1 /*
2 * Copyright (c) 2000-2001 Boris Popov
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by Boris Popov.
16 * 4. Neither the name of the author nor the names of any co-contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 *
32 * $Id: smb_usr.c,v 1.15 2004/12/13 00:25:18 lindak Exp $
33 */
34
35 /*
36 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
37 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
38 * Use is subject to license terms.
39 */
40
41 #include <sys/param.h>
42 #include <sys/kmem.h>
43 #include <sys/systm.h>
44 #include <sys/policy.h>
45 #include <sys/conf.h>
46 #include <sys/proc.h>
47 #include <sys/fcntl.h>
48 #include <sys/file.h>
49 #include <sys/socket.h>
50 #include <sys/sunddi.h>
51 #include <sys/cmn_err.h>
52
53 #include <netsmb/smb_osdep.h>
54
55 #include <netsmb/smb.h>
56 #include <netsmb/smb_conn.h>
57 #include <netsmb/smb_rq.h>
58 #include <netsmb/smb_subr.h>
59 #include <netsmb/smb_dev.h>
60
61 static int smb_cpdatain(struct mbchain *mbp, int len, char *data, int seg);
62
63 /*
64 * Ioctl function for SMBIOC_FLAGS2
65 */
66 int
67 smb_usr_get_flags2(smb_dev_t *sdp, intptr_t arg, int flags)
68 {
69 struct smb_vc *vcp = NULL;
70
71 /* This ioctl requires a session. */
72 if ((vcp = sdp->sd_vc) == NULL)
73 return (ENOTCONN);
74
75 /*
76 * Return the flags2 value.
77 */
78 if (ddi_copyout(&vcp->vc_hflags2, (void *)arg,
79 sizeof (u_int16_t), flags))
80 return (EFAULT);
81
82 return (0);
83 }
84
85 /*
86 * Ioctl function for SMBIOC_GETSSNKEY
87 * Size copied out is SMBIOC_HASH_SZ.
88 *
89 * The RPC library needs this for encrypting things
90 * like "set password" requests. This is called
91 * with an active RPC binding, so the connection
92 * will already be active (but this checks).
93 */
94 int
95 smb_usr_get_ssnkey(smb_dev_t *sdp, intptr_t arg, int flags)
96 {
97 struct smb_vc *vcp = NULL;
98
99 /* This ioctl requires an active session. */
100 if ((vcp = sdp->sd_vc) == NULL)
101 return (ENOTCONN);
102 if (vcp->vc_state != SMBIOD_ST_VCACTIVE)
103 return (ENOTCONN);
104
105 /*
106 * Return the session key.
107 */
108 if (ddi_copyout(vcp->vc_ssn_key, (void *)arg,
109 SMBIOC_HASH_SZ, flags))
110 return (EFAULT);
111
112 return (0);
113 }
114
115 /*
116 * Ioctl function for SMBIOC_REQUEST
117 */
118 int
119 smb_usr_simplerq(smb_dev_t *sdp, intptr_t arg, int flags, cred_t *cr)
120 {
121 struct smb_cred scred;
122 struct smb_share *ssp;
123 smbioc_rq_t *ioc = NULL;
124 struct smb_rq *rqp = NULL;
125 struct mbchain *mbp;
126 struct mdchain *mdp;
127 uint32_t rsz;
128 int err, mbseg;
129
130 /* This ioctl requires a share. */
131 if ((ssp = sdp->sd_share) == NULL)
132 return (ENOTCONN);
133
134 smb_credinit(&scred, cr);
135 ioc = kmem_alloc(sizeof (*ioc), KM_SLEEP);
136 if (ddi_copyin((void *) arg, ioc, sizeof (*ioc), flags)) {
137 err = EFAULT;
138 goto out;
139 }
140
141 /* See ddi_copyin, ddi_copyout */
142 mbseg = (flags & FKIOCTL) ? MB_MSYSTEM : MB_MUSER;
143
144 /*
145 * Lots of SMB commands could be safe, but
146 * these are the only ones used by libsmbfs.
