11023 SMB server min_protocol setting

Reviewed by: Gordon Ross <gordon.ross@nexenta.com>
Reviewed by: Evan Layton <evan.layton@nexenta.com>
Approved by: Garrett D'Amore <garrett@damore.org>

14 files changed, 149 insertions, 54 deletions

diff --git a/usr/src/cmd/smbsrv/fksmbd/Run.sh b/usr/src/cmd/smbsrv/fksmbd/Run.sh
index 8d94211d99..fb76e791e6 100755
--- a/usr/src/cmd/smbsrv/fksmbd/Run.sh
+++ b/usr/src/cmd/smbsrv/fksmbd/Run.sh
@@ -12,7 +12,7 @@
 #
 
 #
-# Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
+# Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
 #
 
 # Helper program to run fksmbd (user-space smbd for debugging)
@@ -56,7 +56,7 @@ LD_LIBRARY_PATH=$ROOT/usr/lib/smbsrv:$ROOT/usr/lib:$ROOT/lib
 export LD_LIBRARY_PATH
 
 # Enable everything, for debugging
-export SMB_MAX_PROTOCOL=3
+export SMB_MAX_PROTOCOL=300
 export SMB_SIGNING=require
 
 # normally runs with cwd=/ but this is more careful
diff --git a/usr/src/cmd/smbsrv/fksmbd/fksmbd_kmod.c b/usr/src/cmd/smbsrv/fksmbd/fksmbd_kmod.c
index 2bebe761f4..02e80358ca 100644
--- a/usr/src/cmd/smbsrv/fksmbd/fksmbd_kmod.c
+++ b/usr/src/cmd/smbsrv/fksmbd/fksmbd_kmod.c
@@ -10,7 +10,7 @@
  */
 
 /*
- * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
  */
 
 /*
@@ -70,22 +70,14 @@ fksmbd_adjust_config(smb_ioc_header_t *ioc_hdr)
 	    ioc->maxconnections, ioc->maxworkers);
 
 	if ((s = getenv("SMB_MAX_PROTOCOL")) != NULL) {
-		switch (s[0]) {
-		case '1':
-			ioc->max_protocol = SMB_VERS_1;
-			break;
-		case '2':
-			ioc->max_protocol = SMB_VERS_2_1;
-			break;
-		case '3':
-			ioc->max_protocol = SMB_VERS_3_0;
-			break;
-		default:
-			smbd_report("env SMB_MAX_PROTOCOL invalid");
-			break;
-		}
+		ioc->max_protocol = strtol(s, NULL, 16);
+		smbd_report("max_protocol=0x%x", ioc->max_protocol);
+	}
+
+	if ((s = getenv("SMB_MIN_PROTOCOL")) != NULL) {
+		ioc->min_protocol = strtol(s, NULL, 16);
+		smbd_report("min_protocol=0x%x", ioc->min_protocol);
 	}
-	smbd_report("max_protocol=0x%x", ioc->max_protocol);
 
 	if ((s = getenv("SMB_SIGNING")) != NULL) {
 		ioc->signing_enable = 0;
diff --git a/usr/src/cmd/smbsrv/smbd/server.xml b/usr/src/cmd/smbsrv/smbd/server.xml
index d6c445f137..ac93f2f70e 100644
--- a/usr/src/cmd/smbsrv/smbd/server.xml
+++ b/usr/src/cmd/smbsrv/smbd/server.xml
@@ -229,6 +229,8 @@ file.
 			value='true' override='true'/>
 		<propval name='max_protocol' type='astring'
 			value='' override='true'/>
+		<propval name='min_protocol' type='astring'
+			value='' override='true'/>
 		<propval name='encrypt' type='astring'
 			value='disabled' override='true'/>
 		<propval name='initial_credits' type='integer'
diff --git a/usr/src/lib/libshare/smb/libshare_smb.c b/usr/src/lib/libshare/smb/libshare_smb.c
index 7a731820e0..6a0ad97b7f 100644
--- a/usr/src/lib/libshare/smb/libshare_smb.c
+++ b/usr/src/lib/libshare/smb/libshare_smb.c
@@ -84,7 +84,7 @@ static int hostname_validator(int, char *);
 static int path_validator(int, char *);
 static int cmd_validator(int, char *);
 static int disposition_validator(int, char *);
-static int max_protocol_validator(int, char *);
+static int protocol_validator(int, char *);
 static int require_validator(int, char *);
 
