4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
25 */
26
27 /*
28 * SMB requests.
29 *
30 * Request
31 * Header
32 * Magic 0xFF 'S' 'M' 'B'
33 * smb_com a byte, the "first" command
34 * Error a 4-byte union, ignored in a request
35 * smb_flg a one byte set of eight flags
36 * smb_flg2 a two byte set of 16 flags
37 * . twelve reserved bytes, have a role
38 * in connectionless transports (IPX, UDP?)
39 * smb_tid a 16-bit tree ID, a mount point sorta,
40 * 0xFFFF is this command does not have
41 * or require a tree context
42 * smb_pid a 16-bit process ID
43 * smb_uid a 16-bit user ID, specific to this "session"
44 * and mapped to a system (bona-fide) UID
151 0x00, PC_NETWORK_PROGRAM_1_0 },
152 { "SmbDeleteDirectory", SMB_SDT_OPS(delete_directory), /* 0x01 001 */
153 0x01, PC_NETWORK_PROGRAM_1_0 },
154 { "SmbOpen", SMB_SDT_OPS(open), /* 0x02 002 */
155 0x02, PC_NETWORK_PROGRAM_1_0 },
156 { "SmbCreate", SMB_SDT_OPS(create), /* 0x03 003 */
157 0x03, PC_NETWORK_PROGRAM_1_0 },
158 { "SmbClose", SMB_SDT_OPS(close), /* 0x04 004 */
159 0x04, PC_NETWORK_PROGRAM_1_0 },
160 { "SmbFlush", SMB_SDT_OPS(flush), /* 0x05 005 */
161 0x05, PC_NETWORK_PROGRAM_1_0 },
162 { "SmbDelete", SMB_SDT_OPS(delete), /* 0x06 006 */
163 0x06, PC_NETWORK_PROGRAM_1_0 },
164 { "SmbRename", SMB_SDT_OPS(rename), /* 0x07 007 */
165 0x07, PC_NETWORK_PROGRAM_1_0 },
166 { "SmbQueryInformation", SMB_SDT_OPS(query_information), /* 0x08 008 */
167 0x08, PC_NETWORK_PROGRAM_1_0 },
168 { "SmbSetInformation", SMB_SDT_OPS(set_information), /* 0x09 009 */
169 0x09, PC_NETWORK_PROGRAM_1_0 },
170 { "SmbRead", SMB_SDT_OPS(read), /* 0x0A 010 */
171 0x0A, PC_NETWORK_PROGRAM_1_0 },
172 { "SmbWrite", SMB_SDT_OPS(write), /* 0x0B 011 */
173 0x0B, PC_NETWORK_PROGRAM_1_0 },
174 { "SmbLockByteRange", SMB_SDT_OPS(lock_byte_range), /* 0x0C 012 */
175 0x0C, PC_NETWORK_PROGRAM_1_0 },
176 { "SmbUnlockByteRange", SMB_SDT_OPS(unlock_byte_range), /* 0x0D 013 */
177 0x0D, PC_NETWORK_PROGRAM_1_0 },
178 { "SmbCreateTemporary", SMB_SDT_OPS(create_temporary), /* 0x0E 014 */
179 0x0E, PC_NETWORK_PROGRAM_1_0 },
180 { "SmbCreateNew", SMB_SDT_OPS(create_new), /* 0x0F 015 */
181 0x0F, PC_NETWORK_PROGRAM_1_0 },
182 { "SmbCheckDirectory", SMB_SDT_OPS(check_directory), /* 0x10 016 */
183 0x10, PC_NETWORK_PROGRAM_1_0 },
184 { "SmbProcessExit", SMB_SDT_OPS(process_exit), /* 0x11 017 */
185 0x11, PC_NETWORK_PROGRAM_1_0,
186 SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
187 { "SmbSeek", SMB_SDT_OPS(seek), /* 0x12 018 */
188 0x12, PC_NETWORK_PROGRAM_1_0 },
189 { "SmbLockAndRead", SMB_SDT_OPS(lock_and_read), /* 0x13 019 */
190 0x13, LANMAN1_0 },
191 { "SmbWriteAndUnlock", SMB_SDT_OPS(write_and_unlock), /* 0x14 020 */
192 0x14, LANMAN1_0 },
193 { "Invalid", SMB_SDT_OPS(invalid), 0x15, 0 }, /* 0x15 021 */
194 { "Invalid", SMB_SDT_OPS(invalid), 0x16, 0 }, /* 0x16 022 */
195 { "Invalid", SMB_SDT_OPS(invalid), 0x17, 0 }, /* 0x17 023 */
196 { "Invalid", SMB_SDT_OPS(invalid), 0x18, 0 }, /* 0x18 024 */
197 { "Invalid", SMB_SDT_OPS(invalid), 0x19, 0 }, /* 0x19 025 */
198 { "SmbReadRaw", SMB_SDT_OPS(invalid), 0x1A, 0 }, /* 0x1A 026 */
199 { "Invalid", SMB_SDT_OPS(invalid), 0x1B, 0 }, /* 0x1B 027 */
200 { "Invalid", SMB_SDT_OPS(invalid), 0x1C, 0 }, /* 0x1C 028 */
201 { "SmbWriteRaw", SMB_SDT_OPS(invalid), 0x1D, 0 }, /* 0x1D 029 */
202 { "Invalid", SMB_SDT_OPS(invalid), 0x1E, 0 }, /* 0x1E 030 */
203 { "Invalid", SMB_SDT_OPS(invalid), 0x1F, 0 }, /* 0x1F 031 */
204 { "Invalid", SMB_SDT_OPS(invalid), 0x20, 0 }, /* 0x20 032 */
205 { "Invalid", SMB_SDT_OPS(invalid), 0x21, 0 }, /* 0x21 033 */
206 { "SmbSetInformation2", SMB_SDT_OPS(set_information2), /* 0x22 034 */
207 0x22, LANMAN1_0 },
208 { "SmbQueryInformation2",
209 SMB_SDT_OPS(query_information2), /* 0x23 035 */
210 0x23, LANMAN1_0 },
211 { "SmbLockingX", SMB_SDT_OPS(locking_andx), /* 0x24 036 */
212 0x24, LANMAN1_0 },
213 { "SmbTransaction", SMB_SDT_OPS(transaction), /* 0x25 037 */
214 0x25, LANMAN1_0 },
215 { "SmbTransactionSecondary",
216 SMB_SDT_OPS(transaction_secondary), /* 0x26 038 */
217 0x26, LANMAN1_0 },
218 { "SmbIoctl", SMB_SDT_OPS(ioctl), /* 0x27 039 */
219 0x27, LANMAN1_0 },
220 { "Invalid", SMB_SDT_OPS(invalid), 0x28, 0 }, /* 0x28 040 */
221 { "Invalid", SMB_SDT_OPS(invalid), 0x29, 0 }, /* 0x29 041 */
222 { "Invalid", SMB_SDT_OPS(invalid), 0x2A, 0 }, /* 0x2A 042 */
223 { "SmbEcho", SMB_SDT_OPS(echo), /* 0x2B 043 */
224 0x2B, LANMAN1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
225 { "SmbWriteAndClose", SMB_SDT_OPS(write_and_close), /* 0x2C 044 */
226 0x2C, LANMAN1_0 },
227 { "SmbOpenX", SMB_SDT_OPS(open_andx), /* 0x2D 045 */
228 0x2D, LANMAN1_0 },
229 { "SmbReadX", SMB_SDT_OPS(read_andx), /* 0x2E 046 */
230 0x2E, LANMAN1_0 },
231 { "SmbWriteX", SMB_SDT_OPS(write_andx), /* 0x2F 047 */
232 0x2F, LANMAN1_0 },
233 { "Invalid", SMB_SDT_OPS(invalid), 0x30, 0 }, /* 0x30 048 */
234 { "SmbCloseAndTreeDisconnect",
235 SMB_SDT_OPS(close_and_tree_disconnect), /* 0x31 049 */