147 */
148 switch (ioc->ioc_cmd) {
149 /* These are OK */
150 case SMB_COM_CLOSE:
151 case SMB_COM_FLUSH:
152 case SMB_COM_NT_CREATE_ANDX:
153 case SMB_COM_OPEN_PRINT_FILE:
154 case SMB_COM_CLOSE_PRINT_FILE:
155 break;
156
157 default:
158 err = EPERM;
159 goto out;
160 }
161
162 err = smb_rq_alloc(SSTOCP(ssp), ioc->ioc_cmd, &scred, &rqp);
163 if (err)
164 goto out;
165
166 mbp = &rqp->sr_rq;
167 err = mb_put_mem(mbp, ioc->ioc_tbuf, ioc->ioc_tbufsz, mbseg);
168
169 err = smb_rq_simple(rqp);
170 if (err == 0) {
171 /*
172 * This may have been an open, so save the
173 * generation ID of the share, which we
174 * check before trying read or write.
175 */
176 sdp->sd_vcgenid = ssp->ss_vcgenid;
177
178 /*
179 * Have reply data. to copyout.
180 * SMB header already parsed.
181 */
182 mdp = &rqp->sr_rp;
183 rsz = msgdsize(mdp->md_top) - SMB_HDRLEN;
184 if (ioc->ioc_rbufsz < rsz) {
185 err = EOVERFLOW;
186 goto out;
187 }
188 ioc->ioc_rbufsz = rsz;
189 err = md_get_mem(mdp, ioc->ioc_rbuf, rsz, mbseg);
190 if (err)
191 goto out;
192
193 }
194
195 ioc->ioc_errclass = rqp->sr_errclass;
196 ioc->ioc_serror = rqp->sr_serror;
197 ioc->ioc_error = rqp->sr_error;
198 (void) ddi_copyout(ioc, (void *)arg, sizeof (*ioc), flags);
199
200 out:
201 if (rqp != NULL)
202 smb_rq_done(rqp); /* free rqp */
203 kmem_free(ioc, sizeof (*ioc));
204 smb_credrele(&scred);
205
206 return (err);
207
208 }
209
210 /*
211 * Ioctl function for SMBIOC_T2RQ
212 */
213 int
214 smb_usr_t2request(smb_dev_t *sdp, intptr_t arg, int flags, cred_t *cr)
215 {
216 struct smb_cred scred;
217 struct smb_share *ssp;
218 smbioc_t2rq_t *ioc = NULL;
219 struct smb_t2rq *t2p = NULL;
220 struct mdchain *mdp;
221 int err, len, mbseg;
222
223 /* This ioctl requires a share. */
224 if ((ssp = sdp->sd_share) == NULL)
225 return (ENOTCONN);
226
227 smb_credinit(&scred, cr);
228 ioc = kmem_alloc(sizeof (*ioc), KM_SLEEP);
229 if (ddi_copyin((void *) arg, ioc, sizeof (*ioc), flags)) {
230 err = EFAULT;
231 goto out;
232 }
233
234 /* See ddi_copyin, ddi_copyout */
235 mbseg = (flags & FKIOCTL) ? MB_MSYSTEM : MB_MUSER;
236
237 if (ioc->ioc_setupcnt > SMBIOC_T2RQ_MAXSETUP) {
238 err = EINVAL;
239 goto out;
240 }
241
242 /*
243 * Fill in the FID for libsmbfs transact named pipe.
