2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "smbd/smbd.h"
23 #include "smbd/globals.h"
24 #include "../libcli/smb/smb_common.h"
25 #include "../libcli/smb/smb2_negotiate_context.h"
26 #include "../lib/tsocket/tsocket.h"
27 #include "../librpc/ndr/libndr.h"
29 extern fstring remote_proto;
32 * this is the entry point if SMB2 is selected via
33 * the SMB negprot and the given dialect.
35 static void reply_smb20xx(struct smb_request *req, uint16_t dialect)
41 size_t len = SMB2_HDR_BODY + 0x24 + 2;
43 smb2_inpdu = talloc_zero_array(talloc_tos(), uint8_t, len);
44 if (smb2_inpdu == NULL) {
45 DEBUG(0, ("Could not push spnego blob\n"));
46 reply_nterror(req, NT_STATUS_NO_MEMORY);
49 smb2_hdr = smb2_inpdu;
50 smb2_body = smb2_hdr + SMB2_HDR_BODY;
51 smb2_dyn = smb2_body + 0x24;
53 SIVAL(smb2_hdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
54 SIVAL(smb2_hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
56 SSVAL(smb2_body, 0x00, 0x0024); /* struct size */
57 SSVAL(smb2_body, 0x02, 0x0001); /* dialect count */
59 SSVAL(smb2_dyn, 0x00, dialect);
63 smbd_smb2_first_negprot(req->xconn, smb2_inpdu, len);
68 * this is the entry point if SMB2 is selected via
69 * the SMB negprot and the "SMB 2.002" dialect.
71 void reply_smb2002(struct smb_request *req, uint16_t choice)
73 reply_smb20xx(req, SMB2_DIALECT_REVISION_202);
77 * this is the entry point if SMB2 is selected via
78 * the SMB negprot and the "SMB 2.???" dialect.
80 void reply_smb20ff(struct smb_request *req, uint16_t choice)
82 struct smbXsrv_connection *xconn = req->xconn;
83 xconn->smb2.allow_2ff = true;
84 reply_smb20xx(req, SMB2_DIALECT_REVISION_2FF);
87 enum protocol_types smbd_smb2_protocol_dialect_match(const uint8_t *indyn,
88 const int dialect_count,
92 enum protocol_types proto;
95 { PROTOCOL_SMB3_11, SMB3_DIALECT_REVISION_311 },
96 { PROTOCOL_SMB3_10, SMB3_DIALECT_REVISION_310 },
97 { PROTOCOL_SMB3_02, SMB3_DIALECT_REVISION_302 },
98 { PROTOCOL_SMB3_00, SMB3_DIALECT_REVISION_300 },
99 { PROTOCOL_SMB2_24, SMB2_DIALECT_REVISION_224 },
100 { PROTOCOL_SMB2_22, SMB2_DIALECT_REVISION_222 },
101 { PROTOCOL_SMB2_10, SMB2_DIALECT_REVISION_210 },
102 { PROTOCOL_SMB2_02, SMB2_DIALECT_REVISION_202 },
106 for (i = 0; i < ARRAY_SIZE(pd); i ++) {
109 if (lp_server_max_protocol() < pd[i].proto) {
112 if (lp_server_min_protocol() > pd[i].proto) {
116 for (c = 0; c < dialect_count; c++) {
117 *dialect = SVAL(indyn, c*2);
118 if (*dialect == pd[i].dialect) {
124 return PROTOCOL_NONE;
127 NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req)
129 struct smbXsrv_connection *xconn = req->xconn;
131 const uint8_t *inbody;
132 const uint8_t *indyn = NULL;
135 DATA_BLOB negprot_spnego_blob;
136 uint16_t security_offset;
137 DATA_BLOB security_buffer;
138 size_t expected_dyn_size = 0;
140 uint16_t security_mode;
141 uint16_t dialect_count;
142 uint16_t in_security_mode;
143 uint32_t in_capabilities;
144 DATA_BLOB in_guid_blob;
146 struct smb2_negotiate_contexts in_c = { .num_contexts = 0, };
147 struct smb2_negotiate_context *in_preauth = NULL;
148 struct smb2_negotiate_context *in_cipher = NULL;
149 struct smb2_negotiate_contexts out_c = { .num_contexts = 0, };
150 DATA_BLOB out_negotiate_context_blob = data_blob_null;
151 uint32_t out_negotiate_context_offset = 0;
152 uint16_t out_negotiate_context_count = 0;
153 uint16_t dialect = 0;
154 uint32_t capabilities;
155 DATA_BLOB out_guid_blob;
156 struct GUID out_guid;
157 enum protocol_types protocol = PROTOCOL_NONE;
159 uint32_t max_trans = lp_smb2_max_trans();
160 uint32_t max_read = lp_smb2_max_read();
161 uint32_t max_write = lp_smb2_max_write();
162 NTTIME now = timeval_to_nttime(&req->request_time);
164 status = smbd_smb2_request_verify_sizes(req, 0x24);
165 if (!NT_STATUS_IS_OK(status)) {
166 return smbd_smb2_request_error(req, status);
168 inbody = SMBD_SMB2_IN_BODY_PTR(req);
170 dialect_count = SVAL(inbody, 0x02);
172 in_security_mode = SVAL(inbody, 0x04);
173 in_capabilities = IVAL(inbody, 0x08);
174 in_guid_blob = data_blob_const(inbody + 0x0C, 16);