 static int smb_enable_resource(sa_resource_t);
@@ -918,10 +918,12 @@ struct smb_proto_option_defs {
 	    SMB_REFRESH_REFRESH },
 	{ SMB_CI_DISPOSITION, 0, MAX_VALUE_BUFLEN,
 	    disposition_validator, SMB_REFRESH_REFRESH },
-	{ SMB_CI_MAX_PROTOCOL, 0, MAX_VALUE_BUFLEN, max_protocol_validator,
+	{ SMB_CI_MAX_PROTOCOL, 0, MAX_VALUE_BUFLEN, protocol_validator,
 	    SMB_REFRESH_REFRESH },
 	{ SMB_CI_ENCRYPT, 0, MAX_VALUE_BUFLEN, require_validator,
 	    SMB_REFRESH_REFRESH },
+	{ SMB_CI_MIN_PROTOCOL, 0, MAX_VALUE_BUFLEN, protocol_validator,
+	    SMB_REFRESH_REFRESH },
 	{ SMB_CI_OPLOCK_ENABLE, 0, 0, true_false_validator,
 	    SMB_REFRESH_REFRESH },
 };
@@ -2389,7 +2391,7 @@ disposition_validator(int index, char *value)
 
 /*ARGSUSED*/
 static int
-max_protocol_validator(int index, char *value)
+protocol_validator(int index, char *value)
 {
 	if (value == NULL)
 		return (SA_BAD_VALUE);
diff --git a/usr/src/lib/smbsrv/libsmb/common/libsmb.h b/usr/src/lib/smbsrv/libsmb/common/libsmb.h
index 3c60630327..56cab5ca8a 100644
--- a/usr/src/lib/smbsrv/libsmb/common/libsmb.h
+++ b/usr/src/lib/smbsrv/libsmb/common/libsmb.h
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
  */
 
 #ifndef	_LIBSMB_H
@@ -158,6 +158,7 @@ typedef enum {
 	SMB_CI_MAXIMUM_CREDITS,
 	SMB_CI_MAX_PROTOCOL,
 	SMB_CI_ENCRYPT,
+	SMB_CI_MIN_PROTOCOL,
 
 	SMB_CI_MAX
 } smb_cfg_id_t;
@@ -216,6 +217,7 @@ extern void smb_config_get_negtok(uchar_t *, uint32_t *);
 
 extern int smb_config_check_protocol(char *);
 extern uint32_t smb_config_get_max_protocol(void);
+extern uint32_t smb_config_get_min_protocol(void);
 extern void smb_config_upgrade(void);
 
 extern smb_cfg_val_t smb_config_get_require(smb_cfg_id_t);
diff --git a/usr/src/lib/smbsrv/libsmb/common/smb_cfg.c b/usr/src/lib/smbsrv/libsmb/common/smb_cfg.c
index 3a82584c03..cfecd0e944 100644
--- a/usr/src/lib/smbsrv/libsmb/common/smb_cfg.c
+++ b/usr/src/lib/smbsrv/libsmb/common/smb_cfg.c
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
  */
 
 /*
@@ -147,6 +147,7 @@ static smb_cfg_param_t smb_cfg_table[] =
 	{SMB_CI_MAXIMUM_CREDITS, "maximum_credits", SCF_TYPE_INTEGER, 0},
 	{SMB_CI_MAX_PROTOCOL, "max_protocol", SCF_TYPE_ASTRING, 0},
 	{SMB_CI_ENCRYPT, "encrypt", SCF_TYPE_ASTRING, 0},
+	{SMB_CI_MIN_PROTOCOL, "min_protocol", SCF_TYPE_ASTRING, 0},
 