244 */
245 if (ioc->ioc_setupcnt > 1 && ioc->ioc_setup[1] == 0xFFFF) {
246 if (sdp->sd_vcgenid != ssp->ss_vcgenid) {
247 err = ESTALE;
248 goto out;
249 }
250 ioc->ioc_setup[1] = (uint16_t)sdp->sd_smbfid;
251 }
252
253 t2p = kmem_alloc(sizeof (*t2p), KM_SLEEP);
254 err = smb_t2_init(t2p, SSTOCP(ssp),
255 ioc->ioc_setup, ioc->ioc_setupcnt, &scred);
256 if (err)
257 goto out;
258 t2p->t2_setupcount = ioc->ioc_setupcnt;
259 t2p->t2_setupdata = ioc->ioc_setup;
260
261 /* This ioc member is a fixed-size array. */
262 if (ioc->ioc_name[0]) {
263 /* Get the name length - carefully! */
264 ioc->ioc_name[SMBIOC_T2RQ_MAXNAME-1] = '\0';
265 t2p->t_name_len = strlen(ioc->ioc_name);
266 t2p->t_name = ioc->ioc_name;
267 }
268 t2p->t2_maxscount = 0;
269 t2p->t2_maxpcount = ioc->ioc_rparamcnt;
270 t2p->t2_maxdcount = ioc->ioc_rdatacnt;
271
272 /* Transmit parameters */
273 err = smb_cpdatain(&t2p->t2_tparam,
274 ioc->ioc_tparamcnt, ioc->ioc_tparam, mbseg);
275 if (err)
276 goto out;
277
278 /* Transmit data */
279 err = smb_cpdatain(&t2p->t2_tdata,
280 ioc->ioc_tdatacnt, ioc->ioc_tdata, mbseg);
281 if (err)
282 goto out;
283
284 err = smb_t2_request(t2p);
285
286 /* Copyout returned parameters. */
287 mdp = &t2p->t2_rparam;
288 if (err == 0 && mdp->md_top != NULL) {
289 /* User's buffer large enough? */
290 len = m_fixhdr(mdp->md_top);
291 if (len > ioc->ioc_rparamcnt) {
292 err = EMSGSIZE;
293 goto out;
294 }
295 ioc->ioc_rparamcnt = (ushort_t)len;
296 err = md_get_mem(mdp, ioc->ioc_rparam, len, mbseg);
297 if (err)
298 goto out;
299 } else
300 ioc->ioc_rparamcnt = 0;
301
302 /* Copyout returned data. */
303 mdp = &t2p->t2_rdata;
304 if (err == 0 && mdp->md_top != NULL) {
305 /* User's buffer large enough? */
306 len = m_fixhdr(mdp->md_top);
307 if (len > ioc->ioc_rdatacnt) {
308 err = EMSGSIZE;
309 goto out;
310 }
311 ioc->ioc_rdatacnt = (ushort_t)len;
312 err = md_get_mem(mdp, ioc->ioc_rdata, len, mbseg);
313 if (err)
314 goto out;
315 } else
316 ioc->ioc_rdatacnt = 0;
317
318 ioc->ioc_errclass = t2p->t2_sr_errclass;
319 ioc->ioc_serror = t2p->t2_sr_serror;
320 ioc->ioc_error = t2p->t2_sr_error;
321 ioc->ioc_rpflags2 = t2p->t2_sr_rpflags2;
322
323 (void) ddi_copyout(ioc, (void *)arg, sizeof (*ioc), flags);
324
325
326 out:
327 if (t2p != NULL) {
328 /* Note: t2p->t_name no longer allocated */
329 smb_t2_done(t2p);
330 kmem_free(t2p, sizeof (*t2p));
331 }
332 kmem_free(ioc, sizeof (*ioc));
333 smb_credrele(&scred);
334
335 return (err);
336 }
337
338 /* helper for _t2request */
339 static int
340 smb_cpdatain(struct mbchain *mbp, int len, char *data, int mbseg)
341 {
342 int error;
343
344 if (len == 0)
345 return (0);
346 error = mb_init(mbp);
347 if (error)
348 return (error);
349 return (mb_put_mem(mbp, data, len, mbseg));
350 }
351
352 /*
353 * Helper for nsmb_ioctl cases
354 * SMBIOC_READ, SMBIOC_WRITE
355 */
356 int
357 smb_usr_rw(smb_dev_t *sdp, int cmd, intptr_t arg, int flags, cred_t *cr)
358 {
359 struct smb_cred scred;
360 struct smb_share *ssp;
361 smbioc_rw_t *ioc = NULL;
362 struct iovec aiov[1];
363 struct uio auio;
364 uint16_t fh;
365 int err;
366 uio_rw_t rw;
367
368 /* This ioctl requires a share. */
369 if ((ssp = sdp->sd_share) == NULL)
370 return (ENOTCONN);
371
372 /* After reconnect, force close+reopen */
373 if (sdp->sd_vcgenid != ssp->ss_vcgenid)
374 return (ESTALE);
375
376 smb_credinit(&scred, cr);
377 ioc = kmem_alloc(sizeof (*ioc), KM_SLEEP);
378 if (ddi_copyin((void *) arg, ioc, sizeof (*ioc), flags)) {
379 err = EFAULT;
380 goto out;
381 }
382
383 switch (cmd) {
384 case SMBIOC_READ:
385 rw = UIO_READ;
386 break;
387 case SMBIOC_WRITE:
388 rw = UIO_WRITE;
389 break;
390 default:
391 err = ENODEV;
392 goto out;
393 }
394
395 /*
396 * If caller passes -1 in ioc_fh, then
397 * use the FID from SMBIOC_NTCREATE.
