1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
24 */
25
26 #include <sys/atomic.h>
27 #include <sys/synch.h>
28 #include <sys/types.h>
29 #include <sys/sdt.h>
30 #include <sys/random.h>
31 #include <smbsrv/netbios.h>
32 #include <smbsrv/smb2_kproto.h>
33 #include <smbsrv/string.h>
34 #include <netinet/tcp.h>
35
36 /* How many iovec we'll handle as a local array (no allocation) */
37 #define SMB_LOCAL_IOV_MAX 16
38
39 #define SMB_NEW_KID() atomic_inc_64_nv(&smb_kids)
40
41 static volatile uint64_t smb_kids;
42
43 /*
44 * We track the keepalive in minutes, but this constant
45 * specifies it in seconds, so convert to minutes.
46 */
47 uint32_t smb_keep_alive = SMB_PI_KEEP_ALIVE_MIN / 60;
48
49 static int smbsr_newrq_initial(smb_request_t *);
50
51 static void smb_session_cancel(smb_session_t *);
52 static int smb_session_reader(smb_session_t *);
53 static int smb_session_xprt_puthdr(smb_session_t *,
54 uint8_t msg_type, uint32_t msg_len,
55 uint8_t *dst, size_t dstlen);
56 static smb_tree_t *smb_session_get_tree(smb_session_t *, smb_tree_t *);
57 static void smb_session_logoff(smb_session_t *);
58 static void smb_request_init_command_mbuf(smb_request_t *sr);
59 static void smb_session_genkey(smb_session_t *);
60
61 void
62 smb_session_timers(smb_llist_t *ll)
63 {
64 smb_session_t *session;
65
66 smb_llist_enter(ll, RW_READER);
67 session = smb_llist_head(ll);
68 while (session != NULL) {
69 /*
70 * Walk through the table and decrement each keep_alive
71 * timer that has not timed out yet. (keepalive > 0)
72 */
73 SMB_SESSION_VALID(session);
74 if (session->keep_alive &&
75 (session->keep_alive != (uint32_t)-1))
76 session->keep_alive--;
77 session = smb_llist_next(ll, session);
78 }
79 smb_llist_exit(ll);
80 }
81
82 void
83 smb_session_correct_keep_alive_values(smb_llist_t *ll, uint32_t new_keep_alive)
84 {
85 smb_session_t *sn;
86
87 /*
88 * Caller specifies seconds, but we track in minutes, so
89 * convert to minutes (rounded up).
90 */
91 new_keep_alive = (new_keep_alive + 59) / 60;
92
93 if (new_keep_alive == smb_keep_alive)
94 return;
95 /*
96 * keep alive == 0 means do not drop connection if it's idle
97 */
98 smb_keep_alive = (new_keep_alive) ? new_keep_alive : -1;
99
100 /*
101 * Walk through the table and set each session to the new keep_alive
102 * value if they have not already timed out. Block clock interrupts.
103 */
104 smb_llist_enter(ll, RW_READER);
105 sn = smb_llist_head(ll);
106 while (sn != NULL) {
107 SMB_SESSION_VALID(sn);
108 if (sn->keep_alive != 0)
109 sn->keep_alive = new_keep_alive;
110 sn = smb_llist_next(ll, sn);
111 }
112 smb_llist_exit(ll);
113 }
114
115 /*
116 * Send a session message - supports SMB-over-NBT and SMB-over-TCP.
117 * If an mbuf chain is provided (optional), it will be freed and
118 * set to NULL -- unconditionally! (error or not)
119 *
120 * Builds a I/O vector (uio/iov) to do the send from mbufs, plus one
121 * segment for the 4-byte NBT header.
