search

hierynomus / smbj

Server Message Block (SMB2, SMB3) implementation in Java
Other
713 stars 180 forks source link

padding during signing/verification SMB2 Signature #546

Open Malunke opened 4 years ago

Malunke commented 4 years ago

Dear Developers,

I can't use SMB2 with OmniOS.

I think it is related to: https://illumos.topicbox.com/groups/developer/T5092d83142769ad1/smb2-with-android-mixplorer-and-illumos-omnios

The signature is only ever 16 bytes long. The fix for the linked issue suggests that the SMBJ implementation didn't account for padding during signing/verification. 

E/abc> Signatures for packet SMB2_CREATE with message id << 5 >> do not match (received: [49, -88, 58, 58, -71, -78, 45, -122, 51, -71, 7, 10, 20, -33, 112, -38], calculated: [79, -111, -37, -93, 114, 76, -103, 43, 73, -52, -123, 85, 45, 9, 63, 123, 18, -100, -123, -107, 104, -65, -125, 105, -108, 124, 86, 39, -100, -38, -47, 46])

E/abc> Packet SMB2_CREATE with message id << 5 >> has header: dialect=null, creditCharge=1, creditRequest=0, creditResponse=2, message=SMB2_CREATE, messageId=5, asyncId=0, sessionId=1, treeId=1, status=0x00000000, flags=9, nextCommandOffset=0

E/yo> << 5 >> woke to: libs.zu: libs.yv: Packet signature for packet SMB2_CREATE with message id << 5 >> was not correct
hierynomus commented 4 years ago

Correct, however this issue was fixed way back. As indicated in the linked thread. The App developer of the client application needs to update the dependency to the latest version.

Malunke commented 4 years ago

Thanks a lot - the developer promised he updated everything but it still doesn't work. I will forward it to the developer and ask him to double check his implementation.

Thanks a lot.

hierynomus commented 4 years ago

Otherwise, do you have a pcap (network trace) file which can be analyzed?

Op di 14 apr. 2020 om 19:34 schreef Malunke notifications@github.com:

Thanks a lot - the developer promised he updated everything but it still doesn't work. I will forward it to the developer and ask him to double check his implementation.

Thanks a lot.

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/hierynomus/smbj/issues/546#issuecomment-613578466, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAA4XIYXS2P2AFPUQRYN763RMSNBDANCNFSM4MH36JOQ .

Malunke commented 4 years ago

I can't use wireshark because the client is my android phone (I don't know how to capture there) and the server is OmniOS -> also there packet capture is difficult for me.

The developer of MiXplorer answered to me:

The log shows that in this class "PacketSignatory", it can't verify the signature of the received packet header. Maybe its algorithm is not "HmacSHA256" but I'm not sure. I'm using the latest version of library. Maybe there is a setting I need to change but I don't really know.