/*

   Unix SMB/CIFS implementation.

   SMB Signing Code

   Copyright (C) Jeremy Allison 2003.

   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2002-2003

   Copyright (C) Stefan Metzmacher 2009

   This program is free software; you can redistribute it and/or modify

   it under the terms of the GNU General Public License as published by

   the Free Software Foundation; either version 3 of the License, or

   (at your option) any later version.

   This program is distributed in the hope that it will be useful,

   but WITHOUT ANY WARRANTY; without even the implied warranty of

   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License

   along with this program.  If not, see <http://www.gnu.org/licenses/>.

*/

#include "includes.h"

#include "smb_common.h"

#include "smb_signing.h"

#include "lib/crypto/gnutls_helpers.h"

#include <gnutls/gnutls.h>

#include <gnutls/crypto.h>

/* Used by the SMB1 signing functions. */

struct smb1_signing_state {

  /* is signing locally allowed */

  bool allowed;

  /* is signing locally desired */

  bool desired;

  /* is signing locally mandatory */

  bool mandatory;

  /* is signing negotiated by the peer */

  bool negotiated;

  bool active; /* Have I ever seen a validly signed packet? */

  /* mac_key.length > 0 means signing is started */

  DATA_BLOB mac_key;

  /* the next expected seqnum */

  uint32_t seqnum;

  TALLOC_CTX *mem_ctx;

  void *(*alloc_fn)(TALLOC_CTX *mem_ctx, size_t len);

  void (*free_fn)(TALLOC_CTX *mem_ctx, void *ptr);

};

static void smb1_signing_reset_info(struct smb1_signing_state *si)

{

  si->active = false;

  si->seqnum = 0;

  data_blob_clear(&si->mac_key);

  if (si->free_fn) {

    si->free_fn(si->mem_ctx, si->mac_key.data);

  } else {

    talloc_free(si->mac_key.data);

  }

  si->mac_key.data = NULL;

  si->mac_key.length = 0;

}

struct smb1_signing_state *smb1_signing_init_ex(TALLOC_CTX *mem_ctx,

                bool allowed,

                bool desired,

                bool mandatory,

                void *(*alloc_fn)(TALLOC_CTX *, size_t),

                void (*free_fn)(TALLOC_CTX *, void *))

{

  struct smb1_signing_state *si;

  if (alloc_fn) {

    void *p = alloc_fn(mem_ctx, sizeof(struct smb1_signing_state));

    if (p == NULL) {

      return NULL;

    }

    memset(p, 0, sizeof(struct smb1_signing_state));

    si = (struct smb1_signing_state *)p;

    si->mem_ctx = mem_ctx;

    si->alloc_fn = alloc_fn;

    si->free_fn = free_fn;

  } else {

    si = talloc_zero(mem_ctx, struct smb1_signing_state);

    if (si == NULL) {

      return NULL;

    }

  }

  if (mandatory) {

    desired = true;

  }

  if (desired) {

    allowed = true;

  }

  si->allowed = allowed;

  si->desired = desired;

  si->mandatory = mandatory;

  return si;

}

struct smb1_signing_state *smb1_signing_init(TALLOC_CTX *mem_ctx,

             bool allowed,

             bool desired,

             bool mandatory)

{

  return smb1_signing_init_ex(mem_ctx, allowed, desired, mandatory,

           NULL, NULL);

}

static bool smb1_signing_good(struct smb1_signing_state *si,

           bool good, uint32_t seq)

{

  if (good) {

    if (!si->active) {

      si->active = true;

    }

    return true;

  }

  if (!si->mandatory && !si->active) {

    /* Non-mandatory signing - just turn off if this is the first bad packet.. */

    DBG_INFO("signing negotiated but not required and peer\n"

        "isn't sending correct signatures. Turning off.\n");

    smb1_signing_reset_info(si);

    return true;

  }

  /* Mandatory signing or bad packet after signing started - fail and disconnect. */

  DBG_ERR("BAD SIG: seq %u\n", (unsigned int)seq);

  return false;

}

static NTSTATUS smb1_signing_md5(const DATA_BLOB *mac_key,

        const uint8_t *hdr, size_t len,

        uint32_t seq_number,

        uint8_t calc_md5_mac[16])

{

  const size_t offset_end_of_sig = (HDR_SS_FIELD + 8);

  uint8_t sequence_buf[8];

  gnutls_hash_hd_t hash_hnd = NULL;

  int rc;

  /*

   * Firstly put the sequence number into the first 4 bytes.

