1 // SPDX-License-Identifier: LGPL-2.1 2 /* 3 * 4 * Copyright (C) International Business Machines Corp., 2002, 2011 5 * Etersoft, 2012 6 * Author(s): Steve French (sfrench@us.ibm.com) 7 * Jeremy Allison (jra@samba.org) 2006 8 * Pavel Shilovsky (pshilovsky@samba.org) 2012 9 * 10 */ 11 12 #include <linux/fs.h> 13 #include <linux/list.h> 14 #include <linux/wait.h> 15 #include <linux/net.h> 16 #include <linux/delay.h> 17 #include <linux/uaccess.h> 18 #include <asm/processor.h> 19 #include <linux/mempool.h> 20 #include <linux/highmem.h> 21 #include <crypto/aead.h> 22 #include <crypto/aes-cbc-macs.h> 23 #include <crypto/sha2.h> 24 #include <crypto/utils.h> 25 #include "cifsglob.h" 26 #include "cifsproto.h" 27 #include "smb2proto.h" 28 #include "cifs_debug.h" 29 #include "../common/smb2status.h" 30 #include "smb2glob.h" 31 32 static 33 int smb3_get_sign_key(__u64 ses_id, struct TCP_Server_Info *server, u8 *key) 34 { 35 struct cifs_chan *chan; 36 struct TCP_Server_Info *pserver; 37 struct cifs_ses *ses = NULL; 38 int i; 39 int rc = 0; 40 bool is_binding = false; 41 42 spin_lock(&cifs_tcp_ses_lock); 43 44 /* If server is a channel, select the primary channel */ 45 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 46 47 list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { 48 if (ses->Suid == ses_id) 49 goto found; 50 } 51 trace_smb3_ses_not_found(ses_id); 52 cifs_server_dbg(FYI, "%s: Could not find session 0x%llx\n", 53 __func__, ses_id); 54 rc = -ENOENT; 55 goto out; 56 57 found: 58 spin_lock(&ses->ses_lock); 59 spin_lock(&ses->chan_lock); 60 61 is_binding = (cifs_chan_needs_reconnect(ses, server) && 62 ses->ses_status == SES_GOOD); 63 if (is_binding) { 64 /* 65 * If we are in the process of binding a new channel 66 * to an existing session, use the master connection 67 * session key 68 */ 69 memcpy(key, ses->smb3signingkey, SMB3_SIGN_KEY_SIZE); 70 spin_unlock(&ses->chan_lock); 71 spin_unlock(&ses->ses_lock); 72 goto out; 73 } 74 75 /* 76 * Otherwise, use the channel key. 77 */ 78 79 for (i = 0; i < ses->chan_count; i++) { 80 chan = ses->chans + i; 81 if (chan->server == server) { 82 memcpy(key, chan->signkey, SMB3_SIGN_KEY_SIZE); 83 spin_unlock(&ses->chan_lock); 84 spin_unlock(&ses->ses_lock); 85 goto out; 86 } 87 } 88 spin_unlock(&ses->chan_lock); 89 spin_unlock(&ses->ses_lock); 90 91 cifs_dbg(VFS, 92 "%s: Could not find channel signing key for session 0x%llx\n", 93 __func__, ses_id); 94 rc = -ENOENT; 95 96 out: 97 spin_unlock(&cifs_tcp_ses_lock); 98 return rc; 99 } 100 101 static struct cifs_ses * 102 smb2_find_smb_ses_unlocked(struct TCP_Server_Info *server, __u64 ses_id) 103 { 104 struct TCP_Server_Info *pserver; 105 struct cifs_ses *ses; 106 107 /* If server is a channel, select the primary channel */ 108 pserver = SERVER_IS_CHAN(server) ? server->primary_server : server; 109 110 list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { 111 if (ses->Suid != ses_id) 112 continue; 113 