projects/linux·blob master · refs

1137 lines · 30.9 KiB

1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * Copyright (C) 2016 Namjae Jeon <[email protected]>
4 * Copyright (C) 2018 Samsung Electronics Co., Ltd.
5 */
6
7#include <linux/kernel.h>
8#include <linux/fs.h>
9#include <linux/uaccess.h>
10#include <linux/backing-dev.h>
11#include <linux/writeback.h>
12#include <linux/uio.h>
13#include <linux/xattr.h>
14#include <crypto/aead.h>
15#include <crypto/aes-cbc-macs.h>
16#include <crypto/md5.h>
17#include <crypto/sha2.h>
18#include <crypto/utils.h>
19#include <linux/random.h>
20#include <linux/scatterlist.h>
21
22#include "auth.h"
23#include "glob.h"
24
25#include <linux/fips.h>
26#include <crypto/arc4.h>
27
28#include "server.h"
29#include "smb_common.h"
30#include "connection.h"
31#include "mgmt/user_session.h"
32#include "mgmt/user_config.h"
33#include "crypto_ctx.h"
34#include "transport_ipc.h"
35
36/*
37 * Fixed format data defining GSS header and fixed string
38 * "not_defined_in_RFC4178@please_ignore".
39 * So sec blob data in neg phase could be generated statically.
40 */
41static char NEGOTIATE_GSS_HEADER[AUTH_GSS_LENGTH] = {
42#ifdef CONFIG_SMB_SERVER_KERBEROS5
43 0x60, 0x5e, 0x06, 0x06, 0x2b, 0x06, 0x01, 0x05,
44 0x05, 0x02, 0xa0, 0x54, 0x30, 0x52, 0xa0, 0x24,
45 0x30, 0x22, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
46 0xf7, 0x12, 0x01, 0x02, 0x02, 0x06, 0x09, 0x2a,
47 0x86, 0x48, 0x82, 0xf7, 0x12, 0x01, 0x02, 0x02,
48 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82,
49 0x37, 0x02, 0x02, 0x0a, 0xa3, 0x2a, 0x30, 0x28,
50 0xa0, 0x26, 0x1b, 0x24, 0x6e, 0x6f, 0x74, 0x5f,
51 0x64, 0x65, 0x66, 0x69, 0x6e, 0x65, 0x64, 0x5f,
52 0x69, 0x6e, 0x5f, 0x52, 0x46, 0x43, 0x34, 0x31,
53 0x37, 0x38, 0x40, 0x70, 0x6c, 0x65, 0x61, 0x73,
54 0x65, 0x5f, 0x69, 0x67, 0x6e, 0x6f, 0x72, 0x65
55#else
56 0x60, 0x48, 0x06, 0x06, 0x2b, 0x06, 0x01, 0x05,
57 0x05, 0x02, 0xa0, 0x3e, 0x30, 0x3c, 0xa0, 0x0e,
58 0x30, 0x0c, 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04,
59 0x01, 0x82, 0x37, 0x02, 0x02, 0x0a, 0xa3, 0x2a,
60 0x30, 0x28, 0xa0, 0x26, 0x1b, 0x24, 0x6e, 0x6f,
61 0x74, 0x5f, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x65,
62 0x64, 0x5f, 0x69, 0x6e, 0x5f, 0x52, 0x46, 0x43,
63 0x34, 0x31, 0x37, 0x38, 0x40, 0x70, 0x6c, 0x65,
64 0x61, 0x73, 0x65, 0x5f, 0x69, 0x67, 0x6e, 0x6f,
65 0x72, 0x65
66#endif
67};
68
69void ksmbd_copy_gss_neg_header(void *buf)
70{
71 memcpy(buf, NEGOTIATE_GSS_HEADER, AUTH_GSS_LENGTH);
72}
73
74static int calc_ntlmv2_hash(struct ksmbd_conn *conn, struct ksmbd_session *sess,
75 char *ntlmv2_hash, char *dname)
76{
77 int ret, len, conv_len;
78 wchar_t *domain = NULL;
79 __le16 *uniname = NULL;
80 struct hmac_md5_ctx ctx;
81
82 hmac_md5_init_usingrawkey(&ctx, user_passkey(sess->user),
83 CIFS_ENCPWD_SIZE);
84
85 /* convert user_name to unicode */
86 len = strlen(user_name(sess->user));
87 uniname = kzalloc(2 + UNICODE_LEN(len), KSMBD_DEFAULT_GFP);
88 if (!uniname) {
89 ret = -ENOMEM;
90 goto out;
91 }
92
93 conv_len = smb_strtoUTF16(uniname, user_name(sess->user), len,
94 conn->local_nls);
95 if (conv_len < 0 || conv_len > len) {
96 ret = -EINVAL;
97 goto out;
98 }
99 UniStrupr(uniname);
100
101 hmac_md5_update(&ctx, (const u8 *)uniname, UNICODE_LEN(conv_len));
102
103 /* Convert domain name or conn name to unicode and uppercase */
104 len = strlen(dname);
105 domain = kzalloc(2 + UNICODE_LEN(len), KSMBD_DEFAULT_GFP);
106 if (!domain) {
107 ret = -ENOMEM;
108 goto out;
109 }
110
111 conv_len = smb_strtoUTF16((__le16 *)domain, dname, len,
112 conn->local_nls);
113 if (conv_len < 0 || conv_len > len) {
114 ret = -EINVAL;
115 goto out;
116 }
117
118 hmac_md5_update(&ctx, (const u8 *)domain, UNICODE_LEN(conv_len));
119 hmac_md5_final(&ctx, ntlmv2_hash);
120 ret = 0;
121out:
122 kfree(uniname);
123 kfree(domain);
124 if (ret) /* Done by hmac_md5_final() already if ret == 0 */
125 memzero_explicit(&ctx, sizeof(ctx));
126 return ret;
127}
128
129/**
130 * ksmbd_auth_ntlmv2() - NTLMv2 authentication handler
131 * @conn: connection
132 * @sess: session of connection
133 * @ntlmv2: NTLMv2 challenge response
134 * @blen: NTLMv2 blob length
135 * @domain_name: domain name
136 * @cryptkey: session crypto key
137 * @sess_key: derived session key output buffer
138 *
139 * Return: 0 on success, error number on error
140 */
141int ksmbd_auth_ntlmv2(struct ksmbd_conn *conn, struct ksmbd_session *sess,
142 struct ntlmv2_resp *ntlmv2, int blen, char *domain_name,
