usr/src/uts/common/fs/smbclnt/netsmb/smb_sign.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21
  22 /*
  23  * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
  24  */
  25
  26 /*
  27  * Support for SMB "signing" (message integrity)
  28  */
  29
  30 #include <sys/param.h>
  31 #include <sys/systm.h>
  32 #include <sys/conf.h>
  33 #include <sys/proc.h>
  34 #include <sys/fcntl.h>
  35 #include <sys/socket.h>
  36 #include <sys/md4.h>
  37 #include <sys/md5.h>
  38 #include <sys/des.h>
  39 #include <sys/kmem.h>
  40 #include <sys/crypto/api.h>
  41 #include <sys/crypto/common.h>
  42 #include <sys/cmn_err.h>
  43 #include <sys/stream.h>
  44 #include <sys/strsun.h>
  45 #include <sys/sdt.h>
  46
  47 #include <netsmb/smb_osdep.h>
  48 #include <netsmb/smb.h>
  49 #include <netsmb/smb_conn.h>
  50 #include <netsmb/smb_subr.h>
  51 #include <netsmb/smb_dev.h>
  52 #include <netsmb/smb_rq.h>
  53
  54 #ifdef DEBUG
  55 /*
  56  * Set this to a small number to debug sequence numbers
  57  * that seem to get out of step.
  58  */
  59 int nsmb_signing_fudge = 0;
  60 #endif
  61
  62 /* Mechanism definitions */
  63 static  crypto_mechanism_t crypto_mech_md5 = { CRYPTO_MECH_INVALID };
  64
  65 void
  66 smb_crypto_mech_init(void)
  67 {
  68         crypto_mech_md5.cm_type = crypto_mech2id(SUN_CKM_MD5);
  69 }
  70
  71
  72
  73 #define SMBSIGLEN       8       /* SMB signature length */
  74 #define SMBSIGOFF       14      /* SMB signature offset */
  75
  76 /*
  77  * Compute HMAC-MD5 of packet data, using the stored MAC key.
  78  *
  79  * See similar code for the server side:
  80  * uts/common/fs/smbsrv/smb_signing.c : smb_sign_calc
  81  */
  82 static int
  83 smb_compute_MAC(struct smb_vc *vcp, mblk_t *mp,
  84         uint32_t seqno, uchar_t *signature)
  85 {
  86         crypto_context_t crypto_ctx;
  87         crypto_data_t key;
  88         crypto_data_t data;
  89         crypto_data_t digest;
  90         uchar_t mac[16];
  91         int status;
  92         /*
  93          * This union is a little bit of trickery to:
  94          * (1) get the sequence number int aligned, and
  95          * (2) reduce the number of digest calls, at the
  96          * cost of a copying 32 bytes instead of 8.
  97          * Both sides of this union are 2+32 bytes.
  98          */
  99         union {
 100                 struct {
 101                         uint8_t skip[2]; /* not used - just alignment */
 102                         uint8_t raw[SMB_HDRLEN];  /* header length (32) */
 103                 } r;
 104                 struct {
 105                         uint8_t skip[2]; /* not used - just alignment */
 106                         uint8_t hdr[SMBSIGOFF]; /* sig. offset (14) */
 107                         uint32_t sig[2]; /* MAC signature, aligned! */
 108                         uint16_t ids[5]; /* pad, Tid, Pid, Uid, Mid */
 109                 } s;
 110         } smbhdr;
 111
 112         ASSERT(mp != NULL);
 113         ASSERT(MBLKL(mp) >= SMB_HDRLEN);
 114         ASSERT(vcp->vc_mackey != NULL);
 115
 116         /*
 117          * Make an aligned copy of the SMB header
 118          * and fill in the sequence number.
 119          */
 120         bcopy(mp->b_rptr, smbhdr.r.raw, SMB_HDRLEN);
 121         smbhdr.s.sig[0] = htolel(seqno);
 122         smbhdr.s.sig[1] = 0;
 123
 124         /*
 125          * Compute the MAC: MD5(concat(Key, message))
 126          */
 127         if (crypto_mech_md5.cm_type == CRYPTO_MECH_INVALID) {
 128                 SMBSDEBUG("crypto_mech_md5 invalid\n");
 129                 return (CRYPTO_MECHANISM_INVALID);
 130         }
 131         status = crypto_digest_init(&crypto_mech_md5, &crypto_ctx, 0);
 132         if (status != CRYPTO_SUCCESS)
 133                 return (status);
 134
 135         /* Digest the MAC Key */
 136         key.cd_format = CRYPTO_DATA_RAW;
 137         key.cd_offset = 0;
 138         key.cd_length = vcp->vc_mackeylen;
 139         key.cd_miscdata = 0;
 140         key.cd_raw.iov_base = (char *)vcp->vc_mackey;
 141         key.cd_raw.iov_len = vcp->vc_mackeylen;
 142         status = crypto_digest_update(crypto_ctx, &key, 0);
 143         if (status != CRYPTO_SUCCESS)
 144                 return (status);
 145
 146         /* Digest the (copied) SMB header */
 147         data.cd_format = CRYPTO_DATA_RAW;
 148         data.cd_offset = 0;
 149         data.cd_length = SMB_HDRLEN;
 150         data.cd_miscdata = 0;
 151         data.cd_raw.iov_base = (char *)smbhdr.r.raw;
 152         data.cd_raw.iov_len = SMB_HDRLEN;
 153         status = crypto_digest_update(crypto_ctx, &data, 0);
 154         if (status != CRYPTO_SUCCESS)
 155                 return (status);
 156
 157         /* Digest rest of the SMB message. */
 158         data.cd_format = CRYPTO_DATA_MBLK;
 159         data.cd_offset = SMB_HDRLEN;
 160         data.cd_length = msgdsize(mp) - SMB_HDRLEN;
 161         data.cd_miscdata = 0;
 162         data.cd_mp = mp;
 163         status = crypto_digest_update(crypto_ctx, &data, 0);
 164         if (status != CRYPTO_SUCCESS)
 165                 return (status);
 166
 167         /* Final */
 168         digest.cd_format = CRYPTO_DATA_RAW;
 169         digest.cd_offset = 0;
 170         digest.cd_length = sizeof (mac);
 171         digest.cd_miscdata = 0;
 172         digest.cd_raw.iov_base = (char *)mac;
 173         digest.cd_raw.iov_len = sizeof (mac);
 174         status = crypto_digest_final(crypto_ctx, &digest, 0);
 175         if (status != CRYPTO_SUCCESS)
 176                 return (status);
 177
 178         /*
 179          * Finally, store the signature.