114 spin_lock(&ses->ses_lock); 115 if (ses->ses_status == SES_EXITING) { 116 spin_unlock(&ses->ses_lock); 117 continue; 118 } 119 cifs_smb_ses_inc_refcount(ses); 120 spin_unlock(&ses->ses_lock); 121 return ses; 122 } 123 124 return NULL; 125 } 126 127 static int smb2_get_sign_key(struct TCP_Server_Info *server, 128 __u64 ses_id, u8 *key) 129 { 130 struct cifs_ses *ses; 131 int rc = -ENOENT; 132 133 if (SERVER_IS_CHAN(server)) 134 server = server->primary_server; 135 136 spin_lock(&cifs_tcp_ses_lock); 137 list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { 138 if (ses->Suid != ses_id) 139 continue; 140 141 rc = 0; 142 spin_lock(&ses->ses_lock); 143 switch (ses->ses_status) { 144 case SES_EXITING: /* SMB2_LOGOFF */ 145 case SES_GOOD: 146 if (likely(ses->auth_key.response)) { 147 memcpy(key, ses->auth_key.response, 148 SMB2_NTLMV2_SESSKEY_SIZE); 149 } else { 150 rc = smb_EIO(smb_eio_trace_no_auth_key); 151 } 152 break; 153 default: 154 rc = -EAGAIN; 155 break; 156 } 157 spin_unlock(&ses->ses_lock); 158 break; 159 } 160 spin_unlock(&cifs_tcp_ses_lock); 161 return rc; 162 } 163 164 static struct cifs_tcon * 165 smb2_find_smb_sess_tcon_unlocked(struct cifs_ses *ses, __u32 tid) 166 { 167 struct cifs_tcon *tcon; 168 169 list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { 170 if (tcon->tid != tid) 171 continue; 172 spin_lock(&tcon->tc_lock); 173 ++tcon->tc_count; 174 spin_unlock(&tcon->tc_lock); 175 trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, 176 netfs_trace_tcon_ref_get_find_sess_tcon); 177 return tcon; 178 } 179 180 return NULL; 181 } 182 183 /* 184 * Obtain tcon corresponding to the tid in the given 185 * cifs_ses 186 */ 187 188 struct cifs_tcon * 189 smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32 tid) 190 { 191 struct cifs_ses *ses; 192 struct cifs_tcon *tcon; 193 194 spin_lock(&cifs_tcp_ses_lock); 195 ses = smb2_find_smb_ses_unlocked(server, ses_id); 196 if (!ses) { 197 spin_unlock(&cifs_tcp_ses_lock); 198 return NULL; 199 } 200 tcon = smb2_find_smb_sess_tcon_unlocked(ses, tid); 201 spin_unlock(&cifs_tcp_ses_lock); 202 /* tcon already has a ref to ses, so we don't need ses anymore */ 203 cifs_put_smb_ses(ses); 204 205 return tcon; 206 } 207 208 static int 209 smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server) 210 { 211 int rc; 212 unsigned char smb2_signature[SMB2_HMACSHA256_SIZE]; 213 struct kvec *iov = rqst->rq_iov; 214 struct smb2_hdr *shdr = (struct smb2_hdr *)iov[0].iov_base; 215 struct hmac_sha256_ctx hmac_ctx; 216 struct smb_rqst drqst; 217 __u64 sid = le64_to_cpu(shdr->SessionId); 218 u8 key[SMB2_NTLMV2_SESSKEY_SIZE]; 219 220 rc = smb2_get_sign_key(server, sid, key); 221 if (unlikely(rc)) { 222 cifs_server_dbg(FYI, "%s: [sesid=0x%llx] couldn't find signing key: %d\n", 223 __func__, sid, rc); 224 return rc; 225 } 226 227 memset(smb2_signature, 0x0, SMB2_HMACSHA256_SIZE); 228 memset(shdr->Signature, 0x0, SMB2_SIGNATURE_SIZE); 229 230 hmac_sha256_init_usingrawkey(&hmac_ctx, key, sizeof(key)); 231 232 /* 233 * For SMB2+, __cifs_calc_signature() expects to sign only the actual 234 * data, that is, iov[0] should not contain a rfc1002 length. 