143 char *cryptkey, char *sess_key)
144{
145 char ntlmv2_hash[CIFS_ENCPWD_SIZE];
146 char ntlmv2_rsp[CIFS_HMAC_MD5_HASH_SIZE];
147 char base_key[SMB2_NTLMV2_SESSKEY_SIZE];
148 struct hmac_md5_ctx ctx;
149 int rc;
150
151 if (fips_enabled) {
152 ksmbd_debug(AUTH, "NTLMv2 support is disabled due to FIPS\n");
153 return -EOPNOTSUPP;
154 }
155
156 rc = calc_ntlmv2_hash(conn, sess, ntlmv2_hash, domain_name);
157 if (rc) {
158 ksmbd_debug(AUTH, "could not get v2 hash rc %d\n", rc);
159 return rc;
160 }
161
162 hmac_md5_init_usingrawkey(&ctx, ntlmv2_hash, CIFS_HMAC_MD5_HASH_SIZE);
163 hmac_md5_update(&ctx, cryptkey, CIFS_CRYPTO_KEY_SIZE);
164 hmac_md5_update(&ctx, (const u8 *)&ntlmv2->blob_signature, blen);
165 hmac_md5_final(&ctx, ntlmv2_rsp);
166
167 /* Generate the session key */
168 hmac_md5_usingrawkey(ntlmv2_hash, CIFS_HMAC_MD5_HASH_SIZE,
169 ntlmv2_rsp, CIFS_HMAC_MD5_HASH_SIZE,
170 base_key);
171
172 if (crypto_memneq(ntlmv2->ntlmv2_hash, ntlmv2_rsp,
173 CIFS_HMAC_MD5_HASH_SIZE)) {
174 rc = -EINVAL;
175 goto out;
176 }
177
178 memcpy(sess_key, base_key, sizeof(base_key));
179 rc = 0;
180out:
181 memzero_explicit(ntlmv2_hash, sizeof(ntlmv2_hash));
182 memzero_explicit(ntlmv2_rsp, sizeof(ntlmv2_rsp));
183 memzero_explicit(base_key, sizeof(base_key));
184 return rc;
185}
186
187/**
188 * ksmbd_decode_ntlmssp_auth_blob() - helper function to construct
189 * authenticate blob
190 * @authblob: authenticate blob source pointer
191 * @blob_len: length of the @authblob message
192 * @conn: connection
193 * @sess: session of connection
194 * @sess_key: derived session key output buffer
195 *
196 * Return: 0 on success, error number on error
197 */
198int ksmbd_decode_ntlmssp_auth_blob(struct authenticate_message *authblob,
199 int blob_len, struct ksmbd_conn *conn,
200 struct ksmbd_session *sess, char *sess_key)
201{
202 char *domain_name;
203 unsigned int nt_off, dn_off;
204 unsigned short nt_len, dn_len;
205 int ret;
206
207 if (blob_len < sizeof(struct authenticate_message)) {
208 ksmbd_debug(AUTH, "negotiate blob len %d too small\n",
209 blob_len);
210 return -EINVAL;
211 }
212
213 if (memcmp(authblob->Signature, "NTLMSSP", 8)) {
214 ksmbd_debug(AUTH, "blob signature incorrect %s\n",
215 authblob->Signature);
216 return -EINVAL;
217 }
218
219 nt_off = le32_to_cpu(authblob->NtChallengeResponse.BufferOffset);
220 nt_len = le16_to_cpu(authblob->NtChallengeResponse.Length);
221 dn_off = le32_to_cpu(authblob->DomainName.BufferOffset);
222 dn_len = le16_to_cpu(authblob->DomainName.Length);
223
224 if (blob_len < (u64)dn_off + dn_len || blob_len < (u64)nt_off + nt_len ||
225 nt_len < CIFS_ENCPWD_SIZE)
226 return -EINVAL;
227
228 /* TODO : use domain name that imported from configuration file */
229 domain_name = smb_strndup_from_utf16((const char *)authblob + dn_off,
230 dn_len, true, conn->local_nls);
231 if (IS_ERR(domain_name))
232 return PTR_ERR(domain_name);
233
234 /* process NTLMv2 authentication */
235 ksmbd_debug(AUTH, "decode_ntlmssp_authenticate_blob dname%s\n",
236 domain_name);
237 ret = ksmbd_auth_ntlmv2(conn, sess,
238 (struct ntlmv2_resp *)((char *)authblob + nt_off),
239 nt_len - CIFS_ENCPWD_SIZE,
240 domain_name, conn->ntlmssp.cryptkey, sess_key);
241 kfree(domain_name);
242 if (ret)
243 return ret;
244
245 /* The recovered secondary session key */
246 if (conn->ntlmssp.client_flags & NTLMSSP_NEGOTIATE_KEY_XCH) {
247 struct arc4_ctx *ctx_arc4;
248 unsigned int sess_key_off, sess_key_len;
249
250 sess_key_off = le32_to_cpu(authblob->SessionKey.BufferOffset);
251 sess_key_len = le16_to_cpu(authblob->SessionKey.Length);
252
253 if (blob_len < (u64)sess_key_off + sess_key_len)
254 return -EINVAL;
255
256 if (sess_key_len > CIFS_KEY_SIZE)
257 return -EINVAL;
258
259 ctx_arc4 = kmalloc_obj(*ctx_arc4, KSMBD_DEFAULT_GFP);
260 if (!ctx_arc4)
261 return -ENOMEM;
262
263 arc4_setkey(ctx_arc4, sess_key, SMB2_NTLMV2_SESSKEY_SIZE);
264 arc4_crypt(ctx_arc4, sess_key,
265 (char *)authblob + sess_key_off, sess_key_len);
266 kfree_sensitive(ctx_arc4);
267 }
268
269 return ret;
270}
271
272/**
273 * ksmbd_decode_ntlmssp_neg_blob() - helper function to construct
274 * negotiate blob
275 * @negblob: negotiate blob source pointer
276 * @blob_len: length of the @authblob message
277 * @conn: connection
278 *
279 */
280int ksmbd_decode_ntlmssp_neg_blob(struct negotiate_message *negblob,
281 int blob_len, struct ksmbd_conn *conn)
282{
283 if (blob_len < sizeof(struct negotiate_message)) {
284 ksmbd_debug(AUTH, "negotiate blob len %d too small\n",
