1 /* 2 * This file and its contents are supplied under the terms of the 3 * Common Development and Distribution License ("CDDL"), version 1.0. 4 * You may only use this file in accordance with the terms of version 5 * 1.0 of the CDDL. 6 * 7 * A full copy of the text of the CDDL should have accompanied this 8 * source. A copy of the CDDL is also available via the Internet at 9 * http://www.illumos.org/license/CDDL. 10 */ 11 12 /* 13 * Copyright 2017 Nexenta Systems, Inc. All rights reserved. 14 */ 15 16 /* 17 * Dispatch function for SMB2_NEGOTIATE 18 */ 19 20 #include <smbsrv/smb2_kproto.h> 21 #include <smbsrv/smb2.h> 22 23 static int smb2_negotiate_common(smb_request_t *, uint16_t); 24 25 uint32_t smb2srv_capabilities = 26 SMB2_CAP_DFS | 27 SMB2_CAP_LARGE_MTU; 28 29 /* 30 * These are not intended as customer tunables, but dev. & test folks 31 * might want to adjust them (with caution). 32 * 33 * smb2_tcp_bufsize is the TCP buffer size, applied to the network socket 34 * with setsockopt SO_SNDBUF, SO_RCVBUF. These set the TCP window size. 35 * This is also used as a "sanity limit" for internal send/reply message 36 * allocations. Note that with compounding SMB2 messages may contain 37 * multiple requests/responses. This size should be large enough for 38 * at least a few SMB2 requests, and at least 2X smb2_max_rwsize. 39 * 40 * smb2_max_rwsize is what we put in the SMB2 negotiate response to tell 41 * the client the largest read and write request size we'll support. 42 * For now, we're using contiguous allocations, so keep this at 64KB 43 * so that (even with message overhead) allocations stay below 128KB, 44 * avoiding kmem_alloc -> page_create_va thrashing. 45 * 46 * smb2_max_trans is the largest "transact" send or receive, which is 47 * used for directory listings and info set/get operations. 48 */ 49 uint32_t smb2_tcp_bufsize = (1<<22); /* 4MB */ 50 uint32_t smb2_max_rwsize = (1<<16); /* 64KB */ 51 uint32_t smb2_max_trans = (1<<16); /* 64KB */ 52 53 /* 54 * With clients (e.g. HP scanners) that don't advertise SMB2_CAP_LARGE_MTU 55 * (including all clients using dialect < SMB 2.1), use a "conservative" value 56 * for max r/w size because some older clients misbehave with larger values. 57 * 64KB is recommended in the [MS-SMB2] spec. (3.3.5.3.1 SMB 2.1 or SMB 3.x 58 * Support) as the minimum so we'll use that. 59 */ 60 uint32_t smb2_old_rwsize = (1<<16); /* 64KB */ 61 62 /* 63 * List of all SMB2 versions we implement. Note that the 64 * highest version we support may be limited by the 65 * _cfg.skc_max_protocol setting. 66 */ 67 static uint16_t smb2_versions[] = { 68 0x202, /* SMB 2.002 */ 69 0x210, /* SMB 2.1 */ 70 0x300, /* SMB 3.0 */ 71 }; 72 static uint16_t smb2_nversions = 73 sizeof (smb2_versions) / sizeof (smb2_versions[0]); 74 75 static boolean_t 76 smb2_supported_version(smb_session_t *s, uint16_t version) 77 { 78 int i; 79 80 if (version > s->s_cfg.skc_max_protocol) 81 return (B_FALSE); 82 for (i = 0; i < smb2_nversions; i++) 83 if (version == smb2_versions[i]) 84 return (B_TRUE); 85 return (B_FALSE); 86 } 87 88 /* 89 * Helper for the (SMB1) smb_com_negotiate(). This is the 90 * very unusual protocol interaction where an SMB1 negotiate 91 * gets an SMB2 negotiate response. This is the normal way 92 * clients first find out if the server supports SMB2. 