libsmbfs/common/smbfs_negprot.c

/*
 * Copyright (c) 2000-2001 Boris Popov
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    This product includes software developed by Boris Popov.
 * 4. Neither the name of the author nor the names of any co-contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

/*
 * Copyright (c) 2009, 2012, Oracle and/or its affiliates. All rights reserved.
 */

/*
 * SMB Negotiate Protocol, and related.
 * Copied from the driver: smb_smb.c
 */

#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <strings.h>
#include <netdb.h>
#include <libintl.h>
#include <xti.h>
#include <assert.h>

#include <sys/types.h>
#include <sys/time.h>
#include <sys/byteorder.h>
#include <sys/socket.h>
#include <sys/fcntl.h>

#include <netinet/in.h>
#include <netinet/tcp.h>
#include <arpa/inet.h>

#include <smb/smb.h>
#include "smbfs_lib.h"
#include <netsmb/netbios.h>
#include "smbfs_nb_lib.h"
#include <netsmb/smb_dev.h>

#include "smbfs_charsets.h"
#include "smbfs_private.h"

/*
 * SMB dialects that we know about.
 */
struct smb_dialect {
    int     d_id;
    const char  *d_name;
};
static struct smb_dialect smb_dialects[] = {
    {PC_NETWORK_PROGRAM_1_0,    "PC NETWORK PROGRAM 1.0"},
    {LANMAN1_0,         "LANMAN1.0"},
    {LANMAN2_0,         "LM1.2X002"},
    {LANMAN2_1,         "LANMAN2.1"},
    {NTLM_0_12,         "NT LM 0.12"},
    {-1,                NULL}
};

#define SMB_DIALECT_MAX \
    (sizeof (smb_dialects) / sizeof (struct smb_dialect) - 2)

/*
 * SMB Negotiate Protocol
 * Based on code from the driver: smb_smb.c
 *
 * If using Extended Security, oblob (output)
 * will hold the initial security "hint".
 */
int
smbfs_negprot(struct smb_ctx *ctx, struct mbdata *oblob)
{
    struct smb_sopt *sv = &ctx->ct_sopt;
    struct smb_iods *is = &ctx->ct_iods;
    struct smb_rq   *rqp;
    struct mbdata   *mbp;
    struct smb_dialect *dp;
    int err, len;
    uint8_t wc, eklen;
    uint16_t dindex, bc;

    /*
     * Initialize: vc_hflags and vc_hflags2.
     * Note: ctx->ct_hflags* are copied into the
     * (per request) rqp->rq_hflags* by smbfs_rq_init.
     *
     * Like Windows, set FLAGS2_UNICODE in our first request,
     * even though technically we don't yet know whether the
     * server supports Unicode.  Will clear this flag below
     * if we find out it doesn't.  Need to do this because
     * some servers reject all non-Unicode requests.
     */
    ctx->ct_hflags = SMB_FLAGS_CASE_INSENSITIVE;
    ctx->ct_hflags2 = SMB_FLAGS2_KNOWS_LONG_NAMES |
        SMB_FLAGS2_NT_STATUS | SMB_FLAGS2_UNICODE;

    /*
     * Sould we offer extended security?
     * We'll turn this back off below if
     * the server doesn't support it.
     */
    if (ctx->ct_vopt & SMBVOPT_EXT_SEC)
        ctx->ct_hflags2 |= SMB_FLAGS2_EXT_SEC;

    /*
     * The initial UID needs to be zero,
     * or Windows XP says "bad user".
     * The initial TID is all ones, but
     * we don't use it or store it here
     * because the driver handles that.
     */
    is->is_smbuid = 0;

    /*
     * In case we're reconnecting,
     * free previous stuff.
     */
    ctx->ct_mac_seqno = 0;
    if (ctx->ct_mackey != NULL) {
        free(ctx->ct_mackey);
        ctx->ct_mackey = NULL;
        ctx->ct_mackeylen = 0;
    }

    sv = &ctx->ct_sopt;
    bzero(sv, sizeof (struct smb_sopt));

    err = smbfs_rq_init(ctx, SMB_COM_NEGOTIATE, &rqp);
    if (err)
        return (err);