285 blob_len);
286 return -EINVAL;
287 }
288
289 if (memcmp(negblob->Signature, "NTLMSSP", 8)) {
290 ksmbd_debug(AUTH, "blob signature incorrect %s\n",
291 negblob->Signature);
292 return -EINVAL;
293 }
294
295 conn->ntlmssp.client_flags = le32_to_cpu(negblob->NegotiateFlags);
296 return 0;
297}
298
299/**
300 * ksmbd_build_ntlmssp_challenge_blob() - helper function to construct
301 * challenge blob
302 * @chgblob: challenge blob source pointer to initialize
303 * @conn: connection
304 *
305 */
306unsigned int
307ksmbd_build_ntlmssp_challenge_blob(struct challenge_message *chgblob,
308 struct ksmbd_conn *conn)
309{
310 struct target_info *tinfo;
311 wchar_t *name;
312 __u8 *target_name;
313 unsigned int flags, blob_off, blob_len, type, target_info_len = 0;
314 int len, uni_len, conv_len;
315 int cflags = conn->ntlmssp.client_flags;
316
317 memcpy(chgblob->Signature, NTLMSSP_SIGNATURE, 8);
318 chgblob->MessageType = NtLmChallenge;
319
320 flags = NTLMSSP_NEGOTIATE_UNICODE |
321 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_TARGET_TYPE_SERVER |
322 NTLMSSP_NEGOTIATE_TARGET_INFO;
323
324 if (cflags & NTLMSSP_NEGOTIATE_SIGN) {
325 flags |= NTLMSSP_NEGOTIATE_SIGN;
326 flags |= cflags & (NTLMSSP_NEGOTIATE_128 |
327 NTLMSSP_NEGOTIATE_56);
328 }
329
330 if (cflags & NTLMSSP_NEGOTIATE_SEAL && smb3_encryption_negotiated(conn))
331 flags |= NTLMSSP_NEGOTIATE_SEAL;
332
333 if (cflags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN)
334 flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
335
336 if (cflags & NTLMSSP_REQUEST_TARGET)
337 flags |= NTLMSSP_REQUEST_TARGET;
338
339 if (conn->use_spnego &&
340 (cflags & NTLMSSP_NEGOTIATE_EXTENDED_SEC))
341 flags |= NTLMSSP_NEGOTIATE_EXTENDED_SEC;
342
343 if (cflags & NTLMSSP_NEGOTIATE_KEY_XCH)
344 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
345
346 chgblob->NegotiateFlags = cpu_to_le32(flags);
347 len = strlen(ksmbd_netbios_name());
348 name = kmalloc(2 + UNICODE_LEN(len), KSMBD_DEFAULT_GFP);
349 if (!name)
350 return -ENOMEM;
351
352 conv_len = smb_strtoUTF16((__le16 *)name, ksmbd_netbios_name(), len,
353 conn->local_nls);
354 if (conv_len < 0 || conv_len > len) {
355 kfree(name);
356 return -EINVAL;
357 }
358
359 uni_len = UNICODE_LEN(conv_len);
360
361 blob_off = sizeof(struct challenge_message);
362 blob_len = blob_off + uni_len;
363
364 chgblob->TargetName.Length = cpu_to_le16(uni_len);
365 chgblob->TargetName.MaximumLength = cpu_to_le16(uni_len);
366 chgblob->TargetName.BufferOffset = cpu_to_le32(blob_off);
367
368 /* Initialize random conn challenge */
369 get_random_bytes(conn->ntlmssp.cryptkey, sizeof(__u64));
370 memcpy(chgblob->Challenge, conn->ntlmssp.cryptkey,
371 CIFS_CRYPTO_KEY_SIZE);
372
373 /* Add Target Information to security buffer */
374 chgblob->TargetInfoArray.BufferOffset = cpu_to_le32(blob_len);
375
376 target_name = (__u8 *)chgblob + blob_off;
377 memcpy(target_name, name, uni_len);
378 tinfo = (struct target_info *)(target_name + uni_len);
379
380 chgblob->TargetInfoArray.Length = 0;
381 /* Add target info list for NetBIOS/DNS settings */
382 for (type = NTLMSSP_AV_NB_COMPUTER_NAME;
383 type <= NTLMSSP_AV_DNS_DOMAIN_NAME; type++) {
384 tinfo->Type = cpu_to_le16(type);
385 tinfo->Length = cpu_to_le16(uni_len);
386 memcpy(tinfo->Content, name, uni_len);
387 tinfo = (struct target_info *)((char *)tinfo + 4 + uni_len);
388 target_info_len += 4 + uni_len;
389 }
390
391 /* Add terminator subblock */
392 tinfo->Type = 0;
393 tinfo->Length = 0;
394 target_info_len += 4;
395
396 chgblob->TargetInfoArray.Length = cpu_to_le16(target_info_len);
397 chgblob->TargetInfoArray.MaximumLength = cpu_to_le16(target_info_len);
398 blob_len += target_info_len;
399 kfree(name);
400 ksmbd_debug(AUTH, "NTLMSSP SecurityBufferLength %d\n", blob_len);
401 return blob_len;
402}
403
404#ifdef CONFIG_SMB_SERVER_KERBEROS5
405int ksmbd_krb5_authenticate(struct ksmbd_session *sess, char *in_blob,
406 int in_len, char *out_blob, int *out_len,
407 char *sess_key)
408{
409 struct ksmbd_spnego_authen_response *resp;
410 struct ksmbd_login_response_ext *resp_ext = NULL;
411 struct ksmbd_user *user = NULL;
412 int retval;
413
414 resp = ksmbd_ipc_spnego_authen_request(in_blob, in_len);
415 if (!resp) {
416 ksmbd_debug(AUTH, "SPNEGO_AUTHEN_REQUEST failure\n");
417 return -EINVAL;
418 }
419
420 if (!(resp->login_response.status & KSMBD_USER_FLAG_OK)) {
421 ksmbd_debug(AUTH, "krb5 authentication failure\n");
422 retval = -EPERM;
423 goto out;
424 }
425