122 */
123 int
124 smb_session_send(smb_session_t *session, uint8_t nbt_type, mbuf_chain_t *mbc)
125 {
126 uio_t uio;
127 iovec_t local_iov[SMB_LOCAL_IOV_MAX];
128 iovec_t *alloc_iov = NULL;
129 int alloc_sz = 0;
130 mbuf_t *m;
131 uint8_t nbt_hdr[NETBIOS_HDR_SZ];
132 uint32_t nbt_len;
133 int i, nseg;
134 int rc;
135
136 switch (session->s_state) {
137 case SMB_SESSION_STATE_DISCONNECTED:
138 case SMB_SESSION_STATE_TERMINATED:
139 rc = ENOTCONN;
140 goto out;
141 default:
142 break;
143 }
144
145 /*
146 * Setup the IOV. First, count the number of IOV segments
147 * (plus one for the NBT header) and decide whether we
148 * need to allocate an iovec or can use local_iov;
149 */
150 bzero(&uio, sizeof (uio));
151 nseg = 1;
152 m = (mbc != NULL) ? mbc->chain : NULL;
153 while (m != NULL) {
154 nseg++;
155 m = m->m_next;
156 }
157 if (nseg <= SMB_LOCAL_IOV_MAX) {
158 uio.uio_iov = local_iov;
159 } else {
160 alloc_sz = nseg * sizeof (iovec_t);
161 alloc_iov = kmem_alloc(alloc_sz, KM_SLEEP);
162 uio.uio_iov = alloc_iov;
163 }
164 uio.uio_iovcnt = nseg;
165 uio.uio_segflg = UIO_SYSSPACE;
166 uio.uio_extflg = UIO_COPY_DEFAULT;
167
168 /*
169 * Build the iov list, meanwhile computing the length of
170 * the SMB payload (to put in the NBT header).
171 */
172 uio.uio_iov[0].iov_base = (void *)nbt_hdr;
173 uio.uio_iov[0].iov_len = sizeof (nbt_hdr);
174 i = 1;
175 nbt_len = 0;
176 m = (mbc != NULL) ? mbc->chain : NULL;
177 while (m != NULL) {
178 uio.uio_iov[i].iov_base = m->m_data;
179 uio.uio_iov[i++].iov_len = m->m_len;
180 nbt_len += m->m_len;
181 m = m->m_next;
182 }
183 ASSERT3S(i, ==, nseg);
184
185 /*
186 * Set the NBT header, set uio_resid
187 */
188 uio.uio_resid = nbt_len + NETBIOS_HDR_SZ;
189 rc = smb_session_xprt_puthdr(session, nbt_type, nbt_len,
190 nbt_hdr, NETBIOS_HDR_SZ);
191 if (rc != 0)
192 goto out;
193
194 smb_server_add_txb(session->s_server, (int64_t)uio.uio_resid);
195 rc = smb_net_send_uio(session, &uio);
196
197 out:
198 if (alloc_iov != NULL)
199 kmem_free(alloc_iov, alloc_sz);
200 if ((mbc != NULL) && (mbc->chain != NULL)) {
201 m_freem(mbc->chain);
202 mbc->chain = NULL;
203 mbc->flags = 0;
204 }
205 return (rc);
206 }
207
208 /*
209 * Read, process and respond to a NetBIOS session request.
210 *
211 * A NetBIOS session must be established for SMB-over-NetBIOS. Validate
212 * the calling and called name format and save the client NetBIOS name,
213 * which is used when a NetBIOS session is established to check for and
214 * cleanup leftover state from a previous session.
215 *
216 * Session requests are not valid for SMB-over-TCP, which is unfortunate
217 * because without the client name leftover state cannot be cleaned up
218 * if the client is behind a NAT server.
