fs/cifs/smb2transport.c

   1 /*
   2  *   fs/cifs/smb2transport.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002, 2011
   5  *                 Etersoft, 2012
   6  *   Author(s): Steve French (sfrench@us.ibm.com)
   7  *              Jeremy Allison (jra@samba.org) 2006
   8  *              Pavel Shilovsky (pshilovsky@samba.org) 2012
   9  *
  10  *   This library is free software; you can redistribute it and/or modify
  11  *   it under the terms of the GNU Lesser General Public License as published
  12  *   by the Free Software Foundation; either version 2.1 of the License, or
  13  *   (at your option) any later version.
  14  *
  15  *   This library is distributed in the hope that it will be useful,
  16  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  18  *   the GNU Lesser General Public License for more details.
  19  *
  20  *   You should have received a copy of the GNU Lesser General Public License
  21  *   along with this library; if not, write to the Free Software
  22  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  23  */
  24
  25 #include <linux/fs.h>
  26 #include <linux/list.h>
  27 #include <linux/wait.h>
  28 #include <linux/net.h>
  29 #include <linux/delay.h>
  30 #include <linux/uaccess.h>
  31 #include <asm/processor.h>
  32 #include <linux/mempool.h>
  33 #include <linux/highmem.h>
  34 #include <crypto/aead.h>
  35 #include "smb2pdu.h"
  36 #include "cifsglob.h"
  37 #include "cifsproto.h"
  38 #include "smb2proto.h"
  39 #include "cifs_debug.h"
  40 #include "smb2status.h"
  41 #include "smb2glob.h"
  42
  43 static int
  44 smb2_crypto_shash_allocate(struct TCP_Server_Info *server)
  45 {
  46         int rc;
  47         unsigned int size;
  48
  49         if (server->secmech.sdeschmacsha256 != NULL)
  50                 return 0; /* already allocated */
  51
  52         server->secmech.hmacsha256 = crypto_alloc_shash("hmac(sha256)", 0, 0);
  53         if (IS_ERR(server->secmech.hmacsha256)) {
  54                 cifs_dbg(VFS, "could not allocate crypto hmacsha256\n");
  55                 rc = PTR_ERR(server->secmech.hmacsha256);
  56                 server->secmech.hmacsha256 = NULL;
  57                 return rc;
  58         }
  59
  60         size = sizeof(struct shash_desc) +
  61                         crypto_shash_descsize(server->secmech.hmacsha256);
  62         server->secmech.sdeschmacsha256 = kmalloc(size, GFP_KERNEL);
  63         if (!server->secmech.sdeschmacsha256) {
  64                 crypto_free_shash(server->secmech.hmacsha256);
  65                 server->secmech.hmacsha256 = NULL;
  66                 return -ENOMEM;
  67         }
  68         server->secmech.sdeschmacsha256->shash.tfm = server->secmech.hmacsha256;
  69         server->secmech.sdeschmacsha256->shash.flags = 0x0;
  70
  71         return 0;
  72 }
  73
  74 static int
  75 smb3_crypto_shash_allocate(struct TCP_Server_Info *server)
  76 {
  77         unsigned int size;
  78         int rc;
  79
  80         if (server->secmech.sdesccmacaes != NULL)
  81                 return 0;  /* already allocated */
  82
  83         rc = smb2_crypto_shash_allocate(server);
  84         if (rc)
  85                 return rc;
  86
  87         server->secmech.cmacaes = crypto_alloc_shash("cmac(aes)", 0, 0);
  88         if (IS_ERR(server->secmech.cmacaes)) {
  89                 cifs_dbg(VFS, "could not allocate crypto cmac-aes");
  90                 kfree(server->secmech.sdeschmacsha256);
  91                 server->secmech.sdeschmacsha256 = NULL;
  92                 crypto_free_shash(server->secmech.hmacsha256);
  93                 server->secmech.hmacsha256 = NULL;
  94                 rc = PTR_ERR(server->secmech.cmacaes);
  95                 server->secmech.cmacaes = NULL;
  96                 return rc;