426 if (*out_len <= resp->spnego_blob_len) {
427 ksmbd_debug(AUTH, "buf len %d, but blob len %d\n",
428 *out_len, resp->spnego_blob_len);
429 retval = -EINVAL;
430 goto out;
431 }
432
433 if (resp->session_key_len > sizeof(sess->sess_key)) {
434 ksmbd_debug(AUTH, "session key is too long\n");
435 retval = -EINVAL;
436 goto out;
437 }
438
439 if (resp->login_response.status & KSMBD_USER_FLAG_EXTENSION)
440 resp_ext = ksmbd_ipc_login_request_ext(resp->login_response.account);
441
442 user = ksmbd_alloc_user(&resp->login_response, resp_ext);
443 kvfree(resp_ext);
444 if (!user) {
445 ksmbd_debug(AUTH, "login failure\n");
446 retval = -ENOMEM;
447 goto out;
448 }
449
450 if (!sess->user) {
451 /* First successful authentication */
452 sess->user = user;
453 } else {
454 if (!ksmbd_compare_user(sess->user, user)) {
455 ksmbd_debug(AUTH, "different user tried to reuse session\n");
456 retval = -EKEYREJECTED;
457 ksmbd_free_user(user);
458 goto out;
459 }
460 ksmbd_free_user(user);
461 }
462
463 memcpy(sess_key, resp->payload, resp->session_key_len);
464 memcpy(out_blob, resp->payload + resp->session_key_len,
465 resp->spnego_blob_len);
466 *out_len = resp->spnego_blob_len;
467 sess->kerberos_expiry = resp->session_expiry;
468 retval = 0;
469out:
470 kvfree_sensitive(resp, sizeof(*resp) + resp->session_key_len +
471 resp->spnego_blob_len);
472 return retval;
473}
474#else
475int ksmbd_krb5_authenticate(struct ksmbd_session *sess, char *in_blob,
476 int in_len, char *out_blob, int *out_len,
477 char *sess_key)
478{
479 return -EOPNOTSUPP;
480}
481#endif
482
483/**
484 * ksmbd_sign_smb2_pdu() - function to generate packet signing
485 * @conn: connection
486 * @key: signing key
487 * @iov: buffer iov array
488 * @n_vec: number of iovecs
489 * @sig: signature value generated for client request packet
490 *
491 */
492void ksmbd_sign_smb2_pdu(struct ksmbd_conn *conn, char *key, struct kvec *iov,
493 int n_vec, char *sig)
494{
495 struct hmac_sha256_ctx ctx;
496 int i;
497
498 hmac_sha256_init_usingrawkey(&ctx, key, SMB2_NTLMV2_SESSKEY_SIZE);
499 for (i = 0; i < n_vec; i++)
500 hmac_sha256_update(&ctx, iov[i].iov_base, iov[i].iov_len);
501 hmac_sha256_final(&ctx, sig);
502}
503
504/**
505 * ksmbd_sign_smb3_pdu() - function to generate packet signing
506 * @conn: connection
507 * @key: signing key
508 * @iov: buffer iov array
509 * @n_vec: number of iovecs
510 * @sig: signature value generated for client request packet
511 *
512 */
513void ksmbd_sign_smb3_pdu(struct ksmbd_conn *conn, char *key, struct kvec *iov,
514 int n_vec, char *sig)
515{
516 struct aes_cmac_key cmac_key __cleanup(aes_cmac_zeroize_key);
517 struct aes_cmac_ctx cmac_ctx;
518 int i;
519
520 /* This cannot fail, since we always pass a valid key length. */
521 static_assert(SMB2_CMACAES_SIZE == AES_KEYSIZE_128);
522 aes_cmac_preparekey(&cmac_key, key, SMB2_CMACAES_SIZE);
523
524 aes_cmac_init(&cmac_ctx, &cmac_key);
525 for (i = 0; i < n_vec; i++)
526 aes_cmac_update(&cmac_ctx, iov[i].iov_base, iov[i].iov_len);
527 aes_cmac_final(&cmac_ctx, sig);
528}
529
530struct derivation {
531 struct kvec label;
532 struct kvec context;
533 bool binding;
534};
535
536static void generate_key(struct ksmbd_conn *conn, const char *sess_key,
537 struct kvec label, struct kvec context, __u8 *key,
538 unsigned int key_size)
539{
540 unsigned char zero = 0x0;
541 __u8 i[4] = {0, 0, 0, 1};
542 __u8 L128[4] = {0, 0, 0, 128};
543 __u8 L256[4] = {0, 0, 1, 0};
544 unsigned char prfhash[SMB2_HMACSHA256_SIZE];
545 struct hmac_sha256_ctx ctx;
546
547 hmac_sha256_init_usingrawkey(&ctx, sess_key,
548 SMB2_NTLMV2_SESSKEY_SIZE);
549 hmac_sha256_update(&ctx, i, 4);
550 hmac_sha256_update(&ctx, label.iov_base, label.iov_len);
551 hmac_sha256_update(&ctx, &zero, 1);
552 hmac_sha256_update(&ctx, context.iov_base, context.iov_len);
553
554 if (key_size == SMB3_ENC_DEC_KEY_SIZE &&
555 (conn->cipher_type == SMB2_ENCRYPTION_AES256_CCM ||
556 conn->cipher_type == SMB2_ENCRYPTION_AES256_GCM))
557 hmac_sha256_update(&ctx, L256, 4);
558 else
559 hmac_sha256_update(&ctx, L128, 4);
560
561 hmac_sha256_final(&ctx, prfhash);
562 memcpy(key, prfhash, key_size);
563 memzero_explicit(prfhash, sizeof(prfhash));
564}
565
566static int generate_smb3signingkey(struct ksmbd_session *sess,
567 struct ksmbd_conn *conn,
568 const struct derivation *signing)
569{
570 struct channel *chann;
571 char *key, *sess_key;
572
573 chann = lookup_chann_list(sess, conn);
574 if (!chann)
575 return 0;
576