398 */
399 if (ioc->ioc_fh == -1)
400 fh = (uint16_t)sdp->sd_smbfid;
401 else
402 fh = (uint16_t)ioc->ioc_fh;
403
404 aiov[0].iov_base = ioc->ioc_base;
405 aiov[0].iov_len = (size_t)ioc->ioc_cnt;
406
407 auio.uio_iov = aiov;
408 auio.uio_iovcnt = 1;
409 auio.uio_loffset = ioc->ioc_offset;
410 auio.uio_segflg = (flags & FKIOCTL) ?
411 UIO_SYSSPACE : UIO_USERSPACE;
412 auio.uio_fmode = 0;
413 auio.uio_resid = (size_t)ioc->ioc_cnt;
414
415 err = smb_rwuio(ssp, fh, rw, &auio, &scred, 0);
416
417 /*
418 * On return ioc_cnt holds the
419 * number of bytes transferred.
420 */
421 ioc->ioc_cnt -= auio.uio_resid;
422
423 (void) ddi_copyout(ioc, (void *)arg, sizeof (*ioc), flags);
424
425 out:
426 kmem_free(ioc, sizeof (*ioc));
427 smb_credrele(&scred);
428
429 return (err);
430 }
431
432 /*
433 * Helper for nsmb_ioctl case
434 * SMBIOC_NTCREATE
435 */
436 int
437 smb_usr_ntcreate(smb_dev_t *sdp, intptr_t arg, int flags, cred_t *cr)
438 {
439 struct smb_cred scred;
440 struct mbchain name_mb;
441 struct smb_share *ssp;
442 smbioc_ntcreate_t *ioc = NULL;
443 uint16_t fid;
444 int err, nmlen;
445
446 /* This ioctl requires a share. */
447 if ((ssp = sdp->sd_share) == NULL)
448 return (ENOTCONN);
449
450 /* Must not be already open. */
451 if (sdp->sd_smbfid != -1)
452 return (EINVAL);
453
454 mb_init(&name_mb);
455 smb_credinit(&scred, cr);
456 ioc = kmem_alloc(sizeof (*ioc), KM_SLEEP);
457 if (ddi_copyin((void *) arg, ioc, sizeof (*ioc), flags)) {
458 err = EFAULT;
459 goto out;
460 }
461
462 /* Build name_mb */
463 ioc->ioc_name[SMBIOC_MAX_NAME-1] = '\0';
464 nmlen = strnlen(ioc->ioc_name, SMBIOC_MAX_NAME-1);
465 err = smb_put_dmem(&name_mb, SSTOVC(ssp),
466 ioc->ioc_name, nmlen,
467 SMB_CS_NONE, NULL);
468 if (err != 0)
469 goto out;
470
471 /* Do the OtW open, save the FID. */
472 err = smb_smb_ntcreate(ssp, &name_mb,
473 0, /* create flags */
474 ioc->ioc_req_acc,
475 ioc->ioc_efattr,
476 ioc->ioc_share_acc,
477 ioc->ioc_open_disp,
478 ioc->ioc_creat_opts,
479 NTCREATEX_IMPERSONATION_IMPERSONATION,
480 &scred,
481 &fid,
482 NULL,
483 NULL);
484 if (err != 0)
485 goto out;
486
487 sdp->sd_smbfid = fid;
488 sdp->sd_vcgenid = ssp->ss_vcgenid;
489
490 out:
491 kmem_free(ioc, sizeof (*ioc));
492 smb_credrele(&scred);
493 mb_done(&name_mb);
494
495 return (err);
496 }
497
498 /*
499 * Helper for nsmb_ioctl case
500 * SMBIOC_PRINTJOB
501 */
502 int