235 * 236 * Sign the rfc1002 length prior to passing the data (iov[1-N]) down to 237 * __cifs_calc_signature(). 238 */ 239 drqst = *rqst; 240 if (drqst.rq_nvec >= 2 && iov[0].iov_len == 4) { 241 hmac_sha256_update(&hmac_ctx, iov[0].iov_base, iov[0].iov_len); 242 drqst.rq_iov++; 243 drqst.rq_nvec--; 244 } 245 246 rc = __cifs_calc_signature( 247 &drqst, server, smb2_signature, 248 &(struct cifs_calc_sig_ctx){ .hmac = &hmac_ctx }); 249 if (!rc) 250 memcpy(shdr->Signature, smb2_signature, SMB2_SIGNATURE_SIZE); 251 252 memzero_explicit(key, sizeof(key)); 253 memzero_explicit(&hmac_ctx, sizeof(hmac_ctx)); 254 return rc; 255 } 256 257 static void generate_key(struct cifs_ses *ses, struct kvec label, 258 struct kvec context, __u8 *key, unsigned int key_size, 259 unsigned int full_key_size) 260 { 261 unsigned char zero = 0x0; 262 __u8 i[4] = {0, 0, 0, 1}; 263 __u8 L128[4] = {0, 0, 0, 128}; 264 __u8 L256[4] = {0, 0, 1, 0}; 265 unsigned char prfhash[SMB2_HMACSHA256_SIZE]; 266 struct TCP_Server_Info *server = ses->server; 267 struct hmac_sha256_ctx hmac_ctx; 268 269 memset(prfhash, 0x0, SMB2_HMACSHA256_SIZE); 270 memset(key, 0x0, key_size); 271 272 hmac_sha256_init_usingrawkey(&hmac_ctx, ses->auth_key.response, 273 full_key_size); 274 hmac_sha256_update(&hmac_ctx, i, 4); 275 hmac_sha256_update(&hmac_ctx, label.iov_base, label.iov_len); 276 hmac_sha256_update(&hmac_ctx, &zero, 1); 277 hmac_sha256_update(&hmac_ctx, context.iov_base, context.iov_len); 278 279 if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) || 280 (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) { 281 hmac_sha256_update(&hmac_ctx, L256, 4); 282 } else { 283 hmac_sha256_update(&hmac_ctx, L128, 4); 284 } 285 hmac_sha256_final(&hmac_ctx, prfhash); 286 287 memcpy(key, prfhash, key_size); 288 memzero_explicit(prfhash, sizeof(prfhash)); 289 } 290 291 struct derivation { 292 struct kvec label; 293 struct kvec context; 294 }; 295 296 struct derivation_triplet { 297 struct derivation signing; 298 struct derivation encryption; 299 struct derivation decryption; 300 }; 301 302 static int 303 generate_smb3signingkey(struct cifs_ses *ses, 304 struct TCP_Server_Info *server, 305 const struct derivation_triplet *ptriplet) 306 { 307 unsigned int full_key_size = SMB2_NTLMV2_SESSKEY_SIZE; 308 bool is_binding = false; 309 int chan_index = 0; 310 311 spin_lock(&ses->ses_lock); 312 spin_lock(&ses->chan_lock); 313 is_binding = (cifs_chan_needs_reconnect(ses, server) && 314 ses->ses_status == SES_GOOD); 315 316 chan_index = cifs_ses_get_chan_index(ses, server); 317 if (chan_index == CIFS_INVAL_CHAN_INDEX) { 318 spin_unlock(&ses->chan_lock); 319 spin_unlock(&ses->ses_lock); 320 321 return -EINVAL; 322 } 323 324 spin_unlock(&ses->chan_lock); 325 