93 * 94 * Note: This sends an SMB2 reply _itself_ and then returns 95 * SDRC_NO_REPLY so the caller will not send an SMB1 reply. 96 * Also, this is called directly from the reader thread, so 97 * we know this is the only thread using this session. 98 * 99 * The caller frees this request. 100 */ 101 smb_sdrc_t 102 smb1_negotiate_smb2(smb_request_t *sr) 103 { 104 smb_session_t *s = sr->session; 105 smb_arg_negotiate_t *negprot = sr->sr_negprot; 106 uint16_t smb2_version; 107 uint16_t secmode2; 108 int rc; 109 110 /* 111 * Note: In the SMB1 negotiate command handler, we 112 * agreed with one of the SMB2 dialects. If that 113 * dialect was "SMB 2.002", we'll respond here with 114 * version 0x202 and negotiation is done. If that 115 * dialect was "SMB 2.???", we'll respond here with 116 * the "wildcard" version 0x2FF, and the client will 117 * come back with an SMB2 negotiate. 118 */ 119 switch (negprot->ni_dialect) { 120 case DIALECT_SMB2002: /* SMB 2.002 (a.k.a. SMB2.0) */ 121 smb2_version = 0x202; 122 s->dialect = smb2_version; 123 s->s_state = SMB_SESSION_STATE_NEGOTIATED; 124 /* Allow normal SMB2 requests now. */ 125 s->newrq_func = smb2sr_newrq; 126 127 /* 128 * Translate SMB1 sec. mode to SMB2. 129 */ 130 secmode2 = 0; 131 if (s->secmode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) 132 secmode2 |= SMB2_NEGOTIATE_SIGNING_ENABLED; 133 if (s->secmode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) 134 secmode2 |= SMB2_NEGOTIATE_SIGNING_REQUIRED; 135 s->secmode = secmode2; 136 break; 137 case DIALECT_SMB2XXX: /* SMB 2.??? (wildcard vers) */ 138 /* 139 * Expecting an SMB2 negotiate next, so keep the 140 * initial s->newrq_func. Note that secmode is 141 * fiction good enough to pass the signing check 142 * in smb2_negotiate_common(). We'll check the 143 * real secmode when the 2nd negotiate comes. 144 */ 145 smb2_version = 0x2FF; 146 s->secmode = SMB2_NEGOTIATE_SIGNING_ENABLED; 147 break; 148 default: 149 return (SDRC_DROP_VC); 150 } 151 152 /* 153 * We did not decode an SMB2 header, so make sure 154 * the SMB2 header fields are initialized. 155 * (Most are zero from smb_request_alloc.) 156 * Also, the SMB1 common dispatch code reserved space 157 * for an SMB1 header, which we need to undo here. 158 */ 159 sr->smb2_reply_hdr = sr->reply.chain_offset = 0; 160 sr->smb2_cmd_code = SMB2_NEGOTIATE; 161 162 rc = smb2_negotiate_common(sr, smb2_version); 163 smb2_send_reply(sr); 164 if (rc != 0) 165 return (SDRC_DROP_VC); 166 167 /* 168 * We sent the reply, so tell the SMB1 dispatch 169 * it should NOT (also) send a reply. 170 */ 171 return (SDRC_NO_REPLY); 172 } 173 174 /* 175 * SMB2 Negotiate gets special handling. This is called directly by 176 * the reader thread (see smbsr_newrq_initial) with what _should_ be 177 * an SMB2 Negotiate. Only the "\feSMB" header has been checked 178 * when this is called, so this needs to check the SMB command, 179 * if it's Negotiate execute it, then send the reply, etc. 180 * 181 * Since this is called directly from the reader thread, we 182 * know this is the only thread currently using this session. 183 * This has to duplicate some of what smb2sr_work does as a 184 * result of bypassing the normal dispatch mechanism. 185 * 186 * The caller always frees this request. 