xref: /titanic_51/usr/src/uts/common/fs/smbsrv/smb_negotiate.c (revision 488474949328b517188fdfc12c28c8e44e23a9f4)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #pragma ident	"@(#)smb_negotiate.c	1.6	08/07/21 SMI"
27 
28 /*
29  * Notes on the virtual circuit (VC) values in the SMB Negotiate
30  * response and SessionSetupAndx request.
31  *
32  * A virtual circuit (VC) represents a connection between a client and a
33  * server using a reliable, session oriented transport protocol, such as
34  * NetBIOS or TCP/IP. Originally, each SMB session was restricted to a
35  * single underlying transport connection, i.e. a single NetBIOS session,
36  * which limited performance for raw data transfers.
37  *
38  * The intention behind multiple VCs was to improve performance by
39  * allowing parallelism over each NetBIOS session. For example, raw data
40  * could be transmitted using a different VC from other types of SMB
41  * requests to remove the interleaving restriction while a raw transfer
42  * is in progress. So the MaxNumberVcs field was added to the negotiate
43  * response to make the number of VCs configurable and to allow servers
44  * to specify how many they were prepared to support per session
45  * connection. This turned out to be difficult to manage and, with
46  * technology improvements, it has become obsolete.
47  *
48  * Servers should set the MaxNumberVcs value in the Negotiate response
49  * to 1. Clients should probably ignore it. If a server receives a
50  * SessionSetupAndx with a VC value of 0, it should close all other
51  * VCs to that client. If it receives a non-zero VC, it should leave
52  * other VCs in tact.
53  *
54  */
55 
56 /*
57  * SMB: negotiate
58  *
59  * Client Request                Description
60  * ============================  =======================================
61  *
62  * UCHAR WordCount;              Count of parameter words = 0
63  * USHORT ByteCount;             Count of data bytes; min = 2
64  * struct {
65  *    UCHAR BufferFormat;        0x02 -- Dialect
66  *    UCHAR DialectName[];       ASCII null-terminated string
67  * } Dialects[];
68  *
69  * The Client sends a list of dialects that it can communicate with.  The
70  * response is a selection of one of those dialects (numbered 0 through n)
71  * or -1 (hex FFFF) indicating that none of the dialects were acceptable.
72  * The negotiate message is binding on the virtual circuit and must be
73  * sent.  One and only one negotiate message may be sent, subsequent
74  * negotiate requests will be rejected with an error response and no action
75  * will be taken.
76  *
77  * The protocol does not impose any particular structure to the dialect
78  * strings.  Implementors of particular protocols may choose to include,
79  * for example, version numbers in the string.
80  *
81  * If the server does not understand any of the dialect strings, or if PC
82  * NETWORK PROGRAM 1.0 is the chosen dialect, the response format is
83  *
84  * Server Response               Description
85  * ============================  =======================================
86  *
87  * UCHAR WordCount;              Count of parameter words = 1
88  * USHORT DialectIndex;          Index of selected dialect
89  * USHORT ByteCount;             Count of data bytes = 0
90  *
91  * If the chosen dialect is greater than core up to and including
92  * LANMAN2.1, the protocol response format is
93  *
94  * Server Response               Description
95  * ============================  =======================================
96  *
97  * UCHAR WordCount;              Count of parameter words = 13
98  * USHORT  DialectIndex;         Index of selected dialect
99  * USHORT  SecurityMode;         Security mode:
100  *                               bit 0: 0 = share, 1 = user
101  *                               bit 1: 1 = use challenge/response
102  *                               authentication
103  * USHORT  MaxBufferSize;        Max transmit buffer size (>= 1024)
104  * USHORT  MaxMpxCount;          Max pending multiplexed requests
105  * USHORT  MaxNumberVcs;         Max VCs between client and server
106  * USHORT  RawMode;              Raw modes supported:
107  *                                bit 0: 1 = Read Raw supported
108  *                                bit 1: 1 = Write Raw supported
109  * ULONG SessionKey;             Unique token identifying this session
110  * SMB_TIME ServerTime;          Current time at server
111  * SMB_DATE ServerDate;          Current date at server
112  * USHORT ServerTimeZone;        Current time zone at server
113  * USHORT  EncryptionKeyLength;  MBZ if this is not LM2.1
114  * USHORT  Reserved;             MBZ
115  * USHORT  ByteCount             Count of data bytes
116  * UCHAR EncryptionKey[];        The challenge encryption key
117  * STRING PrimaryDomain[];       The server's primary domain
118  *
119  * MaxBufferSize is the size of the largest message which the client can
120  * legitimately send to the server
121  *
122  * If  bit0 of the Flags field is set in the negotiate response, this
123  * indicates the server supports the SMB_COM_LOCK_AND_READ and
124  * SMB_COM_WRITE_AND_UNLOCK client requests.
