1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2014 Nexenta Systems, Inc. All rights reserved.
25 */
26
27 #include <smbsrv/smb_kproto.h>
28 #include <smbsrv/smb_fsops.h>
29 #include <smbsrv/smb_share.h>
30 #include <smbsrv/string.h>
31 #include <smbsrv/nmpipes.h>
32 #include <smbsrv/mailslot.h>
33 #include <smbsrv/winioctl.h>
34
35 /*
36 * count of bytes in server response packet
37 * except parameters and data. Note that setup
38 * word count is zero.
39 */
40 #define RESP_HEADER_LEN 24
41
42 /*
43 * We started by using common functions for transaction/transaction2
44 * and transaction_secondary/transaction2_secondary because they
45 * are respectively so similar. However, it turned out to be a bad
46 * idea because of quirky differences. Be sure if you modify one
47 * of these four functions to check and see if the modification should
48 * be applied to its peer.
49 */
50
51 static int smb_trans_ready(smb_xa_t *);
52 static smb_sdrc_t smb_trans_dispatch(smb_request_t *, smb_xa_t *);
53 static smb_sdrc_t smb_trans2_dispatch(smb_request_t *, smb_xa_t *);
54
55 smb_sdrc_t
56 smb_pre_transaction(smb_request_t *sr)
57 {
58 DTRACE_SMB_1(op__Transaction__start, smb_request_t *, sr);
59 return (SDRC_SUCCESS);
60 }
61
62 void
63 smb_post_transaction(smb_request_t *sr)
64 {
65 DTRACE_SMB_1(op__Transaction__done, smb_request_t *, sr);
66 }
67
68 smb_sdrc_t
69 smb_com_transaction(smb_request_t *sr)
70 {
71 int rc;
72 unsigned char msrcnt, suwcnt;
73 uint16_t tpscnt, tdscnt, mprcnt, mdrcnt, flags;
74 uint16_t pscnt, psoff, dscnt, dsoff;
75 uint32_t timeo;
76 struct smb_xa *xa;
77 char *stn;
78 int ready;
79
80 if (!STYPE_ISIPC(sr->tid_tree->t_res_type)) {
81 smbsr_error(sr, 0, ERRDOS, ERRnoaccess);
82 return (SDRC_ERROR);
83 }
84
85 rc = smbsr_decode_vwv(sr, SMB_TRANSHDR_ED_FMT,
86 &tpscnt, &tdscnt, &mprcnt, &mdrcnt, &msrcnt, &flags,
87 &timeo, &pscnt, &psoff, &dscnt, &dsoff, &suwcnt);
88
89 if (rc != 0)
90 return (SDRC_ERROR);
91
92 xa = smb_xa_create(sr->session, sr, tpscnt, tdscnt, mprcnt, mdrcnt,
93 msrcnt, suwcnt);
94 if (xa == NULL) {
95 smbsr_error(sr, 0, ERRSRV, ERRnoroom);
96 return (SDRC_ERROR);
97 }
98
99 /* Should be some alignment stuff here in SMB? */
100 if (sr->smb_flg2 & SMB_FLAGS2_UNICODE) {
101 rc = smbsr_decode_data(sr, "%.U", sr, &stn);
102 } else {
103 rc = smbsr_decode_data(sr, "%s", sr, &stn);
104 }
105 if (rc != 0) {
106 smb_xa_rele(sr->session, xa);
107 return (SDRC_ERROR);
108 }
109
110 xa->xa_pipe_name = smb_mem_strdup(stn);
111 xa->smb_flags = flags;
112 xa->smb_timeout = timeo;
113 xa->req_disp_param = pscnt;
114 xa->req_disp_data = dscnt;
115
116 if (smb_mbc_copy(&xa->req_setup_mb, &sr->smb_vwv,
117 sr->smb_vwv.chain_offset, suwcnt * 2)) {
118 smb_xa_rele(sr->session, xa);
119 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
120 return (SDRC_ERROR);
121 }
122 if (smb_mbc_copy(&xa->req_param_mb, &sr->command, psoff, pscnt)) {
123 smb_xa_rele(sr->session, xa);
124 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
125 return (SDRC_ERROR);
126 }
127 if (smb_mbc_copy(&xa->req_data_mb, &sr->command, dsoff, dscnt)) {
128 smb_xa_rele(sr->session, xa);
129 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
130 return (SDRC_ERROR);
131 }
132
133 ready = smb_trans_ready(xa);
134
135 if (smb_xa_open(xa)) {
136 smb_xa_rele(sr->session, xa);
137 smbsr_error(sr, 0, ERRSRV, ERRsrverror);
138 return (SDRC_ERROR);
139 }
140 sr->r_xa = xa;
141
142 if (!ready) {
143 rc = smbsr_encode_empty_result(sr);
144 return ((rc == 0) ? SDRC_SUCCESS : SDRC_ERROR);
145 }
146
147 if (!smb_xa_complete(xa)) {
148 smb_xa_close(xa);
149 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
150 return (SDRC_ERROR);
151 }
152
153 return (smb_trans_dispatch(sr, xa));
154 }
155
156 smb_sdrc_t
157 smb_pre_transaction_secondary(smb_request_t *sr)
158 {
159 DTRACE_SMB_1(op__TransactionSecondary__start, smb_request_t *, sr);
160 return (SDRC_SUCCESS);
161 }
162
163 void
164 smb_post_transaction_secondary(smb_request_t *sr)
165 {
166 DTRACE_SMB_1(op__TransactionSecondary__done, smb_request_t *, sr);
167 }
168
169 smb_sdrc_t
170 smb_com_transaction_secondary(smb_request_t *sr)
171 {
172 uint16_t tpscnt, tdscnt, pscnt, psdisp;
173 uint16_t dscnt, dsoff, dsdisp, psoff;
174 smb_xa_t *xa;
175 int rc;
176
177 if ((xa = smbsr_lookup_xa(sr)) == 0) {
178 smbsr_error(sr, 0, ERRSRV, ERRsrverror);
179 return (SDRC_ERROR);
180 }
181
182 if (sr->session->signing.flags & SMB_SIGNING_ENABLED) {
183 if (smb_sign_check_secondary(sr, xa->reply_seqnum) != 0) {
184 smbsr_error(sr, NT_STATUS_ACCESS_DENIED,
185 ERRDOS, ERRnoaccess);
186 return (SDRC_ERROR);
187 }
188 }
189
190 if (xa->smb_com != SMB_COM_TRANSACTION) {
191 return (SDRC_DROP_VC);
192 }
193
194 rc = smbsr_decode_vwv(sr, SMB_TRANSSHDR_ED_FMT, &tpscnt, &tdscnt,
195 &pscnt, &psoff, &psdisp, &dscnt, &dsoff, &dsdisp);
196
197 if (rc != 0)
198 return (SDRC_ERROR);
199
200 mutex_enter(&xa->xa_mutex);
201 if (xa->smb_tpscnt > tpscnt)
202 xa->smb_tpscnt = tpscnt;
203 if (xa->smb_tdscnt > tdscnt)
204 xa->smb_tdscnt = tdscnt;
205 xa->req_disp_param = psdisp + pscnt;
206 xa->req_disp_data = dsdisp + dscnt;
207
208 /*
209 * The words psdisp, dsdisp, tell us what displacement
210 * into the entire trans parameter and data buffers
211 * where we should put the params & data that are
212 * delivered by this request. [MS-CIFS] says all the
213 * parameters and data SHOULD be sent sequentially, so
214 * so we can normally reassemble by simply appending.
215 * However, the components MAY come out of order, so
216 * check and set the current offset. This is rare,
217 * and we might like to know when this happens, so
218 * fire some static dtrace probes when it does.
