2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "smbd/smbd.h"
23 #include "smbd/globals.h"
24 #include "../libcli/smb/smb_common.h"
25 #include "../lib/tsocket/tsocket.h"
26 #include "../librpc/ndr/libndr.h"
29 * this is the entry point if SMB2 is selected via
30 * the SMB negprot and the given dialect.
32 static void reply_smb20xx(struct smb_request
*req
, uint16_t dialect
)
38 size_t len
= 4 + SMB2_HDR_BODY
+ 0x24 + 2;
40 smb2_inbuf
= talloc_zero_array(talloc_tos(), uint8_t, len
);
41 if (smb2_inbuf
== NULL
) {
42 DEBUG(0, ("Could not push spnego blob\n"));
43 reply_nterror(req
, NT_STATUS_NO_MEMORY
);
46 smb2_hdr
= smb2_inbuf
+ 4;
47 smb2_body
= smb2_hdr
+ SMB2_HDR_BODY
;
48 smb2_dyn
= smb2_body
+ 0x24;
50 SIVAL(smb2_hdr
, SMB2_HDR_PROTOCOL_ID
, SMB2_MAGIC
);
51 SIVAL(smb2_hdr
, SMB2_HDR_LENGTH
, SMB2_HDR_BODY
);
53 SSVAL(smb2_body
, 0x00, 0x0024); /* struct size */
54 SSVAL(smb2_body
, 0x02, 0x0001); /* dialect count */
56 SSVAL(smb2_dyn
, 0x00, dialect
);
60 smbd_smb2_first_negprot(req
->sconn
, smb2_inbuf
, len
);
65 * this is the entry point if SMB2 is selected via
66 * the SMB negprot and the "SMB 2.002" dialect.
68 void reply_smb2002(struct smb_request
*req
, uint16_t choice
)
70 reply_smb20xx(req
, SMB2_DIALECT_REVISION_202
);
74 * this is the entry point if SMB2 is selected via
75 * the SMB negprot and the "SMB 2.???" dialect.
77 void reply_smb20ff(struct smb_request
*req
, uint16_t choice
)
79 req
->sconn
->smb2
.negprot_2ff
= true;
80 reply_smb20xx(req
, SMB2_DIALECT_REVISION_2FF
);
83 NTSTATUS
smbd_smb2_request_process_negprot(struct smbd_smb2_request
*req
)
86 const uint8_t *inbody
;
87 const uint8_t *indyn
= NULL
;
88 int i
= req
->current_idx
;
91 DATA_BLOB negprot_spnego_blob
;
92 uint16_t security_offset
;
93 DATA_BLOB security_buffer
;
94 size_t expected_dyn_size
= 0;
96 uint16_t security_mode
;
97 uint16_t dialect_count
;
98 uint16_t in_security_mode
;
99 uint32_t in_capabilities
;
100 DATA_BLOB in_guid_blob
;
102 NTTIME in_start_time
;
103 uint16_t dialect
= 0;
104 uint32_t capabilities
;
105 DATA_BLOB out_guid_blob
;
106 struct GUID out_guid
;
107 enum protocol_types protocol
= PROTOCOL_NONE
;
109 uint32_t max_trans
= lp_smb2_max_trans();
110 uint32_t max_read
= lp_smb2_max_read();
111 uint32_t max_write
= lp_smb2_max_write();
113 status
= smbd_smb2_request_verify_sizes(req
, 0x24);
114 if (!NT_STATUS_IS_OK(status
)) {
115 return smbd_smb2_request_error(req
, status
);
117 inbody
= (const uint8_t *)req
->in
.vector
[i
+1].iov_base
;
119 dialect_count
= SVAL(inbody
, 0x02);
121 in_security_mode
= SVAL(inbody
, 0x04);
122 in_capabilities
= IVAL(inbody
, 0x08);
123 in_guid_blob
= data_blob_const(inbody
+ 0x0C, 16);
124 in_start_time
= BVAL(inbody
, 0x1C);
126 if (dialect_count
== 0) {
127 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
130 status
= GUID_from_ndr_blob(&in_guid_blob
, &in_guid
);
131 if (!NT_STATUS_IS_OK(status
)) {
132 return smbd_smb2_request_error(req
, status
);
135 expected_dyn_size
= dialect_count
* 2;
136 if (req
->in
.vector
[i
+2].iov_len
< expected_dyn_size
) {
137 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
139 indyn
= (const uint8_t *)req
