Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * fs/cifs/cifsencrypt.c |
| 3 | * |
Steve French | 12b3b8f | 2006-02-09 21:12:47 +0000 | [diff] [blame] | 4 | * Copyright (C) International Business Machines Corp., 2005,2006 |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 5 | * Author(s): Steve French (sfrench@us.ibm.com) |
| 6 | * |
| 7 | * This library is free software; you can redistribute it and/or modify |
| 8 | * it under the terms of the GNU Lesser General Public License as published |
| 9 | * by the Free Software Foundation; either version 2.1 of the License, or |
| 10 | * (at your option) any later version. |
| 11 | * |
| 12 | * This library is distributed in the hope that it will be useful, |
| 13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See |
| 15 | * the GNU Lesser General Public License for more details. |
| 16 | * |
| 17 | * You should have received a copy of the GNU Lesser General Public License |
| 18 | * along with this library; if not, write to the Free Software |
| 19 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
| 20 | */ |
| 21 | |
| 22 | #include <linux/fs.h> |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 23 | #include <linux/slab.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 24 | #include "cifspdu.h" |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 25 | #include "cifsglob.h" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 26 | #include "cifs_debug.h" |
| 27 | #include "md5.h" |
| 28 | #include "cifs_unicode.h" |
| 29 | #include "cifsproto.h" |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame^] | 30 | #include "ntlmssp.h" |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 31 | #include <linux/ctype.h> |
Steve French | 6d027cf | 2006-06-05 16:26:05 +0000 | [diff] [blame] | 32 | #include <linux/random.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 33 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 34 | /* Calculate and return the CIFS signature based on the mac key and SMB PDU */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 35 | /* the 16 byte signature must be allocated by the caller */ |
| 36 | /* Note we only use the 1st eight bytes */ |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 37 | /* Note that the smb header signature field on input contains the |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 38 | sequence number before this function is called */ |
| 39 | |
| 40 | extern void mdfour(unsigned char *out, unsigned char *in, int n); |
| 41 | extern void E_md4hash(const unsigned char *passwd, unsigned char *p16); |
Jeff Layton | 4e53a3f | 2008-12-05 20:41:21 -0500 | [diff] [blame] | 42 | extern void SMBencrypt(unsigned char *passwd, const unsigned char *c8, |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 43 | unsigned char *p24); |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 44 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 45 | static int cifs_calculate_signature(const struct smb_hdr *cifs_pdu, |
Shirish Pargaonkar | 5f98ca9 | 2010-09-18 22:01:58 -0500 | [diff] [blame] | 46 | const struct session_key *key, char *signature) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 47 | { |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 48 | struct MD5Context context; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 49 | |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 50 | if ((cifs_pdu == NULL) || (signature == NULL) || (key == NULL)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 51 | return -EINVAL; |
| 52 | |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 53 | cifs_MD5_init(&context); |
| 54 | cifs_MD5_update(&context, (char *)&key->data, key->len); |
| 55 | cifs_MD5_update(&context, cifs_pdu->Protocol, cifs_pdu->smb_buf_length); |
Steve French | b609f06 | 2007-07-09 07:55:14 +0000 | [diff] [blame] | 56 | |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 57 | cifs_MD5_final(signature, &context); |
Steve French | 56234e2 | 2010-09-08 20:57:05 +0000 | [diff] [blame] | 58 | return 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 59 | } |
| 60 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 61 | int cifs_sign_smb(struct smb_hdr *cifs_pdu, struct TCP_Server_Info *server, |
