]>
git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blob - fs/cifs/smb2transport.c
2 * fs/cifs/smb2transport.c
4 * Copyright (C) International Business Machines Corp., 2002, 2011
6 * Author(s): Steve French (sfrench@us.ibm.com)
7 * Jeremy Allison (jra@samba.org) 2006
8 * Pavel Shilovsky (pshilovsky@samba.org) 2012
10 * This library is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU Lesser General Public License as published
12 * by the Free Software Foundation; either version 2.1 of the License, or
13 * (at your option) any later version.
15 * This library is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
18 * the GNU Lesser General Public License for more details.
20 * You should have received a copy of the GNU Lesser General Public License
21 * along with this library; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
26 #include <linux/list.h>
27 #include <linux/wait.h>
28 #include <linux/net.h>
29 #include <linux/delay.h>
30 #include <linux/uaccess.h>
31 #include <asm/processor.h>
32 #include <linux/mempool.h>
33 #include <linux/highmem.h>
36 #include "cifsproto.h"
37 #include "smb2proto.h"
38 #include "cifs_debug.h"
39 #include "smb2status.h"
43 smb2_crypto_shash_allocate(struct TCP_Server_Info
*server
)
47 if (server
->secmech
.sdeschmacsha256
!= NULL
)
48 return 0; /* already allocated */
50 server
->secmech
.hmacsha256
= crypto_alloc_shash("hmac(sha256)", 0, 0);
51 if (IS_ERR(server
->secmech
.hmacsha256
)) {
52 cifs_dbg(VFS
, "could not allocate crypto hmacsha256\n");
53 return PTR_ERR(server
->secmech
.hmacsha256
);
56 size
= sizeof(struct shash_desc
) +
57 crypto_shash_descsize(server
->secmech
.hmacsha256
);
58 server
->secmech
.sdeschmacsha256
= kmalloc(size
, GFP_KERNEL
);
59 if (!server
->secmech
.sdeschmacsha256
) {
60 crypto_free_shash(server
->secmech
.hmacsha256
);
61 server
->secmech
.hmacsha256
= NULL
;
64 server
->secmech
.sdeschmacsha256
->shash
.tfm
= server
->secmech
.hmacsha256
;
65 server
->secmech
.sdeschmacsha256
->shash
.flags
= 0x0;
71 smb3_crypto_shash_allocate(struct TCP_Server_Info
*server
)
76 if (server
->secmech
.sdesccmacaes
!= NULL
)
77 return 0; /* already allocated */
79 rc
= smb2_crypto_shash_allocate(server
);
83 server
->secmech
.cmacaes
= crypto_alloc_shash("cmac(aes)", 0, 0);
84 if (IS_ERR(server
->secmech
.cmacaes
)) {
85 cifs_dbg(VFS
, "could not allocate crypto cmac-aes");
86 kfree(server
->secmech
.sdeschmacsha256
);
87 server
->secmech
.sdeschmacsha256
= NULL
;
88 crypto_free_shash(server
->secmech
.hmacsha256
);
89 server
->secmech
.hmacsha256
= NULL
;
90 return PTR_ERR(server
->secmech
.cmacaes
);
93 size
= sizeof(struct shash_desc
) +
94 crypto_shash_descsize(server
->secmech
.cmacaes
);
95 server
->secmech
.sdesccmacaes
= kmalloc(size
, GFP_KERNEL
);
96 if (!server
->secmech
.sdesccmacaes
) {
97 cifs_dbg(VFS
, "%s: Can't alloc cmacaes\n", __func__
);
98 kfree(server
->secmech
.sdeschmacsha256
);
99 server
->secmech
.sdeschmacsha256
= NULL
;
100 crypto_free_shash(server
->secmech
.hmacsha256
);
101 crypto_free_shash(server
->secmech
.cmacaes
);
102 server
->secmech
.hmacsha256
= NULL
;
103 server
->secmech
.cmacaes
= NULL
;
106 server
->secmech
.sdesccmacaes
->shash
.tfm
= server
->secmech
.cmacaes
;
107 server
->secmech
.sdesccmacaes
->shash
.flags
= 0x0;
114 smb2_calc_signature(struct smb_rqst
*rqst
, struct TCP_Server_Info
*server
)
117 unsigned char smb2_signature
[SMB2_HMACSHA256_SIZE
];
118 unsigned char *sigptr
= smb2_signature
;
119 struct kvec
*iov
= rqst
->rq_iov
;
120 int n_vec
= rqst
->rq_nvec
;
121 struct smb2_hdr
*smb2_pdu
= (struct smb2_hdr
*)iov
[0].iov_base
;
123 memset(smb2_signature
, 0x0, SMB2_HMACSHA256_SIZE
);
124 memset(smb2_pdu
->Signature
, 0x0, SMB2_SIGNATURE_SIZE
);
126 rc
= smb2_crypto_shash_allocate(server
);
128 cifs_dbg(VFS
, "%s: shah256 alloc failed\n", __func__
);
132 rc
= crypto_shash_setkey(server
->secmech
.hmacsha256
,
133 server
->session_key
.response
, SMB2_NTLMV2_SESSKEY_SIZE
);
135 cifs_dbg(VFS
, "%s: Could not update with response\n", __func__
);
139 rc
= crypto_shash_init(&server
->secmech
.sdeschmacsha256
->shash
);
141 cifs_dbg(VFS
, "%s: Could not init sha256", __func__
);
145 for (i
= 0; i
< n_vec
; i
++) {
146 if (iov
[i
].iov_len
== 0)
148 if (iov
[i
].iov_base
== NULL
) {
149 cifs_dbg(VFS
, "null iovec entry\n");
153 * The first entry includes a length field (which does not get
154 * signed that occupies the first 4 bytes before the header).
