
395 spin_lock(&ses->chan_lock);
396 is_binding = !CIFS_ALL_CHANS_NEED_RECONNECT(ses);
397 chan_index = cifs_ses_get_chan_index(ses, server);
398 /* TODO: introduce ref counting for channels when the can be freed */
399 spin_unlock(&ses->chan_lock);
400
401 /*
402 * All channels use the same encryption/decryption keys but
403 * they have their own signing key.
404 *
405 * When we generate the keys, check if it is for a new channel
406 * (binding) in which case we only need to generate a signing
407 * key and store it in the channel as to not overwrite the
408 * master connection signing key stored in the session
409 */
410
411 if (is_binding) {
412 rc = generate_key(ses, ptriplet->signing.label,
413 ptriplet->signing.context,
414 ses->chans[chan_index].signkey,
415 SMB3_SIGN_KEY_SIZE);
416 if (rc)
417 return rc;
418 } else {
419 rc = generate_key(ses, ptriplet->signing.label,
420 ptriplet->signing.context,
421 ses->smb3signingkey,
422 SMB3_SIGN_KEY_SIZE);
423 if (rc)
424 return rc;
425
426 /* safe to access primary channel, since it will never go away */
427 spin_lock(&ses->chan_lock);
428 memcpy(ses->chans[0].signkey, ses->smb3signingkey,
429 SMB3_SIGN_KEY_SIZE);
430 spin_unlock(&ses->chan_lock);
431
432 rc = generate_key(ses, ptriplet->encryption.label,
433 ptriplet->encryption.context,
434 ses->smb3encryptionkey,
435 SMB3_ENC_DEC_KEY_SIZE);
436 rc = generate_key(ses, ptriplet->decryption.label,
437 ptriplet->decryption.context,
438 ses->smb3decryptionkey,
439 SMB3_ENC_DEC_KEY_SIZE);
440 if (rc)
441 return rc;
442 }
443
444 if (rc)
445 return rc;
446
447 #ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS
448 cifs_dbg(VFS, "%s: dumping generated AES session keys\n", __func__);
449 /*
450 * The session id is opaque in terms of endianness, so we can't
451 * print it as a long long. we dump it as we got it on the wire
452 */
453 cifs_dbg(VFS, "Session Id %*ph\n", (int)sizeof(ses->Suid),
454 &ses->Suid);
455 cifs_dbg(VFS, "Cipher type %d\n", server->cipher_type);
456 cifs_dbg(VFS, "Session Key %*ph\n",
457 SMB2_NTLMV2_SESSKEY_SIZE, ses->auth_key.response);
458 cifs_dbg(VFS, "Signing Key %*ph\n",
459 SMB3_SIGN_KEY_SIZE, ses->smb3signingkey);
460 if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) ||
461 (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) {
462 cifs_dbg(VFS, "ServerIn Key %*ph\n",
463 SMB3_GCM256_CRYPTKEY_SIZE, ses->smb3encryptionkey);
464 cifs_dbg(VFS, "ServerOut Key %*ph\n",
465 SMB3_GCM256_CRYPTKEY_SIZE, ses->smb3decryptionkey);
466 } else {
467 cifs_dbg(VFS, "ServerIn Key %*ph\n",
468 SMB3_GCM128_CRYPTKEY_SIZE, ses->smb3encryptionkey);
469 cifs_dbg(VFS, "ServerOut Key %*ph\n",
470 SMB3_GCM128_CRYPTKEY_SIZE, ses->smb3decryptionkey);
471 }
472 #endif
473 return rc;
474 }
475
476 int
generate_smb30signingkey(struct cifs_ses * ses,struct TCP_Server_Info * server)477 generate_smb30signingkey(struct cifs_ses *ses,
478 struct TCP_Server_Info *server)
479
480 {
481 struct derivation_triplet triplet;
482 struct derivation *d;
483
484 d = &triplet.signing;
485 d->label.iov_base = "SMB2AESCMAC";