219 */
220 if (xa->req_param_mb.chain_offset != psdisp) {
221 DTRACE_PROBE2(trans_param_disp,
222 smb_xa_t *, xa, uint16_t, psdisp);
223 xa->req_param_mb.chain_offset = psdisp;
224 }
225 if (xa->req_data_mb.chain_offset != dsdisp) {
226 DTRACE_PROBE2(trans_data_disp,
227 smb_xa_t *, xa, uint16_t, dsdisp);
228 xa->req_data_mb.chain_offset = dsdisp;
229 }
230
231 if (smb_mbc_copy(&xa->req_param_mb, &sr->command, psoff, pscnt)) {
232 mutex_exit(&xa->xa_mutex);
233 smb_xa_close(xa);
234 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
235 return (SDRC_ERROR);
236 }
237 if (smb_mbc_copy(&xa->req_data_mb, &sr->command, dsoff, dscnt)) {
238 mutex_exit(&xa->xa_mutex);
239 smb_xa_close(xa);
240 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
241 return (SDRC_ERROR);
242 }
243 mutex_exit(&xa->xa_mutex);
244
245 if (!smb_trans_ready(xa))
246 return (SDRC_NO_REPLY);
247
248 if (!smb_xa_complete(xa))
249 return (SDRC_NO_REPLY);
250
251 return (smb_trans_dispatch(sr, xa));
252 }
253
254 smb_sdrc_t
255 smb_pre_ioctl(smb_request_t *sr)
256 {
257 DTRACE_SMB_1(op__Ioctl__start, smb_request_t *, sr);
258 return (SDRC_SUCCESS);
259 }
260
261 void
262 smb_post_ioctl(smb_request_t *sr)
263 {
264 DTRACE_SMB_1(op__Ioctl__done, smb_request_t *, sr);
265 }
266
267 smb_sdrc_t
268 smb_com_ioctl(smb_request_t *sr)
269 {
270 uint16_t fid, category, function, tpscnt, tdscnt, mprcnt;
271 uint16_t mdrcnt, pscnt, pdoff, dscnt, dsoff;
272 uint32_t timeout;
273 int rc;
274
275 rc = smbsr_decode_vwv(sr, "wwwwwwwl2.wwww", &fid, &category, &function,
276 &tpscnt, &tdscnt, &mprcnt, &mdrcnt, &timeout, &pscnt,
277 &pdoff, &dscnt, &dsoff);
278
279 if (rc != 0)
280 return (SDRC_ERROR);
281
282 return (SDRC_NOT_IMPLEMENTED);
283 }
284
285 smb_sdrc_t
286 smb_pre_transaction2(smb_request_t *sr)
287 {
288 DTRACE_SMB_1(op__Transaction2__start, smb_request_t *, sr);
289 return (SDRC_SUCCESS);
290 }
291
292 void
293 smb_post_transaction2(smb_request_t *sr)
294 {
295 DTRACE_SMB_1(op__Transaction2__done, smb_request_t *, sr);
296 }
297
298 smb_sdrc_t
299 smb_com_transaction2(struct smb_request *sr)
300 {
301 unsigned char msrcnt, suwcnt;
302 uint16_t tpscnt, tdscnt, mprcnt, mdrcnt, flags;
303 uint16_t pscnt, psoff, dscnt, dsoff;
304 uint32_t timeo;
305 smb_xa_t *xa;
306 int ready;
307 int rc;
308
309 rc = smbsr_decode_vwv(sr, SMB_TRANSHDR_ED_FMT, &tpscnt, &tdscnt,
310 &mprcnt, &mdrcnt, &msrcnt, &flags, &timeo, &pscnt, &psoff, &dscnt,
311 &dsoff, &suwcnt);
312
313 if (rc != 0)
314 return (SDRC_ERROR);
315
316 xa = smb_xa_create(sr->session, sr, tpscnt, tdscnt, mprcnt, mdrcnt,
317 msrcnt, suwcnt);
318 if (xa == 0) {
319 smbsr_error(sr, 0, ERRSRV, ERRnoroom);
320 return (SDRC_ERROR);
321 }
322
323 xa->smb_flags = flags;
324 xa->smb_timeout = timeo;
325 xa->req_disp_param = pscnt;
326 xa->req_disp_data = dscnt;
327
328 if (smb_mbc_copy(&xa->req_setup_mb, &sr->smb_vwv,
329 sr->smb_vwv.chain_offset, suwcnt*2)) {
330 smb_xa_rele(sr->session, xa);
331 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
332 return (SDRC_ERROR);
333 }
334 if (smb_mbc_copy(&xa->req_param_mb, &sr->command, psoff, pscnt)) {
335 smb_xa_rele(sr->session, xa);
336 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
337 return (SDRC_ERROR);
338 }
339 if (smb_mbc_copy(&xa->req_data_mb, &sr->command, dsoff, dscnt)) {
340 smb_xa_rele(sr->session, xa);
341 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
342 return (SDRC_ERROR);
343 }
344
345 ready = smb_trans_ready(xa);
346
347 if (smb_xa_open(xa)) {
348 smb_xa_rele(sr->session, xa);
349 smbsr_error(sr, 0, ERRSRV, ERRsrverror);
350 return (SDRC_ERROR);
351 }
352 sr->r_xa = xa;
353
354 if (!ready) {
355 rc = smbsr_encode_empty_result(sr);
356 return ((rc == 0) ? SDRC_SUCCESS : SDRC_ERROR);
357 }
358
359 if (!smb_xa_complete(xa)) {
360 smb_xa_close(xa);
361 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
362 return (SDRC_ERROR);
363 }
364
365 return (smb_trans2_dispatch(sr, xa));
366 }
367
368 smb_sdrc_t
369 smb_pre_transaction2_secondary(smb_request_t *sr)
370 {
371 DTRACE_SMB_1(op__Transaction2Secondary__start, smb_request_t *, sr);
372 return (SDRC_SUCCESS);
373 }
374
375 void
376 smb_post_transaction2_secondary(smb_request_t *sr)
377 {
378 DTRACE_SMB_1(op__Transaction2Secondary__done, smb_request_t *, sr);
379 }
380
381 smb_sdrc_t
382 smb_com_transaction2_secondary(smb_request_t *sr)
383 {
384 uint16_t tpscnt, tdscnt, fid;
385 uint16_t pscnt, psoff, psdisp, dscnt, dsoff, dsdisp;
386 smb_xa_t *xa;
387 int rc;
388
389 if ((xa = smbsr_lookup_xa(sr)) == 0) {
390 smbsr_error(sr, 0, ERRSRV, ERRsrverror);
391 return (SDRC_ERROR);
392 }
393
394 if (sr->session->signing.flags & SMB_SIGNING_ENABLED) {
395 if (smb_sign_check_secondary(sr, xa->reply_seqnum) != 0) {
396 smbsr_error(sr, NT_STATUS_ACCESS_DENIED,
397 ERRDOS, ERRnoaccess);
398 return (SDRC_ERROR);
399 }
400 }
401
402 if (xa->smb_com != SMB_COM_TRANSACTION2) {
403 return (SDRC_DROP_VC);
404 }
405
406 rc = smbsr_decode_vwv(sr, SMB_TRANS2SHDR_ED_FMT, &tpscnt, &tdscnt,
407 &pscnt, &psoff, &psdisp, &dscnt, &dsoff, &dsdisp, &fid);
408
409 if (rc != 0)
410 return (SDRC_ERROR);
411
412 mutex_enter(&xa->xa_mutex);
413 if (xa->smb_tpscnt > tpscnt)
414 xa->smb_tpscnt = tpscnt;
415 if (xa->smb_tdscnt > tdscnt)
416 xa->smb_tdscnt = tdscnt;
417 if (fid != 0xFFFF)
418 xa->xa_smb_fid = fid;
419 xa->req_disp_param = psdisp + pscnt;
420 xa->req_disp_data = dsdisp + dscnt;
421
422 /*
423 * See comment in smb_com_transaction_secondary
424 */
425 if (xa->req_param_mb.chain_offset != psdisp) {
426 DTRACE_PROBE2(trans_param_disp,
427 smb_xa_t *, xa, uint16_t, psdisp);
428 xa->req_param_mb.chain_offset = psdisp;
429 }
430 if (xa->req_data_mb.chain_offset != dsdisp) {
431 DTRACE_PROBE2(trans_data_disp,
432 smb_xa_t *, xa, uint16_t, dsdisp);
433 xa->req_data_mb.chain_offset = dsdisp;
434 }
435
436 if (smb_mbc_copy(&xa->req_param_mb, &sr->command, psoff, pscnt)) {
437 mutex_exit(&xa->xa_mutex);
438 smb_xa_close(xa);
439 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
440 return (SDRC_ERROR);
441 }
442 if (smb_mbc_copy(&xa->req_data_mb, &sr->command, dsoff, dscnt)) {
443 mutex_exit(&xa->xa_mutex);
444 smb_xa_close(xa);
445 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
446 return (SDRC_ERROR);
447 }
448 mutex_exit(&xa->xa_mutex);
449
450 if (!smb_trans_ready(xa))
451 return (SDRC_NO_REPLY);
452
453 if (!smb_xa_complete(xa))
454 return (SDRC_NO_REPLY);
455
456 return (smb_trans2_dispatch(sr, xa));
457 }
458
459 static smb_sdrc_t
460 smb_nt_trans_dispatch(struct smb_request *sr, struct smb_xa *xa)
461 {
462 int rc;
463 int total_bytes, n_setup, n_param, n_data;
464 int param_off, param_pad, data_off, data_pad;
465
466 switch (xa->smb_func) {
467 case NT_TRANSACT_CREATE:
468 if ((rc = smb_pre_nt_transact_create(sr, xa)) == 0)
469 rc = smb_nt_transact_create(sr, xa);
470 smb_post_nt_transact_create(sr, xa);
471 break;
472 case NT_TRANSACT_NOTIFY_CHANGE:
473 rc = smb_nt_transact_notify_change(sr, xa);
474 break;
475 case NT_TRANSACT_QUERY_SECURITY_DESC:
476 rc = smb_nt_transact_query_security_info(sr, xa);
477 break;
478 case NT_TRANSACT_SET_SECURITY_DESC:
479 rc = smb_nt_transact_set_security_info(sr, xa);
480 break;
481 case NT_TRANSACT_IOCTL:
482 rc = smb_nt_transact_ioctl(sr, xa);
483 break;
484 case NT_TRANSACT_QUERY_QUOTA:
485 rc = smb_nt_transact_query_quota(sr, xa);
486 break;
487 case NT_TRANSACT_SET_QUOTA:
488 rc = smb_nt_transact_set_quota(sr, xa);
489 break;
490 case NT_TRANSACT_RENAME:
491 rc = smb_nt_transact_rename(sr, xa);
492 break;
493
494 default:
495 smbsr_error(sr, 0, ERRSRV, ERRsmbcmd);
496 return (SDRC_ERROR);
497 }
498
499 switch (rc) {
500 case SDRC_SUCCESS:
501 break;
502
503 case SDRC_DROP_VC:
504 case SDRC_NO_REPLY:
505 case SDRC_ERROR:
506 case SDRC_SR_KEPT:
507 return (rc);
508
509 case SDRC_NOT_IMPLEMENTED:
510 smbsr_error(sr, 0, ERRSRV, ERRsmbcmd);
511 return (SDRC_ERROR);
512
513 default:
514 break;
515 }
516
517 n_setup = MBC_LENGTH(&xa->rep_setup_mb);
518 n_param = MBC_LENGTH(&xa->rep_param_mb);
519 n_data = MBC_LENGTH(&xa->rep_data_mb);
520
521 if (xa->smb_msrcnt < n_setup ||
522 xa->smb_mprcnt < n_param ||
523 xa->smb_mdrcnt < n_data) {
524 smbsr_error(sr, 0, ERRSRV, ERRsmbcmd);