 	/* SMB_CI_MAX */
 };
@@ -669,15 +670,42 @@ smb_config_setstr(smb_cfg_id_t id, char *value)
 	 * by requiring encryption to accidentally expose their data
 	 * by lowering the protocol, so prevent them from going below 3.0
 	 * if encryption is required.
+	 * Also, ensure that max_protocol >= min_protocol.
 	 */
-	if (id == SMB_CI_MAX_PROTOCOL &&
-	    smb_config_get_require(SMB_CI_ENCRYPT) == SMB_CONFIG_REQUIRED &&
-	    smb_config_get_max_protocol() >= SMB_VERS_3_0 &&
-	    smb_convert_version_str(value) < SMB_VERS_3_0) {
-		syslog(LOG_ERR, "Cannot set smbd/max_protocol below 3.0"
-		    " while smbd/encrypt == required.");
-		rc = SMBD_SMF_INVALID_ARG;
-	} else {
+	if (id == SMB_CI_MAX_PROTOCOL) {
+		smb_cfg_val_t encrypt;
+		uint32_t min;
+		uint32_t val;
+
+		encrypt = smb_config_get_require(SMB_CI_ENCRYPT);
+		min = smb_config_get_min_protocol();
+		val = smb_convert_version_str(value);
+
+		if (encrypt == SMB_CONFIG_REQUIRED &&
+		    val < SMB_VERS_3_0) {
+			syslog(LOG_ERR, "Cannot set smbd/max_protocol below 3.0"
+			    " while smbd/encrypt == required.");
+			rc = SMBD_SMF_INVALID_ARG;
+		} else if (val < min) {
+			syslog(LOG_ERR, "Cannot set smbd/max_protocol to less"
+			    " than smbd/min_protocol.");
+			rc = SMBD_SMF_INVALID_ARG;
+		}
+	} else if (id == SMB_CI_MIN_PROTOCOL) {
+		uint32_t max;
+		uint32_t val;
+
+		max = smb_config_get_max_protocol();
+		val = smb_convert_version_str(value);
+
+		if (val > max) {
+			syslog(LOG_ERR, "Cannot set smbd/min_protocol to more"
+			    " than smbd/max_protocol.");
+			rc = SMBD_SMF_INVALID_ARG;
+		}
+	}
+
+	if (rc == SMBD_SMF_OK) {
 		rc = smb_smf_set_string_property(handle, cfg->sc_name, value);
 	}
 
@@ -1166,6 +1194,26 @@ smb_config_getent(smb_cfg_id_t id)
 	return (NULL);
 }
 
+static uint32_t
+smb_config_get_protocol(smb_cfg_id_t id, char *name, uint32_t default_val)
+{
+	char str[SMB_VERSTR_LEN];
+	int rc;
+	uint32_t val;
+
+	rc = smb_config_getstr(id, str, sizeof (str));
+	if (rc == SMBD_SMF_OK) {
+		val = smb_convert_version_str(str);
+		if (val != 0)
+			return (val);
+		if (str[0] != '\0') {
+			syslog(LOG_ERR, "smbd/%s value invalid: %s", name, str);
+		}
+	}
+
+	return (default_val);
+}
+
 /*
  * The service manifest has empty values by default for min_protocol and
  * max_protocol. The expectation is that when those values are empty, we don't
@@ -1178,21 +1226,28 @@ uint32_t max_protocol_default = SMB_VERS_3_0;
 uint32_t
 smb_config_get_max_protocol(void)
 {
-	char str[SMB_VERSTR_LEN];
-	int rc;
 	uint32_t max;
 
-	rc = smb_config_getstr(SMB_CI_MAX_PROTOCOL, str, sizeof (str));
-	if (rc == SMBD_SMF_OK) {
-		max = smb_convert_version_str(str);
-		if (max != 0)
-			return (max);
-		if (str[0] != '\0') {
-			syslog(LOG_ERR, "smbd/max_protocol value invalid");
-		}
-	}
+	max = smb_config_get_protocol(SMB_CI_MAX_PROTOCOL, "max_protocol",
+	    max_protocol_default);
+
+	return (max);
+}
+
+/*
+ * This should eventually be SMB_VERS_2_BASE
+ */
+uint32_t min_protocol_default = SMB_VERS_1;
+
+uint32_t
+smb_config_get_min_protocol(void)
+{
+	uint32_t min;
+
+	min = smb_config_get_protocol(SMB_CI_MIN_PROTOCOL, "min_protocol",
+	    min_protocol_default);
 
-	return (max_protocol_default);
+	return (min);
 }
 
 int
diff --git a/usr/src/lib/smbsrv/libsmb/common/smb_info.c b/usr/src/lib/smbsrv/libsmb/common/smb_info.c
index 870a667444..4e6df7bb92 100644
--- a/usr/src/lib/smbsrv/libsmb/common/smb_info.c
+++ b/usr/src/lib/smbsrv/libsmb/common/smb_info.c
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
  */
 
 #include <sys/types.h>
@@ -157,6 +157,7 @@ smb_load_kconfig(smb_kmod_cfg_t *kcfg)
 	kcfg->skc_sync_enable = smb_config_getbool(SMB_CI_SYNC_ENABLE);
 	kcfg->skc_traverse_mounts = smb_config_getbool(SMB_CI_TRAVERSE_MOUNTS);
 	kcfg->skc_max_protocol = smb_config_get_max_protocol();
+	kcfg->skc_min_protocol = smb_config_get_min_protocol();
 	kcfg->skc_secmode = smb_config_get_secmode();
 	kcfg->skc_encrypt = smb_config_get_require(SMB_CI_ENCRYPT);
 
diff --git a/usr/src/lib/smbsrv/libsmb/common/smb_kmod.c b/usr/src/lib/smbsrv/libsmb/common/smb_kmod.c
index 28638b538b..652cf15961 100644
--- a/usr/src/lib/smbsrv/libsmb/common/smb_kmod.c
+++ b/usr/src/lib/smbsrv/libsmb/common/smb_kmod.c
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
  * Copyright 2017 Joyent, Inc.
  */
 
