xref: /titanic_52/usr/src/lib/libsmbfs/smb/negprot.c (revision c05412f5f0167035bf18971a928dce68f2e08a13)
1 /*
2  * Copyright (c) 2000-2001 Boris Popov
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *    This product includes software developed by Boris Popov.
16  * 4. Neither the name of the author nor the names of any co-contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
35  * Use is subject to license terms.
36  */
37 
38 /*
39  * SMB Negotiate Protocol, and related.
40  * Copied from the driver: smb_smb.c
41  */
42 
43 #include <errno.h>
44 #include <stdio.h>
45 #include <stdlib.h>
46 #include <unistd.h>
47 #include <strings.h>
48 #include <netdb.h>
49 #include <libintl.h>
50 #include <xti.h>
51 #include <assert.h>
52 
53 #include <sys/types.h>
54 #include <sys/time.h>
55 #include <sys/byteorder.h>
56 #include <sys/socket.h>
57 #include <sys/fcntl.h>
58 
59 #include <netinet/in.h>
60 #include <netinet/tcp.h>
61 #include <arpa/inet.h>
62 
63 #include <netsmb/smb.h>
64 #include <netsmb/smb_lib.h>
65 #include <netsmb/netbios.h>
66 #include <netsmb/nb_lib.h>
67 #include <netsmb/smb_dev.h>
68 
69 #include "charsets.h"
70 #include "private.h"
71 
72 /*
73  * SMB dialects that we know about.
74  */
75 struct smb_dialect {
76 	int		d_id;
77 	const char	*d_name;
78 };
79 static struct smb_dialect smb_dialects[] = {
80 	{SMB_DIALECT_CORE,	"PC NETWORK PROGRAM 1.0"},
81 	{SMB_DIALECT_LANMAN1_0,	"LANMAN1.0"},
82 	{SMB_DIALECT_LANMAN2_0,	"LM1.2X002"},
83 	{SMB_DIALECT_LANMAN2_1,	"LANMAN2.1"},
84 	{SMB_DIALECT_NTLM0_12,	"NT LM 0.12"},
85 	{-1,			NULL}
86 };
87 
88 #define	SMB_DIALECT_MAX \
89 	(sizeof (smb_dialects) / sizeof (struct smb_dialect) - 2)
90 
91 /*
92  * SMB Negotiate Protocol
93  * Based on code from the driver: smb_smb.c
94  *
95  * If using Extended Security, oblob (output)
96  * will hold the initial security "hint".
97  */
98 int
99 smb_negprot(struct smb_ctx *ctx, struct mbdata *oblob)
100 {
101 	struct smb_sopt *sv = &ctx->ct_sopt;
102 	struct smb_iods *is = &ctx->ct_iods;
103 	struct smb_rq	*rqp;
104 	struct mbdata	*mbp;
105 	struct smb_dialect *dp;
106 	int err, len;
107 	uint8_t wc, eklen;
108 	uint16_t dindex, bc;
109 	int will_sign = 0;
110 
111 	/*
112 	 * Initialize: vc_hflags and vc_hflags2.
113 	 * Note: ctx->ct_hflags* are copied into the
114 	 * (per request) rqp->rq_hflags* by smb_rq_init,
115 	 * so changing them after that call will not
116 	 * affect THIS request.
117 	 */
118 	ctx->ct_hflags = SMB_FLAGS_CASELESS;
119 	ctx->ct_hflags2 = (SMB_FLAGS2_ERR_STATUS |
120 	    SMB_FLAGS2_KNOWS_LONG_NAMES);
121 
122 	/*
123 	 * Sould we offer extended security?
124 	 * We'll turn this back off below if
125 	 * the server doesn't support it.
126 	 */
127 	if (ctx->ct_vopt & SMBVOPT_EXT_SEC)
128 		ctx->ct_hflags2 |= SMB_FLAGS2_EXT_SEC;
129 
130 	/*
131 	 * The initial UID needs to be zero,
132 	 * or Windows XP says "bad user".
133 	 * The initial TID is all ones, but
134 	 * we don't use it or store it here
135 	 * because the driver handles that.
