2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "smbd/smbd.h"
23 #include "smbd/globals.h"
24 #include "../libcli/smb/smb_common.h"
25 #include "../libcli/smb/smb2_negotiate_context.h"
26 #include "../lib/tsocket/tsocket.h"
27 #include "../librpc/ndr/libndr.h"
29 extern fstring remote_proto;
32 * this is the entry point if SMB2 is selected via
33 * the SMB negprot and the given dialect.
35 static void reply_smb20xx(struct smb_request *req, uint16_t dialect)
41 size_t len = SMB2_HDR_BODY + 0x24 + 2;
43 smb2_inpdu = talloc_zero_array(talloc_tos(), uint8_t, len);
44 if (smb2_inpdu == NULL) {
45 DEBUG(0, ("Could not push spnego blob\n"));
46 reply_nterror(req, NT_STATUS_NO_MEMORY);
49 smb2_hdr = smb2_inpdu;
50 smb2_body = smb2_hdr + SMB2_HDR_BODY;
51 smb2_dyn = smb2_body + 0x24;
53 SIVAL(smb2_hdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
54 SIVAL(smb2_hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
56 SSVAL(smb2_body, 0x00, 0x0024); /* struct size */
57 SSVAL(smb2_body, 0x02, 0x0001); /* dialect count */
59 SSVAL(smb2_dyn, 0x00, dialect);
63 smbd_smb2_process_negprot(req->xconn, 0, smb2_inpdu, len);
68 * this is the entry point if SMB2 is selected via
69 * the SMB negprot and the "SMB 2.002" dialect.
71 void reply_smb2002(struct smb_request *req, uint16_t choice)
73 reply_smb20xx(req, SMB2_DIALECT_REVISION_202);
77 * this is the entry point if SMB2 is selected via
78 * the SMB negprot and the "SMB 2.???" dialect.
80 void reply_smb20ff(struct smb_request *req, uint16_t choice)
82 struct smbXsrv_connection *xconn = req->xconn;
83 xconn->smb2.allow_2ff = true;
84 reply_smb20xx(req, SMB2_DIALECT_REVISION_2FF);
87 enum protocol_types smbd_smb2_protocol_dialect_match(const uint8_t *indyn,
88 const int dialect_count,
92 enum protocol_types proto;
95 { PROTOCOL_SMB3_11, SMB3_DIALECT_REVISION_311 },
96 { PROTOCOL_SMB3_10, SMB3_DIALECT_REVISION_310 },
97 { PROTOCOL_SMB3_02, SMB3_DIALECT_REVISION_302 },
98 { PROTOCOL_SMB3_00, SMB3_DIALECT_REVISION_300 },
99 { PROTOCOL_SMB2_24, SMB2_DIALECT_REVISION_224 },
100 { PROTOCOL_SMB2_22, SMB2_DIALECT_REVISION_222 },
101 { PROTOCOL_SMB2_10, SMB2_DIALECT_REVISION_210 },
102 { PROTOCOL_SMB2_02, SMB2_DIALECT_REVISION_202 },
106 for (i = 0; i < ARRAY_SIZE(pd); i ++) {
109 if (lp_server_max_protocol() < pd[i].proto) {
112 if (lp_server_min_protocol() > pd[i].proto) {
116 for (c = 0; c < dialect_count; c++) {
117 *dialect = SVAL(indyn, c*2);
118 if (*dialect == pd[i].dialect) {
124 return PROTOCOL_NONE;
127 NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req)
129 struct smbXsrv_connection *xconn = req->xconn;
131 const uint8_t *inbody;
132 const uint8_t *indyn = NULL;
135 DATA_BLOB negprot_spnego_blob;
136 uint16_t security_offset;
137 DATA_BLOB security_buffer;
138 size_t expected_dyn_size = 0;
140 uint16_t security_mode;
141 uint16_t dialect_count;
142 uint16_t in_security_mode;
143 uint32_t in_capabilities;
144 DATA_BLOB in_guid_blob;
146 struct smb2_negotiate_contexts in_c = { .num_contexts = 0, };
147 struct smb2_negotiate_context *in_preauth = NULL;
148 struct smb2_negotiate_context *in_cipher = NULL;
149 struct smb2_negotiate_contexts out_c = { .num_contexts = 0, };
150 DATA_BLOB out_negotiate_context_blob = data_blob_null;
151 uint32_t out_negotiate_context_offset = 0;
152 uint16_t out_negotiate_context_count = 0;