125  *
126  * If the SecurityMode field indicates the server is running in user mode,
127  * the client must send appropriate SMB_COM_SESSION_SETUP_ANDX requests
128  * before the server will allow the client to access resources.   If the
129  * SecurityMode fields indicates the client should use challenge/response
130  * authentication, the client should use the authentication mechanism
131  * specified in section 2.10.
132  *
133  * Clients should submit no more than MaxMpxCount distinct unanswered SMBs
134  * to the server when using multiplexed reads or writes (see sections 5.13
135  * and 5.25)
136  *
137  * Clients using the  "MICROSOFT NETWORKS 1.03" dialect use a different
138  * form of raw reads than documented here, and servers are better off
139  * setting RawMode in this response to 0 for such sessions.
140  *
141  * If the negotiated dialect is "DOS LANMAN2.1" or "LANMAN2.1", then
142  * PrimaryDomain string should be included in this response.
143  *
144  * If the negotiated dialect is NT LM 0.12, the response format is
145  *
146  * Server Response            Description
147  * ========================== =========================================
148  *
149  * UCHAR WordCount;           Count of parameter words = 17
150  * USHORT DialectIndex;       Index of selected dialect
151  * UCHAR SecurityMode;        Security mode:
152  *                             bit 0: 0 = share, 1 = user
153  *                             bit 1: 1 = encrypt passwords
154  * USHORT MaxMpxCount;        Max pending multiplexed requests
155  * USHORT MaxNumberVcs;       Max VCs between client and server
156  * ULONG MaxBufferSize;       Max transmit buffer size
157  * ULONG MaxRawSize;          Maximum raw buffer size
158  * ULONG SessionKey;          Unique token identifying this session
159  * ULONG Capabilities;        Server capabilities
160  * ULONG SystemTimeLow;       System (UTC) time of the server (low).
161  * ULONG SystemTimeHigh;      System (UTC) time of the server (high).
162  * USHORT ServerTimeZone;     Time zone of server (min from UTC)
163  * UCHAR EncryptionKeyLength; Length of encryption key.
164  * USHORT ByteCount;          Count of data bytes
165  * UCHAR EncryptionKey[];     The challenge encryption key
166  * UCHAR OemDomainName[];     The name of the domain (in OEM chars)
167  *
168  * In addition to the definitions above, MaxBufferSize is the size of the
169  * largest message which the client can legitimately send to the server.
170  * If the client is using a connectionless protocol,  MaxBufferSize must be
171  * set to the smaller of the server's internal buffer size and the amount
172  * of data which can be placed in a response packet.
173  *
174  * MaxRawSize specifies the maximum message size the server can send or
175  * receive for SMB_COM_WRITE_RAW or SMB_COM_READ_RAW.
176  *
177  * Connectionless clients must set Sid to 0 in the SMB request header.
178  *
179  * Capabilities allows the server to tell the client what it supports.
180  * The bit definitions defined in cifs.h. Bit 0x2000 used to be set in
181  * the negotiate response capabilities but it caused problems with
182  * Windows 2000. It is probably not valid, it doesn't appear in the
183  * CIFS spec.
184  *
185  * 4.1.1.1   Errors
186  *
187  * SUCCESS/SUCCESS
188  * ERRSRV/ERRerror
189  */
190 #include <sys/types.h>
191 #include <sys/strsubr.h>
192 #include <sys/socketvar.h>
193 #include <sys/socket.h>
194 #include <sys/random.h>
195 #include <netinet/in.h>
196 #include <smbsrv/smb_incl.h>
197 #include <smbsrv/smbinfo.h>
198 #include <smbsrv/smb_i18n.h>
199 
200 /*
201  * Maximum buffer size for DOS: chosen to be the same as NT.
