usr/src/lib/libsmbfs/smb/negprot.c

   1 /*
   2  * Copyright (c) 2000-2001 Boris Popov
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 3. All advertising materials mentioning features or use of this software
  14  *    must display the following acknowledgement:
  15  *    This product includes software developed by Boris Popov.
  16  * 4. Neither the name of the author nor the names of any co-contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 /*
  34  * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
  35  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
  36  */
  37
  38 /*
  39  * SMB Negotiate Protocol, and related.
  40  */
  41
  42 #include <errno.h>
  43 #include <stdio.h>
  44 #include <stdlib.h>
  45 #include <unistd.h>
  46 #include <strings.h>
  47 #include <netdb.h>
  48 #include <libintl.h>
  49 #include <xti.h>
  50 #include <assert.h>
  51
  52 #include <sys/types.h>
  53 #include <sys/time.h>
  54 #include <sys/byteorder.h>
  55 #include <sys/socket.h>
  56 #include <sys/fcntl.h>
  57
  58 #include <netinet/in.h>
  59 #include <netinet/tcp.h>
  60 #include <arpa/inet.h>
  61
  62 #include <netsmb/smb.h>
  63 #include <netsmb/smb_lib.h>
  64 #include <netsmb/netbios.h>
  65 #include <netsmb/nb_lib.h>
  66 #include <netsmb/smb_dev.h>
  67
  68 #include "charsets.h"
  69 #include "smb_crypt.h"
  70 #include "private.h"
  71
  72 /*
  73  * SMB dialects that we know about.
  74  */
  75 struct smb_dialect {
  76         int             d_id;
  77         const char      *d_name;
  78 };
  79 static struct smb_dialect smb_dialects[] = {
  80         {SMB_DIALECT_CORE,      "PC NETWORK PROGRAM 1.0"},
  81         {SMB_DIALECT_LANMAN1_0, "LANMAN1.0"},
  82         {SMB_DIALECT_LANMAN2_0, "LM1.2X002"},
  83         {SMB_DIALECT_LANMAN2_1, "LANMAN2.1"},
  84         {SMB_DIALECT_NTLM0_12,  "NT LM 0.12"},
  85         {-1,                    NULL}
  86 };
  87
  88 #define SMB_DIALECT_MAX \
  89         (sizeof (smb_dialects) / sizeof (struct smb_dialect) - 2)
  90
  91 static const uint32_t smb_clnt_caps_mask =
  92     SMB_CAP_UNICODE |
  93     SMB_CAP_LARGE_FILES |
  94     SMB_CAP_NT_SMBS |
  95     SMB_CAP_STATUS32 |
  96     SMB_CAP_EXT_SECURITY;
  97
  98 /*
  99  * SMB Negotiate Protocol
 100  * Based on code from the driver: smb_smb.c
 101  *
 102  * If using Extended Security, oblob (output)
 103  * will hold the initial security "hint".
 104  */
 105 int
 106 smb_negprot(struct smb_ctx *ctx, struct mbdata *oblob)
 107 {
 108         struct smb_sopt *sv = &ctx->ct_sopt;
 109         struct smb_iods *is = &ctx->ct_iods;
 110         struct smb_rq   *rqp;
 111         struct mbdata   *mbp;
 112         struct smb_dialect *dp;
 113         int err, len;
 114         uint8_t wc, eklen;
 115         uint16_t dindex, bc;
 116         int will_sign = 0;
 117
 118         /*
 119          * Initialize: vc_hflags and vc_hflags2.
 120          * Note: ctx->ct_hflags* are copied into the
 121          * (per request) rqp->rq_hflags* by smb_rq_init.
 122          *
 123          * Like Windows, set FLAGS2_UNICODE in our first request,
 124          * even though technically we don't yet know whether the
 125          * server supports Unicode.  Will clear this flag below
 126          * if we find out it doesn't.  Need to do this because
 127          * some servers reject all non-Unicode requests.
 128          */
 129         ctx->ct_hflags =
 130             SMB_FLAGS_CASELESS |
 131             SMB_FLAGS_CANONICAL_PATHNAMES;
 132         ctx->ct_hflags2 =
 133             SMB_FLAGS2_KNOWS_LONG_NAMES |
 134             SMB_FLAGS2_KNOWS_EAS |
 135             /* SMB_FLAGS2_IS_LONG_NAME |? */
 136             /* EXT_SEC (see below) */
 137             SMB_FLAGS2_ERR_STATUS |
 138             SMB_FLAGS2_UNICODE;
 139
 140         /*
 141          * Sould we offer extended security?