153 uint16_t dialect = 0;
154 uint32_t capabilities;
155 DATA_BLOB out_guid_blob;
156 struct GUID out_guid;
157 enum protocol_types protocol = PROTOCOL_NONE;
159 uint32_t max_trans = lp_smb2_max_trans();
160 uint32_t max_read = lp_smb2_max_read();
161 uint32_t max_write = lp_smb2_max_write();
162 NTTIME now = timeval_to_nttime(&req->request_time);
164 status = smbd_smb2_request_verify_sizes(req, 0x24);
165 if (!NT_STATUS_IS_OK(status)) {
166 return smbd_smb2_request_error(req, status);
168 inbody = SMBD_SMB2_IN_BODY_PTR(req);
170 dialect_count = SVAL(inbody, 0x02);
172 in_security_mode = SVAL(inbody, 0x04);
173 in_capabilities = IVAL(inbody, 0x08);
174 in_guid_blob = data_blob_const(inbody + 0x0C, 16);
176 if (dialect_count == 0) {
177 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
180 status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
181 if (!NT_STATUS_IS_OK(status)) {
182 return smbd_smb2_request_error(req, status);
185 expected_dyn_size = dialect_count * 2;
186 if (SMBD_SMB2_IN_DYN_LEN(req) < expected_dyn_size) {
187 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
189 indyn = SMBD_SMB2_IN_DYN_PTR(req);
191 protocol = smbd_smb2_protocol_dialect_match(indyn,
195 for (c=0; protocol == PROTOCOL_NONE && c < dialect_count; c++) {
196 if (lp_server_max_protocol() < PROTOCOL_SMB2_10) {
200 dialect = SVAL(indyn, c*2);
201 if (dialect == SMB2_DIALECT_REVISION_2FF) {
202 if (xconn->smb2.allow_2ff) {
203 xconn->smb2.allow_2ff = false;
204 protocol = PROTOCOL_SMB2_10;
210 if (protocol == PROTOCOL_NONE) {
211 return smbd_smb2_request_error(req, NT_STATUS_NOT_SUPPORTED);
214 if (protocol >= PROTOCOL_SMB3_10) {
215 uint32_t in_negotiate_context_offset = 0;
216 uint16_t in_negotiate_context_count = 0;
217 DATA_BLOB in_negotiate_context_blob = data_blob_null;
220 in_negotiate_context_offset = IVAL(inbody, 0x1C);
221 in_negotiate_context_count = SVAL(inbody, 0x20);
224 ofs += SMBD_SMB2_IN_BODY_LEN(req);
225 ofs += expected_dyn_size;
226 if ((ofs % 8) != 0) {
227 ofs += 8 - (ofs % 8);
230 if (in_negotiate_context_offset != ofs) {
231 return smbd_smb2_request_error(req,
232 NT_STATUS_INVALID_PARAMETER);
235 ofs -= SMB2_HDR_BODY;
236 ofs -= SMBD_SMB2_IN_BODY_LEN(req);
238 if (SMBD_SMB2_IN_DYN_LEN(req) < ofs) {
239 return smbd_smb2_request_error(req,
240 NT_STATUS_INVALID_PARAMETER);
243 in_negotiate_context_blob = data_blob_const(indyn,
244 SMBD_SMB2_IN_DYN_LEN(req));
246 in_negotiate_context_blob.data += ofs;
247 in_negotiate_context_blob.length -= ofs;
249 status = smb2_negotiate_context_parse(req,
250 in_negotiate_context_blob, &in_c);
251 if (!NT_STATUS_IS_OK(status)) {
252 return smbd_smb2_request_error(req, status);
255 if (in_negotiate_context_count != in_c.num_contexts) {
256 return smbd_smb2_request_error(req,
257 NT_STATUS_INVALID_PARAMETER);
261 switch (get_remote_arch()) {
268 set_remote_arch(RA_VISTA);
272 fstr_sprintf(remote_proto, "SMB%X_%02X",
273 (dialect >> 8) & 0xFF, dialect & 0xFF);
275 reload_services(req->sconn, conn_snum_used, true);
276 DEBUG(3,("Selected protocol %s\n", remote_proto));
278 in_preauth = smb2_negotiate_context_find(&in_c,
279 SMB2_PREAUTH_INTEGRITY_CAPABILITIES);
280 if (protocol >= PROTOCOL_SMB3_10 && in_preauth == NULL) {
281 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
283 in_cipher = smb2_negotiate_context_find(&in_c,
