xref: /illumos-gate/usr/src/uts/common/fs/smbsrv/smb2_negotiate.c (revision 5328fc53d11d7151861fa272e4fb0248b8f0e145)
1 /*
2  * This file and its contents are supplied under the terms of the
3  * Common Development and Distribution License ("CDDL"), version 1.0.
4  * You may only use this file in accordance with the terms of version
5  * 1.0 of the CDDL.
6  *
7  * A full copy of the text of the CDDL should have accompanied this
8  * source.  A copy of the CDDL is also available via the Internet at
9  * http://www.illumos.org/license/CDDL.
10  */
11 
12 /*
13  * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
14  * Copyright 2019 RackTop Systems.
15  */
16 
17 /*
18  * Dispatch function for SMB2_NEGOTIATE
19  */
20 
21 #include <smbsrv/smb2_kproto.h>
22 #include <smbsrv/smb2.h>
23 
24 /*
25  * Note from [MS-SMB2] Sec. 2.2.3:  Windows servers return
26  * invalid parameter if the dialect count is greater than 64
27  * This is here (and not in smb2.h) because this is technically
28  * an implementation detail, not protocol specification.
29  */
30 #define	SMB2_NEGOTIATE_MAX_DIALECTS	64
31 
32 static int smb2_negotiate_common(smb_request_t *, uint16_t);
33 
34 /* List of supported capabilities.  Can be patched for testing. */
35 uint32_t smb2srv_capabilities =
36 	SMB2_CAP_DFS |
37 	SMB2_CAP_LEASING |
38 	SMB2_CAP_LARGE_MTU |
39 	SMB2_CAP_PERSISTENT_HANDLES |
40 	SMB2_CAP_ENCRYPTION;
41 
42 /* These are the only capabilities defined for SMB2.X */
43 #define	SMB_2X_CAPS (SMB2_CAP_DFS | SMB2_CAP_LEASING | SMB2_CAP_LARGE_MTU)
44 
45 /*
46  * These are not intended as customer tunables, but dev. & test folks
47  * might want to adjust them (with caution).
48  *
49  * smb2_tcp_bufsize is the TCP buffer size, applied to the network socket
50  * with setsockopt SO_SNDBUF, SO_RCVBUF.  These set the TCP window size.
51  * This is also used as a "sanity limit" for internal send/reply message
52  * allocations.  Note that with compounding SMB2 messages may contain
53  * multiple requests/responses.  This size should be large enough for
54  * at least a few SMB2 requests, and at least 2X smb2_max_rwsize.
55  *
56  * smb2_max_rwsize is what we put in the SMB2 negotiate response to tell
57  * the client the largest read and write request size we'll support.
58  * For now, we're using contiguous allocations, so keep this at 64KB
59  * so that (even with message overhead) allocations stay below 128KB,
60  * avoiding kmem_alloc -> page_create_va thrashing.
61  *
62  * smb2_max_trans is the largest "transact" send or receive, which is
63  * used for directory listings and info set/get operations.
64  */
65 uint32_t smb2_tcp_bufsize = (1<<22);	/* 4MB */
66 uint32_t smb2_max_rwsize = (1<<16);	/* 64KB */
67 uint32_t smb2_max_trans  = (1<<16);	/* 64KB */
68 
69 /*
70  * With clients (e.g. HP scanners) that don't advertise SMB2_CAP_LARGE_MTU
71  * (including all clients using dialect < SMB 2.1), use a "conservative" value
72  * for max r/w size because some older clients misbehave with larger values.
73  * 64KB is recommended in the [MS-SMB2] spec.  (3.3.5.3.1 SMB 2.1 or SMB 3.x
74  * Support) as the minimum so we'll use that.
75  */
76 uint32_t smb2_old_rwsize = (1<<16);	/* 64KB */
77 
78 /*
79  * List of all SMB2 versions we implement.  Note that the
80  * versions we support may be limited by the
81  * _cfg.skc_max_protocol and min_protocol settings.
82  */
83 static uint16_t smb2_versions[] = {
84 	0x202,	/* SMB 2.002 */
85 	0x210,	/* SMB 2.1 */
86 	0x300,	/* SMB 3.0 */
87 	0x302,	/* SMB 3.02 */
88 };
89 static uint16_t smb2_nversions =
90     sizeof (smb2_versions) / sizeof (smb2_versions[0]);
91 
92 static boolean_t
93 smb2_supported_version(smb_session_t *s, uint16_t version)
94 {
95 	int i;
96 
97 	if (version > s->s_cfg.skc_max_protocol ||
98 	    version < s->s_cfg.skc_min_protocol)
99 		return (B_FALSE);
100 	for (i = 0; i < smb2_nversions; i++)
101 		if (version == smb2_versions[i])
102 			return (B_TRUE);
103 	return (B_FALSE);
104 }
105 
106 /*
107  * Helper for the (SMB1) smb_com_negotiate().  This is the
108  * very unusual protocol interaction where an SMB1 negotiate
109  * gets an SMB2 negotiate response.  This is the normal way
110  * clients first find out if the server supports SMB2.
