xref: /illumos-gate/usr/src/uts/common/fs/smbsrv/smb2_negotiate.c (revision c51c88bde802fed1751677b61203271b3cda0128)
1 /*
2  * This file and its contents are supplied under the terms of the
3  * Common Development and Distribution License ("CDDL"), version 1.0.
4  * You may only use this file in accordance with the terms of version
5  * 1.0 of the CDDL.
6  *
7  * A full copy of the text of the CDDL should have accompanied this
8  * source.  A copy of the CDDL is also available via the Internet at
9  * http://www.illumos.org/license/CDDL.
10  */
11 
12 /*
13  * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
14  */
15 
16 /*
17  * Dispatch function for SMB2_NEGOTIATE
18  */
19 
20 #include <smbsrv/smb2_kproto.h>
21 #include <smbsrv/smb2.h>
22 
23 static int smb2_negotiate_common(smb_request_t *, uint16_t);
24 
25 uint32_t smb2srv_capabilities =
26 	SMB2_CAP_DFS |
27 	SMB2_CAP_LARGE_MTU;
28 
29 /*
30  * These are not intended as customer tunables, but dev. & test folks
31  * might want to adjust them (with caution).
32  *
33  * smb2_tcp_bufsize is the TCP buffer size, applied to the network socket
34  * with setsockopt SO_SNDBUF, SO_RCVBUF.  These set the TCP window size.
35  * This is also used as a "sanity limit" for internal send/reply message
36  * allocations.  Note that with compounding SMB2 messages may contain
37  * multiple requests/responses.  This size should be large enough for
38  * at least a few SMB2 requests, and at least 2X smb2_max_rwsize.
39  *
40  * smb2_max_rwsize is what we put in the SMB2 negotiate response to tell
41  * the client the largest read and write request size we'll support.
42  * For now, we're using contiguous allocations, so keep this at 64KB
43  * so that (even with message overhead) allocations stay below 128KB,
44  * avoiding kmem_alloc -> page_create_va thrashing.
45  *
46  * smb2_max_trans is the largest "transact" send or receive, which is
47  * used for directory listings and info set/get operations.
48  */
49 uint32_t smb2_tcp_bufsize = (1<<22);	/* 4MB */
50 uint32_t smb2_max_rwsize = (1<<16);	/* 64KB */
51 uint32_t smb2_max_trans  = (1<<16);	/* 64KB */
52 
53 /*
54  * With clients (e.g. HP scanners) that don't advertise SMB2_CAP_LARGE_MTU
55  * (including all clients using dialect < SMB 2.1), use a "conservative" value
56  * for max r/w size because some older clients misbehave with larger values.
57  * 64KB is recommended in the [MS-SMB2] spec.  (3.3.5.3.1 SMB 2.1 or SMB 3.x
58  * Support) as the minimum so we'll use that.
59  */
60 uint32_t smb2_old_rwsize = (1<<16);	/* 64KB */
61 
62 /*
63  * List of all SMB2 versions we implement.  Note that the
64  * highest version we support may be limited by the
65  * _cfg.skc_max_protocol setting.
66  */
67 static uint16_t smb2_versions[] = {
68 	0x202,	/* SMB 2.002 */
69 	0x210,	/* SMB 2.1 */
70 	0x300,	/* SMB 3.0 */
71 };
72 static uint16_t smb2_nversions =
73     sizeof (smb2_versions) / sizeof (smb2_versions[0]);
74 
75 static boolean_t
76 smb2_supported_version(smb_session_t *s, uint16_t version)
77 {
78 	int i;
79 
80 	if (version > s->s_cfg.skc_max_protocol)
81 		return (B_FALSE);
82 	for (i = 0; i < smb2_nversions; i++)
83 		if (version == smb2_versions[i])
84 			return (B_TRUE);
85 	return (B_FALSE);
86 }
87 
88 /*
89  * Helper for the (SMB1) smb_com_negotiate().  This is the
90  * very unusual protocol interaction where an SMB1 negotiate
91  * gets an SMB2 negotiate response.  This is the normal way
92  * clients first find out if the server supports SMB2.
93  *
94  * Note: This sends an SMB2 reply _itself_ and then returns
95  * SDRC_NO_REPLY so the caller will not send an SMB1 reply.
96  * Also, this is called directly from the reader thread, so
97  * we know this is the only thread using this session.
