613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Copyright (c) 2000-2001 Boris Popov
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * All rights reserved.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Redistribution and use in source and binary forms, with or without
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * modification, are permitted provided that the following conditions
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * 1. Redistributions of source code must retain the above copyright
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * notice, this list of conditions and the following disclaimer.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * 2. Redistributions in binary form must reproduce the above copyright
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * notice, this list of conditions and the following disclaimer in the
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * documentation and/or other materials provided with the distribution.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * 3. All advertising materials mentioning features or use of this software
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * must display the following acknowledgement:
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * This product includes software developed by Boris Popov.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * 4. Neither the name of the author nor the names of any co-contributors
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * may be used to endorse or promote products derived from this software
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * without specific prior written permission.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * SUCH DAMAGE.
ae3d7f90695ef456a6da4f7bdccd448ebe0b99e1Gordon Ross * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
85e6b6747d07050e01ec91acef2453655821f9abGordon Ross * Copyright 2013 Nexenta Systems, Inc. All rights reserved.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * SMB Negotiate Protocol, and related.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * SMB dialects that we know about.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross (sizeof (smb_dialects) / sizeof (struct smb_dialect) - 2)
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * SMB Negotiate Protocol
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Based on code from the driver: smb_smb.c
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * If using Extended Security, oblob (output)
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * will hold the initial security "hint".
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Rosssmb_negprot(struct smb_ctx *ctx, struct mbdata *oblob)
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Initialize: vc_hflags and vc_hflags2.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Note: ctx->ct_hflags* are copied into the
ae3d7f90695ef456a6da4f7bdccd448ebe0b99e1Gordon Ross * (per request) rqp->rq_hflags* by smb_rq_init.
ae3d7f90695ef456a6da4f7bdccd448ebe0b99e1Gordon Ross * Like Windows, set FLAGS2_UNICODE in our first request,
ae3d7f90695ef456a6da4f7bdccd448ebe0b99e1Gordon Ross * even though technically we don't yet know whether the
ae3d7f90695ef456a6da4f7bdccd448ebe0b99e1Gordon Ross * server supports Unicode. Will clear this flag below
ae3d7f90695ef456a6da4f7bdccd448ebe0b99e1Gordon Ross * if we find out it doesn't. Need to do this because
ae3d7f90695ef456a6da4f7bdccd448ebe0b99e1Gordon Ross * some servers reject all non-Unicode requests.
85e6b6747d07050e01ec91acef2453655821f9abGordon Ross /* SMB_FLAGS2_IS_LONG_NAME |? */
85e6b6747d07050e01ec91acef2453655821f9abGordon Ross /* EXT_SEC (see below) */
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Sould we offer extended security?
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * We'll turn this back off below if
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * the server doesn't support it.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * The initial UID needs to be zero,
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * or Windows XP says "bad user".
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * The initial TID is all ones, but
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * we don't use it or store it here
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * because the driver handles that.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * In case we're reconnecting,
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * free previous stuff.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross err = smb_rq_init(ctx, SMB_COM_NEGOTIATE, &rqp);
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Build the SMB request.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * This does the OTW call
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Decode the response
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Comments to right show names as described in
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * The Microsoft SMB Protocol spec. [MS-SMB]
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * section 2.2.3
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross /* XXX: User-visible warning too? */
02d09e03eb27f3a2dc299de704e45dae5173f43fGordon Ross md_get_uint8(mbp, &sv->sv_sm); /* SecurityMode */
02d09e03eb27f3a2dc299de704e45dae5173f43fGordon Ross md_get_uint16le(mbp, &sv->sv_maxmux); /* MaxMpxCount */
02d09e03eb27f3a2dc299de704e45dae5173f43fGordon Ross md_get_uint16le(mbp, &sv->sv_maxvcs); /* MaxCountVCs */
02d09e03eb27f3a2dc299de704e45dae5173f43fGordon Ross md_get_uint32le(mbp, &sv->sv_maxtx); /* MaxBufferSize */
02d09e03eb27f3a2dc299de704e45dae5173f43fGordon Ross md_get_uint32le(mbp, &sv->sv_maxraw); /* MaxRawSize */
02d09e03eb27f3a2dc299de704e45dae5173f43fGordon Ross md_get_uint32le(mbp, &sv->sv_skey); /* SessionKey */
02d09e03eb27f3a2dc299de704e45dae5173f43fGordon Ross md_get_uint32le(mbp, &sv->sv_caps); /* Capabilities */
02d09e03eb27f3a2dc299de704e45dae5173f43fGordon Ross md_get_mem(mbp, NULL, 8, MB_MSYSTEM); /* SystemTime(s) */
02d09e03eb27f3a2dc299de704e45dae5173f43fGordon Ross md_get_uint8(mbp, &eklen); /* EncryptionKeyLength */
02d09e03eb27f3a2dc299de704e45dae5173f43fGordon Ross err = md_get_uint16le(mbp, &bc); /* ByteCount */
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross /* BEGIN CSTYLED */
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Will we do SMB signing? Or block the connection?