577 if (conn->dialect >= SMB30_PROT_ID && signing->binding) {
578 key = chann->smb3signingkey;
579 sess_key = chann->sess_key;
580 } else {
581 key = sess->smb3signingkey;
582 sess_key = sess->sess_key;
583 }
584
585 generate_key(conn, sess_key, signing->label, signing->context, key,
586 SMB3_SIGN_KEY_SIZE);
587
588 if (!(conn->dialect >= SMB30_PROT_ID && signing->binding))
589 memcpy(chann->smb3signingkey, key, SMB3_SIGN_KEY_SIZE);
590
591 ksmbd_debug(AUTH, "generated SMB3 signing key\n");
592 ksmbd_debug(AUTH, "Session Id %llu\n", sess->id);
593 return 0;
594}
595
596int ksmbd_gen_smb30_signingkey(struct ksmbd_session *sess,
597 struct ksmbd_conn *conn)
598{
599 struct derivation d;
600
601 d.label.iov_base = "SMB2AESCMAC";
602 d.label.iov_len = 12;
603 d.context.iov_base = "SmbSign";
604 d.context.iov_len = 8;
605 d.binding = conn->binding;
606
607 return generate_smb3signingkey(sess, conn, &d);
608}
609
610int ksmbd_gen_smb311_signingkey(struct ksmbd_session *sess,
611 struct ksmbd_conn *conn)
612{
613 struct derivation d;
614
615 d.label.iov_base = "SMBSigningKey";
616 d.label.iov_len = 14;
617 if (conn->binding) {
618 struct preauth_session *preauth_sess;
619
620 preauth_sess = ksmbd_preauth_session_lookup(conn, sess->id);
621 if (!preauth_sess)
622 return -ENOENT;
623 d.context.iov_base = preauth_sess->Preauth_HashValue;
624 } else {
625 d.context.iov_base = sess->Preauth_HashValue;
626 }
627 d.context.iov_len = 64;
628 d.binding = conn->binding;
629
630 return generate_smb3signingkey(sess, conn, &d);
631}
632
633struct derivation_twin {
634 struct derivation encryption;
635 struct derivation decryption;
636};
637
638static void generate_smb3encryptionkey(struct ksmbd_conn *conn,
639 struct ksmbd_session *sess,
640 const struct derivation_twin *ptwin)
641{
642 generate_key(conn, sess->sess_key, ptwin->encryption.label,
643 ptwin->encryption.context, sess->smb3encryptionkey,
644 SMB3_ENC_DEC_KEY_SIZE);
645
646 generate_key(conn, sess->sess_key, ptwin->decryption.label,
647 ptwin->decryption.context,
648 sess->smb3decryptionkey, SMB3_ENC_DEC_KEY_SIZE);
649
650 ksmbd_debug(AUTH, "generated SMB3 encryption/decryption keys\n");
651 ksmbd_debug(AUTH, "Cipher type %d\n", conn->cipher_type);
652 ksmbd_debug(AUTH, "Session Id %llu\n", sess->id);
653}
654
655void ksmbd_gen_smb30_encryptionkey(struct ksmbd_conn *conn,
656 struct ksmbd_session *sess)
657{
658 struct derivation_twin twin;
659 struct derivation *d;
660
661 d = &twin.encryption;
662 d->label.iov_base = "SMB2AESCCM";
663 d->label.iov_len = 11;
664 d->context.iov_base = "ServerOut";
665 d->context.iov_len = 10;
666
667 d = &twin.decryption;
668 d->label.iov_base = "SMB2AESCCM";
669 d->label.iov_len = 11;
670 d->context.iov_base = "ServerIn ";
671 d->context.iov_len = 10;
672
673 generate_smb3encryptionkey(conn, sess, &twin);
674}
675
676void ksmbd_gen_smb311_encryptionkey(struct ksmbd_conn *conn,
677 struct ksmbd_session *sess)
678{
679 struct derivation_twin twin;
680 struct derivation *d;
681
682 d = &twin.encryption;
683 d->label.iov_base = "SMBS2CCipherKey";
684 d->label.iov_len = 16;
685 d->context.iov_base = sess->Preauth_HashValue;
686 d->context.iov_len = 64;
687
688 d = &twin.decryption;
689 d->label.iov_base = "SMBC2SCipherKey";
690 d->label.iov_len = 16;
691 d->context.iov_base = sess->Preauth_HashValue;
692 d->context.iov_len = 64;
693
694 generate_smb3encryptionkey(conn, sess, &twin);
695}
696
697int ksmbd_gen_preauth_integrity_hash(struct ksmbd_conn *conn, char *buf,
698 __u8 *pi_hash)
699{
700 struct smb2_hdr *rcv_hdr = smb_get_msg(buf);
701 char *all_bytes_msg = (char *)&rcv_hdr->ProtocolId;
702 int msg_size = get_rfc1002_len(buf);
703 struct sha512_ctx sha_ctx;
704
705 if (conn->preauth_info->Preauth_HashId !=
706 SMB2_PREAUTH_INTEGRITY_SHA512)
707 return -EINVAL;
708
709 sha512_init(&sha_ctx);
710 sha512_update(&sha_ctx, pi_hash, 64);
711 sha512_update(&sha_ctx, all_bytes_msg, msg_size);
712 sha512_final(&sha_ctx, pi_hash);
713 return 0;
714}
715
716static int ksmbd_get_encryption_key(struct ksmbd_work *work, __u64 ses_id,
717 int enc, u8 *key)
718{
719 struct ksmbd_session *sess;
720 u8 *ses_enc_key;
721
722 if (enc)
723 sess = work->sess;
724 else {
725 /*
726 * A previous-session replacement leaves the old encryption key in
727 * place. Use it to authenticate an encrypted request, then let
728 * session validation reject the expired session. This preserves the
729 * encrypted STATUS_USER_SESSION_DELETED response without reviving
730 * the session.