  97         }
  98
  99         size = sizeof(struct shash_desc) +
 100                         crypto_shash_descsize(server->secmech.cmacaes);
 101         server->secmech.sdesccmacaes = kmalloc(size, GFP_KERNEL);
 102         if (!server->secmech.sdesccmacaes) {
 103                 cifs_dbg(VFS, "%s: Can't alloc cmacaes\n", __func__);
 104                 kfree(server->secmech.sdeschmacsha256);
 105                 server->secmech.sdeschmacsha256 = NULL;
 106                 crypto_free_shash(server->secmech.hmacsha256);
 107                 crypto_free_shash(server->secmech.cmacaes);
 108                 server->secmech.hmacsha256 = NULL;
 109                 server->secmech.cmacaes = NULL;
 110                 return -ENOMEM;
 111         }
 112         server->secmech.sdesccmacaes->shash.tfm = server->secmech.cmacaes;
 113         server->secmech.sdesccmacaes->shash.flags = 0x0;
 114
 115         return 0;
 116 }
 117
 118 static struct cifs_ses *
 119 smb2_find_smb_ses_unlocked(struct TCP_Server_Info *server, __u64 ses_id)
 120 {
 121         struct cifs_ses *ses;
 122
 123         list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
 124                 if (ses->Suid != ses_id)
 125                         continue;
 126                 return ses;
 127         }
 128
 129         return NULL;
 130 }
 131
 132 struct cifs_ses *
 133 smb2_find_smb_ses(struct TCP_Server_Info *server, __u64 ses_id)
 134 {
 135         struct cifs_ses *ses;
 136
 137         spin_lock(&cifs_tcp_ses_lock);
 138         ses = smb2_find_smb_ses_unlocked(server, ses_id);
 139         spin_unlock(&cifs_tcp_ses_lock);
 140
 141         return ses;
 142 }
 143
 144 static struct cifs_tcon *
 145 smb2_find_smb_sess_tcon_unlocked(struct cifs_ses *ses, __u32  tid)
 146 {
 147         struct cifs_tcon *tcon;
 148
 149         list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
 150                 if (tcon->tid != tid)
 151                         continue;
 152                 ++tcon->tc_count;
 153                 return tcon;
 154         }
 155
 156         return NULL;
 157 }
 158
 159 /*
 160  * Obtain tcon corresponding to the tid in the given
 161  * cifs_ses
 162  */
 163
 164 struct cifs_tcon *
 165 smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32  tid)
 166 {
 167         struct cifs_ses *ses;
 168         struct cifs_tcon *tcon;
 169
 170         spin_lock(&cifs_tcp_ses_lock);
 171         ses = smb2_find_smb_ses_unlocked(server, ses_id);
 172         if (!ses) {
 173                 spin_unlock(&cifs_tcp_ses_lock);
 174                 return NULL;
 175         }
 176         tcon = smb2_find_smb_sess_tcon_unlocked(ses, tid);
 177         spin_unlock(&cifs_tcp_ses_lock);
 178
 179         return tcon;
 180 }
 181
 182 int
 183 smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
 184 {
 185         int rc;
 186         unsigned char smb2_signature[SMB2_HMACSHA256_SIZE];
 187         unsigned char *sigptr = smb2_signature;
 188         struct kvec *iov = rqst->rq_iov;
 189         struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)iov[1].iov_base;
 190         struct cifs_ses *ses;
 191
 192         ses = smb2_find_smb_ses(server, shdr->SessionId);
 193         if (!ses) {
 194                 cifs_dbg(VFS, "%s: Could not find session\n", __func__);
 195                 return 0;
 196         }
 197
 198         memset(smb2_signature, 0x0, SMB2_HMACSHA256_SIZE);
 199         memset(shdr->Signature, 0x0, SMB2_SIGNATURE_SIZE);
 200
 201         rc = smb2_crypto_shash_allocate(server);
 202         if (rc) {
 203                 cifs_dbg(VFS, "%s: shah256 alloc failed\n", __func__);
 204                 return rc;
 205         }
 206
 207         rc = crypto_shash_setkey(server->secmech.hmacsha256,
 208                 ses->auth_key.response, SMB2_NTLMV2_SESSKEY_SIZE);