486 d->label.iov_len = 12;
487 d->context.iov_base = "SmbSign";
488 d->context.iov_len = 8;
489
490 d = &triplet.encryption;
491 d->label.iov_base = "SMB2AESCCM";
492 d->label.iov_len = 11;
493 d->context.iov_base = "ServerIn ";
494 d->context.iov_len = 10;
495
496 d = &triplet.decryption;
497 d->label.iov_base = "SMB2AESCCM";
498 d->label.iov_len = 11;
499 d->context.iov_base = "ServerOut";
500 d->context.iov_len = 10;
501
502 return generate_smb3signingkey(ses, server, &triplet);
503 }
504
505 int
generate_smb311signingkey(struct cifs_ses * ses,struct TCP_Server_Info * server)506 generate_smb311signingkey(struct cifs_ses *ses,
507 struct TCP_Server_Info *server)
508
509 {
510 struct derivation_triplet triplet;
511 struct derivation *d;
512
513 d = &triplet.signing;
514 d->label.iov_base = "SMBSigningKey";
515 d->label.iov_len = 14;
516 d->context.iov_base = ses->preauth_sha_hash;
517 d->context.iov_len = 64;
518
519 d = &triplet.encryption;
520 d->label.iov_base = "SMBC2SCipherKey";
521 d->label.iov_len = 16;
522 d->context.iov_base = ses->preauth_sha_hash;
523 d->context.iov_len = 64;
524
525 d = &triplet.decryption;
526 d->label.iov_base = "SMBS2CCipherKey";
527 d->label.iov_len = 16;
528 d->context.iov_base = ses->preauth_sha_hash;
529 d->context.iov_len = 64;
530
531 return generate_smb3signingkey(ses, server, &triplet);
532 }
533
534 int
smb3_calc_signature(struct smb_rqst * rqst,struct TCP_Server_Info * server,bool allocate_crypto)535 smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server,
536 bool allocate_crypto)
537 {
538 int rc;
539 unsigned char smb3_signature[SMB2_CMACAES_SIZE];
540 unsigned char *sigptr = smb3_signature;
541 struct kvec *iov = rqst->rq_iov;
542 struct smb2_hdr *shdr = (struct smb2_hdr *)iov[0].iov_base;
543 struct shash_desc *shash = NULL;
544 struct smb_rqst drqst;
545 u8 key[SMB3_SIGN_KEY_SIZE];
546
547 rc = smb2_get_sign_key(le64_to_cpu(shdr->SessionId), server, key);
548 if (unlikely(rc)) {
549 cifs_server_dbg(VFS, "%s: Could not get signing key\n", __func__);
550 return rc;
551 }
552
553 if (allocate_crypto) {
554 rc = cifs_alloc_hash("cmac(aes)", &shash);
555 if (rc)
556 return rc;
557 } else {
558 shash = server->secmech.aes_cmac;
559 }
560
561 memset(smb3_signature, 0x0, SMB2_CMACAES_SIZE);
562 memset(shdr->Signature, 0x0, SMB2_SIGNATURE_SIZE);
563
564 rc = crypto_shash_setkey(shash->tfm, key, SMB2_CMACAES_SIZE);
565 if (rc) {
566 cifs_server_dbg(VFS, "%s: Could not set key for cmac aes\n", __func__);
567 goto out;
568 }
569
570 /*
571 * we already allocate aes_cmac when we init smb3 signing key,
572 * so unlike smb2 case we do not have to check here if secmech are
573 * initialized
574 */
575 rc = crypto_shash_init(shash);
576 if (rc) {
577 cifs_server_dbg(VFS, "%s: Could not init cmac aes\n", __func__);
578 goto out;
579 }
580
581 /*
582 * For SMB2+, __cifs_calc_signature() expects to sign only the actual
583 * data, that is, iov[0] should not contain a rfc1002 length.
584 *
585 * Sign the rfc1002 length prior to passing the data (iov[1-N]) down to
586 * __cifs_calc_signature().
