source/smbd/negprot.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 1.9.
   4    negprot reply code
   5    Copyright (C) Andrew Tridgell 1992-1998
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24 extern int DEBUGLEVEL;
  25 extern int Protocol;
  26 extern int max_recv;
  27 extern fstring global_myworkgroup;
  28 extern fstring remote_machine;
  29
  30 /****************************************************************************
  31 reply for the core protocol
  32 ****************************************************************************/
  33 static int reply_corep(char *outbuf)
  34 {
  35         int outsize = set_message(outbuf,1,0,True);
  36
  37         Protocol = PROTOCOL_CORE;
  38
  39         return outsize;
  40 }
  41
  42
  43 /****************************************************************************
  44 reply for the coreplus protocol
  45 ****************************************************************************/
  46 static int reply_coreplus(char *outbuf)
  47 {
  48   int raw = (lp_readraw()?1:0) | (lp_writeraw()?2:0);
  49   int outsize = set_message(outbuf,13,0,True);
  50   SSVAL(outbuf,smb_vwv5,raw); /* tell redirector we support
  51                                  readbraw and writebraw (possibly) */
  52   /* Reply, SMBlockread, SMBwritelock supported. */
  53   SCVAL(outbuf,smb_flg,FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
  54   SSVAL(outbuf,smb_vwv1,0x1); /* user level security, don't encrypt */
  55
  56   Protocol = PROTOCOL_COREPLUS;
  57
  58   return outsize;
  59 }
  60
  61
  62 /****************************************************************************
  63 reply for the lanman 1.0 protocol
  64 ****************************************************************************/
  65 static int reply_lanman1(char *outbuf)
  66 {
  67   int raw = (lp_readraw()?1:0) | (lp_writeraw()?2:0);
  68   int secword=0;
  69   BOOL doencrypt = SMBENCRYPT();
  70   time_t t = time(NULL);
  71
  72   if (lp_security()>=SEC_USER) secword |= 1;
  73   if (doencrypt) secword |= 2;
  74
  75   set_message(outbuf,13,doencrypt?8:0,True);
  76   SSVAL(outbuf,smb_vwv1,secword);
  77   /* Create a token value and add it to the outgoing packet. */
  78   if (doencrypt)
  79     generate_next_challenge(smb_buf(outbuf));
  80
  81   Protocol = PROTOCOL_LANMAN1;
  82
  83   /* Reply, SMBlockread, SMBwritelock supported. */
  84   SCVAL(outbuf,smb_flg,FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
  85   SSVAL(outbuf,smb_vwv2,max_recv);
  86   SSVAL(outbuf,smb_vwv3,lp_maxmux()); /* maxmux */
  87   SSVAL(outbuf,smb_vwv4,1);
  88   SSVAL(outbuf,smb_vwv5,raw); /* tell redirector we support
  89                                  readbraw writebraw (possibly) */
  90   SIVAL(outbuf,smb_vwv6,sys_getpid());
  91   SSVAL(outbuf,smb_vwv10, TimeDiff(t)/60);
  92
  93   put_dos_date(outbuf,smb_vwv8,t);
  94
  95   return (smb_len(outbuf)+4);
  96 }
  97
  98
  99 /****************************************************************************
 100 reply for the lanman 2.0 protocol
 101 ****************************************************************************/
 102 static int reply_lanman2(char *outbuf)
 103 {
 104   int raw = (lp_readraw()?1:0) | (lp_writeraw()?2:0);
 105   int secword=0;
 106   BOOL doencrypt = SMBENCRYPT();
 107   time_t t = time(NULL);
 108   struct cli_state *cli = NULL;
 109   char cryptkey[8];
 110   char crypt_len = 0;
 111
 112   if (lp_security() == SEC_SERVER) {
 113           cli = server_cryptkey();
 114   }
 115
 116   if (cli) {
 117           DEBUG(3,("using password server validation\n"));
 118           doencrypt = ((cli->sec_mode & 2) != 0);
 119   }
 120
 121   if (lp_security()>=SEC_USER) secword |= 1;
 122   if (doencrypt) secword |= 2;
 123
 124   if (doencrypt) {
 125           crypt_len = 8;