525 return (SDRC_ERROR);
526 }
527
528 /* neato, blast it over there */
529
530 n_setup = (n_setup + 1) / 2; /* Conver to setup words */
531 param_pad = 1; /* must be one */
532 param_off = param_pad + 32 + 37 + (n_setup << 1) + 2;
533 data_pad = (4 - ((param_off + n_param) & 3)) % 4; /* Pad to 4 byte */
534 data_off = param_off + n_param + data_pad; /* Param off from hdr */
535 total_bytes = param_pad + n_param + data_pad + n_data;
536
537 rc = smbsr_encode_result(sr, 18+n_setup, total_bytes,
538 "b3.llllllllbCw#.C#.C",
539 18 + n_setup, /* wct */
540 n_param, /* Total Parameter Bytes */
541 n_data, /* Total Data Bytes */
542 n_param, /* Total Parameter Bytes this buffer */
543 param_off, /* Param offset from header start */
544 0, /* Param displacement */
545 n_data, /* Total Data Bytes this buffer */
546 data_off, /* Data offset from header start */
547 0, /* Data displacement */
548 n_setup, /* suwcnt */
549 &xa->rep_setup_mb, /* setup[] */
550 total_bytes, /* Total data bytes */
551 param_pad,
552 &xa->rep_param_mb,
553 data_pad,
554 &xa->rep_data_mb);
555 return ((rc == 0) ? SDRC_SUCCESS : SDRC_ERROR);
556 }
557
558 smb_sdrc_t
559 smb_pre_nt_transact(smb_request_t *sr)
560 {
561 DTRACE_SMB_1(op__NtTransact__start, smb_request_t *, sr);
562 return (SDRC_SUCCESS);
563 }
564
565 void
566 smb_post_nt_transact(smb_request_t *sr)
567 {
568 DTRACE_SMB_1(op__NtTransact__done, smb_request_t *, sr);
569 }
570
571 smb_sdrc_t
572 smb_com_nt_transact(struct smb_request *sr)
573 {
574 uint16_t Function;
575 unsigned char MaxSetupCount, SetupCount;
576 uint32_t TotalParameterCount, TotalDataCount;
577 uint32_t MaxParameterCount, MaxDataCount, pscnt;
578 uint32_t psoff, dscnt, dsoff;
579 smb_xa_t *xa;
580 int ready;
581 int rc;
582
583 rc = smbsr_decode_vwv(sr, SMB_NT_TRANSHDR_ED_FMT, &MaxSetupCount,
584 &TotalParameterCount, &TotalDataCount, &MaxParameterCount,
585 &MaxDataCount, &pscnt, &psoff, &dscnt,
586 &dsoff, &SetupCount, &Function);
587
588 if (rc != 0)
589 return (SDRC_ERROR);
590
591 xa = smb_xa_create(sr->session, sr, TotalParameterCount, TotalDataCount,
592 MaxParameterCount, MaxDataCount, MaxSetupCount, SetupCount);
593 if (xa == 0) {
594 smbsr_error(sr, 0, ERRSRV, ERRnoroom);
595 return (SDRC_ERROR);
596 }
597
598 xa->smb_flags = 0;
599 xa->smb_timeout = 0;
600 xa->smb_func = Function;
601 xa->req_disp_param = pscnt;
602 xa->req_disp_data = dscnt;
603
604 if (smb_mbc_copy(&xa->req_setup_mb, &sr->smb_vwv,
605 sr->smb_vwv.chain_offset, SetupCount * 2)) {
606 smb_xa_rele(sr->session, xa);
607 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
608 return (SDRC_ERROR);
609 }
610 if (smb_mbc_copy(&xa->req_param_mb, &sr->command, psoff, pscnt)) {
611 smb_xa_rele(sr->session, xa);
612 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
613 return (SDRC_ERROR);
614 }
615 if (smb_mbc_copy(&xa->req_data_mb, &sr->command, dsoff, dscnt)) {
616 smb_xa_rele(sr->session, xa);
617 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
618 return (SDRC_ERROR);
619 }
620
621 ready = smb_trans_ready(xa);
622
623 if (smb_xa_open(xa)) {
624 smb_xa_rele(sr->session, xa);
625 smbsr_error(sr, 0, ERRSRV, ERRsrverror);
626 return (SDRC_ERROR);
627 }
628 sr->r_xa = xa;
629
630 if (!ready) {
631 rc = smbsr_encode_empty_result(sr);
632 return ((rc == 0) ? SDRC_SUCCESS : SDRC_ERROR);
633 }
634
635 if (!smb_xa_complete(xa)) {
636 smb_xa_close(xa);
637 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
638 return (SDRC_ERROR);
639 }
640
641 return (smb_nt_trans_dispatch(sr, xa));
642 }
643
644 smb_sdrc_t
645 smb_pre_nt_transact_secondary(smb_request_t *sr)
646 {
647 DTRACE_SMB_1(op__NtTransactSecondary__start, smb_request_t *, sr);
648 return (SDRC_SUCCESS);
649 }
650
651 void
652 smb_post_nt_transact_secondary(smb_request_t *sr)
653 {
654 DTRACE_SMB_1(op__NtTransactSecondary__done, smb_request_t *, sr);
655 }
656
657 smb_sdrc_t
658 smb_com_nt_transact_secondary(struct smb_request *sr)
659 {
660 uint16_t tpscnt, tdscnt, fid;
661 uint16_t pscnt, psoff, psdisp, dscnt, dsoff, dsdisp;
662 smb_xa_t *xa;
663 int rc;
664
665 if ((xa = smbsr_lookup_xa(sr)) == 0) {
666 smbsr_error(sr, 0, ERRSRV, ERRsrverror);
667 return (SDRC_ERROR);
668 }
669
670 if (sr->session->signing.flags & SMB_SIGNING_ENABLED) {
671 if (smb_sign_check_secondary(sr, xa->reply_seqnum) != 0) {
672 smbsr_error(sr, NT_STATUS_ACCESS_DENIED,
673 ERRDOS, ERRnoaccess);
674 return (SDRC_ERROR);
675 }
676 }
677
678 if (xa->smb_com != SMB_COM_TRANSACTION2) {
679 return (SDRC_DROP_VC);
680 }
681
682 rc = smbsr_decode_vwv(sr, SMB_TRANS2SHDR_ED_FMT, &tpscnt, &tdscnt,
683 &pscnt, &psoff, &psdisp, &dscnt, &dsoff, &dsdisp, &fid);
684
685 if (rc != 0)
686 return (SDRC_ERROR);
687
688 mutex_enter(&xa->xa_mutex);
689 if (xa->smb_tpscnt > tpscnt)
690 xa->smb_tpscnt = tpscnt;
691 if (xa->smb_tdscnt > tdscnt)
692 xa->smb_tdscnt = tdscnt;
693 if (fid != 0xFFFF)
694 xa->xa_smb_fid = fid;
695 xa->req_disp_param = psdisp + pscnt;
696 xa->req_disp_data = dsdisp + dscnt;
697
698 /*
699 * See comment in smb_com_transaction_secondary
700 */
701 if (xa->req_param_mb.chain_offset != psdisp) {
702 DTRACE_PROBE2(trans_param_disp,
703 smb_xa_t *, xa, uint16_t, psdisp);
704 xa->req_param_mb.chain_offset = psdisp;
705 }
706 if (xa->req_data_mb.chain_offset != dsdisp) {
707 DTRACE_PROBE2(trans_data_disp,
708 smb_xa_t *, xa, uint16_t, dsdisp);
709 xa->req_data_mb.chain_offset = dsdisp;
710 }
711
712 if (smb_mbc_copy(&xa->req_param_mb, &sr->command, psoff, pscnt)) {
713 mutex_exit(&xa->xa_mutex);
714 smb_xa_close(xa);
715 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
716 return (SDRC_ERROR);
717 }
718 if (smb_mbc_copy(&xa->req_data_mb, &sr->command, dsoff, dscnt)) {
719 mutex_exit(&xa->xa_mutex);
720 smb_xa_close(xa);
721 smbsr_error(sr, 0, ERRDOS, ERRbadformat);
722 return (SDRC_ERROR);
723 }
724 mutex_exit(&xa->xa_mutex);
725
726 if (!smb_trans_ready(xa))
727 return (SDRC_NO_REPLY);
728
729 if (!smb_xa_complete(xa))
730 return (SDRC_NO_REPLY);
731
732 return (smb_nt_trans_dispatch(sr, xa));
733 }
734
735 static int
736 smb_trans_ready(smb_xa_t *xa)
737 {
738 int rc;
739
740 mutex_enter(&xa->xa_mutex);
741 rc = xa->req_disp_data >= xa->smb_tdscnt &&
742 xa->req_disp_param >= xa->smb_tpscnt;
743 mutex_exit(&xa->xa_mutex);
744
745 return (rc);
746 }
747
748 static void
749 smb_encode_SHARE_INFO_1(struct mbuf_chain *output, struct mbuf_chain *text,
750 char *oem_name, uint16_t type, char *comment)
751 {
752 (void) smb_mbc_encodef(output, "13c.wl", oem_name,
753 type, MBC_LENGTH(text));
754
755 (void) smb_mbc_encodef(text, "s", comment ? comment : "");
756 }
757
758 static void
759 smb_encode_SHARE_INFO_2(struct mbuf_chain *output, struct mbuf_chain *text,
760 smb_request_t *sr, char *oem_name, uint16_t type,
761 char *comment, uint16_t access, char *path, char *password)
762 {
763 unsigned char pword[9];
764
765 bzero(pword, sizeof (pword));
766 (void) strncpy((char *)pword, password, sizeof (pword));
767 smb_encode_SHARE_INFO_1(output, text, oem_name, type, comment);
768 (void) smb_mbc_encodef(output, "wwwl9c.",
769 access,
770 sr->sr_cfg->skc_maxconnections,
771 smb_server_get_session_count(sr->sr_server),
772 MBC_LENGTH(text),
773 pword);
774 (void) smb_mbc_encodef(text, "s", path);
775 }
776
777 int
778 smb_trans_net_share_enum(struct smb_request *sr, struct smb_xa *xa)
779 {
780 uint16_t pid_hi, pid_lo;
781
782 /*
783 * Number of data bytes that will
784 * be sent in the current response
785 */
786 uint16_t data_scnt;
787
788 /*
789 * Total number of data bytes that
790 * are sent till now. This is only
791 * used for calculating current data
792 * displacement
793 */
794 uint16_t tot_data_scnt;
795
796 /*
797 * Number of parameter bytes should
798 * be sent for the current response.
799 * It is 8 for the 1st response and
800 * 0 for others
801 */
802 uint16_t param_scnt;
803
804 /* number of setup and parameter bytes */
805 uint16_t n_setup, n_param;
806
807 /* data and parameter displacement */
808 uint16_t data_disp, param_disp;
809
810 /* parameter and data offset and pad */
811 int param_off, param_pad, data_off, data_pad;
812
813 /*
814 * total bytes of parameters and data
815 * in the packet, plus the pad bytes.