 142          * We'll turn this back off below if
 143          * the server doesn't support it.
 144          */
 145         if (ctx->ct_vopt & SMBVOPT_EXT_SEC)
 146                 ctx->ct_hflags2 |= SMB_FLAGS2_EXT_SEC;
 147
 148         /*
 149          * The initial UID needs to be zero,
 150          * or Windows XP says "bad user".
 151          * The initial TID is all ones, but
 152          * we don't use it or store it here
 153          * because the driver handles that.
 154          */
 155         is->is_smbuid = 0;
 156
 157         /*
 158          * In case we're reconnecting,
 159          * free previous stuff.
 160          */
 161         ctx->ct_mac_seqno = 0;
 162         if (ctx->ct_mackey != NULL) {
 163                 free(ctx->ct_mackey);
 164                 ctx->ct_mackey = NULL;
 165                 ctx->ct_mackeylen = 0;
 166         }
 167
 168         sv = &ctx->ct_sopt;
 169         bzero(sv, sizeof (struct smb_sopt));
 170
 171         err = smb_rq_init(ctx, SMB_COM_NEGOTIATE, &rqp);
 172         if (err)
 173                 return (err);
 174
 175         /*
 176          * Build the SMB request.
 177          */
 178         mbp = &rqp->rq_rq;
 179         mb_put_uint8(mbp, 0);                   /* word count */
 180         smb_rq_bstart(rqp);
 181         for (dp = smb_dialects; dp->d_id != -1; dp++) {
 182                 mb_put_uint8(mbp, SMB_DT_DIALECT);
 183                 mb_put_astring(mbp, dp->d_name);
 184         }
 185         smb_rq_bend(rqp);
 186
 187         /*
 188          * This does the OTW call
 189          */
 190         err = smb_rq_internal(ctx, rqp);
 191         if (err) {
 192                 DPRINT("call failed, err %d", err);
 193                 goto errout;
 194         }
 195         if (rqp->rq_status != 0) {
 196                 DPRINT("nt status 0x%x", rqp->rq_status);
 197                 err = EBADRPC;
 198                 goto errout;
 199         }
 200
 201         /*
 202          * Decode the response
 203          *
 204          * Comments to right show names as described in
 205          * The Microsoft SMB Protocol spec. [MS-SMB]
 206          * section 2.2.3
 207          */
 208         mbp = &rqp->rq_rp;
 209         (void) md_get_uint8(mbp, &wc);
 210         err = md_get_uint16le(mbp, &dindex);
 211         if (err || dindex > SMB_DIALECT_MAX) {
 212                 DPRINT("err %d dindex %d", err, (int)dindex);
 213                 goto errout;
 214         }
 215         dp = smb_dialects + dindex;
 216         sv->sv_proto = dp->d_id;
 217         DPRINT("Dialect %s", dp->d_name);
 218         if (dp->d_id < SMB_DIALECT_NTLM0_12) {
 219                 /* XXX: User-visible warning too? */
 220                 DPRINT("old dialect %s", dp->d_name);
 221                 goto errout;
 222         }
 223         if (wc != 17) {
 224                 DPRINT("bad wc %d", (int)wc);
 225                 goto errout;
 226         }
 227         md_get_uint8(mbp, &sv->sv_sm);          /* SecurityMode */
 228         md_get_uint16le(mbp, &sv->sv_maxmux);   /* MaxMpxCount */
 229         md_get_uint16le(mbp, &sv->sv_maxvcs);   /* MaxCountVCs */
 230         md_get_uint32le(mbp, &sv->sv_maxtx);    /* MaxBufferSize */
 231         md_get_uint32le(mbp, &sv->sv_maxraw);   /* MaxRawSize */
 232         md_get_uint32le(mbp, &sv->sv_skey);     /* SessionKey */
 233         md_get_uint32le(mbp, &sv->sv_caps);     /* Capabilities */
 234         md_get_mem(mbp, NULL, 8, MB_MSYSTEM);   /* SystemTime(s) */
 235         md_get_uint16le(mbp, (uint16_t *)&sv->sv_tz);
 236         md_get_uint8(mbp, &eklen);      /* EncryptionKeyLength */
 237         err = md_get_uint16le(mbp, &bc);        /* ByteCount */
 238         if (err)
 239                 goto errout;
 240
 241         /* BEGIN CSTYLED */
 242         /*
 243          * Will we do SMB signing?  Or block the connection?
