xref: /illumos-gate/usr/src/uts/common/fs/smbclnt/netsmb/smb_sign.c (revision 142d813a06c6f9a6142e2c276b62129a17a31a65)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
25  */
26 
27 /*
28  * Support for SMB "signing" (message integrity)
29  */
30 
31 #include <sys/param.h>
32 #include <sys/systm.h>
33 #include <sys/conf.h>
34 #include <sys/proc.h>
35 #include <sys/fcntl.h>
36 #include <sys/socket.h>
37 #include <sys/md4.h>
38 #include <sys/md5.h>
39 #include <sys/des.h>
40 #include <sys/kmem.h>
41 #include <sys/cmn_err.h>
42 #include <sys/stream.h>
43 #include <sys/strsun.h>
44 #include <sys/sdt.h>
45 
46 #include <netsmb/smb_osdep.h>
47 #include <netsmb/smb.h>
48 #include <netsmb/smb_conn.h>
49 #include <netsmb/smb_subr.h>
50 #include <netsmb/smb_dev.h>
51 #include <netsmb/smb_rq.h>
52 #include <netsmb/smb_signing.h>
53 
54 #ifdef DEBUG
55 /*
56  * Set this to a small number to debug sequence numbers
57  * that seem to get out of step.
58  */
59 int nsmb_signing_fudge = 0;
60 #endif
61 
62 /*
63  * This is called just after session setup completes,
64  * at the top of smb_iod_vc_work().  Initialize signing.
65  */
66 int
67 smb_sign_init(smb_vc_t *vcp)
68 {
69 	int rc;
70 
71 	ASSERT(vcp->vc_ssnkey != NULL);
72 	ASSERT(vcp->vc_mackey == NULL);
73 
74 	rc = smb_md5_getmech(&vcp->vc_signmech);
75 	if (rc != 0) {
76 		cmn_err(CE_NOTE, "smb can't get signing mechanism");
77 		return (EAUTH);
78 	}
79 
80 	/*
81 	 * Convert the session key to the MAC key.
82 	 * SMB1 uses the whole session key.
83 	 */
84 	vcp->vc_mackeylen = vcp->vc_ssnkeylen;
85 	vcp->vc_mackey = kmem_zalloc(vcp->vc_mackeylen, KM_SLEEP);
86 	bcopy(vcp->vc_ssnkey, vcp->vc_mackey, vcp->vc_mackeylen);
87 
88 	/* The initial sequence number is two. */
89 	vcp->vc_next_seq = 2;
90 
91 	return (0);
92 }
93 
94 
95 #define	SMBSIGLEN	8	/* SMB signature length */
96 #define	SMBSIGOFF	14	/* SMB signature offset */
97 
98 /*
99  * Compute HMAC-MD5 of packet data, using the stored MAC key.
100  *
101  * See similar code for the server side:
102  * uts/common/fs/smbsrv/smb_signing.c : smb_sign_calc
103  */
104 static int
105 smb_compute_MAC(struct smb_vc *vcp, mblk_t *mp,
106 	uint32_t seqno, uchar_t *signature)
107 {
108 	uchar_t digest[MD5_DIGEST_LENGTH];
109 	smb_sign_ctx_t ctx = 0;
110 	mblk_t *m = mp;
111 	int size;
112 	int rc;
113 
114 	/*
115 	 * This union is a little bit of trickery to:
116 	 * (1) get the sequence number int aligned, and
117 	 * (2) reduce the number of digest calls, at the
118 	 * cost of a copying 32 bytes instead of 8.
119 	 * Both sides of this union are 2+32 bytes.
120 	 */
121 	union {
122 		struct {
123 			uint8_t skip[2]; /* not used - just alignment */
124 			uint8_t raw[SMB_HDRLEN];  /* header length (32) */
125 		} r;
126 		struct {
127 			uint8_t skip[2]; /* not used - just alignment */
128 			uint8_t hdr[SMBSIGOFF]; /* sig. offset (14) */
129 			uint32_t sig[2]; /* MAC signature, aligned! */
130 			uint16_t ids[5]; /* pad, Tid, Pid, Uid, Mid */
131 		} s;
132 	} smbhdr;
133 
134 	if (vcp->vc_mackey == NULL)
135 		return (-1);
136 
137 	if ((rc = smb_md5_init(&ctx, &vcp->vc_signmech)) != 0)
138 		return (rc);
139 
140 	/* Digest the MAC Key */
141 	rc = smb_md5_update(ctx, vcp->vc_mackey, vcp->vc_mackeylen);
142 	if (rc != 0)
143 		return (rc);
144 
145 	/* Our caller should ensure mp has a contiguous header */
146 	ASSERT(m != NULL);
147 	ASSERT(MBLKL(m) >= SMB_HDRLEN);
148 
149 	/*
150 	 * Make an aligned copy of the SMB header,
151 	 * fill in the sequence number, and digest.
152 	 */
153 	size = SMB_HDRLEN;
154 	bcopy(m->b_rptr, smbhdr.r.raw, size);
155 	smbhdr.s.sig[0] = htolel(seqno);
156 	smbhdr.s.sig[1] = 0;
157 
158 	rc = smb_md5_update(ctx, &smbhdr.r.raw, size);
159 	if (rc != 0)
160 		return (rc);
161 
162 	/*
163 	 * Digest the rest of the SMB header packet, starting at
164 	 * the data just after the SMB header.