587 */
588 drqst = *rqst;
589 if (drqst.rq_nvec >= 2 && iov[0].iov_len == 4) {
590 rc = crypto_shash_update(shash, iov[0].iov_base,
591 iov[0].iov_len);
592 if (rc) {
593 cifs_server_dbg(VFS, "%s: Could not update with payload\n",
594 __func__);
595 goto out;
596 }
597 drqst.rq_iov++;
598 drqst.rq_nvec--;
599 }
600
601 rc = __cifs_calc_signature(&drqst, server, sigptr, shash);
602 if (!rc)
603 memcpy(shdr->Signature, sigptr, SMB2_SIGNATURE_SIZE);
604
605 out:
606 if (allocate_crypto)
607 cifs_free_hash(&shash);
608 return rc;
609 }
610
611 /* must be called with server->srv_mutex held */
612 static int
smb2_sign_rqst(struct smb_rqst * rqst,struct TCP_Server_Info * server)613 smb2_sign_rqst(struct smb_rqst *rqst, struct TCP_Server_Info *server)
614 {
615 int rc = 0;
616 struct smb2_hdr *shdr;
617 struct smb2_sess_setup_req *ssr;
618 bool is_binding;
619 bool is_signed;
620
621 shdr = (struct smb2_hdr *)rqst->rq_iov[0].iov_base;
622 ssr = (struct smb2_sess_setup_req *)shdr;
623
624 is_binding = shdr->Command == SMB2_SESSION_SETUP &&
625 (ssr->Flags & SMB2_SESSION_REQ_FLAG_BINDING);
626 is_signed = shdr->Flags & SMB2_FLAGS_SIGNED;
627
628 if (!is_signed)
629 return 0;
630 spin_lock(&server->srv_lock);
631 if (server->ops->need_neg &&
632 server->ops->need_neg(server)) {
633 spin_unlock(&server->srv_lock);
634 return 0;
635 }
636 spin_unlock(&server->srv_lock);
637 if (!is_binding && !server->session_estab) {
638 strncpy(shdr->Signature, "BSRSPYL", 8);
639 return 0;
640 }
641
642 rc = server->ops->calc_signature(rqst, server, false);
643
644 return rc;
645 }
646
647 int
smb2_verify_signature(struct smb_rqst * rqst,struct TCP_Server_Info * server)648 smb2_verify_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
649 {
650 unsigned int rc;
651 char server_response_sig[SMB2_SIGNATURE_SIZE];
652 struct smb2_hdr *shdr =
653 (struct smb2_hdr *)rqst->rq_iov[0].iov_base;
654
655 if ((shdr->Command == SMB2_NEGOTIATE) ||
656 (shdr->Command == SMB2_SESSION_SETUP) ||
657 (shdr->Command == SMB2_OPLOCK_BREAK) ||
658 server->ignore_signature ||
659 (!server->session_estab))
660 return 0;
661
662 /*
663 * BB what if signatures are supposed to be on for session but
664 * server does not send one? BB
665 */
666
667 /* Do not need to verify session setups with signature "BSRSPYL " */
668 if (memcmp(shdr->Signature, "BSRSPYL ", 8) == 0)
669 cifs_dbg(FYI, "dummy signature received for smb command 0x%x\n",
670 shdr->Command);
671
672 /*
673 * Save off the origiginal signature so we can modify the smb and check
674 * our calculated signature against what the server sent.
675 */
676 memcpy(server_response_sig, shdr->Signature, SMB2_SIGNATURE_SIZE);
677
678 memset(shdr->Signature, 0, SMB2_SIGNATURE_SIZE);
679
680 rc = server->ops->calc_signature(rqst, server, true);
681
682 if (rc)
683 return rc;
684
685 if (memcmp(server_response_sig, shdr->Signature, SMB2_SIGNATURE_SIZE)) {
686 cifs_dbg(VFS, "sign fail cmd 0x%x message id 0x%llx\n",
687 shdr->Command, shdr->MessageId);
688 return -EACCES;
689 } else
690 return 0;
691 }
692
693 /*
694 * Set message id for the request. Should be called after wait_for_free_request
695 * and when srv_mutex is held.