111  *
112  * Note: This sends an SMB2 reply _itself_ and then returns
113  * SDRC_NO_REPLY so the caller will not send an SMB1 reply.
114  * Also, this is called directly from the reader thread, so
115  * we know this is the only thread using this session.
116  *
117  * The caller frees this request.
118  */
119 smb_sdrc_t
120 smb1_negotiate_smb2(smb_request_t *sr)
121 {
122 	smb_session_t *s = sr->session;
123 	smb_arg_negotiate_t *negprot = sr->sr_negprot;
124 	uint16_t smb2_version;
125 
126 	/*
127 	 * Note: In the SMB1 negotiate command handler, we
128 	 * agreed with one of the SMB2 dialects.  If that
129 	 * dialect was "SMB 2.002", we'll respond here with
130 	 * version 0x202 and negotiation is done.  If that
131 	 * dialect was "SMB 2.???", we'll respond here with
132 	 * the "wildcard" version 0x2FF, and the client will
133 	 * come back with an SMB2 negotiate.
134 	 */
135 	switch (negprot->ni_dialect) {
136 	case DIALECT_SMB2002:	/* SMB 2.002 (a.k.a. SMB2.0) */
137 		smb2_version = SMB_VERS_2_002;
138 		s->dialect = smb2_version;
139 		s->s_state = SMB_SESSION_STATE_NEGOTIATED;
140 		/* Allow normal SMB2 requests now. */
141 		s->newrq_func = smb2sr_newrq;
142 		break;
143 	case DIALECT_SMB2XXX:	/* SMB 2.??? (wildcard vers) */
144 		/*
145 		 * Expecting an SMB2 negotiate next, so keep the
146 		 * initial s->newrq_func.
147 		 */
148 		smb2_version = 0x2FF;
149 		break;
150 	default:
151 		return (SDRC_DROP_VC);
152 	}
153 
154 	/*
155 	 * We did not decode an SMB2 header, so make sure
156 	 * the SMB2 header fields are initialized.
157 	 * (Most are zero from smb_request_alloc.)
158 	 * Also, the SMB1 common dispatch code reserved space
159 	 * for an SMB1 header, which we need to undo here.
160 	 */
161 	sr->smb2_reply_hdr = sr->reply.chain_offset = 0;
162 	sr->smb2_cmd_code = SMB2_NEGOTIATE;
163 	sr->smb2_hdr_flags = SMB2_FLAGS_SERVER_TO_REDIR;
164 
165 	(void) smb2_encode_header(sr, B_FALSE);
166 	if (smb2_negotiate_common(sr, smb2_version) != 0)
167 		sr->smb2_status = NT_STATUS_INTERNAL_ERROR;
168 	if (sr->smb2_status != 0)
169 		smb2sr_put_error(sr, sr->smb2_status);
170 	(void) smb2_encode_header(sr, B_TRUE);
171 
172 	smb2_send_reply(sr);
173 
174 	/*
175 	 * We sent the reply, so tell the SMB1 dispatch
176 	 * it should NOT (also) send a reply.
177 	 */
178 	return (SDRC_NO_REPLY);
179 }
180 
181 static uint16_t
182 smb2_find_best_dialect(smb_session_t *s, uint16_t cl_versions[],
183     uint16_t version_cnt)
184 {
185 	uint16_t best_version = 0;
186 	int i;
187 
188 	for (i = 0; i < version_cnt; i++)
189 		if (smb2_supported_version(s, cl_versions[i]) &&
190 		    best_version < cl_versions[i])
191 			best_version = cl_versions[i];
192 
193 	return (best_version);
194 }
195 
196 /*
197  * SMB2 Negotiate gets special handling.  This is called directly by
198  * the reader thread (see smbsr_newrq_initial) with what _should_ be
199  * an SMB2 Negotiate.  Only the "\feSMB" header has been checked
200  * when this is called, so this needs to check the SMB command,
201  * if it's Negotiate execute it, then send the reply, etc.
202  *
203  * Since this is called directly from the reader thread, we
204  * know this is the only thread currently using this session.