| 62 | __u32 *pexpected_response_sequence_number) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 63 | { |
| 64 | int rc = 0; |
| 65 | char smb_signature[20]; |
| 66 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 67 | if ((cifs_pdu == NULL) || (server == NULL)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 68 | return -EINVAL; |
| 69 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 70 | if ((cifs_pdu->Flags2 & SMBFLG2_SECURITY_SIGNATURE) == 0) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 71 | return rc; |
| 72 | |
| 73 | spin_lock(&GlobalMid_Lock); |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 74 | cifs_pdu->Signature.Sequence.SequenceNumber = |
| 75 | cpu_to_le32(server->sequence_number); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 76 | cifs_pdu->Signature.Sequence.Reserved = 0; |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 77 | |
Steve French | ad009ac | 2005-04-28 22:41:05 -0700 | [diff] [blame] | 78 | *pexpected_response_sequence_number = server->sequence_number++; |
| 79 | server->sequence_number++; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 80 | spin_unlock(&GlobalMid_Lock); |
| 81 | |
Shirish Pargaonkar | 5f98ca9 | 2010-09-18 22:01:58 -0500 | [diff] [blame] | 82 | rc = cifs_calculate_signature(cifs_pdu, &server->session_key, |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 83 | smb_signature); |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 84 | if (rc) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 85 | memset(cifs_pdu->Signature.SecuritySignature, 0, 8); |
| 86 | else |
| 87 | memcpy(cifs_pdu->Signature.SecuritySignature, smb_signature, 8); |
| 88 | |
| 89 | return rc; |
| 90 | } |
| 91 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 92 | static int cifs_calc_signature2(const struct kvec *iov, int n_vec, |
Shirish Pargaonkar | 5f98ca9 | 2010-09-18 22:01:58 -0500 | [diff] [blame] | 93 | const struct session_key *key, char *signature) |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 94 | { |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 95 | struct MD5Context context; |
Steve French | e9917a0 | 2006-03-31 21:22:00 +0000 | [diff] [blame] | 96 | int i; |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 97 | |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 98 | if ((iov == NULL) || (signature == NULL) || (key == NULL)) |
Steve French | e9917a0 | 2006-03-31 21:22:00 +0000 | [diff] [blame] | 99 | return -EINVAL; |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 100 | |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 101 | cifs_MD5_init(&context); |
| 102 | cifs_MD5_update(&context, (char *)&key->data, key->len); |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 103 | for (i = 0; i < n_vec; i++) { |
Jeff Layton | 745542e | 2007-11-03 04:34:04 +0000 | [diff] [blame] | 104 | if (iov[i].iov_len == 0) |
| 105 | continue; |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 106 | if (iov[i].iov_base == NULL) { |
Steve French | 56234e2 | 2010-09-08 20:57:05 +0000 | [diff] [blame] | 107 | cERROR(1, "null iovec entry"); |
Steve French | e9917a0 | 2006-03-31 21:22:00 +0000 | [diff] [blame] | 108 | return -EIO; |
Jeff Layton | 745542e | 2007-11-03 04:34:04 +0000 | [diff] [blame] | 109 | } |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 110 | /* The first entry includes a length field (which does not get |
Steve French | e9917a0 | 2006-03-31 21:22:00 +0000 | [diff] [blame] | 111 | signed that occupies the first 4 bytes before the header */ |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 112 | if (i == 0) { |
Steve French | 63d2583 | 2007-11-05 21:46:10 +0000 | [diff] [blame] | 113 | if (iov[0].iov_len <= 8) /* cmd field at offset 9 */ |
Steve French | e9917a0 | 2006-03-31 21:22:00 +0000 | [diff] [blame] | 114 | break; /* nothing to sign or corrupt header */ |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 115 | cifs_MD5_update(&context, iov[0].iov_base+4, |
| 116 | iov[0].iov_len-4); |
Steve French | e9917a0 | 2006-03-31 21:22:00 +0000 | [diff] [blame] | 117 | } else |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 118 | cifs_MD5_update(&context, iov[i].iov_base, iov[i].iov_len); |