->in
.vector
[i
+2].iov_base
;
141 for (c
=0; protocol
== PROTOCOL_NONE
&& c
< dialect_count
; c
++) {
142 if (lp_srv_maxprotocol() < PROTOCOL_SMB3_00
) {
145 if (lp_srv_minprotocol() > PROTOCOL_SMB3_00
) {
149 dialect
= SVAL(indyn
, c
*2);
150 if (dialect
== SMB3_DIALECT_REVISION_300
) {
151 protocol
= PROTOCOL_SMB3_00
;
156 for (c
=0; protocol
== PROTOCOL_NONE
&& c
< dialect_count
; c
++) {
157 if (lp_srv_maxprotocol() < PROTOCOL_SMB2_24
) {
160 if (lp_srv_minprotocol() > PROTOCOL_SMB2_24
) {
164 dialect
= SVAL(indyn
, c
*2);
165 if (dialect
== SMB2_DIALECT_REVISION_224
) {
166 protocol
= PROTOCOL_SMB2_24
;
171 for (c
=0; protocol
== PROTOCOL_NONE
&& c
< dialect_count
; c
++) {
172 if (lp_srv_maxprotocol() < PROTOCOL_SMB2_22
) {
175 if (lp_srv_minprotocol() > PROTOCOL_SMB2_22
) {
179 dialect
= SVAL(indyn
, c
*2);
180 if (dialect
== SMB2_DIALECT_REVISION_222
) {
181 protocol
= PROTOCOL_SMB2_22
;
186 for (c
=0; protocol
== PROTOCOL_NONE
&& c
< dialect_count
; c
++) {
187 if (lp_srv_maxprotocol() < PROTOCOL_SMB2_10
) {
190 if (lp_srv_minprotocol() > PROTOCOL_SMB2_10
) {
194 dialect
= SVAL(indyn
, c
*2);
195 if (dialect
== SMB2_DIALECT_REVISION_210
) {
196 protocol
= PROTOCOL_SMB2_10
;
201 for (c
=0; protocol
== PROTOCOL_NONE
&& c
< dialect_count
; c
++) {
202 if (lp_srv_maxprotocol() < PROTOCOL_SMB2_02
) {
205 if (lp_srv_minprotocol() > PROTOCOL_SMB2_02
) {
209 dialect
= SVAL(indyn
, c
*2);
210 if (dialect
== SMB2_DIALECT_REVISION_202
) {
211 protocol
= PROTOCOL_SMB2_02
;
216 for (c
=0; protocol
== PROTOCOL_NONE
&& c
< dialect_count
; c
++) {
217 if (lp_srv_maxprotocol() < PROTOCOL_SMB2_10
) {
221 dialect
= SVAL(indyn
, c
*2);
222 if (dialect
== SMB2_DIALECT_REVISION_2FF
) {
223 if (req
->sconn
->smb2
.negprot_2ff
) {
224 req
->sconn
->smb2
.negprot_2ff
= false;
225 protocol
= PROTOCOL_SMB2_10
;
231 if (protocol
== PROTOCOL_NONE
) {
232 return smbd_smb2_request_error(req
, NT_STATUS_NOT_SUPPORTED
);
235 if (get_remote_arch() != RA_SAMBA
) {
236 set_remote_arch(RA_VISTA
);
239 /* negprot_spnego() returns a the server guid in the first 16 bytes */
240 negprot_spnego_blob
= negprot_spnego(req
, req
->sconn
);
241 if (negprot_spnego_blob
.data
== NULL
) {
242 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
245 if (negprot_spnego_blob
.length
< 16) {
246 return smbd_smb2_request_error(req
, NT_STATUS_INTERNAL_ERROR
);
249 security_mode
= SMB2_NEGOTIATE_SIGNING_ENABLED
;
250 if (lp_server_signing() == SMB_SIGNING_REQUIRED
) {
251 security_mode
|= SMB2_NEGOTIATE_SIGNING_REQUIRED
;
255 if (lp_host_msdfs()) {
256 capabilities
|= SMB2_CAP_DFS
;
260 * 0x10000 (65536) is the maximum allowed message size
265 if (protocol
>= PROTOCOL_SMB2_10
) {
266 /* largeMTU is only available on port 445 */
268 tsocket_address_inet_port(req
->sconn
->local_address
))
271 capabilities
|= SMB2_CAP_LARGE_MTU
;
272 req
->sconn
->smb2
.supports_multicredit
= true;
274 /* SMB2.1 has 1 MB of allowed size */
275 max_limit
= 0x100000; /* 1MB */
280 * the defaults are 1MB, but we'll limit this to max_limit based on
281 * the dialect (64kb for SMB2.0, 1MB for SMB2.1 with LargeMTU)
283 * user configured values exceeding the limits will be overwritten,