157 if (iov
[0].iov_len
<= 8) /* cmd field at offset 9 */
158 break; /* nothing to sign or corrupt header */
161 &server
->secmech
.sdeschmacsha256
->shash
,
162 iov
[i
].iov_base
+ 4, iov
[i
].iov_len
- 4);
166 &server
->secmech
.sdeschmacsha256
->shash
,
167 iov
[i
].iov_base
, iov
[i
].iov_len
);
170 cifs_dbg(VFS
, "%s: Could not update with payload\n",
176 /* now hash over the rq_pages array */
177 for (i
= 0; i
< rqst
->rq_npages
; i
++) {
180 cifs_rqst_page_to_kvec(rqst
, i
, &p_iov
);
181 crypto_shash_update(&server
->secmech
.sdeschmacsha256
->shash
,
182 p_iov
.iov_base
, p_iov
.iov_len
);
183 kunmap(rqst
->rq_pages
[i
]);
186 rc
= crypto_shash_final(&server
->secmech
.sdeschmacsha256
->shash
,
189 cifs_dbg(VFS
, "%s: Could not generate sha256 hash\n", __func__
);
191 memcpy(smb2_pdu
->Signature
, sigptr
, SMB2_SIGNATURE_SIZE
);
197 generate_smb3signingkey(struct TCP_Server_Info
*server
)
199 unsigned char zero
= 0x0;
200 __u8 i
[4] = {0, 0, 0, 1};
201 __u8 L
[4] = {0, 0, 0, 128};
203 unsigned char prfhash
[SMB2_HMACSHA256_SIZE
];
204 unsigned char *hashptr
= prfhash
;
206 memset(prfhash
, 0x0, SMB2_HMACSHA256_SIZE
);
207 memset(server
->smb3signingkey
, 0x0, SMB3_SIGNKEY_SIZE
);
209 rc
= smb3_crypto_shash_allocate(server
);
211 cifs_dbg(VFS
, "%s: crypto alloc failed\n", __func__
);
212 goto smb3signkey_ret
;
215 rc
= crypto_shash_setkey(server
->secmech
.hmacsha256
,
216 server
->session_key
.response
, SMB2_NTLMV2_SESSKEY_SIZE
);
218 cifs_dbg(VFS
, "%s: Could not set with session key\n", __func__
);
219 goto smb3signkey_ret
;
222 rc
= crypto_shash_init(&server
->secmech
.sdeschmacsha256
->shash
);
224 cifs_dbg(VFS
, "%s: Could not init sign hmac\n", __func__
);
225 goto smb3signkey_ret
;
228 rc
= crypto_shash_update(&server
->secmech
.sdeschmacsha256
->shash
,
231 cifs_dbg(VFS
, "%s: Could not update with n\n", __func__
);
232 goto smb3signkey_ret
;
235 rc
= crypto_shash_update(&server
->secmech
.sdeschmacsha256
->shash
,
238 cifs_dbg(VFS
, "%s: Could not update with label\n", __func__
);
239 goto smb3signkey_ret
;
242 rc
= crypto_shash_update(&server
->secmech
.sdeschmacsha256
->shash
,
245 cifs_dbg(VFS
, "%s: Could not update with zero\n", __func__
);
246 goto smb3signkey_ret
;
249 rc
= crypto_shash_update(&server
->secmech
.sdeschmacsha256
->shash
,
252 cifs_dbg(VFS
, "%s: Could not update with context\n", __func__
);
253 goto smb3signkey_ret
;
256 rc
= crypto_shash_update(&server
->secmech
.sdeschmacsha256
->shash
,
259 cifs_dbg(VFS
, "%s: Could not update with L\n", __func__
);
260 goto smb3signkey_ret
;
263 rc
= crypto_shash_final(&server
->secmech
.sdeschmacsha256
->shash
,
266 cifs_dbg(VFS
, "%s: Could not generate sha256 hash\n", __func__
);
267 goto smb3signkey_ret
;
270 memcpy(server
->smb3signingkey
, hashptr
, SMB3_SIGNKEY_SIZE
);
277 smb3_calc_signature(struct smb_rqst
*rqst
, struct TCP_Server_Info
*server
)
280 unsigned char smb3_signature
[SMB2_CMACAES_SIZE
];
281 unsigned char *sigptr
= smb3_signature
;
282 struct kvec
*iov