 126           if (!cli) {
 127                   generate_next_challenge(cryptkey);
 128           } else {
 129                   memcpy(cryptkey, cli->cryptkey, 8);
 130                   set_challenge(cli->cryptkey);
 131           }
 132   }
 133
 134   set_message(outbuf,13,crypt_len,True);
 135   SSVAL(outbuf,smb_vwv1,secword);
 136   SIVAL(outbuf,smb_vwv6,sys_getpid());
 137   if (doencrypt)
 138           memcpy(smb_buf(outbuf), cryptkey, 8);
 139
 140   Protocol = PROTOCOL_LANMAN2;
 141
 142   /* Reply, SMBlockread, SMBwritelock supported. */
 143   SCVAL(outbuf,smb_flg,FLAG_REPLY|FLAG_SUPPORT_LOCKREAD);
 144   SSVAL(outbuf,smb_vwv2,max_recv);
 145   SSVAL(outbuf,smb_vwv3,lp_maxmux());
 146   SSVAL(outbuf,smb_vwv4,1);
 147   SSVAL(outbuf,smb_vwv5,raw); /* readbraw and/or writebraw */
 148   SSVAL(outbuf,smb_vwv10, TimeDiff(t)/60);
 149   put_dos_date(outbuf,smb_vwv8,t);
 150
 151   return (smb_len(outbuf)+4);
 152 }
 153
 154
 155 /****************************************************************************
 156 reply for the nt protocol
 157 ****************************************************************************/
 158 static int reply_nt1(char *outbuf)
 159 {
 160   /* dual names + lock_and_read + nt SMBs + remote API calls */
 161   int capabilities = CAP_NT_FIND|CAP_LOCK_AND_READ|CAP_LEVEL_II_OPLOCKS|
 162                      (lp_nt_smb_support() ? CAP_NT_SMBS | CAP_RPC_REMOTE_APIS : 0) |
 163                      (SMB_OFF_T_BITS == 64 ? CAP_LARGE_FILES : 0);
 164
 165
 166 /*
 167   other valid capabilities which we may support at some time...
 168                      CAP_LARGE_READX|CAP_STATUS32|CAP_LEVEL_II_OPLOCKS;
 169  */
 170
 171   int secword=0;
 172   BOOL doencrypt = SMBENCRYPT();
 173   time_t t = time(NULL);
 174   int data_len;
 175   struct cli_state *cli = NULL;
 176   char cryptkey[8];
 177   char crypt_len = 0;
 178
 179   if (lp_security() == SEC_SERVER) {
 180           cli = server_cryptkey();
 181   }
 182
 183   if (cli) {
 184           DEBUG(3,("using password server validation\n"));
 185           doencrypt = ((cli->sec_mode & 2) != 0);
 186   }
 187
 188   if (doencrypt) {
 189           crypt_len = 8;
 190           if (!cli) {
 191                   generate_next_challenge(cryptkey);
 192           } else {
 193                   memcpy(cryptkey, cli->cryptkey, 8);
 194                   set_challenge(cli->cryptkey);
 195           }
 196   }
 197
 198   if (lp_readraw() && lp_writeraw()) {
 199           capabilities |= CAP_RAW_MODE;
 200   }
 201
 202
 203   /* allow for disabling unicode */
 204   if (lp_unicode()) {
 205           capabilities |= CAP_UNICODE;
 206   }
 207
 208 #ifdef WITH_MSDFS
 209   if(lp_host_msdfs())
 210         capabilities |= CAP_DFS;
 211 #endif
 212
 213   if (lp_security() >= SEC_USER) secword |= 1;
 214   if (doencrypt) secword |= 2;
 215
 216   /* decide where (if) to put the encryption challenge, and
 217      follow it with the OEM'd domain name
 218    */
 219   data_len = crypt_len + strlen(global_myworkgroup) + 1;
 220
 221   set_message(outbuf,17,data_len,True);
 222   pstrcpy(smb_buf(outbuf)+crypt_len, global_myworkgroup);
 223
 224   CVAL(outbuf,smb_vwv1) = secword;
 225   SSVALS(outbuf,smb_vwv16+1,crypt_len);
 226   if (doencrypt)
 227           memcpy(smb_buf(outbuf), cryptkey, 8);
 228
 229   Protocol = PROTOCOL_NT1;
 230
 231   SSVAL(outbuf,smb_vwv1+1,lp_maxmux()); /* maxmpx */
 232   SSVAL(outbuf,smb_vwv2+1,1); /* num vcs */
 233   SIVAL(outbuf,smb_vwv3+1,0xffff); /* max buffer. LOTS! */
 234   SIVAL(outbuf,smb_vwv5+1,0x10000); /* raw size. full 64k */
 235   SIVAL(outbuf,smb_vwv7+1,sys_getpid()); /* session key */
 236   SIVAL(outbuf,smb_vwv9+1,capabilities); /* capabilities */
 237   put_long_date(outbuf+smb_vwv11+1,t);
 238   SSVALS(outbuf,smb_vwv15+1,TimeDiff(t)/60);