@@ -89,6 +89,7 @@ smb_kmod_setcfg(smb_kmod_cfg_t *cfg)
 	ioc.print_enable = cfg->skc_print_enable;
 	ioc.traverse_mounts = cfg->skc_traverse_mounts;
 	ioc.max_protocol = cfg->skc_max_protocol;
+	ioc.min_protocol = cfg->skc_min_protocol;
 	ioc.exec_flags = cfg->skc_execflags;
 	ioc.negtok_len = cfg->skc_negtok_len;
 	ioc.version = cfg->skc_version;
diff --git a/usr/src/man/man4/smb.4 b/usr/src/man/man4/smb.4
index d22d6f969c..99404484e6 100644
--- a/usr/src/man/man4/smb.4
+++ b/usr/src/man/man4/smb.4
@@ -1,6 +1,6 @@
 '\" te
 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved.
-.\" Copyright 2016, Nexenta Systems, Inc. All Rights Reserved.
+.\" Copyright 2017, Nexenta Systems, Inc. All Rights Reserved.
 .\" The contents of this file are subject to the terms of the
 .\" Common Development and Distribution License (the "License").
 .\" You may not use this file except in compliance with the License.
@@ -352,6 +352,18 @@ Valid settings include: \fB1\fR, \fB2.1\fR, \fB3.0\fR
 .sp
 .ne 2
 .na
+\fB\fBmin_protocol\fR\fR
+.ad
+.sp .6
+.RS 4n
+Specifies the minimum SMB protocol level that the SMB service
+should allow clients to negotiate.  The default value is \fB1\fR.
+Valid settings include: \fB1\fR, \fB2.1\fR, \fB3.0\fR
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fBmax_workers\fR\fR
 .ad
 .sp .6
diff --git a/usr/src/uts/common/fs/smbsrv/smb2_negotiate.c b/usr/src/uts/common/fs/smbsrv/smb2_negotiate.c
index c534ebe7fb..cbdd5f9fb5 100644
--- a/usr/src/uts/common/fs/smbsrv/smb2_negotiate.c
+++ b/usr/src/uts/common/fs/smbsrv/smb2_negotiate.c
@@ -63,8 +63,8 @@ uint32_t smb2_old_rwsize = (1<<16);	/* 64KB */
 
 /*
  * List of all SMB2 versions we implement.  Note that the
- * highest version we support may be limited by the
- * _cfg.skc_max_protocol setting.
+ * versions we support may be limited by the
+ * _cfg.skc_max_protocol and min_protocol settings.
  */
 static uint16_t smb2_versions[] = {
 	0x202,	/* SMB 2.002 */
@@ -79,7 +79,8 @@ smb2_supported_version(smb_session_t *s, uint16_t version)
 {
 	int i;
 
-	if (version > s->s_cfg.skc_max_protocol)
+	if (version > s->s_cfg.skc_max_protocol ||
+	    version < s->s_cfg.skc_min_protocol)
 		return (B_FALSE);
 	for (i = 0; i < smb2_nversions; i++)
 		if (version == smb2_versions[i])
@@ -119,7 +120,7 @@ smb1_negotiate_smb2(smb_request_t *sr)
 	 */
 	switch (negprot->ni_dialect) {
 	case DIALECT_SMB2002:	/* SMB 2.002 (a.k.a. SMB2.0) */
-		smb2_version = 0x202;
+		smb2_version = SMB_VERS_2_002;
 		s->dialect = smb2_version;
 		s->s_state = SMB_SESSION_STATE_NEGOTIATED;
 		/* Allow normal SMB2 requests now. */
@@ -254,8 +255,13 @@ smb2_newrq_negotiate(smb_request_t *sr)
 	 * We walk the array and pick the highest supported.
 	 */
 	best_version = smb2_find_best_dialect(s, cl_versions, version_cnt);
-	if (best_version == 0)
-		return (SDRC_DROP_VC);
+	if (best_version == 0) {
+		cmn_err(CE_NOTE, "clnt %s no supported dialect",
+		    sr->session->ip_addr_str);
+		sr->smb2_status = NT_STATUS_INVALID_PARAMETER;
+		rc = -1;
+		goto errout;
+	}
 	s->dialect = best_version;
 
 	/* Allow normal SMB2 requests now. */
@@ -264,6 +270,7 @@ smb2_newrq_negotiate(smb_request_t *sr)
 
 	rc = smb2_negotiate_common(sr, best_version);
 