205  * This has to duplicate some of what smb2sr_work does as a
206  * result of bypassing the normal dispatch mechanism.
207  *
208  * The caller always frees this request.
209  *
210  * Return value is 0 for success, and anything else will
211  * terminate the reader thread (drop the connection).
212  */
213 int
214 smb2_newrq_negotiate(smb_request_t *sr)
215 {
216 	smb_session_t *s = sr->session;
217 	int rc;
218 	uint32_t status = 0;
219 	uint16_t struct_size;
220 	uint16_t best_version;
221 	uint16_t version_cnt;
222 	uint16_t cl_versions[SMB2_NEGOTIATE_MAX_DIALECTS];
223 
224 	sr->smb2_cmd_hdr = sr->command.chain_offset;
225 	rc = smb2_decode_header(sr);
226 	if (rc != 0)
227 		return (rc);
228 
229 	if (sr->smb2_hdr_flags & SMB2_FLAGS_SERVER_TO_REDIR)
230 		return (-1);
231 
232 	if ((sr->smb2_cmd_code != SMB2_NEGOTIATE) ||
233 	    (sr->smb2_next_command != 0))
234 		return (-1);
235 
236 	/*
237 	 * Decode SMB2 Negotiate (fixed-size part)
238 	 */
239 	rc = smb_mbc_decodef(
240 	    &sr->command, "www..l16c8.",
241 	    &struct_size,	/* w */
242 	    &version_cnt,	/* w */
243 	    &s->cli_secmode,	/* w */
244 	    /* reserved		(..) */
245 	    &s->capabilities,	/* l */
246 	    s->clnt_uuid);	/* 16c */
247 	    /* start_time	  8. */
248 	if (rc != 0)
249 		return (rc);
250 	if (struct_size != 36)
251 		return (-1);
252 
253 	/*
254 	 * Decode SMB2 Negotiate (variable part)
255 	 *
256 	 * Be somewhat tolerant while decoding the variable part
257 	 * so we can return errors instead of dropping the client.
258 	 * Will limit decoding to the size of cl_versions here,
259 	 * and do the error checks on version_cnt after the
260 	 * dtrace start probe.
261 	 */
262 	if (version_cnt > 0 &&
263 	    version_cnt <= SMB2_NEGOTIATE_MAX_DIALECTS &&
264 	    smb_mbc_decodef(&sr->command, "#w", version_cnt,
265 	    cl_versions) != 0) {
266 	    /* decode error; force an error below */
267 	    version_cnt = 0;
268 	}
269 
270 	DTRACE_SMB2_START(op__Negotiate, smb_request_t *, sr);
271 
272 	sr->smb2_hdr_flags |= SMB2_FLAGS_SERVER_TO_REDIR;
273 	(void) smb2_encode_header(sr, B_FALSE);
274 
275 	/*
276 	 * [MS-SMB2] 3.3.5.2.4 Verifying the Signature
277 	 * "If the SMB2 header of the SMB2 NEGOTIATE request has the
278 	 * SMB2_FLAGS_SIGNED bit set in the Flags field, the server
279 	 * MUST fail the request with STATUS_INVALID_PARAMETER."
280 	 */
281 	if ((sr->smb2_hdr_flags & SMB2_FLAGS_SIGNED) != 0) {
282 		sr->smb2_hdr_flags &= ~SMB2_FLAGS_SIGNED;
283 		status = NT_STATUS_INVALID_PARAMETER;
284 		goto errout;
285 	}
286 
287 	/*
288 	 * [MS-SMB2] 3.3.5.4 Receiving an SMB2 NEGOTIATE Request
289 	 * "If the DialectCount of the SMB2 NEGOTIATE Request is 0, the
290 	 * server MUST fail the request with STATUS_INVALID_PARAMETER."
291 	 */
292 	if (version_cnt == 0 ||
293 	    version_cnt > SMB2_NEGOTIATE_MAX_DIALECTS) {
294 		status = NT_STATUS_INVALID_PARAMETER;
295 		goto errout;
296 	}
297 
298 	/*
299 	 * The client offers an array of protocol versions it
300 	 * supports, which we have decoded into cl_versions[].
301 	 * We walk the array and pick the highest supported.
302 	 *
303 	 * [MS-SMB2] 3.3.5.4 Receiving an SMB2 NEGOTIATE Request
304 	 * "If a common dialect is not found, the server MUST fail
305 	 * the request with STATUS_NOT_SUPPORTED."
