1a90cf9f2SGordon Ross /* 2a90cf9f2SGordon Ross * This file and its contents are supplied under the terms of the 3a90cf9f2SGordon Ross * Common Development and Distribution License ("CDDL"), version 1.0. 4a90cf9f2SGordon Ross * You may only use this file in accordance with the terms of version 5a90cf9f2SGordon Ross * 1.0 of the CDDL. 6a90cf9f2SGordon Ross * 7a90cf9f2SGordon Ross * A full copy of the text of the CDDL should have accompanied this 8a90cf9f2SGordon Ross * source. A copy of the CDDL is also available via the Internet at 9a90cf9f2SGordon Ross * http://www.illumos.org/license/CDDL. 10a90cf9f2SGordon Ross */ 11a90cf9f2SGordon Ross 12a90cf9f2SGordon Ross /* 13*4ad35fa3SMatt Barden * Copyright 2019 Nexenta Systems, Inc. All rights reserved. 14700daa96SAndrew Stormont * Copyright 2019 RackTop Systems. 15a90cf9f2SGordon Ross */ 16a90cf9f2SGordon Ross 17a90cf9f2SGordon Ross /* 18a90cf9f2SGordon Ross * Dispatch function for SMB2_NEGOTIATE 19a90cf9f2SGordon Ross */ 20a90cf9f2SGordon Ross 21a90cf9f2SGordon Ross #include <smbsrv/smb2_kproto.h> 22a90cf9f2SGordon Ross #include <smbsrv/smb2.h> 23a90cf9f2SGordon Ross 24ebc5aadbSAndrew Stormont /* 25ebc5aadbSAndrew Stormont * Note from [MS-SMB2] Sec. 2.2.3: Windows servers return 26ebc5aadbSAndrew Stormont * invalid parameter if the dialect count is greater than 64 27ebc5aadbSAndrew Stormont * This is here (and not in smb2.h) because this is technically 28ebc5aadbSAndrew Stormont * an implementation detail, not protocol specification. 29ebc5aadbSAndrew Stormont */ 30ebc5aadbSAndrew Stormont #define SMB2_NEGOTIATE_MAX_DIALECTS 64 31ebc5aadbSAndrew Stormont 32a90cf9f2SGordon Ross static int smb2_negotiate_common(smb_request_t *, uint16_t); 33a90cf9f2SGordon Ross 34700daa96SAndrew Stormont /* List of supported capabilities. Can be patched for testing. */ 35a90cf9f2SGordon Ross uint32_t smb2srv_capabilities = 36a90cf9f2SGordon Ross SMB2_CAP_DFS | 3794047d49SGordon Ross SMB2_CAP_LEASING | 381160dcf7SMatt Barden SMB2_CAP_LARGE_MTU | 398d94f651SGordon Ross SMB2_CAP_PERSISTENT_HANDLES | 401160dcf7SMatt Barden SMB2_CAP_ENCRYPTION; 41a90cf9f2SGordon Ross 428d94f651SGordon Ross /* These are the only capabilities defined for SMB2.X */ 438d94f651SGordon Ross #define SMB_2X_CAPS (SMB2_CAP_DFS | SMB2_CAP_LEASING | SMB2_CAP_LARGE_MTU) 448d94f651SGordon Ross 45a90cf9f2SGordon Ross /* 46a90cf9f2SGordon Ross * These are not intended as customer tunables, but dev. & test folks 47a90cf9f2SGordon Ross * might want to adjust them (with caution). 48a90cf9f2SGordon Ross * 49a90cf9f2SGordon Ross * smb2_tcp_bufsize is the TCP buffer size, applied to the network socket 50a90cf9f2SGordon Ross * with setsockopt SO_SNDBUF, SO_RCVBUF. These set the TCP window size. 51a90cf9f2SGordon Ross * This is also used as a "sanity limit" for internal send/reply message 52a90cf9f2SGordon Ross * allocations. Note that with compounding SMB2 messages may contain 53a90cf9f2SGordon Ross * multiple requests/responses. This size should be large enough for 54a90cf9f2SGordon Ross * at least a few SMB2 requests, and at least 2X smb2_max_rwsize. 55a90cf9f2SGordon Ross * 56a90cf9f2SGordon Ross * smb2_max_rwsize is what we put in the SMB2 negotiate response to tell 57a90cf9f2SGordon Ross * the client the largest read and write request size we'll support. 5887ca5dcaSGordon Ross * For now, we're using contiguous allocations, so keep this at 64KB 5987ca5dcaSGordon Ross * so that (even with message overhead) allocations stay below 128KB, 6087ca5dcaSGordon Ross * avoiding kmem_alloc -> page_create_va thrashing. 