696 */
697 static inline void
smb2_seq_num_into_buf(struct TCP_Server_Info * server,struct smb2_hdr * shdr)698 smb2_seq_num_into_buf(struct TCP_Server_Info *server,
699 struct smb2_hdr *shdr)
700 {
701 unsigned int i, num = le16_to_cpu(shdr->CreditCharge);
702
703 shdr->MessageId = get_next_mid64(server);
704 /* skip message numbers according to CreditCharge field */
705 for (i = 1; i < num; i++)
706 get_next_mid(server);
707 }
708
709 static struct mid_q_entry *
smb2_mid_entry_alloc(const struct smb2_hdr * shdr,struct TCP_Server_Info * server)710 smb2_mid_entry_alloc(const struct smb2_hdr *shdr,
711 struct TCP_Server_Info *server)
712 {
713 struct mid_q_entry *temp;
714 unsigned int credits = le16_to_cpu(shdr->CreditCharge);
715
716 if (server == NULL) {
717 cifs_dbg(VFS, "Null TCP session in smb2_mid_entry_alloc\n");
718 return NULL;
719 }
720
721 temp = mempool_alloc(cifs_mid_poolp, GFP_NOFS);
722 memset(temp, 0, sizeof(struct mid_q_entry));
723 kref_init(&temp->refcount);
724 temp->mid = le64_to_cpu(shdr->MessageId);
725 temp->credits = credits > 0 ? credits : 1;
726 temp->pid = current->pid;
727 temp->command = shdr->Command; /* Always LE */
728 temp->when_alloc = jiffies;
729 temp->server = server;
730
731 /*
732 * The default is for the mid to be synchronous, so the
733 * default callback just wakes up the current task.
734 */
735 get_task_struct(current);
736 temp->creator = current;
737 temp->callback = cifs_wake_up_task;
738 temp->callback_data = current;
739
740 atomic_inc(&mid_count);
741 temp->mid_state = MID_REQUEST_ALLOCATED;
742 trace_smb3_cmd_enter(le32_to_cpu(shdr->Id.SyncId.TreeId),
743 le64_to_cpu(shdr->SessionId),
744 le16_to_cpu(shdr->Command), temp->mid);
745 return temp;
746 }
747
748 static int
smb2_get_mid_entry(struct cifs_ses * ses,struct TCP_Server_Info * server,struct smb2_hdr * shdr,struct mid_q_entry ** mid)749 smb2_get_mid_entry(struct cifs_ses *ses, struct TCP_Server_Info *server,
750 struct smb2_hdr *shdr, struct mid_q_entry **mid)
751 {
752 spin_lock(&server->srv_lock);
753 if (server->tcpStatus == CifsExiting) {
754 spin_unlock(&server->srv_lock);
755 return -ENOENT;
756 }
757
758 if (server->tcpStatus == CifsNeedReconnect) {
759 spin_unlock(&server->srv_lock);
760 cifs_dbg(FYI, "tcp session dead - return to caller to retry\n");
761 return -EAGAIN;
762 }
763
764 if (server->tcpStatus == CifsNeedNegotiate &&
765 shdr->Command != SMB2_NEGOTIATE) {
766 spin_unlock(&server->srv_lock);
767 return -EAGAIN;
768 }
769 spin_unlock(&server->srv_lock);
770
771 spin_lock(&ses->ses_lock);
772 if (ses->ses_status == SES_NEW) {
773 if ((shdr->Command != SMB2_SESSION_SETUP) &&
774 (shdr->Command != SMB2_NEGOTIATE)) {
775 spin_unlock(&ses->ses_lock);
776 return -EAGAIN;
777 }
778 /* else ok - we are setting up session */
779 }
780
781 if (ses->ses_status == SES_EXITING) {
782 if (shdr->Command != SMB2_LOGOFF) {
783 spin_unlock(&ses->ses_lock);
784 return -EAGAIN;
785 }
786 /* else ok - we are shutting down the session */
787 }
788 spin_unlock(&ses->ses_lock);
789
790 *mid = smb2_mid_entry_alloc(shdr, server);
791 if (*mid == NULL)
792 return -ENOMEM;
793 spin_lock(&server->mid_lock);
794 list_add_tail(&(*mid)->qhead, &server->pending_mid_q);
795 spin_unlock(&server->mid_lock);
796
797 return 0;
798 }
799
800 int
smb2_check_receive(struct mid_q_entry * mid,struct TCP_Server_Info * server,bool log_error)801 smb2_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