731 */
732 sess = ksmbd_session_lookup_all_states(work->conn, ses_id);
733 if (sess && sess->state != SMB2_SESSION_VALID &&
734 (sess->state != SMB2_SESSION_EXPIRED || !sess->enc)) {
735 ksmbd_user_session_put(sess);
736 sess = NULL;
737 }
738 }
739 if (!sess)
740 return -EINVAL;
741
742 ses_enc_key = enc ? sess->smb3encryptionkey :
743 sess->smb3decryptionkey;
744 memcpy(key, ses_enc_key, SMB3_ENC_DEC_KEY_SIZE);
745 if (!enc)
746 ksmbd_user_session_put(sess);
747
748 return 0;
749}
750
751static inline void smb2_sg_set_buf(struct scatterlist *sg, const void *buf,
752 unsigned int buflen)
753{
754 void *addr;
755
756 if (is_vmalloc_addr(buf))
757 addr = vmalloc_to_page(buf);
758 else
759 addr = virt_to_page(buf);
760 sg_set_page(sg, addr, buflen, offset_in_page(buf));
761}
762
763static struct scatterlist *ksmbd_init_sg(struct kvec *iov, unsigned int nvec,
764 u8 *sign)
765{
766 struct scatterlist *sg;
767 unsigned int assoc_data_len = sizeof(struct smb2_transform_hdr) - 20;
768 int i, *nr_entries, total_entries = 0, sg_idx = 0;
769
770 if (!nvec)
771 return NULL;
772
773 nr_entries = kzalloc_objs(int, nvec, KSMBD_DEFAULT_GFP);
774 if (!nr_entries)
775 return NULL;
776
777 for (i = 0; i < nvec - 1; i++) {
778 unsigned long kaddr = (unsigned long)iov[i + 1].iov_base;
779
780 if (is_vmalloc_addr(iov[i + 1].iov_base)) {
781 nr_entries[i] = ((kaddr + iov[i + 1].iov_len +
782 PAGE_SIZE - 1) >> PAGE_SHIFT) -
783 (kaddr >> PAGE_SHIFT);
784 } else {
785 nr_entries[i]++;
786 }
787 total_entries += nr_entries[i];
788 }
789
790 /* Add two entries for transform header and signature */
791 total_entries += 2;
792
793 sg = kmalloc_objs(struct scatterlist, total_entries, KSMBD_DEFAULT_GFP);
794 if (!sg) {
795 kfree(nr_entries);
796 return NULL;
797 }
798
799 sg_init_table(sg, total_entries);
800 smb2_sg_set_buf(&sg[sg_idx++], iov[0].iov_base + 24, assoc_data_len);
801 for (i = 0; i < nvec - 1; i++) {
802 void *data = iov[i + 1].iov_base;
803 int len = iov[i + 1].iov_len;
804
805 if (is_vmalloc_addr(data)) {
806 int j, offset = offset_in_page(data);
807
808 for (j = 0; j < nr_entries[i]; j++) {
809 unsigned int bytes = PAGE_SIZE - offset;
810
811 if (!len)
812 break;
813
814 if (bytes > len)
815 bytes = len;
816
817 sg_set_page(&sg[sg_idx++],
818 vmalloc_to_page(data), bytes,
819 offset_in_page(data));
820
821 data += bytes;
822 len -= bytes;
823 offset = 0;
824 }
825 } else {
826 sg_set_page(&sg[sg_idx++], virt_to_page(data), len,
827 offset_in_page(data));
828 }
829 }
830 smb2_sg_set_buf(&sg[sg_idx], sign, SMB2_SIGNATURE_SIZE);
831 kfree(nr_entries);
832 return sg;
833}
834
835/**
836 * ksmbd_init_rdma_sg() - build an AEAD scatterlist for an RDMA payload
837 * @buf: payload buffer
838 * @buflen: payload length
839 * @tag: authentication tag buffer
840 * @taglen: authentication tag length
841 *
842 * Split vmalloc-backed payloads at page boundaries and append the detached
843 * authentication tag as the final scatterlist entry.