236 0x31, LANMAN1_0 },
237 { "SmbTransaction2", SMB_SDT_OPS(transaction2), /* 0x32 050 */
238 0x32, LM1_2X002 },
239 { "SmbTransaction2Secondary",
240 SMB_SDT_OPS(transaction2_secondary), /* 0x33 051 */
241 0x33, LM1_2X002 },
242 { "SmbFindClose2", SMB_SDT_OPS(find_close2), /* 0x34 052 */
243 0x34, LM1_2X002 },
244 { "Invalid", SMB_SDT_OPS(invalid), 0x35, 0 }, /* 0x35 053 */
245 { "Invalid", SMB_SDT_OPS(invalid), 0x36, 0 }, /* 0x36 054 */
246 { "Invalid", SMB_SDT_OPS(invalid), 0x37, 0 }, /* 0x37 055 */
247 { "Invalid", SMB_SDT_OPS(invalid), 0x38, 0 }, /* 0x38 056 */
248 { "Invalid", SMB_SDT_OPS(invalid), 0x39, 0 }, /* 0x39 057 */
249 { "Invalid", SMB_SDT_OPS(invalid), 0x3A, 0 }, /* 0x3A 058 */
250 { "Invalid", SMB_SDT_OPS(invalid), 0x3B, 0 }, /* 0x3B 059 */
251 { "Invalid", SMB_SDT_OPS(invalid), 0x3C, 0 }, /* 0x3C 060 */
252 { "Invalid", SMB_SDT_OPS(invalid), 0x3D, 0 }, /* 0x3D 061 */
391 { "Invalid", SMB_SDT_OPS(invalid), 0xAF, 0, 0 }, /* 0xAF 175 */
392 { "Invalid", SMB_SDT_OPS(invalid), 0xB0, 0, 0 }, /* 0xB0 176 */
393 { "Invalid", SMB_SDT_OPS(invalid), 0xB1, 0, 0 }, /* 0xB1 177 */
394 { "Invalid", SMB_SDT_OPS(invalid), 0xB2, 0, 0 }, /* 0xB2 178 */
395 { "Invalid", SMB_SDT_OPS(invalid), 0xB3, 0, 0 }, /* 0xB3 179 */
396 { "Invalid", SMB_SDT_OPS(invalid), 0xB4, 0, 0 }, /* 0xB4 180 */
397 { "Invalid", SMB_SDT_OPS(invalid), 0xB5, 0, 0 }, /* 0xB5 181 */
398 { "Invalid", SMB_SDT_OPS(invalid), 0xB6, 0, 0 }, /* 0xB6 182 */
399 { "Invalid", SMB_SDT_OPS(invalid), 0xB7, 0, 0 }, /* 0xB7 183 */
400 { "Invalid", SMB_SDT_OPS(invalid), 0xB8, 0, 0 }, /* 0xB8 184 */
401 { "Invalid", SMB_SDT_OPS(invalid), 0xB9, 0, 0 }, /* 0xB9 185 */
402 { "Invalid", SMB_SDT_OPS(invalid), 0xBA, 0, 0 }, /* 0xBA 186 */
403 { "Invalid", SMB_SDT_OPS(invalid), 0xBB, 0, 0 }, /* 0xBB 187 */
404 { "Invalid", SMB_SDT_OPS(invalid), 0xBC, 0, 0 }, /* 0xBC 188 */
405 { "Invalid", SMB_SDT_OPS(invalid), 0xBD, 0, 0 }, /* 0xBD 189 */
406 { "Invalid", SMB_SDT_OPS(invalid), 0xBE, 0, 0 }, /* 0xBE 190 */
407 { "Invalid", SMB_SDT_OPS(invalid), 0xBF, 0, 0 }, /* 0xBF 191 */
408 { "SmbOpenPrintFile", SMB_SDT_OPS(open_print_file), /* 0xC0 192 */
409 0xC0, PC_NETWORK_PROGRAM_1_0, 0 },
410 { "SmbWritePrintFile", SMB_SDT_OPS(write_print_file), /* 0xC1 193 */
411 0xC1, PC_NETWORK_PROGRAM_1_0, 0 },
412 { "SmbClosePrintFile", SMB_SDT_OPS(close_print_file), /* 0xC2 194 */
413 0xC2, PC_NETWORK_PROGRAM_1_0, 0 },
414 { "SmbGetPrintQueue", SMB_SDT_OPS(get_print_queue), /* 0xC3 195 */
415 0xC3, PC_NETWORK_PROGRAM_1_0, 0 },
416 { "Invalid", SMB_SDT_OPS(invalid), 0xC4, 0, 0 }, /* 0xC4 196 */
417 { "Invalid", SMB_SDT_OPS(invalid), 0xC5, 0, 0 }, /* 0xC5 197 */
418 { "Invalid", SMB_SDT_OPS(invalid), 0xC6, 0, 0 }, /* 0xC6 198 */
419 { "Invalid", SMB_SDT_OPS(invalid), 0xC7, 0, 0 }, /* 0xC7 199 */
420 { "Invalid", SMB_SDT_OPS(invalid), 0xC8, 0, 0 }, /* 0xC8 200 */
421 { "Invalid", SMB_SDT_OPS(invalid), 0xC9, 0, 0 }, /* 0xC9 201 */
422 { "Invalid", SMB_SDT_OPS(invalid), 0xCA, 0, 0 }, /* 0xCA 202 */
423 { "Invalid", SMB_SDT_OPS(invalid), 0xCB, 0, 0 }, /* 0xCB 203 */
424 { "Invalid", SMB_SDT_OPS(invalid), 0xCC, 0, 0 }, /* 0xCC 204 */
425 { "Invalid", SMB_SDT_OPS(invalid), 0xCD, 0, 0 }, /* 0xCD 205 */
426 { "Invalid", SMB_SDT_OPS(invalid), 0xCE, 0, 0 }, /* 0xCE 206 */
427 { "Invalid", SMB_SDT_OPS(invalid), 0xCF, 0, 0 }, /* 0xCF 207 */
428 { "Invalid", SMB_SDT_OPS(invalid), 0xD0, 0, 0 }, /* 0xD0 208 */
429 { "Invalid", SMB_SDT_OPS(invalid), 0xD1, 0, 0 }, /* 0xD1 209 */
430 { "Invalid", SMB_SDT_OPS(invalid), 0xD2, 0, 0 }, /* 0xD2 210 */
431 { "Invalid", SMB_SDT_OPS(invalid), 0xD3, 0, 0 }, /* 0xD3 211 */
486
487 void
488 smbsr_cleanup(smb_request_t *sr)
489 {
490 ASSERT((sr->sr_state != SMB_REQ_STATE_CLEANED_UP) &&
491 (sr->sr_state != SMB_REQ_STATE_COMPLETED));
492
493 if (sr->r_xa) {
494 if (sr->r_xa->xa_flags & SMB_XA_FLAG_COMPLETE)
495 smb_xa_close(sr->r_xa);
496 smb_xa_rele(sr->session, sr->r_xa);
497 sr->r_xa = NULL;
498 }
499
500 /*
501 * Mark this request so we know that we've already cleaned it up.
502 * A request should only get cleaned up once so multiple calls to
503 * smbsr_cleanup for the same request indicate a bug.
504 */
505 mutex_enter(&sr->sr_mutex);
506 if (sr->sr_state != SMB_REQ_STATE_CANCELED)
507 sr->sr_state = SMB_REQ_STATE_CLEANED_UP;
508 mutex_exit(&sr->sr_mutex);
509 }
510
511 /*
512 * This is the SMB1 handler for new smb requests, called from
513 * smb_session_reader after SMB negotiate is done. For most SMB
514 * requests, we just enqueue them for the smb_session_worker to
515 * execute via the task queue, so they can block for resources
516 * without stopping the reader thread. A few protocol messages
517 * are special cases and are handled directly here in the reader
518 * thread so they don't wait for taskq scheduling. Later, a few
519 * MORE things could be handled here, such as REPLY messages
520 * (oplock break reply) and things like "NT_cancel".