98  *
99  * The caller frees this request.
100  */
101 smb_sdrc_t
102 smb1_negotiate_smb2(smb_request_t *sr)
103 {
104 	smb_session_t *s = sr->session;
105 	smb_arg_negotiate_t *negprot = sr->sr_negprot;
106 	uint16_t smb2_version;
107 	uint16_t secmode2;
108 	int rc;
109 
110 	/*
111 	 * Note: In the SMB1 negotiate command handler, we
112 	 * agreed with one of the SMB2 dialects.  If that
113 	 * dialect was "SMB 2.002", we'll respond here with
114 	 * version 0x202 and negotiation is done.  If that
115 	 * dialect was "SMB 2.???", we'll respond here with
116 	 * the "wildcard" version 0x2FF, and the client will
117 	 * come back with an SMB2 negotiate.
118 	 */
119 	switch (negprot->ni_dialect) {
120 	case DIALECT_SMB2002:	/* SMB 2.002 (a.k.a. SMB2.0) */
121 		smb2_version = 0x202;
122 		s->dialect = smb2_version;
123 		s->s_state = SMB_SESSION_STATE_NEGOTIATED;
124 		/* Allow normal SMB2 requests now. */
125 		s->newrq_func = smb2sr_newrq;
126 
127 		/*
128 		 * Translate SMB1 sec. mode to SMB2.
129 		 */
130 		secmode2 = 0;
131 		if (s->secmode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED)
132 			secmode2 |= SMB2_NEGOTIATE_SIGNING_ENABLED;
133 		if (s->secmode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED)
134 			secmode2 |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
135 		s->secmode = secmode2;
136 		break;
137 	case DIALECT_SMB2XXX:	/* SMB 2.??? (wildcard vers) */
138 		/*
139 		 * Expecting an SMB2 negotiate next, so keep the
140 		 * initial s->newrq_func.  Note that secmode is
141 		 * fiction good enough to pass the signing check
142 		 * in smb2_negotiate_common().  We'll check the
143 		 * real secmode when the 2nd negotiate comes.
144 		 */
145 		smb2_version = 0x2FF;
146 		s->secmode = SMB2_NEGOTIATE_SIGNING_ENABLED;
147 		break;
148 	default:
149 		return (SDRC_DROP_VC);
150 	}
151 
152 	/*
153 	 * We did not decode an SMB2 header, so make sure
154 	 * the SMB2 header fields are initialized.
155 	 * (Most are zero from smb_request_alloc.)
156 	 * Also, the SMB1 common dispatch code reserved space
157 	 * for an SMB1 header, which we need to undo here.
158 	 */
159 	sr->smb2_reply_hdr = sr->reply.chain_offset = 0;
160 	sr->smb2_cmd_code = SMB2_NEGOTIATE;
161 
162 	rc = smb2_negotiate_common(sr, smb2_version);
163 	smb2_send_reply(sr);
164 	if (rc != 0)
165 		return (SDRC_DROP_VC);
166 
167 	/*
168 	 * We sent the reply, so tell the SMB1 dispatch
169 	 * it should NOT (also) send a reply.
170 	 */
171 	return (SDRC_NO_REPLY);
172 }
173 
174 /*
175  * SMB2 Negotiate gets special handling.  This is called directly by
176  * the reader thread (see smbsr_newrq_initial) with what _should_ be
177  * an SMB2 Negotiate.  Only the "\feSMB" header has been checked
178  * when this is called, so this needs to check the SMB command,
179  * if it's Negotiate execute it, then send the reply, etc.
180  *
181  * Since this is called directly from the reader thread, we
182  * know this is the only thread currently using this session.
183  * This has to duplicate some of what smb2sr_work does as a
184  * result of bypassing the normal dispatch mechanism.
185  *
186  * The caller always frees this request.
187  *
188  * Return value is 0 for success, and anything else will
189  * terminate the reader thread (drop the connection).