 209         if (rc) {
 210                 cifs_dbg(VFS, "%s: Could not update with response\n", __func__);
 211                 return rc;
 212         }
 213
 214         rc = crypto_shash_init(&server->secmech.sdeschmacsha256->shash);
 215         if (rc) {
 216                 cifs_dbg(VFS, "%s: Could not init sha256", __func__);
 217                 return rc;
 218         }
 219
 220         rc = __cifs_calc_signature(rqst, server, sigptr,
 221                 &server->secmech.sdeschmacsha256->shash);
 222
 223         if (!rc)
 224                 memcpy(shdr->Signature, sigptr, SMB2_SIGNATURE_SIZE);
 225
 226         return rc;
 227 }
 228
 229 static int generate_key(struct cifs_ses *ses, struct kvec label,
 230                         struct kvec context, __u8 *key, unsigned int key_size)
 231 {
 232         unsigned char zero = 0x0;
 233         __u8 i[4] = {0, 0, 0, 1};
 234         __u8 L[4] = {0, 0, 0, 128};
 235         int rc = 0;
 236         unsigned char prfhash[SMB2_HMACSHA256_SIZE];
 237         unsigned char *hashptr = prfhash;
 238
 239         memset(prfhash, 0x0, SMB2_HMACSHA256_SIZE);
 240         memset(key, 0x0, key_size);
 241
 242         rc = smb3_crypto_shash_allocate(ses->server);
 243         if (rc) {
 244                 cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
 245                 goto smb3signkey_ret;
 246         }
 247
 248         rc = crypto_shash_setkey(ses->server->secmech.hmacsha256,
 249                 ses->auth_key.response, SMB2_NTLMV2_SESSKEY_SIZE);
 250         if (rc) {
 251                 cifs_dbg(VFS, "%s: Could not set with session key\n", __func__);
 252                 goto smb3signkey_ret;
 253         }
 254
 255         rc = crypto_shash_init(&ses->server->secmech.sdeschmacsha256->shash);
 256         if (rc) {
 257                 cifs_dbg(VFS, "%s: Could not init sign hmac\n", __func__);
 258                 goto smb3signkey_ret;
 259         }
 260
 261         rc = crypto_shash_update(&ses->server->secmech.sdeschmacsha256->shash,
 262                                 i, 4);
 263         if (rc) {
 264                 cifs_dbg(VFS, "%s: Could not update with n\n", __func__);
 265                 goto smb3signkey_ret;
 266         }
 267
 268         rc = crypto_shash_update(&ses->server->secmech.sdeschmacsha256->shash,
 269                                 label.iov_base, label.iov_len);
 270         if (rc) {
 271                 cifs_dbg(VFS, "%s: Could not update with label\n", __func__);
 272                 goto smb3signkey_ret;
 273         }
 274
 275         rc = crypto_shash_update(&ses->server->secmech.sdeschmacsha256->shash,
 276                                 &zero, 1);
 277         if (rc) {
 278                 cifs_dbg(VFS, "%s: Could not update with zero\n", __func__);
 279                 goto smb3signkey_ret;
 280         }
 281
 282         rc = crypto_shash_update(&ses->server->secmech.sdeschmacsha256->shash,
 283                                 context.iov_base, context.iov_len);
 284         if (rc) {
 285                 cifs_dbg(VFS, "%s: Could not update with context\n", __func__);
 286                 goto smb3signkey_ret;
 287         }
 288
 289         rc = crypto_shash_update(&ses->server->secmech.sdeschmacsha256->shash,
 290                                 L, 4);
 291         if (rc) {
 292                 cifs_dbg(VFS, "%s: Could not update with L\n", __func__);
 293                 goto smb3signkey_ret;
 294         }
 295
 296         rc = crypto_shash_final(&ses->server->secmech.sdeschmacsha256->shash,
 297                                 hashptr);
 298         if (rc) {
 299                 cifs_dbg(VFS, "%s: Could not generate sha256 hash\n", __func__);
 300                 goto smb3signkey_ret;
 301         }