503 smb_usr_printjob(smb_dev_t *sdp, intptr_t arg, int flags, cred_t *cr)
504 {
505 struct smb_cred scred;
506 struct smb_share *ssp;
507 smbioc_printjob_t *ioc = NULL;
508 uint16_t fid;
509 int err;
510
511 /* This ioctl requires a share. */
512 if ((ssp = sdp->sd_share) == NULL)
513 return (ENOTCONN);
514
515 /* The share must be a print queue. */
516 if (ssp->ss_type != STYPE_PRINTQ)
517 return (EINVAL);
518
519 /* Must not be already open. */
520 if (sdp->sd_smbfid != -1)
521 return (EINVAL);
522
523 smb_credinit(&scred, cr);
524 ioc = kmem_alloc(sizeof (*ioc), KM_SLEEP);
525 if (ddi_copyin((void *) arg, ioc, sizeof (*ioc), flags)) {
526 err = EFAULT;
527 goto out;
528 }
529 ioc->ioc_title[SMBIOC_MAX_NAME-1] = '\0';
530
531 /* Do the OtW open, save the FID. */
532 err = smb_smb_open_prjob(ssp, ioc->ioc_title,
533 ioc->ioc_setuplen, ioc->ioc_prmode,
534 &scred, &fid);
535 if (err != 0)
536 goto out;
537
538 sdp->sd_smbfid = fid;
539 sdp->sd_vcgenid = ssp->ss_vcgenid;
540
541 out:
542 kmem_free(ioc, sizeof (*ioc));
543 smb_credrele(&scred);
544
545 return (err);
546 }
547
548 /*
549 * Helper for nsmb_ioctl case
550 * SMBIOC_CLOSEFH
551 */
552 int
553 smb_usr_closefh(smb_dev_t *sdp, cred_t *cr)
554 {
555 struct smb_cred scred;
556 struct smb_share *ssp;
557 uint16_t fid;
558 int err;
559
560 /* This ioctl requires a share. */
561 if ((ssp = sdp->sd_share) == NULL)
562 return (ENOTCONN);
563
564 if (sdp->sd_smbfid == -1)
565 return (0);
566 fid = (uint16_t)sdp->sd_smbfid;
567 sdp->sd_smbfid = -1;
568
569 smb_credinit(&scred, cr);
570 if (ssp->ss_type == STYPE_PRINTQ)
571 err = smb_smb_close_prjob(ssp, fid, &scred);
572 else
573 err = smb_smb_close(ssp, fid, NULL, &scred);
574 smb_credrele(&scred);
575
576 return (err);
577 }
578
579 /*
580 * Ioctl functions: SMBIOC_SSN_FIND, SMBIOC_SSN_CREATE
581 * Find or create a session (a.k.a. "VC" in here)
582 */
583 int
584 smb_usr_get_ssn(smb_dev_t *sdp, int cmd, intptr_t arg, int flags, cred_t *cr)
585 {
586 struct smb_cred scred;
587 smbioc_ossn_t *ossn = NULL;
588 struct smb_vc *vcp = NULL;
589 int error = 0;
590 uid_t realuid;
591
592 /* Should be no VC */
593 if (sdp->sd_vc != NULL)
594 return (EISCONN);
595
596 smb_credinit(&scred, cr);
597 ossn = kmem_alloc(sizeof (*ossn), KM_SLEEP);
598 if (ddi_copyin((void *)arg, ossn, sizeof (*ossn), flags)) {
599 error = EFAULT;
600 goto out;
601 }
602
603 /*
604 * Only superuser can specify a UID or GID.