61a90cf9f2SGordon Ross * 62a90cf9f2SGordon Ross * smb2_max_trans is the largest "transact" send or receive, which is 63a90cf9f2SGordon Ross * used for directory listings and info set/get operations. 64a90cf9f2SGordon Ross */ 65a90cf9f2SGordon Ross uint32_t smb2_tcp_bufsize = (1<<22); /* 4MB */ 6687ca5dcaSGordon Ross uint32_t smb2_max_rwsize = (1<<16); /* 64KB */ 67a90cf9f2SGordon Ross uint32_t smb2_max_trans = (1<<16); /* 64KB */ 68a90cf9f2SGordon Ross 69a90cf9f2SGordon Ross /* 70aa321b3cSDan McDonald * With clients (e.g. HP scanners) that don't advertise SMB2_CAP_LARGE_MTU 71aa321b3cSDan McDonald * (including all clients using dialect < SMB 2.1), use a "conservative" value 72aa321b3cSDan McDonald * for max r/w size because some older clients misbehave with larger values. 73aa321b3cSDan McDonald * 64KB is recommended in the [MS-SMB2] spec. (3.3.5.3.1 SMB 2.1 or SMB 3.x 74aa321b3cSDan McDonald * Support) as the minimum so we'll use that. 75aa321b3cSDan McDonald */ 76aa321b3cSDan McDonald uint32_t smb2_old_rwsize = (1<<16); /* 64KB */ 77aa321b3cSDan McDonald 78aa321b3cSDan McDonald /* 79a90cf9f2SGordon Ross * List of all SMB2 versions we implement. Note that the 803e2c0c09SMatt Barden * versions we support may be limited by the 813e2c0c09SMatt Barden * _cfg.skc_max_protocol and min_protocol settings. 82a90cf9f2SGordon Ross */ 83a90cf9f2SGordon Ross static uint16_t smb2_versions[] = { 84a90cf9f2SGordon Ross 0x202, /* SMB 2.002 */ 85a90cf9f2SGordon Ross 0x210, /* SMB 2.1 */ 86c51c88bdSMatt Barden 0x300, /* SMB 3.0 */ 87dfa42fabSMatt Barden 0x302, /* SMB 3.02 */ 88a90cf9f2SGordon Ross }; 89a90cf9f2SGordon Ross static uint16_t smb2_nversions = 90a90cf9f2SGordon Ross sizeof (smb2_versions) / sizeof (smb2_versions[0]); 91a90cf9f2SGordon Ross 92a90cf9f2SGordon Ross static boolean_t 93a90cf9f2SGordon Ross smb2_supported_version(smb_session_t *s, uint16_t version) 94a90cf9f2SGordon Ross { 95a90cf9f2SGordon Ross int i; 96a90cf9f2SGordon Ross 973e2c0c09SMatt Barden if (version > s->s_cfg.skc_max_protocol || 983e2c0c09SMatt Barden version < s->s_cfg.skc_min_protocol) 99a90cf9f2SGordon Ross return (B_FALSE); 100a90cf9f2SGordon Ross for (i = 0; i < smb2_nversions; i++) 101a90cf9f2SGordon Ross if (version == smb2_versions[i]) 102a90cf9f2SGordon Ross return (B_TRUE); 103a90cf9f2SGordon Ross return (B_FALSE); 104a90cf9f2SGordon Ross } 105a90cf9f2SGordon Ross 106a90cf9f2SGordon Ross /* 107a90cf9f2SGordon Ross * Helper for the (SMB1) smb_com_negotiate(). This is the 108a90cf9f2SGordon Ross * very unusual protocol interaction where an SMB1 negotiate 109a90cf9f2SGordon Ross * gets an SMB2 negotiate response. This is the normal way 110a90cf9f2SGordon Ross * clients first find out if the server supports SMB2. 111a90cf9f2SGordon Ross * 112a90cf9f2SGordon Ross * Note: This sends an SMB2 reply _itself_ and then returns 113a90cf9f2SGordon Ross * SDRC_NO_REPLY so the caller will not send an SMB1 reply. 114a90cf9f2SGordon Ross * Also, this is called directly from the reader thread, so 115a90cf9f2SGordon Ross * we know this is the only thread using this session. 116a90cf9f2SGordon Ross * 117a90cf9f2SGordon Ross * The caller frees this request. 