mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-30 06:25:03 +08:00
1bb5681067
Make CIFS_FULL_KEY_DUMP ioctl able to return variable-length keys.
* userspace needs to pass the struct size along with optional
session_id and some space at the end to store keys
* if there is enough space kernel returns keys in the extra space and
sets the length of each key via xyz_key_length fields
This also fixes the build error for get_user() on ARM.
Sample program:
#include <stdlib.h>
#include <stdio.h>
#include <stdint.h>
#include <sys/fcntl.h>
#include <sys/ioctl.h>
struct smb3_full_key_debug_info {
uint32_t in_size;
uint64_t session_id;
uint16_t cipher_type;
uint8_t session_key_length;
uint8_t server_in_key_length;
uint8_t server_out_key_length;
uint8_t data[];
/*
* return this struct with the keys appended at the end:
* uint8_t session_key[session_key_length];
* uint8_t server_in_key[server_in_key_length];
* uint8_t server_out_key[server_out_key_length];
*/
} __attribute__((packed));
#define CIFS_IOCTL_MAGIC 0xCF
#define CIFS_DUMP_FULL_KEY _IOWR(CIFS_IOCTL_MAGIC, 10, struct smb3_full_key_debug_info)
void dump(const void *p, size_t len) {
const char *hex = "0123456789ABCDEF";
const uint8_t *b = p;
for (int i = 0; i < len; i++)
printf("%c%c ", hex[(b[i]>>4)&0xf], hex[b[i]&0xf]);
putchar('\n');
}
int main(int argc, char **argv)
{
struct smb3_full_key_debug_info *keys;
uint8_t buf[sizeof(*keys)+1024] = {0};
size_t off = 0;
int fd, rc;
keys = (struct smb3_full_key_debug_info *)&buf;
keys->in_size = sizeof(buf);
fd = open(argv[1], O_RDONLY);
if (fd < 0)
perror("open"), exit(1);
rc = ioctl(fd, CIFS_DUMP_FULL_KEY, keys);
if (rc < 0)
perror("ioctl"), exit(1);
printf("SessionId ");
dump(&keys->session_id, 8);
printf("Cipher %04x\n", keys->cipher_type);
printf("SessionKey ");
dump(keys->data+off, keys->session_key_length);
off += keys->session_key_length;
printf("ServerIn Key ");
dump(keys->data+off, keys->server_in_key_length);
off += keys->server_in_key_length;
printf("ServerOut Key ");
dump(keys->data+off, keys->server_out_key_length);
return 0;
}
Usage:
$ gcc -o dumpkeys dumpkeys.c
Against Windows Server 2020 preview (with AES-256-GCM support):
# mount.cifs //$ip/test /mnt -o "username=administrator,password=foo,vers=3.0,seal"
# ./dumpkeys /mnt/somefile
SessionId 0D 00 00 00 00 0C 00 00
Cipher 0002
SessionKey AB CD CC 0D E4 15 05 0C 6F 3C 92 90 19 F3 0D 25
ServerIn Key 73 C6 6A C8 6B 08 CF A2 CB 8E A5 7D 10 D1 5B DC
ServerOut Key 6D 7E 2B A1 71 9D D7 2B 94 7B BA C4 F0 A5 A4 F8
# umount /mnt
With 256 bit keys:
# echo 1 > /sys/module/cifs/parameters/require_gcm_256
# mount.cifs //$ip/test /mnt -o "username=administrator,password=foo,vers=3.11,seal"
# ./dumpkeys /mnt/somefile
SessionId 09 00 00 00 00 0C 00 00
Cipher 0004
SessionKey 93 F5 82 3B 2F B7 2A 50 0B B9 BA 26 FB 8C 8B 03
ServerIn Key 6C 6A 89 B2 CB 7B 78 E8 04 93 37 DA 22 53 47 DF B3 2C 5F 02 26 70 43 DB 8D 33 7B DC 66 D3 75 A9
ServerOut Key 04 11 AA D7 52 C7 A8 0F ED E3 93 3A 65 FE 03 AD 3F 63 03 01 2B C0 1B D7 D7 E5 52 19 7F CC 46 B4
Signed-off-by: Aurelien Aptel <aaptel@suse.com>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
129 lines
3.8 KiB
C
129 lines
3.8 KiB
C
/*
|
|
* fs/cifs/cifs_ioctl.h
|
|
*
|
|
* Structure definitions for io control for cifs/smb3
|
|
*
|
|
* Copyright (c) 2015 Steve French <steve.french@primarydata.com>
|
|
*
|
|
* This library is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU Lesser General Public License as published
|
|
* by the Free Software Foundation; either version 2.1 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
|
|
* the GNU Lesser General Public License for more details.