 302
 303         memcpy(key, hashptr, key_size);
 304
 305 smb3signkey_ret:
 306         return rc;
 307 }
 308
 309 struct derivation {
 310         struct kvec label;
 311         struct kvec context;
 312 };
 313
 314 struct derivation_triplet {
 315         struct derivation signing;
 316         struct derivation encryption;
 317         struct derivation decryption;
 318 };
 319
 320 static int
 321 generate_smb3signingkey(struct cifs_ses *ses,
 322                         const struct derivation_triplet *ptriplet)
 323 {
 324         int rc;
 325
 326         rc = generate_key(ses, ptriplet->signing.label,
 327                           ptriplet->signing.context, ses->smb3signingkey,
 328                           SMB3_SIGN_KEY_SIZE);
 329         if (rc)
 330                 return rc;
 331
 332         rc = generate_key(ses, ptriplet->encryption.label,
 333                           ptriplet->encryption.context, ses->smb3encryptionkey,
 334                           SMB3_SIGN_KEY_SIZE);
 335         if (rc)
 336                 return rc;
 337
 338         rc = generate_key(ses, ptriplet->decryption.label,
 339                           ptriplet->decryption.context,
 340                           ses->smb3decryptionkey, SMB3_SIGN_KEY_SIZE);
 341
 342         if (rc)
 343                 return rc;
 344
 345 #ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS
 346         cifs_dbg(VFS, "%s: dumping generated AES session keys\n", __func__);
 347         /*
 348          * The session id is opaque in terms of endianness, so we can't
 349          * print it as a long long. we dump it as we got it on the wire
 350          */
 351         cifs_dbg(VFS, "Session Id    %*ph\n", (int)sizeof(ses->Suid),
 352                         &ses->Suid);
 353         cifs_dbg(VFS, "Session Key   %*ph\n",
 354                  SMB2_NTLMV2_SESSKEY_SIZE, ses->auth_key.response);
 355         cifs_dbg(VFS, "Signing Key   %*ph\n",
 356                  SMB3_SIGN_KEY_SIZE, ses->smb3signingkey);
 357         cifs_dbg(VFS, "ServerIn Key  %*ph\n",
 358                  SMB3_SIGN_KEY_SIZE, ses->smb3encryptionkey);
 359         cifs_dbg(VFS, "ServerOut Key %*ph\n",
 360                  SMB3_SIGN_KEY_SIZE, ses->smb3decryptionkey);
 361 #endif
 362         return rc;
 363 }
 364
 365 int
 366 generate_smb30signingkey(struct cifs_ses *ses)
 367
 368 {
 369         struct derivation_triplet triplet;
 370         struct derivation *d;
 371
 372         d = &triplet.signing;
 373         d->label.iov_base = "SMB2AESCMAC";
 374         d->label.iov_len = 12;
 375         d->context.iov_base = "SmbSign";
 376         d->context.iov_len = 8;
 377
 378         d = &triplet.encryption;
 379         d->label.iov_base = "SMB2AESCCM";
 380         d->label.iov_len = 11;
 381         d->context.iov_base = "ServerIn ";
 382         d->context.iov_len = 10;
 383
 384         d = &triplet.decryption;
 385         d->label.iov_base = "SMB2AESCCM";
 386         d->label.iov_len = 11;
 387         d->context.iov_base = "ServerOut";
 388         d->context.iov_len = 10;
 389
 390         return generate_smb3signingkey(ses, &triplet);
 391 }
 392
 393 int
 394 generate_smb311signingkey(struct cifs_ses *ses)
 395
 396 {
 397         struct derivation_triplet triplet;
 398         struct derivation *d;
 399
 400         d = &triplet.signing;
 401         d->label.iov_base = "SMB2AESCMAC";
 402         d->label.iov_len = 12;
 403         d->context.iov_base = "SmbSign";
 404         d->context.iov_len = 8;
 405
 406         d = &triplet.encryption;
 407         d->label.iov_base = "SMB2AESCCM";
 408         d->label.iov_len = 11;
 409         d->context.iov_base = "ServerIn ";
 410         d->context.iov_len = 10;
 411
 412         d = &triplet.decryption;
 413         d->label.iov_base = "SMB2AESCCM";