= rqst
->rq_iov
;
283 int n_vec
= rqst
->rq_nvec
;
284 struct smb2_hdr
*smb2_pdu
= (struct smb2_hdr
*)iov
[0].iov_base
;
286 memset(smb3_signature
, 0x0, SMB2_CMACAES_SIZE
);
287 memset(smb2_pdu
->Signature
, 0x0, SMB2_SIGNATURE_SIZE
);
289 rc
= crypto_shash_setkey(server
->secmech
.cmacaes
,
290 server
->smb3signingkey
, SMB2_CMACAES_SIZE
);
292 cifs_dbg(VFS
, "%s: Could not set key for cmac aes\n", __func__
);
297 * we already allocate sdesccmacaes when we init smb3 signing key,
298 * so unlike smb2 case we do not have to check here if secmech are
301 rc
= crypto_shash_init(&server
->secmech
.sdesccmacaes
->shash
);
303 cifs_dbg(VFS
, "%s: Could not init cmac aes\n", __func__
);
307 for (i
= 0; i
< n_vec
; i
++) {
308 if (iov
[i
].iov_len
== 0)
310 if (iov
[i
].iov_base
== NULL
) {
311 cifs_dbg(VFS
, "null iovec entry");
315 * The first entry includes a length field (which does not get
316 * signed that occupies the first 4 bytes before the header).
319 if (iov
[0].iov_len
<= 8) /* cmd field at offset 9 */
320 break; /* nothing to sign or corrupt header */
323 &server
->secmech
.sdesccmacaes
->shash
,
324 iov
[i
].iov_base
+ 4, iov
[i
].iov_len
- 4);
328 &server
->secmech
.sdesccmacaes
->shash
,
329 iov
[i
].iov_base
, iov
[i
].iov_len
);
332 cifs_dbg(VFS
, "%s: Couldn't update cmac aes with payload\n",
338 /* now hash over the rq_pages array */
339 for (i
= 0; i
< rqst
->rq_npages
; i
++) {
342 cifs_rqst_page_to_kvec(rqst
, i
, &p_iov
);
343 crypto_shash_update(&server
->secmech
.sdesccmacaes
->shash
,
344 p_iov
.iov_base
, p_iov
.iov_len
);
345 kunmap(rqst
->rq_pages
[i
]);
348 rc
= crypto_shash_final(&server
->secmech
.sdesccmacaes
->shash
,
351 cifs_dbg(VFS
, "%s: Could not generate cmac aes\n", __func__
);
353 memcpy(smb2_pdu
->Signature
, sigptr
, SMB2_SIGNATURE_SIZE
);
358 /* must be called with server->srv_mutex held */
360 smb2_sign_rqst(struct smb_rqst
*rqst
, struct TCP_Server_Info
*server
)
363 struct smb2_hdr
*smb2_pdu
= rqst
->rq_iov
[0].iov_base
;
365 if (!(smb2_pdu
->Flags
& SMB2_FLAGS_SIGNED
) ||
366 server
->tcpStatus
== CifsNeedNegotiate
)
369 if (!server
->session_estab
) {
370 strncpy(smb2_pdu
->Signature
, "BSRSPYL", 8);
374 rc
= server
->ops
->calc_signature(rqst
, server
);
380 smb2_verify_signature(struct smb_rqst
*rqst
, struct TCP_Server_Info
*server
)
383 char server_response_sig
[16];
384 struct smb2_hdr
*smb2_pdu
= (struct smb2_hdr
*)rqst
->rq_iov
[0].iov_base
;
386 if ((smb2_pdu
->Command
== SMB2_NEGOTIATE
) ||
387 (smb2_pdu
->Command
== SMB2_OPLOCK_BREAK
) ||
388 (!server
->session_estab
))
392 * BB what if signatures are supposed to be on for session but
393 * server does not send one? BB
396 /* Do not need to verify session setups with signature "BSRSPYL " */
397 if (memcmp(smb2_pdu
->Signature
, "BSRSPYL ", 8) == 0)
398 cifs_dbg(FYI
, "dummy signature received for smb command 0x%x\n",
402 * Save off the origiginal signature so we can modify the smb and check
403 * our calculated signature against what the server sent.