|
|
*
|
|
*/
|
|
|
|
struct smb_mnt_fs_info {
|
|
__u32 version; /* 0001 */
|
|
__u16 protocol_id;
|
|
__u16 tcon_flags;
|
|
__u32 vol_serial_number;
|
|
__u32 vol_create_time;
|
|
__u32 share_caps;
|
|
__u32 share_flags;
|
|
__u32 sector_flags;
|
|
__u32 optimal_sector_size;
|
|
__u32 max_bytes_chunk;
|
|
__u32 fs_attributes;
|
|
__u32 max_path_component;
|
|
__u32 device_type;
|
|
__u32 device_characteristics;
|
|
__u32 maximal_access;
|
|
__u64 cifs_posix_caps;
|
|
} __packed;
|
|
|
|
struct smb_snapshot_array {
|
|
__u32 number_of_snapshots;
|
|
__u32 number_of_snapshots_returned;
|
|
__u32 snapshot_array_size;
|
|
/* snapshots[]; */
|
|
} __packed;
|
|
|
|
/* query_info flags */
|
|
#define PASSTHRU_QUERY_INFO 0x00000000
|
|
#define PASSTHRU_FSCTL 0x00000001
|
|
#define PASSTHRU_SET_INFO 0x00000002
|
|
struct smb_query_info {
|
|
__u32 info_type;
|
|
__u32 file_info_class;
|
|
__u32 additional_information;
|
|
__u32 flags;
|
|
__u32 input_buffer_length;
|
|
__u32 output_buffer_length;
|
|
/* char buffer[]; */
|
|
} __packed;
|
|
|
|
/*
|
|
* Dumping the commonly used 16 byte (e.g. CCM and GCM128) keys still supported
|
|
* for backlevel compatibility, but is not sufficient for dumping the less
|
|
* frequently used GCM256 (32 byte) keys (see the newer "CIFS_DUMP_FULL_KEY"
|
|
* ioctl for dumping decryption info for GCM256 mounts)
|
|
*/
|
|
struct smb3_key_debug_info {
|
|
__u64 Suid;
|
|
__u16 cipher_type;
|
|
__u8 auth_key[16]; /* SMB2_NTLMV2_SESSKEY_SIZE */
|
|
__u8 smb3encryptionkey[SMB3_SIGN_KEY_SIZE];
|
|
__u8 smb3decryptionkey[SMB3_SIGN_KEY_SIZE];
|
|
} __packed;
|
|
|
|
/*
|
|
* Dump variable-sized keys
|
|
*/
|
|
struct smb3_full_key_debug_info {
|
|
/* INPUT: size of userspace buffer */
|
|
__u32 in_size;
|
|
|
|
/*
|
|
* INPUT: 0 for current user, otherwise session to dump
|
|
* OUTPUT: session id that was dumped
|
|
*/
|
|
__u64 session_id;
|
|
__u16 cipher_type;
|
|
__u8 session_key_length;
|
|
__u8 server_in_key_length;
|
|
__u8 server_out_key_length;
|
|
__u8 data[];
|
|
/*
|
|
* return this struct with the keys appended at the end:
|
|
* __u8 session_key[session_key_length];
|
|
* __u8 server_in_key[server_in_key_length];
|
|
* __u8 server_out_key[server_out_key_length];
|
|
*/
|
|
} __packed;
|
|
|
|
struct smb3_notify {
|
|
__u32 completion_filter;
|
|
bool watch_tree;
|
|
} __packed;
|
|
|
|
#define CIFS_IOCTL_MAGIC 0xCF
|
|
#define CIFS_IOC_COPYCHUNK_FILE _IOW(CIFS_IOCTL_MAGIC, 3, int)
|
|
#define CIFS_IOC_SET_INTEGRITY _IO(CIFS_IOCTL_MAGIC, 4)
|
|
#define CIFS_IOC_GET_MNT_INFO _IOR(CIFS_IOCTL_MAGIC, 5, struct smb_mnt_fs_info)
|
|
#define CIFS_ENUMERATE_SNAPSHOTS _IOR(CIFS_IOCTL_MAGIC, 6, struct smb_snapshot_array)
|
|
#define CIFS_QUERY_INFO _IOWR(CIFS_IOCTL_MAGIC, 7, struct smb_query_info)
|
|
#define CIFS_DUMP_KEY _IOWR(CIFS_IOCTL_MAGIC, 8, struct smb3_key_debug_info)
|
|
#define CIFS_IOC_NOTIFY _IOW(CIFS_IOCTL_MAGIC, 9, struct smb3_notify)
|
|
#define CIFS_DUMP_FULL_KEY _IOWR(CIFS_IOCTL_MAGIC, 10, struct smb3_full_key_debug_info)
|
|
#define CIFS_IOC_SHUTDOWN _IOR ('X', 125, __u32)
|
|
|
|
/*
|
|
* Flags for going down operation
|
|
*/
|
|
#define CIFS_GOING_FLAGS_DEFAULT 0x0 /* going down */
|
|
#define CIFS_GOING_FLAGS_LOGFLUSH 0x1 /* flush log but not data */
|
|
#define CIFS_GOING_FLAGS_NOLOGFLUSH 0x2 /* don't flush log nor data */
|
|
|
|
static inline bool cifs_forced_shutdown(struct cifs_sb_info *sbi)
|
|
{
|
|
if (CIFS_MOUNT_SHUTDOWN & sbi->mnt_cifs_flags)
|
|
return true;
|
|
else
|
|
return false;
|
|
}
|