Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * fs/cifs/cifsencrypt.c |
| 3 | * |
Steve French | 12b3b8f | 2006-02-09 21:12:47 +0000 | [diff] [blame] | 4 | * Copyright (C) International Business Machines Corp., 2005,2006 |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 5 | * Author(s): Steve French (sfrench@us.ibm.com) |
| 6 | * |
| 7 | * This library is free software; you can redistribute it and/or modify |
| 8 | * it under the terms of the GNU Lesser General Public License as published |
| 9 | * by the Free Software Foundation; either version 2.1 of the License, or |
| 10 | * (at your option) any later version. |
| 11 | * |
| 12 | * This library is distributed in the hope that it will be useful, |
| 13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See |
| 15 | * the GNU Lesser General Public License for more details. |
| 16 | * |
| 17 | * You should have received a copy of the GNU Lesser General Public License |
| 18 | * along with this library; if not, write to the Free Software |
| 19 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
| 20 | */ |
| 21 | |
| 22 | #include <linux/fs.h> |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 23 | #include <linux/slab.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 24 | #include "cifspdu.h" |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 25 | #include "cifsglob.h" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 26 | #include "cifs_debug.h" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 27 | #include "cifs_unicode.h" |
| 28 | #include "cifsproto.h" |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 29 | #include "ntlmssp.h" |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 30 | #include <linux/ctype.h> |
Steve French | 6d027cf | 2006-06-05 16:26:05 +0000 | [diff] [blame] | 31 | #include <linux/random.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 32 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 33 | /* Calculate and return the CIFS signature based on the mac key and SMB PDU */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 34 | /* the 16 byte signature must be allocated by the caller */ |
| 35 | /* Note we only use the 1st eight bytes */ |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 36 | /* Note that the smb header signature field on input contains the |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 37 | sequence number before this function is called */ |
| 38 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 39 | static int cifs_calculate_signature(const struct smb_hdr *cifs_pdu, |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 40 | struct TCP_Server_Info *server, char *signature) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 41 | { |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 42 | int rc; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 43 | |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 44 | if (cifs_pdu == NULL || signature == NULL || server == NULL) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 45 | return -EINVAL; |
| 46 | |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 47 | if (!server->secmech.sdescmd5) { |
| 48 | cERROR(1, "%s: Can't generate signature\n", __func__); |
| 49 | return -1; |
| 50 | } |
Steve French | b609f06 | 2007-07-09 07:55:14 +0000 | [diff] [blame] | 51 | |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 52 | rc = crypto_shash_init(&server->secmech.sdescmd5->shash); |
| 53 | if (rc) { |
| 54 | cERROR(1, "%s: Oould not init md5\n", __func__); |
| 55 | return rc; |
| 56 | } |
| 57 | |
| 58 | crypto_shash_update(&server->secmech.sdescmd5->shash, |
| 59 | server->session_key.response, server->session_key.len); |
| 60 | |
| 61 | crypto_shash_update(&server->secmech.sdescmd5->shash, |
| 62 | cifs_pdu->Protocol, cifs_pdu->smb_buf_length); |
| 63 | |
| 64 | rc = crypto_shash_final(&server->secmech.sdescmd5->shash, signature); |
| 65 | |
Steve French | 56234e2 | 2010-09-08 20:57:05 +0000 | [diff] [blame] | 66 | return 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 67 | } |
| 68 | |
Jeff Layton | a0f8b4f | 2011-01-07 11:30:28 -0500 | [diff] [blame] | 69 | /* must be called with server->srv_mutex held */ |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 70 | int cifs_sign_smb(struct smb_hdr *cifs_pdu, struct TCP_Server_Info *server, |
| 71 | __u32 *pexpected_response_sequence_number) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 72 | { |
| 73 | int rc = 0; |
| 74 | char smb_signature[20]; |
| 75 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 76 | if ((cifs_pdu == NULL) || (server == NULL)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 77 | return -EINVAL; |
| 78 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 79 | if ((cifs_pdu->Flags2 & SMBFLG2_SECURITY_SIGNATURE) == 0) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 80 | return rc; |
| 81 | |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 82 | cifs_pdu->Signature.Sequence.SequenceNumber = |
| 83 | cpu_to_le32(server->sequence_number); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 84 | cifs_pdu->Signature.Sequence.Reserved = 0; |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 85 | |
Steve French | ad009ac | 2005-04-28 22:41:05 -0700 | [diff] [blame] | 86 | *pexpected_response_sequence_number = server->sequence_number++; |