187 * 188 * Return value is 0 for success, and anything else will 189 * terminate the reader thread (drop the connection). 190 */ 191 int 192 smb2_newrq_negotiate(smb_request_t *sr) 193 { 194 smb_session_t *s = sr->session; 195 int i, rc; 196 uint16_t struct_size; 197 uint16_t best_version; 198 uint16_t version_cnt; 199 uint16_t cl_versions[8]; 200 201 sr->smb2_cmd_hdr = sr->command.chain_offset; 202 rc = smb2_decode_header(sr); 203 if (rc != 0) 204 return (rc); 205 206 if ((sr->smb2_cmd_code != SMB2_NEGOTIATE) || 207 (sr->smb2_next_command != 0)) 208 return (-1); 209 210 /* 211 * Decode SMB2 Negotiate (fixed-size part) 212 */ 213 rc = smb_mbc_decodef( 214 &sr->command, "www..l16.8.", 215 &struct_size, /* w */ 216 &version_cnt, /* w */ 217 &s->secmode, /* w */ 218 /* reserved (..) */ 219 &s->capabilities); /* l */ 220 /* clnt_uuid 16. */ 221 /* start_time 8. */ 222 if (rc != 0) 223 return (rc); 224 if (struct_size != 36 || version_cnt > 8) 225 return (-1); 226 227 /* 228 * Decode SMB2 Negotiate (variable part) 229 */ 230 rc = smb_mbc_decodef(&sr->command, 231 "#w", version_cnt, cl_versions); 232 if (rc != 0) 233 return (rc); 234 235 DTRACE_SMB2_START(op__Negotiate, smb_request_t *, sr); 236 237 /* 238 * The client offers an array of protocol versions it 239 * supports, which we have decoded into cl_versions[]. 240 * We walk the array and pick the highest supported. 241 */ 242 best_version = 0; 243 for (i = 0; i < version_cnt; i++) 244 if (smb2_supported_version(s, cl_versions[i]) && 245 best_version < cl_versions[i]) 246 best_version = cl_versions[i]; 247 if (best_version == 0) 248 return (SDRC_DROP_VC); 249 s->dialect = best_version; 250 251 /* Allow normal SMB2 requests now. */ 252 s->s_state = SMB_SESSION_STATE_NEGOTIATED; 253 s->newrq_func = smb2sr_newrq; 254 255 rc = smb2_negotiate_common(sr, best_version); 256 257 /* sr->smb2_status was set */ 258 DTRACE_SMB2_DONE(op__Negotiate, smb_request_t *, sr); 259 260 smb2_send_reply(sr); 261 262 return (rc); 263 } 264 265 /* 266 * Common parts of SMB2 Negotiate, used for both the 267 * SMB1-to-SMB2 style, and straight SMB2 style. 268 * Do negotiation decisions and encode the reply. 269 * The caller does the network send. 270 * 271 * Return value is 0 for success, and anything else will 272 * terminate the reader thread (drop the connection). 273 */ 274 static int 275 smb2_negotiate_common(smb_request_t *sr, uint16_t version) 276 { 277 timestruc_t boot_tv, now_tv; 278 smb_session_t *s = sr->session; 279 int rc; 280 uint32_t max_rwsize; 281 uint16_t secmode; 282 283 sr->smb2_status = 0; 284 285 /* 286 * Negotiation itself. First the Security Mode. 287 * The caller stashed the client's secmode in s->secmode, 288 * which we validate, and then replace with the server's 289 * secmode, which is all we care about after this. 290 */ 291 secmode = SMB2_NEGOTIATE_SIGNING_ENABLED; 292 if (sr->sr_cfg->skc_signing_required) { 293 secmode |= SMB2_NEGOTIATE_SIGNING_REQUIRED; 294 /* Make sure client at least enables signing. */ 295 if ((s->secmode & secmode) == 0) { 296 sr->smb2_status = NT_STATUS_INVALID_PARAMETER; 297 } 298 } 299 s->secmode = secmode; 300 301 s->cmd_max_bytes = smb2_tcp_bufsize; 302 s->reply_max_bytes = smb2_tcp_bufsize; 303 304 /* 305 * "The number of credits held by the client MUST be considered 306 * as 1 when the connection is established." [MS-SMB2] 307 * We leave credits at 1 until the first successful 308 * session setup is completed. 