 239   SSVAL(outbuf,smb_vwv17,data_len); /* length of challenge+domain strings */
 240
 241   return (smb_len(outbuf)+4);
 242 }
 243
 244 /* these are the protocol lists used for auto architecture detection:
 245
 246 WinNT 3.51:
 247 protocol [PC NETWORK PROGRAM 1.0]
 248 protocol [XENIX CORE]
 249 protocol [MICROSOFT NETWORKS 1.03]
 250 protocol [LANMAN1.0]
 251 protocol [Windows for Workgroups 3.1a]
 252 protocol [LM1.2X002]
 253 protocol [LANMAN2.1]
 254 protocol [NT LM 0.12]
 255
 256 Win95:
 257 protocol [PC NETWORK PROGRAM 1.0]
 258 protocol [XENIX CORE]
 259 protocol [MICROSOFT NETWORKS 1.03]
 260 protocol [LANMAN1.0]
 261 protocol [Windows for Workgroups 3.1a]
 262 protocol [LM1.2X002]
 263 protocol [LANMAN2.1]
 264 protocol [NT LM 0.12]
 265
 266 Win2K:
 267 protocol [PC NETWORK PROGRAM 1.0]
 268 protocol [LANMAN1.0]
 269 protocol [Windows for Workgroups 3.1a]
 270 protocol [LM1.2X002]
 271 protocol [LANMAN2.1]
 272 protocol [NT LM 0.12]
 273
 274 OS/2:
 275 protocol [PC NETWORK PROGRAM 1.0]
 276 protocol [XENIX CORE]
 277 protocol [LANMAN1.0]
 278 protocol [LM1.2X002]
 279 protocol [LANMAN2.1]
 280 */
 281
 282 /*
 283   * Modified to recognize the architecture of the remote machine better.
 284   *
 285   * This appears to be the matrix of which protocol is used by which
 286   * MS product.
 287        Protocol                       WfWg    Win95   WinNT  Win2K  OS/2
 288        PC NETWORK PROGRAM 1.0          1       1       1      1      1
 289        XENIX CORE                                      2             2
 290        MICROSOFT NETWORKS 3.0          2       2
 291        DOS LM1.2X002                   3       3
 292        MICROSOFT NETWORKS 1.03                         3
 293        DOS LANMAN2.1                   4       4
 294        LANMAN1.0                                       4      2      3
 295        Windows for Workgroups 3.1a     5       5       5      3
 296        LM1.2X002                                       6      4      4
 297        LANMAN2.1                                       7      5      5
 298        NT LM 0.12                              6       8      6
 299   *
 300   *  tim@fsg.com 09/29/95
 301   *  Win2K added by matty 17/7/99
 302   */
 303
 304 #define ARCH_WFWG     0x3      /* This is a fudge because WfWg is like Win95 */
 305 #define ARCH_WIN95    0x2
 306 #define ARCH_WINNT    0x4
 307 #define ARCH_WIN2K    0xC      /* Win2K is like NT */
 308 #define ARCH_OS2      0x14     /* Again OS/2 is like NT */
 309 #define ARCH_SAMBA    0x20
 310
 311 #define ARCH_ALL      0x3F
 312
 313 /* List of supported protocols, most desired first */
 314 static struct {
 315   char *proto_name;
 316   char *short_name;
 317   int (*proto_reply_fn)(char *);
 318   int protocol_level;
 319 } supported_protocols[] = {
 320   {"NT LANMAN 1.0",           "NT1",      reply_nt1,      PROTOCOL_NT1},
 321   {"NT LM 0.12",              "NT1",      reply_nt1,      PROTOCOL_NT1},
 322   {"LM1.2X002",               "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 323   {"Samba",                   "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 324   {"DOS LM1.2X002",           "LANMAN2",  reply_lanman2,  PROTOCOL_LANMAN2},
 325   {"LANMAN1.0",               "LANMAN1",  reply_lanman1,  PROTOCOL_LANMAN1},
 326   {"MICROSOFT NETWORKS 3.0",  "LANMAN1",  reply_lanman1,  PROTOCOL_LANMAN1},
 327   {"MICROSOFT NETWORKS 1.03", "COREPLUS", reply_coreplus, PROTOCOL_COREPLUS},
 328   {"PC NETWORK PROGRAM 1.0",  "CORE",     reply_corep,    PROTOCOL_CORE},
 329   {NULL,NULL,NULL,0},
 330 };
 331
 332
 333 /****************************************************************************
 334   reply to a negprot
 335 ****************************************************************************/
 336 int reply_negprot(connection_struct *conn,