spin_unlock(&ses->ses_lock); 326 327 /* 328 * All channels use the same encryption/decryption keys but 329 * they have their own signing key. 330 * 331 * When we generate the keys, check if it is for a new channel 332 * (binding) in which case we only need to generate a signing 333 * key and store it in the channel as to not overwrite the 334 * master connection signing key stored in the session 335 */ 336 337 if (is_binding) { 338 generate_key(ses, ptriplet->signing.label, 339 ptriplet->signing.context, 340 ses->chans[chan_index].signkey, SMB3_SIGN_KEY_SIZE, 341 SMB2_NTLMV2_SESSKEY_SIZE); 342 } else { 343 generate_key(ses, ptriplet->signing.label, 344 ptriplet->signing.context, ses->smb3signingkey, 345 SMB3_SIGN_KEY_SIZE, SMB2_NTLMV2_SESSKEY_SIZE); 346 347 /* 348 * Per MS-SMB2 3.2.5.3.1, signing key always uses Session.SessionKey 349 * (first 16 bytes). Encryption/decryption keys use 350 * Session.FullSessionKey when dialect is 3.1.1 and cipher is 351 * AES-256-CCM or AES-256-GCM, otherwise Session.SessionKey. 352 */ 353 354 if (server->dialect == SMB311_PROT_ID && 355 (server->cipher_type == SMB2_ENCRYPTION_AES256_CCM || 356 server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) 357 full_key_size = ses->auth_key.len; 358 359 /* safe to access primary channel, since it will never go away */ 360 spin_lock(&ses->chan_lock); 361 memcpy(ses->chans[chan_index].signkey, ses->smb3signingkey, 362 SMB3_SIGN_KEY_SIZE); 363 spin_unlock(&ses->chan_lock); 364 365 generate_key(ses, ptriplet->encryption.label, 366 ptriplet->encryption.context, 367 ses->smb3encryptionkey, SMB3_ENC_DEC_KEY_SIZE, 368 full_key_size); 369 370 generate_key(ses, ptriplet->decryption.label, 371 ptriplet->decryption.context, 372 ses->smb3decryptionkey, SMB3_ENC_DEC_KEY_SIZE, 373 full_key_size); 374 } 375 376 #ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS 377 cifs_dbg(VFS, "%s: dumping generated AES session keys\n", __func__); 378 /* 379 * The session id is opaque in terms of endianness, so we can't 380 * print it as a long long. we dump it as we got it on the wire 381 */ 382 cifs_dbg(VFS, "Session Id %*ph\n", (int)sizeof(ses->Suid), 383 &ses->Suid); 384 cifs_dbg(VFS, "Cipher type %d\n", server->cipher_type); 385 cifs_dbg(VFS, "Session Key %*ph\n", 386 (int)ses->auth_key.len, ses->auth_key.response); 387 cifs_dbg(VFS, "Signing Key %*ph\n", 388 SMB3_SIGN_KEY_SIZE, ses->smb3signingkey); 389 if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) || 390 (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) { 391 cifs_dbg(VFS, "ServerIn Key %*ph\n", 392 SMB3_GCM256_CRYPTKEY_SIZE, ses->smb3encryptionkey); 393 cifs_dbg(VFS, "ServerOut Key %*ph\n", 394 SMB3_GCM256_CRYPTKEY_SIZE, ses->smb3decryptionkey); 395 } else { 396 cifs_dbg(VFS, "ServerIn Key %*ph\n", 397 SMB3_GCM128_CRYPTKEY_SIZE, ses->smb3encryptionkey); 398 cifs_dbg(VFS, "ServerOut Key %*ph\n", 399 SMB3_GCM128_CRYPTKEY_SIZE, ses->smb3decryptionkey); 400 } 401 #endif 402 