190  */
191 int
192 smb2_newrq_negotiate(smb_request_t *sr)
193 {
194 	smb_session_t *s = sr->session;
195 	int i, rc;
196 	uint16_t struct_size;
197 	uint16_t best_version;
198 	uint16_t version_cnt;
199 	uint16_t cl_versions[8];
200 
201 	sr->smb2_cmd_hdr = sr->command.chain_offset;
202 	rc = smb2_decode_header(sr);
203 	if (rc != 0)
204 		return (rc);
205 
206 	if ((sr->smb2_cmd_code != SMB2_NEGOTIATE) ||
207 	    (sr->smb2_next_command != 0))
208 		return (-1);
209 
210 	/*
211 	 * Decode SMB2 Negotiate (fixed-size part)
212 	 */
213 	rc = smb_mbc_decodef(
214 	    &sr->command, "www..l16.8.",
215 	    &struct_size,	/* w */
216 	    &version_cnt,	/* w */
217 	    &s->secmode,	/* w */
218 	    /* reserved		(..) */
219 	    &s->capabilities);	/* l */
220 	    /* clnt_uuid	 16. */
221 	    /* start_time	  8. */
222 	if (rc != 0)
223 		return (rc);
224 	if (struct_size != 36 || version_cnt > 8)
225 		return (-1);
226 
227 	/*
228 	 * Decode SMB2 Negotiate (variable part)
229 	 */
230 	rc = smb_mbc_decodef(&sr->command,
231 	    "#w", version_cnt, cl_versions);
232 	if (rc != 0)
233 		return (rc);
234 
235 	DTRACE_SMB2_START(op__Negotiate, smb_request_t *, sr);
236 
237 	/*
238 	 * The client offers an array of protocol versions it
239 	 * supports, which we have decoded into cl_versions[].
240 	 * We walk the array and pick the highest supported.
241 	 */
242 	best_version = 0;
243 	for (i = 0; i < version_cnt; i++)
244 		if (smb2_supported_version(s, cl_versions[i]) &&
245 		    best_version < cl_versions[i])
246 			best_version = cl_versions[i];
247 	if (best_version == 0)
248 		return (SDRC_DROP_VC);
249 	s->dialect = best_version;
250 
251 	/* Allow normal SMB2 requests now. */
252 	s->s_state = SMB_SESSION_STATE_NEGOTIATED;
253 	s->newrq_func = smb2sr_newrq;
254 
255 	rc = smb2_negotiate_common(sr, best_version);
256 
257 	/* sr->smb2_status was set */
258 	DTRACE_SMB2_DONE(op__Negotiate, smb_request_t *, sr);
259 
260 	smb2_send_reply(sr);
261 
262 	return (rc);
263 }
264 
265 /*
266  * Common parts of SMB2 Negotiate, used for both the
267  * SMB1-to-SMB2 style, and straight SMB2 style.
268  * Do negotiation decisions and encode the reply.
269  * The caller does the network send.
270  *
271  * Return value is 0 for success, and anything else will
272  * terminate the reader thread (drop the connection).
273  */
274 static int
275 smb2_negotiate_common(smb_request_t *sr, uint16_t version)
276 {
277 	timestruc_t boot_tv, now_tv;
278 	smb_session_t *s = sr->session;
279 	int rc;
280 	uint32_t max_rwsize;
281 	uint16_t secmode;
282 
283 	sr->smb2_status = 0;
284 
285 	/*
286 	 * Negotiation itself.  First the Security Mode.
287 	 * The caller stashed the client's secmode in s->secmode,
288 	 * which we validate, and then replace with the server's
289 	 * secmode, which is all we care about after this.
290 	 */
291 	secmode = SMB2_NEGOTIATE_SIGNING_ENABLED;
292 	if (sr->sr_cfg->skc_signing_required) {
293 		secmode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
294 		/* Make sure client at least enables signing. */
295 		if ((s->secmode & secmode) == 0) {
296 			sr->smb2_status = NT_STATUS_INVALID_PARAMETER;
297 		}
298 	}
299 	s->secmode = secmode;
300 
301 	s->cmd_max_bytes = smb2_tcp_bufsize;
302 	s->reply_max_bytes = smb2_tcp_bufsize;
303 
304 	/*
305 	 * "The number of credits held by the client MUST be considered
306 	 * as 1 when the connection is established." [MS-SMB2]
307 	 * We leave credits at 1 until the first successful
308 	 * session setup is completed.
