[PATCH 2/2] ksmbd: add AES-GMAC signing support

[Michail Andreas Michalopoulos <mike.michalo@gmail.com>]

SMB 3.1.1 adds AES-GMAC as a signing algorithm that clients can
negotiate in the SMB2_SIGNING_CAPABILITIES context (MS-SMB2 3.1.4.1).
Windows and Samba support it.

Implement it with the AES-GCM library: the message, with its Signature
field zeroed, is authenticated as associated data with nothing
encrypted, and the 16-byte tag is the signature. The 12-byte nonce is
the MessageId followed by a 32-bit value with bit 0 set for messages
from the server and bit 1 set for SMB2 CANCEL.

Also accept AES-GMAC from the client's list of algorithms, and refuse
to bind a channel to a session if only one of them uses AES-GMAC, with
the same status codes as Windows (checked by smbtorture's
smb2.session.bind_negative_smb3sign* tests): STATUS_REQUEST_OUT_OF_SEQUENCE
for an AES-GMAC session and STATUS_NOT_SUPPORTED for an AES-GMAC
channel. These responses keep the SMB2_FLAGS_SIGNED flag like the other
binding errors, as clients reject unsigned responses to signed requests.

Mark the feature as supported in the ksmbd feature status table.

The nonce format follows Enzo Matsumiya's AES-GMAC series for the SMB
client and Samba's implementation.

An AI assistant was used to draft the patch and as an independent
reviewer. Testing is described in the cover letter.

Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
---
 Documentation/filesystems/smb/ksmbd.rst |  2 +-
 fs/smb/server/Kconfig                   |  1 +
 fs/smb/server/auth.c                    | 46 +++++++++++++++++++++++++
 fs/smb/server/smb2pdu.c                 | 35 +++++++++++++++++--
 4 files changed, 80 insertions(+), 4 deletions(-)

diff --git a/Documentation/filesystems/smb/ksmbd.rst b/Documentation/filesystems/smb/ksmbd.rst
index 728cfca1320..59c98c53d78 100644
--- a/Documentation/filesystems/smb/ksmbd.rst
+++ b/Documentation/filesystems/smb/ksmbd.rst
@@ -118,7 +118,7 @@ SMB3.1.1 Compression           Supported.
 SMB3.1.1 over QUIC             Planned for future.
 Signing over RDMA              Under development.
 Encryption over RDMA           Supported.
-SMB3.1.1 GMAC signing support  Planned for future.
+SMB3.1.1 GMAC signing support  Supported.
 ============================== =================================================
 
 
diff --git a/fs/smb/server/Kconfig b/fs/smb/server/Kconfig
index f8b03605db5..30523ca165e 100644
--- a/fs/smb/server/Kconfig
+++ b/fs/smb/server/Kconfig
@@ -8,6 +8,7 @@ config SMB_SERVER
 	select NLS_UCS2_UTILS
 	select CRYPTO
 	select CRYPTO_LIB_AES_CBC_MACS
+	select CRYPTO_LIB_AES_GCM
 	select CRYPTO_LIB_ARC4
 	select CRYPTO_LIB_MD5
 	select CRYPTO_LIB_SHA256
diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c
index 78e35f21746..f650bdd0beb 100644
--- a/fs/smb/server/auth.c
+++ b/fs/smb/server/auth.c
@@ -13,6 +13,7 @@
 #include <linux/xattr.h>
 #include <crypto/aead.h>
 #include <crypto/aes-cbc-macs.h>
+#include <crypto/aes-gcm.h>
 #include <crypto/md5.h>
 #include <crypto/sha2.h>
 #include <crypto/utils.h>
@@ -501,6 +502,46 @@ void ksmbd_sign_smb2_pdu(struct ksmbd_conn *conn, char *key, struct kvec *iov,
 	hmac_sha256_final(&ctx, sig);
 }
 
+/*
+ * AES-GMAC signing (SMB 3.1.1, MS-SMB2 3.1.4.1): AES-128-GCM with the
+ * whole message as associated data and nothing encrypted. The nonce is
+ * the MessageId followed by a 32-bit word whose bit 0 is set for messages
+ * from the server and bit 1 for SMB2 CANCEL.
+ */
+static void ksmbd_sign_smb3_pdu_gmac(char *key, struct kvec *iov, int n_vec,
+				     char *sig)
+{
+	struct smb2_hdr *hdr = iov[0].iov_base;
+	struct aes_gcm_key gcm_key;
+	struct aes_gcm_ctx gcm_ctx;
+	struct {
+		__le64 mid;
+		__le32 flags;
+	} __packed nonce;
+	int i;
+
+	static_assert(sizeof(nonce) == GCM_AES_IV_SIZE);
+	nonce.mid = hdr->MessageId;
+	nonce.flags = 0;
+	if (hdr->Flags & SMB2_FLAGS_SERVER_TO_REDIR)
+		nonce.flags |= cpu_to_le32(BIT(0));
+	if (hdr->Command == SMB2_CANCEL)
+		nonce.flags |= cpu_to_le32(BIT(1));
+
+	/* This cannot fail, since we always pass valid lengths. */
+	if (WARN_ON_ONCE(aes_gcm_preparekey(&gcm_key, key, SMB3_SIGN_KEY_SIZE,
+					    SMB2_SIGNATURE_SIZE))) {
+		memset(sig, 0, SMB2_SIGNATURE_SIZE);
+		return;
+	}
+
+	aes_gcm_init(&gcm_ctx, (const u8 *)&nonce, &gcm_key);
+	for (i = 0; i < n_vec; i++)
+		aes_gcm_auth_update(&gcm_ctx, iov[i].iov_base, iov[i].iov_len);
+	aes_gcm_encrypt_final(&gcm_ctx, sig);
+	memzero_explicit(&gcm_key, sizeof(gcm_key));
+}
+
 /**
  * ksmbd_sign_smb3_pdu() - function to generate packet signing
  * @conn:	connection
@@ -518,6 +559,11 @@ void ksmbd_sign_smb3_pdu(struct ksmbd_conn *conn, __le16 signing_algorithm,
 	struct aes_cmac_ctx cmac_ctx;
 	int i;
 