 414         d->label.iov_len = 11;
 415         d->context.iov_base = "ServerOut";
 416         d->context.iov_len = 10;
 417
 418         return generate_smb3signingkey(ses, &triplet);
 419 }
 420
 421 int
 422 smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
 423 {
 424         int rc = 0;
 425         unsigned char smb3_signature[SMB2_CMACAES_SIZE];
 426         unsigned char *sigptr = smb3_signature;
 427         struct kvec *iov = rqst->rq_iov;
 428         struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)iov[1].iov_base;
 429         struct cifs_ses *ses;
 430
 431         ses = smb2_find_smb_ses(server, shdr->SessionId);
 432         if (!ses) {
 433                 cifs_dbg(VFS, "%s: Could not find session\n", __func__);
 434                 return 0;
 435         }
 436
 437         memset(smb3_signature, 0x0, SMB2_CMACAES_SIZE);
 438         memset(shdr->Signature, 0x0, SMB2_SIGNATURE_SIZE);
 439
 440         rc = crypto_shash_setkey(server->secmech.cmacaes,
 441                 ses->smb3signingkey, SMB2_CMACAES_SIZE);
 442
 443         if (rc) {
 444                 cifs_dbg(VFS, "%s: Could not set key for cmac aes\n", __func__);
 445                 return rc;
 446         }
 447
 448         /*
 449          * we already allocate sdesccmacaes when we init smb3 signing key,
 450          * so unlike smb2 case we do not have to check here if secmech are
 451          * initialized
 452          */
 453         rc = crypto_shash_init(&server->secmech.sdesccmacaes->shash);
 454         if (rc) {
 455                 cifs_dbg(VFS, "%s: Could not init cmac aes\n", __func__);
 456                 return rc;
 457         }
 458
 459         rc = __cifs_calc_signature(rqst, server, sigptr,
 460                                    &server->secmech.sdesccmacaes->shash);
 461
 462         if (!rc)
 463                 memcpy(shdr->Signature, sigptr, SMB2_SIGNATURE_SIZE);
 464
 465         return rc;
 466 }
 467
 468 /* must be called with server->srv_mutex held */
 469 static int
 470 smb2_sign_rqst(struct smb_rqst *rqst, struct TCP_Server_Info *server)
 471 {
 472         int rc = 0;
 473         struct smb2_sync_hdr *shdr =
 474                         (struct smb2_sync_hdr *)rqst->rq_iov[1].iov_base;
 475
 476         if (!(shdr->Flags & SMB2_FLAGS_SIGNED) ||
 477             server->tcpStatus == CifsNeedNegotiate)
 478                 return rc;
 479
 480         if (!server->session_estab) {
 481                 strncpy(shdr->Signature, "BSRSPYL", 8);
 482                 return rc;
 483         }
 484
 485         rc = server->ops->calc_signature(rqst, server);
 486
 487         return rc;
 488 }
 489
 490 int
 491 smb2_verify_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
 492 {
 493         unsigned int rc;
 494         char server_response_sig[16];
 495         struct smb2_sync_hdr *shdr =
 496                         (struct smb2_sync_hdr *)rqst->rq_iov[1].iov_base;
 497
 498         if ((shdr->Command == SMB2_NEGOTIATE) ||
 499             (shdr->Command == SMB2_SESSION_SETUP) ||
 500             (shdr->Command == SMB2_OPLOCK_BREAK) ||
 501             (!server->session_estab))
 502                 return 0;
 503
 504         /*
 505          * BB what if signatures are supposed to be on for session but
 506          * server does not send one? BB
 507          */
 508
 509         /* Do not need to verify session setups with signature "BSRSPYL " */
 510         if (memcmp(shdr->Signature, "BSRSPYL ", 8) == 0)
 511                 cifs_dbg(FYI, "dummy signature received for smb command 0x%x\n",
 512                          shdr->Command);
 513
 514         /*
 515          * Save off the origiginal signature so we can modify the smb and check
 516          * our calculated signature against what the server sent.