405 memcpy(server_response_sig
, smb2_pdu
->Signature
, SMB2_SIGNATURE_SIZE
);
407 memset(smb2_pdu
->Signature
, 0, SMB2_SIGNATURE_SIZE
);
409 mutex_lock(&server
->srv_mutex
);
410 rc
= server
->ops
->calc_signature(rqst
, server
);
411 mutex_unlock(&server
->srv_mutex
);
416 if (memcmp(server_response_sig
, smb2_pdu
->Signature
,
417 SMB2_SIGNATURE_SIZE
))
424 * Set message id for the request. Should be called after wait_for_free_request
425 * and when srv_mutex is held.
428 smb2_seq_num_into_buf(struct TCP_Server_Info
*server
, struct smb2_hdr
*hdr
)
430 hdr
->MessageId
= get_next_mid(server
);
433 static struct mid_q_entry
*
434 smb2_mid_entry_alloc(const struct smb2_hdr
*smb_buffer
,
435 struct TCP_Server_Info
*server
)
437 struct mid_q_entry
*temp
;
439 if (server
== NULL
) {
440 cifs_dbg(VFS
, "Null TCP session in smb2_mid_entry_alloc\n");
444 temp
= mempool_alloc(cifs_mid_poolp
, GFP_NOFS
);
448 memset(temp
, 0, sizeof(struct mid_q_entry
));
449 temp
->mid
= smb_buffer
->MessageId
; /* always LE */
450 temp
->pid
= current
->pid
;
451 temp
->command
= smb_buffer
->Command
; /* Always LE */
452 temp
->when_alloc
= jiffies
;
453 temp
->server
= server
;
456 * The default is for the mid to be synchronous, so the
457 * default callback just wakes up the current task.
459 temp
->callback
= cifs_wake_up_task
;
460 temp
->callback_data
= current
;
463 atomic_inc(&midCount
);
464 temp
->mid_state
= MID_REQUEST_ALLOCATED
;
469 smb2_get_mid_entry(struct cifs_ses
*ses
, struct smb2_hdr
*buf
,
470 struct mid_q_entry
**mid
)
472 if (ses
->server
->tcpStatus
== CifsExiting
)
475 if (ses
->server
->tcpStatus
== CifsNeedReconnect
) {
476 cifs_dbg(FYI
, "tcp session dead - return to caller to retry\n");
480 if (ses
->status
!= CifsGood
) {
481 /* check if SMB2 session is bad because we are setting it up */
482 if ((buf
->Command
!= SMB2_SESSION_SETUP
) &&
483 (buf
->Command
!= SMB2_NEGOTIATE
))
485 /* else ok - we are setting up session */
487 *mid
= smb2_mid_entry_alloc(buf
, ses
->server
);
490 spin_lock(&GlobalMid_Lock
);
491 list_add_tail(&(*mid
)->qhead
, &ses
->server
->pending_mid_q
);
492 spin_unlock(&GlobalMid_Lock
);
497 smb2_check_receive(struct mid_q_entry
*mid
, struct TCP_Server_Info
*server
,
500 unsigned int len
= get_rfc1002_length(mid
->resp_buf
);
502 struct smb_rqst rqst
= { .rq_iov
= &iov
,
505 iov
.iov_base
= (char *)mid
->resp_buf
;
506 iov
.iov_len
= get_rfc1002_length(mid
->resp_buf
) + 4;
508 dump_smb(mid
->resp_buf
, min_t(u32
, 80, len
));
509 /* convert the length into a more usable form */
510 if (len
> 24 && server
->sign
) {
513 rc
= smb2_verify_signature(&rqst
, server
);
515 cifs_dbg(VFS
, "SMB signature verification returned error = %d\n",
519 return map_smb2_to_linux_error(mid
->resp_buf
, log_error
);
523 smb2_setup_request(struct cifs_ses
*ses
, struct smb_rqst
*rqst
)
526 struct smb2_hdr
*hdr
= (struct smb2_hdr
*)rqst
->rq_iov
[0].iov_base
;
527 struct mid_q_entry
*mid
;
529 smb2_seq_num_into_buf(ses
->server
, hdr
);
531 rc
= smb2_get_mid_entry(ses
, hdr
, &mid
);
534 rc
= smb2_sign_rqst(rqst
, ses
->server
);
536 cifs_delete_mid(mid
);
543 smb2_setup_async_request(struct TCP_Server_Info
*server
, struct smb_rqst
*rqst
)
546 struct smb2_hdr
*hdr
= (struct smb2_hdr
*)rqst
->rq_iov
[0].iov_base
;
547 struct mid_q_entry
*mid
;
549 smb2_seq_num_into_buf(server
, hdr
);
551 mid
= smb2_mid_entry_alloc(hdr
, server
);
553 return ERR_PTR(-ENOMEM
);
555 rc
= smb2_sign_rqst(rqst
, server
);
557 DeleteMidQEntry(mid
);