202  * Do not change this value, DOS is very sensitive to it.
203  */
204 #define	SMB_DOS_MAXBUF			0x1104
205 
206 /*
207  * The DOS TCP rcvbuf is set to 8700 because DOS 6.1 seems to have problems
208  * with other values. DOS 6.1 seems to depend on a window value of 8700 to
209  * send the next set of data. If we return a window value of 40KB, after
210  * sending 8700 bytes of data, it will start the next set of data from 40KB
211  * instead of 8.7k. Why 8.7k? We have no idea; it is the value that NT uses.
212  * September 2000.
213  *
214  * IR104720 Increased smb_nt_tcp_rcvbuf from 40KB to just under 1MB to allow
215  * for a larger TCP window sizei based on observations of Windows 2000 and
216  * performance testing. March 2003.
217  */
218 static uint32_t	smb_dos_tcp_rcvbuf = 8700;
219 static uint32_t	smb_nt_tcp_rcvbuf = 1048560;	/* scale factor of 4 */
220 
221 static void smb_get_security_info(smb_request_t *, unsigned short *,
222     unsigned char *, unsigned char *, uint32_t *);
223 
224 /*
225  * Function: int smb_com_negotiate(struct smb_request *)
226  */
227 smb_sdrc_t
228 smb_pre_negotiate(smb_request_t *sr)
229 {
230 	DTRACE_SMB_1(op__Negotiate__start, smb_request_t *, sr);
231 	return (SDRC_SUCCESS);
232 }
233 
234 void
235 smb_post_negotiate(smb_request_t *sr)
236 {
237 	DTRACE_SMB_1(op__Negotiate__done, smb_request_t *, sr);
238 }
239 
240 smb_sdrc_t
241 smb_com_negotiate(smb_request_t *sr)
242 {
243 	int			dialect = 0;
244 	int			this_dialect;
245 	unsigned char		keylen;
246 	int			sel_pos = -1;
247 	int			pos;
248 	char 			key[32];
249 	char			*p;
250 	timestruc_t		time_val;
251 	unsigned short		secmode;
252 	uint32_t		sesskey;
253 	uint32_t		capabilities = 0;
254 	int			rc;
255 	unsigned short		max_mpx_count;
256 	int16_t			tz_correction;
257 	char			ipaddr_buf[INET6_ADDRSTRLEN];
258 	char			*tmpbuf;
259 	int			buflen;
260 	smb_msgbuf_t		mb;
261 
262 	if (sr->session->s_state != SMB_SESSION_STATE_ESTABLISHED) {
263 		/* The protocol has already been negotiated. */
264 		smbsr_error(sr, 0, ERRSRV, ERRerror);
265 		return (SDRC_ERROR);
266 	}
267 
268 	for (pos = 0;
269 	    sr->smb_data.chain_offset < sr->smb_data.max_bytes;
270 	    pos++) {
271 		if (smb_mbc_decodef(&sr->smb_data, "%L", sr, &p) != 0) {
272 			smbsr_error(sr, 0, ERRSRV, ERRerror);
273 			return (SDRC_ERROR);
274 		}
275 
276 		this_dialect = smb_xlate_dialect_str_to_cd(p);
277 
278 		if (this_dialect < 0)
279 			continue;
280 
281 		if (dialect < this_dialect) {
282 			dialect = this_dialect;
283 			sel_pos = pos;
284 		}
285 	}
286 
287 	smb_get_security_info(sr, &secmode, (unsigned char *)key,
288 	    &keylen, &sesskey);
289 
290 	(void) microtime(&time_val);
291 	tz_correction = sr->sr_gmtoff / 60;
292 
293 	switch (dialect) {
294 	case PC_NETWORK_PROGRAM_1_0:	/* core */