176 if (dialect_count == 0) {
177 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
180 status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
181 if (!NT_STATUS_IS_OK(status)) {
182 return smbd_smb2_request_error(req, status);
185 expected_dyn_size = dialect_count * 2;
186 if (SMBD_SMB2_IN_DYN_LEN(req) < expected_dyn_size) {
187 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
189 indyn = SMBD_SMB2_IN_DYN_PTR(req);
191 protocol = smbd_smb2_protocol_dialect_match(indyn,
195 for (c=0; protocol == PROTOCOL_NONE && c < dialect_count; c++) {
196 if (lp_server_max_protocol() < PROTOCOL_SMB2_10) {
200 dialect = SVAL(indyn, c*2);
201 if (dialect == SMB2_DIALECT_REVISION_2FF) {
202 if (xconn->smb2.allow_2ff) {
203 xconn->smb2.allow_2ff = false;
204 protocol = PROTOCOL_SMB2_10;
210 if (protocol == PROTOCOL_NONE) {
211 return smbd_smb2_request_error(req, NT_STATUS_NOT_SUPPORTED);
214 if (protocol >= PROTOCOL_SMB3_10) {
215 uint32_t in_negotiate_context_offset = 0;
216 uint16_t in_negotiate_context_count = 0;
217 DATA_BLOB in_negotiate_context_blob = data_blob_null;
220 in_negotiate_context_offset = IVAL(inbody, 0x1C);
221 in_negotiate_context_count = SVAL(inbody, 0x20);
224 ofs += SMBD_SMB2_IN_BODY_LEN(req);
225 ofs += expected_dyn_size;
226 if ((ofs % 8) != 0) {
227 ofs += 8 - (ofs % 8);
230 if (in_negotiate_context_offset != ofs) {
231 return smbd_smb2_request_error(req,
232 NT_STATUS_INVALID_PARAMETER);
235 ofs -= SMB2_HDR_BODY;
236 ofs -= SMBD_SMB2_IN_BODY_LEN(req);
238 if (SMBD_SMB2_IN_DYN_LEN(req) < ofs) {
239 return smbd_smb2_request_error(req,
240 NT_STATUS_INVALID_PARAMETER);
243 in_negotiate_context_blob = data_blob_const(indyn,
244 SMBD_SMB2_IN_DYN_LEN(req));
246 in_negotiate_context_blob.data += ofs;
247 in_negotiate_context_blob.length -= ofs;
249 status = smb2_negotiate_context_parse(req,
250 in_negotiate_context_blob, &in_c);
251 if (!NT_STATUS_IS_OK(status)) {
252 return smbd_smb2_request_error(req, status);
255 if (in_negotiate_context_count != in_c.num_contexts) {
256 return smbd_smb2_request_error(req,
257 NT_STATUS_INVALID_PARAMETER);
261 if (get_remote_arch() != RA_SAMBA) {
262 set_remote_arch(RA_VISTA);
265 fstr_sprintf(remote_proto, "SMB%X_%02X",
266 (dialect >> 8) & 0xFF, dialect & 0xFF);
268 reload_services(req->sconn, conn_snum_used, true);
269 DEBUG(3,("Selected protocol %s\n", remote_proto));
271 in_preauth = smb2_negotiate_context_find(&in_c,
272 SMB2_PREAUTH_INTEGRITY_CAPABILITIES);
273 if (protocol >= PROTOCOL_SMB3_10 && in_preauth == NULL) {
274 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
276 in_cipher = smb2_negotiate_context_find(&in_c,
277 SMB2_ENCRYPTION_CAPABILITIES);
279 /* negprot_spnego() returns a the server guid in the first 16 bytes */
280 negprot_spnego_blob = negprot_spnego(req, xconn);
281 if (negprot_spnego_blob.data == NULL) {
282 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
285 if (negprot_spnego_blob.length < 16) {
286 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
289 security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
290 if (lp_server_signing() == SMB_SIGNING_REQUIRED) {
291 security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
295 if (lp_host_msdfs()) {
296 capabilities |= SMB2_CAP_DFS;
299 if (protocol >= PROTOCOL_SMB2_10 &&
301 lp_oplocks(GLOBAL_SECTION_SNUM) &&
302 !lp_kernel_oplocks(GLOBAL_SECTION_SNUM))
304 capabilities |= SMB2_CAP_LEASING;
307 if ((protocol >= PROTOCOL_SMB2_24) &&
308 (lp_smb_encrypt(-1) != SMB_SIGNING_OFF) &&
309 (in_capabilities & SMB2_CAP_ENCRYPTION)) {
310 capabilities |= SMB2_CAP_ENCRYPTION;
314 * 0x10000 (65536) is the maximum allowed message size
319 if (protocol >= PROTOCOL_SMB2_10) {
322 if (tsocket_address_is_inet(req->sconn->local_address, "ip")) {
323 p = tsocket_address_inet_port(req->sconn->local_address);
326 /* largeMTU is not supported over NBT (tcp port 139) */
327 if (p != NBT_SMB_PORT) {
328 capabilities |= SMB2_CAP_LARGE_MTU;
329 xconn->smb2.credits.multicredit = true;
332 * We allow up to almost 16MB.