284 SMB2_ENCRYPTION_CAPABILITIES);
286 /* negprot_spnego() returns a the server guid in the first 16 bytes */
287 negprot_spnego_blob = negprot_spnego(req, xconn);
288 if (negprot_spnego_blob.data == NULL) {
289 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
292 if (negprot_spnego_blob.length < 16) {
293 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
296 security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
297 if (lp_server_signing() == SMB_SIGNING_REQUIRED) {
298 security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
302 if (lp_host_msdfs()) {
303 capabilities |= SMB2_CAP_DFS;
306 if (protocol >= PROTOCOL_SMB2_10 &&
308 lp_oplocks(GLOBAL_SECTION_SNUM) &&
309 !lp_kernel_oplocks(GLOBAL_SECTION_SNUM))
311 capabilities |= SMB2_CAP_LEASING;
314 if ((protocol >= PROTOCOL_SMB2_24) &&
315 (lp_smb_encrypt(-1) != SMB_SIGNING_OFF) &&
316 (in_capabilities & SMB2_CAP_ENCRYPTION)) {
317 capabilities |= SMB2_CAP_ENCRYPTION;
321 * 0x10000 (65536) is the maximum allowed message size
326 if (protocol >= PROTOCOL_SMB2_10) {
329 if (tsocket_address_is_inet(req->sconn->local_address, "ip")) {
330 p = tsocket_address_inet_port(req->sconn->local_address);
333 /* largeMTU is not supported over NBT (tcp port 139) */
334 if (p != NBT_SMB_PORT) {
335 capabilities |= SMB2_CAP_LARGE_MTU;
336 xconn->smb2.credits.multicredit = true;
339 * We allow up to almost 16MB.
341 * The maximum PDU size is 0xFFFFFF (16776960)
342 * and we need some space for the header.
344 max_limit = 0xFFFF00;
349 * the defaults are 8MB, but we'll limit this to max_limit based on
350 * the dialect (64kb for SMB 2.0, 8MB for SMB >= 2.1 with LargeMTU)
352 * user configured values exceeding the limits will be overwritten,
353 * only smaller values will be accepted
356 max_trans = MIN(max_limit, lp_smb2_max_trans());
357 max_read = MIN(max_limit, lp_smb2_max_read());
358 max_write = MIN(max_limit, lp_smb2_max_write());
360 if (in_preauth != NULL) {
363 uint16_t salt_length;
364 uint16_t selected_preauth = 0;
370 if (in_preauth->data.length < needed) {
371 return smbd_smb2_request_error(req,
372 NT_STATUS_INVALID_PARAMETER);
375 hash_count = SVAL(in_preauth->data.data, 0);
376 salt_length = SVAL(in_preauth->data.data, 2);
378 if (hash_count == 0) {
379 return smbd_smb2_request_error(req,
380 NT_STATUS_INVALID_PARAMETER);
383 p = in_preauth->data.data + needed;
384 needed += hash_count * 2;
385 needed += salt_length;
387 if (in_preauth->data.length < needed) {
388 return smbd_smb2_request_error(req,
389 NT_STATUS_INVALID_PARAMETER);
392 for (i=0; i < hash_count; i++) {
398 if (v == SMB2_PREAUTH_INTEGRITY_SHA512) {
399 selected_preauth = v;
404 if (selected_preauth == 0) {
405 return smbd_smb2_request_error(req,
406 NT_STATUS_SMB_NO_PREAUTH_INTEGRITY_HASH_OVERLAP);
409 SSVAL(buf, 0, 1); /* HashAlgorithmCount */
410 SSVAL(buf, 2, 32); /* SaltLength */
411 SSVAL(buf, 4, selected_preauth);
412 generate_random_buffer(buf + 6, 32);
414 b = data_blob_const(buf, sizeof(buf));
415 status = smb2_negotiate_context_add(req, &out_c,
416 SMB2_PREAUTH_INTEGRITY_CAPABILITIES, b);
417 if (!NT_STATUS_IS_OK(status)) {
418 return smbd_smb2_request_error(req, status);
421 req->preauth = &req->xconn->smb2.preauth;
424 if (in_cipher != NULL) {
426 uint16_t cipher_count;
431 bool aes_128_ccm_supported = false;