Steve French | e9917a0 | 2006-03-31 21:22:00 +0000 | [diff] [blame] | 119 | } |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 120 | |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 121 | cifs_MD5_final(signature, &context); |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 122 | |
Steve French | 56234e2 | 2010-09-08 20:57:05 +0000 | [diff] [blame] | 123 | return 0; |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 124 | } |
| 125 | |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 126 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 127 | int cifs_sign_smb2(struct kvec *iov, int n_vec, struct TCP_Server_Info *server, |
Steve French | 63d2583 | 2007-11-05 21:46:10 +0000 | [diff] [blame] | 128 | __u32 *pexpected_response_sequence_number) |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 129 | { |
| 130 | int rc = 0; |
| 131 | char smb_signature[20]; |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 132 | struct smb_hdr *cifs_pdu = iov[0].iov_base; |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 133 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 134 | if ((cifs_pdu == NULL) || (server == NULL)) |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 135 | return -EINVAL; |
| 136 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 137 | if ((cifs_pdu->Flags2 & SMBFLG2_SECURITY_SIGNATURE) == 0) |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 138 | return rc; |
| 139 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 140 | spin_lock(&GlobalMid_Lock); |
| 141 | cifs_pdu->Signature.Sequence.SequenceNumber = |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 142 | cpu_to_le32(server->sequence_number); |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 143 | cifs_pdu->Signature.Sequence.Reserved = 0; |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 144 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 145 | *pexpected_response_sequence_number = server->sequence_number++; |
| 146 | server->sequence_number++; |
| 147 | spin_unlock(&GlobalMid_Lock); |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 148 | |
Shirish Pargaonkar | 5f98ca9 | 2010-09-18 22:01:58 -0500 | [diff] [blame] | 149 | rc = cifs_calc_signature2(iov, n_vec, &server->session_key, |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 150 | smb_signature); |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 151 | if (rc) |
| 152 | memset(cifs_pdu->Signature.SecuritySignature, 0, 8); |
| 153 | else |
| 154 | memcpy(cifs_pdu->Signature.SecuritySignature, smb_signature, 8); |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 155 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 156 | return rc; |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 157 | } |
| 158 | |
Steve French | b609f06 | 2007-07-09 07:55:14 +0000 | [diff] [blame] | 159 | int cifs_verify_signature(struct smb_hdr *cifs_pdu, |
Shirish Pargaonkar | 5f98ca9 | 2010-09-18 22:01:58 -0500 | [diff] [blame] | 160 | const struct session_key *session_key, |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 161 | __u32 expected_sequence_number) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 162 | { |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 163 | unsigned int rc; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 164 | char server_response_sig[8]; |
| 165 | char what_we_think_sig_should_be[20]; |
| 166 | |
Shirish Pargaonkar | 5f98ca9 | 2010-09-18 22:01:58 -0500 | [diff] [blame] | 167 | if (cifs_pdu == NULL || session_key == NULL) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 168 | return -EINVAL; |
| 169 | |
| 170 | if (cifs_pdu->Command == SMB_COM_NEGOTIATE) |
| 171 | return 0; |
| 172 | |
| 173 | if (cifs_pdu->Command == SMB_COM_LOCKING_ANDX) { |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 174 | struct smb_com_lock_req *pSMB = |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 175 | (struct smb_com_lock_req *)cifs_pdu; |
| 176 | if (pSMB->LockType & LOCKING_ANDX_OPLOCK_RELEASE) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 177 | return 0; |
| 178 | } |
| 179 | |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 180 | /* BB what if signatures are supposed to be on for session but |
| 181 | server does not send one? BB */ |