334 * The maximum PDU size is 0xFFFFFF (16776960)
335 * and we need some space for the header.
337 max_limit = 0xFFFF00;
342 * the defaults are 8MB, but we'll limit this to max_limit based on
343 * the dialect (64kb for SMB 2.0, 8MB for SMB >= 2.1 with LargeMTU)
345 * user configured values exceeding the limits will be overwritten,
346 * only smaller values will be accepted
349 max_trans = MIN(max_limit, lp_smb2_max_trans());
350 max_read = MIN(max_limit, lp_smb2_max_read());
351 max_write = MIN(max_limit, lp_smb2_max_write());
353 if (in_preauth != NULL) {
356 uint16_t salt_length;
357 uint16_t selected_preauth = 0;
363 if (in_preauth->data.length < needed) {
364 return smbd_smb2_request_error(req,
365 NT_STATUS_INVALID_PARAMETER);
368 hash_count = SVAL(in_preauth->data.data, 0);
369 salt_length = SVAL(in_preauth->data.data, 2);
371 if (hash_count == 0) {
372 return smbd_smb2_request_error(req,
373 NT_STATUS_INVALID_PARAMETER);
376 p = in_preauth->data.data + needed;
377 needed += hash_count * 2;
378 needed += salt_length;
380 if (in_preauth->data.length < needed) {
381 return smbd_smb2_request_error(req,
382 NT_STATUS_INVALID_PARAMETER);
385 for (i=0; i < hash_count; i++) {
391 if (v == SMB2_PREAUTH_INTEGRITY_SHA512) {
392 selected_preauth = v;
397 if (selected_preauth == 0) {
398 return smbd_smb2_request_error(req,
399 NT_STATUS_SMB_NO_PREAUTH_INTEGRITY_HASH_OVERLAP);
402 SSVAL(buf, 0, 1); /* HashAlgorithmCount */
403 SSVAL(buf, 2, 32); /* SaltLength */
404 SSVAL(buf, 4, selected_preauth);
405 generate_random_buffer(buf + 6, 32);
407 b = data_blob_const(buf, sizeof(buf));
408 status = smb2_negotiate_context_add(req, &out_c,
409 SMB2_PREAUTH_INTEGRITY_CAPABILITIES, b);
410 if (!NT_STATUS_IS_OK(status)) {
411 return smbd_smb2_request_error(req, status);
414 req->preauth = &req->xconn->smb2.preauth;
417 if (!(capabilities & SMB2_CAP_ENCRYPTION)) {
421 if (in_cipher != NULL) {
423 uint16_t cipher_count;
429 capabilities &= ~SMB2_CAP_ENCRYPTION;
431 if (in_cipher->data.length < needed) {
432 return smbd_smb2_request_error(req,
433 NT_STATUS_INVALID_PARAMETER);
436 cipher_count = SVAL(in_cipher->data.data, 0);
438 if (cipher_count == 0) {
439 return smbd_smb2_request_error(req,
440 NT_STATUS_INVALID_PARAMETER);
443 p = in_cipher->data.data + needed;
444 needed += cipher_count * 2;
446 if (in_cipher->data.length < needed) {
447 return smbd_smb2_request_error(req,
448 NT_STATUS_INVALID_PARAMETER);
451 for (i=0; i < cipher_count; i++) {
457 if (v == SMB2_ENCRYPTION_AES128_GCM) {
458 xconn->smb2.server.cipher = v;
461 if (v == SMB2_ENCRYPTION_AES128_CCM) {
462 xconn->smb2.server.cipher = v;
467 SSVAL(buf, 0, 1); /* ChiperCount */
468 SSVAL(buf, 2, xconn->smb2.server.cipher);
470 b = data_blob_const(buf, sizeof(buf));
471 status = smb2_negotiate_context_add(req, &out_c,
472 SMB2_ENCRYPTION_CAPABILITIES, b);
473 if (!NT_STATUS_IS_OK(status)) {
474 return smbd_smb2_request_error(req, status);
478 if (capabilities & SMB2_CAP_ENCRYPTION) {
479 xconn->smb2.server.cipher = SMB2_ENCRYPTION_AES128_CCM;
482 security_offset = SMB2_HDR_BODY + 0x40;
485 /* Try SPNEGO auth... */
486 security_buffer = data_blob_const(negprot_spnego_blob.data + 16,
487 negprot_spnego_blob.length - 16);
489 /* for now we want raw NTLMSSP */
490 security_buffer = data_blob_const(NULL, 0);
493 if (out_c.num_contexts != 0) {