816 */
817 int tot_packet_bytes;
818
819 boolean_t first_resp;
820
821 char fmt[16];
822 struct mbuf_chain reply;
823
824 uint16_t level;
825 uint16_t pkt_bufsize;
826 smb_enumshare_info_t esi;
827 char *sent_buf;
828
829 ASSERT(sr->uid_user);
830
831 if (smb_mbc_decodef(&xa->req_param_mb, "ww", &level,
832 &esi.es_bufsize) != 0)
833 return (SDRC_NOT_IMPLEMENTED);
834
835 if (level != 1) {
836 /*
837 * Only level 1 is valid for NetShareEnum
838 * None of the error codes in the spec are meaningful
839 * here. This error code is returned by Windows.
840 */
841 (void) smb_mbc_encodef(&xa->rep_param_mb, "wwww",
842 ERROR_INVALID_LEVEL, 0, 0, 0);
843 return (SDRC_SUCCESS);
844 }
845
846 esi.es_buf = smb_srm_zalloc(sr, esi.es_bufsize);
847 esi.es_posix_uid = crgetuid(sr->uid_user->u_cred);
848 smb_kshare_enum(sr->sr_server, &esi);
849
850 /* client buffer size is not big enough to hold any shares */
851 if (esi.es_nsent == 0) {
852 (void) smb_mbc_encodef(&xa->rep_param_mb, "wwww",
853 ERROR_MORE_DATA, 0, esi.es_nsent, esi.es_ntotal);
854 return (SDRC_SUCCESS);
855 }
856
857 /*
858 * Initialize the reply mbuf chain. Note that we re-initialize
859 * this on each pass through the loop below.
860 */
861 MBC_SETUP(&reply, smb_maxbufsize);
862
863 /*
864 * The rep_setup_mb is already initialized in smb_trans_dispatch().
865 * Calling MBC_INIT() will initialized the structure and so the
866 * pointer to the mbuf chains will be lost. Therefore, we need
867 * to free the resources before calling MBC_INIT() again.
868 */
869 n_setup = 0; /* Setup count for NetShareEnum SMB is 0 */
870 MBC_FLUSH(&xa->rep_setup_mb);
871
872 n_param = 8;
873 pkt_bufsize = sr->session->smb_msg_size -
874 (SMB_HEADER_ED_LEN + RESP_HEADER_LEN + n_param);
875
876 tot_data_scnt = 0;
877 sent_buf = esi.es_buf;
878 first_resp = B_TRUE;
879
880 while (tot_data_scnt < esi.es_datasize) {
881 data_scnt = esi.es_datasize - tot_data_scnt;
882 if (data_scnt > pkt_bufsize)
883 data_scnt = pkt_bufsize;
884 MBC_FLUSH(&xa->rep_data_mb);
885
886 (void) sprintf(fmt, "%dc", data_scnt);
887 (void) smb_mbc_encodef(&xa->rep_data_mb, fmt, sent_buf);
888
889 sent_buf += data_scnt;
890 tot_data_scnt += data_scnt;
891
892 /* Only the 1st response packet contains parameters */
893 param_scnt = (first_resp) ? n_param : 0;
894 param_pad = 1; /* always one */
895 param_off = SMB_HEADER_ED_LEN + RESP_HEADER_LEN;
896 param_disp = (first_resp) ? 0 : n_param;
897
898 MBC_FLUSH(&xa->rep_param_mb);
899
900 if (first_resp) {
901 first_resp = B_FALSE;
902 (void) smb_mbc_encodef(&xa->rep_param_mb, "wwww",
903 (esi.es_ntotal > esi.es_nsent)
904 ? ERROR_MORE_DATA : 0,
905 0, esi.es_nsent, esi.es_ntotal);
906 }
907
908 data_pad = (param_off + n_param) & 1; /* Pad to short */
909
910 /* data off from hdr start */
911 data_off = param_off + param_scnt + data_pad;
912 data_disp = tot_data_scnt - data_scnt;
913 tot_packet_bytes = param_pad + param_scnt + data_pad +
914 data_scnt;
915
916 pid_hi = sr->smb_pid >> 16;
917 pid_lo = (uint16_t)sr->smb_pid;
918
919 MBC_FLUSH(&reply);
920 (void) smb_mbc_encodef(&reply, SMB_HEADER_ED_FMT,
921 sr->first_smb_com,
922 sr->smb_rcls,
923 sr->smb_reh,
924 sr->smb_err,
925 sr->smb_flg | SMB_FLAGS_REPLY,
926 sr->smb_flg2,
927 pid_hi,
928 sr->smb_sig,
929 sr->smb_tid,
930 pid_lo,
931 sr->smb_uid,
932 sr->smb_mid);
933
934 (void) smb_mbc_encodef(&reply,
935 "bww2.wwwwwwb.Cw#.C#.C",
936 10 + n_setup, /* wct */
937 n_param, /* Total Parameter Bytes */
938 esi.es_datasize, /* Total Data Bytes */
939 param_scnt, /* Total Parameter Bytes this buffer */
940 param_off, /* Param offset from header start */
941 param_disp, /* Param displacement */
942 data_scnt, /* Total Data Bytes this buffer */
943 data_off, /* Data offset from header start */
944 data_disp, /* Data displacement */
945 n_setup, /* suwcnt */
946 &xa->rep_setup_mb, /* setup[] */
947 tot_packet_bytes, /* Total data bytes */
948 param_pad,
949 &xa->rep_param_mb,
950 data_pad,
951 &xa->rep_data_mb);
952
953 if (sr->session->signing.flags & SMB_SIGNING_ENABLED)
954 smb_sign_reply(sr, &reply);
955
956 (void) smb_session_send(sr->session, 0, &reply);
957
958 }
959
960 m_freem(reply.chain);
961
962 return (SDRC_NO_REPLY);
963 }
964
965 int
966 smb_trans_net_share_getinfo(smb_request_t *sr, struct smb_xa *xa)
967 {
968 uint16_t level, max_bytes, access;
969 struct mbuf_chain str_mb;
970 char *share;
971 char *password;
972 smb_kshare_t *si;
973
974 if (smb_mbc_decodef(&xa->req_param_mb, "%sww", sr,
975 &share, &level, &max_bytes) != 0)
976 return (SDRC_NOT_IMPLEMENTED);
977
978 si = smb_kshare_lookup(sr->sr_server, share);
979 if ((si == NULL) || (si->shr_oemname == NULL)) {
980 (void) smb_mbc_encodef(&xa->rep_param_mb, "www",
981 NERR_NetNameNotFound, 0, 0);
982 if (si)
983 smb_kshare_release(sr->sr_server, si);
984 return (SDRC_SUCCESS);
985 }
986
987 access = SHARE_ACCESS_ALL;
988 password = "";
989
990 MBC_INIT(&str_mb, max_bytes);
991
992 switch (level) {
993 case 0 :
994 (void) smb_mbc_encodef(&xa->rep_data_mb, "13c",
995 si->shr_oemname);
996 break;
997
998 case 1 :
999 smb_encode_SHARE_INFO_1(&xa->rep_data_mb, &str_mb,
1000 si->shr_oemname, si->shr_type, si->shr_cmnt);
1001 break;
1002
1003 case 2 :
1004 smb_encode_SHARE_INFO_2(&xa->rep_data_mb, &str_mb, sr,
1005 si->shr_oemname, si->shr_type, si->shr_cmnt, access,
1006 si->shr_path, password);
1007 break;
1008
1009 default:
1010 smb_kshare_release(sr->sr_server, si);
1011 (void) smb_mbc_encodef(&xa->rep_param_mb, "www",
1012 ERROR_INVALID_LEVEL, 0, 0);
1013 m_freem(str_mb.chain);
1014 return (SDRC_NOT_IMPLEMENTED);
1015 }
1016
1017 smb_kshare_release(sr->sr_server, si);
1018 (void) smb_mbc_encodef(&xa->rep_param_mb, "www", NERR_Success,
1019 -MBC_LENGTH(&xa->rep_data_mb),
1020 MBC_LENGTH(&xa->rep_data_mb) + MBC_LENGTH(&str_mb));
1021 (void) smb_mbc_encodef(&xa->rep_data_mb, "C", &str_mb);
1022 m_freem(str_mb.chain);
1023 return (SDRC_SUCCESS);
1024 }
1025
1026 int
1027 smb_trans_net_workstation_getinfo(struct smb_request *sr, struct smb_xa *xa)
1028 {
1029 uint16_t level, max_bytes;
1030 struct mbuf_chain str_mb;
1031 char *domain;
1032 char *hostname;
1033
1034 if ((smb_mbc_decodef(&xa->req_param_mb, "ww",
1035 &level, &max_bytes) != 0) ||
1036 (level != 10)) {
1037 (void) smb_mbc_encodef(&xa->rep_param_mb, "wwww",
1038 NERR_BadTransactConfig, 0, 0, 0);
1039 return (SDRC_SUCCESS);
1040 }
1041
1042 domain = sr->sr_cfg->skc_nbdomain;
1043 hostname = sr->sr_cfg->skc_hostname;
1044
1045 MBC_INIT(&str_mb, max_bytes);
1046
1047 (void) smb_mbc_encodef(&str_mb, "."); /* Prevent NULL pointers */
1048
1049 (void) smb_mbc_encodef(&xa->rep_data_mb, "l", MBC_LENGTH(&str_mb));
1050 (void) smb_mbc_encodef(&str_mb, "s", hostname);
1051 (void) smb_mbc_encodef(&xa->rep_data_mb, "l", MBC_LENGTH(&str_mb));
1052 (void) smb_mbc_encodef(&str_mb, "s", "nobody");
1053 (void) smb_mbc_encodef(&xa->rep_data_mb, "l", MBC_LENGTH(&str_mb));
1054 (void) smb_mbc_encodef(&str_mb, "s", domain);
1055 (void) smb_mbc_encodef(&xa->rep_data_mb, "bbl",
1056 (uint8_t)sr->sr_cfg->skc_version.sv_major,
1057 (uint8_t)sr->sr_cfg->skc_version.sv_minor,
1058 MBC_LENGTH(&str_mb));
1059 (void) smb_mbc_encodef(&str_mb, "s", domain);
1060 (void) smb_mbc_encodef(&xa->rep_data_mb, "l", MBC_LENGTH(&str_mb));
1061 (void) smb_mbc_encodef(&str_mb, "s", domain);
1062
1063 (void) smb_mbc_encodef(&xa->rep_param_mb, "www", 0,
1064 -MBC_LENGTH(&xa->rep_data_mb),
1065 MBC_LENGTH(&xa->rep_data_mb) + MBC_LENGTH(&str_mb));
1066 (void) smb_mbc_encodef(&xa->rep_data_mb, "C", &str_mb);
1067 m_freem(str_mb.chain);
1068 return (SDRC_SUCCESS);
1069 }
1070
1071 int
1072 smb_trans_net_user_getinfo(struct smb_request *sr, struct smb_xa *xa)
1073 {
1074 uint16_t level, max_bytes;
1075 unsigned char *user;
1076 int rc;
1077
1078 rc = smb_mbc_decodef(&xa->req_param_mb, "%sww", sr,
1079 &user,
1080 &level,
1081 &max_bytes);
1082
1083 if (rc != 0)
1084 return (SDRC_NOT_IMPLEMENTED);
1085
1086 (void) smb_mbc_encodef(&xa->rep_param_mb, "www",
1087 NERR_UserNotFound, 0, 0);
1088 return (SDRC_SUCCESS);
