smb: client: Use FullSessionKey for AES-256 encryption key derivation

When Kerberos authentication is used with AES-256 encryption (AES-256-CCM
or AES-256-GCM), the SMB3 encryption and decryption keys must be derived
using the full session key (Session.FullSessionKey) rather than just the
first 16 bytes (Session.SessionKey).

Per MS-SMB2 section 3.2.5.3.1, when Connection.Dialect is "3.1.1" and
Connection.CipherId is AES-256-CCM or AES-256-GCM, Session.FullSessionKey
must be set to the full cryptographic key from the GSS authentication
context. The encryption and decryption key derivation (SMBC2SCipherKey,
SMBS2CCipherKey) must use this FullSessionKey as the KDF input. The
signing key derivation continues to use Session.SessionKey (first 16
bytes) in all cases.

Previously, generate_key() hardcoded SMB2_NTLMV2_SESSKEY_SIZE (16) as the
HMAC-SHA256 key input length for all derivations. When Kerberos with
AES-256 provides a 32-byte session key, the KDF for encryption/decryption
was using only the first 16 bytes, producing keys that did not match the
server's, causing mount failures with sec=krb5 and require_gcm_256=1.

Add a full_key_size parameter to generate_key() and pass the appropriate
size from generate_smb3signingkey():
 - Signing: always SMB2_NTLMV2_SESSKEY_SIZE (16 bytes)
 - Encryption/Decryption: ses->auth_key.len when AES-256, otherwise 16

Also fix cifs_dump_full_key() to report the actual session key length for
AES-256 instead of hardcoded CIFS_SESS_KEY_SIZE, so that userspace tools
like Wireshark receive the correct key for decryption.

Cc: <stable@vger.kernel.org>
Reviewed-by: Bharath SM <bharathsm@microsoft.com>
Signed-off-by: Piyush Sachdeva <psachdeva@microsoft.com>
Signed-off-by: Piyush Sachdeva <s.piyush1024@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/client/ioctl.c b/fs/smb/client/ioctl.c
index 9afab3237e54c3766138d80874ca8e039ead7fc4..17408bb8ab65bf1727fbc944ede5d9e2c622d28c 100644 (file)
--- a/fs/smb/client/ioctl.c
+++ b/fs/smb/client/ioctl.c
@@ -296,7 +296,7 @@ search_end:
                break;
        case SMB2_ENCRYPTION_AES256_CCM:
        case SMB2_ENCRYPTION_AES256_GCM:
-               out.session_key_length = CIFS_SESS_KEY_SIZE;
+               out.session_key_length = ses->auth_key.len;
                out.server_in_key_length = out.server_out_key_length = SMB3_GCM256_CRYPTKEY_SIZE;
                break;
        default:

diff --git a/fs/smb/client/smb2transport.c b/fs/smb/client/smb2transport.c
index 41009039b4cbe6bd4ad397114f90f3be31804ae1..e8eeff9e50d67f7e92c3282237ed44ef9df15378 100644 (file)
--- a/fs/smb/client/smb2transport.c
+++ b/fs/smb/client/smb2transport.c
@@ -251,7 +251,8 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
 }
 
 static void generate_key(struct cifs_ses *ses, struct kvec label,
-                        struct kvec context, __u8 *key, unsigned int key_size)
+                        struct kvec context, __u8 *key, unsigned int key_size,
+                        unsigned int full_key_size)
 {
        unsigned char zero = 0x0;
        __u8 i[4] = {0, 0, 0, 1};
@@ -265,7 +266,7 @@ static void generate_key(struct cifs_ses *ses, struct kvec label,
        memset(key, 0x0, key_size);
 
        hmac_sha256_init_usingrawkey(&hmac_ctx, ses->auth_key.response,
-                                    SMB2_NTLMV2_SESSKEY_SIZE);
+                                    full_key_size);
        hmac_sha256_update(&hmac_ctx, i, 4);
        hmac_sha256_update(&hmac_ctx, label.iov_base, label.iov_len);
        hmac_sha256_update(&hmac_ctx, &zero, 1);
@@ -298,6 +299,7 @@ generate_smb3signingkey(struct cifs_ses *ses,
                        struct TCP_Server_Info *server,
                        const struct derivation_triplet *ptriplet)
 {
+       unsigned int full_key_size = SMB2_NTLMV2_SESSKEY_SIZE;
        bool is_binding = false;
        int chan_index = 0;
 
@@ -330,12 +332,24 @@ generate_smb3signingkey(struct cifs_ses *ses,
        if (is_binding) {
                generate_key(ses, ptriplet->signing.label,
                             ptriplet->signing.context,
-                            ses->chans[chan_index].signkey,
-                            SMB3_SIGN_KEY_SIZE);
+                            ses->chans[chan_index].signkey, SMB3_SIGN_KEY_SIZE,
+                            SMB2_NTLMV2_SESSKEY_SIZE);
        } else {
                generate_key(ses, ptriplet->signing.label,
-                            ptriplet->signing.context,
-                            ses->smb3signingkey, SMB3_SIGN_KEY_SIZE);
+                            ptriplet->signing.context, ses->smb3signingkey,
+                            SMB3_SIGN_KEY_SIZE, SMB2_NTLMV2_SESSKEY_SIZE);
+
+               /*
+                * Per MS-SMB2 3.2.5.3.1, signing key always uses Session.SessionKey
+                * (first 16 bytes). Encryption/decryption keys use
+                * Session.FullSessionKey when dialect is 3.1.1 and cipher is
+                * AES-256-CCM or AES-256-GCM, otherwise Session.SessionKey.
+                */
+
+               if (server->dialect == SMB311_PROT_ID &&
+                   (server->cipher_type == SMB2_ENCRYPTION_AES256_CCM ||
+                    server->cipher_type == SMB2_ENCRYPTION_AES256_GCM))
+                       full_key_size = ses->auth_key.len;
 
                /* safe to access primary channel, since it will never go away */
                spin_lock(&ses->chan_lock);
@@ -345,10 +359,13 @@ generate_smb3signingkey(struct cifs_ses *ses,
 
                generate_key(ses, ptriplet->encryption.label,
                             ptriplet->encryption.context,
-                            ses->smb3encryptionkey, SMB3_ENC_DEC_KEY_SIZE);
+                            ses->smb3encryptionkey, SMB3_ENC_DEC_KEY_SIZE,
+                            full_key_size);
+
                generate_key(ses, ptriplet->decryption.label,
                             ptriplet->decryption.context,
-                            ses->smb3decryptionkey, SMB3_ENC_DEC_KEY_SIZE);
+                            ses->smb3decryptionkey, SMB3_ENC_DEC_KEY_SIZE,
+                            full_key_size);
        }
 
 #ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS
@@ -361,7 +378,7 @@ generate_smb3signingkey(struct cifs_ses *ses,
                        &ses->Suid);
        cifs_dbg(VFS, "Cipher type   %d\n", server->cipher_type);
        cifs_dbg(VFS, "Session Key   %*ph\n",
-                SMB2_NTLMV2_SESSKEY_SIZE, ses->auth_key.response);
+                (int)ses->auth_key.len, ses->auth_key.response);
        cifs_dbg(VFS, "Signing Key   %*ph\n",
                 SMB3_SIGN_KEY_SIZE, ses->smb3signingkey);
        if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) ||