295 		(void) ksocket_setsockopt(sr->session->sock, SOL_SOCKET,
296 		    SO_RCVBUF, (const void *)&smb_dos_tcp_rcvbuf,
297 		    sizeof (smb_dos_tcp_rcvbuf), CRED());
298 		rc = smbsr_encode_result(sr, 1, 0, "bww", 1, sel_pos, 0);
299 		break;
300 
301 	case Windows_for_Workgroups_3_1a:
302 	case PCLAN1_0:
303 	case MICROSOFT_NETWORKS_1_03:
304 	case MICROSOFT_NETWORKS_3_0:
305 	case LANMAN1_0:
306 	case LM1_2X002:
307 	case DOS_LM1_2X002:
308 		(void) ksocket_setsockopt(sr->session->sock, SOL_SOCKET,
309 		    SO_RCVBUF, (const void *)&smb_dos_tcp_rcvbuf,
310 		    sizeof (smb_dos_tcp_rcvbuf), CRED());
311 		sr->smb_flg |= SMB_FLAGS_LOCK_AND_READ_OK;
312 		rc = smbsr_encode_result(sr, 13, VAR_BCC,
313 		    "bwwwwwwlYww2.w#c",
314 		    13,		/* wct */
315 		    sel_pos,	/* dialect index */
316 		    secmode,		/* security mode */
317 		    SMB_DOS_MAXBUF,	/* max buffer size */
318 		    1,		/* max MPX (temporary) */
319 		    1,		/* max VCs (temporary, ambiguous) */
320 		    3,		/* raw mode (s/b 3) */
321 		    sesskey,	/* session key */
322 		    time_val.tv_sec, /* server time/date */
323 		    tz_correction,
324 		    (short)keylen,	/* Encryption Key Length */
325 				/* reserved field handled 2. */
326 		    VAR_BCC,
327 		    (int)keylen,
328 		    key);		/* encryption key */
329 		break;
330 
331 	case DOS_LANMAN2_1:
332 	case LANMAN2_1:
333 		(void) ksocket_setsockopt(sr->session->sock, SOL_SOCKET,
334 		    SO_RCVBUF, (const void *)&smb_dos_tcp_rcvbuf,
335 		    sizeof (smb_dos_tcp_rcvbuf), CRED());
336 		sr->smb_flg |= SMB_FLAGS_LOCK_AND_READ_OK;
337 		rc = smbsr_encode_result(sr, 13, VAR_BCC,
338 		    "bwwwwwwlYww2.w#cs",
339 		    13,		/* wct */
340 		    sel_pos,	/* dialect index */
341 		    secmode,		/* security mode */
342 		    SMB_DOS_MAXBUF,	/* max buffer size */
343 		    1,		/* max MPX (temporary) */
344 		    1,		/* max VCs (temporary, ambiguous) */
345 		    3,		/* raw mode (s/b 3) */
346 		    sesskey,	/* session key */
347 		    time_val.tv_sec, /* server time/date */
348 		    tz_correction,
349 		    (short)keylen,	/* Encryption Key Length */
350 				/* reserved field handled 2. */
351 		    VAR_BCC,
352 		    (int)keylen,
353 		    key,		/* encryption key */
354 		    sr->sr_cfg->skc_nbdomain);
355 		break;
356 
357 	case NT_LM_0_12:
358 		(void) ksocket_setsockopt(sr->session->sock, SOL_SOCKET,
359 		    SO_RCVBUF, (const void *)&smb_nt_tcp_rcvbuf,
360 		    sizeof (smb_nt_tcp_rcvbuf), CRED());
361 		capabilities = CAP_LARGE_FILES
362 		    | CAP_NT_SMBS
363 		    | CAP_STATUS32
364 		    | CAP_NT_FIND
365 		    | CAP_RAW_MODE
366 		    | CAP_LEVEL_II_OPLOCKS
367 		    | CAP_LOCK_AND_READ
368 		    | CAP_RPC_REMOTE_APIS
369 		    | CAP_LARGE_READX;
370 
371 		/*
372 		 * UNICODE support is required to enable support for long
373 		 * share names and long file names and streams.