118a90cf9f2SGordon Ross */ 119a90cf9f2SGordon Ross smb_sdrc_t 120a90cf9f2SGordon Ross smb1_negotiate_smb2(smb_request_t *sr) 121a90cf9f2SGordon Ross { 122a90cf9f2SGordon Ross smb_session_t *s = sr->session; 123a90cf9f2SGordon Ross smb_arg_negotiate_t *negprot = sr->sr_negprot; 124a90cf9f2SGordon Ross uint16_t smb2_version; 125a90cf9f2SGordon Ross 126a90cf9f2SGordon Ross /* 127a90cf9f2SGordon Ross * Note: In the SMB1 negotiate command handler, we 128a90cf9f2SGordon Ross * agreed with one of the SMB2 dialects. If that 129a90cf9f2SGordon Ross * dialect was "SMB 2.002", we'll respond here with 130a90cf9f2SGordon Ross * version 0x202 and negotiation is done. If that 131a90cf9f2SGordon Ross * dialect was "SMB 2.???", we'll respond here with 132a90cf9f2SGordon Ross * the "wildcard" version 0x2FF, and the client will 133a90cf9f2SGordon Ross * come back with an SMB2 negotiate. 134a90cf9f2SGordon Ross */ 135a90cf9f2SGordon Ross switch (negprot->ni_dialect) { 136a90cf9f2SGordon Ross case DIALECT_SMB2002: /* SMB 2.002 (a.k.a. SMB2.0) */ 1373e2c0c09SMatt Barden smb2_version = SMB_VERS_2_002; 138a90cf9f2SGordon Ross s->dialect = smb2_version; 139a90cf9f2SGordon Ross s->s_state = SMB_SESSION_STATE_NEGOTIATED; 140a90cf9f2SGordon Ross /* Allow normal SMB2 requests now. */ 141a90cf9f2SGordon Ross s->newrq_func = smb2sr_newrq; 142a90cf9f2SGordon Ross break; 143a90cf9f2SGordon Ross case DIALECT_SMB2XXX: /* SMB 2.??? (wildcard vers) */ 144a90cf9f2SGordon Ross /* 145a90cf9f2SGordon Ross * Expecting an SMB2 negotiate next, so keep the 1461160dcf7SMatt Barden * initial s->newrq_func. 147a90cf9f2SGordon Ross */ 148a90cf9f2SGordon Ross smb2_version = 0x2FF; 149a90cf9f2SGordon Ross break; 150a90cf9f2SGordon Ross default: 151a90cf9f2SGordon Ross return (SDRC_DROP_VC); 152a90cf9f2SGordon Ross } 153a90cf9f2SGordon Ross 154a90cf9f2SGordon Ross /* 155a90cf9f2SGordon Ross * We did not decode an SMB2 header, so make sure 156a90cf9f2SGordon Ross * the SMB2 header fields are initialized. 157a90cf9f2SGordon Ross * (Most are zero from smb_request_alloc.) 158a90cf9f2SGordon Ross * Also, the SMB1 common dispatch code reserved space 159a90cf9f2SGordon Ross * for an SMB1 header, which we need to undo here. 160a90cf9f2SGordon Ross */ 161a90cf9f2SGordon Ross sr->smb2_reply_hdr = sr->reply.chain_offset = 0; 162a90cf9f2SGordon Ross sr->smb2_cmd_code = SMB2_NEGOTIATE; 163ebc5aadbSAndrew Stormont sr->smb2_hdr_flags = SMB2_FLAGS_SERVER_TO_REDIR; 164a90cf9f2SGordon Ross 165ebc5aadbSAndrew Stormont (void) smb2_encode_header(sr, B_FALSE); 166ebc5aadbSAndrew Stormont if (smb2_negotiate_common(sr, smb2_version) != 0) 167ebc5aadbSAndrew Stormont sr->smb2_status = NT_STATUS_INTERNAL_ERROR; 168ebc5aadbSAndrew Stormont if (sr->smb2_status != 0) 169ebc5aadbSAndrew Stormont smb2sr_put_error(sr, sr->smb2_status); 170ebc5aadbSAndrew Stormont (void) smb2_encode_header(sr, B_TRUE); 171ebc5aadbSAndrew Stormont 17293bc28dbSGordon Ross smb2_send_reply(sr); 173a90cf9f2SGordon Ross 17493bc28dbSGordon Ross /* 17593bc28dbSGordon Ross * We sent the reply, so tell the SMB1 dispatch 17693bc28dbSGordon Ross * it should NOT (also) send a reply. 17793bc28dbSGordon Ross */ 178a90cf9f2SGordon Ross return (SDRC_NO_REPLY); 179a90cf9f2SGordon Ross } 180a90cf9f2SGordon Ross 1811160dcf7SMatt Barden static uint16_t 1821160dcf7SMatt Barden smb2_find_best_dialect(smb_session_t *s, uint16_t cl_versions[], 1831160dcf7SMatt Barden uint16_t version_cnt) 1841160dcf7SMatt Barden { 1851160dcf7SMatt Barden uint16_t best_version = 0; 1861160dcf7SMatt Barden int i; 1871160dcf7SMatt Barden 1881160dcf7SMatt Barden for (i = 0; i < version_cnt; i++) 1891160dcf7SMatt Barden if (smb2_supported_version(s, cl_versions[i]) && 