605 */
606 realuid = crgetruid(cr);
607 if (ossn->ssn_owner == SMBM_ANY_OWNER)
608 ossn->ssn_owner = realuid;
609 else {
610 /*
611 * Do we have the privilege to create with the
612 * specified uid? (does uid == cr->cr_uid, etc.)
613 */
614 if (secpolicy_vnode_owner(cr, ossn->ssn_owner)) {
615 error = EPERM;
616 goto out;
617 }
618 /* ossn->ssn_owner is OK */
619 }
620
621 /*
622 * Make sure the strings are null terminated.
623 */
624 ossn->ssn_srvname[SMBIOC_MAX_NAME-1] = '\0';
625 ossn->ssn_id.id_domain[ SMBIOC_MAX_NAME-1] = '\0';
626 ossn->ssn_id.id_user[ SMBIOC_MAX_NAME-1] = '\0';
627
628 if (cmd == SMBIOC_SSN_CREATE)
629 ossn->ssn_vopt |= SMBVOPT_CREATE;
630 else /* FIND */
631 ossn->ssn_vopt &= ~SMBVOPT_CREATE;
632
633 error = smb_vc_findcreate(ossn, &scred, &vcp);
634 if (error)
635 goto out;
636 ASSERT(vcp != NULL);
637
638 /*
639 * We have a VC, held, but not locked.
640 * If we're creating, mark this instance as
641 * an open from IOD so close can do cleanup.
642 *
643 * XXX: Would be nice to have a back pointer
644 * from the VC to this (IOD) sdp instance.
645 */
646 if (cmd == SMBIOC_SSN_CREATE) {
647 if (vcp->iod_thr != NULL) {
648 error = EEXIST;
649 goto out;
650 }
651 sdp->sd_flags |= NSMBFL_IOD;
652 } else {
653 /*
654 * Wait for it to finish connecting
655 * (or reconnect) if necessary.
656 */
657 if (vcp->vc_state != SMBIOD_ST_VCACTIVE) {
658 error = smb_iod_reconnect(vcp);
659 if (error != 0)
660 goto out;
661 }
662 }
663
664 /*
665 * The VC has a hold from _findvc
666 * which we keep until _SSN_RELE
667 * or nsmb_close().
668 */
669 sdp->sd_level = SMBL_VC;
670 sdp->sd_vc = vcp;
671 vcp = NULL;
672 (void) ddi_copyout(ossn, (void *)arg, sizeof (*ossn), flags);
673
674 out:
675 if (vcp) {
676 /* Error path: rele hold from _findcreate */
677 smb_vc_rele(vcp);
678 }
679 kmem_free(ossn, sizeof (*ossn));
680 smb_credrele(&scred);
681
682 return (error);
683 }
684
685 /*
686 * Ioctl functions: SMBIOC_SSN_RELE, SMBIOC_SSN_KILL
687 * Release or kill the current session.
688 */
689 int
690 smb_usr_drop_ssn(smb_dev_t *sdp, int cmd)
691 {
692 struct smb_vc *vcp = NULL;
693
694 /* Must have a VC. */
695 if ((vcp = sdp->sd_vc) == NULL)
696 return (ENOTCONN);
697
698 /* If we have a share ref, drop it too. */
699 if (sdp->sd_share) {
700 smb_share_rele(sdp->sd_share);
701 sdp->sd_share = NULL;
702 sdp->sd_level = SMBL_VC;
703 }
704
705 if (cmd == SMBIOC_SSN_KILL)
706 smb_vc_kill(vcp);
707
708 /* Drop the VC ref. */
709 smb_vc_rele(vcp);
710 sdp->sd_vc = NULL;
711 sdp->sd_level = 0;
712
713 return (0);
714 }
715
716 /*
717 * Find or create a tree (connected share)
718 */
719 int
720 smb_usr_get_tree(smb_dev_t *sdp, int cmd, intptr_t arg, int flags, cred_t *cr)
721 {
722 struct smb_cred scred;
723 smbioc_tcon_t *tcon = NULL;
724 struct smb_vc *vcp = NULL;
725 struct smb_share *ssp = NULL;
726 int error = 0;
727
728 /* Must have a VC. */
729 if ((vcp = sdp->sd_vc) == NULL)
730 return (ENOTCONN);
731 /* Should not have a share. */
732 if (sdp->sd_share != NULL)
733 return (EISCONN);
734
735 smb_credinit(&scred, cr);
736 tcon = kmem_alloc(sizeof (*tcon), KM_SLEEP);
737 if (ddi_copyin((void *)arg, tcon, sizeof (*tcon), flags)) {
738 error = EFAULT;
739 goto out;
740 }
741
742 /*
743 * Make sure the strings are null terminated.