219 */
220 static int
221 smb_netbios_session_request(struct smb_session *session)
222 {
223 int rc;
224 char *calling_name;
225 char *called_name;
226 char client_name[NETBIOS_NAME_SZ];
227 struct mbuf_chain mbc;
228 char *names = NULL;
229 smb_wchar_t *wbuf = NULL;
230 smb_xprt_t hdr;
231 char *p;
232 int rc1, rc2;
233
234 session->keep_alive = smb_keep_alive;
235
236 if ((rc = smb_session_xprt_gethdr(session, &hdr)) != 0)
237 return (rc);
238
239 DTRACE_PROBE2(receive__session__req__xprthdr, struct session *, session,
240 smb_xprt_t *, &hdr);
241
242 if ((hdr.xh_type != SESSION_REQUEST) ||
243 (hdr.xh_length != NETBIOS_SESSION_REQUEST_DATA_LENGTH)) {
244 DTRACE_PROBE1(receive__session__req__failed,
245 struct session *, session);
246 return (EINVAL);
247 }
248
249 names = kmem_alloc(hdr.xh_length, KM_SLEEP);
250
251 if ((rc = smb_sorecv(session->sock, names, hdr.xh_length)) != 0) {
252 kmem_free(names, hdr.xh_length);
253 DTRACE_PROBE1(receive__session__req__failed,
254 struct session *, session);
255 return (rc);
256 }
257
258 DTRACE_PROBE3(receive__session__req__data, struct session *, session,
259 char *, names, uint32_t, hdr.xh_length);
260
261 called_name = &names[0];
262 calling_name = &names[NETBIOS_ENCODED_NAME_SZ + 2];
263
264 rc1 = netbios_name_isvalid(called_name, 0);
265 rc2 = netbios_name_isvalid(calling_name, client_name);
266
267 if (rc1 == 0 || rc2 == 0) {
268
269 DTRACE_PROBE3(receive__invalid__session__req,
270 struct session *, session, char *, names,
271 uint32_t, hdr.xh_length);
272
273 kmem_free(names, hdr.xh_length);
274 MBC_INIT(&mbc, MAX_DATAGRAM_LENGTH);
275 (void) smb_mbc_encodef(&mbc, "b",
276 DATAGRAM_INVALID_SOURCE_NAME_FORMAT);
277 (void) smb_session_send(session, NEGATIVE_SESSION_RESPONSE,
278 &mbc);
279 return (EINVAL);
280 }
281
282 DTRACE_PROBE3(receive__session__req__calling__decoded,
283 struct session *, session,
284 char *, calling_name, char *, client_name);
285
286 /*
287 * The client NetBIOS name is in oem codepage format.
288 * We need to convert it to unicode and store it in
289 * multi-byte format. We also need to strip off any
290 * spaces added as part of the NetBIOS name encoding.
291 */
292 wbuf = kmem_alloc((SMB_PI_MAX_HOST * sizeof (smb_wchar_t)), KM_SLEEP);
293 (void) oemtoucs(wbuf, client_name, SMB_PI_MAX_HOST, OEM_CPG_850);
294 (void) smb_wcstombs(session->workstation, wbuf, SMB_PI_MAX_HOST);
295 kmem_free(wbuf, (SMB_PI_MAX_HOST * sizeof (smb_wchar_t)));
296
297 if ((p = strchr(session->workstation, ' ')) != 0)
298 *p = '\0';
299
300 kmem_free(names, hdr.xh_length);
301 return (smb_session_send(session, POSITIVE_SESSION_RESPONSE, NULL));
302 }
303
304 /*
305 * Read 4-byte header from the session socket and build an in-memory
306 * session transport header. See smb_xprt_t definition for header
307 * format information.
308 *
309 * Direct hosted NetBIOS-less SMB (SMB-over-TCP) uses port 445. The
310 * first byte of the four-byte header must be 0 and the next three
311 * bytes contain the length of the remaining data.
312 */
313 int
314 smb_session_xprt_gethdr(smb_session_t *session, smb_xprt_t *ret_hdr)
315 {
316 int rc;
317 unsigned char buf[NETBIOS_HDR_SZ];
318
319 if ((rc = smb_sorecv(session->sock, buf, NETBIOS_HDR_SZ)) != 0)
320 return (rc);
321
322 switch (session->s_local_port) {
323 case IPPORT_NETBIOS_SSN:
324 ret_hdr->xh_type = buf[0];
325 ret_hdr->xh_length = (((uint32_t)buf[1] & 1) << 16) |
326 ((uint32_t)buf[2] << 8) |
327 ((uint32_t)buf[3]);
328 break;
329
330 case IPPORT_SMB:
331 ret_hdr->xh_type = buf[0];
332
333 if (ret_hdr->xh_type != 0) {
334 cmn_err(CE_WARN, "invalid NBT type (%u) from %s",
335 ret_hdr->xh_type, session->ip_addr_str);
336 return (EPROTO);
337 }
338
339 ret_hdr->xh_length = ((uint32_t)buf[1] << 16) |
340 ((uint32_t)buf[2] << 8) |
341 ((uint32_t)buf[3]);
342 break;
343
344 default:
345 cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
346 return (EPROTO);
347 }
348
349 return (0);
350 }
351
352 /*
353 * Encode a transport session packet header into a 4-byte buffer.