   * and zero out the next 4 bytes.

   *

   * We do this here, to avoid modifying the packet.

   */

  DBG_DEBUG("sequence number %u\n", seq_number );

  SIVAL(sequence_buf, 0, seq_number);

  SIVAL(sequence_buf, 4, 0);

  /*

   * Calculate the 16 byte MAC - but don't alter the data in the

   * incoming packet.

   *

   * This makes for a bit of fussing about, but it's not too bad.

   */

  rc = gnutls_hash_init(&hash_hnd, GNUTLS_DIG_MD5);

  if (rc < 0) {

    return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);

  }

  /* Initialise with the key. */

  rc = gnutls_hash(hash_hnd, mac_key->data, mac_key->length);

  if (rc < 0) {

    gnutls_hash_deinit(hash_hnd, NULL);

    return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);

  }

  /* Copy in the first bit of the SMB header. */

  rc = gnutls_hash(hash_hnd, hdr, HDR_SS_FIELD);

  if (rc < 0) {

    gnutls_hash_deinit(hash_hnd, NULL);

    return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);

  }

  /* Copy in the sequence number, instead of the signature. */

  rc = gnutls_hash(hash_hnd, sequence_buf, sizeof(sequence_buf));

  if (rc < 0) {

    gnutls_hash_deinit(hash_hnd, NULL);

    return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);

  }

  /* Copy in the rest of the packet in, skipping the signature. */

  rc = gnutls_hash(hash_hnd, hdr + offset_end_of_sig, len - offset_end_of_sig);

  if (rc < 0) {

    gnutls_hash_deinit(hash_hnd, NULL);

    return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);

  }

  gnutls_hash_deinit(hash_hnd, calc_md5_mac);

  return NT_STATUS_OK;

}

uint32_t smb1_signing_next_seqnum(struct smb1_signing_state *si, bool oneway)

{

  uint32_t seqnum;

  if (si->mac_key.length == 0) {

    return 0;

  }

  seqnum = si->seqnum;

  if (oneway) {

    si->seqnum += 1;

  } else {

    si->seqnum += 2;

  }

  return seqnum;

}

void smb1_signing_cancel_reply(struct smb1_signing_state *si, bool oneway)

{

  if (si->mac_key.length == 0) {

    return;

  }

  if (oneway) {

    si->seqnum -= 1;

  } else {

    si->seqnum -= 2;

  }

}

NTSTATUS smb1_signing_sign_pdu(struct smb1_signing_state *si,

            uint8_t *outhdr, size_t len,

            uint32_t seqnum)

{

  uint8_t calc_md5_mac[16];

  uint8_t com;

  uint8_t flags;

  if (si->mac_key.length == 0) {

    if (!si->negotiated) {

      return NT_STATUS_OK;

    }

  }

  /* JRA Paranioa test - we should be able to get rid of this... */

  if (len < (HDR_SS_FIELD + 8)) {

    DBG_WARNING("Logic error. "

       "Can't check signature on short packet! smb_len = %u\n",

       (unsigned)len);

    abort();

  }

  com = SVAL(outhdr, HDR_COM);

  flags = SVAL(outhdr, HDR_FLG);

  if (!(flags & FLAG_REPLY)) {

    uint16_t flags2 = SVAL(outhdr, HDR_FLG2);

    /*

     * If this is a request, specify what is

     * supported or required by the client

     */

    if (si->negotiated && si->desired) {

      flags2 |= FLAGS2_SMB_SECURITY_SIGNATURES;

    }

    if (si->negotiated && si->mandatory) {

      flags2 |= FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;

    }

    SSVAL(outhdr, HDR_FLG2, flags2);

  }

  if (si->mac_key.length == 0) {

    /* I wonder what BSRSPYL stands for - but this is what MS

       actually sends! */

    if (com == SMBsesssetupX) {

      memcpy(calc_md5_mac, "BSRSPYL ", 8);

    } else {

      memset(calc_md5_mac, 0, 8);

    }

  } else {

    NTSTATUS status;

    status = smb1_signing_md5(&si->mac_key,

                 outhdr,

           len,

           seqnum,

           calc_md5_mac);

    if (!NT_STATUS_IS_OK(status)) {

      return status;

    }

  }

  DBG_DEBUG("sent SMB signature of\n");

  dump_data(10, calc_md5_mac, 8);

  memcpy(&outhdr[HDR_SS_FIELD], calc_md5_mac, 8);