432 bool aes_128_gcm_supported = false;
434 capabilities &= ~SMB2_CAP_ENCRYPTION;
436 if (in_cipher->data.length < needed) {
437 return smbd_smb2_request_error(req,
438 NT_STATUS_INVALID_PARAMETER);
441 cipher_count = SVAL(in_cipher->data.data, 0);
443 if (cipher_count == 0) {
444 return smbd_smb2_request_error(req,
445 NT_STATUS_INVALID_PARAMETER);
448 p = in_cipher->data.data + needed;
449 needed += cipher_count * 2;
451 if (in_cipher->data.length < needed) {
452 return smbd_smb2_request_error(req,
453 NT_STATUS_INVALID_PARAMETER);
456 for (i=0; i < cipher_count; i++) {
462 if (v == SMB2_ENCRYPTION_AES128_GCM) {
463 aes_128_gcm_supported = true;
465 if (v == SMB2_ENCRYPTION_AES128_CCM) {
466 aes_128_ccm_supported = true;
471 * For now we preferr CCM because our implementation
472 * is faster than GCM, see bug #11451.
474 if (aes_128_ccm_supported) {
475 xconn->smb2.server.cipher = SMB2_ENCRYPTION_AES128_CCM;
476 } else if (aes_128_gcm_supported) {
477 xconn->smb2.server.cipher = SMB2_ENCRYPTION_AES128_GCM;
480 SSVAL(buf, 0, 1); /* ChiperCount */
481 SSVAL(buf, 2, xconn->smb2.server.cipher);
483 b = data_blob_const(buf, sizeof(buf));
484 status = smb2_negotiate_context_add(req, &out_c,
485 SMB2_ENCRYPTION_CAPABILITIES, b);
486 if (!NT_STATUS_IS_OK(status)) {
487 return smbd_smb2_request_error(req, status);
491 if (capabilities & SMB2_CAP_ENCRYPTION) {
492 xconn->smb2.server.cipher = SMB2_ENCRYPTION_AES128_CCM;
495 if (protocol >= PROTOCOL_SMB2_22 &&
496 xconn->client->server_multi_channel_enabled)
498 if (in_capabilities & SMB2_CAP_MULTI_CHANNEL) {
499 capabilities |= SMB2_CAP_MULTI_CHANNEL;
503 security_offset = SMB2_HDR_BODY + 0x40;
506 /* Try SPNEGO auth... */
507 security_buffer = data_blob_const(negprot_spnego_blob.data + 16,
508 negprot_spnego_blob.length - 16);
510 /* for now we want raw NTLMSSP */
511 security_buffer = data_blob_const(NULL, 0);
514 if (out_c.num_contexts != 0) {
515 status = smb2_negotiate_context_push(req,
516 &out_negotiate_context_blob,
518 if (!NT_STATUS_IS_OK(status)) {
519 return smbd_smb2_request_error(req, status);
523 if (out_negotiate_context_blob.length != 0) {
524 static const uint8_t zeros[8];
529 outdyn = data_blob_dup_talloc(req, security_buffer);
530 if (outdyn.length != security_buffer.length) {
531 return smbd_smb2_request_error(req,
532 NT_STATUS_NO_MEMORY);
535 ofs = security_offset + security_buffer.length;
536 if ((ofs % 8) != 0) {
541 ok = data_blob_append(req, &outdyn, zeros, pad);
543 return smbd_smb2_request_error(req,
544 NT_STATUS_NO_MEMORY);
547 ok = data_blob_append(req, &outdyn,
548 out_negotiate_context_blob.data,
549 out_negotiate_context_blob.length);
551 return smbd_smb2_request_error(req,
552 NT_STATUS_NO_MEMORY);
555 out_negotiate_context_offset = ofs;
556 out_negotiate_context_count = out_c.num_contexts;
558 outdyn = security_buffer;
561 out_guid_blob = data_blob_const(negprot_spnego_blob.data, 16);
562 status = GUID_from_ndr_blob(&out_guid_blob, &out_guid);
563 if (!NT_STATUS_IS_OK(status)) {
564 return smbd_smb2_request_error(req, status);
567 outbody = smbd_smb2_generate_outbody(req, 0x40);
568 if (outbody.data == NULL) {
569 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
572 SSVAL(outbody.data, 0x00, 0x40 + 1); /* struct size */
573 SSVAL(outbody.data, 0x02,