521 *
522 * This function must either enqueue the new request for
523 * execution via the task queue, or execute it directly
524 * and then free it. If this returns non-zero, the caller
525 * will drop the session.
526 */
527 int
528 smb1sr_newrq(smb_request_t *sr)
529 {
530 uint32_t magic;
531
532 magic = SMB_READ_PROTOCOL(sr->sr_request_buf);
533 if (magic != SMB_PROTOCOL_MAGIC) {
534 smb_request_free(sr);
535 return (EPROTO);
536 }
537
538 if (sr->session->signing.flags & SMB_SIGNING_ENABLED) {
539 if (SMB_IS_NT_CANCEL(sr)) {
540 sr->session->signing.seqnum++;
541 sr->sr_seqnum = sr->session->signing.seqnum + 1;
542 sr->reply_seqnum = 0;
543 } else {
544 sr->session->signing.seqnum += 2;
545 sr->sr_seqnum = sr->session->signing.seqnum;
546 sr->reply_seqnum = sr->sr_seqnum + 1;
547 }
548 }
549
550 /*
551 * Submit the request to the task queue, which calls
552 * smb1_tq_work when the workload permits.
553 */
554 sr->sr_time_submitted = gethrtime();
555 sr->sr_state = SMB_REQ_STATE_SUBMITTED;
556 smb_srqueue_waitq_enter(sr->session->s_srqueue);
557 (void) taskq_dispatch(sr->sr_server->sv_worker_pool,
558 smb1_tq_work, sr, TQ_SLEEP);
559
560 return (0);
561 }
562
563 static void
564 smb1_tq_work(void *arg)
565 {
566 smb_request_t *sr;
567 smb_srqueue_t *srq;
568
569 sr = (smb_request_t *)arg;
570 SMB_REQ_VALID(sr);
571
572 srq = sr->session->s_srqueue;
573 smb_srqueue_waitq_to_runq(srq);
574 sr->sr_worker = curthread;
575 sr->sr_time_active = gethrtime();
576
577 mutex_enter(&sr->sr_mutex);
578 switch (sr->sr_state) {
579 case SMB_REQ_STATE_SUBMITTED:
580 mutex_exit(&sr->sr_mutex);
581 smb1sr_work(sr);
582 sr = NULL;
583 break;
584
585 default:
586 /*
587 * SMB1 requests that have been cancelled
588 * have no reply. Just free it.
589 */
590 sr->sr_state = SMB_REQ_STATE_COMPLETED;
591 mutex_exit(&sr->sr_mutex);
592 smb_request_free(sr);
593 break;
594 }
595 smb_srqueue_runq_exit(srq);
596 }
597
598 /*
599 * smb1sr_work
600 *
601 * In most cases, this should free the request before return.
602 * Exceptions are when a dispatch function returns SDRC_SR_KEPT.
603 */
604 void
605 smb1sr_work(struct smb_request *sr)
606 {
607 smb_sdrc_t sdrc;
608 const smb_disp_entry_t *sdd;
609 smb_disp_stats_t *sds;
610 boolean_t disconnect = B_FALSE;
611 smb_session_t *session;
612 smb_server_t *server;
613 uint32_t byte_count;
614 uint32_t max_bytes;
615 uint16_t pid_hi, pid_lo;
616
617 session = sr->session;
618 server = session->s_server;
619
620 ASSERT(sr->tid_tree == 0);
621 ASSERT(sr->uid_user == 0);
622 ASSERT(sr->fid_ofile == 0);
623 sr->smb_fid = (uint16_t)-1;
624
625 /* temporary until we identify a user */
626 sr->user_cr = zone_kcred();
627 sr->orig_request_hdr = sr->command.chain_offset;
628
629 /*
630 * Decode the SMB header.
631 */
632 if (smb_mbc_decodef(&sr->command, SMB_HEADER_ED_FMT,
661 sr->smb_rcls = 0;
662 sr->smb_reh = 0;
663 sr->smb_err = 0;
664 sr->smb_flg2 &= ~SMB_FLAGS2_NT_STATUS;
665
666 (void) smb_mbc_encodef(&sr->reply, SMB_HEADER_ED_FMT,
667 sr->smb_com,
668 sr->smb_rcls,
669 sr->smb_reh,
670 sr->smb_err,
671 sr->smb_flg,
672 sr->smb_flg2,
673 pid_hi,
674 sr->smb_sig,
675 sr->smb_tid,
676 pid_lo,
677 sr->smb_uid,
678 sr->smb_mid);
679 sr->first_smb_com = sr->smb_com;
680
681 if ((session->signing.flags & SMB_SIGNING_CHECK) != 0) {
682 if ((sr->smb_flg2 & SMB_FLAGS2_SMB_SECURITY_SIGNATURE) == 0 ||
683 smb_sign_check_request(sr) != 0) {
684 smbsr_error(sr, NT_STATUS_ACCESS_DENIED,
685 ERRDOS, ERROR_ACCESS_DENIED);
686 disconnect = B_TRUE;
687 goto report_error;
688 }
689 }
690
691 andx_more:
692 sdd = &smb_disp_table[sr->smb_com];
693 ASSERT(sdd->sdt_function);
694 sds = &server->sv_disp_stats1[sr->smb_com];
695
696 if (smb_mbc_decodef(&sr->command, "b", &sr->smb_wct) != 0) {
697 disconnect = B_TRUE;
698 goto report_error;
699 }
700
701 (void) MBC_SHADOW_CHAIN(&sr->smb_vwv, &sr->command,
702 sr->command.chain_offset, sr->smb_wct * 2);
703
704 if (smb_mbc_decodef(&sr->command, "#.w", sr->smb_wct*2, &sr->smb_bcc)) {
705 disconnect = B_TRUE;
706 goto report_error;
707 }
708
709 atomic_add_64(&sds->sdt_rxb,
710 (int64_t)(sr->smb_wct * 2 + sr->smb_bcc + 1));
711 sr->sr_txb = sr->reply.chain_offset;
712
713 /*
714 * Ignore smb_bcc if CAP_LARGE_READX/CAP_LARGE_WRITEX
715 * and this is SmbReadX/SmbWriteX since this enables
716 * large reads/write and bcc is only 16-bits.
717 */
718 max_bytes = sr->command.max_bytes - sr->command.chain_offset;
719 if (sr->smb_com == SMB_COM_WRITE_ANDX) {
720 /* Allow > BCC */
721 byte_count = max_bytes;
722 } else if (max_bytes < (uint32_t)sr->smb_bcc) {
723 /* BCC is bogus. Will fail later. */
724 byte_count = max_bytes;
725 } else {
726 /* ordinary case */
727 byte_count = (uint32_t)sr->smb_bcc;
728 }
729
730 (void) MBC_SHADOW_CHAIN(&sr->smb_data, &sr->command,
731 sr->command.chain_offset, byte_count);
732
733 sr->command.chain_offset += byte_count;
734 if (sr->command.chain_offset > sr->command.max_bytes) {
735 disconnect = B_TRUE;
736 goto report_error;
737 }
738
739 /* Store pointers for later */
740 sr->cur_reply_offset = sr->reply.chain_offset;
741
742 if (is_andx_com(sr->smb_com)) {
743 /* Peek ahead and don't disturb vwv */
744 if (smb_mbc_peek(&sr->smb_vwv, sr->smb_vwv.chain_offset, "b.w",
745 &sr->andx_com, &sr->andx_off) < 0) {
746 disconnect = B_TRUE;
747 goto report_error;
748 }
749 } else {
750 sr->andx_com = (unsigned char)-1;
751 }
752
753 mutex_enter(&sr->sr_mutex);
754 switch (sr->sr_state) {
755 case SMB_REQ_STATE_SUBMITTED:
756 case SMB_REQ_STATE_CLEANED_UP:
757 sr->sr_state = SMB_REQ_STATE_ACTIVE;
758 break;
759 case SMB_REQ_STATE_CANCELED:
760 break;
761 default:
762 ASSERT(0);
763 break;
764 }
765 mutex_exit(&sr->sr_mutex);
766
767 /*
768 * Setup UID and TID information (if required). Both functions
769 * will set the sr credentials. In domain mode, the user and
770 * tree credentials should be the same. In share mode, the
771 * tree credentials (defined in the share definition) should
772 * override the user credentials.