744 */
745 tcon->tc_sh.sh_name[SMBIOC_MAX_NAME-1] = '\0';
746 tcon->tc_sh.sh_pass[SMBIOC_MAX_NAME-1] = '\0';
747
748 if (cmd == SMBIOC_TREE_CONNECT)
749 tcon->tc_opt |= SMBSOPT_CREATE;
750 else /* FIND */
751 tcon->tc_opt &= ~SMBSOPT_CREATE;
752
753 error = smb_share_findcreate(tcon, vcp, &ssp, &scred);
754 if (error)
755 goto out;
756 ASSERT(ssp != NULL);
757
758 /*
759 * We have a share, held, but not locked.
760 * If we're creating, do tree connect now,
761 * otherwise let that wait for a request.
762 */
763 if (cmd == SMBIOC_TREE_CONNECT) {
764 error = smb_share_tcon(ssp, &scred);
765 if (error)
766 goto out;
767 }
768
769 /*
770 * Give caller the real share type from
771 * the tree connect response, so they can
772 * see if they got the requested type.
773 */
774 tcon->tc_sh.sh_type = ssp->ss_type;
775
776 /*
777 * The share has a hold from _tcon
778 * which we keep until nsmb_close()
779 * or the SMBIOC_TDIS below.
780 */
781 sdp->sd_level = SMBL_SHARE;
782 sdp->sd_share = ssp;
783 ssp = NULL;
784 (void) ddi_copyout(tcon, (void *)arg, sizeof (*tcon), flags);
785
786 out:
787 if (ssp) {
788 /* Error path: rele hold from _findcreate */
789 smb_share_rele(ssp);
790 }
791 /*
792 * This structure may contain a
793 * cleartext password, so zap it.
794 */
795 bzero(tcon, sizeof (*tcon));
796 kmem_free(tcon, sizeof (*tcon));
797 smb_credrele(&scred);
798
799 return (error);
800 }
801
802 /*
803 * Ioctl functions: SMBIOC_TREE_RELE, SMBIOC_TREE_KILL
804 * Release or kill the current tree
805 */
806 int
807 smb_usr_drop_tree(smb_dev_t *sdp, int cmd)
808 {
809 struct smb_share *ssp = NULL;
810
811 /* Must have a VC and a share. */
812 if (sdp->sd_vc == NULL)
813 return (ENOTCONN);
814 if ((ssp = sdp->sd_share) == NULL)
815 return (ENOTCONN);
816
817 if (cmd == SMBIOC_TREE_KILL)
818 smb_share_kill(ssp);
819
820 /* Drop the share ref. */
821 smb_share_rele(sdp->sd_share);
822 sdp->sd_share = NULL;
823 sdp->sd_level = SMBL_VC;
824
825 return (0);
826 }
827
828
829 /*
830 * Ioctl function: SMBIOC_IOD_WORK
831 *
832 * Become the reader (IOD) thread, until either the connection is
833 * reset by the server, or until the connection is idle longer than
834 * some max time. (max idle time not yet implemented)
835 */
836 int
837 smb_usr_iod_work(smb_dev_t *sdp, intptr_t arg, int flags, cred_t *cr)
838 {
839 struct smb_vc *vcp = NULL;
840 int err = 0;
841
842 /* Must have a valid session. */
843 if ((vcp = sdp->sd_vc) == NULL)
844 return (EINVAL);
845 if (vcp->vc_flags & SMBV_GONE)
846 return (EINVAL);
847
848 /*
849 * Is there already an IOD for this VC?