    /*
     * Build the SMB request.
     */
    mbp = &rqp->rq_rq;
    smbfs_mb_put_uint8(mbp, 0);         /* word count */
    smbfs_rq_bstart(rqp);
    for (dp = smb_dialects; dp->d_id != -1; dp++) {
        smbfs_mb_put_uint8(mbp, SMB_FMT_DIALECT);
        smbfs_mb_put_astring(mbp, dp->d_name);
    }
    smbfs_rq_bend(rqp);

    /*
     * This does the OTW call
     */
    err = smbfs_rq_internal(ctx, rqp);
    if (err) {
        DPRINT("call failed, err %d", err);
        goto errout;
    }
    if (rqp->rq_status != 0) {
        DPRINT("nt status 0x%x", rqp->rq_status);
        err = EBADRPC;
        goto errout;
    }

    /*
     * Decode the response
     *
     * Comments to right show names as described in
     * The Microsoft SMB Protocol spec. [MS-SMB]
     * section 2.2.3
     */
    mbp = &rqp->rq_rp;
    (void) smbfs_md_get_uint8(mbp, &wc);
    err = smbfs_md_get_uint16le(mbp, &dindex);
    if (err || dindex > SMB_DIALECT_MAX) {
        DPRINT("err %d dindex %d", err, (int)dindex);
        goto errout;
    }
    dp = smb_dialects + dindex;
    sv->sv_proto = dp->d_id;
    DPRINT("Dialect %s", dp->d_name);
    if (dp->d_id < NTLM_0_12) {
        /* XXX: User-visible warning too? */
        DPRINT("old dialect %s", dp->d_name);
        goto errout;
    }
    if (wc != 17) {
        DPRINT("bad wc %d", (int)wc);
        goto errout;
    }
    smbfs_md_get_uint8(mbp, &sv->sv_sm);        /* SecurityMode */
    smbfs_md_get_uint16le(mbp, &sv->sv_maxmux); /* MaxMpxCount */
    smbfs_md_get_uint16le(mbp, &sv->sv_maxvcs); /* MaxCountVCs */
    smbfs_md_get_uint32le(mbp, &sv->sv_maxtx);  /* MaxBufferSize */
    smbfs_md_get_uint32le(mbp, &sv->sv_maxraw); /* MaxRawSize */
    smbfs_md_get_uint32le(mbp, &sv->sv_skey);   /* SessionKey */
    smbfs_md_get_uint32le(mbp, &sv->sv_caps);   /* Capabilities */
    smbfs_md_get_mem(mbp, NULL, 8, MB_MSYSTEM); /* SystemTime(s) */
    smbfs_md_get_uint16le(mbp, (uint16_t *)&sv->sv_tz);
    smbfs_md_get_uint8(mbp, &eklen);        /* EncryptionKeyLen */
    err = smbfs_md_get_uint16le(mbp, &bc);  /* ByteCount */
    if (err)
        goto errout;

    /*
     * Signing rules:
     * - If the server REQUIRES signing smb client will sign.
     * - If the client REQUIRES signing smb client will sign.
     * - If the server doesn't REQUIRE signing and client_signing_required
     *   is FALSE, smb client will not sign.
     */

    if (sv->sv_sm & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED)
        ctx->ct_vcflags |= SMBV_WILL_SIGN;
    else if (ctx->ct_vopt & SMBVOPT_SIGNING_REQUIRED)
        ctx->ct_vcflags |= SMBV_WILL_SIGN;

    DPRINT("Security signatures: %d\n",
        ctx->ct_vcflags & SMBV_WILL_SIGN ? 1 : 0);

    /* See comment above re. FLAGS2_UNICODE */
    if (sv->sv_caps & CAP_UNICODE)
        ctx->ct_vcflags |= SMBV_UNICODE;
    else
        ctx->ct_hflags2 &= ~SMB_FLAGS2_UNICODE;

    if ((sv->sv_caps & CAP_STATUS32) == 0) {
        /*
         * They don't do NT error codes.
         *
         * If we send requests with
         * SMB_FLAGS2_NT_STATUS set in
         * Flags2, Windows 98, at least,
         * appears to send replies with that
         * bit set even though it sends back
         * DOS error codes.  (They probably
         * just use the request header as
         * a template for the reply header,
         * and don't bother clearing that bit.)
         *
         * Therefore, we clear that bit in
         * our vc_hflags2 field.
         */
        ctx->ct_hflags2 &= ~SMB_FLAGS2_NT_STATUS;
    }
    if (dp->d_id == NTLM_0_12 &&
        sv->sv_maxtx < 4096 &&
        (sv->sv_caps & CAP_NT_SMBS) == 0) {
        ctx->ct_vcflags |= SMBV_WIN95;
        DPRINT("Win95 detected");
    }