 244          * The table below describes this logic.  References:
 245          * [Windows Server Protocols: MS-SMB, sec. 3.2.4.2.3]
 246          * http://msdn.microsoft.com/en-us/library/cc212511.aspx
 247          * http://msdn.microsoft.com/en-us/library/cc212929.aspx
 248          *
 249          * Srv/Cli     | Required | Enabled    | If Required | Disabled
 250          * ------------+----------+------------+-------------+-----------
 251          * Required    | Signed   | Signed     | Signed      | Blocked [1]
 252          * ------------+----------+------------+-------------+-----------
 253          * Enabled     | Signed   | Signed     | Not Signed  | Not Signed
 254          * ------------+----------+------------+-------------+-----------
 255          * If Required | Signed   | Not Signed | Not Signed  | Not Signed
 256          * ------------+----------+------------+-------------+-----------
 257          * Disabled    | Blocked  | Not Signed | Not Signed  | Not Signed
 258          *
 259          * [1] Like Windows 2003 and later, we don't really implement
 260          * the "Disabled" setting.  Instead we implement "If Required",
 261          * so we always sign if the server requires signing.
 262          */
 263         /* END CSTYLED */
 264
 265         if (sv->sv_sm & SMB_SM_SIGS_REQUIRE) {
 266                 /*
 267                  * Server requires signing.  We will sign,
 268                  * even if local setting is "disabled".
 269                  */
 270                 will_sign = 1;
 271         } else if (sv->sv_sm & SMB_SM_SIGS) {
 272                 /*
 273                  * Server enables signing (client's option).
 274                  * If enabled locally, do signing.
 275                  */
 276                 if (ctx->ct_vopt & SMBVOPT_SIGNING_ENABLED)
 277                         will_sign = 1;
 278                 /* else not signing. */
 279         } else {
 280                 /*
 281                  * Server does not support signing.
 282                  * If we "require" it, bail now.
 283                  */
 284                 if (ctx->ct_vopt & SMBVOPT_SIGNING_REQUIRED) {
 285                         DPRINT("Client requires signing "
 286                             "but server has it disabled.");
 287                         err = EBADRPC;
 288                         goto errout;
 289                 }
 290         }
 291
 292         if (will_sign) {
 293                 ctx->ct_vcflags |= SMBV_WILL_SIGN;
 294         }
 295         DPRINT("Security signatures: %d", will_sign);
 296
 297         /* See comment above re. FLAGS2_UNICODE */
 298         if (sv->sv_caps & SMB_CAP_UNICODE)
 299                 ctx->ct_vcflags |= SMBV_UNICODE;
 300         else
 301                 ctx->ct_hflags2 &= ~SMB_FLAGS2_UNICODE;
 302
 303         if ((sv->sv_caps & SMB_CAP_STATUS32) == 0) {
 304                 /*
 305                  * They don't do NT error codes.
 306                  *
 307                  * If we send requests with
 308                  * SMB_FLAGS2_ERR_STATUS set in
 309                  * Flags2, Windows 98, at least,
 310                  * appears to send replies with that
 311                  * bit set even though it sends back
 312                  * DOS error codes.  (They probably
 313                  * just use the request header as
 314                  * a template for the reply header,
 315                  * and don't bother clearing that bit.)
 316                  *
 317                  * Therefore, we clear that bit in
 318                  * our vc_hflags2 field.
 319                  */
 320                 ctx->ct_hflags2 &= ~SMB_FLAGS2_ERR_STATUS;
 321         }
 322         if (dp->d_id == SMB_DIALECT_NTLM0_12 &&
 323             sv->sv_maxtx < 4096 &&
 324             (sv->sv_caps & SMB_CAP_NT_SMBS) == 0) {
 325                 ctx->ct_vcflags |= SMBV_WIN95;
 326                 DPRINT("Win95 detected");
 327         }
 328
 329         /*
 330          * The rest of the message varies depending on
 331          * whether we've negotiated "extended security".
 332          *
 333          * With extended security, we have:
 334          *      Server_GUID     (length 16)
 335          *      Security_BLOB
 336          * Otherwise we have:
 337          *      EncryptionKey (length is eklen)
 338          *      PrimaryDomain
 339          */
 340         if (sv->sv_caps & SMB_CAP_EXT_SECURITY) {
 341                 struct mbuf *m;
 342                 DPRINT("Ext.Security: yes");
 343
 344                 /*
 345                  * Skip the server GUID.