1089 }
1090
1091 smb_sdrc_t
1092 smb_trans_net_server_getinfo(struct smb_request *sr, struct smb_xa *xa)
1093 {
1094 uint16_t level, buf_size;
1095 uint16_t avail_data, max_data;
1096 char server_name[16];
1097 struct mbuf_chain str_mb;
1098
1099 if (smb_mbc_decodef(&xa->req_param_mb, "ww", &level, &buf_size) != 0)
1100 return (SDRC_ERROR);
1101
1102 max_data = MBC_MAXBYTES(&xa->rep_data_mb);
1103
1104 MBC_INIT(&str_mb, buf_size);
1105
1106 bzero(server_name, sizeof (server_name));
1107 (void) strncpy(server_name, sr->sr_cfg->skc_hostname,
1108 sizeof (server_name));
1109
1110 /* valid levels are 0 and 1 */
1111 switch (level) {
1112 case 0:
1113 (void) smb_mbc_encodef(&xa->rep_data_mb, "16c", server_name);
1114 break;
1115
1116 case 1:
1117 (void) smb_mbc_encodef(&str_mb, "s",
1118 sr->sr_cfg->skc_system_comment);
1119 (void) smb_mbc_encodef(&xa->rep_data_mb, "16cbbll", server_name,
1120 (uint8_t)sr->sr_cfg->skc_version.sv_major,
1121 (uint8_t)sr->sr_cfg->skc_version.sv_minor,
1122 MY_SERVER_TYPE, max_data - MBC_LENGTH(&str_mb));
1123 break;
1124
1125 default:
1126 (void) smb_mbc_encodef(&xa->rep_param_mb, "www",
1127 ERROR_INVALID_LEVEL, 0, 0);
1128 m_freem(str_mb.chain);
1129 return (SDRC_SUCCESS);
1130 }
1131
1132 avail_data = MBC_LENGTH(&xa->rep_data_mb) + MBC_LENGTH(&str_mb);
1133 (void) smb_mbc_encodef(&xa->rep_param_mb, "www",
1134 NERR_Success, max_data - avail_data, avail_data);
1135 (void) smb_mbc_encodef(&xa->rep_data_mb, "C", &str_mb);
1136 m_freem(str_mb.chain);
1137 return (SDRC_SUCCESS);
1138 }
1139
1140 /*
1141 * 6.4 The NetServerEnum2 RAP Service
1142 *
1143 * The NetServerEnum2 RAP service lists all computers of the specified type
1144 * or types that are visible in the specified domains. It may also
1145 * enumerate domains.
1146 *
1147 * The following definition uses the notation and terminology defined in
1148 * the CIFS Remote Administration Protocol specification, which is required
1149 * in order to make it well-defined. The definition is:
1150 *
1151 * uint16_t NetServerEnum2 (
1152 * uint16_t sLevel,
1153 * RCVBUF pbBuffer,
1154 * RCVBUFLEN cbBuffer,
1155 * ENTCOUNT pcEntriesRead,
1156 * uint16_t *pcTotalAvail,
1157 * uint32_t fServerType,
1158 * char *pszDomain,
1159 * );
1160 *
1161 * where:
1162 *
1163 * sLevel specifies the level of detail (0 or 1) requested.
1164 *
1165 * pbBuffer points to the buffer to receive the returned data. If the
1166 * function is successful, the buffer contains a sequence of
1167 * server_info_x structures, where x is 0 or 1, depending on the
1168 * level of detail requested.
1169 *
1170 * cbBuffer specifies the size, in bytes, of the buffer pointed to by
1171 * the pbBuffer parameter.
1172 *
1173 * pcEntriesRead points to a 16 bit variable that receives a count of
1174 * the number of servers enumerated in the buffer. This count is
1175 * valid only if NetServerEnum2 returns the NERR_Success or
1176 * ERROR_MORE_DATA values.
1177 *
1178 * pcTotal Avail points to a 16 bit variable that receives a count of
1179 * the total number of available entries. This count is valid only if
1180 * NetServerEnum2 returns the NERR_Success or ERROR_MORE_DATA values.
1181 *
1182 * fServerType specifies the type or types of computers to enumerate.
1183 * Computers that match at least one of the specified types are
1184 * returned in the buffer. Possible values are defined in the request
1185 * parameters section.
1186 *
1187 * pszDomain points to a null-terminated string that contains the
1188 * name of the workgroup in which to enumerate computers of the
1189 * specified type or types. If the pszDomain parameter is a null
1190 * string or a null pointer, servers are enumerated for the current
1191 * domain of the computer.
1192 *
1193 * 6.4.1 Transaction Request Parameters section
1194 *
1195 * The Transaction request parameters section in this instance contains:
1196 * . The 16 bit function number for NetServerEnum2 which is 104.
1197 * . The parameter descriptor string which is "WrLehDz".
1198 * . The data descriptor string for the (returned) data which is "B16" for
1199 * level detail 0 or "B16BBDz" for level detail 1.
1200 * . The actual parameters as described by the parameter descriptor
1201 * string.
1202 *
1203 * The parameters are:
1204 * . A 16 bit integer with a value of 0 or 1 (corresponding to the "W" in
1205 * the parameter descriptor string. This represents the level of detail
1206 * the server is expected to return
1207 * . A 16 bit integer that contains the size of the receive buffer.
1208 * . A 32 bit integer that represents the type of servers the function
1209 * should enumerate. The possible values may be any of the following or
1210 * a combination of the following:
1211 *
1212 * SV_TYPE_WORKSTATION 0x00000001 All workstations
1213 * SV_TYPE_SERVER 0x00000002 All servers
1214 * SV_TYPE_SQLSERVER 0x00000004 Any server running with SQL
1215 * server
1216 * SV_TYPE_DOMAIN_CTRL 0x00000008 Primary domain controller
1217 * SV_TYPE_DOMAIN_BAKCTRL 0x00000010 Backup domain controller
1218 * SV_TYPE_TIME_SOURCE 0x00000020 Server running the timesource
1219 * service
1220 * SV_TYPE_AFP 0x00000040 Apple File Protocol servers
1221 * SV_TYPE_NOVELL 0x00000080 Novell servers
1222 * SV_TYPE_DOMAIN_MEMBER 0x00000100 Domain Member
1223 * SV_TYPE_PRINTQ_SERVER 0x00000200 Server sharing print queue
1224 * SV_TYPE_DIALIN_SERVER 0x00000400 Server running dialin service.
1225 * SV_TYPE_XENIX_SERVER 0x00000800 Xenix server
1226 * SV_TYPE_NT 0x00001000 NT server
1227 * SV_TYPE_WFW 0x00002000 Server running Windows for
1228 * Workgroups
1229 * SV_TYPE_SERVER_NT 0x00008000 Windows NT non DC server
1230 * SV_TYPE_POTENTIAL_BROWSER 0x00010000 Server that can run the browser
1231 * service
1232 * SV_TYPE_BACKUP_BROWSER 0x00020000 Backup browser server
1233 * SV_TYPE_MASTER_BROWSER 0x00040000 Master browser server
1234 * SV_TYPE_DOMAIN_MASTER 0x00080000 Domain Master Browser server
1235 * SV_TYPE_LOCAL_LIST_ONLY 0x40000000 Enumerate only entries marked
1236 * "local"
1237 * SV_TYPE_DOMAIN_ENUM 0x80000000 Enumerate Domains. The pszDomain
1238 * parameter must be NULL.
1239 *
1240 * . A null terminated ASCII string representing the pszDomain parameter
1241 * described above
1242 *
1243 * 6.4.2 Transaction Request Data section
1244 *
1245 * There is no data or auxiliary data to send as part of the request.
1246 *
1247 * 6.4.3 Transaction Response Parameters section
1248 *
1249 * The transaction response parameters section consists of:
1250 * . A 16 bit word indicating the return status. The possible values are:
1251 *
1252 * Code Value Description
1253 * NERR_Success 0 No errors encountered
1254 * ERROR_MORE_DATA 234 Additional data is available
1255 * NERR_ServerNotStarted 2114 The RAP service on the remote computer
1256 * is not running
1257 * NERR_BadTransactConfig 2141 The server is not configured for
1258 * transactions, IPC$ is not shared
1259 *
1260 * . A 16 bit "converter" word.
1261 * . A 16 bit number representing the number of entries returned.
1262 * . A 16 bit number representing the total number of available entries.
1263 * If the supplied buffer is large enough, this will equal the number of
1264 * entries returned.
1265 *
1266 * 6.4.4 Transaction Response Data section
1267 *
1268 * The return data section consists of a number of SERVER_INFO_1 structures.
1269 * The number of such structures present is determined by the third entry
1270 * (described above) in the return parameters section.
1271 *
1272 * At level detail 0, the Transaction response data section contains a
1273 * number of SERVER_INFO_0 data structure. The number of such structures is
1274 * equal to the 16 bit number returned by the server in the third parameter
1275 * in the Transaction response parameter section. The SERVER_INFO_0 data
1276 * structure is defined as:
1277 *
1278 * struct SERVER_INFO_0 {
1279 * char sv0_name[16];
1280 * };
1281 *
1282 * where:
1283 *
1284 * sv0_name is a null-terminated string that specifies the name of a
1285 * computer or domain .