 180          * (first 8 bytes of the mac)
 181          */
 182         if (signature)
 183                 bcopy(mac, signature, SMBSIGLEN);
 184
 185         return (0);
 186 }
 187
 188 /*
 189  * Sign a request with HMAC-MD5.
 190  */
 191 void
 192 smb_rq_sign(struct smb_rq *rqp)
 193 {
 194         struct smb_vc *vcp = rqp->sr_vc;
 195         mblk_t *mp = rqp->sr_rq.mb_top;
 196         uint8_t *sigloc;
 197         int status;
 198
 199         /*
 200          * Our mblk allocation ensures this,
 201          * but just in case...
 202          */
 203         if (MBLKL(mp) < SMB_HDRLEN) {
 204                 if (!pullupmsg(mp, SMB_HDRLEN))
 205                         return;
 206         }
 207         sigloc = mp->b_rptr + SMBSIGOFF;
 208
 209         if (vcp->vc_mackey == NULL) {
 210                 /*
 211                  * Signing is required, but we have no key yet
 212                  * fill in with the magic fake signing value.
 213                  * This happens with SPNEGO, NTLMSSP, ...
 214                  */
 215                 bcopy("BSRSPLY", sigloc, 8);
 216                 return;
 217         }
 218
 219         /*
 220          * This will compute the MAC and store it
 221          * directly into the message at sigloc.
 222          */
 223         status = smb_compute_MAC(vcp, mp, rqp->sr_seqno, sigloc);
 224         if (status != CRYPTO_SUCCESS) {
 225                 SMBSDEBUG("Crypto error %d", status);
 226                 bzero(sigloc, SMBSIGLEN);
 227         }
 228 }
 229
 230 /*
 231  * Verify reply signature.
 232  */
 233 int
 234 smb_rq_verify(struct smb_rq *rqp)
 235 {
 236         struct smb_vc *vcp = rqp->sr_vc;
 237         mblk_t *mp = rqp->sr_rp.md_top;
 238         uint8_t sigbuf[SMBSIGLEN];
 239         uint8_t *sigloc;
 240         int fudge, rsn, status;
 241
 242         /*
 243          * Note vc_mackey and vc_mackeylen gets filled in by
 244          * smb_usr_iod_work as the connection comes in.
 245          */
 246         if (vcp->vc_mackey == NULL) {
 247                 SMBSDEBUG("no mac key\n");
 248                 return (0);
 249         }
 250
 251         /*
 252          * Let caller deal with empty reply or short messages by
 253          * returning zero.  Caller will fail later, in parsing.
 254          */
 255         if (mp == NULL) {
 256                 SMBSDEBUG("empty reply\n");
 257                 return (0);
 258         }
 259         if (MBLKL(mp) < SMB_HDRLEN) {
 260                 if (!pullupmsg(mp, SMB_HDRLEN))
 261                         return (0);
 262         }
 263         sigloc = mp->b_rptr + SMBSIGOFF;
 264
 265         /*
 266          * Compute the expected signature in sigbuf.
 267          */
 268         rsn = rqp->sr_rseqno;
 269         status = smb_compute_MAC(vcp, mp, rsn, sigbuf);
 270         if (status != CRYPTO_SUCCESS) {
 271                 SMBSDEBUG("Crypto error %d", status);
 272                 /*
 273                  * If we can't compute a MAC, then there's
 274                  * no point trying other seqno values.
 275                  */
 276                 return (EBADRPC);
 277         }
 278
 279         /*
 280          * Compare the computed signature with the
 281          * one found in the message (at sigloc)
 282          */
 283         if (bcmp(sigbuf, sigloc, SMBSIGLEN) == 0)
 284                 return (0);
 285
 286         SMBERROR("BAD signature, Server=%s MID=0x%x Seq=%d\n",
 287             vcp->vc_srvname, rqp->sr_mid, rsn);
 288
 289 #ifdef DEBUG
 290         /*
 291          * For diag purposes, we check whether the client/server idea
 292          * of the sequence # has gotten a bit out of sync.
 293          */
 294         for (fudge = 1; fudge <= nsmb_signing_fudge; fudge++) {
 295                 (void) smb_compute_MAC(vcp, mp, rsn + fudge, sigbuf);
 296                 if (bcmp(sigbuf, sigloc, SMBSIGLEN) == 0)
 297                         break;
 298                 (void) smb_compute_MAC(vcp, mp, rsn - fudge, sigbuf);
 299                 if (bcmp(sigbuf, sigloc, SMBSIGLEN) == 0) {
 300                         fudge = -fudge;
 301                         break;
 302                 }
 303         }
 304         if (fudge <= nsmb_signing_fudge) {
 305                 SMBERROR("MID=0x%x, Seq=%d, but %d would have worked\n",
 306                     rqp->sr_mid, rsn, rsn + fudge);
 307         }
 308 #endif
 309         return (EBADRPC);
 310 }