773 */
774 if (!(sdd->sdt_flags & SDDF_SUPPRESS_UID) && (sr->uid_user == NULL)) {
775 sr->uid_user = smb_session_lookup_uid(session, sr->smb_uid);
776 if (sr->uid_user == NULL) {
777 smbsr_error(sr, 0, ERRSRV, ERRbaduid);
778 smbsr_cleanup(sr);
779 goto report_error;
781
782 sr->user_cr = smb_user_getcred(sr->uid_user);
783 }
784 if (!(sdd->sdt_flags & SDDF_SUPPRESS_TID) && (sr->tid_tree == NULL)) {
785 sr->tid_tree = smb_session_lookup_tree(session, sr->smb_tid);
786 if (sr->tid_tree == NULL) {
787 smbsr_error(sr, 0, ERRSRV, ERRinvnid);
788 smbsr_cleanup(sr);
789 goto report_error;
790 }
791 }
792
793 sr->sr_time_start = gethrtime();
794 if ((sdrc = (*sdd->sdt_pre_op)(sr)) == SDRC_SUCCESS)
795 sdrc = (*sdd->sdt_function)(sr);
796
797 if (sdrc != SDRC_SR_KEPT) {
798 (*sdd->sdt_post_op)(sr);
799 smbsr_cleanup(sr);
800 }
801 smb_latency_add_sample(&sds->sdt_lat, gethrtime() - sr->sr_time_start);
802
803 atomic_add_64(&sds->sdt_txb,
804 (int64_t)(sr->reply.chain_offset - sr->sr_txb));
805
806 switch (sdrc) {
807 case SDRC_SUCCESS:
808 break;
809
810 case SDRC_DROP_VC:
811 disconnect = B_TRUE;
812 goto drop_connection;
813
814 case SDRC_NO_REPLY:
815 /* will free sr */
816 goto out;
817
818 case SDRC_SR_KEPT:
819 /* Do NOT free sr */
820 sr = NULL;
821 goto out;
822
823 case SDRC_ERROR:
824 goto report_error;
825
844 sr->andx_com, MBC_LENGTH(&sr->reply));
845
846 sr->command.chain_offset = sr->orig_request_hdr + sr->andx_off;
847 sr->smb_com = sr->andx_com;
848 goto andx_more;
849
850 report_error:
851 sr->reply.chain_offset = sr->cur_reply_offset;
852 (void) smb_mbc_encodef(&sr->reply, "bw", 0, 0);
853
854 sr->smb_wct = 0;
855 sr->smb_bcc = 0;
856
857 if (sr->smb_rcls == 0 && sr->smb_reh == 0 && sr->smb_err == 0)
858 smbsr_error(sr, 0, ERRSRV, ERRerror);
859
860 reply_ready:
861 smbsr_send_reply(sr);
862
863 drop_connection:
864 if (disconnect) {
865 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
866 switch (session->s_state) {
867 case SMB_SESSION_STATE_DISCONNECTED:
868 case SMB_SESSION_STATE_TERMINATED:
869 break;
870 default:
871 smb_soshutdown(session->sock);
872 session->s_state = SMB_SESSION_STATE_DISCONNECTED;
873 break;
874 }
875 smb_rwx_rwexit(&session->s_lock);
876 }
877
878 out:
879 if (sr != NULL) {
880 mutex_enter(&sr->sr_mutex);
881 sr->sr_state = SMB_REQ_STATE_COMPLETED;
882 mutex_exit(&sr->sr_mutex);
883 smb_request_free(sr);
884 }
885 }
886
887 int
888 smbsr_encode_empty_result(struct smb_request *sr)
889 {
890 return (smbsr_encode_result(sr, 0, 0, "bw", 0, 0));
891 }
892
893 int
894 smbsr_encode_result(struct smb_request *sr, int wct, int bcc,
895 const char *fmt, ...)
896 {
1169 case SMB_COM_LOGOFF_ANDX:
1170 case SMB_COM_TREE_CONNECT_ANDX:
1171 case SMB_COM_NT_CREATE_ANDX:
1172 return (1);
1173 }
1174 return (0);
1175 }
1176
1177 /*
1178 * Invalid command stubs.
1179 *
1180 * The Read/Write Block Multiplexed (mpx) protocol is used to maximize
1181 * performance when reading/writing a large block of data: it can be
1182 * used in parallel with other client/server operations. The mpx sub-
1183 * protocol is not supported because we support only connection oriented
1184 * transports and NT supports mpx only over connectionless transports.
1185 */
1186 smb_sdrc_t
1187 smb_pre_invalid(smb_request_t *sr)
1188 {
1189 DTRACE_SMB_1(op__Invalid__start, smb_request_t *, sr);
1190 return (SDRC_SUCCESS);
1191 }
1192
1193 void
1194 smb_post_invalid(smb_request_t *sr)
1195 {
1196 DTRACE_SMB_1(op__Invalid__done, smb_request_t *, sr);
1197 }
1198
1199 smb_sdrc_t
1200 smb_com_invalid(smb_request_t *sr)
1201 {
1202 smb_sdrc_t sdrc;
1203
1204 switch (sr->smb_com) {
1205 case SMB_COM_WRITE_COMPLETE:
1206 smbsr_error(sr, 0, ERRSRV, ERRerror);
1207 sdrc = SDRC_ERROR;
1208 break;
1209
1210 default:
1211 smbsr_error(sr, NT_STATUS_NOT_IMPLEMENTED,
1212 ERRDOS, ERROR_INVALID_FUNCTION);
1213 sdrc = SDRC_NOT_IMPLEMENTED;
1214 break;
1215 }
1216
|
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2019 Nexenta Systems, Inc. All rights reserved.
25 */
26
27 /*
28 * SMB requests.
29 *
30 * Request
31 * Header
32 * Magic 0xFF 'S' 'M' 'B'
33 * smb_com a byte, the "first" command
34 * Error a 4-byte union, ignored in a request
35 * smb_flg a one byte set of eight flags
36 * smb_flg2 a two byte set of 16 flags
37 * . twelve reserved bytes, have a role
38 * in connectionless transports (IPX, UDP?)
