613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * CDDL HEADER START
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * The contents of this file are subject to the terms of the
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Common Development and Distribution License (the "License").
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * You may not use this file except in compliance with the License.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * See the License for the specific language governing permissions
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * and limitations under the License.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * When distributing Covered Code, include this CDDL HEADER in each
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * If applicable, add the following below this CDDL HEADER, with the
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * fields enclosed by brackets "[]" replaced with your own identifying
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * information: Portions Copyright [yyyy] [name of copyright owner]
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * CDDL HEADER END
a547be5daca7e465ca82df6d179f6b1f8e0cda72Gordon Ross * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Support for SMB "signing" (message integrity)
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Set this to a small number to debug sequence numbers
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * that seem to get out of step.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross/* Mechanism definitions */
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Rossstatic crypto_mechanism_t crypto_mech_md5 = { CRYPTO_MECH_INVALID };
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross crypto_mech_md5.cm_type = crypto_mech2id(SUN_CKM_MD5);
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Compute HMAC-MD5 of packet data, using the stored MAC key.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * See similar code for the server side:
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * uts/common/fs/smbsrv/smb_signing.c : smb_sign_calc
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * This union is a little bit of trickery to:
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * (1) get the sequence number int aligned, and
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * (2) reduce the number of digest calls, at the
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * cost of a copying 32 bytes instead of 8.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Both sides of this union are 2+32 bytes.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross uint8_t skip[2]; /* not used - just alignment */
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross uint8_t raw[SMB_HDRLEN]; /* header length (32) */
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross uint8_t skip[2]; /* not used - just alignment */
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Make an aligned copy of the SMB header
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * and fill in the sequence number.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Compute the MAC: MD5(concat(Key, message))
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross if (crypto_mech_md5.cm_type == CRYPTO_MECH_INVALID) {
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross status = crypto_digest_init(&crypto_mech_md5, &crypto_ctx, 0);
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross /* Digest the MAC Key */
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross status = crypto_digest_update(crypto_ctx, &key, 0);
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross /* Digest the (copied) SMB header */
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross status = crypto_digest_update(crypto_ctx, &data, 0);
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross /* Digest rest of the SMB message. */
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross status = crypto_digest_update(crypto_ctx, &data, 0);
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross status = crypto_digest_final(crypto_ctx, &digest, 0);
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Finally, store the signature.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * (first 8 bytes of the mac)
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Sign a request with HMAC-MD5.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Our mblk allocation ensures this,
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * but just in case...
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Signing is required, but we have no key yet
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * fill in with the magic fake signing value.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * This happens with SPNEGO, NTLMSSP, ...
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * This will compute the MAC and store it
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * directly into the message at sigloc.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross status = smb_compute_MAC(vcp, mp, rqp->sr_seqno, sigloc);
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Verify reply signature.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Note vc_mackey and vc_mackeylen gets filled in by
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * smb_usr_iod_work as the connection comes in.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Let caller deal with empty reply or short messages by
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * returning zero. Caller will fail later, in parsing.
02d09e03eb27f3a2dc299de704e45dae5173f43fGordon Ross * Compute the expected signature in sigbuf.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * If we can't compute a MAC, then there's
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * no point trying other seqno values.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Compare the computed signature with the
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * one found in the message (at sigloc)
a547be5daca7e465ca82df6d179f6b1f8e0cda72Gordon Ross SMBERROR("BAD signature, Server=%s MID=0x%x Seq=%d\n",
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * For diag purposes, we check whether the client/server idea
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * of the sequence # has gotten a bit out of sync.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross for (fudge = 1; fudge <= nsmb_signing_fudge; fudge++) {
02d09e03eb27f3a2dc299de704e45dae5173f43fGordon Ross (void) smb_compute_MAC(vcp, mp, rsn + fudge, sigbuf);
02d09e03eb27f3a2dc299de704e45dae5173f43fGordon Ross (void) smb_compute_MAC(vcp, mp, rsn - fudge, sigbuf);
a547be5daca7e465ca82df6d179f6b1f8e0cda72Gordon Ross SMBERROR("MID=0x%x, Seq=%d, but %d would have worked\n",