/*  outhdr[HDR_SS_FIELD+2]=0;

  Uncomment this to test if the remote server actually verifies signatures...*/

  return NT_STATUS_OK;

}

bool smb1_signing_check_pdu(struct smb1_signing_state *si,

         const uint8_t *inhdr, size_t len,

         uint32_t seqnum)

{

  bool good;

  uint8_t calc_md5_mac[16];

  const uint8_t *reply_sent_mac;

  NTSTATUS status;

  if (si->mac_key.length == 0) {

    return true;

  }

  if (len < (HDR_SS_FIELD + 8)) {

    DBG_WARNING("Can't check signature "

       "on short packet! smb_len = %u\n",

       (unsigned)len);

    return false;

  }

  status = smb1_signing_md5(&si->mac_key,

         inhdr,

         len,

         seqnum,

         calc_md5_mac);

  if (!NT_STATUS_IS_OK(status)) {

    DBG_ERR("Failed to calculate signing mac: %s\n",

      nt_errstr(status));

    return false;

  }

  reply_sent_mac = &inhdr[HDR_SS_FIELD];

  good = mem_equal_const_time(reply_sent_mac, calc_md5_mac, 8);

  if (!good) {

    int i;

    const int sign_range = 5;

    DBG_INFO("BAD SIG: wanted SMB signature of\n");

    dump_data(5, calc_md5_mac, 8);

    DBG_INFO("BAD SIG: got SMB signature of\n");

    dump_data(5, reply_sent_mac, 8);

    for (i = -sign_range; i < sign_range; i++) {

      smb1_signing_md5(&si->mac_key, inhdr, len,

          seqnum+i, calc_md5_mac);

      if (mem_equal_const_time(reply_sent_mac, calc_md5_mac, 8)) {

        DBG_ERR("out of seq. seq num %u matches. "

           "We were expecting seq %u\n",

           (unsigned int)seqnum+i,

           (unsigned int)seqnum);

        break;

      }

    }

  } else {

    DBG_DEBUG("seq %u: got good SMB signature of\n",

         (unsigned int)seqnum);

    dump_data(10, reply_sent_mac, 8);

  }

  return smb1_signing_good(si, good, seqnum);

}

bool smb1_signing_activate(struct smb1_signing_state *si,

        const DATA_BLOB user_session_key,

        const DATA_BLOB response)

{

  size_t len;

  off_t ofs;

  if (!user_session_key.length) {

    return false;

  }

  if (!si->negotiated) {

    return false;

  }

  if (si->active) {

    return false;

  }

  if (si->mac_key.length > 0) {

    return false;

  }

  smb1_signing_reset_info(si);

  len = response.length + user_session_key.length;

  if (si->alloc_fn) {

    si->mac_key.data = (uint8_t *)si->alloc_fn(si->mem_ctx, len);

    if (si->mac_key.data == NULL) {

      return false;

    }

  } else {

    si->mac_key.data = (uint8_t *)talloc_size(si, len);

    if (si->mac_key.data == NULL) {

      return false;

    }

  }

  si->mac_key.length = len;

  ofs = 0;

  memcpy(&si->mac_key.data[ofs], user_session_key.data, user_session_key.length);

  DBG_DEBUG("user_session_key\n");

  dump_data(10, user_session_key.data, user_session_key.length);

  if (response.length) {

    ofs = user_session_key.length;

    memcpy(&si->mac_key.data[ofs], response.data, response.length);

    DBG_DEBUG("response_data\n");

    dump_data(10, response.data, response.length);

  } else {

    DBG_DEBUG("NULL response_data\n");

  }

  dump_data_pw("smb1_signing_activate: mac key is:\n",

         si->mac_key.data, si->mac_key.length);

  /* Initialise the sequence number */

  si->seqnum = 2;

  return true;

}

bool smb1_signing_is_active(struct smb1_signing_state *si)

{

  return si->active;

}

bool smb1_signing_is_desired(struct smb1_signing_state *si)

{

  return si->desired;

}

bool smb1_signing_is_mandatory(struct smb1_signing_state *si)

{

  return si->mandatory;

}

bool smb1_signing_set_negotiated(struct smb1_signing_state *si,

        bool allowed, bool mandatory)

{

  if (si->active) {

    return true;

  }

  if (mandatory) {

    allowed = true;

  }

  if (!si->allowed && mandatory) {

    return false;

  }

  if (si->mandatory && !allowed) {

    return false;

  }

  if (si->mandatory) {

    si->negotiated = true;

    return true;