39 * smb_tid a 16-bit tree ID, a mount point sorta,
40 * 0xFFFF is this command does not have
41 * or require a tree context
42 * smb_pid a 16-bit process ID
43 * smb_uid a 16-bit user ID, specific to this "session"
44 * and mapped to a system (bona-fide) UID
151 0x00, PC_NETWORK_PROGRAM_1_0 },
152 { "SmbDeleteDirectory", SMB_SDT_OPS(delete_directory), /* 0x01 001 */
153 0x01, PC_NETWORK_PROGRAM_1_0 },
154 { "SmbOpen", SMB_SDT_OPS(open), /* 0x02 002 */
155 0x02, PC_NETWORK_PROGRAM_1_0 },
156 { "SmbCreate", SMB_SDT_OPS(create), /* 0x03 003 */
157 0x03, PC_NETWORK_PROGRAM_1_0 },
158 { "SmbClose", SMB_SDT_OPS(close), /* 0x04 004 */
159 0x04, PC_NETWORK_PROGRAM_1_0 },
160 { "SmbFlush", SMB_SDT_OPS(flush), /* 0x05 005 */
161 0x05, PC_NETWORK_PROGRAM_1_0 },
162 { "SmbDelete", SMB_SDT_OPS(delete), /* 0x06 006 */
163 0x06, PC_NETWORK_PROGRAM_1_0 },
164 { "SmbRename", SMB_SDT_OPS(rename), /* 0x07 007 */
165 0x07, PC_NETWORK_PROGRAM_1_0 },
166 { "SmbQueryInformation", SMB_SDT_OPS(query_information), /* 0x08 008 */
167 0x08, PC_NETWORK_PROGRAM_1_0 },
168 { "SmbSetInformation", SMB_SDT_OPS(set_information), /* 0x09 009 */
169 0x09, PC_NETWORK_PROGRAM_1_0 },
170 { "SmbRead", SMB_SDT_OPS(read), /* 0x0A 010 */
171 0x0A, PC_NETWORK_PROGRAM_1_0, SDDF_READOP },
172 { "SmbWrite", SMB_SDT_OPS(write), /* 0x0B 011 */
173 0x0B, PC_NETWORK_PROGRAM_1_0, SDDF_WRITEOP },
174 { "SmbLockByteRange", SMB_SDT_OPS(lock_byte_range), /* 0x0C 012 */
175 0x0C, PC_NETWORK_PROGRAM_1_0 },
176 { "SmbUnlockByteRange", SMB_SDT_OPS(unlock_byte_range), /* 0x0D 013 */
177 0x0D, PC_NETWORK_PROGRAM_1_0 },
178 { "SmbCreateTemporary", SMB_SDT_OPS(create_temporary), /* 0x0E 014 */
179 0x0E, PC_NETWORK_PROGRAM_1_0 },
180 { "SmbCreateNew", SMB_SDT_OPS(create_new), /* 0x0F 015 */
181 0x0F, PC_NETWORK_PROGRAM_1_0 },
182 { "SmbCheckDirectory", SMB_SDT_OPS(check_directory), /* 0x10 016 */
183 0x10, PC_NETWORK_PROGRAM_1_0 },
184 { "SmbProcessExit", SMB_SDT_OPS(process_exit), /* 0x11 017 */
185 0x11, PC_NETWORK_PROGRAM_1_0,
186 SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
187 { "SmbSeek", SMB_SDT_OPS(seek), /* 0x12 018 */
188 0x12, PC_NETWORK_PROGRAM_1_0 },
189 { "SmbLockAndRead", SMB_SDT_OPS(lock_and_read), /* 0x13 019 */
190 0x13, LANMAN1_0, SDDF_READOP},
191 { "SmbWriteAndUnlock", SMB_SDT_OPS(write_and_unlock), /* 0x14 020 */
192 0x14, LANMAN1_0, SDDF_WRITEOP },
193 { "Invalid", SMB_SDT_OPS(invalid), 0x15, 0 }, /* 0x15 021 */
194 { "Invalid", SMB_SDT_OPS(invalid), 0x16, 0 }, /* 0x16 022 */
195 { "Invalid", SMB_SDT_OPS(invalid), 0x17, 0 }, /* 0x17 023 */
196 { "Invalid", SMB_SDT_OPS(invalid), 0x18, 0 }, /* 0x18 024 */
197 { "Invalid", SMB_SDT_OPS(invalid), 0x19, 0 }, /* 0x19 025 */
198 { "SmbReadRaw", SMB_SDT_OPS(read_raw), /* 0x1A 026 */
199 0x1A, LANMAN1_0 },
200 { "Invalid", SMB_SDT_OPS(invalid), 0x1B, 0 }, /* 0x1B 027 */
201 { "Invalid", SMB_SDT_OPS(invalid), 0x1C, 0 }, /* 0x1C 028 */
202 { "SmbWriteRaw", SMB_SDT_OPS(write_raw), /* 0x1D 029 */
203 0x1D, LANMAN1_0 },
204 { "Invalid", SMB_SDT_OPS(invalid), 0x1E, 0 }, /* 0x1E 030 */
205 { "Invalid", SMB_SDT_OPS(invalid), 0x1F, 0 }, /* 0x1F 031 */
206 { "Invalid", SMB_SDT_OPS(invalid), 0x20, 0 }, /* 0x20 032 */
207 { "Invalid", SMB_SDT_OPS(invalid), 0x21, 0 }, /* 0x21 033 */
208 { "SmbSetInformation2", SMB_SDT_OPS(set_information2), /* 0x22 034 */
209 0x22, LANMAN1_0 },
210 { "SmbQueryInformation2",
211 SMB_SDT_OPS(query_information2), /* 0x23 035 */
212 0x23, LANMAN1_0 },
213 { "SmbLockingX", SMB_SDT_OPS(locking_andx), /* 0x24 036 */
214 0x24, LANMAN1_0 },
215 { "SmbTransaction", SMB_SDT_OPS(transaction), /* 0x25 037 */
216 0x25, LANMAN1_0 },
217 { "SmbTransactionSecondary",
218 SMB_SDT_OPS(transaction_secondary), /* 0x26 038 */
219 0x26, LANMAN1_0 },
220 { "SmbIoctl", SMB_SDT_OPS(ioctl), /* 0x27 039 */
221 0x27, LANMAN1_0 },
222 { "Invalid", SMB_SDT_OPS(invalid), 0x28, 0 }, /* 0x28 040 */
223 { "Invalid", SMB_SDT_OPS(invalid), 0x29, 0 }, /* 0x29 041 */
224 { "Invalid", SMB_SDT_OPS(invalid), 0x2A, 0 }, /* 0x2A 042 */
225 { "SmbEcho", SMB_SDT_OPS(echo), /* 0x2B 043 */
226 0x2B, LANMAN1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
227 { "SmbWriteAndClose", SMB_SDT_OPS(write_and_close), /* 0x2C 044 */
228 0x2C, LANMAN1_0, SDDF_WRITEOP },
229 { "SmbOpenX", SMB_SDT_OPS(open_andx), /* 0x2D 045 */
230 0x2D, LANMAN1_0 },
231 { "SmbReadX", SMB_SDT_OPS(read_andx), /* 0x2E 046 */
232 0x2E, LANMAN1_0, SDDF_READOP },
233 { "SmbWriteX", SMB_SDT_OPS(write_andx), /* 0x2F 047 */
234 0x2F, LANMAN1_0, SDDF_WRITEOP },
235 { "Invalid", SMB_SDT_OPS(invalid), 0x30, 0 }, /* 0x30 048 */
236 { "SmbCloseAndTreeDisconnect",
237 SMB_SDT_OPS(close_and_tree_disconnect), /* 0x31 049 */
238 0x31, LANMAN1_0 },
239 { "SmbTransaction2", SMB_SDT_OPS(transaction2), /* 0x32 050 */
240 0x32, LM1_2X002 },
241 { "SmbTransaction2Secondary",
242 SMB_SDT_OPS(transaction2_secondary), /* 0x33 051 */
243 0x33, LM1_2X002 },
244 { "SmbFindClose2", SMB_SDT_OPS(find_close2), /* 0x34 052 */
245 0x34, LM1_2X002 },
246 { "Invalid", SMB_SDT_OPS(invalid), 0x35, 0 }, /* 0x35 053 */