| 87 | server->sequence_number++; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 88 | |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 89 | rc = cifs_calculate_signature(cifs_pdu, server, smb_signature); |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 90 | if (rc) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 91 | memset(cifs_pdu->Signature.SecuritySignature, 0, 8); |
| 92 | else |
| 93 | memcpy(cifs_pdu->Signature.SecuritySignature, smb_signature, 8); |
| 94 | |
| 95 | return rc; |
| 96 | } |
| 97 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 98 | static int cifs_calc_signature2(const struct kvec *iov, int n_vec, |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 99 | struct TCP_Server_Info *server, char *signature) |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 100 | { |
Steve French | e9917a0 | 2006-03-31 21:22:00 +0000 | [diff] [blame] | 101 | int i; |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 102 | int rc; |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 103 | |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 104 | if (iov == NULL || signature == NULL || server == NULL) |
Steve French | e9917a0 | 2006-03-31 21:22:00 +0000 | [diff] [blame] | 105 | return -EINVAL; |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 106 | |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 107 | if (!server->secmech.sdescmd5) { |
| 108 | cERROR(1, "%s: Can't generate signature\n", __func__); |
| 109 | return -1; |
| 110 | } |
| 111 | |
| 112 | rc = crypto_shash_init(&server->secmech.sdescmd5->shash); |
| 113 | if (rc) { |
| 114 | cERROR(1, "%s: Oould not init md5\n", __func__); |
| 115 | return rc; |
| 116 | } |
| 117 | |
| 118 | crypto_shash_update(&server->secmech.sdescmd5->shash, |
| 119 | server->session_key.response, server->session_key.len); |
| 120 | |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 121 | for (i = 0; i < n_vec; i++) { |
Jeff Layton | 745542e | 2007-11-03 04:34:04 +0000 | [diff] [blame] | 122 | if (iov[i].iov_len == 0) |
| 123 | continue; |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 124 | if (iov[i].iov_base == NULL) { |
Steve French | 56234e2 | 2010-09-08 20:57:05 +0000 | [diff] [blame] | 125 | cERROR(1, "null iovec entry"); |
Steve French | e9917a0 | 2006-03-31 21:22:00 +0000 | [diff] [blame] | 126 | return -EIO; |
Jeff Layton | 745542e | 2007-11-03 04:34:04 +0000 | [diff] [blame] | 127 | } |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 128 | /* The first entry includes a length field (which does not get |
Steve French | e9917a0 | 2006-03-31 21:22:00 +0000 | [diff] [blame] | 129 | signed that occupies the first 4 bytes before the header */ |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 130 | if (i == 0) { |
Steve French | 63d2583 | 2007-11-05 21:46:10 +0000 | [diff] [blame] | 131 | if (iov[0].iov_len <= 8) /* cmd field at offset 9 */ |
Steve French | e9917a0 | 2006-03-31 21:22:00 +0000 | [diff] [blame] | 132 | break; /* nothing to sign or corrupt header */ |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 133 | crypto_shash_update(&server->secmech.sdescmd5->shash, |
| 134 | iov[i].iov_base + 4, iov[i].iov_len - 4); |
Steve French | e9917a0 | 2006-03-31 21:22:00 +0000 | [diff] [blame] | 135 | } else |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 136 | crypto_shash_update(&server->secmech.sdescmd5->shash, |
| 137 | iov[i].iov_base, iov[i].iov_len); |
Steve French | e9917a0 | 2006-03-31 21:22:00 +0000 | [diff] [blame] | 138 | } |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 139 | |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 140 | rc = crypto_shash_final(&server->secmech.sdescmd5->shash, signature); |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 141 | |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 142 | return rc; |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 143 | } |
| 144 | |
Jeff Layton | a0f8b4f | 2011-01-07 11:30:28 -0500 | [diff] [blame] | 145 | /* must be called with server->srv_mutex held */ |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 146 | int cifs_sign_smb2(struct kvec *iov, int n_vec, struct TCP_Server_Info *server, |
Steve French | 63d2583 | 2007-11-05 21:46:10 +0000 | [diff] [blame] | 147 | __u32 *pexpected_response_sequence_number) |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 148 | { |
| 149 | int rc = 0; |
| 150 | char smb_signature[20]; |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 151 | struct smb_hdr *cifs_pdu = iov[0].iov_base; |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 152 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 153 | if ((cifs_pdu == NULL) || (server == NULL)) |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 154 | return -EINVAL; |
| 155 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 156 | if ((cifs_pdu->Flags2 & SMBFLG2_SECURITY_SIGNATURE) == 0) |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 157 | return rc; |
| 158 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 159 | cifs_pdu->Signature.Sequence.SequenceNumber = |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 160 | cpu_to_le32(server->sequence_number); |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 161 | cifs_pdu->Signature.Sequence.Reserved = 0; |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 162 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 163 | *pexpected_response_sequence_number = server->sequence_number++; |