 337                   char *inbuf,char *outbuf, int dum_size,
 338                   int dum_buffsize)
 339 {
 340   int outsize = set_message(outbuf,1,0,True);
 341   int Index=0;
 342   int choice= -1;
 343   int protocol;
 344   char *p;
 345   int bcc = SVAL(smb_buf(inbuf),-2);
 346   int arch = ARCH_ALL;
 347   START_PROFILE(SMBnegprot);
 348
 349   p = smb_buf(inbuf)+1;
 350   while (p < (smb_buf(inbuf) + bcc))
 351     {
 352       Index++;
 353       DEBUG(3,("Requested protocol [%s]\n",p));
 354       if (strcsequal(p,"Windows for Workgroups 3.1a"))
 355         arch &= ( ARCH_WFWG | ARCH_WIN95 | ARCH_WINNT | ARCH_WIN2K );
 356       else if (strcsequal(p,"DOS LM1.2X002"))
 357         arch &= ( ARCH_WFWG | ARCH_WIN95 );
 358       else if (strcsequal(p,"DOS LANMAN2.1"))
 359         arch &= ( ARCH_WFWG | ARCH_WIN95 );
 360       else if (strcsequal(p,"NT LM 0.12"))
 361         arch &= ( ARCH_WIN95 | ARCH_WINNT | ARCH_WIN2K );
 362       else if (strcsequal(p,"LANMAN2.1"))
 363         arch &= ( ARCH_WINNT | ARCH_WIN2K | ARCH_OS2 );
 364       else if (strcsequal(p,"LM1.2X002"))
 365         arch &= ( ARCH_WINNT | ARCH_WIN2K | ARCH_OS2 );
 366       else if (strcsequal(p,"MICROSOFT NETWORKS 1.03"))
 367         arch &= ARCH_WINNT;
 368       else if (strcsequal(p,"XENIX CORE"))
 369         arch &= ( ARCH_WINNT | ARCH_OS2 );
 370       else if (strcsequal(p,"Samba")) {
 371         arch = ARCH_SAMBA;
 372         break;
 373       }
 374
 375       p += strlen(p) + 2;
 376     }
 377
 378   switch ( arch ) {
 379   case ARCH_SAMBA:
 380     set_remote_arch(RA_SAMBA);
 381     break;
 382   case ARCH_WFWG:
 383     set_remote_arch(RA_WFWG);
 384     break;
 385   case ARCH_WIN95:
 386     set_remote_arch(RA_WIN95);
 387     break;
 388   case ARCH_WINNT:
 389    if(SVAL(inbuf,smb_flg2)==FLAGS2_WIN2K_SIGNATURE)
 390      set_remote_arch(RA_WIN2K);
 391    else
 392      set_remote_arch(RA_WINNT);
 393     break;
 394   case ARCH_WIN2K:
 395     set_remote_arch(RA_WIN2K);
 396     break;
 397   case ARCH_OS2:
 398     set_remote_arch(RA_OS2);
 399     break;
 400   default:
 401     set_remote_arch(RA_UNKNOWN);
 402     break;
 403   }
 404
 405   /* possibly reload - change of architecture */
 406   reload_services(True);
 407
 408   /* a special case to stop password server loops */
 409   if (Index == 1 && strequal(remote_machine,myhostname()) &&
 410       (lp_security()==SEC_SERVER || lp_security()==SEC_DOMAIN))
 411     exit_server("Password server loop!");
 412
 413   /* Check for protocols, most desirable first */
 414   for (protocol = 0; supported_protocols[protocol].proto_name; protocol++)
 415     {
 416       p = smb_buf(inbuf)+1;
 417       Index = 0;
 418       if ((supported_protocols[protocol].protocol_level <= lp_maxprotocol()) &&
 419           (supported_protocols[protocol].protocol_level >= lp_minprotocol()))
 420         while (p < (smb_buf(inbuf) + bcc))
 421           {
 422             if (strequal(p,supported_protocols[protocol].proto_name))
 423               choice = Index;
 424             Index++;
 425             p += strlen(p) + 2;
 426           }
 427       if(choice != -1)
 428         break;
 429     }
 430
 431   SSVAL(outbuf,smb_vwv0,choice);
 432   if(choice != -1) {
 433     extern fstring remote_proto;
 434     fstrcpy(remote_proto,supported_protocols[protocol].short_name);
 435     reload_services(True);
 436     outsize = supported_protocols[protocol].proto_reply_fn(outbuf);
 437     DEBUG(3,("Selected protocol %s\n",supported_protocols[protocol].proto_name));
 438   }
 439   else {
 440     DEBUG(0,("No protocol supported !\n"));
 441   }
 442   SSVAL(outbuf,smb_vwv0,choice);
 443
 444   DEBUG( 5, ( "negprot index=%d\n", choice ) );
 445
 446   END_PROFILE(SMBnegprot);
 447   return(outsize);
 448 }