247 { "Invalid", SMB_SDT_OPS(invalid), 0x36, 0 }, /* 0x36 054 */
248 { "Invalid", SMB_SDT_OPS(invalid), 0x37, 0 }, /* 0x37 055 */
249 { "Invalid", SMB_SDT_OPS(invalid), 0x38, 0 }, /* 0x38 056 */
250 { "Invalid", SMB_SDT_OPS(invalid), 0x39, 0 }, /* 0x39 057 */
251 { "Invalid", SMB_SDT_OPS(invalid), 0x3A, 0 }, /* 0x3A 058 */
252 { "Invalid", SMB_SDT_OPS(invalid), 0x3B, 0 }, /* 0x3B 059 */
253 { "Invalid", SMB_SDT_OPS(invalid), 0x3C, 0 }, /* 0x3C 060 */
254 { "Invalid", SMB_SDT_OPS(invalid), 0x3D, 0 }, /* 0x3D 061 */
393 { "Invalid", SMB_SDT_OPS(invalid), 0xAF, 0, 0 }, /* 0xAF 175 */
394 { "Invalid", SMB_SDT_OPS(invalid), 0xB0, 0, 0 }, /* 0xB0 176 */
395 { "Invalid", SMB_SDT_OPS(invalid), 0xB1, 0, 0 }, /* 0xB1 177 */
396 { "Invalid", SMB_SDT_OPS(invalid), 0xB2, 0, 0 }, /* 0xB2 178 */
397 { "Invalid", SMB_SDT_OPS(invalid), 0xB3, 0, 0 }, /* 0xB3 179 */
398 { "Invalid", SMB_SDT_OPS(invalid), 0xB4, 0, 0 }, /* 0xB4 180 */
399 { "Invalid", SMB_SDT_OPS(invalid), 0xB5, 0, 0 }, /* 0xB5 181 */
400 { "Invalid", SMB_SDT_OPS(invalid), 0xB6, 0, 0 }, /* 0xB6 182 */
401 { "Invalid", SMB_SDT_OPS(invalid), 0xB7, 0, 0 }, /* 0xB7 183 */
402 { "Invalid", SMB_SDT_OPS(invalid), 0xB8, 0, 0 }, /* 0xB8 184 */
403 { "Invalid", SMB_SDT_OPS(invalid), 0xB9, 0, 0 }, /* 0xB9 185 */
404 { "Invalid", SMB_SDT_OPS(invalid), 0xBA, 0, 0 }, /* 0xBA 186 */
405 { "Invalid", SMB_SDT_OPS(invalid), 0xBB, 0, 0 }, /* 0xBB 187 */
406 { "Invalid", SMB_SDT_OPS(invalid), 0xBC, 0, 0 }, /* 0xBC 188 */
407 { "Invalid", SMB_SDT_OPS(invalid), 0xBD, 0, 0 }, /* 0xBD 189 */
408 { "Invalid", SMB_SDT_OPS(invalid), 0xBE, 0, 0 }, /* 0xBE 190 */
409 { "Invalid", SMB_SDT_OPS(invalid), 0xBF, 0, 0 }, /* 0xBF 191 */
410 { "SmbOpenPrintFile", SMB_SDT_OPS(open_print_file), /* 0xC0 192 */
411 0xC0, PC_NETWORK_PROGRAM_1_0, 0 },
412 { "SmbWritePrintFile", SMB_SDT_OPS(write_print_file), /* 0xC1 193 */
413 0xC1, PC_NETWORK_PROGRAM_1_0, SDDF_WRITEOP },
414 { "SmbClosePrintFile", SMB_SDT_OPS(close_print_file), /* 0xC2 194 */
415 0xC2, PC_NETWORK_PROGRAM_1_0, 0 },
416 { "SmbGetPrintQueue", SMB_SDT_OPS(get_print_queue), /* 0xC3 195 */
417 0xC3, PC_NETWORK_PROGRAM_1_0, 0 },
418 { "Invalid", SMB_SDT_OPS(invalid), 0xC4, 0, 0 }, /* 0xC4 196 */
419 { "Invalid", SMB_SDT_OPS(invalid), 0xC5, 0, 0 }, /* 0xC5 197 */
420 { "Invalid", SMB_SDT_OPS(invalid), 0xC6, 0, 0 }, /* 0xC6 198 */
421 { "Invalid", SMB_SDT_OPS(invalid), 0xC7, 0, 0 }, /* 0xC7 199 */
422 { "Invalid", SMB_SDT_OPS(invalid), 0xC8, 0, 0 }, /* 0xC8 200 */
423 { "Invalid", SMB_SDT_OPS(invalid), 0xC9, 0, 0 }, /* 0xC9 201 */
424 { "Invalid", SMB_SDT_OPS(invalid), 0xCA, 0, 0 }, /* 0xCA 202 */
425 { "Invalid", SMB_SDT_OPS(invalid), 0xCB, 0, 0 }, /* 0xCB 203 */
426 { "Invalid", SMB_SDT_OPS(invalid), 0xCC, 0, 0 }, /* 0xCC 204 */
427 { "Invalid", SMB_SDT_OPS(invalid), 0xCD, 0, 0 }, /* 0xCD 205 */
428 { "Invalid", SMB_SDT_OPS(invalid), 0xCE, 0, 0 }, /* 0xCE 206 */
429 { "Invalid", SMB_SDT_OPS(invalid), 0xCF, 0, 0 }, /* 0xCF 207 */
430 { "Invalid", SMB_SDT_OPS(invalid), 0xD0, 0, 0 }, /* 0xD0 208 */
431 { "Invalid", SMB_SDT_OPS(invalid), 0xD1, 0, 0 }, /* 0xD1 209 */
432 { "Invalid", SMB_SDT_OPS(invalid), 0xD2, 0, 0 }, /* 0xD2 210 */
433 { "Invalid", SMB_SDT_OPS(invalid), 0xD3, 0, 0 }, /* 0xD3 211 */
488
489 void
490 smbsr_cleanup(smb_request_t *sr)
491 {
492 ASSERT((sr->sr_state != SMB_REQ_STATE_CLEANED_UP) &&
493 (sr->sr_state != SMB_REQ_STATE_COMPLETED));
494
495 if (sr->r_xa) {
496 if (sr->r_xa->xa_flags & SMB_XA_FLAG_COMPLETE)
497 smb_xa_close(sr->r_xa);
498 smb_xa_rele(sr->session, sr->r_xa);
499 sr->r_xa = NULL;
500 }
501
502 /*
503 * Mark this request so we know that we've already cleaned it up.
504 * A request should only get cleaned up once so multiple calls to
505 * smbsr_cleanup for the same request indicate a bug.
506 */
507 mutex_enter(&sr->sr_mutex);
508 if (sr->sr_state != SMB_REQ_STATE_CANCELLED)
509 sr->sr_state = SMB_REQ_STATE_CLEANED_UP;
510 mutex_exit(&sr->sr_mutex);
511 }
512
513 int smb_cancel_in_reader = 1;
514
515 /*
516 * This is the SMB1 handler for new smb requests, called from
517 * smb_session_reader after SMB negotiate is done. For most SMB
518 * requests, we just enqueue them for the smb_session_worker to
519 * execute via the task queue, so they can block for resources
520 * without stopping the reader thread. A few protocol messages
521 * are special cases and are handled directly here in the reader
522 * thread so they don't wait for taskq scheduling. Later, a few
523 * MORE things could be handled here, such as REPLY messages
524 * (oplock break reply) and things like "NT_cancel".
525 *
526 * This function must either enqueue the new request for
527 * execution via the task queue, or execute it directly
528 * and then free it. If this returns non-zero, the caller
529 * will drop the session.
530 */
531 int
532 smb1sr_newrq(smb_request_t *sr)
533 {
534 uint16_t pid_hi, pid_lo;
535 int rc, save_offset;
536
537 /*
538 * Decode the SMB header now (peek) so that
539 * SMB_COM_NT_CANCEL can find this SR.