1901160dcf7SMatt Barden best_version < cl_versions[i]) 1911160dcf7SMatt Barden best_version = cl_versions[i]; 1921160dcf7SMatt Barden 1931160dcf7SMatt Barden return (best_version); 1941160dcf7SMatt Barden } 1951160dcf7SMatt Barden 196a90cf9f2SGordon Ross /* 197a90cf9f2SGordon Ross * SMB2 Negotiate gets special handling. This is called directly by 198a90cf9f2SGordon Ross * the reader thread (see smbsr_newrq_initial) with what _should_ be 199a90cf9f2SGordon Ross * an SMB2 Negotiate. Only the "\feSMB" header has been checked 200a90cf9f2SGordon Ross * when this is called, so this needs to check the SMB command, 201a90cf9f2SGordon Ross * if it's Negotiate execute it, then send the reply, etc. 202a90cf9f2SGordon Ross * 203a90cf9f2SGordon Ross * Since this is called directly from the reader thread, we 204a90cf9f2SGordon Ross * know this is the only thread currently using this session. 205a90cf9f2SGordon Ross * This has to duplicate some of what smb2sr_work does as a 206a90cf9f2SGordon Ross * result of bypassing the normal dispatch mechanism. 207a90cf9f2SGordon Ross * 208a90cf9f2SGordon Ross * The caller always frees this request. 20993bc28dbSGordon Ross * 21093bc28dbSGordon Ross * Return value is 0 for success, and anything else will 21193bc28dbSGordon Ross * terminate the reader thread (drop the connection). 212a90cf9f2SGordon Ross */ 213a90cf9f2SGordon Ross int 214a90cf9f2SGordon Ross smb2_newrq_negotiate(smb_request_t *sr) 215a90cf9f2SGordon Ross { 216a90cf9f2SGordon Ross smb_session_t *s = sr->session; 2171160dcf7SMatt Barden int rc; 218ebc5aadbSAndrew Stormont uint32_t status = 0; 219a90cf9f2SGordon Ross uint16_t struct_size; 220a90cf9f2SGordon Ross uint16_t best_version; 221a90cf9f2SGordon Ross uint16_t version_cnt; 222ebc5aadbSAndrew Stormont uint16_t cl_versions[SMB2_NEGOTIATE_MAX_DIALECTS]; 223a90cf9f2SGordon Ross 224a90cf9f2SGordon Ross sr->smb2_cmd_hdr = sr->command.chain_offset; 225a90cf9f2SGordon Ross rc = smb2_decode_header(sr); 226a90cf9f2SGordon Ross if (rc != 0) 227a90cf9f2SGordon Ross return (rc); 228a90cf9f2SGordon Ross 229ebc5aadbSAndrew Stormont if (sr->smb2_hdr_flags & SMB2_FLAGS_SERVER_TO_REDIR) 230ebc5aadbSAndrew Stormont return (-1); 231ebc5aadbSAndrew Stormont 232a90cf9f2SGordon Ross if ((sr->smb2_cmd_code != SMB2_NEGOTIATE) || 233a90cf9f2SGordon Ross (sr->smb2_next_command != 0)) 23493bc28dbSGordon Ross return (-1); 235a90cf9f2SGordon Ross 236a90cf9f2SGordon Ross /* 237a90cf9f2SGordon Ross * Decode SMB2 Negotiate (fixed-size part) 238a90cf9f2SGordon Ross */ 239a90cf9f2SGordon Ross rc = smb_mbc_decodef( 2401160dcf7SMatt Barden &sr->command, "www..l16c8.", 241a90cf9f2SGordon Ross &struct_size, /* w */ 242a90cf9f2SGordon Ross &version_cnt, /* w */ 2431160dcf7SMatt Barden &s->cli_secmode, /* w */ 244a90cf9f2SGordon Ross /* reserved (..) */ 2451160dcf7SMatt Barden &s->capabilities, /* l */ 2461160dcf7SMatt Barden s->clnt_uuid); /* 16c */ 247a90cf9f2SGordon Ross /* start_time 8. */ 248a90cf9f2SGordon Ross if (rc != 0) 249a90cf9f2SGordon Ross return (rc); 250ebc5aadbSAndrew Stormont if (struct_size != 36) 25193bc28dbSGordon Ross return (-1); 252a90cf9f2SGordon Ross 253a90cf9f2SGordon Ross /* 254a90cf9f2SGordon Ross * Decode SMB2 Negotiate (variable part) 255ebc5aadbSAndrew Stormont * 256ebc5aadbSAndrew Stormont * Be somewhat tolerant while decoding the variable part 257ebc5aadbSAndrew Stormont * so we can return errors instead of dropping the client. 