802 bool log_error)
803 {
804 unsigned int len = mid->resp_buf_size;
805 struct kvec iov[1];
806 struct smb_rqst rqst = { .rq_iov = iov,
807 .rq_nvec = 1 };
808
809 iov[0].iov_base = (char *)mid->resp_buf;
810 iov[0].iov_len = len;
811
812 dump_smb(mid->resp_buf, min_t(u32, 80, len));
813 /* convert the length into a more usable form */
814 if (len > 24 && server->sign && !mid->decrypted) {
815 int rc;
816
817 rc = smb2_verify_signature(&rqst, server);
818 if (rc)
819 cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n",
820 rc);
821 }
822
823 return map_smb2_to_linux_error(mid->resp_buf, log_error);
824 }
825
826 struct mid_q_entry *
smb2_setup_request(struct cifs_ses * ses,struct TCP_Server_Info * server,struct smb_rqst * rqst)827 smb2_setup_request(struct cifs_ses *ses, struct TCP_Server_Info *server,
828 struct smb_rqst *rqst)
829 {
830 int rc;
831 struct smb2_hdr *shdr =
832 (struct smb2_hdr *)rqst->rq_iov[0].iov_base;
833 struct mid_q_entry *mid;
834
835 smb2_seq_num_into_buf(server, shdr);
836
837 rc = smb2_get_mid_entry(ses, server, shdr, &mid);
838 if (rc) {
839 revert_current_mid_from_hdr(server, shdr);
840 return ERR_PTR(rc);
841 }
842
843 rc = smb2_sign_rqst(rqst, server);
844 if (rc) {
845 revert_current_mid_from_hdr(server, shdr);
846 delete_mid(mid);
847 return ERR_PTR(rc);
848 }
849
850 return mid;
851 }
852
853 struct mid_q_entry *
smb2_setup_async_request(struct TCP_Server_Info * server,struct smb_rqst * rqst)854 smb2_setup_async_request(struct TCP_Server_Info *server, struct smb_rqst *rqst)
855 {
856 int rc;
857 struct smb2_hdr *shdr =
858 (struct smb2_hdr *)rqst->rq_iov[0].iov_base;
859 struct mid_q_entry *mid;
860
861 spin_lock(&server->srv_lock);
862 if (server->tcpStatus == CifsNeedNegotiate &&
863 shdr->Command != SMB2_NEGOTIATE) {
864 spin_unlock(&server->srv_lock);
865 return ERR_PTR(-EAGAIN);
866 }
867 spin_unlock(&server->srv_lock);
868
869 smb2_seq_num_into_buf(server, shdr);
870
871 mid = smb2_mid_entry_alloc(shdr, server);
872 if (mid == NULL) {
873 revert_current_mid_from_hdr(server, shdr);
874 return ERR_PTR(-ENOMEM);
875 }
876
877 rc = smb2_sign_rqst(rqst, server);
878 if (rc) {
879 revert_current_mid_from_hdr(server, shdr);
880 release_mid(mid);
881 return ERR_PTR(rc);
882 }
883
884 return mid;
885 }
886
887 int
smb3_crypto_aead_allocate(struct TCP_Server_Info * server)888 smb3_crypto_aead_allocate(struct TCP_Server_Info *server)
889 {
890 struct crypto_aead *tfm;
891
892 if (!server->secmech.enc) {
893 if ((server->cipher_type == SMB2_ENCRYPTION_AES128_GCM) ||
894 (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM))
895 tfm = crypto_alloc_aead("gcm(aes)", 0, 0);
896 else
897 tfm = crypto_alloc_aead("ccm(aes)", 0, 0);
898 if (IS_ERR(tfm)) {
899 cifs_server_dbg(VFS, "%s: Failed alloc encrypt aead\n",
900 __func__);
901 return PTR_ERR(tfm);
902 }
903 server->secmech.enc = tfm;
904 }
905
906 if (!server->secmech.dec) {
907 if ((server->cipher_type == SMB2_ENCRYPTION_AES128_GCM) ||
908 (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM))
909 tfm = crypto_alloc_aead("gcm(aes)", 0, 0);
910 else
911 tfm = crypto_alloc_aead("ccm(aes)", 0, 0);
912 if (IS_ERR(tfm)) {
913 crypto_free_aead(server->secmech.enc);
914 server->secmech.enc = NULL;
915 cifs_server_dbg(VFS, "%s: Failed to alloc decrypt aead\n",
916 __func__);
917 return PTR_ERR(tfm);
918 }
919 server->secmech.dec = tfm;
920 }
921
922 return 0;
923 }
924