165 	 */
166 	size = MBLKL(m) - SMB_HDRLEN;
167 	rc = smb_md5_update(ctx, m->b_rptr + SMB_HDRLEN, size);
168 	if (rc != 0)
169 		return (rc);
170 	m = m->b_cont;
171 
172 	/* Digest rest of the SMB message. */
173 	while (m != NULL) {
174 		size = MBLKL(m);
175 		if (size > 0) {
176 			rc = smb_md5_update(ctx, m->b_rptr, size);
177 			if (rc != 0)
178 				return (rc);
179 		}
180 		m = m->b_cont;
181 	}
182 	rc = smb_md5_final(ctx, digest);
183 	if (rc != 0)
184 		return (rc);
185 
186 	/*
187 	 * Finally, store the signature.
188 	 * (first 8 bytes of the mac)
189 	 */
190 	if (signature != NULL)
191 		bcopy(digest, signature, SMBSIGLEN);
192 
193 	return (0);
194 }
195 
196 /*
197  * Sign a request with HMAC-MD5.
198  */
199 void
200 smb_rq_sign(struct smb_rq *rqp)
201 {
202 	struct smb_vc *vcp = rqp->sr_vc;
203 	mblk_t *mp = rqp->sr_rq.mb_top;
204 	uint8_t *sigloc;
205 	int status;
206 
207 	/*
208 	 * smb_rq_new() ensures this,
209 	 * but just in case..
210 	 */
211 	ASSERT(MBLKL(mp) >= SMB_HDRLEN);
212 	sigloc = mp->b_rptr + SMBSIGOFF;
213 
214 	if (vcp->vc_mackey == NULL) {
215 		/*
216 		 * Signing is required, but we have no key yet
217 		 * fill in with the magic fake signing value.
218 		 * This happens with SPNEGO, NTLMSSP, ...
219 		 */
220 		bcopy("BSRSPLY", sigloc, 8);
221 		return;
222 	}
223 
224 	/*
225 	 * This will compute the MAC and store it
226 	 * directly into the message at sigloc.
227 	 */
228 	status = smb_compute_MAC(vcp, mp, rqp->sr_seqno, sigloc);
229 	if (status != 0) {
230 		SMBSDEBUG("Crypto error %d", status);
231 		bzero(sigloc, SMBSIGLEN);
232 	}
233 }
234 
235 /*
236  * Verify reply signature.
237  */
238 int
239 smb_rq_verify(struct smb_rq *rqp)
240 {
241 	struct smb_vc *vcp = rqp->sr_vc;
242 	mblk_t *mp = rqp->sr_rp.md_top;
243 	uint8_t sigbuf[SMBSIGLEN];
244 	uint8_t *sigloc;
245 	int fudge, rsn, status;
246 
247 	/*
248 	 * Note vc_mackey and vc_mackeylen gets filled in by
249 	 * smb_usr_iod_work as the connection comes in.
250 	 */
251 	if (vcp->vc_mackey == NULL) {
252 		SMBSDEBUG("no mac key\n");
253 		return (0);
254 	}
255 
256 	/*
257 	 * Let caller deal with empty reply or short messages by
258 	 * returning zero.  Caller will fail later, in parsing.
259 	 */
260 	if (mp == NULL) {
261 		SMBSDEBUG("empty reply\n");
262 		return (0);
263 	}
264 
265 	ASSERT(MBLKL(mp) >= SMB_HDRLEN);
266 	sigloc = mp->b_rptr + SMBSIGOFF;
267 
268 	/*
269 	 * Compute the expected signature in sigbuf.
270 	 */
271 	rsn = rqp->sr_rseqno;
272 	status = smb_compute_MAC(vcp, mp, rsn, sigbuf);
273 	if (status != 0) {
274 		SMBSDEBUG("Crypto error %d", status);
275 		/*
276 		 * If we can't compute a MAC, then there's
277 		 * no point trying other seqno values.
278 		 */
279 		return (EBADRPC);
280 	}
281 
282 	/*
283 	 * Compare the computed signature with the
284 	 * one found in the message (at sigloc)
285 	 */
286 	if (bcmp(sigbuf, sigloc, SMBSIGLEN) == 0)
287 		return (0);
288 
289 	SMBERROR("BAD signature, Server=%s MID=0x%x Seq=%d\n",
290 	    vcp->vc_srvname, rqp->sr_mid, rsn);
291 
292 #ifdef DEBUG
293 	/*
294 	 * For diag purposes, we check whether the client/server idea
295 	 * of the sequence # has gotten a bit out of sync.
296 	 */
297 	for (fudge = 1; fudge <= nsmb_signing_fudge; fudge++) {
298 		(void) smb_compute_MAC(vcp, mp, rsn + fudge, sigbuf);
299 		if (bcmp(sigbuf, sigloc, SMBSIGLEN) == 0)
300 			break;
301 		(void) smb_compute_MAC(vcp, mp, rsn - fudge, sigbuf);
302 		if (bcmp(sigbuf, sigloc, SMBSIGLEN) == 0) {
303 			fudge = -fudge;
304 			break;
305 		}
306 	}
307 	if (fudge <= nsmb_signing_fudge) {
308 		SMBERROR("MID=0x%x, Seq=%d, but %d would have worked\n",
309 		    rqp->sr_mid, rsn, rsn + fudge);
310 	}
311 #endif
312 	return (EBADRPC);
313 }
314