306 	 */
307 	best_version = smb2_find_best_dialect(s, cl_versions, version_cnt);
308 	if (best_version == 0) {
309 		status = NT_STATUS_NOT_SUPPORTED;
310 		goto errout;
311 	}
312 	s->dialect = best_version;
313 
314 	/* Allow normal SMB2 requests now. */
315 	s->s_state = SMB_SESSION_STATE_NEGOTIATED;
316 	s->newrq_func = smb2sr_newrq;
317 
318 	if (smb2_negotiate_common(sr, best_version) != 0)
319 		status = NT_STATUS_INTERNAL_ERROR;
320 
321 errout:
322 	sr->smb2_status = status;
323 	DTRACE_SMB2_DONE(op__Negotiate, smb_request_t *, sr);
324 
325 	if (sr->smb2_status != 0)
326 		smb2sr_put_error(sr, sr->smb2_status);
327 	(void) smb2_encode_header(sr, B_TRUE);
328 
329 	smb2_send_reply(sr);
330 
331 	return (rc);
332 }
333 
334 /*
335  * Common parts of SMB2 Negotiate, used for both the
336  * SMB1-to-SMB2 style, and straight SMB2 style.
337  * Do negotiation decisions and encode the reply.
338  * The caller does the network send.
339  *
340  * Return value is 0 for success, else error.
341  */
342 static int
343 smb2_negotiate_common(smb_request_t *sr, uint16_t version)
344 {
345 	timestruc_t boot_tv, now_tv;
346 	smb_session_t *s = sr->session;
347 	int rc;
348 	uint32_t max_rwsize;
349 	uint16_t secmode;
350 
351 	/*
352 	 * Negotiation itself.  First the Security Mode.
353 	 */
354 	secmode = SMB2_NEGOTIATE_SIGNING_ENABLED;
355 	if (sr->sr_cfg->skc_signing_required)
356 		secmode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
357 	s->srv_secmode = secmode;
358 
359 	s->cmd_max_bytes = smb2_tcp_bufsize;
360 	s->reply_max_bytes = smb2_tcp_bufsize;
361 
362 	/*
363 	 * "The number of credits held by the client MUST be considered
364 	 * as 1 when the connection is established." [MS-SMB2]
365 	 * We leave credits at 1 until the first successful
366 	 * session setup is completed.
367 	 */
368 	s->s_cur_credits = s->s_max_credits = 1;
369 	sr->smb2_credit_response = 1;
370 
371 	boot_tv.tv_sec = smb_get_boottime();
372 	boot_tv.tv_nsec = 0;
373 	now_tv.tv_sec = gethrestime_sec();
374 	now_tv.tv_nsec = 0;
375 
376 	/*
377 	 * If the version is 0x2FF, we haven't completed negotiate.
378 	 * Don't initialize until we have our final request.
379 	 */
380 	if (version != 0x2FF)
381 		smb2_sign_init_mech(s);
382 
383 	/*
384 	 * [MS-SMB2] 3.3.5.4 Receiving an SMB2 NEGOTIATE Request
385 	 *
386 	 * The SMB2.x capabilities are returned without regard for
387 	 * what capabilities the client provided in the request.
388 	 * The SMB3.x capabilities returned are the traditional
389 	 * logical AND of server and client capabilities.
390 	 *
391 	 * One additional check: If KCF is missing something we
392 	 * require for encryption, turn off that capability.