| 182 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 183 | /* Do not need to verify session setups with signature "BSRSPYL " */ |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 184 | if (memcmp(cifs_pdu->Signature.SecuritySignature, "BSRSPYL ", 8) == 0) |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 185 | cFYI(1, "dummy signature received for smb command 0x%x", |
| 186 | cifs_pdu->Command); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 187 | |
| 188 | /* save off the origiginal signature so we can modify the smb and check |
| 189 | its signature against what the server sent */ |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 190 | memcpy(server_response_sig, cifs_pdu->Signature.SecuritySignature, 8); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 191 | |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 192 | cifs_pdu->Signature.Sequence.SequenceNumber = |
| 193 | cpu_to_le32(expected_sequence_number); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 194 | cifs_pdu->Signature.Sequence.Reserved = 0; |
| 195 | |
Shirish Pargaonkar | 5f98ca9 | 2010-09-18 22:01:58 -0500 | [diff] [blame] | 196 | rc = cifs_calculate_signature(cifs_pdu, session_key, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 197 | what_we_think_sig_should_be); |
| 198 | |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 199 | if (rc) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 200 | return rc; |
| 201 | |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 202 | /* cifs_dump_mem("what we think it should be: ", |
| 203 | what_we_think_sig_should_be, 16); */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 204 | |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 205 | if (memcmp(server_response_sig, what_we_think_sig_should_be, 8)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 206 | return -EACCES; |
| 207 | else |
| 208 | return 0; |
| 209 | |
| 210 | } |
| 211 | |
| 212 | /* We fill in key by putting in 40 byte array which was allocated by caller */ |
Shirish Pargaonkar | 5f98ca9 | 2010-09-18 22:01:58 -0500 | [diff] [blame] | 213 | int cifs_calculate_session_key(struct session_key *key, const char *rn, |
Steve French | b609f06 | 2007-07-09 07:55:14 +0000 | [diff] [blame] | 214 | const char *password) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 215 | { |
| 216 | char temp_key[16]; |
| 217 | if ((key == NULL) || (rn == NULL)) |
| 218 | return -EINVAL; |
| 219 | |
| 220 | E_md4hash(password, temp_key); |
Steve French | b609f06 | 2007-07-09 07:55:14 +0000 | [diff] [blame] | 221 | mdfour(key->data.ntlm, temp_key, 16); |
| 222 | memcpy(key->data.ntlm+16, rn, CIFS_SESS_KEY_SIZE); |
| 223 | key->len = 40; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 224 | return 0; |
| 225 | } |
| 226 | |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 227 | #ifdef CONFIG_CIFS_WEAK_PW_HASH |
Jeff Layton | 4e53a3f | 2008-12-05 20:41:21 -0500 | [diff] [blame] | 228 | void calc_lanman_hash(const char *password, const char *cryptkey, bool encrypt, |
| 229 | char *lnm_session_key) |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 230 | { |
| 231 | int i; |
| 232 | char password_with_pad[CIFS_ENCPWD_SIZE]; |
| 233 | |
| 234 | memset(password_with_pad, 0, CIFS_ENCPWD_SIZE); |
Jeff Layton | 4e53a3f | 2008-12-05 20:41:21 -0500 | [diff] [blame] | 235 | if (password) |
| 236 | strncpy(password_with_pad, password, CIFS_ENCPWD_SIZE); |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 237 | |
Jeff Layton | 04912d6 | 2010-04-24 07:57:45 -0400 | [diff] [blame] | 238 | if (!encrypt && global_secflags & CIFSSEC_MAY_PLNTXT) { |
Jeff Layton | 4e53a3f | 2008-12-05 20:41:21 -0500 | [diff] [blame] | 239 | memset(lnm_session_key, 0, CIFS_SESS_KEY_SIZE); |
| 240 | memcpy(lnm_session_key, password_with_pad, |
| 241 | CIFS_ENCPWD_SIZE); |
| 242 | return; |
| 243 | } |
Steve French | bdc4bf6e | 2006-06-02 22:57:13 +0000 | [diff] [blame] | 244 | |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 245 | /* calculate old style session key */ |
| 246 | /* calling toupper is less broken than repeatedly |
| 247 | calling nls_toupper would be since that will never |
| 248 | work for UTF8, but neither handles multibyte code pages |
| 249 | but the only alternative would be converting to UCS-16 (Unicode) |
| 250 | (using a routine something like UniStrupr) then |
| 251 | uppercasing and then converting back from Unicode - which |