| 164 | server->sequence_number++; |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 165 | |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 166 | rc = cifs_calc_signature2(iov, n_vec, server, smb_signature); |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 167 | if (rc) |
| 168 | memset(cifs_pdu->Signature.SecuritySignature, 0, 8); |
| 169 | else |
| 170 | memcpy(cifs_pdu->Signature.SecuritySignature, smb_signature, 8); |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 171 | |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 172 | return rc; |
Steve French | 84afc29 | 2005-12-02 13:32:45 -0800 | [diff] [blame] | 173 | } |
| 174 | |
Steve French | b609f06 | 2007-07-09 07:55:14 +0000 | [diff] [blame] | 175 | int cifs_verify_signature(struct smb_hdr *cifs_pdu, |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 176 | struct TCP_Server_Info *server, |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 177 | __u32 expected_sequence_number) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 178 | { |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 179 | unsigned int rc; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 180 | char server_response_sig[8]; |
| 181 | char what_we_think_sig_should_be[20]; |
| 182 | |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 183 | if (cifs_pdu == NULL || server == NULL) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 184 | return -EINVAL; |
| 185 | |
| 186 | if (cifs_pdu->Command == SMB_COM_NEGOTIATE) |
| 187 | return 0; |
| 188 | |
| 189 | if (cifs_pdu->Command == SMB_COM_LOCKING_ANDX) { |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 190 | struct smb_com_lock_req *pSMB = |
Steve French | ffdd6e4 | 2007-06-24 21:15:44 +0000 | [diff] [blame] | 191 | (struct smb_com_lock_req *)cifs_pdu; |
| 192 | if (pSMB->LockType & LOCKING_ANDX_OPLOCK_RELEASE) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 193 | return 0; |
| 194 | } |
| 195 | |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 196 | /* BB what if signatures are supposed to be on for session but |
| 197 | server does not send one? BB */ |
| 198 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 199 | /* Do not need to verify session setups with signature "BSRSPYL " */ |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 200 | if (memcmp(cifs_pdu->Signature.SecuritySignature, "BSRSPYL ", 8) == 0) |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 201 | cFYI(1, "dummy signature received for smb command 0x%x", |
| 202 | cifs_pdu->Command); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 203 | |
| 204 | /* save off the origiginal signature so we can modify the smb and check |
| 205 | its signature against what the server sent */ |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 206 | memcpy(server_response_sig, cifs_pdu->Signature.SecuritySignature, 8); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 207 | |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 208 | cifs_pdu->Signature.Sequence.SequenceNumber = |
| 209 | cpu_to_le32(expected_sequence_number); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 210 | cifs_pdu->Signature.Sequence.Reserved = 0; |
| 211 | |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 212 | rc = cifs_calculate_signature(cifs_pdu, server, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 213 | what_we_think_sig_should_be); |
| 214 | |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 215 | if (rc) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 216 | return rc; |
| 217 | |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 218 | /* cifs_dump_mem("what we think it should be: ", |
| 219 | what_we_think_sig_should_be, 16); */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 220 | |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 221 | if (memcmp(server_response_sig, what_we_think_sig_should_be, 8)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 222 | return -EACCES; |
| 223 | else |
| 224 | return 0; |
| 225 | |
| 226 | } |
| 227 | |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 228 | /* first calculate 24 bytes ntlm response and then 16 byte session key */ |
| 229 | int setup_ntlm_response(struct cifsSesInfo *ses) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 230 | { |
Shirish Pargaonkar | ee2c925 | 2011-01-27 09:58:04 -0600 | [diff] [blame] | 231 | int rc = 0; |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 232 | unsigned int temp_len = CIFS_SESS_KEY_SIZE + CIFS_AUTH_RESP_SIZE; |
| 233 | char temp_key[CIFS_SESS_KEY_SIZE]; |
| 234 | |
| 235 | if (!ses) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 236 | return -EINVAL; |
| 237 | |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 238 | ses->auth_key.response = kmalloc(temp_len, GFP_KERNEL); |
| 239 | if (!ses->auth_key.response) { |
| 240 | cERROR(1, "NTLM can't allocate (%u bytes) memory", temp_len); |
| 241 | return -ENOMEM; |
| 242 | } |
| 243 | ses->auth_key.len = temp_len; |
| 244 | |
Shirish Pargaonkar | ee2c925 | 2011-01-27 09:58:04 -0600 | [diff] [blame] | 245 | rc = SMBNTencrypt(ses->password, ses->server->cryptkey, |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 246 | ses->auth_key.response + CIFS_SESS_KEY_SIZE); |
Shirish Pargaonkar | ee2c925 | 2011-01-27 09:58:04 -0600 | [diff] [blame] | 247 | if (rc) { |
| 248 | cFYI(1, "%s Can't generate NTLM response, error: %d", |
| 249 | __func__, rc); |
| 250 | return rc; |
| 251 | } |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 252 | |
Shirish Pargaonkar | ee2c925 | 2011-01-27 09:58:04 -0600 | [diff] [blame] | 253 | rc = E_md4hash(ses->password, temp_key); |