136 	 */
137 	is->is_smbuid = 0;
138 
139 	/*
140 	 * In case we're reconnecting,
141 	 * free previous stuff.
142 	 */
143 	ctx->ct_mac_seqno = 0;
144 	if (ctx->ct_mackey != NULL) {
145 		free(ctx->ct_mackey);
146 		ctx->ct_mackey = NULL;
147 		ctx->ct_mackeylen = 0;
148 	}
149 
150 	sv = &ctx->ct_sopt;
151 	bzero(sv, sizeof (struct smb_sopt));
152 
153 	err = smb_rq_init(ctx, SMB_COM_NEGOTIATE, &rqp);
154 	if (err)
155 		return (err);
156 
157 	/*
158 	 * Build the SMB request.
159 	 */
160 	mbp = &rqp->rq_rq;
161 	mb_put_uint8(mbp, 0);			/* word count */
162 	smb_rq_bstart(rqp);
163 	for (dp = smb_dialects; dp->d_id != -1; dp++) {
164 		mb_put_uint8(mbp, SMB_DT_DIALECT);
165 		mb_put_astring(mbp, dp->d_name);
166 	}
167 	smb_rq_bend(rqp);
168 
169 	/*
170 	 * This does the OTW call
171 	 */
172 	err = smb_rq_internal(ctx, rqp);
173 	if (err) {
174 		DPRINT("call failed, err %d", err);
175 		goto errout;
176 	}
177 	if (rqp->rq_status != 0) {
178 		DPRINT("nt status 0x%x", rqp->rq_status);
179 		err = EBADRPC;
180 		goto errout;
181 	}
182 
183 	/*
184 	 * Decode the response
185 	 *
186 	 * Comments to right show names as described in
187 	 * The Microsoft SMB Protocol spec. [MS-SMB]
188 	 * section 2.2.3
189 	 */
190 	mbp = &rqp->rq_rp;
191 	(void) md_get_uint8(mbp, &wc);
192 	err = md_get_uint16le(mbp, &dindex);
193 	if (err || dindex > SMB_DIALECT_MAX) {
194 		DPRINT("err %d dindex %d", err, (int)dindex);
195 		goto errout;
196 	}
197 	dp = smb_dialects + dindex;
198 	sv->sv_proto = dp->d_id;
199 	DPRINT("Dialect %s", dp->d_name);
200 	if (dp->d_id < SMB_DIALECT_NTLM0_12) {
201 		/* XXX: User-visible warning too? */
202 		DPRINT("old dialect %s", dp->d_name);
203 		goto errout;
204 	}
205 	if (wc != 17) {
206 		DPRINT("bad wc %d", (int)wc);
207 		goto errout;
208 	}
209 	md_get_uint8(mbp, &sv->sv_sm);		/* SecurityMode */
210 	md_get_uint16le(mbp, &sv->sv_maxmux);	/* MaxMpxCount */
211 	md_get_uint16le(mbp, &sv->sv_maxvcs);	/* MaxCountVCs */
212 	md_get_uint32le(mbp, &sv->sv_maxtx);	/* MaxBufferSize */
213 	md_get_uint32le(mbp, &sv->sv_maxraw);	/* MaxRawSize */
214 	md_get_uint32le(mbp, &sv->sv_skey);	/* SessionKey */
215 	md_get_uint32le(mbp, &sv->sv_caps);	/* Capabilities */
216 	md_get_mem(mbp, NULL, 8, MB_MSYSTEM);	/* SystemTime(s) */
217 	md_get_uint16le(mbp, (uint16_t *)&sv->sv_tz);
218 	md_get_uint8(mbp, &eklen);	/* EncryptionKeyLength */
219 	err = md_get_uint16le(mbp, &bc);	/* ByteCount */
220 	if (err)
221 		goto errout;
222 
223 	/* BEGIN CSTYLED */
224 	/*
225 	 * Will we do SMB signing?  Or block the connection?