return 0; 403 } 404 405 int 406 generate_smb30signingkey(struct cifs_ses *ses, 407 struct TCP_Server_Info *server) 408 409 { 410 struct derivation_triplet triplet; 411 struct derivation *d; 412 413 d = &triplet.signing; 414 d->label.iov_base = "SMB2AESCMAC"; 415 d->label.iov_len = 12; 416 d->context.iov_base = "SmbSign"; 417 d->context.iov_len = 8; 418 419 d = &triplet.encryption; 420 d->label.iov_base = "SMB2AESCCM"; 421 d->label.iov_len = 11; 422 d->context.iov_base = "ServerIn "; 423 d->context.iov_len = 10; 424 425 d = &triplet.decryption; 426 d->label.iov_base = "SMB2AESCCM"; 427 d->label.iov_len = 11; 428 d->context.iov_base = "ServerOut"; 429 d->context.iov_len = 10; 430 431 return generate_smb3signingkey(ses, server, &triplet); 432 } 433 434 int 435 generate_smb311signingkey(struct cifs_ses *ses, 436 struct TCP_Server_Info *server) 437 438 { 439 struct derivation_triplet triplet; 440 struct derivation *d; 441 442 d = &triplet.signing; 443 d->label.iov_base = "SMBSigningKey"; 444 d->label.iov_len = 14; 445 d->context.iov_base = ses->preauth_sha_hash; 446 d->context.iov_len = 64; 447 448 d = &triplet.encryption; 449 d->label.iov_base = "SMBC2SCipherKey"; 450 d->label.iov_len = 16; 451 d->context.iov_base = ses->preauth_sha_hash; 452 d->context.iov_len = 64; 453 454 d = &triplet.decryption; 455 d->label.iov_base = "SMBS2CCipherKey"; 456 d->label.iov_len = 16; 457 d->context.iov_base = ses->preauth_sha_hash; 458 d->context.iov_len = 64; 459 460 return generate_smb3signingkey(ses, server, &triplet); 461 } 462 463 static int 464 smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server) 465 { 466 int rc; 467 unsigned char smb3_signature[SMB2_CMACAES_SIZE]; 468 struct kvec *iov = rqst->rq_iov; 469 struct smb2_hdr *shdr = (struct smb2_hdr *)iov[0].iov_base; 470 struct aes_cmac_key cmac_key __cleanup(aes_cmac_zeroize_key); 471 struct aes_cmac_ctx cmac_ctx __cleanup(aes_cmac_zeroize_ctx); 472 struct smb_rqst drqst; 473 u8 key[SMB3_SIGN_KEY_SIZE]; 474 475 if (server->vals->protocol_id <= SMB21_PROT_ID) 476 return smb2_calc_signature(rqst, server); 477 478 rc = smb3_get_sign_key(le64_to_cpu(shdr->SessionId), server, key); 479 if (unlikely(rc)) { 480 cifs_server_dbg(FYI, "%s: Could not get signing key\n", __func__); 481 return rc; 482 } 483 484 memset(smb3_signature, 0x0, SMB2_CMACAES_SIZE); 485 memset(shdr->Signature, 0x0, SMB2_SIGNATURE_SIZE); 486 487 rc = aes_cmac_preparekey(&cmac_key, key, SMB2_CMACAES_SIZE); 488 memzero_explicit(key, sizeof(key)); 489 if (rc) { 490 cifs_server_dbg(VFS, "%s: Could not set key for cmac aes\n", __func__); 491 return rc; 492 } 493 494 aes_cmac_init(&cmac_ctx, &cmac_key); 495 496 /* 497 * For SMB2+, __cifs_calc_signature() expects to sign only the actual 498 * data, that is, iov[0] should not contain a rfc1002 length. 499 * 500 * Sign the rfc1002 length prior to passing the data (iov[1-N]) down to 501 * __cifs_calc_signature(). 