| 254 | if (rc) { |
| 255 | cFYI(1, "%s Can't generate NT hash, error: %d", __func__, rc); |
| 256 | return rc; |
| 257 | } |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 258 | |
Shirish Pargaonkar | ee2c925 | 2011-01-27 09:58:04 -0600 | [diff] [blame] | 259 | rc = mdfour(ses->auth_key.response, temp_key, CIFS_SESS_KEY_SIZE); |
| 260 | if (rc) |
| 261 | cFYI(1, "%s Can't generate NTLM session key, error: %d", |
| 262 | __func__, rc); |
| 263 | |
| 264 | return rc; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 265 | } |
| 266 | |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 267 | #ifdef CONFIG_CIFS_WEAK_PW_HASH |
Jeff Layton | 4e53a3f | 2008-12-05 20:41:21 -0500 | [diff] [blame] | 268 | void calc_lanman_hash(const char *password, const char *cryptkey, bool encrypt, |
| 269 | char *lnm_session_key) |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 270 | { |
| 271 | int i; |
| 272 | char password_with_pad[CIFS_ENCPWD_SIZE]; |
| 273 | |
| 274 | memset(password_with_pad, 0, CIFS_ENCPWD_SIZE); |
Jeff Layton | 4e53a3f | 2008-12-05 20:41:21 -0500 | [diff] [blame] | 275 | if (password) |
| 276 | strncpy(password_with_pad, password, CIFS_ENCPWD_SIZE); |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 277 | |
Jeff Layton | 04912d6 | 2010-04-24 07:57:45 -0400 | [diff] [blame] | 278 | if (!encrypt && global_secflags & CIFSSEC_MAY_PLNTXT) { |
Jeff Layton | 4e53a3f | 2008-12-05 20:41:21 -0500 | [diff] [blame] | 279 | memset(lnm_session_key, 0, CIFS_SESS_KEY_SIZE); |
| 280 | memcpy(lnm_session_key, password_with_pad, |
| 281 | CIFS_ENCPWD_SIZE); |
| 282 | return; |
| 283 | } |
Steve French | bdc4bf6e | 2006-06-02 22:57:13 +0000 | [diff] [blame] | 284 | |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 285 | /* calculate old style session key */ |
| 286 | /* calling toupper is less broken than repeatedly |
| 287 | calling nls_toupper would be since that will never |
| 288 | work for UTF8, but neither handles multibyte code pages |
| 289 | but the only alternative would be converting to UCS-16 (Unicode) |
| 290 | (using a routine something like UniStrupr) then |
| 291 | uppercasing and then converting back from Unicode - which |
| 292 | would only worth doing it if we knew it were utf8. Basically |
| 293 | utf8 and other multibyte codepages each need their own strupper |
| 294 | function since a byte at a time will ont work. */ |
| 295 | |
Shirish Pargaonkar | ef571ca | 2008-07-24 15:56:05 +0000 | [diff] [blame] | 296 | for (i = 0; i < CIFS_ENCPWD_SIZE; i++) |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 297 | password_with_pad[i] = toupper(password_with_pad[i]); |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 298 | |
Jeff Layton | 4e53a3f | 2008-12-05 20:41:21 -0500 | [diff] [blame] | 299 | SMBencrypt(password_with_pad, cryptkey, lnm_session_key); |
| 300 | |
Steve French | 7c7b25b | 2006-06-01 19:20:10 +0000 | [diff] [blame] | 301 | /* clear password before we return/free memory */ |
| 302 | memset(password_with_pad, 0, CIFS_ENCPWD_SIZE); |
| 303 | } |
| 304 | #endif /* CIFS_WEAK_PW_HASH */ |
| 305 | |
Shirish Pargaonkar | 9daa42e | 2010-10-10 13:21:05 -0500 | [diff] [blame] | 306 | /* Build a proper attribute value/target info pairs blob. |
| 307 | * Fill in netbios and dns domain name and workstation name |
| 308 | * and client time (total five av pairs and + one end of fields indicator. |
| 309 | * Allocate domain name which gets freed when session struct is deallocated. |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 310 | */ |
| 311 | static int |
Shirish Pargaonkar | 9daa42e | 2010-10-10 13:21:05 -0500 | [diff] [blame] | 312 | build_avpair_blob(struct cifsSesInfo *ses, const struct nls_table *nls_cp) |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 313 | { |
Shirish Pargaonkar | 9daa42e | 2010-10-10 13:21:05 -0500 | [diff] [blame] | 314 | unsigned int dlen; |
| 315 | unsigned int wlen; |
| 316 | unsigned int size = 6 * sizeof(struct ntlmssp2_name); |
| 317 | __le64 curtime; |
| 318 | char *defdmname = "WORKGROUP"; |
| 319 | unsigned char *blobptr; |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 320 | struct ntlmssp2_name *attrptr; |
| 321 | |
Shirish Pargaonkar | 9daa42e | 2010-10-10 13:21:05 -0500 | [diff] [blame] | 322 | if (!ses->domainName) { |
| 323 | ses->domainName = kstrdup(defdmname, GFP_KERNEL); |
| 324 | if (!ses->domainName) |
| 325 | return -ENOMEM; |
| 326 | } |
| 327 | |
| 328 | dlen = strlen(ses->domainName); |
| 329 | wlen = strlen(ses->server->hostname); |
| 330 | |
| 331 | /* The length of this blob is a size which is |
| 332 | * six times the size of a structure which holds name/size + |
| 333 | * two times the unicode length of a domain name + |
| 334 | * two times the unicode length of a server name + |
| 335 | * size of a timestamp (which is 8 bytes). |
| 336 | */ |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 337 | ses->auth_key.len = size + 2 * (2 * dlen) + 2 * (2 * wlen) + 8; |
| 338 | ses->auth_key.response = kzalloc(ses->auth_key.len, GFP_KERNEL); |
| 339 | if (!ses->auth_key.response) { |
| 340 | ses->auth_key.len = 0; |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 341 | cERROR(1, "Challenge target info allocation failure"); |
| 342 | return -ENOMEM; |
| 343 | } |
Shirish Pargaonkar | 9daa42e | 2010-10-10 13:21:05 -0500 | [diff] [blame] | 344 | |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 345 | blobptr = ses->auth_key.response; |