258ebc5aadbSAndrew Stormont * Will limit decoding to the size of cl_versions here, 259ebc5aadbSAndrew Stormont * and do the error checks on version_cnt after the 260ebc5aadbSAndrew Stormont * dtrace start probe. 261a90cf9f2SGordon Ross */ 262ebc5aadbSAndrew Stormont if (version_cnt > 0 && 263ebc5aadbSAndrew Stormont version_cnt <= SMB2_NEGOTIATE_MAX_DIALECTS && 264ebc5aadbSAndrew Stormont smb_mbc_decodef(&sr->command, "#w", version_cnt, 265ebc5aadbSAndrew Stormont cl_versions) != 0) { 266ebc5aadbSAndrew Stormont /* decode error; force an error below */ 267ebc5aadbSAndrew Stormont version_cnt = 0; 268ebc5aadbSAndrew Stormont } 26993bc28dbSGordon Ross 27093bc28dbSGordon Ross DTRACE_SMB2_START(op__Negotiate, smb_request_t *, sr); 271a90cf9f2SGordon Ross 272ebc5aadbSAndrew Stormont sr->smb2_hdr_flags |= SMB2_FLAGS_SERVER_TO_REDIR; 273ebc5aadbSAndrew Stormont (void) smb2_encode_header(sr, B_FALSE); 274ebc5aadbSAndrew Stormont 275ebc5aadbSAndrew Stormont /* 276ebc5aadbSAndrew Stormont * [MS-SMB2] 3.3.5.2.4 Verifying the Signature 277ebc5aadbSAndrew Stormont * "If the SMB2 header of the SMB2 NEGOTIATE request has the 278ebc5aadbSAndrew Stormont * SMB2_FLAGS_SIGNED bit set in the Flags field, the server 279ebc5aadbSAndrew Stormont * MUST fail the request with STATUS_INVALID_PARAMETER." 280ebc5aadbSAndrew Stormont */ 281ebc5aadbSAndrew Stormont if ((sr->smb2_hdr_flags & SMB2_FLAGS_SIGNED) != 0) { 282ebc5aadbSAndrew Stormont sr->smb2_hdr_flags &= ~SMB2_FLAGS_SIGNED; 283ebc5aadbSAndrew Stormont status = NT_STATUS_INVALID_PARAMETER; 284ebc5aadbSAndrew Stormont goto errout; 285ebc5aadbSAndrew Stormont } 286ebc5aadbSAndrew Stormont 287ebc5aadbSAndrew Stormont /* 288ebc5aadbSAndrew Stormont * [MS-SMB2] 3.3.5.4 Receiving an SMB2 NEGOTIATE Request 289ebc5aadbSAndrew Stormont * "If the DialectCount of the SMB2 NEGOTIATE Request is 0, the 290ebc5aadbSAndrew Stormont * server MUST fail the request with STATUS_INVALID_PARAMETER." 291ebc5aadbSAndrew Stormont */ 292ebc5aadbSAndrew Stormont if (version_cnt == 0 || 293ebc5aadbSAndrew Stormont version_cnt > SMB2_NEGOTIATE_MAX_DIALECTS) { 294ebc5aadbSAndrew Stormont status = NT_STATUS_INVALID_PARAMETER; 295ebc5aadbSAndrew Stormont goto errout; 296ebc5aadbSAndrew Stormont } 297ebc5aadbSAndrew Stormont 298a90cf9f2SGordon Ross /* 299a90cf9f2SGordon Ross * The client offers an array of protocol versions it 300a90cf9f2SGordon Ross * supports, which we have decoded into cl_versions[]. 301a90cf9f2SGordon Ross * We walk the array and pick the highest supported. 302ebc5aadbSAndrew Stormont * 303ebc5aadbSAndrew Stormont * [MS-SMB2] 3.3.5.4 Receiving an SMB2 NEGOTIATE Request 304ebc5aadbSAndrew Stormont * "If a common dialect is not found, the server MUST fail 305ebc5aadbSAndrew Stormont * the request with STATUS_NOT_SUPPORTED." 306a90cf9f2SGordon Ross */ 3071160dcf7SMatt Barden best_version = smb2_find_best_dialect(s, cl_versions, version_cnt); 3083e2c0c09SMatt Barden if (best_version == 0) { 309ebc5aadbSAndrew Stormont status = NT_STATUS_NOT_SUPPORTED; 3103e2c0c09SMatt Barden goto errout; 3113e2c0c09SMatt Barden } 312a90cf9f2SGordon Ross s->dialect = best_version; 313a90cf9f2SGordon Ross 314a90cf9f2SGordon Ross /* Allow normal SMB2 requests now. */ 315a90cf9f2SGordon Ross s->s_state = SMB_SESSION_STATE_NEGOTIATED; 316a90cf9f2SGordon Ross s->newrq_func = smb2sr_newrq; 317a90cf9f2SGordon Ross 318ebc5aadbSAndrew Stormont if (smb2_negotiate_common(sr, best_version) != 0) 319ebc5aadbSAndrew Stormont status = NT_STATUS_INTERNAL_ERROR; 320a90cf9f2SGordon Ross 3213e2c0c09SMatt Barden errout: 322ebc5aadbSAndrew Stormont sr->smb2_status = status; 32393bc28dbSGordon Ross DTRACE_SMB2_DONE(op__Negotiate, smb_request_t *, sr); 32493bc28dbSGordon Ross 325ebc5aadbSAndrew Stormont if (sr->smb2_status != 0) 326ebc5aadbSAndrew Stormont smb2sr_put_error(sr, sr->smb2_status); 327ebc5aadbSAndrew Stormont (void) smb2_encode_header(sr, B_TRUE); 328ebc5aadbSAndrew Stormont 32993bc28dbSGordon Ross smb2_send_reply(sr); 33093bc28dbSGordon Ross 33193bc28dbSGordon Ross return (rc); 332a90cf9f2SGordon Ross } 333a90cf9f2SGordon Ross 334a90cf9f2SGordon Ross /* 335a90cf9f2SGordon Ross * Common parts of SMB2 Negotiate, used for both the 336a90cf9f2SGordon Ross * SMB1-to-SMB2 style, and straight SMB2 style. 33793bc28dbSGordon Ross * Do negotiation decisions and encode the reply. 33893bc28dbSGordon Ross * The caller does the network send. 33993bc28dbSGordon Ross * 340ebc5aadbSAndrew Stormont * Return value is 0 for success, else error. 341a90cf9f2SGordon Ross */ 342a90cf9f2SGordon Ross static int 343a90cf9f2SGordon Ross smb2_negotiate_common(smb_request_t *sr, uint16_t version) 344a90cf9f2SGordon Ross { 345a90cf9f2SGordon Ross timestruc_t boot_tv, now_tv; 346a90cf9f2SGordon Ross smb_session_t *s = sr->session; 347a90cf9f2SGordon Ross int rc; 348aa321b3cSDan McDonald uint32_t max_rwsize; 349a90cf9f2SGordon Ross uint16_t secmode; 350a90cf9f2SGordon Ross 351a90cf9f2SGordon Ross /* 352a90cf9f2SGordon Ross * Negotiation itself. First the Security Mode. 353a90cf9f2SGordon Ross */ 354a90cf9f2SGordon Ross secmode = SMB2_NEGOTIATE_SIGNING_ENABLED; 355ebc5aadbSAndrew Stormont if (sr->sr_cfg->skc_signing_required) 356a90cf9f2SGordon Ross secmode |= SMB2_NEGOTIATE_SIGNING_REQUIRED; 3571160dcf7SMatt Barden s->srv_secmode = secmode; 358a90cf9f2SGordon Ross 359a90cf9f2SGordon Ross s->cmd_max_bytes = smb2_tcp_bufsize; 360a90cf9f2SGordon Ross s->reply_max_bytes = smb2_tcp_bufsize; 361a90cf9f2SGordon Ross 362a90cf9f2SGordon Ross /* 363a90cf9f2SGordon Ross * "The number of credits held by the client MUST be considered 364a90cf9f2SGordon Ross * as 1 when the connection is established." [MS-SMB2] 365a90cf9f2SGordon Ross * We leave credits at 1 until the first successful 366a90cf9f2SGordon Ross * session setup is completed. 367a90cf9f2SGordon Ross */ 368a90cf9f2SGordon Ross s->s_cur_credits = s->s_max_credits = 1; 369a90cf9f2SGordon Ross sr->smb2_credit_response = 1; 370a90cf9f2SGordon Ross 371a90cf9f2SGordon Ross boot_tv.tv_sec = smb_get_boottime(); 372a90cf9f2SGordon Ross boot_tv.tv_nsec = 0; 373a90cf9f2SGordon Ross now_tv.tv_sec = gethrestime_sec(); 374a90cf9f2SGordon Ross now_tv.tv_nsec = 0; 375a90cf9f2SGordon Ross 376a90cf9f2SGordon Ross /* 377c51c88bdSMatt Barden * If the version is 0x2FF, we haven't completed negotiate. 378c51c88bdSMatt Barden * Don't initialize until we have our final request. 379c51c88bdSMatt Barden */ 380c51c88bdSMatt Barden if (version != 0x2FF) 381c51c88bdSMatt Barden smb2_sign_init_mech(s); 382c51c88bdSMatt Barden 383c51c88bdSMatt Barden /* 3841160dcf7SMatt Barden * [MS-SMB2] 3.3.5.4 Receiving an SMB2 NEGOTIATE Request 3851160dcf7SMatt Barden * 3868d94f651SGordon Ross * The SMB2.x capabilities are returned without regard for 3878d94f651SGordon Ross * what capabilities the client provided in the request. 3888d94f651SGordon Ross * The SMB3.x capabilities returned are the traditional 3898d94f651SGordon Ross * logical AND of server and client capabilities. 