309 */ 310 s->s_cur_credits = s->s_max_credits = 1; 311 sr->smb2_credit_response = 1; 312 313 boot_tv.tv_sec = smb_get_boottime(); 314 boot_tv.tv_nsec = 0; 315 now_tv.tv_sec = gethrestime_sec(); 316 now_tv.tv_nsec = 0; 317 318 /* 319 * SMB2 negotiate reply 320 */ 321 sr->smb2_hdr_flags = SMB2_FLAGS_SERVER_TO_REDIR; 322 (void) smb2_encode_header(sr, B_FALSE); 323 if (sr->smb2_status != 0) { 324 smb2sr_put_error(sr, sr->smb2_status); 325 /* smb2_send_reply(sr); in caller */ 326 return (-1); /* will drop */ 327 } 328 329 /* 330 * If the version is 0x2FF, we haven't completed negotiate. 331 * Don't initialize until we have our final request. 332 */ 333 if (version != 0x2FF) 334 smb2_sign_init_mech(s); 335 336 /* 337 * See notes above smb2_max_rwsize, smb2_old_rwsize 338 */ 339 if (s->capabilities & SMB2_CAP_LARGE_MTU) 340 max_rwsize = smb2_max_rwsize; 341 else 342 max_rwsize = smb2_old_rwsize; 343 344 rc = smb_mbc_encodef( 345 &sr->reply, 346 "wwww#cllllTTwwl#c", 347 65, /* StructSize */ /* w */ 348 s->secmode, /* w */ 349 version, /* w */ 350 0, /* reserved */ /* w */ 351 UUID_LEN, /* # */ 352 &s->s_cfg.skc_machine_uuid, /* c */ 353 smb2srv_capabilities, /* l */ 354 smb2_max_trans, /* l */ 355 max_rwsize, /* l */ 356 max_rwsize, /* l */ 357 &now_tv, /* T */ 358 &boot_tv, /* T */ 359 128, /* SecBufOff */ /* w */ 360 sr->sr_cfg->skc_negtok_len, /* w */ 361 0, /* reserved */ /* l */ 362 sr->sr_cfg->skc_negtok_len, /* # */ 363 sr->sr_cfg->skc_negtok); /* c */ 364 365 /* smb2_send_reply(sr); in caller */ 366 367 (void) ksocket_setsockopt(s->sock, SOL_SOCKET, 368 SO_SNDBUF, (const void *)&smb2_tcp_bufsize, 369 sizeof (smb2_tcp_bufsize), CRED()); 370 (void) ksocket_setsockopt(s->sock, SOL_SOCKET, 371 SO_RCVBUF, (const void *)&smb2_tcp_bufsize, 372 sizeof (smb2_tcp_bufsize), CRED()); 373 374 return (rc); 375 } 376 377 /* 378 * SMB2 Dispatch table handler, which will run if we see an 379 * SMB2_NEGOTIATE after the initial negotiation is done. 380 * That would be a protocol error. 381 */ 382 smb_sdrc_t 383 smb2_negotiate(smb_request_t *sr) 384 { 385 sr->smb2_status = NT_STATUS_INVALID_PARAMETER; 386 return (SDRC_ERROR); 387 } 388 389 /* 390 * VALIDATE_NEGOTIATE_INFO [MS-SMB2] 2.2.32.6 391 */ 392 uint32_t 393 smb2_fsctl_vneginfo(smb_request_t *sr, smb_fsctl_t *fsctl) 394 { 395 smb_session_t *s = sr->session; 396 int rc; 397 398 /* 399 * The spec. says to parse the VALIDATE_NEGOTIATE_INFO here 400 * and verify that the original negotiate was not modified. 401 * The only tampering we need worry about is secmode, and 402 * we're not taking that from the client, so don't bother. 403 * 404 * One interesting requirement here is that we MUST reply 405 * with exactly the same information as we returned in our 406 * original reply to the SMB2 negotiate on this session. 407 * If we don't the client closes the connection. 408 */ 409 410 rc = smb_mbc_encodef( 411 fsctl->out_mbc, "l#cww", 412 smb2srv_capabilities, /* l */ 413 UUID_LEN, /* # */ 414 &s->s_cfg.skc_machine_uuid, /* c */ 415 s->secmode, /* w */ 416 s->dialect); /* w */ 417 if (rc) 418 return (NT_STATUS_INTERNAL_ERROR); 419 420 return (0); 421 } 422