Shirish Pargaonkar | 9daa42e | 2010-10-10 13:21:05 -0500 | [diff] [blame] | 346 | attrptr = (struct ntlmssp2_name *) blobptr; |
| 347 | |
| 348 | attrptr->type = cpu_to_le16(NTLMSSP_AV_NB_DOMAIN_NAME); |
| 349 | attrptr->length = cpu_to_le16(2 * dlen); |
| 350 | blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name); |
| 351 | cifs_strtoUCS((__le16 *)blobptr, ses->domainName, dlen, nls_cp); |
| 352 | |
| 353 | blobptr += 2 * dlen; |
| 354 | attrptr = (struct ntlmssp2_name *) blobptr; |
| 355 | |
| 356 | attrptr->type = cpu_to_le16(NTLMSSP_AV_NB_COMPUTER_NAME); |
| 357 | attrptr->length = cpu_to_le16(2 * wlen); |
| 358 | blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name); |
| 359 | cifs_strtoUCS((__le16 *)blobptr, ses->server->hostname, wlen, nls_cp); |
| 360 | |
| 361 | blobptr += 2 * wlen; |
| 362 | attrptr = (struct ntlmssp2_name *) blobptr; |
| 363 | |
| 364 | attrptr->type = cpu_to_le16(NTLMSSP_AV_DNS_DOMAIN_NAME); |
| 365 | attrptr->length = cpu_to_le16(2 * dlen); |
| 366 | blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name); |
| 367 | cifs_strtoUCS((__le16 *)blobptr, ses->domainName, dlen, nls_cp); |
| 368 | |
| 369 | blobptr += 2 * dlen; |
| 370 | attrptr = (struct ntlmssp2_name *) blobptr; |
| 371 | |
| 372 | attrptr->type = cpu_to_le16(NTLMSSP_AV_DNS_COMPUTER_NAME); |
| 373 | attrptr->length = cpu_to_le16(2 * wlen); |
| 374 | blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name); |
| 375 | cifs_strtoUCS((__le16 *)blobptr, ses->server->hostname, wlen, nls_cp); |
| 376 | |
| 377 | blobptr += 2 * wlen; |
| 378 | attrptr = (struct ntlmssp2_name *) blobptr; |
| 379 | |
| 380 | attrptr->type = cpu_to_le16(NTLMSSP_AV_TIMESTAMP); |
| 381 | attrptr->length = cpu_to_le16(sizeof(__le64)); |
| 382 | blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name); |
| 383 | curtime = cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME)); |
| 384 | memcpy(blobptr, &curtime, sizeof(__le64)); |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 385 | |
| 386 | return 0; |
| 387 | } |
| 388 | |
| 389 | /* Server has provided av pairs/target info in the type 2 challenge |
| 390 | * packet and we have plucked it and stored within smb session. |
| 391 | * We parse that blob here to find netbios domain name to be used |
| 392 | * as part of ntlmv2 authentication (in Target String), if not already |
| 393 | * specified on the command line. |
| 394 | * If this function returns without any error but without fetching |
| 395 | * domain name, authentication may fail against some server but |
| 396 | * may not fail against other (those who are not very particular |
| 397 | * about target string i.e. for some, just user name might suffice. |
| 398 | */ |
| 399 | static int |
Shirish Pargaonkar | f7c5445 | 2010-10-26 18:10:24 -0500 | [diff] [blame] | 400 | find_domain_name(struct cifsSesInfo *ses, const struct nls_table *nls_cp) |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 401 | { |
| 402 | unsigned int attrsize; |
| 403 | unsigned int type; |
| 404 | unsigned int onesize = sizeof(struct ntlmssp2_name); |
| 405 | unsigned char *blobptr; |
| 406 | unsigned char *blobend; |
| 407 | struct ntlmssp2_name *attrptr; |
| 408 | |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 409 | if (!ses->auth_key.len || !ses->auth_key.response) |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 410 | return 0; |
| 411 | |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 412 | blobptr = ses->auth_key.response; |
| 413 | blobend = blobptr + ses->auth_key.len; |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 414 | |
| 415 | while (blobptr + onesize < blobend) { |
| 416 | attrptr = (struct ntlmssp2_name *) blobptr; |
| 417 | type = le16_to_cpu(attrptr->type); |
| 418 | if (type == NTLMSSP_AV_EOL) |
| 419 | break; |
| 420 | blobptr += 2; /* advance attr type */ |
| 421 | attrsize = le16_to_cpu(attrptr->length); |
| 422 | blobptr += 2; /* advance attr size */ |
| 423 | if (blobptr + attrsize > blobend) |
| 424 | break; |
| 425 | if (type == NTLMSSP_AV_NB_DOMAIN_NAME) { |
| 426 | if (!attrsize) |
| 427 | break; |
| 428 | if (!ses->domainName) { |
| 429 | ses->domainName = |
| 430 | kmalloc(attrsize + 1, GFP_KERNEL); |
| 431 | if (!ses->domainName) |
| 432 | return -ENOMEM; |
| 433 | cifs_from_ucs2(ses->domainName, |
| 434 | (__le16 *)blobptr, attrsize, attrsize, |
Shirish Pargaonkar | f7c5445 | 2010-10-26 18:10:24 -0500 | [diff] [blame] | 435 | nls_cp, false); |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 436 | break; |
| 437 | } |
| 438 | } |
| 439 | blobptr += attrsize; /* advance attr value */ |
| 440 | } |
| 441 | |
| 442 | return 0; |
| 443 | } |
| 444 | |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 445 | static int calc_ntlmv2_hash(struct cifsSesInfo *ses, char *ntlmv2_hash, |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 446 | const struct nls_table *nls_cp) |
Steve French | a8ee034 | 2006-06-05 23:34:19 +0000 | [diff] [blame] | 447 | { |
| 448 | int rc = 0; |
| 449 | int len; |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 450 | char nt_hash[CIFS_NTHASH_SIZE]; |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 451 | wchar_t *user; |
| 452 | wchar_t *domain; |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 453 | wchar_t *server; |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 454 | |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 455 | if (!ses->server->secmech.sdeschmacmd5) { |