| 252 | would only worth doing it if we knew it were utf8. Basically |
| 253 | utf8 and other multibyte codepages each need their own strupper |
| 254 | function since a byte at a time will ont work. */ |
| 255 | |
Shirish Pargaonkar | ef571ca | 2008-07-24 15:56:05 +0000 | [diff] [blame] | 256 | for (i = 0; i < CIFS_ENCPWD_SIZE; i++) |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 257 | password_with_pad[i] = toupper(password_with_pad[i]); |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 258 | |
Jeff Layton | 4e53a3f | 2008-12-05 20:41:21 -0500 | [diff] [blame] | 259 | SMBencrypt(password_with_pad, cryptkey, lnm_session_key); |
| 260 | |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 261 | /* clear password before we return/free memory */ |
| 262 | memset(password_with_pad, 0, CIFS_ENCPWD_SIZE); |
| 263 | } |
| 264 | #endif /* CIFS_WEAK_PW_HASH */ |
| 265 | |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame^] | 266 | /* This is just a filler for ntlmv2 type of security mechanisms. |
| 267 | * Older servers are not very particular about the contents of av pairs |
| 268 | * in the blob and for sec mechs like ntlmv2, there is no negotiation |
| 269 | * as in ntlmssp, so unless domain and server netbios and dns names |
| 270 | * are specified, there is no way to obtain name. In case of ntlmssp, |
| 271 | * server provides that info in type 2 challenge packet |
| 272 | */ |
| 273 | static int |
| 274 | build_avpair_blob(struct cifsSesInfo *ses) |
| 275 | { |
| 276 | struct ntlmssp2_name *attrptr; |
| 277 | |
| 278 | ses->tilen = 2 * sizeof(struct ntlmssp2_name); |
| 279 | ses->tiblob = kzalloc(ses->tilen, GFP_KERNEL); |
| 280 | if (!ses->tiblob) { |
| 281 | ses->tilen = 0; |
| 282 | cERROR(1, "Challenge target info allocation failure"); |
| 283 | return -ENOMEM; |
| 284 | } |
| 285 | attrptr = (struct ntlmssp2_name *) ses->tiblob; |
| 286 | attrptr->type = cpu_to_le16(NTLMSSP_DOMAIN_TYPE); |
| 287 | |
| 288 | return 0; |
| 289 | } |
| 290 | |
| 291 | /* Server has provided av pairs/target info in the type 2 challenge |
| 292 | * packet and we have plucked it and stored within smb session. |
| 293 | * We parse that blob here to find netbios domain name to be used |
| 294 | * as part of ntlmv2 authentication (in Target String), if not already |
| 295 | * specified on the command line. |
| 296 | * If this function returns without any error but without fetching |
| 297 | * domain name, authentication may fail against some server but |
| 298 | * may not fail against other (those who are not very particular |
| 299 | * about target string i.e. for some, just user name might suffice. |
| 300 | */ |
| 301 | static int |
| 302 | find_domain_name(struct cifsSesInfo *ses) |
| 303 | { |
| 304 | unsigned int attrsize; |
| 305 | unsigned int type; |
| 306 | unsigned int onesize = sizeof(struct ntlmssp2_name); |
| 307 | unsigned char *blobptr; |
| 308 | unsigned char *blobend; |
| 309 | struct ntlmssp2_name *attrptr; |
| 310 | |
| 311 | if (!ses->tilen || !ses->tiblob) |
| 312 | return 0; |
| 313 | |
| 314 | blobptr = ses->tiblob; |
| 315 | blobend = ses->tiblob + ses->tilen; |
| 316 | |
| 317 | while (blobptr + onesize < blobend) { |
| 318 | attrptr = (struct ntlmssp2_name *) blobptr; |
| 319 | type = le16_to_cpu(attrptr->type); |
| 320 | if (type == NTLMSSP_AV_EOL) |
| 321 | break; |
| 322 | blobptr += 2; /* advance attr type */ |
| 323 | attrsize = le16_to_cpu(attrptr->length); |
| 324 | blobptr += 2; /* advance attr size */ |
| 325 | if (blobptr + attrsize > blobend) |
| 326 | break; |
| 327 | if (type == NTLMSSP_AV_NB_DOMAIN_NAME) { |
| 328 | if (!attrsize) |
| 329 | break; |
| 330 | if (!ses->domainName) { |
| 331 | ses->domainName = |
| 332 | kmalloc(attrsize + 1, GFP_KERNEL); |
| 333 | if (!ses->domainName) |
| 334 | return -ENOMEM; |
| 335 | cifs_from_ucs2(ses->domainName, |
| 336 | (__le16 *)blobptr, attrsize, attrsize, |
| 337 | load_nls_default(), false); |
| 338 | break; |
| 339 | } |
| 340 | } |
| 341 | blobptr += attrsize; /* advance attr value */ |
| 342 | } |
| 343 | |
| 344 | return 0; |
| 345 | } |
| 346 | |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 347 | static int calc_ntlmv2_hash(struct cifsSesInfo *ses, |
| 348 | const struct nls_table *nls_cp) |
