From patchwork Fri Sep 20 07:07:22 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve French X-Patchwork-Id: 11153845 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id D53051745 for ; Fri, 20 Sep 2019 07:07:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A5984206C2 for ; Fri, 20 Sep 2019 07:07:37 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="eMZqqOKv" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390684AbfITHHh (ORCPT ); Fri, 20 Sep 2019 03:07:37 -0400 Received: from mail-io1-f50.google.com ([209.85.166.50]:39455 "EHLO mail-io1-f50.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2390630AbfITHHh (ORCPT ); Fri, 20 Sep 2019 03:07:37 -0400 Received: by mail-io1-f50.google.com with SMTP id a1so13874077ioc.6 for ; Fri, 20 Sep 2019 00:07:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=okJYcSdtFVyAVwO/GO4YqAqofHrbE1eBVlcWVEJegAw=; b=eMZqqOKv4wfevbxpa+sdw3ZObLugRtncz6gfUX81PAIpc7WyON0lSLVCtNmy8o69/P IYXLj/B8Cwv5GBRX6bE+1mdk6dPaOk3JE++PZKe9X5G0bbNTpMevBI6SGjiZ0f6gcWzZ UxWtnS4NsngQBScXyxb9Uh1FE3VkQj5tWNmo+77kLu4nYi9qzmZImnjzt3Z3dcHkiCkO aPt2sHZ5sHMJOztMzfmHsMVdREttI+XQ9z4mKTYiOfkB3AAwAUpu+Rv4NEJCET0kj6kN F+VBB6nPUb2wo82sFx+IiVoQhLSbO5K0ockxDARTciDkM3c4w06PuhvukgzdMiB+2GCc WTWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=okJYcSdtFVyAVwO/GO4YqAqofHrbE1eBVlcWVEJegAw=; b=gYcAm4Wd/mocqcrCHVnz/aMcBMCJCHtvpM5Vhkk4SGmhuUBgRa1tWQJsBJNnwKggZ0 FOCk5QJSQoOPdn7v1SFMiOK8vBYeM6iIC07uTwU6DIkWZerkEo7A0bZnPoQSYwiSaber 78hsJloNq1shEmDDjfrN62X89QvUpQZiEOOATVKaLfBR5ELmUQmreaxQXgu5q6o/wXaX GQQOo/56BQGWHmELni6sHierAxwWWK4Xw+zzneEJ9MFqMAuy5ryggXXLHbdeIyZ6ZtOg XC/RSJgAt7Br7+TMUrCuUgOA/6J79s0wmrSC6upR13fllzfubS7E1AjwDDURGexne6OJ DM2A== X-Gm-Message-State: APjAAAUOYL+cbYo0y+Eoea//PObzyNd+hhE+G0MuWDg+jj/oBFHQenxP 4ouR/53KciWixssY6TyrlG/Izdh14jzRpTHJW1I= X-Google-Smtp-Source: APXvYqwaWnUYhLz/O5M7qwUTJfuDLy/m+SCebXVVZJ5xZfcP7thnewkk9koxIOMwg0y+yEGYUW+gCWu8h+pJUBiCcjY= X-Received: by 2002:a5d:8e0d:: with SMTP id e13mr5099659iod.3.1568963254367; Fri, 20 Sep 2019 00:07:34 -0700 (PDT) MIME-Version: 1.0 From: Steve French Date: Fri, 20 Sep 2019 02:07:22 -0500 Message-ID: Subject: [SMB3][PATCH] dump encryption keys to allow wireshark debugging of encrypted To: =?utf-8?q?Aur=C3=A9lien_Aptel?= , CIFS , samba-technical Sender: linux-cifs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-cifs@vger.kernel.org kernel patch updated to check if encryption is enabled In order to debug certain problems it is important to be able to decrypt network traces (e.g. wireshark) but to do this we need to be able to dump out the encryption/decryption keys. Dumping them to an ioctl is safer than dumping then to dmesg, (and better than showing all keys in a pseudofile). Restrict this to root (CAP_SYS_ADMIN), and only for a mount that this admin has access to. Sample smbinfo output: SMB3.0 encryption Session Id: 0x82d2ec52 Session Key: a5 6d 81 d0 e c1 ca e1 d8 13 aa 20 e8 f2 cc 71 Server Encryption Key: 1a c3 be ba 3d fc dc 3c e bc 93 9e 50 9e 19 c1 Server Decryption Key: e0 d4 d9 43 1b a2 1b e3 d8 76 77 49 56 f7 20 88 From 3cee2eec9c2849bf1148b5d51b5e7147e97b0b55 Mon Sep 17 00:00:00 2001 From: Steve French Date: Thu, 19 Sep 2019 04:00:55 -0500 Subject: [PATCH] smb3: allow decryption keys to be dumped