3908d94f651SGordon Ross * 3918d94f651SGordon Ross * One additional check: If KCF is missing something we 3928d94f651SGordon Ross * require for encryption, turn off that capability. 3931160dcf7SMatt Barden */ 394700daa96SAndrew Stormont if (s->dialect < SMB_VERS_2_1) { 395700daa96SAndrew Stormont /* SMB 2.002 */ 396700daa96SAndrew Stormont s->srv_cap = smb2srv_capabilities & SMB2_CAP_DFS; 397700daa96SAndrew Stormont } else if (s->dialect < SMB_VERS_3_0) { 3988d94f651SGordon Ross /* SMB 2.x */ 3998d94f651SGordon Ross s->srv_cap = smb2srv_capabilities & SMB_2X_CAPS; 4008d94f651SGordon Ross } else { 4018d94f651SGordon Ross /* SMB 3.0 or later */ 4028d94f651SGordon Ross s->srv_cap = smb2srv_capabilities & 4038d94f651SGordon Ross (SMB_2X_CAPS | s->capabilities); 4048d94f651SGordon Ross if ((s->srv_cap & SMB2_CAP_ENCRYPTION) != 0 && 4058d94f651SGordon Ross smb3_encrypt_init_mech(s) != 0) { 4068d94f651SGordon Ross s->srv_cap &= ~SMB2_CAP_ENCRYPTION; 4078d94f651SGordon Ross } 4088d94f651SGordon Ross } 4091160dcf7SMatt Barden 4101160dcf7SMatt Barden /* 411aa321b3cSDan McDonald * See notes above smb2_max_rwsize, smb2_old_rwsize 412aa321b3cSDan McDonald */ 413aa321b3cSDan McDonald if (s->capabilities & SMB2_CAP_LARGE_MTU) 414aa321b3cSDan McDonald max_rwsize = smb2_max_rwsize; 415aa321b3cSDan McDonald else 416aa321b3cSDan McDonald max_rwsize = smb2_old_rwsize; 417aa321b3cSDan McDonald 418a90cf9f2SGordon Ross rc = smb_mbc_encodef( 419a90cf9f2SGordon Ross &sr->reply, 420a90cf9f2SGordon Ross "wwww#cllllTTwwl#c", 421a90cf9f2SGordon Ross 65, /* StructSize */ /* w */ 4221160dcf7SMatt Barden s->srv_secmode, /* w */ 423a90cf9f2SGordon Ross version, /* w */ 424a90cf9f2SGordon Ross 0, /* reserved */ /* w */ 425a90cf9f2SGordon Ross UUID_LEN, /* # */ 426a90cf9f2SGordon Ross &s->s_cfg.skc_machine_uuid, /* c */ 4271160dcf7SMatt Barden s->srv_cap, /* l */ 428a90cf9f2SGordon Ross smb2_max_trans, /* l */ 429aa321b3cSDan McDonald max_rwsize, /* l */ 430aa321b3cSDan McDonald max_rwsize, /* l */ 431a90cf9f2SGordon Ross &now_tv, /* T */ 432a90cf9f2SGordon Ross &boot_tv, /* T */ 433a90cf9f2SGordon Ross 128, /* SecBufOff */ /* w */ 434a90cf9f2SGordon Ross sr->sr_cfg->skc_negtok_len, /* w */ 435a90cf9f2SGordon Ross 0, /* reserved */ /* l */ 436a90cf9f2SGordon Ross sr->sr_cfg->skc_negtok_len, /* # */ 437a90cf9f2SGordon Ross sr->sr_cfg->skc_negtok); /* c */ 438a90cf9f2SGordon Ross 43993bc28dbSGordon Ross /* smb2_send_reply(sr); in caller */ 440a90cf9f2SGordon Ross 441a90cf9f2SGordon Ross (void) ksocket_setsockopt(s->sock, SOL_SOCKET, 442a90cf9f2SGordon Ross SO_SNDBUF, (const void *)&smb2_tcp_bufsize, 443a90cf9f2SGordon Ross sizeof (smb2_tcp_bufsize), CRED()); 444a90cf9f2SGordon Ross (void) ksocket_setsockopt(s->sock, SOL_SOCKET, 445a90cf9f2SGordon Ross SO_RCVBUF, (const void *)&smb2_tcp_bufsize, 446a90cf9f2SGordon Ross sizeof (smb2_tcp_bufsize), CRED()); 447a90cf9f2SGordon Ross 448a90cf9f2SGordon Ross return (rc); 449a90cf9f2SGordon Ross } 450a90cf9f2SGordon Ross 451a90cf9f2SGordon Ross /* 452a90cf9f2SGordon Ross * SMB2 Dispatch table handler, which will run if we see an 453a90cf9f2SGordon Ross * SMB2_NEGOTIATE after the initial negotiation is done. 454a90cf9f2SGordon Ross * That would be a protocol error. 