574 security_mode); /* security mode */
575 SSVAL(outbody.data, 0x04, dialect); /* dialect revision */
576 SSVAL(outbody.data, 0x06,
577 out_negotiate_context_count); /* reserved/NegotiateContextCount */
578 memcpy(outbody.data + 0x08,
579 out_guid_blob.data, 16); /* server guid */
580 SIVAL(outbody.data, 0x18,
581 capabilities); /* capabilities */
582 SIVAL(outbody.data, 0x1C, max_trans); /* max transact size */
583 SIVAL(outbody.data, 0x20, max_read); /* max read size */
584 SIVAL(outbody.data, 0x24, max_write); /* max write size */
585 SBVAL(outbody.data, 0x28, now); /* system time */
586 SBVAL(outbody.data, 0x30, 0); /* server start time */
587 SSVAL(outbody.data, 0x38,
588 security_offset); /* security buffer offset */
589 SSVAL(outbody.data, 0x3A,
590 security_buffer.length); /* security buffer length */
591 SIVAL(outbody.data, 0x3C,
592 out_negotiate_context_offset); /* reserved/NegotiateContextOffset */
594 req->sconn->using_smb2 = true;
596 if (dialect != SMB2_DIALECT_REVISION_2FF) {
597 struct smbXsrv_client_global0 *global0 = NULL;
599 status = smbXsrv_connection_init_tables(xconn, protocol);
600 if (!NT_STATUS_IS_OK(status)) {
601 return smbd_smb2_request_error(req, status);
604 xconn->smb2.client.capabilities = in_capabilities;
605 xconn->smb2.client.security_mode = in_security_mode;
606 xconn->smb2.client.guid = in_guid;
607 xconn->smb2.client.num_dialects = dialect_count;
608 xconn->smb2.client.dialects = talloc_array(xconn,
611 if (xconn->smb2.client.dialects == NULL) {
612 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
614 for (c=0; c < dialect_count; c++) {
615 xconn->smb2.client.dialects[c] = SVAL(indyn, c*2);
618 xconn->smb2.server.capabilities = capabilities;
619 xconn->smb2.server.security_mode = security_mode;
620 xconn->smb2.server.guid = out_guid;
621 xconn->smb2.server.dialect = dialect;
622 xconn->smb2.server.max_trans = max_trans;
623 xconn->smb2.server.max_read = max_read;
624 xconn->smb2.server.max_write = max_write;
626 if (xconn->protocol < PROTOCOL_SMB2_10) {
628 * SMB2_02 doesn't support client guids
630 return smbd_smb2_request_done(req, outbody, &outdyn);
633 if (!xconn->client->server_multi_channel_enabled) {
635 * Only deal with the client guid database
636 * if multi-channel is enabled.
638 return smbd_smb2_request_done(req, outbody, &outdyn);
641 if (xconn->smb2.client.guid_verified) {
643 * The connection was passed from another
646 return smbd_smb2_request_done(req, outbody, &outdyn);
649 status = smb2srv_client_lookup_global(xconn->client,
650 xconn->smb2.client.guid,
653 * TODO: check for races...
655 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECTID_NOT_FOUND)) {
657 * This stores the new client information in
658 * smbXsrv_client_global.tdb
660 xconn->client->global->client_guid =
661 xconn->smb2.client.guid;
662 status = smbXsrv_client_update(xconn->client);
663 if (!NT_STATUS_IS_OK(status)) {
667 xconn->smb2.client.guid_verified = true;
668 } else if (NT_STATUS_IS_OK(status)) {
669 status = smb2srv_client_connection_pass(req,
671 if (!NT_STATUS_IS_OK(status)) {
672 return smbd_smb2_request_error(req, status);
675 smbd_server_connection_terminate(xconn,
676 "passed connection");
677 return NT_STATUS_OBJECTID_EXISTS;
679 return smbd_smb2_request_error(req, status);
683 return smbd_smb2_request_done(req, outbody, &outdyn);