1286 *
1287 * At level detail 1, the Transaction response data section contains a
1288 * number of SERVER_INFO_1 data structure. The number of such structures is
1289 * equal to the 16 bit number returned by the server in the third parameter
1290 * in the Transaction response parameter section. The SERVER_INFO_1 data
1291 * structure is defined as:
1292 *
1293 * struct SERVER_INFO_1 {
1294 * char sv1_name[16];
1295 * char sv1_version_major;
1296 * char sv1_version_minor;
1297 * uint32_t sv1_type;
1298 * char *sv1_comment_or_master_browser;
1299 * };
1300 *
1301 * sv1_name contains a null-terminated string that specifies the name
1302 * of a computer, or a domain name if SV_TYPE_DOMAIN_ENUM is set in
1303 * sv1_type.
1304 *
1305 * sv1_version_major whatever was specified in the HostAnnouncement
1306 * or DomainAnnouncement frame with which the entry was registered.
1307 *
1308 * sv1_version_minor whatever was specified in the HostAnnouncement
1309 * or DomainAnnouncement frame with which the entry was registered.
1310 *
1311 * sv1_type specifies the type of software the computer is running.
1312 * The member can be one or a combination of the values defined above
1313 * in the Transaction request parameters section for fServerType.
1314 *
1315 *
1316 * sv1_comment_or_master_browser points to a null-terminated string. If
1317 * the sv1_type indicates that the entry is for a domain, this
1318 * specifies the name of server running the domain master browser;
1319 * otherwise, it specifies a comment describing the server. The comment
1320 * can be a null string or the pointer may be a null pointer.
1321 *
1322 * In case there are multiple SERVER_INFO_1 data structures to
1323 * return, the server may put all these fixed length structures in
1324 * the return buffer, leave some space and then put all the variable
1325 * length data (the actual value of the sv1_comment strings) at the
1326 * end of the buffer.
1327 *
1328 * There is no auxiliary data to receive.
1329 */
1330
1331 int
1332 smb_trans_net_server_enum2(struct smb_request *sr, struct smb_xa *xa)
1333 {
1334 uint16_t opcode, level, max_bytes;
1335 uint32_t server_type;
1336 unsigned char *domain;
1337 struct mbuf_chain str_mb;
1338 char *hostname, *s;
1339 smb_kmod_cfg_t *si;
1340
1341 if (smb_mbc_decodef(&xa->req_param_mb,
1342 "%wsswwls", sr, &opcode, &s, &s,
1343 &level, &max_bytes, &server_type, &domain) != 0)
1344 return (SDRC_NOT_IMPLEMENTED);
1345
1346 si = sr->sr_cfg;
1347
1348 if (smb_strcasecmp(si->skc_nbdomain, (char *)domain, 0) != 0) {
1349 (void) smb_mbc_encodef(&xa->rep_param_mb, "wwww", 0, 0, 0, 0);
1350 return (SDRC_SUCCESS);
1351 }
1352
1353 if ((server_type & MY_SERVER_TYPE) == 0) {
1354 (void) smb_mbc_encodef(&xa->rep_param_mb, "wwww", 0, 0, 0, 0);
1355 return (SDRC_SUCCESS);
1356 }
1357
1358 MBC_INIT(&str_mb, max_bytes);
1359
1360 hostname = si->skc_hostname;
1361
1362 (void) smb_mbc_encodef(&xa->rep_data_mb, "16c", hostname);
1363 if (level == 1) {
1364 (void) smb_mbc_encodef(&xa->rep_data_mb, "bbll",
1365 (uint8_t)sr->sr_cfg->skc_version.sv_major,
1366 (uint8_t)sr->sr_cfg->skc_version.sv_minor,
1367 MY_SERVER_TYPE, MBC_LENGTH(&str_mb));
1368 (void) smb_mbc_encodef(&str_mb, "s", si->skc_system_comment);
1369 }
1370
1371 (void) smb_mbc_encodef(&xa->rep_param_mb, "wwww", 0,
1372 -MBC_LENGTH(&xa->rep_data_mb), 1, 1);
1373 (void) smb_mbc_encodef(&xa->rep_data_mb, "m", str_mb.chain);
1374 return (SDRC_SUCCESS);
1375 }
1376
1377 static boolean_t
1378 is_supported_mailslot(const char *mailslot)
1379 {
1380 static char *mailslots[] = {
1381 PIPE_LANMAN,
1382 MAILSLOT_LANMAN,
1383 MAILSLOT_BROWSE,
1384 MAILSLOT_MSBROWSE
1385 };
1386
1387 int i;
1388
1389 for (i = 0; i < sizeof (mailslots)/sizeof (mailslots[0]); ++i)
1390 if (smb_strcasecmp(mailslot, mailslots[i], 0) == 0)
1391 return (B_TRUE);
1392
1393 return (B_FALSE);
1394 }
1395
1396 /*
1397 * smb_trans_nmpipe
1398 *
1399 * This is used for RPC bind and request transactions.
1400 *
1401 * If the data available from the pipe is larger than the maximum
1402 * data size requested by the client, return as much as requested.
1403 * The residual data remains in the pipe until the client comes back
1404 * with a read request or closes the pipe.
1405 *
1406 * When we read less than what's available, we MUST return the
1407 * status NT_STATUS_BUFFER_OVERFLOW (or ERRDOS/ERROR_MORE_DATA)
1408 */
1409 static smb_sdrc_t
1410 smb_trans_nmpipe(smb_request_t *sr, smb_xa_t *xa)
1411 {
1412 smb_fsctl_t fsctl;
1413 uint32_t status;
1414
1415 smbsr_lookup_file(sr);
1416 if (sr->fid_ofile == NULL) {
1417 smbsr_error(sr, NT_STATUS_INVALID_HANDLE,
1418 ERRDOS, ERRbadfid);
1419 return (SDRC_ERROR);
1420 }
1421
1422 /*
1423 * A little confusing perhaps, but the fsctl "input" is what we
1424 * write to the pipe (from the transaction "send" data), and the
1425 * fsctl "output" is what we read from the pipe (and becomes the
1426 * transaction receive data).
1427 */
1428 fsctl.CtlCode = FSCTL_PIPE_TRANSCEIVE;
1429 fsctl.InputCount = xa->smb_tdscnt; /* write count */
1430 fsctl.OutputCount = 0; /* minimum to read from the pipe */
1431 fsctl.MaxOutputResp = xa->smb_mdrcnt; /* max to read */
1432 fsctl.in_mbc = &xa->req_data_mb; /* write from here */
1433 fsctl.out_mbc = &xa->rep_data_mb; /* read into here */
1434
1435 status = smb_opipe_fsctl(sr, &fsctl);
1436 if (status) {
1437 smbsr_status(sr, status, 0, 0);
1438 if (NT_SC_SEVERITY(status) == NT_STATUS_SEVERITY_ERROR)
1439 return (SDRC_ERROR);
1440 /* Warnings like NT_STATUS_BUFFER_OVERFLOW are OK */
1441 }
1442
1443 return (SDRC_SUCCESS);
1444 }
1445
1446 static smb_sdrc_t
1447 smb_trans_dispatch(smb_request_t *sr, smb_xa_t *xa)
1448 {
1449 int rc, pos;
1450 int total_bytes, n_setup, n_param, n_data;
1451 int param_off, param_pad, data_off, data_pad;
1452 uint16_t opcode;
1453 uint16_t devstate;
1454 char *req_fmt;
1455 char *rep_fmt;
1456
1457 if (xa->smb_suwcnt > 0) {
1458 rc = smb_mbc_decodef(&xa->req_setup_mb, "ww", &opcode,
1459 &sr->smb_fid);
1460 if (rc != 0)
1461 goto trans_err_not_supported;
1462 switch (opcode) {
1463 case TRANS_SET_NMPIPE_STATE:
1464 if ((rc = smb_mbc_decodef(&xa->req_param_mb, "w",
1465 &devstate)) != 0)
1466 goto trans_err_not_supported;
1467
1468 rc = SDRC_SUCCESS;
1469 break;
1470
1471 case TRANS_TRANSACT_NMPIPE:
1472 rc = smb_trans_nmpipe(sr, xa);
1473 break;
1474
1475 case TRANS_WAIT_NMPIPE:
1476 delay(SEC_TO_TICK(1));
1477 rc = SDRC_SUCCESS;
1478 break;
1479
1480 default:
1481 goto trans_err_not_supported;
1482 }
1483 } else {
1484 if (!is_supported_mailslot(xa->xa_pipe_name))
1485 goto trans_err_not_supported;
1486
1487 if ((rc = smb_mbc_decodef(&xa->req_param_mb, "%wss", sr,
1488 &opcode, &req_fmt, &rep_fmt)) != 0)
1489 goto trans_err_not_supported;
1490
1491 switch (opcode) {
1492 case API_WshareEnum:
1493 rc = smb_trans_net_share_enum(sr, xa);
1494 break;
1495
1496 case API_WshareGetInfo:
1497 rc = smb_trans_net_share_getinfo(sr, xa);
1498 break;
1499
1500 case API_WserverGetInfo:
1501 rc = smb_trans_net_server_getinfo(sr, xa);
1502 break;
1503
1504 case API_WUserGetInfo:
1505 rc = smb_trans_net_user_getinfo(sr, xa);
1506 break;
1507
1508 case API_WWkstaGetInfo:
1509 rc = smb_trans_net_workstation_getinfo(sr, xa);
1510 break;
1511
1512 case API_NetServerEnum2:
1513 rc = smb_trans_net_server_enum2(sr, xa);
1514 break;
1515
1516 default:
1517 goto trans_err_not_supported;
1518 }
1519 }
1520
1521 switch (rc) {
1522 case SDRC_SUCCESS:
1523 break;
1524
1525 case SDRC_DROP_VC:
1526 case SDRC_NO_REPLY:
1527 case SDRC_ERROR:
1528 return (rc);
1529
1530 case SDRC_NOT_IMPLEMENTED:
1531 goto trans_err_not_supported;
1532
1533 default:
1534 break;
1535 }
1536
1537 n_setup = MBC_LENGTH(&xa->rep_setup_mb);
1538 n_param = MBC_LENGTH(&xa->rep_param_mb);
1539 n_data = MBC_LENGTH(&xa->rep_data_mb);
1540
1541 if (xa->smb_msrcnt < n_setup ||
1542 xa->smb_mprcnt < n_param ||
1543 xa->smb_mdrcnt < n_data) {
1544 goto trans_err_too_small;
1545 }
1546
1547 /* neato, blast it over there */
1548
1549 n_setup = (n_setup + 1) / 2; /* Convert to setup words */
1550 param_pad = 1; /* always one */
1551 param_off = param_pad + 32 + 21 + (n_setup << 1) + 2;
1552 data_pad = (param_off + n_param) & 1; /* Pad to short */
1553 /* Param off from hdr start */
1554 data_off = param_off + n_param + data_pad;
1555 total_bytes = param_pad + n_param + data_pad + n_data;
1556
1557 rc = smbsr_encode_result(sr, 10+n_setup, total_bytes,
1558 "bww2.wwwwwwb.Cw#.C#.C",
1559 10 + n_setup, /* wct */
1560 n_param, /* Total Parameter Bytes */
1561 n_data, /* Total Data Bytes */
1562 n_param, /* Total Parameter Bytes this buffer */
1563 param_off, /* Param offset from header start */
1564 0, /* Param displacement */
1565 n_data, /* Total Data Bytes this buffer */
1566 data_off, /* Data offset from header start */
1567 0, /* Data displacement */
1568 n_setup, /* suwcnt */
1569 &xa->rep_setup_mb, /* setup[] */
1570 total_bytes, /* Total data bytes */
1571 param_pad,
1572 &xa->rep_param_mb,
1573 data_pad,
1574 &xa->rep_data_mb);
1575 return ((rc == 0) ? SDRC_SUCCESS : SDRC_ERROR);
1576
1577 trans_err_too_small:
1578 rc = NERR_BufTooSmall;
1579 goto trans_err;
1580
1581 trans_err_not_supported:
1582 rc = ERROR_NOT_SUPPORTED;
1583 goto trans_err;
1584
1585 trans_err:
1586 pos = MBC_LENGTH(&sr->reply) + 23;
1587 rc = smbsr_encode_result(sr, 10, 4, "bww2.wwwwwwb.www",
1588 10, /* wct */
1589 4, 0, /* tpscnt tdscnt */
1590 4, pos, 0, /* pscnt psoff psdisp */
1591 0, 0, 0, /* dscnt dsoff dsdisp */
1592 0, /* suwcnt */
1593 4, /* bcc */
1594 rc,
1595 0); /* converter word? */
1596 return ((rc == 0) ? SDRC_SUCCESS : SDRC_ERROR);
1597 }
1598
1599 static smb_sdrc_t
1600 smb_trans2_dispatch(smb_request_t *sr, smb_xa_t *xa)
1601 {
1602 int rc, pos;
1603 int total_bytes, n_setup, n_param, n_data;
1604 int param_off, param_pad, data_off;
1605 uint16_t data_pad;
1606 uint16_t opcode;
1607 uint16_t nt_unknown_secret = 0x0100;
1608 char *fmt;
1609
1610 n_data = xa->smb_mdrcnt;
1611
1612 if (smb_mbc_decodef(&xa->req_setup_mb, "w", &opcode) != 0)
1613 goto trans_err_not_supported;
1614
1615 /*
1616 * Save this for /proc to read later.