455a90cf9f2SGordon Ross */ 456a90cf9f2SGordon Ross smb_sdrc_t 457a90cf9f2SGordon Ross smb2_negotiate(smb_request_t *sr) 458a90cf9f2SGordon Ross { 459a90cf9f2SGordon Ross sr->smb2_status = NT_STATUS_INVALID_PARAMETER; 460a90cf9f2SGordon Ross return (SDRC_ERROR); 461a90cf9f2SGordon Ross } 462a90cf9f2SGordon Ross 463a90cf9f2SGordon Ross /* 464a90cf9f2SGordon Ross * VALIDATE_NEGOTIATE_INFO [MS-SMB2] 2.2.32.6 465a90cf9f2SGordon Ross */ 466a90cf9f2SGordon Ross uint32_t 46755f0a249SGordon Ross smb2_nego_validate(smb_request_t *sr, smb_fsctl_t *fsctl) 468a90cf9f2SGordon Ross { 469a90cf9f2SGordon Ross smb_session_t *s = sr->session; 470a90cf9f2SGordon Ross int rc; 471a90cf9f2SGordon Ross 472a90cf9f2SGordon Ross /* 473a90cf9f2SGordon Ross * The spec. says to parse the VALIDATE_NEGOTIATE_INFO here 474a90cf9f2SGordon Ross * and verify that the original negotiate was not modified. 475*4ad35fa3SMatt Barden * The request MUST be signed, and we MUST validate the signature. 476a90cf9f2SGordon Ross * 477a90cf9f2SGordon Ross * One interesting requirement here is that we MUST reply 478a90cf9f2SGordon Ross * with exactly the same information as we returned in our 479a90cf9f2SGordon Ross * original reply to the SMB2 negotiate on this session. 480a90cf9f2SGordon Ross * If we don't the client closes the connection. 481a90cf9f2SGordon Ross */ 482a90cf9f2SGordon Ross 4831160dcf7SMatt Barden /* dialects[8] taken from cl_versions[8] in smb2_newrq_negotiate */ 4841160dcf7SMatt Barden uint32_t capabilities; 4851160dcf7SMatt Barden uint16_t secmode, num_dialects, dialects[8]; 4861160dcf7SMatt Barden uint8_t clnt_guid[16]; 4871160dcf7SMatt Barden 488*4ad35fa3SMatt Barden if ((sr->smb2_hdr_flags & SMB2_FLAGS_SIGNED) == 0) 489*4ad35fa3SMatt Barden goto drop; 490*4ad35fa3SMatt Barden 4911160dcf7SMatt Barden if (fsctl->InputCount < 24) 4921160dcf7SMatt Barden goto drop; 4931160dcf7SMatt Barden 4941160dcf7SMatt Barden (void) smb_mbc_decodef(fsctl->in_mbc, "l16cww", 4951160dcf7SMatt Barden &capabilities, /* l */ 4961160dcf7SMatt Barden &clnt_guid, /* 16c */ 4971160dcf7SMatt Barden &secmode, /* w */ 4981160dcf7SMatt Barden &num_dialects); /* w */ 4991160dcf7SMatt Barden 5001160dcf7SMatt Barden if (num_dialects == 0 || num_dialects > 8) 5011160dcf7SMatt Barden goto drop; 5021160dcf7SMatt Barden if (secmode != s->cli_secmode) 5031160dcf7SMatt Barden goto drop; 5041160dcf7SMatt Barden if (capabilities != s->capabilities) 5051160dcf7SMatt Barden goto drop; 5061160dcf7SMatt Barden if (memcmp(clnt_guid, s->clnt_uuid, sizeof (clnt_guid)) != 0) 5071160dcf7SMatt Barden goto drop; 5081160dcf7SMatt Barden 5091160dcf7SMatt Barden if (fsctl->InputCount < (24 + num_dialects * sizeof (*dialects))) 5101160dcf7SMatt Barden goto drop; 5111160dcf7SMatt Barden 5121160dcf7SMatt Barden rc = smb_mbc_decodef(fsctl->in_mbc, "#w", num_dialects, dialects); 5131160dcf7SMatt Barden if (rc != 0) 5141160dcf7SMatt Barden goto drop; 5151160dcf7SMatt Barden 5161160dcf7SMatt Barden if (smb2_find_best_dialect(s, dialects, num_dialects) != s->dialect) 5171160dcf7SMatt Barden goto drop; 5181160dcf7SMatt Barden 519a90cf9f2SGordon Ross rc = smb_mbc_encodef( 520a90cf9f2SGordon Ross fsctl->out_mbc, "l#cww", 5211160dcf7SMatt Barden s->srv_cap, /* l */ 522a90cf9f2SGordon Ross UUID_LEN, /* # */ 523a90cf9f2SGordon Ross &s->s_cfg.skc_machine_uuid, /* c */ 5241160dcf7SMatt Barden s->srv_secmode, /* w */ 525a90cf9f2SGordon Ross s->dialect); /* w */ 5261160dcf7SMatt Barden if (rc == 0) 5271160dcf7SMatt Barden return (rc); 528a90cf9f2SGordon Ross 5291160dcf7SMatt Barden drop: 5301160dcf7SMatt Barden smb_session_disconnect(s); 5311160dcf7SMatt Barden return (NT_STATUS_ACCESS_DENIED); 532a90cf9f2SGordon Ross } 533