226 	 * The table below describes this logic.  References:
227 	 * [Windows Server Protocols: MS-SMB, sec. 3.2.4.2.3]
228 	 * http://msdn.microsoft.com/en-us/library/cc212511.aspx
229 	 * http://msdn.microsoft.com/en-us/library/cc212929.aspx
230 	 *
231 	 * Srv/Cli     | Required | Enabled    | If Required | Disabled
232 	 * ------------+----------+------------+-------------+-----------
233 	 * Required    | Signed   | Signed     | Signed      | Blocked [1]
234 	 * ------------+----------+------------+-------------+-----------
235 	 * Enabled     | Signed   | Signed     | Not Signed  | Not Signed
236 	 * ------------+----------+------------+-------------+-----------
237 	 * If Required | Signed   | Not Signed | Not Signed  | Not Signed
238 	 * ------------+----------+------------+-------------+-----------
239 	 * Disabled    | Blocked  | Not Signed | Not Signed  | Not Signed
240 	 *
241 	 * [1] Like Windows 2003 and later, we don't really implement
242 	 * the "Disabled" setting.  Instead we implement "If Required",
243 	 * so we always sign if the server requires signing.
244 	 */
245 	/* END CSTYLED */
246 
247 	if (sv->sv_sm & SMB_SM_SIGS_REQUIRE) {
248 		/*
249 		 * Server requires signing.  We will sign,
250 		 * even if local setting is "disabled".
251 		 */
252 		will_sign = 1;
253 	} else if (sv->sv_sm & SMB_SM_SIGS) {
254 		/*
255 		 * Server enables signing (client's option).
256 		 * If enabled locally, do signing.
257 		 */
258 		if (ctx->ct_vopt & SMBVOPT_SIGNING_ENABLED)
259 			will_sign = 1;
260 		/* else not signing. */
261 	} else {
262 		/*
263 		 * Server does not support signing.
264 		 * If we "require" it, bail now.
265 		 */
266 		if (ctx->ct_vopt & SMBVOPT_SIGNING_REQUIRED) {
267 			DPRINT("Client requires signing "
268 			    "but server has it disabled.");
269 			err = EBADRPC;
270 			goto errout;
271 		}
272 	}
273 
274 	if (will_sign) {
275 		ctx->ct_vcflags |= SMBV_WILL_SIGN;
276 	}
277 	DPRINT("Security signatures: %d", will_sign);
278 
279 	if (sv->sv_caps & SMB_CAP_UNICODE) {
280 		ctx->ct_vcflags |= SMBV_UNICODE;
281 		ctx->ct_hflags2 |= SMB_FLAGS2_UNICODE;
282 
283 	}
284 	if ((sv->sv_caps & SMB_CAP_STATUS32) == 0) {
285 		/*
286 		 * They don't do NT error codes.
287 		 *
288 		 * If we send requests with
289 		 * SMB_FLAGS2_ERR_STATUS set in
290 		 * Flags2, Windows 98, at least,
291 		 * appears to send replies with that
292 		 * bit set even though it sends back
293 		 * DOS error codes.  (They probably
294 		 * just use the request header as
295 		 * a template for the reply header,
296 		 * and don't bother clearing that bit.)
297 		 *
298 		 * Therefore, we clear that bit in
299 		 * our vc_hflags2 field.
300 		 */
301 		ctx->ct_hflags2 &= ~SMB_FLAGS2_ERR_STATUS;
302 	}
303 	if (dp->d_id == SMB_DIALECT_NTLM0_12 &&
304 	    sv->sv_maxtx < 4096 &&
305 	    (sv->sv_caps & SMB_CAP_NT_SMBS) == 0) {
306 		ctx->ct_vcflags |= SMBV_WIN95;
307 		DPRINT("Win95 detected");
308 	}
309 
310 	/*
311 	 * The rest of the message varies depending on
312 	 * whether we've negotiated "extended security".
313 	 *
314 	 * With extended security, we have:
315 	 *	Server_GUID	(length 16)
316 	 *	Security_BLOB
317 	 * Otherwise we have:
318 	 *	EncryptionKey (length is eklen)
319 	 *	PrimaryDomain
320 	 */
321 	if (sv->sv_caps & SMB_CAP_EXT_SECURITY) {
322 		struct mbuf *m;
323 		DPRINT("Ext.Security: yes");
324 
325 		/*
326 		 * Skip the server GUID.