540 */
541 save_offset = sr->command.chain_offset;
542 rc = smb_mbc_decodef(&sr->command, SMB_HEADER_ED_FMT,
543 &sr->smb_com,
544 &sr->smb_rcls,
545 &sr->smb_reh,
546 &sr->smb_err,
547 &sr->smb_flg,
548 &sr->smb_flg2,
549 &pid_hi,
550 sr->smb_sig,
551 &sr->smb_tid,
552 &pid_lo,
553 &sr->smb_uid,
554 &sr->smb_mid);
555 sr->command.chain_offset = save_offset;
556 if (rc != 0) {
557 /* Failed decoding the header. Drop 'em. */
558 smb_request_free(sr);
559 return (EPROTO);
560 }
561 sr->smb_pid = (pid_hi << 16) | pid_lo;
562
563 if (sr->smb_com == SMB_COM_NT_CANCEL) {
564 if (sr->session->signing.flags & SMB_SIGNING_ENABLED) {
565 sr->session->signing.seqnum++;
566 sr->sr_seqnum = sr->session->signing.seqnum + 1;
567 sr->reply_seqnum = 0;
568 }
569
570 /*
571 * Normally execute cancel requests immediately,
572 * (here in the reader thread) so they won't wait
573 * for other commands already in the task queue.
574 * Disable this via smb_cancel_in_reader=0 for
575 * testing or diagnostic efforts, in which case
576 * cancel runs via taskq_dispatch.
577 */
578 if (smb_cancel_in_reader != 0) {
579 rc = smb1sr_newrq_cancel(sr);
580 smb_request_free(sr);
581 return (rc);
582 }
583 } else {
584 /* not NT cancel */
585 if (sr->session->signing.flags & SMB_SIGNING_ENABLED) {
586 sr->session->signing.seqnum += 2;
587 sr->sr_seqnum = sr->session->signing.seqnum;
588 sr->reply_seqnum = sr->sr_seqnum + 1;
589 }
590 }
591
592 /*
593 * Submit the request to the task queue, which calls
594 * smb1_tq_work when the workload permits.
595 */
596 sr->sr_time_submitted = gethrtime();
597 sr->sr_state = SMB_REQ_STATE_SUBMITTED;
598 smb_srqueue_waitq_enter(sr->session->s_srqueue);
599 (void) taskq_dispatch(sr->sr_server->sv_worker_pool,
600 smb1_tq_work, sr, TQ_SLEEP);
601
602 return (0);
603 }
604
605 static void
606 smb1_tq_work(void *arg)
607 {
608 smb_request_t *sr;
609 smb_srqueue_t *srq;
610
611 sr = (smb_request_t *)arg;
612 SMB_REQ_VALID(sr);
613
614 srq = sr->session->s_srqueue;
615 smb_srqueue_waitq_to_runq(srq);
616 sr->sr_worker = curthread;
617 sr->sr_time_active = gethrtime();
618
619 /*
620 * Always dispatch to the work function, because cancelled
621 * requests need an error reply (NT_STATUS_CANCELLED).
622 */
623 mutex_enter(&sr->sr_mutex);
624 if (sr->sr_state == SMB_REQ_STATE_SUBMITTED)
625 sr->sr_state = SMB_REQ_STATE_ACTIVE;
626 mutex_exit(&sr->sr_mutex);
627
628 smb1sr_work(sr);
629
630 smb_srqueue_runq_exit(srq);
631 }
632
633 /*
634 * smb1sr_work
635 *
636 * In most cases, this should free the request before return.
637 * Exceptions are when a dispatch function returns SDRC_SR_KEPT.
638 */
639 void
640 smb1sr_work(struct smb_request *sr)
641 {
642 smb_sdrc_t sdrc;
643 const smb_disp_entry_t *sdd;
644 smb_disp_stats_t *sds;
645 boolean_t disconnect = B_FALSE;
646 smb_session_t *session;
647 smb_server_t *server;
648 int32_t txbase;
649 uint32_t rxbytes;
650 uint32_t byte_count;
651 uint32_t max_bytes;
652 uint16_t pid_hi, pid_lo;
653
654 session = sr->session;
655 server = session->s_server;
656
657 ASSERT(sr->tid_tree == 0);
658 ASSERT(sr->uid_user == 0);
659 ASSERT(sr->fid_ofile == 0);
660 sr->smb_fid = (uint16_t)-1;
661
662 /* temporary until we identify a user */
663 sr->user_cr = zone_kcred();
664 sr->orig_request_hdr = sr->command.chain_offset;
665
666 /*
667 * Decode the SMB header.
668 */
669 if (smb_mbc_decodef(&sr->command, SMB_HEADER_ED_FMT,
698 sr->smb_rcls = 0;
699 sr->smb_reh = 0;
700 sr->smb_err = 0;
701 sr->smb_flg2 &= ~SMB_FLAGS2_NT_STATUS;
702
703 (void) smb_mbc_encodef(&sr->reply, SMB_HEADER_ED_FMT,
704 sr->smb_com,
705 sr->smb_rcls,
706 sr->smb_reh,
707 sr->smb_err,
708 sr->smb_flg,
709 sr->smb_flg2,
710 pid_hi,
711 sr->smb_sig,
712 sr->smb_tid,
713 pid_lo,
714 sr->smb_uid,
715 sr->smb_mid);
716 sr->first_smb_com = sr->smb_com;
717
718 /* Need this for early goto report_error cases. */
719 sr->cur_reply_offset = sr->reply.chain_offset;
720
721 if ((session->signing.flags & SMB_SIGNING_CHECK) != 0) {
722 if ((sr->smb_flg2 & SMB_FLAGS2_SMB_SECURITY_SIGNATURE) == 0 ||
723 smb_sign_check_request(sr) != 0) {
724 smbsr_error(sr, NT_STATUS_ACCESS_DENIED,
725 ERRDOS, ERROR_ACCESS_DENIED);
726 disconnect = B_TRUE;
727 goto report_error;
728 }
729 }
730
731 andx_more:
732 sdd = &smb_disp_table[sr->smb_com];
733 ASSERT(sdd->sdt_function);
734 sds = &server->sv_disp_stats1[sr->smb_com];
735
736 if (smb_mbc_decodef(&sr->command, "b", &sr->smb_wct) != 0) {
737 disconnect = B_TRUE;
738 goto report_error;
739 }
740
741 (void) MBC_SHADOW_CHAIN(&sr->smb_vwv, &sr->command,
742 sr->command.chain_offset, sr->smb_wct * 2);
743
744 if (smb_mbc_decodef(&sr->command, "#.w", sr->smb_wct*2, &sr->smb_bcc)) {
745 disconnect = B_TRUE;
746 goto report_error;
747 }
748
749 /*
750 * Ignore smb_bcc if CAP_LARGE_READX/CAP_LARGE_WRITEX
751 * and this is SmbReadX/SmbWriteX since this enables
752 * large reads/write and bcc is only 16-bits.
753 */
754 max_bytes = sr->command.max_bytes - sr->command.chain_offset;
755 if (sr->smb_com == SMB_COM_WRITE_ANDX) {
756 /* Allow > BCC */
757 byte_count = max_bytes;
758 } else if (max_bytes < (uint32_t)sr->smb_bcc) {
759 /* BCC is bogus. Will fail later. */
760 byte_count = max_bytes;
761 } else {
762 /* ordinary case */
763 byte_count = (uint32_t)sr->smb_bcc;
764 }
765
766 /* Save these for kstat updates below. */
767 rxbytes = byte_count + 1 + 2 * sr->smb_wct;
768 txbase = sr->reply.chain_offset;
769
770 (void) MBC_SHADOW_CHAIN(&sr->smb_data, &sr->command,
771 sr->command.chain_offset, byte_count);
772
773 sr->command.chain_offset += byte_count;
774 if (sr->command.chain_offset > sr->command.max_bytes) {
775 disconnect = B_TRUE;
776 goto report_error;
777 }
778
779 /* Store pointers for later */
780 sr->cur_reply_offset = sr->reply.chain_offset;
781
782 if (is_andx_com(sr->smb_com)) {
783 /* Peek ahead and don't disturb vwv */
784 if (smb_mbc_peek(&sr->smb_vwv, sr->smb_vwv.chain_offset, "b.w",
785 &sr->andx_com, &sr->andx_off) < 0) {
786 disconnect = B_TRUE;
787 goto report_error;
788 }
789 } else {
790 sr->andx_com = (unsigned char)-1;
791 }
792
793 mutex_enter(&sr->sr_mutex);
794 switch (sr->sr_state) {
795 case SMB_REQ_STATE_ACTIVE:
796 break;
797 case SMB_REQ_STATE_CLEANED_UP:
798 sr->sr_state = SMB_REQ_STATE_ACTIVE;
799 break;
800 case SMB_REQ_STATE_CANCELLED:
801 /*
802 * Keep cancelled. Handlers that might block will
803 * check the state and return NT_STATUS_CANCELLED.