| 456 | cERROR(1, "calc_ntlmv2_hash: can't generate ntlmv2 hash\n"); |
| 457 | return -1; |
| 458 | } |
Steve French | a8ee034 | 2006-06-05 23:34:19 +0000 | [diff] [blame] | 459 | |
| 460 | /* calculate md4 hash of password */ |
| 461 | E_md4hash(ses->password, nt_hash); |
| 462 | |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 463 | crypto_shash_setkey(ses->server->secmech.hmacmd5, nt_hash, |
| 464 | CIFS_NTHASH_SIZE); |
| 465 | |
| 466 | rc = crypto_shash_init(&ses->server->secmech.sdeschmacmd5->shash); |
| 467 | if (rc) { |
| 468 | cERROR(1, "calc_ntlmv2_hash: could not init hmacmd5\n"); |
| 469 | return rc; |
| 470 | } |
Steve French | a8ee034 | 2006-06-05 23:34:19 +0000 | [diff] [blame] | 471 | |
Steve French | 8727c8a | 2011-02-25 01:11:56 -0600 | [diff] [blame^] | 472 | /* convert ses->user_name to unicode and uppercase */ |
| 473 | len = strlen(ses->user_name); |
Steve French | 1717ffc | 2006-06-08 05:41:32 +0000 | [diff] [blame] | 474 | user = kmalloc(2 + (len * 2), GFP_KERNEL); |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 475 | if (user == NULL) { |
| 476 | cERROR(1, "calc_ntlmv2_hash: user mem alloc failure\n"); |
| 477 | rc = -ENOMEM; |
Steve French | 1717ffc | 2006-06-08 05:41:32 +0000 | [diff] [blame] | 478 | goto calc_exit_2; |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 479 | } |
Steve French | 8727c8a | 2011-02-25 01:11:56 -0600 | [diff] [blame^] | 480 | len = cifs_strtoUCS((__le16 *)user, ses->user_name, len, nls_cp); |
Steve French | 1717ffc | 2006-06-08 05:41:32 +0000 | [diff] [blame] | 481 | UniStrupr(user); |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 482 | |
| 483 | crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash, |
| 484 | (char *)user, 2 * len); |
Steve French | a8ee034 | 2006-06-05 23:34:19 +0000 | [diff] [blame] | 485 | |
| 486 | /* convert ses->domainName to unicode and uppercase */ |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 487 | if (ses->domainName) { |
Steve French | 1717ffc | 2006-06-08 05:41:32 +0000 | [diff] [blame] | 488 | len = strlen(ses->domainName); |
Steve French | a8ee034 | 2006-06-05 23:34:19 +0000 | [diff] [blame] | 489 | |
Steve French | 50c2f75 | 2007-07-13 00:33:32 +0000 | [diff] [blame] | 490 | domain = kmalloc(2 + (len * 2), GFP_KERNEL); |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 491 | if (domain == NULL) { |
| 492 | cERROR(1, "calc_ntlmv2_hash: domain mem alloc failure"); |
| 493 | rc = -ENOMEM; |
Steve French | 1717ffc | 2006-06-08 05:41:32 +0000 | [diff] [blame] | 494 | goto calc_exit_1; |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 495 | } |
Cyril Gorcunov | 8f2376a | 2007-10-14 17:58:43 +0000 | [diff] [blame] | 496 | len = cifs_strtoUCS((__le16 *)domain, ses->domainName, len, |
| 497 | nls_cp); |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 498 | crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash, |
| 499 | (char *)domain, 2 * len); |
Steve French | 1717ffc | 2006-06-08 05:41:32 +0000 | [diff] [blame] | 500 | kfree(domain); |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 501 | } else if (ses->serverName) { |
| 502 | len = strlen(ses->serverName); |
| 503 | |
| 504 | server = kmalloc(2 + (len * 2), GFP_KERNEL); |
| 505 | if (server == NULL) { |
| 506 | cERROR(1, "calc_ntlmv2_hash: server mem alloc failure"); |
| 507 | rc = -ENOMEM; |
| 508 | goto calc_exit_1; |
| 509 | } |
| 510 | len = cifs_strtoUCS((__le16 *)server, ses->serverName, len, |
| 511 | nls_cp); |
| 512 | crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash, |
| 513 | (char *)server, 2 * len); |
| 514 | kfree(server); |
Steve French | 1717ffc | 2006-06-08 05:41:32 +0000 | [diff] [blame] | 515 | } |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 516 | |
| 517 | rc = crypto_shash_final(&ses->server->secmech.sdeschmacmd5->shash, |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 518 | ntlmv2_hash); |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 519 | |
Steve French | 1717ffc | 2006-06-08 05:41:32 +0000 | [diff] [blame] | 520 | calc_exit_1: |
| 521 | kfree(user); |
| 522 | calc_exit_2: |
Steve French | a8ee034 | 2006-06-05 23:34:19 +0000 | [diff] [blame] | 523 | return rc; |
| 524 | } |
| 525 | |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 526 | static int |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 527 | CalcNTLMv2_response(const struct cifsSesInfo *ses, char *ntlmv2_hash) |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 528 | { |
| 529 | int rc; |
| 530 | unsigned int offset = CIFS_SESS_KEY_SIZE + 8; |
| 531 | |
| 532 | if (!ses->server->secmech.sdeschmacmd5) { |
| 533 | cERROR(1, "calc_ntlmv2_hash: can't generate ntlmv2 hash\n"); |
| 534 | return -1; |
| 535 | } |
| 536 | |
| 537 | crypto_shash_setkey(ses->server->secmech.hmacmd5, |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 538 | ntlmv2_hash, CIFS_HMAC_MD5_HASH_SIZE); |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 539 | |
| 540 | rc = crypto_shash_init(&ses->server->secmech.sdeschmacmd5->shash); |
| 541 | if (rc) { |
| 542 | cERROR(1, "CalcNTLMv2_response: could not init hmacmd5"); |
| 543 | return rc; |
| 544 | } |
| 545 | |
Shirish Pargaonkar | d3ba50b | 2010-10-27 15:20:36 -0500 | [diff] [blame] | 546 | if (ses->server->secType == RawNTLMSSP) |
| 547 | memcpy(ses->auth_key.response + offset, |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 548 | ses->ntlmssp->cryptkey, CIFS_SERVER_CHALLENGE_SIZE); |
Shirish Pargaonkar | d3ba50b | 2010-10-27 15:20:36 -0500 | [diff] [blame] | 549 | else |