502 */ 503 drqst = *rqst; 504 if (drqst.rq_nvec >= 2 && iov[0].iov_len == 4) { 505 aes_cmac_update(&cmac_ctx, iov[0].iov_base, iov[0].iov_len); 506 drqst.rq_iov++; 507 drqst.rq_nvec--; 508 } 509 510 rc = __cifs_calc_signature( 511 &drqst, server, smb3_signature, 512 &(struct cifs_calc_sig_ctx){ .cmac = &cmac_ctx }); 513 if (!rc) 514 memcpy(shdr->Signature, smb3_signature, SMB2_SIGNATURE_SIZE); 515 return rc; 516 } 517 518 /* must be called with server->srv_mutex held */ 519 static int 520 smb2_sign_rqst(struct smb_rqst *rqst, struct TCP_Server_Info *server) 521 { 522 struct smb2_hdr *shdr; 523 struct smb2_sess_setup_req *ssr; 524 bool is_binding; 525 bool is_signed; 526 527 shdr = (struct smb2_hdr *)rqst->rq_iov[0].iov_base; 528 ssr = (struct smb2_sess_setup_req *)shdr; 529 530 is_binding = shdr->Command == SMB2_SESSION_SETUP && 531 (ssr->Flags & SMB2_SESSION_REQ_FLAG_BINDING); 532 is_signed = shdr->Flags & SMB2_FLAGS_SIGNED; 533 534 if (!is_signed) 535 return 0; 536 spin_lock(&server->srv_lock); 537 if (server->ops->need_neg && 538 server->ops->need_neg(server)) { 539 spin_unlock(&server->srv_lock); 540 return 0; 541 } 542 spin_unlock(&server->srv_lock); 543 if (!is_binding && !server->session_estab) { 544 strscpy(shdr->Signature, "BSRSPYL"); 545 return 0; 546 } 547 548 return smb3_calc_signature(rqst, server); 549 } 550 551 int 552 smb2_verify_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server) 553 { 554 unsigned int rc; 555 char server_response_sig[SMB2_SIGNATURE_SIZE]; 556 struct smb2_hdr *shdr = 557 (struct smb2_hdr *)rqst->rq_iov[0].iov_base; 558 559 if ((shdr->Command == SMB2_NEGOTIATE) || 560 (shdr->Command == SMB2_SESSION_SETUP) || 561 (shdr->Command == SMB2_OPLOCK_BREAK) || 562 server->ignore_signature || 563 (!server->session_estab)) 564 return 0; 565 566 /* 567 * BB what if signatures are supposed to be on for session but 568 * server does not send one? BB 569 */ 570 571 /* Do not need to verify session setups with signature "BSRSPYL " */ 572 if (memcmp(shdr->Signature, "BSRSPYL ", 8) == 0) 573 cifs_dbg(FYI, "dummy signature received for smb command 0x%x\n", 574 shdr->Command); 575 576 /* 577 * Save off the original signature so we can modify the smb and check 578 * our calculated signature against what the server sent. 579 */ 580 memcpy(server_response_sig, shdr->Signature, SMB2_SIGNATURE_SIZE); 581 582 memset(shdr->Signature, 0, SMB2_SIGNATURE_SIZE); 583 584 rc = smb3_calc_signature(rqst, server); 585 586 if (rc) 587 return rc; 588 589 if (crypto_memneq(server_response_sig, shdr->Signature, 590 SMB2_SIGNATURE_SIZE)) { 591 cifs_dbg(VFS, "sign fail cmd 0x%x message id 0x%llx\n", 592 shdr->Command, shdr->MessageId); 593 return -EACCES; 594 } else 595 return 0; 596 } 597 598 /* 599 * Set message id for the request. Should be called after wait_for_free_request 600 * and when srv_mutex is held. 601 */ 602 static inline void 603 smb2_seq_num_into_buf(struct TCP_Server_Info *server, 604 struct smb2_hdr *shdr) 