1617 */
1618 xa->smb_func = opcode;
1619
1620 /* for now, only respond to the */
1621 switch (opcode) {
1622 case TRANS2_OPEN2:
1623 rc = smb_com_trans2_open2(sr, xa);
1624 break;
1625
1626 case TRANS2_CREATE_DIRECTORY:
1627 rc = smb_com_trans2_create_directory(sr, xa);
1628 break;
1629
1630 case TRANS2_FIND_FIRST2:
1631 /*
1632 * Should have enough room to send the response
1633 * data back to client.
1634 */
1635 if (n_data == 0) {
1636 smbsr_error(sr, NT_STATUS_INFO_LENGTH_MISMATCH,
1637 ERRDOS, ERROR_BAD_LENGTH);
1638 return (SDRC_ERROR);
1639 }
1640 rc = smb_com_trans2_find_first2(sr, xa);
1641 break;
1642
1643 case TRANS2_FIND_NEXT2:
1644 /*
1645 * Should have enough room to send the response
1646 * data back to client.
1647 */
1648 if (n_data == 0) {
1649 smbsr_error(sr, NT_STATUS_INFO_LENGTH_MISMATCH,
1650 ERRDOS, ERROR_BAD_LENGTH);
1651 return (SDRC_ERROR);
1652 }
1653 rc = smb_com_trans2_find_next2(sr, xa);
1654 break;
1655
1656 case TRANS2_QUERY_FS_INFORMATION:
1657 /*
1658 * Should have enough room to send the response
1659 * data back to client.
1660 */
1661 if (n_data == 0) {
1662 smbsr_error(sr, NT_STATUS_INFO_LENGTH_MISMATCH,
1663 ERRDOS, ERROR_BAD_LENGTH);
1664 return (SDRC_ERROR);
1665 }
1666 rc = smb_com_trans2_query_fs_information(sr, xa);
1667 break;
1668
1669 case TRANS2_SET_FS_INFORMATION:
1670 rc = smb_com_trans2_set_fs_information(sr, xa);
1671 break;
1672
1673 case TRANS2_QUERY_PATH_INFORMATION:
1674 /*
1675 * Should have enough room to send the response
1676 * data back to client.
1677 */
1678 if (n_data == 0) {
1679 smbsr_error(sr, NT_STATUS_INFO_LENGTH_MISMATCH,
1680 ERRDOS, ERROR_BAD_LENGTH);
1681 return (SDRC_ERROR);
1682 }
1683 rc = smb_com_trans2_query_path_information(sr, xa);
1684 break;
1685
1686 case TRANS2_QUERY_FILE_INFORMATION:
1687 /*
1688 * Should have enough room to send the response
1689 * data back to client.
1690 */
1691 if (n_data == 0) {
1692 smbsr_error(sr, NT_STATUS_INFO_LENGTH_MISMATCH,
1693 ERRDOS, ERROR_BAD_LENGTH);
1694 return (SDRC_ERROR);
1695 }
1696 rc = smb_com_trans2_query_file_information(sr, xa);
1697 break;
1698
1699 case TRANS2_SET_PATH_INFORMATION:
1700 rc = smb_com_trans2_set_path_information(sr, xa);
1701 break;
1702
1703 case TRANS2_SET_FILE_INFORMATION:
1704 rc = smb_com_trans2_set_file_information(sr, xa);
1705 break;
1706
1707 case TRANS2_GET_DFS_REFERRAL:
1708 rc = smb_com_trans2_get_dfs_referral(sr, xa);
1709 break;
1710
1711 default:
1712 (void) smb_mbc_encodef(&xa->rep_param_mb, "w", 0);
1713 goto trans_err_not_supported;
1714 }
1715
1716 switch (rc) {
1717 case SDRC_SUCCESS:
1718 break;
1719
1720 case SDRC_DROP_VC:
1721 case SDRC_NO_REPLY:
1722 case SDRC_ERROR:
1723 return (rc);
1724
1725 case SDRC_NOT_IMPLEMENTED:
1726 goto trans_err_not_supported;
1727
1728 default:
1729 break;
1730 }
1731
1732 n_setup = MBC_LENGTH(&xa->rep_setup_mb);
1733 n_param = MBC_LENGTH(&xa->rep_param_mb);
1734 n_data = MBC_LENGTH(&xa->rep_data_mb);
1735
1736 if (xa->smb_msrcnt < n_setup ||
1737 xa->smb_mprcnt < n_param ||
1738 xa->smb_mdrcnt < n_data) {
1739 goto trans_err_too_small;
1740 }
1741
1742 /* neato, blast it over there */
1743
1744 n_setup = (n_setup + 1) / 2; /* Conver to setup words */
1745 param_pad = 1; /* must be one */
1746 param_off = param_pad + 32 + 21 + (n_setup << 1) + 2;
1747
1748 /*
1749 * Including the nt_unknown_secret value persuades netmon to
1750 * display the correct data format for QueryPathInfo and
1751 * QueryFileInfo.
1752 */
1753 if (opcode == TRANS2_QUERY_FILE_INFORMATION ||
1754 opcode == TRANS2_QUERY_PATH_INFORMATION) {
1755 data_pad = sizeof (uint16_t);
1756 data_off = param_off + n_param + data_pad;
1757 fmt = "bww2.wwwwwwb.Cw#.CwC";
1758 nt_unknown_secret = 0x0100;
1759 }
1760 else
1761 {
1762 data_pad = (param_off + n_param) & 1; /* Pad to short */
1763 /* Param off from hdr start */
1764 data_off = param_off + n_param + data_pad;
1765 fmt = "bww2.wwwwwwb.Cw#.C#.C";
1766 nt_unknown_secret = data_pad;
1767 }
1768
1769 total_bytes = param_pad + n_param + data_pad + n_data;
1770
1771 rc = smbsr_encode_result(sr, 10+n_setup, total_bytes,
1772 fmt,
1773 10 + n_setup, /* wct */
1774 n_param, /* Total Parameter Bytes */
1775 n_data /* + data_pad */, /* Total Data Bytes */
1776 n_param, /* Total Parameter Bytes this buffer */
1777 param_off, /* Param offset from header start */
1778 0, /* Param displacement */
1779 n_data /* + data_pad */, /* Total Data Bytes this buffer */
1780 data_off, /* Data offset from header start */
1781 0, /* Data displacement */
1782 n_setup, /* suwcnt */
1783 &xa->rep_setup_mb, /* setup[] */
1784 total_bytes, /* Total data bytes */
1785 param_pad,
1786 &xa->rep_param_mb,
1787 nt_unknown_secret,
1788 &xa->rep_data_mb);
1789 return ((rc == 0) ? SDRC_SUCCESS : SDRC_ERROR);
1790
1791 trans_err_too_small:
1792 rc = NERR_BufTooSmall;
1793 goto trans_err;
1794
1795 trans_err_not_supported:
1796 rc = ERROR_NOT_SUPPORTED;
1797 goto trans_err;
1798
1799 trans_err:
1800 pos = MBC_LENGTH(&sr->reply) + 23;
1801 rc = smbsr_encode_result(sr, 10, 4, "bww2.wwwwwwb.www",
1802 10, /* wct */
1803 4, 0, /* tpscnt tdscnt */
1804 4, pos, 0, /* pscnt psoff psdisp */
1805 0, 0, 0, /* dscnt dsoff dsdisp */
1806 0, /* suwcnt */
1807 4, /* bcc */
1808 rc,
1809 0); /* converter word? */
1810 return ((rc == 0) ? SDRC_SUCCESS : SDRC_ERROR);
1811 }
1812
1813 static uint32_t smb_xa_max_setup_count = 200;
1814 static uint32_t smb_xa_max_param_count = 32 * 1024;
1815 static uint32_t smb_xa_max_data_count = 64 * 1024;
1816
1817 smb_xa_t *
1818 smb_xa_create(
1819 smb_session_t *session,
1820 smb_request_t *sr,
1821 uint32_t total_parameter_count,
1822 uint32_t total_data_count,
1823 uint32_t max_parameter_count,
1824 uint32_t max_data_count,
1825 uint32_t max_setup_count,
1826 uint32_t setup_word_count)
1827 {
1828 smb_xa_t *xa, *nxa;
1829 smb_llist_t *xlist;
1830
1831 /*
1832 * Sanity check what the client says it will send.
