linux-kernel - Re: [PATCH 2/3] ksmbd: Use HMAC-SHA256 library for message signing and key generation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAKYAXd8Zwnr2bv85_xEekjOHvSqC7dtfZw+ETZnv1s_d+ZRyiw@mail.gmail.com>
Date: Thu, 16 Oct 2025 14:00:37 +0900
From: Namjae Jeon <linkinjeon@...nel.org>
To: Eric Biggers <ebiggers@...nel.org>
Cc: linux-cifs@...r.kernel.org, Steve French <smfrench@...il.com>, 
	Sergey Senozhatsky <senozhatsky@...omium.org>, Tom Talpey <tom@...pey.com>, linux-crypto@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/3] ksmbd: Use HMAC-SHA256 library for message signing
 and key generation

[snip]
> @@ -8876,22 +8865,21 @@ void smb2_set_sign_rsp(struct ksmbd_work *work)
>         struct kvec *iov;
>         int n_vec = 1;
>
>         hdr = ksmbd_resp_buf_curr(work);
>         hdr->Flags |= SMB2_FLAGS_SIGNED;
> -       memset(hdr->Signature, 0, SMB2_SIGNATURE_SIZE);
By deleting this line, the following error occurs.

[162118.260693] CIFS: VFS: sign fail cmd 0x3 message id 0x3
[162118.260707] CIFS: VFS: \\10.177.110.57 SMB signature verification
returned error = -13
[162118.261473] CIFS: VFS: sign fail cmd 0xb message id 0x4
[162118.261482] CIFS: VFS: \\10.177.110.57 SMB signature verification
returned error = -13
[162118.262437] CIFS: VFS: sign fail cmd 0x3 message id 0x5
[162118.262449] CIFS: VFS: \\10.177.110.57 SMB signature verification
returned error = -13
[162118.262892] CIFS: VFS: sign fail cmd 0x5 message id 0x6
[162118.262900] CIFS: VFS: \\10.177.110.57 SMB signature verification
returned error = -13
[162118.263301] CIFS: VFS: sign fail cmd 0x10 message id 0x7
[162118.263314] CIFS: VFS: \\10.177.110.57 SMB signature verification
returned error = -13
[162118.263724] CIFS: VFS: sign fail cmd 0x10 message id 0x8
[162118.263736] CIFS: VFS: \\10.177.110.57 SMB signature verification
returned error = -13
[162118.264142] CIFS: VFS: sign fail cmd 0x6 message id 0x9
[162118.264154] CIFS: VFS: \\10.177.110.57 SMB signature verification
returned error = -13
[162118.264591] CIFS: VFS: sign fail cmd 0x5 message id 0xa
[162118.264603] CIFS: VFS: \\10.177.110.57 SMB signature verification
returned error = -13
[162118.264912] CIFS: VFS: sign fail cmd 0x6 message id 0xb
[162118.264925] CIFS: VFS: \\10.177.110.57 SMB signature verification
returned error = -13
[162118.265244] CIFS: VFS: sign fail cmd 0x5 message id 0xc
[162118.265257] CIFS: VFS: \\10.177.110.57 SMB signature verification
returned error = -13
[162119.831575] CIFS: VFS: \\10.177.110.57\homes2 SMB signature
verification returned error = -13

I have directly restored this line manually and then applied this
patch to #ksmbd-for-next-next.
Thanks!
>
>         if (hdr->Command == SMB2_READ) {
>                 iov = &work->iov[work->iov_idx - 1];
>                 n_vec++;
>         } else {
>                 iov = &work->iov[work->iov_idx];
>         }
>
> -       if (!ksmbd_sign_smb2_pdu(work->conn, work->sess->sess_key, iov, n_vec,
> -                                signature))
> -               memcpy(hdr->Signature, signature, SMB2_SIGNATURE_SIZE);
> +       ksmbd_sign_smb2_pdu(work->conn, work->sess->sess_key, iov, n_vec,
> +                           signature);
> +       memcpy(hdr->Signature, signature, SMB2_SIGNATURE_SIZE);
>  }
>
>  /**
>   * smb3_check_sign_req() - handler for req packet sign processing
>   * @work:   smb work containing notify command buffer
> diff --git a/fs/smb/server/smb_common.h b/fs/smb/server/smb_common.h
> index d742ba754348b..b6e0659a7e414 100644
> --- a/fs/smb/server/smb_common.h
> +++ b/fs/smb/server/smb_common.h
> @@ -407,11 +407,11 @@ struct smb_version_ops {
>         int (*get_ksmbd_tcon)(struct ksmbd_work *work);
>         bool (*is_sign_req)(struct ksmbd_work *work, unsigned int command);
>         int (*check_sign_req)(struct ksmbd_work *work);
>         void (*set_sign_rsp)(struct ksmbd_work *work);
>         int (*generate_signingkey)(struct ksmbd_session *sess, struct ksmbd_conn *conn);
> -       int (*generate_encryptionkey)(struct ksmbd_conn *conn, struct ksmbd_session *sess);
> +       void (*generate_encryptionkey)(struct ksmbd_conn *conn, struct ksmbd_session *sess);
>         bool (*is_transform_hdr)(void *buf);
>         int (*decrypt_req)(struct ksmbd_work *work);
>         int (*encrypt_resp)(struct ksmbd_work *work);
>  };
>
> --
> 2.51.0
>