Steve French | a8ee034 | 2006-06-05 23:34:19 +0000 | [diff] [blame] | 349 | { |
| 350 | int rc = 0; |
| 351 | int len; |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 352 | char nt_hash[16]; |
| 353 | struct HMACMD5Context *pctxt; |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 354 | wchar_t *user; |
| 355 | wchar_t *domain; |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 356 | |
| 357 | pctxt = kmalloc(sizeof(struct HMACMD5Context), GFP_KERNEL); |
| 358 | |
| 359 | if (pctxt == NULL) |
| 360 | return -ENOMEM; |
Steve French | a8ee034 | 2006-06-05 23:34:19 +0000 | [diff] [blame] | 361 | |
| 362 | /* calculate md4 hash of password */ |
| 363 | E_md4hash(ses->password, nt_hash); |
| 364 | |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 365 | /* convert Domainname to unicode and uppercase */ |
| 366 | hmac_md5_init_limK_to_64(nt_hash, 16, pctxt); |
Steve French | a8ee034 | 2006-06-05 23:34:19 +0000 | [diff] [blame] | 367 | |
| 368 | /* convert ses->userName to unicode and uppercase */ |
Steve French | 1717ffc | 2006-06-08 05:41:32 +0000 | [diff] [blame] | 369 | len = strlen(ses->userName); |
| 370 | user = kmalloc(2 + (len * 2), GFP_KERNEL); |
Steve French | 56234e2 | 2010-09-08 20:57:05 +0000 | [diff] [blame] | 371 | if (user == NULL) |
Steve French | 1717ffc | 2006-06-08 05:41:32 +0000 | [diff] [blame] | 372 | goto calc_exit_2; |
Cyril Gorcunov | 8f2376a | 2007-10-14 17:58:43 +0000 | [diff] [blame] | 373 | len = cifs_strtoUCS((__le16 *)user, ses->userName, len, nls_cp); |
Steve French | 1717ffc | 2006-06-08 05:41:32 +0000 | [diff] [blame] | 374 | UniStrupr(user); |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 375 | hmac_md5_update((char *)user, 2*len, pctxt); |
Steve French | a8ee034 | 2006-06-05 23:34:19 +0000 | [diff] [blame] | 376 | |
| 377 | /* convert ses->domainName to unicode and uppercase */ |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 378 | if (ses->domainName) { |
Steve French | 1717ffc | 2006-06-08 05:41:32 +0000 | [diff] [blame] | 379 | len = strlen(ses->domainName); |
Steve French | a8ee034 | 2006-06-05 23:34:19 +0000 | [diff] [blame] | 380 | |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 381 | domain = kmalloc(2 + (len * 2), GFP_KERNEL); |
Steve French | 56234e2 | 2010-09-08 20:57:05 +0000 | [diff] [blame] | 382 | if (domain == NULL) |
Steve French | 1717ffc | 2006-06-08 05:41:32 +0000 | [diff] [blame] | 383 | goto calc_exit_1; |
Cyril Gorcunov | 8f2376a | 2007-10-14 17:58:43 +0000 | [diff] [blame] | 384 | len = cifs_strtoUCS((__le16 *)domain, ses->domainName, len, |
| 385 | nls_cp); |
Steve French | b609f06 | 2007-07-09 07:55:14 +0000 | [diff] [blame] | 386 | /* the following line was removed since it didn't work well |
| 387 | with lower cased domain name that passed as an option. |
| 388 | Maybe converting the domain name earlier makes sense */ |
| 389 | /* UniStrupr(domain); */ |
Steve French | a8ee034 | 2006-06-05 23:34:19 +0000 | [diff] [blame] | 390 | |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 391 | hmac_md5_update((char *)domain, 2*len, pctxt); |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 392 | |
Steve French | 1717ffc | 2006-06-08 05:41:32 +0000 | [diff] [blame] | 393 | kfree(domain); |
| 394 | } |
| 395 | calc_exit_1: |
| 396 | kfree(user); |
| 397 | calc_exit_2: |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 398 | /* BB FIXME what about bytes 24 through 40 of the signing key? |
Steve French | 1717ffc | 2006-06-08 05:41:32 +0000 | [diff] [blame] | 399 | compare with the NTLM example */ |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 400 | hmac_md5_final(ses->server->ntlmv2_hash, pctxt); |
Steve French | a8ee034 | 2006-06-05 23:34:19 +0000 | [diff] [blame] | 401 | |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 402 | kfree(pctxt); |
Steve French | a8ee034 | 2006-06-05 23:34:19 +0000 | [diff] [blame] | 403 | return rc; |
| 404 | } |
| 405 | |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame^] | 406 | int |
| 407 | setup_ntlmv2_rsp(struct cifsSesInfo *ses, char *resp_buf, |
Steve French | 9fbc590 | 2010-08-20 20:42:26 +0000 | [diff] [blame] | 408 | const struct nls_table *nls_cp) |