1833 * Caller handles NULL return as ERRnoroom.
1834 */
1835 if (setup_word_count > smb_xa_max_setup_count)
1836 return (NULL);
1837 if (total_parameter_count > smb_xa_max_param_count)
1838 return (NULL);
1839 if (total_data_count > smb_xa_max_data_count)
1840 return (NULL);
1841
1842 /*
1843 * Limit what the client asks us to allocate for
1844 * returned setup, params, data.
1845 */
1846 if (max_setup_count > smb_xa_max_setup_count)
1847 max_setup_count = smb_xa_max_setup_count;
1848 if (max_parameter_count > smb_xa_max_param_count)
1849 max_parameter_count = smb_xa_max_param_count;
1850 if (max_data_count > smb_xa_max_data_count)
1851 max_data_count = smb_xa_max_data_count;
1852
1853 xa = kmem_zalloc(sizeof (smb_xa_t), KM_SLEEP);
1854 xa->xa_refcnt = 1;
1855 xa->smb_com = sr->smb_com;
1856 xa->smb_flg = sr->smb_flg;
1857 xa->smb_flg2 = sr->smb_flg2;
1858 xa->smb_tid = sr->smb_tid;
1859 xa->smb_pid = sr->smb_pid;
1860 xa->smb_uid = sr->smb_uid;
1861 xa->xa_smb_mid = sr->smb_mid;
1862 xa->xa_smb_fid = 0xFFFF;
1863 xa->reply_seqnum = sr->reply_seqnum;
1864 xa->smb_tpscnt = total_parameter_count;
1865 xa->smb_tdscnt = total_data_count;
1866 xa->smb_mprcnt = max_parameter_count;
1867 xa->smb_mdrcnt = max_data_count;
1868 xa->smb_msrcnt = max_setup_count;
1869 xa->smb_suwcnt = setup_word_count;
1870 xa->xa_session = session;
1871 xa->xa_magic = SMB_XA_MAGIC;
1872
1873 /* request parts */
1874 xa->req_setup_mb.max_bytes = setup_word_count * 2;
1875 xa->req_param_mb.max_bytes = total_parameter_count;
1876 xa->req_data_mb.max_bytes = total_data_count;
1877
1878 /* reply parts */
1879 xa->rep_setup_mb.max_bytes = max_setup_count * 2;
1880 xa->rep_param_mb.max_bytes = max_parameter_count;
1881 xa->rep_data_mb.max_bytes = max_data_count;
1882
1883 /*
1884 * The new xa structure is checked against the current list to see
1885 * if it exists already.
1886 */
1887 xlist = &session->s_xa_list;
1888 smb_llist_enter(xlist, RW_WRITER);
1889 nxa = smb_llist_head(xlist);
1890 while (nxa) {
1891 ASSERT(nxa->xa_magic == SMB_XA_MAGIC);
1892 if (nxa->xa_smb_mid == xa->xa_smb_mid &&
1893 nxa->smb_pid == xa->smb_pid &&
1894 !SMB_XA_CLOSED(nxa) &&
1895 !(nxa->xa_flags & SMB_XA_FLAG_COMPLETE)) {
1896 smb_llist_exit(xlist);
1897 kmem_free(xa, sizeof (smb_xa_t));
1898 return (NULL);
1899 }
1900 nxa = smb_llist_next(xlist, nxa);
1901 }
1902 smb_llist_insert_tail(xlist, xa);
1903 smb_llist_exit(xlist);
1904 return (xa);
1905 }
1906
1907 void
1908 smb_xa_delete(smb_xa_t *xa)
1909 {
1910 ASSERT(xa->xa_refcnt == 0);
1911 ASSERT(SMB_XA_CLOSED(xa));
1912
1913 if (xa->xa_pipe_name)
1914 smb_mem_free(xa->xa_pipe_name);
1915
1916 /* request parts */
1917 if (xa->req_setup_mb.chain != NULL)
1918 m_freem(xa->req_setup_mb.chain);
1919 if (xa->req_param_mb.chain != NULL)
1920 m_freem(xa->req_param_mb.chain);
1921 if (xa->req_data_mb.chain != NULL)
1922 m_freem(xa->req_data_mb.chain);
1923
1924 /* reply parts */
1925 if (xa->rep_setup_mb.chain != NULL)
1926 m_freem(xa->rep_setup_mb.chain);
1927 if (xa->rep_param_mb.chain != NULL)
1928 m_freem(xa->rep_param_mb.chain);
1929 if (xa->rep_data_mb.chain != NULL)
1930 m_freem(xa->rep_data_mb.chain);
1931
1932 xa->xa_magic = (uint32_t)~SMB_XA_MAGIC;
1933 kmem_free(xa, sizeof (smb_xa_t));
1934 }
1935
1936 smb_xa_t *
1937 smb_xa_hold(smb_xa_t *xa)
1938 {
1939 mutex_enter(&xa->xa_mutex);
1940 xa->xa_refcnt++;
1941 ASSERT(xa->xa_refcnt);
1942 mutex_exit(&xa->xa_mutex);
1943 return (xa);
1944 }
1945
1946 void
1947 smb_xa_rele(smb_session_t *session, smb_xa_t *xa)
1948 {
1949 mutex_enter(&xa->xa_mutex);
1950 ASSERT(xa->xa_refcnt);
1951 xa->xa_refcnt--;
1952 if (SMB_XA_CLOSED(xa) && (xa->xa_refcnt == 0)) {
1953 mutex_exit(&xa->xa_mutex);
1954 smb_llist_enter(&session->s_xa_list, RW_WRITER);
1955 smb_llist_remove(&session->s_xa_list, xa);
1956 smb_llist_exit(&session->s_xa_list);
1957 smb_xa_delete(xa);
1958 return;
1959 }
1960 mutex_exit(&xa->xa_mutex);
1961 }
1962
1963 int
1964 smb_xa_open(smb_xa_t *xa)
1965 {
1966 int rc;
1967
1968 mutex_enter(&xa->xa_mutex);
1969
1970 ASSERT((xa->xa_flags & SMB_XA_FLAG_OPEN) == 0);
1971
1972 if ((xa->xa_flags & SMB_XA_FLAG_CLOSE) == 0) {
1973 xa->xa_flags |= SMB_XA_FLAG_OPEN;
1974 rc = 0;
1975 } else {
1976 rc = ERROR_INVALID_HANDLE;
1977 }
1978
1979 mutex_exit(&xa->xa_mutex);
1980
1981 return (rc);
1982 }
1983
1984 void
1985 smb_xa_close(smb_xa_t *xa)
1986 {
1987 mutex_enter(&xa->xa_mutex);
1988 xa->xa_flags |= SMB_XA_FLAG_CLOSE;
1989 xa->xa_flags &= ~SMB_XA_FLAG_OPEN;
1990
1991 if (xa->xa_refcnt == 0) {
1992 mutex_exit(&xa->xa_mutex);
1993 smb_llist_enter(&xa->xa_session->s_xa_list, RW_WRITER);
1994 smb_llist_remove(&xa->xa_session->s_xa_list, xa);
1995 smb_llist_exit(&xa->xa_session->s_xa_list);
1996 smb_xa_delete(xa);
1997 return;
1998 }
1999
2000 mutex_exit(&xa->xa_mutex);
2001 }
2002
2003 int
2004 smb_xa_complete(smb_xa_t *xa)
2005 {
2006 int rc;
2007
2008 mutex_enter(&xa->xa_mutex);
2009 if (xa->xa_flags & (SMB_XA_FLAG_COMPLETE | SMB_XA_FLAG_CLOSE)) {
2010 rc = 0; /* error ("not complete") */
2011 } else {
2012 rc = 1; /* Yes, "complete" */
2013 xa->xa_flags |= SMB_XA_FLAG_COMPLETE;
2014
2015 /*
2016 * During trans & trans-secondary processing,
2017 * we copied the request data into these.
2018 * Now we want to parse them, so we need to
2019 * move the "finger" back to the beginning.
2020 */
2021 xa->req_setup_mb.chain_offset = 0;
2022 xa->req_param_mb.chain_offset = 0;
2023 xa->req_data_mb.chain_offset = 0;
2024 }
2025
2026 mutex_exit(&xa->xa_mutex);
2027 return (rc);
2028 }
2029
2030 smb_xa_t *
2031 smb_xa_find(
2032 smb_session_t *session,
2033 uint32_t pid,
2034 uint16_t mid)
2035 {
2036 smb_xa_t *xa;
2037 smb_llist_t *xlist;
2038
2039 xlist = &session->s_xa_list;
2040 smb_llist_enter(xlist, RW_READER);
2041 xa = smb_llist_head(xlist);
2042 while (xa) {
2043 mutex_enter(&xa->xa_mutex);
2044 if (xa->xa_smb_mid == mid &&
2045 xa->smb_pid == pid &&
2046 !SMB_XA_CLOSED(xa) &&
2047 !(xa->xa_flags & SMB_XA_FLAG_COMPLETE)) {
2048 xa->xa_refcnt++;
2049 ASSERT(xa->xa_refcnt);
2050 mutex_exit(&xa->xa_mutex);
2051 break;
2052 }
2053 mutex_exit(&xa->xa_mutex);
2054 xa = smb_llist_next(xlist, xa);
2055 }
2056 smb_llist_exit(xlist);
2057 return (xa);
2058 }