| 550 | memcpy(ses->auth_key.response + offset, |
| 551 | ses->server->cryptkey, CIFS_SERVER_CHALLENGE_SIZE); |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 552 | crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash, |
| 553 | ses->auth_key.response + offset, ses->auth_key.len - offset); |
| 554 | |
| 555 | rc = crypto_shash_final(&ses->server->secmech.sdeschmacmd5->shash, |
| 556 | ses->auth_key.response + CIFS_SESS_KEY_SIZE); |
| 557 | |
| 558 | return rc; |
| 559 | } |
| 560 | |
| 561 | |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 562 | int |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 563 | setup_ntlmv2_rsp(struct cifsSesInfo *ses, const struct nls_table *nls_cp) |
Steve French | 9fbc590 | 2010-08-20 20:42:26 +0000 | [diff] [blame] | 564 | { |
Steve French | c8e56f1 | 2010-09-08 21:10:58 +0000 | [diff] [blame] | 565 | int rc; |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 566 | int baselen; |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 567 | unsigned int tilen; |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 568 | struct ntlmv2_resp *buf; |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 569 | char ntlmv2_hash[16]; |
| 570 | unsigned char *tiblob = NULL; /* target info blob */ |
Steve French | 6d027cf | 2006-06-05 16:26:05 +0000 | [diff] [blame] | 571 | |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 572 | if (ses->server->secType == RawNTLMSSP) { |
| 573 | if (!ses->domainName) { |
Shirish Pargaonkar | f7c5445 | 2010-10-26 18:10:24 -0500 | [diff] [blame] | 574 | rc = find_domain_name(ses, nls_cp); |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 575 | if (rc) { |
| 576 | cERROR(1, "error %d finding domain name", rc); |
| 577 | goto setup_ntlmv2_rsp_ret; |
| 578 | } |
| 579 | } |
| 580 | } else { |
Shirish Pargaonkar | 9daa42e | 2010-10-10 13:21:05 -0500 | [diff] [blame] | 581 | rc = build_avpair_blob(ses, nls_cp); |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 582 | if (rc) { |
| 583 | cERROR(1, "error %d building av pair blob", rc); |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 584 | goto setup_ntlmv2_rsp_ret; |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 585 | } |
| 586 | } |
Steve French | a8ee034 | 2006-06-05 23:34:19 +0000 | [diff] [blame] | 587 | |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 588 | baselen = CIFS_SESS_KEY_SIZE + sizeof(struct ntlmv2_resp); |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 589 | tilen = ses->auth_key.len; |
| 590 | tiblob = ses->auth_key.response; |
| 591 | |
| 592 | ses->auth_key.response = kmalloc(baselen + tilen, GFP_KERNEL); |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 593 | if (!ses->auth_key.response) { |
| 594 | rc = ENOMEM; |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 595 | ses->auth_key.len = 0; |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 596 | cERROR(1, "%s: Can't allocate auth blob", __func__); |
| 597 | goto setup_ntlmv2_rsp_ret; |
| 598 | } |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 599 | ses->auth_key.len += baselen; |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 600 | |
| 601 | buf = (struct ntlmv2_resp *) |
| 602 | (ses->auth_key.response + CIFS_SESS_KEY_SIZE); |
| 603 | buf->blob_signature = cpu_to_le32(0x00000101); |
| 604 | buf->reserved = 0; |
| 605 | buf->time = cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME)); |
| 606 | get_random_bytes(&buf->client_chal, sizeof(buf->client_chal)); |
| 607 | buf->reserved2 = 0; |
| 608 | |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 609 | memcpy(ses->auth_key.response + baselen, tiblob, tilen); |
Shirish Pargaonkar | 21e7339 | 2010-10-21 06:42:55 -0500 | [diff] [blame] | 610 | |
Shirish Pargaonkar | f7c5445 | 2010-10-26 18:10:24 -0500 | [diff] [blame] | 611 | /* calculate ntlmv2_hash */ |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 612 | rc = calc_ntlmv2_hash(ses, ntlmv2_hash, nls_cp); |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 613 | if (rc) { |
Joe Perches | b6b38f7 | 2010-04-21 03:50:45 +0000 | [diff] [blame] | 614 | cERROR(1, "could not get v2 hash rc %d", rc); |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 615 | goto setup_ntlmv2_rsp_ret; |
| 616 | } |
Shirish Pargaonkar | f7c5445 | 2010-10-26 18:10:24 -0500 | [diff] [blame] | 617 | |
| 618 | /* calculate first part of the client response (CR1) */ |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 619 | rc = CalcNTLMv2_response(ses, ntlmv2_hash); |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 620 | if (rc) { |
| 621 | cERROR(1, "Could not calculate CR1 rc: %d", rc); |
| 622 | goto setup_ntlmv2_rsp_ret; |
| 623 | } |
Steve French | b609f06 | 2007-07-09 07:55:14 +0000 | [diff] [blame] | 624 | |
Shirish Pargaonkar | 5d0d288 | 2010-10-13 18:15:00 -0500 | [diff] [blame] | 625 | /* now calculate the session key for NTLMv2 */ |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 626 | crypto_shash_setkey(ses->server->secmech.hmacmd5, |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 627 | ntlmv2_hash, CIFS_HMAC_MD5_HASH_SIZE); |
Shirish Pargaonkar | 307fbd3 | 2010-10-21 14:25:17 -0500 | [diff] [blame] | 628 | |
| 629 | rc = crypto_shash_init(&ses->server->secmech.sdeschmacmd5->shash); |
| 630 | if (rc) { |
| 631 | cERROR(1, "%s: Could not init hmacmd5\n", __func__); |
| 632 | goto setup_ntlmv2_rsp_ret; |
| 633 | } |
| 634 | |
| 635 | crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash, |