+errout:
 	/* sr->smb2_status was set */
 	DTRACE_SMB2_DONE(op__Negotiate, smb_request_t *, sr);
 
diff --git a/usr/src/uts/common/fs/smbsrv/smb_negotiate.c b/usr/src/uts/common/fs/smbsrv/smb_negotiate.c
index 265bc227e3..7de84e5f05 100644
--- a/usr/src/uts/common/fs/smbsrv/smb_negotiate.c
+++ b/usr/src/uts/common/fs/smbsrv/smb_negotiate.c
@@ -379,6 +379,17 @@ smb_pre_negotiate(smb_request_t *sr)
 		    skc->skc_max_protocol < SMB_VERS_2_BASE)
 			continue;
 
+		/*
+		 * We may not support SMB1; skip those dialects if true.
+		 */
+		if (dialect < DIALECT_SMB2002 &&
+		    skc->skc_min_protocol > SMB_VERS_1)
+			continue;
+
+		if (dialect == DIALECT_SMB2002 &&
+		    skc->skc_min_protocol > SMB_VERS_2_002)
+			continue;
+
 		if (negprot->ni_dialect < dialect) {
 			negprot->ni_dialect = dialect;
 			negprot->ni_index = pos;
@@ -419,6 +430,13 @@ smb_com_negotiate(smb_request_t *sr)
 		return (SDRC_ERROR);
 	}
 
+	if (negprot->ni_index < 0) {
+		cmn_err(CE_NOTE, "clnt %s no supported dialect",
+		    sr->session->ip_addr_str);
+		smbsr_error(sr, 0, ERRSRV, ERRerror);
+		return (SDRC_DROP_VC);
+	}
+
 	/*
 	 * Special case for negotiating SMB2 from SMB1.  The client
 	 * includes the  "SMB 2..." dialects in the SMB1 negotiate,
diff --git a/usr/src/uts/common/fs/smbsrv/smb_server.c b/usr/src/uts/common/fs/smbsrv/smb_server.c
index a0ed95d595..0291cacc1c 100644
--- a/usr/src/uts/common/fs/smbsrv/smb_server.c
+++ b/usr/src/uts/common/fs/smbsrv/smb_server.c
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 2017 by Delphix. All rights reserved.
  */
 
@@ -2051,6 +2051,7 @@ smb_server_store_cfg(smb_server_t *sv, smb_ioc_cfg_t *ioc)
 	sv->sv_cfg.skc_print_enable = ioc->print_enable;
 	sv->sv_cfg.skc_traverse_mounts = ioc->traverse_mounts;
 	sv->sv_cfg.skc_max_protocol = ioc->max_protocol;
+	sv->sv_cfg.skc_min_protocol = ioc->min_protocol;
 	sv->sv_cfg.skc_encrypt = ioc->encrypt;
 	sv->sv_cfg.skc_execflags = ioc->exec_flags;
 	sv->sv_cfg.skc_negtok_len = ioc->negtok_len;
diff --git a/usr/src/uts/common/smbsrv/smb_ioctl.h b/usr/src/uts/common/smbsrv/smb_ioctl.h
index 343c0d549c..1518d07423 100644
--- a/usr/src/uts/common/smbsrv/smb_ioctl.h
+++ b/usr/src/uts/common/smbsrv/smb_ioctl.h
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
  * Copyright 2017 Joyent, Inc.
  */
 
@@ -172,6 +172,7 @@ typedef struct smb_ioc_cfg {
 	int32_t		print_enable;
 	int32_t		traverse_mounts;
 	uint32_t	max_protocol;
+	uint32_t	min_protocol;
 	uint32_t	encrypt;
 	uint32_t	exec_flags;
 	uint32_t	negtok_len;
diff --git a/usr/src/uts/common/smbsrv/smbinfo.h b/usr/src/uts/common/smbsrv/smbinfo.h
index 213a1e8ced..bc2e4a769b 100644
--- a/usr/src/uts/common/smbsrv/smbinfo.h
+++ b/usr/src/uts/common/smbsrv/smbinfo.h
@@ -155,6 +155,7 @@ typedef struct smb_kmod_cfg {
 	int32_t skc_print_enable;
 	int32_t skc_traverse_mounts;
 	uint32_t skc_max_protocol;	/* SMB_VERS_... */
+	uint32_t skc_min_protocol;	/* SMB_VERS_... */
 	smb_cfg_val_t skc_encrypt; /* EncryptData and RejectUnencryptedAccess */
 	uint32_t skc_execflags;
 	uint32_t skc_negtok_len;