    /*
     * The rest of the message varies depending on
     * whether we've negotiated "extended security".
     *
     * With extended security, we have:
     *  Server_GUID (length 16)
     *  Security_BLOB
     * Otherwise we have:
     *  EncryptionKey (length is eklen)
     *  PrimaryDomain
     */
    if (sv->sv_caps & CAP_EXTENDED_SECURITY) {
        struct mbuf *m;
        DPRINT("Ext.Security: yes");

        /*
         * Skip the server GUID.
         */
        err = smbfs_md_get_mem(mbp, NULL, SMB_GUID_LEN, MB_MSYSTEM);
        if (err)
            goto errout;
        /*
         * Remainder is the security blob.
         * Note: eklen "must be ignored" [MS-SMB]
         */
        len = (int)bc - SMB_GUID_LEN;
        if (len < 0)
            goto errout;

        /*
         * Get the (optional) SPNEGO "hint".
         */
        err = smbfs_md_get_mbuf(mbp, len, &m);
        if (err)
            goto errout;
        smbfs_mb_initm(oblob, m);
        oblob->mb_count = len;
    } else {
        DPRINT("Ext.Security: no");
        ctx->ct_hflags2 &= ~SMB_FLAGS2_EXT_SEC;

        /*
         * Save the "Encryption Key" (the challenge).
         *
         * Sanity check: make sure the sec. blob length
         * isn't bigger than the byte count.
         */
        if (bc < eklen || eklen < NTLM_CHAL_SZ) {
            err = EBADRPC;
            goto errout;
        }
        err = smbfs_md_get_mem(mbp, ctx->ct_ntlm_chal,
            NTLM_CHAL_SZ, MB_MSYSTEM);
        /*
         * Server domain follows (ignored)
         * Note: NOT aligned(2) - unusual!
         */
    }

    smbfs_rq_done(rqp);

    /*
     * A few sanity checks on what we received,
     * becuse we will send these in ssnsetup.
     *
     * Maximum outstanding requests (we care),
     * and Max. VCs (we only use one).  Also,
     * MaxBufferSize lower limit per spec.
     */
    if (sv->sv_maxmux < 1)
        sv->sv_maxmux = 1;
    if (sv->sv_maxvcs < 1)
        sv->sv_maxvcs = 1;
    if (sv->sv_maxtx < 1024)
        sv->sv_maxtx = 1024;

    /*
     * Maximum transfer size.
     * Sanity checks:
     *
     * Let's be conservative about an upper limit here.
     * Win2k uses 16644 (and others) so 32k should be a
     * reasonable sanity limit for this value.
     *
     * Note that this limit does NOT affect READX/WRITEX
     * with CAP_LARGE_..., which we nearly always use.
     */
    is->is_txmax = sv->sv_maxtx;
    if (is->is_txmax > 0x8000)
        is->is_txmax = 0x8000;

    /*
     * Max read/write sizes, WITHOUT overhead.
     * This is just the payload size, so we must
     * leave room for the SMB headers, etc.
     * This is just the ct_txmax value, but
     * reduced and rounded down.  Tricky bit:
     *
     * Servers typically give us a value that's
     * some nice "round" number, i.e 0x4000 plus
     * some overhead, i.e. Win2k: 16644==0x4104
     * Subtract for the SMB header (32) and the
     * SMB command word and byte vectors (34?),
     * then round down to a 512 byte multiple.
     */
    len = is->is_txmax - 68;
    len &= 0xFE00;
    /* XXX: Not sure yet which of these to keep. */
    is->is_rwmax = len;
    is->is_rxmax = len;
    is->is_wxmax = len;

    return (0);

errout:
    smbfs_rq_done(rqp);
    if (err == 0)
        err = EBADRPC;
    return (err);
}