 346                  */
 347                 err = md_get_mem(mbp, NULL, SMB_GUIDLEN, MB_MSYSTEM);
 348                 if (err)
 349                         goto errout;
 350                 /*
 351                  * Remainder is the security blob.
 352                  * Note: eklen "must be ignored" [MS-SMB]
 353                  */
 354                 len = (int)bc - SMB_GUIDLEN;
 355                 if (len < 0)
 356                         goto errout;
 357
 358                 /*
 359                  * Get the (optional) SPNEGO "hint".
 360                  */
 361                 err = md_get_mbuf(mbp, len, &m);
 362                 if (err)
 363                         goto errout;
 364                 mb_initm(oblob, m);
 365                 oblob->mb_count = len;
 366         } else {
 367                 DPRINT("Ext.Security: no");
 368                 ctx->ct_hflags2 &= ~SMB_FLAGS2_EXT_SEC;
 369
 370                 /*
 371                  * Save the "Encryption Key" (the challenge).
 372                  *
 373                  * Sanity check: make sure the sec. blob length
 374                  * isn't bigger than the byte count.
 375                  */
 376                 if (bc < eklen || eklen < NTLM_CHAL_SZ) {
 377                         err = EBADRPC;
 378                         goto errout;
 379                 }
 380                 err = md_get_mem(mbp, ctx->ct_srv_chal,
 381                     NTLM_CHAL_SZ, MB_MSYSTEM);
 382                 /*
 383                  * Server domain follows (ignored)
 384                  * Note: NOT aligned(2) - unusual!
 385                  */
 386         }
 387
 388         smb_rq_done(rqp);
 389
 390         /*
 391          * A few sanity checks on what we received,
 392          * becuse we will send these in ssnsetup.
 393          *
 394          * Maximum outstanding requests (we care),
 395          * and Max. VCs (we only use one).  Also,
 396          * MaxBufferSize lower limit per spec.
 397          */
 398         if (sv->sv_maxmux < 1)
 399                 sv->sv_maxmux = 1;
 400         if (sv->sv_maxvcs < 1)
 401                 sv->sv_maxvcs = 1;
 402         if (sv->sv_maxtx < 1024)
 403                 sv->sv_maxtx = 1024;
 404
 405         /*
 406          * Maximum transfer size.
 407          * Sanity checks:
 408          *
 409          * Let's be conservative about an upper limit here.
 410          * Win2k uses 16644 (and others) so 32k should be a
 411          * reasonable sanity limit for this value.
 412          *
 413          * Note that this limit does NOT affect READX/WRITEX
 414          * with CAP_LARGE_..., which we nearly always use.
 415          */
 416         is->is_txmax = sv->sv_maxtx;
 417         if (is->is_txmax > 0x8000)
 418                 is->is_txmax = 0x8000;
 419
 420         /*
 421          * Max read/write sizes, WITHOUT overhead.
 422          * This is just the payload size, so we must
 423          * leave room for the SMB headers, etc.
 424          * This is just the ct_txmax value, but
 425          * reduced and rounded down.  Tricky bit:
 426          *
 427          * Servers typically give us a value that's
 428          * some nice "round" number, i.e 0x4000 plus
 429          * some overhead, i.e. Win2k: 16644==0x4104
 430          * Subtract for the SMB header (32) and the
 431          * SMB command word and byte vectors (34?),
 432          * then round down to a 512 byte multiple.
 433          */
 434         len = is->is_txmax - 68;
 435         len &= 0xFE00;
 436         /* XXX: Not sure yet which of these to keep. */
 437         is->is_rwmax = len;
 438         is->is_rxmax = len;
 439         is->is_wxmax = len;
 440
 441         /*
 442          * Most of the "capability" bits we offer in session setup
 443          * are just copied from those offered by the server.
 444          */
 445         ctx->ct_clnt_caps = sv->sv_caps & smb_clnt_caps_mask;
 446
 447         /* Get the client nonce. */
 448         (void) smb_get_urandom(ctx->ct_clnonce, NTLM_CHAL_SZ);
 449
 450         return (0);
 451
 452 errout:
 453         smb_rq_done(rqp);
 454         if (err == 0)
 455                 err = EBADRPC;
 456         return (err);
 457 }