374 		 */
375 
376 		capabilities |= CAP_UNICODE;
377 
378 
379 		/*
380 		 * Turn off Extended Security Negotiation
381 		 */
382 		sr->smb_flg2 &= ~SMB_FLAGS2_EXT_SEC;
383 
384 		/*
385 		 * Allow SMB signatures if security challenge response enabled
386 		 */
387 		if ((secmode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
388 		    sr->sr_cfg->skc_signing_enable) {
389 			secmode |= NEGOTIATE_SECURITY_SIGNATURES_ENABLED;
390 			if (sr->sr_cfg->skc_signing_required)
391 				secmode |=
392 				    NEGOTIATE_SECURITY_SIGNATURES_REQUIRED;
393 
394 			sr->session->secmode = secmode;
395 		}
396 		(void) smb_inet_ntop(&sr->session->ipaddr, ipaddr_buf,
397 		    SMB_IPSTRLEN(sr->session->ipaddr.a_family));
398 
399 		max_mpx_count = sr->sr_cfg->skc_maxworkers;
400 
401 		/*
402 		 * skc_nbdomain is not expected to be aligned.
403 		 * Use temporary buffer to avoid alignment padding
404 		 */
405 		buflen = mts_wcequiv_strlen(sr->sr_cfg->skc_nbdomain) +
406 		    sizeof (mts_wchar_t);
407 		tmpbuf = kmem_zalloc(buflen, KM_SLEEP);
408 		smb_msgbuf_init(&mb, (uint8_t *)tmpbuf, buflen,
409 		    SMB_MSGBUF_UNICODE);
410 		if (smb_msgbuf_encode(&mb, "U",
411 		    sr->sr_cfg->skc_nbdomain) < 0) {
412 			smb_msgbuf_term(&mb);
413 			kmem_free(tmpbuf, buflen);
414 			smbsr_error(sr, 0, ERRSRV, ERRerror);
415 			return (SDRC_ERROR);
416 		}
417 
418 		rc = smbsr_encode_result(sr, 17, VAR_BCC,
419 		    "bwbwwllllTwbw#c#c",
420 		    17,		/* wct */
421 		    sel_pos,	/* dialect index */
422 		    secmode,	/* security mode */
423 		    max_mpx_count,		/* max MPX (temporary) */
424 		    1,		/* max VCs (temporary, ambiguous) */
425 		    (DWORD)smb_maxbufsize,	/* max buffer size */
426 		    0xFFFF,	/* max raw size */
427 		    sesskey,	/* session key */
428 		    capabilities,
429 		    &time_val,	/* system time */
430 		    tz_correction,
431 		    keylen,	/* Encryption Key Length */
432 		    VAR_BCC,
433 		    (int)keylen,
434 		    key,	/* encryption key */
435 		    buflen,
436 		    tmpbuf);	/* skc_nbdomain */
437 
438 		smb_msgbuf_term(&mb);
439 		kmem_free(tmpbuf, buflen);
440 		break;
441 
442 	default:
443 		sel_pos = -1;
444 		rc = smbsr_encode_result(sr, 1, 0, "bww", 1, sel_pos, 0);
445 		return ((rc == 0) ? SDRC_SUCCESS : SDRC_ERROR);
446 	}
447 
448 	if (rc != 0)
449 		return (SDRC_ERROR);
450 
451 	/*
452 	 * Save the agreed dialect. Note that this value is also
453 	 * used to detect and reject attempts to re-negotiate.
454 	 */
455 	sr->session->dialect = dialect;
456 	sr->session->s_state = SMB_SESSION_STATE_NEGOTIATED;
457 	return (SDRC_SUCCESS);
458 }
459 
460 static void
461 smb_get_security_info(
462     struct smb_request *sr,
463     unsigned short *secmode,
464     unsigned char *key,
465     unsigned char *keylen,
466     uint32_t *sesskey)
467 {
468 	uchar_t tmp_key[8];
469 
470 	(void) random_get_pseudo_bytes(tmp_key, 8);
471 	bcopy(tmp_key, &sr->session->challenge_key, 8);
472 	sr->session->challenge_len = 8;
473 	*keylen = 8;
474 	bcopy(tmp_key, key, 8);
475 
476 	sr->session->secmode = NEGOTIATE_SECURITY_CHALLENGE_RESPONSE|
477 	    NEGOTIATE_SECURITY_USER_LEVEL;
478 
479 	(void) random_get_pseudo_bytes(tmp_key, 4);
480 	sr->session->sesskey = tmp_key[0] | tmp_key[1] << 8 |
481 	    tmp_key[2] << 16 | tmp_key[3] << 24;
482 
483 	*secmode = sr->session->secmode;
484 	*sesskey = sr->session->sesskey;
485 }
486