| 409 | { |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 410 | int rc; |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 411 | struct ntlmv2_resp *buf = (struct ntlmv2_resp *)resp_buf; |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 412 | struct HMACMD5Context context; |
Steve French | 6d027cf | 2006-06-05 16:26:05 +0000 | [diff] [blame] | 413 | |
| 414 | buf->blob_signature = cpu_to_le32(0x00000101); |
| 415 | buf->reserved = 0; |
| 416 | buf->time = cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME)); |
Steve French | 1717ffc | 2006-06-08 05:41:32 +0000 | [diff] [blame] | 417 | get_random_bytes(&buf->client_chal, sizeof(buf->client_chal)); |
Steve French | 6d027cf | 2006-06-05 16:26:05 +0000 | [diff] [blame] | 418 | buf->reserved2 = 0; |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame^] | 419 | |
| 420 | if (ses->server->secType == RawNTLMSSP) { |
| 421 | if (!ses->domainName) { |
| 422 | rc = find_domain_name(ses); |
| 423 | if (rc) { |
| 424 | cERROR(1, "error %d finding domain name", rc); |
| 425 | goto setup_ntlmv2_rsp_ret; |
| 426 | } |
| 427 | } |
| 428 | } else { |
| 429 | rc = build_avpair_blob(ses); |
| 430 | if (rc) { |
| 431 | cERROR(1, "error %d building av pair blob", rc); |
| 432 | return rc; |
| 433 | } |
| 434 | } |
Steve French | a8ee034 | 2006-06-05 23:34:19 +0000 | [diff] [blame] | 435 | |
Steve French | 6d027cf | 2006-06-05 16:26:05 +0000 | [diff] [blame] | 436 | /* calculate buf->ntlmv2_hash */ |
Steve French | 1717ffc | 2006-06-08 05:41:32 +0000 | [diff] [blame] | 437 | rc = calc_ntlmv2_hash(ses, nls_cp); |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame^] | 438 | if (rc) { |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 439 | cERROR(1, "could not get v2 hash rc %d", rc); |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame^] | 440 | goto setup_ntlmv2_rsp_ret; |
| 441 | } |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 442 | CalcNTLMv2_response(ses, resp_buf); |
Steve French | b609f06 | 2007-07-09 07:55:14 +0000 | [diff] [blame] | 443 | |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 444 | /* now calculate the MAC key for NTLMv2 */ |
| 445 | hmac_md5_init_limK_to_64(ses->server->ntlmv2_hash, 16, &context); |
| 446 | hmac_md5_update(resp_buf, 16, &context); |
Shirish Pargaonkar | 5f98ca9 | 2010-09-18 22:01:58 -0500 | [diff] [blame] | 447 | hmac_md5_final(ses->server->session_key.data.ntlmv2.key, &context); |
Steve French | b609f06 | 2007-07-09 07:55:14 +0000 | [diff] [blame] | 448 | |
Shirish Pargaonkar | 5f98ca9 | 2010-09-18 22:01:58 -0500 | [diff] [blame] | 449 | memcpy(&ses->server->session_key.data.ntlmv2.resp, resp_buf, |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 450 | sizeof(struct ntlmv2_resp)); |
Shirish Pargaonkar | 5f98ca9 | 2010-09-18 22:01:58 -0500 | [diff] [blame] | 451 | ses->server->session_key.len = 16 + sizeof(struct ntlmv2_resp); |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame^] | 452 | |
| 453 | return 0; |
| 454 | |
| 455 | setup_ntlmv2_rsp_ret: |
| 456 | kfree(ses->tiblob); |
| 457 | ses->tiblob = NULL; |
| 458 | ses->tilen = 0; |
| 459 | |
| 460 | return rc; |
Steve French | 6d027cf | 2006-06-05 16:26:05 +0000 | [diff] [blame] | 461 | } |
| 462 | |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 463 | void CalcNTLMv2_response(const struct cifsSesInfo *ses, |
| 464 | char *v2_session_response) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 465 | { |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 466 | struct HMACMD5Context context; |
| 467 | /* rest of v2 struct already generated */ |
| 468 | memcpy(v2_session_response + 8, ses->server->cryptKey, 8); |
| 469 | hmac_md5_init_limK_to_64(ses->server->ntlmv2_hash, 16, &context); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 470 | |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 471 | hmac_md5_update(v2_session_response+8, |
| 472 | sizeof(struct ntlmv2_resp) - 8, &context); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 473 | |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame^] | 474 | if (ses->tilen) |
| 475 | hmac_md5_update(ses->tiblob, ses->tilen, &context); |
| 476 | |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 477 | hmac_md5_final(v2_session_response, &context); |
| 478 | /* cifs_dump_mem("v2_sess_rsp: ", v2_session_response, 32); */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 479 | } |