605 { 606 unsigned int i, num = le16_to_cpu(shdr->CreditCharge); 607 608 shdr->MessageId = get_next_mid64(server); 609 /* skip message numbers according to CreditCharge field */ 610 for (i = 1; i < num; i++) 611 get_next_mid(server); 612 } 613 614 static struct mid_q_entry * 615 smb2_mid_entry_alloc(const struct smb2_hdr *shdr, 616 struct TCP_Server_Info *server) 617 { 618 struct mid_q_entry *temp; 619 unsigned int credits = le16_to_cpu(shdr->CreditCharge); 620 621 if (server == NULL) { 622 cifs_dbg(VFS, "Null TCP session in smb2_mid_entry_alloc\n"); 623 return NULL; 624 } 625 626 temp = mempool_alloc(&cifs_mid_pool, GFP_NOFS); 627 memset(temp, 0, sizeof(struct mid_q_entry)); 628 refcount_set(&temp->refcount, 1); 629 spin_lock_init(&temp->mid_lock); 630 temp->mid = le64_to_cpu(shdr->MessageId); 631 temp->credits = credits > 0 ? credits : 1; 632 temp->pid = current->pid; 633 temp->command = shdr->Command; /* Always LE */ 634 temp->when_alloc = jiffies; 635 636 /* 637 * The default is for the mid to be synchronous, so the 638 * default callback just wakes up the current task. 639 */ 640 get_task_struct(current); 641 temp->creator = current; 642 temp->callback = cifs_wake_up_task; 643 temp->callback_data = current; 644 645 atomic_inc(&mid_count); 646 temp->mid_state = MID_REQUEST_ALLOCATED; 647 trace_smb3_cmd_enter(le32_to_cpu(shdr->Id.SyncId.TreeId), 648 le64_to_cpu(shdr->SessionId), 649 le16_to_cpu(shdr->Command), temp->mid); 650 return temp; 651 } 652 653 static int 654 smb2_get_mid_entry(struct cifs_ses *ses, struct TCP_Server_Info *server, 655 struct smb2_hdr *shdr, struct mid_q_entry **mid) 656 { 657 switch (READ_ONCE(server->tcpStatus)) { 658 case CifsExiting: 659 return -ENOENT; 660 case CifsNeedReconnect: 661 cifs_dbg(FYI, "tcp session dead - return to caller to retry\n"); 662 return -EAGAIN; 663 case CifsNeedNegotiate: 664 if (shdr->Command != SMB2_NEGOTIATE) 665 return -EAGAIN; 666 break; 667 default: 668 break; 669 } 670 671 switch (READ_ONCE(ses->ses_status)) { 672 case SES_NEW: 673 if (shdr->Command != SMB2_SESSION_SETUP && 674 shdr->Command != SMB2_NEGOTIATE) 675 return -EAGAIN; 676 /* else ok - we are setting up session */ 677 break; 678 case SES_EXITING: 679 if (shdr->Command != SMB2_LOGOFF) 680 return -EAGAIN; 681 /* else ok - we are shutting down the session */ 682 break; 683 default: 684 break; 685 } 686 687 *mid = smb2_mid_entry_alloc(shdr, server); 688 if (*mid == NULL) 689 return -ENOMEM; 690 spin_lock(&server->mid_queue_lock); 691 list_add_tail(&(*mid)->qhead, &server->pending_mid_q); 692 spin_unlock(&server->mid_queue_lock); 693 694 return 0; 695 } 696 697 int 698 smb2_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server, 699 bool log_error) 700 { 701 unsigned int len = mid->resp_buf_size; 702 struct kvec iov[1]; 703 struct smb_rqst rqst = { .rq_iov = iov, 704 .rq_nvec = 1 }; 705 706 iov[0].iov_base = (char *)mid->resp_buf; 707 iov[0].iov_len = len; 708 709 