844 *
845 * Return: allocated scatterlist, or NULL on allocation failure
846 */
847static struct scatterlist *ksmbd_init_rdma_sg(void *buf,
848 unsigned int buflen,
849 u8 *tag,
850 unsigned int taglen)
851{
852 struct scatterlist *sg;
853 unsigned int nr_data = 1, nr_entries, i = 0;
854 void *data = buf;
855 int len = buflen;
856
857 if (is_vmalloc_addr(buf))
858 nr_data = DIV_ROUND_UP(offset_in_page(buf) + buflen, PAGE_SIZE);
859 nr_entries = nr_data + 1;
860
861 sg = kmalloc_objs(struct scatterlist, nr_entries, KSMBD_DEFAULT_GFP);
862 if (!sg)
863 return NULL;
864
865 sg_init_table(sg, nr_entries);
866 if (!is_vmalloc_addr(buf)) {
867 smb2_sg_set_buf(&sg[i++], buf, buflen);
868 } else {
869 while (len) {
870 unsigned int bytes = min_t(unsigned int,
871 PAGE_SIZE - offset_in_page(data), len);
872
873 sg_set_page(&sg[i++], vmalloc_to_page(data), bytes,
874 offset_in_page(data));
875 data += bytes;
876 len -= bytes;
877 }
878 }
879 smb2_sg_set_buf(&sg[i], tag, taglen);
880 return sg;
881}
882
883/**
884 * ksmbd_crypt_rdma() - encrypt or decrypt an SMB Direct data buffer
885 * @conn: connection containing the negotiated cipher
886 * @key: session encryption or decryption key
887 * @buf: RDMA payload, transformed in place
888 * @buflen: payload length (the authentication tag is carried out of band)
889 * @nonce: transform nonce
890 * @nonce_len: nonce length
891 * @tag: authentication tag output for encryption, input for decryption
892 * @tag_len: authentication tag length
893 * @enc: true to encrypt, false to decrypt
894 *
895 * SMB2_RDMA_CRYPTO_TRANSFORM carries the nonce and authentication tag in the
896 * SMB2 message while only the payload is transferred through RDMA. Therefore
897 * this uses AEAD without the normal SMB3 transform header as associated data.
898 *
899 * Return: 0 on success, otherwise a negative errno
900 */
901int ksmbd_crypt_rdma(struct ksmbd_conn *conn, const u8 *key,
902 void *buf, unsigned int buflen, const u8 *nonce,
903 unsigned int nonce_len, u8 *tag, unsigned int tag_len,
904 bool enc)
905{
906 struct ksmbd_crypto_ctx *ctx;
907 struct crypto_aead *tfm;
908 struct aead_request *req = NULL;
909 struct scatterlist *sg = NULL;
910 unsigned int iv_len, crypt_len;
911 u8 auth_tag[SMB2_SIGNATURE_SIZE] = {};
912 u8 *iv = NULL;
913 u16 cipher = le16_to_cpu(conn->cipher_type);
914 int rc;
915 DECLARE_CRYPTO_WAIT(wait);
916
917 if (!buflen || !tag_len || tag_len > SMB2_SIGNATURE_SIZE) {
918 pr_err("RDMA %s rejected: cipher=0x%04x payload=%u nonce=%u tag=%u\n",
919 enc ? "encryption" : "decryption", cipher, buflen,
920 nonce_len, tag_len);
921 return -EINVAL;
922 }
923 if (!enc)
924 memcpy(auth_tag, tag, tag_len);
925
926 if (conn->cipher_type == SMB2_ENCRYPTION_AES128_GCM ||
927 conn->cipher_type == SMB2_ENCRYPTION_AES256_GCM) {
928 if (nonce_len != SMB3_AES_GCM_NONCE) {
929 pr_err("RDMA %s rejected: cipher=0x%04x invalid nonce=%u expected=%u\n",
930 enc ? "encryption" : "decryption", cipher,
931 nonce_len, SMB3_AES_GCM_NONCE);
932 return -EINVAL;
933 }
934 ctx = ksmbd_crypto_ctx_find_gcm();
935 } else {
936 if (nonce_len != SMB3_AES_CCM_NONCE) {
937 pr_err("RDMA %s rejected: cipher=0x%04x invalid nonce=%u expected=%u\n",
938 enc ? "encryption" : "decryption", cipher,
939 nonce_len, SMB3_AES_CCM_NONCE);
940 return -EINVAL;
941 }
942 ctx = ksmbd_crypto_ctx_find_ccm();
943 }
944 if (!ctx) {
945 pr_err("RDMA %s failed: cipher=0x%04x crypto context unavailable\n",
946 enc ? "encryption" : "decryption", cipher);
947 return -ENOMEM;
948 }
949
950 tfm = (conn->cipher_type == SMB2_ENCRYPTION_AES128_GCM ||
951 conn->cipher_type == SMB2_ENCRYPTION_AES256_GCM) ?
952 CRYPTO_GCM(ctx) : CRYPTO_CCM(ctx);
953 if (conn->cipher_type == SMB2_ENCRYPTION_AES256_CCM ||
954 conn->cipher_type == SMB2_ENCRYPTION_AES256_GCM)
955 rc = crypto_aead_setkey(tfm, key, SMB3_GCM256_CRYPTKEY_SIZE);
956 else
957 rc = crypto_aead_setkey(tfm, key, SMB3_GCM128_CRYPTKEY_SIZE);
958 if (rc)
959 goto out;
960
961 rc = crypto_aead_setauthsize(tfm, tag_len);
962 if (rc)
963 goto out;
964
965 req = aead_request_alloc(tfm, KSMBD_DEFAULT_GFP);
966 if (!req) {
967 rc = -ENOMEM;
968 goto out;
969 }
970
971 sg = ksmbd_init_rdma_sg(buf, buflen, auth_tag, tag_len);
972 if (!sg) {
973 rc = -ENOMEM;
974 goto out;
975 }
976
977 iv_len = crypto_aead_ivsize(tfm);
978 iv = kzalloc(iv_len, KSMBD_DEFAULT_GFP);
979 if (!iv) {
980 rc = -ENOMEM;
981 goto out;
982 }
983 if (conn->cipher_type == SMB2_ENCRYPTION_AES128_GCM ||