 517          */
 518         memcpy(server_response_sig, shdr->Signature, SMB2_SIGNATURE_SIZE);
 519
 520         memset(shdr->Signature, 0, SMB2_SIGNATURE_SIZE);
 521
 522         mutex_lock(&server->srv_mutex);
 523         rc = server->ops->calc_signature(rqst, server);
 524         mutex_unlock(&server->srv_mutex);
 525
 526         if (rc)
 527                 return rc;
 528
 529         if (memcmp(server_response_sig, shdr->Signature, SMB2_SIGNATURE_SIZE))
 530                 return -EACCES;
 531         else
 532                 return 0;
 533 }
 534
 535 /*
 536  * Set message id for the request. Should be called after wait_for_free_request
 537  * and when srv_mutex is held.
 538  */
 539 static inline void
 540 smb2_seq_num_into_buf(struct TCP_Server_Info *server,
 541                       struct smb2_sync_hdr *shdr)
 542 {
 543         unsigned int i, num = le16_to_cpu(shdr->CreditCharge);
 544
 545         shdr->MessageId = get_next_mid64(server);
 546         /* skip message numbers according to CreditCharge field */
 547         for (i = 1; i < num; i++)
 548                 get_next_mid(server);
 549 }
 550
 551 static struct mid_q_entry *
 552 smb2_mid_entry_alloc(const struct smb2_sync_hdr *shdr,
 553                      struct TCP_Server_Info *server)
 554 {
 555         struct mid_q_entry *temp;
 556
 557         if (server == NULL) {
 558                 cifs_dbg(VFS, "Null TCP session in smb2_mid_entry_alloc\n");
 559                 return NULL;
 560         }
 561
 562         temp = mempool_alloc(cifs_mid_poolp, GFP_NOFS);
 563         memset(temp, 0, sizeof(struct mid_q_entry));
 564         temp->mid = le64_to_cpu(shdr->MessageId);
 565         temp->pid = current->pid;
 566         temp->command = shdr->Command; /* Always LE */
 567         temp->when_alloc = jiffies;
 568         temp->server = server;
 569
 570         /*
 571          * The default is for the mid to be synchronous, so the
 572          * default callback just wakes up the current task.
 573          */
 574         temp->callback = cifs_wake_up_task;
 575         temp->callback_data = current;
 576
 577         atomic_inc(&midCount);
 578         temp->mid_state = MID_REQUEST_ALLOCATED;
 579         return temp;
 580 }
 581
 582 static int
 583 smb2_get_mid_entry(struct cifs_ses *ses, struct smb2_sync_hdr *shdr,
 584                    struct mid_q_entry **mid)
 585 {
 586         if (ses->server->tcpStatus == CifsExiting)
 587                 return -ENOENT;
 588
 589         if (ses->server->tcpStatus == CifsNeedReconnect) {
 590                 cifs_dbg(FYI, "tcp session dead - return to caller to retry\n");
 591                 return -EAGAIN;
 592         }
 593
 594         if (ses->status == CifsNew) {
 595                 if ((shdr->Command != SMB2_SESSION_SETUP) &&
 596                     (shdr->Command != SMB2_NEGOTIATE))
 597                         return -EAGAIN;
 598                 /* else ok - we are setting up session */
 599         }
 600
 601         if (ses->status == CifsExiting) {
 602                 if (shdr->Command != SMB2_LOGOFF)
 603                         return -EAGAIN;
 604                 /* else ok - we are shutting down the session */
 605         }
 606
 607         *mid = smb2_mid_entry_alloc(shdr, ses->server);
 608         if (*mid == NULL)
 609                 return -ENOMEM;
 610         spin_lock(&GlobalMid_Lock);
 611         list_add_tail(&(*mid)->qhead, &ses->server->pending_mid_q);
 612         spin_unlock(&GlobalMid_Lock);
 613         return 0;
 614 }
 615
 616 int