| 636 | ses->auth_key.response + CIFS_SESS_KEY_SIZE, |
| 637 | CIFS_HMAC_MD5_HASH_SIZE); |
| 638 | |
| 639 | rc = crypto_shash_final(&ses->server->secmech.sdeschmacmd5->shash, |
| 640 | ses->auth_key.response); |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 641 | |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 642 | setup_ntlmv2_rsp_ret: |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 643 | kfree(tiblob); |
Shirish Pargaonkar | 2b149f1 | 2010-09-18 22:02:18 -0500 | [diff] [blame] | 644 | |
| 645 | return rc; |
Steve French | 6d027cf | 2006-06-05 16:26:05 +0000 | [diff] [blame] | 646 | } |
| 647 | |
Shirish Pargaonkar | d2b9152 | 2010-10-21 14:25:08 -0500 | [diff] [blame] | 648 | int |
| 649 | calc_seckey(struct cifsSesInfo *ses) |
| 650 | { |
| 651 | int rc; |
| 652 | struct crypto_blkcipher *tfm_arc4; |
| 653 | struct scatterlist sgin, sgout; |
| 654 | struct blkcipher_desc desc; |
| 655 | unsigned char sec_key[CIFS_SESS_KEY_SIZE]; /* a nonce */ |
| 656 | |
| 657 | get_random_bytes(sec_key, CIFS_SESS_KEY_SIZE); |
| 658 | |
| 659 | tfm_arc4 = crypto_alloc_blkcipher("ecb(arc4)", 0, CRYPTO_ALG_ASYNC); |
Shirish Pargaonkar | 7a8587e | 2011-01-29 13:54:58 -0600 | [diff] [blame] | 660 | if (IS_ERR(tfm_arc4)) { |
| 661 | rc = PTR_ERR(tfm_arc4); |
Shirish Pargaonkar | d2b9152 | 2010-10-21 14:25:08 -0500 | [diff] [blame] | 662 | cERROR(1, "could not allocate crypto API arc4\n"); |
Shirish Pargaonkar | 7a8587e | 2011-01-29 13:54:58 -0600 | [diff] [blame] | 663 | return rc; |
Shirish Pargaonkar | d2b9152 | 2010-10-21 14:25:08 -0500 | [diff] [blame] | 664 | } |
| 665 | |
| 666 | desc.tfm = tfm_arc4; |
| 667 | |
| 668 | crypto_blkcipher_setkey(tfm_arc4, ses->auth_key.response, |
| 669 | CIFS_SESS_KEY_SIZE); |
| 670 | |
| 671 | sg_init_one(&sgin, sec_key, CIFS_SESS_KEY_SIZE); |
Shirish Pargaonkar | d3686d5 | 2010-10-28 09:53:07 -0500 | [diff] [blame] | 672 | sg_init_one(&sgout, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE); |
Shirish Pargaonkar | d2b9152 | 2010-10-21 14:25:08 -0500 | [diff] [blame] | 673 | |
| 674 | rc = crypto_blkcipher_encrypt(&desc, &sgout, &sgin, CIFS_CPHTXT_SIZE); |
| 675 | if (rc) { |
| 676 | cERROR(1, "could not encrypt session key rc: %d\n", rc); |
| 677 | crypto_free_blkcipher(tfm_arc4); |
| 678 | return rc; |
| 679 | } |
| 680 | |
| 681 | /* make secondary_key/nonce as session key */ |
| 682 | memcpy(ses->auth_key.response, sec_key, CIFS_SESS_KEY_SIZE); |
| 683 | /* and make len as that of session key only */ |
| 684 | ses->auth_key.len = CIFS_SESS_KEY_SIZE; |
| 685 | |
| 686 | crypto_free_blkcipher(tfm_arc4); |
| 687 | |
| 688 | return 0; |
| 689 | } |
| 690 | |
| 691 | void |
| 692 | cifs_crypto_shash_release(struct TCP_Server_Info *server) |
| 693 | { |
| 694 | if (server->secmech.md5) |
| 695 | crypto_free_shash(server->secmech.md5); |
| 696 | |
| 697 | if (server->secmech.hmacmd5) |
| 698 | crypto_free_shash(server->secmech.hmacmd5); |
| 699 | |
| 700 | kfree(server->secmech.sdeschmacmd5); |
| 701 | |
| 702 | kfree(server->secmech.sdescmd5); |
| 703 | } |
| 704 | |
| 705 | int |
| 706 | cifs_crypto_shash_allocate(struct TCP_Server_Info *server) |
| 707 | { |
| 708 | int rc; |
| 709 | unsigned int size; |
| 710 | |
| 711 | server->secmech.hmacmd5 = crypto_alloc_shash("hmac(md5)", 0, 0); |
Shirish Pargaonkar | ee2c925 | 2011-01-27 09:58:04 -0600 | [diff] [blame] | 712 | if (IS_ERR(server->secmech.hmacmd5)) { |
Shirish Pargaonkar | d2b9152 | 2010-10-21 14:25:08 -0500 | [diff] [blame] | 713 | cERROR(1, "could not allocate crypto hmacmd5\n"); |
| 714 | return PTR_ERR(server->secmech.hmacmd5); |
| 715 | } |
| 716 | |
| 717 | server->secmech.md5 = crypto_alloc_shash("md5", 0, 0); |
Shirish Pargaonkar | ee2c925 | 2011-01-27 09:58:04 -0600 | [diff] [blame] | 718 | if (IS_ERR(server->secmech.md5)) { |
Shirish Pargaonkar | d2b9152 | 2010-10-21 14:25:08 -0500 | [diff] [blame] | 719 | cERROR(1, "could not allocate crypto md5\n"); |
| 720 | rc = PTR_ERR(server->secmech.md5); |
| 721 | goto crypto_allocate_md5_fail; |
| 722 | } |
| 723 | |
| 724 | size = sizeof(struct shash_desc) + |
| 725 | crypto_shash_descsize(server->secmech.hmacmd5); |
| 726 | server->secmech.sdeschmacmd5 = kmalloc(size, GFP_KERNEL); |
| 727 | if (!server->secmech.sdeschmacmd5) { |
| 728 | cERROR(1, "cifs_crypto_shash_allocate: can't alloc hmacmd5\n"); |
| 729 | rc = -ENOMEM; |
| 730 | goto crypto_allocate_hmacmd5_sdesc_fail; |
| 731 | } |
| 732 | server->secmech.sdeschmacmd5->shash.tfm = server->secmech.hmacmd5; |
| 733 | server->secmech.sdeschmacmd5->shash.flags = 0x0; |
| 734 | |
| 735 | |
| 736 | size = sizeof(struct shash_desc) + |
| 737 | crypto_shash_descsize(server->secmech.md5); |
| 738 | server->secmech.sdescmd5 = kmalloc(size, GFP_KERNEL); |
| 739 | if (!server->secmech.sdescmd5) { |
| 740 | cERROR(1, "cifs_crypto_shash_allocate: can't alloc md5\n"); |
| 741 | rc = -ENOMEM; |
| 742 | goto crypto_allocate_md5_sdesc_fail; |
| 743 | } |
| 744 | server->secmech.sdescmd5->shash.tfm = server->secmech.md5; |
| 745 | server->secmech.sdescmd5->shash.flags = 0x0; |
| 746 | |
| 747 | return 0; |
| 748 | |
| 749 | crypto_allocate_md5_sdesc_fail: |
| 750 | kfree(server->secmech.sdeschmacmd5); |
| 751 | |
| 752 | crypto_allocate_hmacmd5_sdesc_fail: |
| 753 | crypto_free_shash(server->secmech.md5); |
| 754 | |
| 755 | crypto_allocate_md5_fail: |
| 756 | crypto_free_shash(server->secmech.hmacmd5); |
| 757 | |
| 758 | return rc; |
| 759 | } |