984 conn->cipher_type == SMB2_ENCRYPTION_AES256_GCM) {
985 memcpy(iv, nonce, nonce_len);
986 } else {
987 iv[0] = 3;
988 memcpy(iv + 1, nonce, nonce_len);
989 }
990
991 crypt_len = buflen + (enc ? 0 : tag_len);
992 aead_request_set_crypt(req, sg, sg, crypt_len, iv);
993 aead_request_set_ad(req, 0);
994 aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
995 CRYPTO_TFM_REQ_MAY_SLEEP,
996 crypto_req_done, &wait);
997 rc = crypto_wait_req(enc ? crypto_aead_encrypt(req) :
998 crypto_aead_decrypt(req), &wait);
999 if (!rc && enc)
1000 memcpy(tag, auth_tag, tag_len);
1001out:
1002 kfree(iv);
1003 kfree(sg);
1004 aead_request_free(req);
1005 ksmbd_release_crypto_ctx(ctx);
1006 if (rc)
1007 pr_err("RDMA %s failed: cipher=0x%04x payload=%u nonce=%u tag=%u rc=%d\n",
1008 enc ? "encryption" : "decryption", cipher, buflen,
1009 nonce_len, tag_len, rc);
1010 else
1011 ksmbd_debug(RDMA,
1012 "RDMA %s completed: cipher=0x%04x payload=%u nonce=%u tag=%u\n",
1013 enc ? "encryption" : "decryption", cipher, buflen,
1014 nonce_len, tag_len);
1015 return rc;
1016}
1017
1018int ksmbd_crypt_message(struct ksmbd_work *work, struct kvec *iov,
1019 unsigned int nvec, int enc)
1020{
1021 struct ksmbd_conn *conn = work->conn;
1022 struct smb2_transform_hdr *tr_hdr = smb_get_msg(iov[0].iov_base);
1023 unsigned int assoc_data_len = sizeof(struct smb2_transform_hdr) - 20;
1024 int rc;
1025 DECLARE_CRYPTO_WAIT(wait);
1026 struct scatterlist *sg;
1027 u8 sign[SMB2_SIGNATURE_SIZE] = {};
1028 u8 key[SMB3_ENC_DEC_KEY_SIZE];
1029 struct aead_request *req;
1030 char *iv;
1031 unsigned int iv_len;
1032 struct crypto_aead *tfm;
1033 unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize);
1034 struct ksmbd_crypto_ctx *ctx;
1035
1036 rc = ksmbd_get_encryption_key(work,
1037 le64_to_cpu(tr_hdr->SessionId),
1038 enc,
1039 key);
1040 if (rc) {
1041 pr_err("Could not get %scryption key\n", enc ? "en" : "de");
1042 return rc;
1043 }
1044
1045 if (conn->cipher_type == SMB2_ENCRYPTION_AES128_GCM ||
1046 conn->cipher_type == SMB2_ENCRYPTION_AES256_GCM)
1047 ctx = ksmbd_crypto_ctx_find_gcm();
1048 else
1049 ctx = ksmbd_crypto_ctx_find_ccm();
1050 if (!ctx) {
1051 pr_err("crypto alloc failed\n");
1052 rc = -ENOMEM;
1053 goto zeroize_key;
1054 }
1055
1056 if (conn->cipher_type == SMB2_ENCRYPTION_AES128_GCM ||
1057 conn->cipher_type == SMB2_ENCRYPTION_AES256_GCM)
1058 tfm = CRYPTO_GCM(ctx);
1059 else
1060 tfm = CRYPTO_CCM(ctx);
1061
1062 if (conn->cipher_type == SMB2_ENCRYPTION_AES256_CCM ||
1063 conn->cipher_type == SMB2_ENCRYPTION_AES256_GCM)
1064 rc = crypto_aead_setkey(tfm, key, SMB3_GCM256_CRYPTKEY_SIZE);
1065 else
1066 rc = crypto_aead_setkey(tfm, key, SMB3_GCM128_CRYPTKEY_SIZE);
1067 if (rc) {
1068 pr_err("Failed to set aead key %d\n", rc);
1069 goto free_ctx;
1070 }
1071
1072 rc = crypto_aead_setauthsize(tfm, SMB2_SIGNATURE_SIZE);
1073 if (rc) {
1074 pr_err("Failed to set authsize %d\n", rc);
1075 goto free_ctx;
1076 }
1077
1078 req = aead_request_alloc(tfm, KSMBD_DEFAULT_GFP);
1079 if (!req) {
1080 rc = -ENOMEM;
1081 goto free_ctx;
1082 }
1083
1084 if (!enc) {
1085 memcpy(sign, &tr_hdr->Signature, SMB2_SIGNATURE_SIZE);
1086 crypt_len += SMB2_SIGNATURE_SIZE;
1087 }
1088
1089 sg = ksmbd_init_sg(iov, nvec, sign);
1090 if (!sg) {
1091 pr_err("Failed to init sg\n");
1092 rc = -ENOMEM;
1093 goto free_req;
1094 }
1095
1096 iv_len = crypto_aead_ivsize(tfm);
1097 iv = kzalloc(iv_len, KSMBD_DEFAULT_GFP);
1098 if (!iv) {
1099 rc = -ENOMEM;
1100 goto free_sg;
1101 }
1102
1103 if (conn->cipher_type == SMB2_ENCRYPTION_AES128_GCM ||
1104 conn->cipher_type == SMB2_ENCRYPTION_AES256_GCM) {
1105 memcpy(iv, (char *)tr_hdr->Nonce, SMB3_AES_GCM_NONCE);
1106 } else {
1107 iv[0] = 3;
1108 memcpy(iv + 1, (char *)tr_hdr->Nonce, SMB3_AES_CCM_NONCE);
1109 }
1110
1111 aead_request_set_crypt(req, sg, sg, crypt_len, iv);
1112 aead_request_set_ad(req, assoc_data_len);
1113 aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
1114 CRYPTO_TFM_REQ_MAY_SLEEP,
1115 crypto_req_done, &wait);
1116
1117 rc = crypto_wait_req(enc ? crypto_aead_encrypt(req) :
1118 crypto_aead_decrypt(req), &wait);
1119 if (rc)
1120 goto free_iv;
1121
1122 if (enc)
1123 memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
1124
1125free_iv:
1126 kfree(iv);
1127free_sg:
1128 kfree(sg);
1129free_req:
1130 aead_request_free(req);
1131free_ctx:
1132 ksmbd_release_crypto_ctx(ctx);
1133zeroize_key:
1134 memzero_explicit(key, sizeof(key));
1135 memzero_explicit(sign, sizeof(sign));
1136 return rc;
1137}