804 */
805 break;
806 default:
807 ASSERT(0);
808 break;
809 }
810 mutex_exit(&sr->sr_mutex);
811
812 /*
813 * Setup UID and TID information (if required). Both functions
814 * will set the sr credentials. In domain mode, the user and
815 * tree credentials should be the same. In share mode, the
816 * tree credentials (defined in the share definition) should
817 * override the user credentials.
818 */
819 if (!(sdd->sdt_flags & SDDF_SUPPRESS_UID) && (sr->uid_user == NULL)) {
820 sr->uid_user = smb_session_lookup_uid(session, sr->smb_uid);
821 if (sr->uid_user == NULL) {
822 smbsr_error(sr, 0, ERRSRV, ERRbaduid);
823 smbsr_cleanup(sr);
824 goto report_error;
826
827 sr->user_cr = smb_user_getcred(sr->uid_user);
828 }
829 if (!(sdd->sdt_flags & SDDF_SUPPRESS_TID) && (sr->tid_tree == NULL)) {
830 sr->tid_tree = smb_session_lookup_tree(session, sr->smb_tid);
831 if (sr->tid_tree == NULL) {
832 smbsr_error(sr, 0, ERRSRV, ERRinvnid);
833 smbsr_cleanup(sr);
834 goto report_error;
835 }
836 }
837
838 sr->sr_time_start = gethrtime();
839 if ((sdrc = (*sdd->sdt_pre_op)(sr)) == SDRC_SUCCESS)
840 sdrc = (*sdd->sdt_function)(sr);
841
842 if (sdrc != SDRC_SR_KEPT) {
843 (*sdd->sdt_post_op)(sr);
844 smbsr_cleanup(sr);
845 }
846
847 /* Record latency and rx/tx bytes per: server, session, share. */
848 {
849 hrtime_t dt;
850 int64_t rxb, txb;
851 smb_disp_stats_t *client_sds; /* session */
852 smb_disp_stats_t *share_sds; /* kshare */
853 int cmd_type;
854
855 if (sdd->sdt_flags & SDDF_READOP) {
856 cmd_type = SMBSRV_CLSH_READ;
857 } else if (sdd->sdt_flags & SDDF_WRITEOP) {
858 cmd_type = SMBSRV_CLSH_WRITE;
859 } else {
860 cmd_type = SMBSRV_CLSH_OTHER;
861 }
862
863 dt = gethrtime() - sr->sr_time_start;
864 rxb = (int64_t)rxbytes;
865 txb = (int64_t)(sr->reply.chain_offset - txbase);
866
867 smb_server_inc_req(server);
868 smb_latency_add_sample(&sds->sdt_lat, dt);
869 atomic_add_64(&sds->sdt_rxb, rxb);
870 atomic_add_64(&sds->sdt_txb, txb);
871
872 client_sds = &session->s_stats[cmd_type];
873 smb_latency_add_sample(&client_sds->sdt_lat, dt);
874 atomic_add_64(&client_sds->sdt_rxb, rxb);
875 atomic_add_64(&client_sds->sdt_txb, txb);
876
877 if ((sr->tid_tree != NULL) &&
878 (sr->tid_tree->t_kshare != NULL)) {
879 share_sds =
880 &sr->tid_tree->t_kshare->shr_stats[cmd_type];
881 smb_latency_add_sample(&share_sds->sdt_lat, dt);
882 atomic_add_64(&share_sds->sdt_rxb, rxb);
883 atomic_add_64(&share_sds->sdt_txb, txb);
884 }
885 }
886
887 switch (sdrc) {
888 case SDRC_SUCCESS:
889 break;
890
891 case SDRC_DROP_VC:
892 disconnect = B_TRUE;
893 goto drop_connection;
894
895 case SDRC_NO_REPLY:
896 /* will free sr */
897 goto out;
898
899 case SDRC_SR_KEPT:
900 /* Do NOT free sr */
901 sr = NULL;
902 goto out;
903
904 case SDRC_ERROR:
905 goto report_error;
906
925 sr->andx_com, MBC_LENGTH(&sr->reply));
926
927 sr->command.chain_offset = sr->orig_request_hdr + sr->andx_off;
928 sr->smb_com = sr->andx_com;
929 goto andx_more;
930
931 report_error:
932 sr->reply.chain_offset = sr->cur_reply_offset;
933 (void) smb_mbc_encodef(&sr->reply, "bw", 0, 0);
934
935 sr->smb_wct = 0;
936 sr->smb_bcc = 0;
937
938 if (sr->smb_rcls == 0 && sr->smb_reh == 0 && sr->smb_err == 0)
939 smbsr_error(sr, 0, ERRSRV, ERRerror);
940
941 reply_ready:
942 smbsr_send_reply(sr);
943
944 drop_connection:
945 if (disconnect)
946 smb_session_disconnect(session);
947
948 out:
949 if (sr != NULL) {
950 mutex_enter(&sr->sr_mutex);
951 sr->sr_state = SMB_REQ_STATE_COMPLETED;
952 mutex_exit(&sr->sr_mutex);
953 smb_request_free(sr);
954 }
955 }
956
957 int
958 smbsr_encode_empty_result(struct smb_request *sr)
959 {
960 return (smbsr_encode_result(sr, 0, 0, "bw", 0, 0));
961 }
962
963 int
964 smbsr_encode_result(struct smb_request *sr, int wct, int bcc,
965 const char *fmt, ...)
966 {
1239 case SMB_COM_LOGOFF_ANDX:
1240 case SMB_COM_TREE_CONNECT_ANDX:
1241 case SMB_COM_NT_CREATE_ANDX:
1242 return (1);
1243 }
1244 return (0);
1245 }
1246
1247 /*
1248 * Invalid command stubs.
1249 *
1250 * The Read/Write Block Multiplexed (mpx) protocol is used to maximize
1251 * performance when reading/writing a large block of data: it can be
1252 * used in parallel with other client/server operations. The mpx sub-
1253 * protocol is not supported because we support only connection oriented
1254 * transports and NT supports mpx only over connectionless transports.
1255 */
1256 smb_sdrc_t
1257 smb_pre_invalid(smb_request_t *sr)
1258 {
1259 DTRACE_SMB_START(op__Invalid, smb_request_t *, sr);
1260 return (SDRC_SUCCESS);
1261 }
1262
1263 void
1264 smb_post_invalid(smb_request_t *sr)
1265 {
1266 DTRACE_SMB_DONE(op__Invalid, smb_request_t *, sr);
1267 }
1268
1269 smb_sdrc_t
1270 smb_com_invalid(smb_request_t *sr)
1271 {
1272 smb_sdrc_t sdrc;
1273
1274 switch (sr->smb_com) {
1275 case SMB_COM_WRITE_COMPLETE:
1276 smbsr_error(sr, 0, ERRSRV, ERRerror);
1277 sdrc = SDRC_ERROR;
1278 break;
1279
1280 default:
1281 smbsr_error(sr, NT_STATUS_NOT_IMPLEMENTED,
1282 ERRDOS, ERROR_INVALID_FUNCTION);
1283 sdrc = SDRC_NOT_IMPLEMENTED;
1284 break;
1285 }
1286
|