dump_smb(mid->resp_buf, min_t(u32, 80, len)); 710 /* convert the length into a more usable form */ 711 if (len > 24 && server->sign && !mid->decrypted) { 712 int rc; 713 714 rc = smb2_verify_signature(&rqst, server); 715 if (rc) 716 cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n", 717 rc); 718 } 719 720 return map_smb2_to_linux_error(mid->resp_buf, log_error); 721 } 722 723 struct mid_q_entry * 724 smb2_setup_request(struct cifs_ses *ses, struct TCP_Server_Info *server, 725 struct smb_rqst *rqst) 726 { 727 int rc; 728 struct smb2_hdr *shdr = 729 (struct smb2_hdr *)rqst->rq_iov[0].iov_base; 730 struct mid_q_entry *mid; 731 732 smb2_seq_num_into_buf(server, shdr); 733 734 rc = smb2_get_mid_entry(ses, server, shdr, &mid); 735 if (rc) { 736 revert_current_mid_from_hdr(server, shdr); 737 return ERR_PTR(rc); 738 } 739 740 rc = smb2_sign_rqst(rqst, server); 741 if (rc) { 742 revert_current_mid_from_hdr(server, shdr); 743 delete_mid(server, mid); 744 return ERR_PTR(rc); 745 } 746 747 return mid; 748 } 749 750 struct mid_q_entry * 751 smb2_setup_async_request(struct TCP_Server_Info *server, struct smb_rqst *rqst) 752 { 753 int rc; 754 struct smb2_hdr *shdr = 755 (struct smb2_hdr *)rqst->rq_iov[0].iov_base; 756 struct mid_q_entry *mid; 757 758 spin_lock(&server->srv_lock); 759 if (server->tcpStatus == CifsNeedNegotiate && 760 shdr->Command != SMB2_NEGOTIATE) { 761 spin_unlock(&server->srv_lock); 762 return ERR_PTR(-EAGAIN); 763 } 764 spin_unlock(&server->srv_lock); 765 766 smb2_seq_num_into_buf(server, shdr); 767 768 mid = smb2_mid_entry_alloc(shdr, server); 769 if (mid == NULL) { 770 revert_current_mid_from_hdr(server, shdr); 771 return ERR_PTR(-ENOMEM); 772 } 773 774 rc = smb2_sign_rqst(rqst, server); 775 if (rc) { 776 revert_current_mid_from_hdr(server, shdr); 777 release_mid(server, mid); 778 return ERR_PTR(rc); 779 } 780 781 return mid; 782 } 783 784 int 785 smb3_crypto_aead_allocate(struct TCP_Server_Info *server) 786 { 787 struct crypto_aead *tfm; 788 789 if (!server->secmech.enc) { 790 if ((server->cipher_type == SMB2_ENCRYPTION_AES128_GCM) || 791 (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) 792 tfm = crypto_alloc_aead("gcm(aes)", 0, 0); 793 else 794 tfm = crypto_alloc_aead("ccm(aes)", 0, 0); 795 if (IS_ERR(tfm)) { 796 cifs_server_dbg(VFS, "%s: Failed alloc encrypt aead\n", 797 __func__); 798 return PTR_ERR(tfm); 799 } 800 server->secmech.enc = tfm; 801 } 802 803 if (!server->secmech.dec) { 804 if ((server->cipher_type == SMB2_ENCRYPTION_AES128_GCM) || 805 (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) 806 tfm = crypto_alloc_aead("gcm(aes)", 0, 0); 807 else 808 tfm = crypto_alloc_aead("ccm(aes)", 0, 0); 809 if (IS_ERR(tfm)) { 810 crypto_free_aead(server->secmech.enc); 811 server->secmech.enc = NULL; 812 cifs_server_dbg(VFS, "%s: Failed to alloc decrypt aead\n", 813 __func__); 814 return PTR_ERR(tfm); 815 } 816 server->secmech.dec = tfm; 817 } 818 819 return 0; 820 } 821