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * The table below describes this logic. References:
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * [Windows Server Protocols: MS-SMB, sec. 3.2.4.2.3]
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * http://msdn.microsoft.com/en-us/library/cc212511.aspx
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * http://msdn.microsoft.com/en-us/library/cc212929.aspx
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Srv/Cli | Required | Enabled | If Required | Disabled
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * ------------+----------+------------+-------------+-----------
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Required | Signed | Signed | Signed | Blocked [1]
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * ------------+----------+------------+-------------+-----------
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Enabled | Signed | Signed | Not Signed | Not Signed
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * ------------+----------+------------+-------------+-----------
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * If Required | Signed | Not Signed | Not Signed | Not Signed
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * ------------+----------+------------+-------------+-----------
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Disabled | Blocked | Not Signed | Not Signed | Not Signed
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * [1] Like Windows 2003 and later, we don't really implement
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * the "Disabled" setting. Instead we implement "If Required",
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * so we always sign if the server requires signing.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross /* END CSTYLED */
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Server requires signing. We will sign,
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * even if local setting is "disabled".
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Server enables signing (client's option).
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * If enabled locally, do signing.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross /* else not signing. */
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Server does not support signing.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * If we "require" it, bail now.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross "but server has it disabled.");
ae3d7f90695ef456a6da4f7bdccd448ebe0b99e1Gordon Ross /* See comment above re. FLAGS2_UNICODE */
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * They don't do NT error codes.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * If we send requests with
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * SMB_FLAGS2_ERR_STATUS set in
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Flags2, Windows 98, at least,
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * appears to send replies with that
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * bit set even though it sends back
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * DOS error codes. (They probably
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * just use the request header as
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * a template for the reply header,
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * and don't bother clearing that bit.)
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Therefore, we clear that bit in
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * our vc_hflags2 field.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * The rest of the message varies depending on
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * whether we've negotiated "extended security".
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * With extended security, we have:
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Server_GUID (length 16)
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Security_BLOB
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Otherwise we have:
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * EncryptionKey (length is eklen)
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * PrimaryDomain
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Skip the server GUID.
02d09e03eb27f3a2dc299de704e45dae5173f43fGordon Ross err = md_get_mem(mbp, NULL, SMB_GUIDLEN, MB_MSYSTEM);
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Remainder is the security blob.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Note: eklen "must be ignored" [MS-SMB]
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Get the (optional) SPNEGO "hint".
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Save the "Encryption Key" (the challenge).
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Sanity check: make sure the sec. blob length
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * isn't bigger than the byte count.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Server domain follows (ignored)
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Note: NOT aligned(2) - unusual!
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * A few sanity checks on what we received,
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * becuse we will send these in ssnsetup.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Maximum outstanding requests (we care),
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * and Max. VCs (we only use one). Also,
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * MaxBufferSize lower limit per spec.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Maximum transfer size.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Sanity checks:
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Let's be conservative about an upper limit here.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Win2k uses 16644 (and others) so 32k should be a
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * reasonable sanity limit for this value.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Note that this limit does NOT affect READX/WRITEX
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * with CAP_LARGE_..., which we nearly always use.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Max read/write sizes, WITHOUT overhead.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * This is just the payload size, so we must
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * leave room for the SMB headers, etc.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * This is just the ct_txmax value, but
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * reduced and rounded down. Tricky bit:
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Servers typically give us a value that's
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * some nice "round" number, i.e 0x4000 plus
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * some overhead, i.e. Win2k: 16644==0x4104
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * Subtract for the SMB header (32) and the
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * SMB command word and byte vectors (34?),
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross * then round down to a 512 byte multiple.
613a2f6ba31e891e3d947a356daf5e563d43c1ceGordon Ross /* XXX: Not sure yet which of these to keep. */
85e6b6747d07050e01ec91acef2453655821f9abGordon Ross * Most of the "capability" bits we offer in session setup
85e6b6747d07050e01ec91acef2453655821f9abGordon Ross * are just copied from those offered by the server.
85e6b6747d07050e01ec91acef2453655821f9abGordon Ross ctx->ct_clnt_caps = sv->sv_caps & smb_clnt_caps_mask;
85e6b6747d07050e01ec91acef2453655821f9abGordon Ross /* Get the client nonce. */