309 	 */
310 	s->s_cur_credits = s->s_max_credits = 1;
311 	sr->smb2_credit_response = 1;
312 
313 	boot_tv.tv_sec = smb_get_boottime();
314 	boot_tv.tv_nsec = 0;
315 	now_tv.tv_sec = gethrestime_sec();
316 	now_tv.tv_nsec = 0;
317 
318 	/*
319 	 * SMB2 negotiate reply
320 	 */
321 	sr->smb2_hdr_flags = SMB2_FLAGS_SERVER_TO_REDIR;
322 	(void) smb2_encode_header(sr, B_FALSE);
323 	if (sr->smb2_status != 0) {
324 		smb2sr_put_error(sr, sr->smb2_status);
325 		/* smb2_send_reply(sr); in caller */
326 		return (-1); /* will drop */
327 	}
328 
329 	/*
330 	 * If the version is 0x2FF, we haven't completed negotiate.
331 	 * Don't initialize until we have our final request.
332 	 */
333 	if (version != 0x2FF)
334 		smb2_sign_init_mech(s);
335 
336 	/*
337 	 * See notes above smb2_max_rwsize, smb2_old_rwsize
338 	 */
339 	if (s->capabilities & SMB2_CAP_LARGE_MTU)
340 		max_rwsize = smb2_max_rwsize;
341 	else
342 		max_rwsize = smb2_old_rwsize;
343 
344 	rc = smb_mbc_encodef(
345 	    &sr->reply,
346 	    "wwww#cllllTTwwl#c",
347 	    65,	/* StructSize */	/* w */
348 	    s->secmode,			/* w */
349 	    version,			/* w */
350 	    0, /* reserved */		/* w */
351 	    UUID_LEN,			/* # */
352 	    &s->s_cfg.skc_machine_uuid, /* c */
353 	    smb2srv_capabilities,	/* l */
354 	    smb2_max_trans,		/* l */
355 	    max_rwsize,			/* l */
356 	    max_rwsize,			/* l */
357 	    &now_tv,			/* T */
358 	    &boot_tv,			/* T */
359 	    128, /* SecBufOff */	/* w */
360 	    sr->sr_cfg->skc_negtok_len,	/* w */
361 	    0,	/* reserved */		/* l */
362 	    sr->sr_cfg->skc_negtok_len,	/* # */
363 	    sr->sr_cfg->skc_negtok);	/* c */
364 
365 	/* smb2_send_reply(sr); in caller */
366 
367 	(void) ksocket_setsockopt(s->sock, SOL_SOCKET,
368 	    SO_SNDBUF, (const void *)&smb2_tcp_bufsize,
369 	    sizeof (smb2_tcp_bufsize), CRED());
370 	(void) ksocket_setsockopt(s->sock, SOL_SOCKET,
371 	    SO_RCVBUF, (const void *)&smb2_tcp_bufsize,
372 	    sizeof (smb2_tcp_bufsize), CRED());
373 
374 	return (rc);
375 }
376 
377 /*
378  * SMB2 Dispatch table handler, which will run if we see an
379  * SMB2_NEGOTIATE after the initial negotiation is done.
380  * That would be a protocol error.
381  */
382 smb_sdrc_t
383 smb2_negotiate(smb_request_t *sr)
384 {
385 	sr->smb2_status = NT_STATUS_INVALID_PARAMETER;
386 	return (SDRC_ERROR);
387 }
388 
389 /*
390  * VALIDATE_NEGOTIATE_INFO [MS-SMB2] 2.2.32.6
391  */
392 uint32_t
393 smb2_fsctl_vneginfo(smb_request_t *sr, smb_fsctl_t *fsctl)
394 {
395 	smb_session_t *s = sr->session;
396 	int rc;
397 
398 	/*
399 	 * The spec. says to parse the VALIDATE_NEGOTIATE_INFO here
400 	 * and verify that the original negotiate was not modified.
401 	 * The only tampering we need worry about is secmode, and
402 	 * we're not taking that from the client, so don't bother.
403 	 *
404 	 * One interesting requirement here is that we MUST reply
405 	 * with exactly the same information as we returned in our
406 	 * original reply to the SMB2 negotiate on this session.
407 	 * If we don't the client closes the connection.
408 	 */
409 
410 	rc = smb_mbc_encodef(
411 	    fsctl->out_mbc, "l#cww",
412 	    smb2srv_capabilities,	/* l */
413 	    UUID_LEN,			/* # */
414 	    &s->s_cfg.skc_machine_uuid, /* c */
415 	    s->secmode,			/* w */
416 	    s->dialect);		/* w */
417 	if (rc)
418 		return (NT_STATUS_INTERNAL_ERROR);
419 
420 	return (0);
421 }
422