+	if (signing_algorithm == SIGNING_ALG_AES_GMAC_LE) {
+		ksmbd_sign_smb3_pdu_gmac(key, iov, n_vec, sig);
+		return;
+	}
+
 	if (signing_algorithm == SIGNING_ALG_HMAC_SHA256_LE) {
 		u8 mac[SHA256_DIGEST_SIZE];
 
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 11994e6b92e..1f977741f30 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -1793,7 +1793,8 @@ static void decode_sign_cap_ctxt(struct ksmbd_conn *conn,
 
 	for (i = 0; i < sign_algo_cnt; i++) {
 		if (pneg_ctxt->SigningAlgorithms[i] == SIGNING_ALG_HMAC_SHA256_LE ||
-		    pneg_ctxt->SigningAlgorithms[i] == SIGNING_ALG_AES_CMAC_LE) {
+		    pneg_ctxt->SigningAlgorithms[i] == SIGNING_ALG_AES_CMAC_LE ||
+		    pneg_ctxt->SigningAlgorithms[i] == SIGNING_ALG_AES_GMAC_LE) {
 			ksmbd_debug(SMB, "Signing Algorithm ID = 0x%x\n",
 				    pneg_ctxt->SigningAlgorithms[i]);
 			conn->signing_negotiated = true;
@@ -2558,6 +2559,23 @@ static int krb5_authenticate(struct ksmbd_work *work,
 }
 #endif
 
+/*
+ * A channel can only be bound to a session signed with AES-GMAC if it
+ * negotiated AES-GMAC too, and the other way round. The status codes are
+ * the ones Windows returns, as checked by smbtorture.
+ */
+static int smb2_check_binding_signing_algorithm(struct ksmbd_conn *conn,
+						struct ksmbd_session *sess)
+{
+	if (sess->signing_algorithm == conn->signing_algorithm)
+		return 0;
+	if (sess->signing_algorithm == SIGNING_ALG_AES_GMAC_LE)
+		return -EPROTO;
+	if (conn->signing_algorithm == SIGNING_ALG_AES_GMAC_LE)
+		return -EOPNOTSUPP;
+	return 0;
+}
+
 int smb2_sess_setup(struct ksmbd_work *work)
 {
 	struct ksmbd_conn *conn = work->conn;
@@ -2615,6 +2633,10 @@ int smb2_sess_setup(struct ksmbd_work *work)
 			goto out_err;
 		}
 
+		rc = smb2_check_binding_signing_algorithm(conn, sess);
+		if (rc)
+			goto out_err;
+
 		if (conn->dialect != sess->dialect) {
 			rc = -EINVAL;
 			goto out_err;
@@ -2677,10 +2699,12 @@ int smb2_sess_setup(struct ksmbd_work *work)
 	} else if ((conn->dialect < SMB30_PROT_ID ||
 		    server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) &&
 		   (req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) {
+		rc = 0;
 		sess = ksmbd_session_lookup_slowpath(le64_to_cpu(req->hdr.SessionId));
 		if (sess) {
 			int sign_ret;
 
+			rc = smb2_check_binding_signing_algorithm(conn, sess);
 			work->sess = sess;
 			installed = true;
 			if (sess->dialect >= SMB30_PROT_ID)
@@ -2695,7 +2719,8 @@ int smb2_sess_setup(struct ksmbd_work *work)
 				sess = NULL;
 			}
 		}
-		rc = -EACCES;
+		if (!rc)
+			rc = -EACCES;
 		goto out_err;
 	} else {
 		sess = ksmbd_session_lookup(conn,
@@ -2823,12 +2848,16 @@ int smb2_sess_setup(struct ksmbd_work *work)
 		rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES;
 	else if (rc == -EOPNOTSUPP)
 		rsp->hdr.Status = STATUS_NOT_SUPPORTED;
+	else if (rc == -EPROTO)
+		rsp->hdr.Status = STATUS_REQUEST_OUT_OF_SEQUENCE;
 	else if (rc == -EKEYREJECTED)
 		rsp->hdr.Status = STATUS_ACCESS_DENIED;
 	else if (rc)
 		rsp->hdr.Status = STATUS_LOGON_FAILURE;
 	if ((rsp->hdr.Status == STATUS_USER_SESSION_DELETED ||
-	     (rsp->hdr.Status == STATUS_INVALID_PARAMETER &&
+	     ((rsp->hdr.Status == STATUS_INVALID_PARAMETER ||
+	       rsp->hdr.Status == STATUS_NOT_SUPPORTED ||
+	       rsp->hdr.Status == STATUS_REQUEST_OUT_OF_SEQUENCE) &&
 	      (req->Flags & SMB2_SESSION_REQ_FLAG_BINDING))) &&
 	    (req->hdr.Flags & SMB2_FLAGS_SIGNED))
 		rsp->hdr.Flags |= SMB2_FLAGS_SIGNED;
-- 
2.43.0