284 * only smaller values will be accepted
287 max_trans
= MIN(max_limit
, lp_smb2_max_trans());
288 max_read
= MIN(max_limit
, lp_smb2_max_read());
289 max_write
= MIN(max_limit
, lp_smb2_max_write());
291 security_offset
= SMB2_HDR_BODY
+ 0x40;
294 /* Try SPNEGO auth... */
295 security_buffer
= data_blob_const(negprot_spnego_blob
.data
+ 16,
296 negprot_spnego_blob
.length
- 16);
298 /* for now we want raw NTLMSSP */
299 security_buffer
= data_blob_const(NULL
, 0);
302 out_guid_blob
= data_blob_const(negprot_spnego_blob
.data
, 16);
303 status
= GUID_from_ndr_blob(&out_guid_blob
, &out_guid
);
304 if (!NT_STATUS_IS_OK(status
)) {
305 return smbd_smb2_request_error(req
, status
);
308 outbody
= data_blob_talloc(req
->out
.vector
, NULL
, 0x40);
309 if (outbody
.data
== NULL
) {
310 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
313 SSVAL(outbody
.data
, 0x00, 0x40 + 1); /* struct size */
314 SSVAL(outbody
.data
, 0x02,
315 security_mode
); /* security mode */
316 SSVAL(outbody
.data
, 0x04, dialect
); /* dialect revision */
317 SSVAL(outbody
.data
, 0x06, 0); /* reserved */
318 memcpy(outbody
.data
+ 0x08,
319 out_guid_blob
.data
, 16); /* server guid */
320 SIVAL(outbody
.data
, 0x18,
321 capabilities
); /* capabilities */
322 SIVAL(outbody
.data
, 0x1C, max_trans
); /* max transact size */
323 SIVAL(outbody
.data
, 0x20, max_read
); /* max read size */
324 SIVAL(outbody
.data
, 0x24, max_write
); /* max write size */
325 SBVAL(outbody
.data
, 0x28, 0); /* system time */
326 SBVAL(outbody
.data
, 0x30, 0); /* server start time */
327 SSVAL(outbody
.data
, 0x38,
328 security_offset
); /* security buffer offset */
329 SSVAL(outbody
.data
, 0x3A,
330 security_buffer
.length
); /* security buffer length */
331 SIVAL(outbody
.data
, 0x3C, 0); /* reserved */
333 outdyn
= security_buffer
;
335 req
->sconn
->using_smb2
= true;
337 if (dialect
!= SMB2_DIALECT_REVISION_2FF
) {
338 struct smbXsrv_connection
*conn
= req
->sconn
->conn
;
340 status
= smbXsrv_connection_init_tables(conn
, protocol
);
341 if (!NT_STATUS_IS_OK(status
)) {
342 return smbd_smb2_request_error(req
, status
);
345 conn
->smb2
.client
.capabilities
= in_capabilities
;
346 conn
->smb2
.client
.security_mode
= in_security_mode
;
347 conn
->smb2
.client
.guid
= in_guid
;
348 conn
->smb2
.client
.num_dialects
= dialect_count
;
349 conn
->smb2
.client
.dialects
= talloc_array(conn
,
352 if (conn
->smb2
.client
.dialects
== NULL
) {
353 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
355 for (c
=0; c
< dialect_count
; c
++) {
356 conn
->smb2
.client
.dialects
[c
] = SVAL(indyn
, c
*2);
359 conn
->smb2
.server
.capabilities
= capabilities
;
360 conn
->smb2
.server
.security_mode
= security_mode
;
361 conn
->smb2
.server
.guid
= out_guid
;
362 conn
->smb2
.server
.dialect
= dialect
;
363 conn
->smb2
.server
.max_trans
= max_trans
;
364 conn
->smb2
.server
.max_read
= max_read
;
365 conn
->smb2
.server
.max_write
= max_write
;
367 req
->sconn
->smb2
.max_trans
= max_trans
;
368 req
->sconn
->smb2
.max_read
= max_read
;
369 req
->sconn
->smb2
.max_write
= max_write
;
372 return smbd_smb2_request_done(req
, outbody
, &outdyn
);