by admin for debugging In order to debug certain problems it is important to be able to decrypt network traces (e.g. wireshark) but to do this we need to be able to dump out the encryption/decryption keys. Dumping them to an ioctl is safer than dumping then to dmesg, (and better than showing all keys in a pseudofile). Restrict this to root (CAP_SYS_ADMIN), and only for a mount that this admin has access to. Sample smbinfo output: SMB3.0 encryption Session Id: 0x82d2ec52 Session Key: a5 6d 81 d0 e c1 ca e1 d8 13 aa 20 e8 f2 cc 71 Server Encryption Key: 1a c3 be ba 3d fc dc 3c e bc 93 9e 50 9e 19 c1 Server Decryption Key: e0 d4 d9 43 1b a2 1b e3 d8 76 77 49 56 f7 20 88 Reviewed-by: Aurelien Aptel Signed-off-by: Steve French --- fs/cifs/cifs_ioctl.h | 9 +++++++++ fs/cifs/ioctl.c | 29 +++++++++++++++++++++++++++++ 2 files changed, 38 insertions(+) diff --git a/fs/cifs/cifs_ioctl.h b/fs/cifs/cifs_ioctl.h index 6c3bd07868d7..0f0dc1c1fe41 100644 --- a/fs/cifs/cifs_ioctl.h +++ b/fs/cifs/cifs_ioctl.h @@ -57,9 +57,18 @@ struct smb_query_info { /* char buffer[]; */ } __packed; +struct smb3_key_debug_info { + __u64 Suid; + __u16 cipher_type; + __u8 auth_key[16]; /* SMB2_NTLMV2_SESSKEY_SIZE */ + __u8 smb3encryptionkey[SMB3_SIGN_KEY_SIZE]; + __u8 smb3decryptionkey[SMB3_SIGN_KEY_SIZE]; +} __packed; + #define CIFS_IOCTL_MAGIC 0xCF #define CIFS_IOC_COPYCHUNK_FILE _IOW(CIFS_IOCTL_MAGIC, 3, int) #define CIFS_IOC_SET_INTEGRITY _IO(CIFS_IOCTL_MAGIC, 4) #define CIFS_IOC_GET_MNT_INFO _IOR(CIFS_IOCTL_MAGIC, 5, struct smb_mnt_fs_info) #define CIFS_ENUMERATE_SNAPSHOTS _IOR(CIFS_IOCTL_MAGIC, 6, struct smb_snapshot_array) #define CIFS_QUERY_INFO _IOWR(CIFS_IOCTL_MAGIC, 7, struct smb_query_info) +#define CIFS_DUMP_KEY _IOWR(CIFS_IOCTL_MAGIC, 8, struct smb3_key_debug_info) diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c index 76ddd98b6298..48c23929350c 100644 --- a/fs/cifs/ioctl.c +++ b/fs/cifs/ioctl.c @@ -164,6 +164,7 @@ static long smb_mnt_get_fsinfo(unsigned int xid, struct cifs_tcon *tcon, long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg) { struct inode *inode = file_inode(filep); + struct smb3_key_debug_info pkey_inf; int rc = -ENOTTY; /* strange error - but the precedent */ unsigned int xid; struct cifsFileInfo *pSMBFile = filep->private_data; @@ -270,6 +271,34 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg) else rc = -EOPNOTSUPP; break; + case CIFS_DUMP_KEY: + cifs_dbg(VFS, "ioctl dumpkey\n"); /* BB REMOVEME */ + if (pSMBFile == NULL) + break; + if (!capable(CAP_SYS_ADMIN)) { + rc = -EACCES; + break; + } + tcon = tlink_tcon(pSMBFile->tlink); + if (!smb3_encryption_required(tcon)) { + rc = -EOPNOTSUPP; + break; + } + pkey_inf.cipher_type = + le16_to_cpu(tcon->ses->server->cipher_type); + pkey_inf.Suid = tcon->ses->Suid; + memcpy(pkey_inf.auth_key, tcon->ses->auth_key.response, + 16 /* SMB2_NTLMV2_SESSKEY_SIZE */); + memcpy(pkey_inf.smb3decryptionkey, + tcon->ses->smb3decryptionkey, SMB3_SIGN_KEY_SIZE); + memcpy(pkey_inf.smb3encryptionkey, + tcon->ses->smb3encryptionkey, SMB3_SIGN_KEY_SIZE); + if (copy_to_user((void __user *)arg, &pkey_inf, + sizeof(struct smb3_key_debug_info))) + rc = -EFAULT; + else + rc = 0; + break; default: cifs_dbg(FYI, "unsupported ioctl\n"); break; -- 2.20.1