393 	 */
394 	if (s->dialect < SMB_VERS_2_1) {
395 		/* SMB 2.002 */
396 		s->srv_cap = smb2srv_capabilities & SMB2_CAP_DFS;
397 	} else if (s->dialect < SMB_VERS_3_0) {
398 		/* SMB 2.x */
399 		s->srv_cap = smb2srv_capabilities & SMB_2X_CAPS;
400 	} else {
401 		/* SMB 3.0 or later */
402 		s->srv_cap = smb2srv_capabilities &
403 		    (SMB_2X_CAPS | s->capabilities);
404 		if ((s->srv_cap & SMB2_CAP_ENCRYPTION) != 0 &&
405 		    smb3_encrypt_init_mech(s) != 0) {
406 			s->srv_cap &= ~SMB2_CAP_ENCRYPTION;
407 		}
408 	}
409 
410 	/*
411 	 * See notes above smb2_max_rwsize, smb2_old_rwsize
412 	 */
413 	if (s->capabilities & SMB2_CAP_LARGE_MTU)
414 		max_rwsize = smb2_max_rwsize;
415 	else
416 		max_rwsize = smb2_old_rwsize;
417 
418 	rc = smb_mbc_encodef(
419 	    &sr->reply,
420 	    "wwww#cllllTTwwl#c",
421 	    65,	/* StructSize */	/* w */
422 	    s->srv_secmode,		/* w */
423 	    version,			/* w */
424 	    0, /* reserved */		/* w */
425 	    UUID_LEN,			/* # */
426 	    &s->s_cfg.skc_machine_uuid, /* c */
427 	    s->srv_cap,			/* l */
428 	    smb2_max_trans,		/* l */
429 	    max_rwsize,			/* l */
430 	    max_rwsize,			/* l */
431 	    &now_tv,			/* T */
432 	    &boot_tv,			/* T */
433 	    128, /* SecBufOff */	/* w */
434 	    sr->sr_cfg->skc_negtok_len,	/* w */
435 	    0,	/* reserved */		/* l */
436 	    sr->sr_cfg->skc_negtok_len,	/* # */
437 	    sr->sr_cfg->skc_negtok);	/* c */
438 
439 	/* smb2_send_reply(sr); in caller */
440 
441 	(void) ksocket_setsockopt(s->sock, SOL_SOCKET,
442 	    SO_SNDBUF, (const void *)&smb2_tcp_bufsize,
443 	    sizeof (smb2_tcp_bufsize), CRED());
444 	(void) ksocket_setsockopt(s->sock, SOL_SOCKET,
445 	    SO_RCVBUF, (const void *)&smb2_tcp_bufsize,
446 	    sizeof (smb2_tcp_bufsize), CRED());
447 
448 	return (rc);
449 }
450 
451 /*
452  * SMB2 Dispatch table handler, which will run if we see an
453  * SMB2_NEGOTIATE after the initial negotiation is done.
454  * That would be a protocol error.
455  */
456 smb_sdrc_t
457 smb2_negotiate(smb_request_t *sr)
458 {
459 	sr->smb2_status = NT_STATUS_INVALID_PARAMETER;
460 	return (SDRC_ERROR);
461 }
462 
463 /*
464  * VALIDATE_NEGOTIATE_INFO [MS-SMB2] 2.2.32.6
465  */
466 uint32_t
467 smb2_nego_validate(smb_request_t *sr, smb_fsctl_t *fsctl)
468 {
469 	smb_session_t *s = sr->session;
470 	int rc;
471 
472 	/*
473 	 * The spec. says to parse the VALIDATE_NEGOTIATE_INFO here
474 	 * and verify that the original negotiate was not modified.
475 	 * The only tampering we need worry about is secmode, and
476 	 * we're not taking that from the client, so don't bother.
477 	 *
478 	 * One interesting requirement here is that we MUST reply
479 	 * with exactly the same information as we returned in our
480 	 * original reply to the SMB2 negotiate on this session.
481 	 * If we don't the client closes the connection.
482 	 */
483 
484 	/* dialects[8] taken from cl_versions[8] in smb2_newrq_negotiate */
485 	uint32_t capabilities;
486 	uint16_t secmode, num_dialects, dialects[8];
487 	uint8_t clnt_guid[16];
488 
489 	if (fsctl->InputCount < 24)
490 		goto drop;
491 
492 	(void) smb_mbc_decodef(fsctl->in_mbc, "l16cww",
493 	    &capabilities, /* l */
494 	    &clnt_guid, /* 16c */
495 	    &secmode, /* w */
496 	    &num_dialects); /* w */
497 
498 	if (num_dialects == 0 || num_dialects > 8)
499 		goto drop;
500 	if (secmode != s->cli_secmode)
501 		goto drop;
502 	if (capabilities != s->capabilities)
503 		goto drop;
504 	if (memcmp(clnt_guid, s->clnt_uuid, sizeof (clnt_guid)) != 0)
505 		goto drop;
506 
507 	if (fsctl->InputCount < (24 + num_dialects * sizeof (*dialects)))
508 		goto drop;
509 
510 	rc = smb_mbc_decodef(fsctl->in_mbc, "#w", num_dialects, dialects);
511 	if (rc != 0)
512 		goto drop;
513 
514 	if (smb2_find_best_dialect(s, dialects, num_dialects) != s->dialect)
515 		goto drop;
516 
517 	rc = smb_mbc_encodef(
518 	    fsctl->out_mbc, "l#cww",
519 	    s->srv_cap,			/* l */
520 	    UUID_LEN,			/* # */
521 	    &s->s_cfg.skc_machine_uuid, /* c */
522 	    s->srv_secmode,		/* w */
523 	    s->dialect);		/* w */
524 	if (rc == 0)
525 		return (rc);
526 
527 drop:
528 	smb_session_disconnect(s);
529 	return (NT_STATUS_ACCESS_DENIED);
530 }
531