850 * (Should never happen.)
851 */
852 SMB_VC_LOCK(vcp);
853 if (vcp->iod_thr == NULL)
854 vcp->iod_thr = curthread;
855 else
856 err = EEXIST;
857 SMB_VC_UNLOCK(vcp);
858 if (err)
859 return (err);
860
861 /*
862 * Copy the "work" state, etc. into the VC
863 * The MAC key is copied separately.
864 */
865 if (ddi_copyin((void *)arg, &vcp->vc_work,
866 sizeof (smbioc_ssn_work_t), flags)) {
867 err = EFAULT;
868 goto out;
869 }
870 if (vcp->vc_u_maclen) {
871 vcp->vc_mackeylen = vcp->vc_u_maclen;
872 vcp->vc_mackey = kmem_alloc(vcp->vc_mackeylen, KM_SLEEP);
873 if (ddi_copyin(vcp->vc_u_mackey.lp_ptr, vcp->vc_mackey,
874 vcp->vc_mackeylen, flags)) {
875 err = EFAULT;
876 goto out;
877 }
878 }
879
880 err = smb_iod_vc_work(vcp, cr);
881
882 /* Caller wants state here. */
883 vcp->vc_work.wk_out_state = vcp->vc_state;
884
885 (void) ddi_copyout(&vcp->vc_work, (void *)arg,
886 sizeof (smbioc_ssn_work_t), flags);
887
888 out:
889 if (vcp->vc_mackey) {
890 kmem_free(vcp->vc_mackey, vcp->vc_mackeylen);
891 vcp->vc_mackey = NULL;
892 vcp->vc_mackeylen = 0;
893 }
894
895 /*
896 * The IOD thread is leaving the driver. Clear iod_thr,
897 * and wake up anybody waiting for us to quit.
898 */
899 SMB_VC_LOCK(vcp);
900 vcp->iod_thr = NULL;
901 cv_broadcast(&vcp->vc_statechg);
902 SMB_VC_UNLOCK(vcp);
903
904 return (err);
905 }
906
907 /*
908 * Ioctl functions: SMBIOC_IOD_IDLE, SMBIOC_IOD_RCFAIL
909 *
910 * Wait for user-level requests to be enqueued on this session,
911 * and then return to the user-space helper, which will then
912 * initiate a reconnect, etc.
913 */
914 int
915 smb_usr_iod_ioctl(smb_dev_t *sdp, int cmd, intptr_t arg, int flags)
916 {
917 struct smb_vc *vcp = NULL;
918 int err = 0;
919
920 /* Must have a valid session. */
921 if ((vcp = sdp->sd_vc) == NULL)
922 return (EINVAL);
923 if (vcp->vc_flags & SMBV_GONE)
924 return (EINVAL);
925
926 /*
927 * Is there already an IOD for this VC?
928 * (Should never happen.)
929 */
930 SMB_VC_LOCK(vcp);
931 if (vcp->iod_thr == NULL)
932 vcp->iod_thr = curthread;
933 else
934 err = EEXIST;
935 SMB_VC_UNLOCK(vcp);
936 if (err)
937 return (err);
938
939 /* nothing to copyin */
940
941 switch (cmd) {
942 case SMBIOC_IOD_IDLE:
943 err = smb_iod_vc_idle(vcp);
944 break;
945
946 case SMBIOC_IOD_RCFAIL:
947 err = smb_iod_vc_rcfail(vcp);
948 break;
949
950 default:
951 err = ENOTTY;
952 goto out;
953 }
954
955 /* Both of these ioctls copy out the new state. */
956 (void) ddi_copyout(&vcp->vc_state, (void *)arg,
957 sizeof (int), flags);
958
959 out:
960 /*
961 * The IOD thread is leaving the driver. Clear iod_thr,
962 * and wake up anybody waiting for us to quit.
963 */
964 SMB_VC_LOCK(vcp);
965 vcp->iod_thr = NULL;
966 cv_broadcast(&vcp->vc_statechg);
967 SMB_VC_UNLOCK(vcp);
968
969 return (err);
970 }