  }

  if (mandatory) {

    si->negotiated = true;

    return true;

  }

  if (!si->desired) {

    si->negotiated = false;

    return true;

  }

  if (si->desired && allowed) {

    si->negotiated = true;

    return true;

  }

  si->negotiated = false;

  return true;

}

bool smb1_signing_is_negotiated(struct smb1_signing_state *si)

{

  return si->negotiated;

}

NTSTATUS smb1_key_derivation(const uint8_t *KI,

          size_t KI_len,

          uint8_t KO[16])

{

  int rc;

  static const uint8_t SSKeyHash[256] = {

    0x53, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79,

    0x20, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75,

    0x72, 0x65, 0x20, 0x4b, 0x65, 0x79, 0x20, 0x55,

    0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x79, 0x07,

    0x6e, 0x28, 0x2e, 0x69, 0x88, 0x10, 0xb3, 0xdb,

    0x01, 0x55, 0x72, 0xfb, 0x74, 0x14, 0xfb, 0xc4,

    0xc5, 0xaf, 0x3b, 0x41, 0x65, 0x32, 0x17, 0xba,

    0xa3, 0x29, 0x08, 0xc1, 0xde, 0x16, 0x61, 0x7e,

    0x66, 0x98, 0xa4, 0x0b, 0xfe, 0x06, 0x83, 0x53,

    0x4d, 0x05, 0xdf, 0x6d, 0xa7, 0x51, 0x10, 0x73,

    0xc5, 0x50, 0xdc, 0x5e, 0xf8, 0x21, 0x46, 0xaa,

    0x96, 0x14, 0x33, 0xd7, 0x52, 0xeb, 0xaf, 0x1f,

    0xbf, 0x36, 0x6c, 0xfc, 0xb7, 0x1d, 0x21, 0x19,

    0x81, 0xd0, 0x6b, 0xfa, 0x77, 0xad, 0xbe, 0x18,

    0x78, 0xcf, 0x10, 0xbd, 0xd8, 0x78, 0xf7, 0xd3,

    0xc6, 0xdf, 0x43, 0x32, 0x19, 0xd3, 0x9b, 0xa8,

    0x4d, 0x9e, 0xaa, 0x41, 0xaf, 0xcb, 0xc6, 0xb9,

    0x34, 0xe7, 0x48, 0x25, 0xd4, 0x88, 0xc4, 0x51,

    0x60, 0x38, 0xd9, 0x62, 0xe8, 0x8d, 0x5b, 0x83,

    0x92, 0x7f, 0xb5, 0x0e, 0x1c, 0x2d, 0x06, 0x91,

    0xc3, 0x75, 0xb3, 0xcc, 0xf8, 0xf7, 0x92, 0x91,

    0x0b, 0x3d, 0xa1, 0x10, 0x5b, 0xd5, 0x0f, 0xa8,

    0x3f, 0x5d, 0x13, 0x83, 0x0a, 0x6b, 0x72, 0x93,

    0x14, 0x59, 0xd5, 0xab, 0xde, 0x26, 0x15, 0x6d,

    0x60, 0x67, 0x71, 0x06, 0x6e, 0x3d, 0x0d, 0xa7,

    0xcb, 0x70, 0xe9, 0x08, 0x5c, 0x99, 0xfa, 0x0a,

    0x5f, 0x3d, 0x44, 0xa3, 0x8b, 0xc0, 0x8d, 0xda,

    0xe2, 0x68, 0xd0, 0x0d, 0xcd, 0x7f, 0x3d, 0xf8,

    0x73, 0x7e, 0x35, 0x7f, 0x07, 0x02, 0x0a, 0xb5,

    0xe9, 0xb7, 0x87, 0xfb, 0xa1, 0xbf, 0xcb, 0x32,

    0x31, 0x66, 0x09, 0x48, 0x88, 0xcc, 0x18, 0xa3,

    0xb2, 0x1f, 0x1f, 0x1b, 0x90, 0x4e, 0xd7, 0xe1

  };

  /* The callers passing down KI_len of 16 so no need to limit to 64 */

  rc = gnutls_hmac_fast(GNUTLS_MAC_MD5,

            KI,

            KI_len,

            SSKeyHash,

            sizeof(SSKeyHash),

            KO);

  if (rc < 0) {

    return gnutls_error_to_ntstatus(rc, NT_STATUS_HMAC_NOT_SUPPORTED);

  }

  return NT_STATUS_OK;

}