 617 smb2_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
 618                    bool log_error)
 619 {
 620         unsigned int len = get_rfc1002_length(mid->resp_buf);
 621         struct kvec iov[2];
 622         struct smb_rqst rqst = { .rq_iov = iov,
 623                                  .rq_nvec = 2 };
 624
 625         iov[0].iov_base = (char *)mid->resp_buf;
 626         iov[0].iov_len = 4;
 627         iov[1].iov_base = (char *)mid->resp_buf + 4;
 628         iov[1].iov_len = len;
 629
 630         dump_smb(mid->resp_buf, min_t(u32, 80, len));
 631         /* convert the length into a more usable form */
 632         if (len > 24 && server->sign && !mid->decrypted) {
 633                 int rc;
 634
 635                 rc = smb2_verify_signature(&rqst, server);
 636                 if (rc)
 637                         cifs_dbg(VFS, "SMB signature verification returned error = %d\n",
 638                                  rc);
 639         }
 640
 641         return map_smb2_to_linux_error(mid->resp_buf, log_error);
 642 }
 643
 644 struct mid_q_entry *
 645 smb2_setup_request(struct cifs_ses *ses, struct smb_rqst *rqst)
 646 {
 647         int rc;
 648         struct smb2_sync_hdr *shdr =
 649                         (struct smb2_sync_hdr *)rqst->rq_iov[1].iov_base;
 650         struct mid_q_entry *mid;
 651
 652         smb2_seq_num_into_buf(ses->server, shdr);
 653
 654         rc = smb2_get_mid_entry(ses, shdr, &mid);
 655         if (rc)
 656                 return ERR_PTR(rc);
 657         rc = smb2_sign_rqst(rqst, ses->server);
 658         if (rc) {
 659                 cifs_delete_mid(mid);
 660                 return ERR_PTR(rc);
 661         }
 662         return mid;
 663 }
 664
 665 struct mid_q_entry *
 666 smb2_setup_async_request(struct TCP_Server_Info *server, struct smb_rqst *rqst)
 667 {
 668         int rc;
 669         struct smb2_sync_hdr *shdr =
 670                         (struct smb2_sync_hdr *)rqst->rq_iov[1].iov_base;
 671         struct mid_q_entry *mid;
 672
 673         smb2_seq_num_into_buf(server, shdr);
 674
 675         mid = smb2_mid_entry_alloc(shdr, server);
 676         if (mid == NULL)
 677                 return ERR_PTR(-ENOMEM);
 678
 679         rc = smb2_sign_rqst(rqst, server);
 680         if (rc) {
 681                 DeleteMidQEntry(mid);
 682                 return ERR_PTR(rc);
 683         }
 684
 685         return mid;
 686 }
 687
 688 int
 689 smb3_crypto_aead_allocate(struct TCP_Server_Info *server)
 690 {
 691         struct crypto_aead *tfm;
 692
 693         if (!server->secmech.ccmaesencrypt) {
 694                 tfm = crypto_alloc_aead("ccm(aes)", 0, 0);
 695                 if (IS_ERR(tfm)) {
 696                         cifs_dbg(VFS, "%s: Failed to alloc encrypt aead\n",
 697                                  __func__);
 698                         return PTR_ERR(tfm);
 699                 }
 700                 server->secmech.ccmaesencrypt = tfm;
 701         }
 702
 703         if (!server->secmech.ccmaesdecrypt) {
 704                 tfm = crypto_alloc_aead("ccm(aes)", 0, 0);
 705                 if (IS_ERR(tfm)) {
 706                         crypto_free_aead(server->secmech.ccmaesencrypt);
 707                         server->secmech.ccmaesencrypt = NULL;
 708                         cifs_dbg(VFS, "%s: Failed to alloc decrypt aead\n",
 709                                  __func__);
 710                         return PTR_ERR(tfm);
 711                 }
 712                 server->secmech.ccmaesdecrypt = tfm;
 713         }
 714
 715         return 0;
 716 }