327 		 */
328 		err = md_get_mem(mbp, NULL, SMB_GUIDLEN, MB_MSYSTEM);
329 		if (err)
330 			goto errout;
331 		/*
332 		 * Remainder is the security blob.
333 		 * Note: eklen "must be ignored" [MS-SMB]
334 		 */
335 		len = (int)bc - SMB_GUIDLEN;
336 		if (len < 0)
337 			goto errout;
338 
339 		/*
340 		 * Get the (optional) SPNEGO "hint".
341 		 */
342 		err = md_get_mbuf(mbp, len, &m);
343 		if (err)
344 			goto errout;
345 		mb_initm(oblob, m);
346 		oblob->mb_count = len;
347 	} else {
348 		DPRINT("Ext.Security: no");
349 		ctx->ct_hflags2 &= ~SMB_FLAGS2_EXT_SEC;
350 
351 		/*
352 		 * Save the "Encryption Key" (the challenge).
353 		 *
354 		 * Sanity check: make sure the sec. blob length
355 		 * isn't bigger than the byte count.
356 		 */
357 		if (bc < eklen || eklen < NTLM_CHAL_SZ) {
358 			err = EBADRPC;
359 			goto errout;
360 		}
361 		err = md_get_mem(mbp, ctx->ct_ntlm_chal,
362 		    NTLM_CHAL_SZ, MB_MSYSTEM);
363 		/*
364 		 * Server domain follows (ignored)
365 		 * Note: NOT aligned(2) - unusual!
366 		 */
367 	}
368 
369 	smb_rq_done(rqp);
370 
371 	/*
372 	 * A few sanity checks on what we received,
373 	 * becuse we will send these in ssnsetup.
374 	 *
375 	 * Maximum outstanding requests (we care),
376 	 * and Max. VCs (we only use one).  Also,
377 	 * MaxBufferSize lower limit per spec.
378 	 */
379 	if (sv->sv_maxmux < 1)
380 		sv->sv_maxmux = 1;
381 	if (sv->sv_maxvcs < 1)
382 		sv->sv_maxvcs = 1;
383 	if (sv->sv_maxtx < 1024)
384 		sv->sv_maxtx = 1024;
385 
386 	/*
387 	 * Maximum transfer size.
388 	 * Sanity checks:
389 	 *
390 	 * Let's be conservative about an upper limit here.
391 	 * Win2k uses 16644 (and others) so 32k should be a
392 	 * reasonable sanity limit for this value.
393 	 *
394 	 * Note that this limit does NOT affect READX/WRITEX
395 	 * with CAP_LARGE_..., which we nearly always use.
396 	 */
397 	is->is_txmax = sv->sv_maxtx;
398 	if (is->is_txmax > 0x8000)
399 		is->is_txmax = 0x8000;
400 
401 	/*
402 	 * Max read/write sizes, WITHOUT overhead.
403 	 * This is just the payload size, so we must
404 	 * leave room for the SMB headers, etc.
405 	 * This is just the ct_txmax value, but
406 	 * reduced and rounded down.  Tricky bit:
407 	 *
408 	 * Servers typically give us a value that's
409 	 * some nice "round" number, i.e 0x4000 plus
410 	 * some overhead, i.e. Win2k: 16644==0x4104
411 	 * Subtract for the SMB header (32) and the
412 	 * SMB command word and byte vectors (34?),
413 	 * then round down to a 512 byte multiple.
414 	 */
415 	len = is->is_txmax - 68;
416 	len &= 0xFE00;
417 	/* XXX: Not sure yet which of these to keep. */
418 	is->is_rwmax = len;
419 	is->is_rxmax = len;
420 	is->is_wxmax = len;
421 
422 	return (0);
423 
424 errout:
425 	smb_rq_done(rqp);
426 	if (err == 0)
427 		err = EBADRPC;
428 	return (err);
429 }
430