494 status = smb2_negotiate_context_push(req,
495 &out_negotiate_context_blob,
497 if (!NT_STATUS_IS_OK(status)) {
498 return smbd_smb2_request_error(req, status);
502 if (out_negotiate_context_blob.length != 0) {
503 static const uint8_t zeros[8];
508 outdyn = data_blob_dup_talloc(req, security_buffer);
509 if (outdyn.length != security_buffer.length) {
510 return smbd_smb2_request_error(req,
511 NT_STATUS_NO_MEMORY);
514 ofs = security_offset + security_buffer.length;
515 if ((ofs % 8) != 0) {
520 ok = data_blob_append(req, &outdyn, zeros, pad);
522 return smbd_smb2_request_error(req,
523 NT_STATUS_NO_MEMORY);
526 ok = data_blob_append(req, &outdyn,
527 out_negotiate_context_blob.data,
528 out_negotiate_context_blob.length);
530 return smbd_smb2_request_error(req,
531 NT_STATUS_NO_MEMORY);
534 out_negotiate_context_offset = ofs;
535 out_negotiate_context_count = out_c.num_contexts;
537 outdyn = security_buffer;
540 out_guid_blob = data_blob_const(negprot_spnego_blob.data, 16);
541 status = GUID_from_ndr_blob(&out_guid_blob, &out_guid);
542 if (!NT_STATUS_IS_OK(status)) {
543 return smbd_smb2_request_error(req, status);
546 outbody = smbd_smb2_generate_outbody(req, 0x40);
547 if (outbody.data == NULL) {
548 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
551 SSVAL(outbody.data, 0x00, 0x40 + 1); /* struct size */
552 SSVAL(outbody.data, 0x02,
553 security_mode); /* security mode */
554 SSVAL(outbody.data, 0x04, dialect); /* dialect revision */
555 SSVAL(outbody.data, 0x06,
556 out_negotiate_context_count); /* reserved/NegotiateContextCount */
557 memcpy(outbody.data + 0x08,
558 out_guid_blob.data, 16); /* server guid */
559 SIVAL(outbody.data, 0x18,
560 capabilities); /* capabilities */
561 SIVAL(outbody.data, 0x1C, max_trans); /* max transact size */
562 SIVAL(outbody.data, 0x20, max_read); /* max read size */
563 SIVAL(outbody.data, 0x24, max_write); /* max write size */
564 SBVAL(outbody.data, 0x28, now); /* system time */
565 SBVAL(outbody.data, 0x30, 0); /* server start time */
566 SSVAL(outbody.data, 0x38,
567 security_offset); /* security buffer offset */
568 SSVAL(outbody.data, 0x3A,
569 security_buffer.length); /* security buffer length */
570 SIVAL(outbody.data, 0x3C,
571 out_negotiate_context_offset); /* reserved/NegotiateContextOffset */
573 req->sconn->using_smb2 = true;
575 if (dialect != SMB2_DIALECT_REVISION_2FF) {
576 status = smbXsrv_connection_init_tables(xconn, protocol);
577 if (!NT_STATUS_IS_OK(status)) {
578 return smbd_smb2_request_error(req, status);
581 xconn->smb2.client.capabilities = in_capabilities;
582 xconn->smb2.client.security_mode = in_security_mode;
583 xconn->smb2.client.guid = in_guid;
584 xconn->smb2.client.num_dialects = dialect_count;
585 xconn->smb2.client.dialects = talloc_array(xconn,
588 if (xconn->smb2.client.dialects == NULL) {
589 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
591 for (c=0; c < dialect_count; c++) {
592 xconn->smb2.client.dialects[c] = SVAL(indyn, c*2);
595 xconn->smb2.server.capabilities = capabilities;
596 xconn->smb2.server.security_mode = security_mode;
597 xconn->smb2.server.guid = out_guid;
598 xconn->smb2.server.dialect = dialect;
599 xconn->smb2.server.max_trans = max_trans;
600 xconn->smb2.server.max_read = max_read;
601 xconn->smb2.server.max_write = max_write;
604 return smbd_smb2_request_done(req, outbody, &outdyn);