354 */
355 static int
356 smb_session_xprt_puthdr(smb_session_t *session,
357 uint8_t msg_type, uint32_t msg_length,
358 uint8_t *buf, size_t buflen)
359 {
360 if (buf == NULL || buflen < NETBIOS_HDR_SZ) {
361 return (-1);
362 }
363
364 switch (session->s_local_port) {
365 case IPPORT_NETBIOS_SSN:
366 /* Per RFC 1001, 1002: msg. len < 128KB */
367 if (msg_length >= (1 << 17))
368 return (-1);
369 buf[0] = msg_type;
370 buf[1] = ((msg_length >> 16) & 1);
371 buf[2] = (msg_length >> 8) & 0xff;
372 buf[3] = msg_length & 0xff;
373 break;
374
375 case IPPORT_SMB:
376 /*
377 * SMB over TCP is like NetBIOS but the one byte
378 * message type is always zero, and the length
379 * part is three bytes. It could actually use
380 * longer messages, but this is conservative.
381 */
382 if (msg_length >= (1 << 24))
383 return (-1);
384 buf[0] = msg_type;
385 buf[1] = (msg_length >> 16) & 0xff;
386 buf[2] = (msg_length >> 8) & 0xff;
387 buf[3] = msg_length & 0xff;
388 break;
389
390 default:
391 cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
392 return (-1);
393 }
394
395 return (0);
396 }
397
398 static void
399 smb_request_init_command_mbuf(smb_request_t *sr)
400 {
401
402 /*
403 * Setup mbuf using the buffer we allocated.
404 */
405 MBC_ATTACH_BUF(&sr->command, sr->sr_request_buf, sr->sr_req_length);
406
407 sr->command.flags = 0;
408 sr->command.shadow_of = NULL;
409 }
410
411 /*
412 * smb_request_cancel
413 *
414 * Handle a cancel for a request properly depending on the current request
415 * state.
416 */
417 void
418 smb_request_cancel(smb_request_t *sr)
419 {
420 mutex_enter(&sr->sr_mutex);
421 switch (sr->sr_state) {
422
423 case SMB_REQ_STATE_INITIALIZING:
424 case SMB_REQ_STATE_SUBMITTED:
425 case SMB_REQ_STATE_ACTIVE:
426 case SMB_REQ_STATE_CLEANED_UP:
427 sr->sr_state = SMB_REQ_STATE_CANCELED;
428 break;
429
430 case SMB_REQ_STATE_WAITING_LOCK:
431 /*
432 * This request is waiting on a lock. Wakeup everything
433 * waiting on the lock so that the relevant thread regains
434 * control and notices that is has been canceled. The
435 * other lock request threads waiting on this lock will go
436 * back to sleep when they discover they are still blocked.
437 */
438 sr->sr_state = SMB_REQ_STATE_CANCELED;
439
440 ASSERT(sr->sr_awaiting != NULL);
441 mutex_enter(&sr->sr_awaiting->l_mutex);
442 cv_broadcast(&sr->sr_awaiting->l_cv);
443 mutex_exit(&sr->sr_awaiting->l_mutex);
444 break;
445
446 case SMB_REQ_STATE_WAITING_EVENT:
447 /*
448 * This request is waiting in change notify.
449 */
450 sr->sr_state = SMB_REQ_STATE_CANCELED;
451 cv_signal(&sr->sr_ncr.nc_cv);
452 break;
453
454 case SMB_REQ_STATE_EVENT_OCCURRED:
455 case SMB_REQ_STATE_COMPLETED:
456 case SMB_REQ_STATE_CANCELED:
457 /*
458 * No action required for these states since the request
459 * is completing.
460 */
461 break;
462
463 case SMB_REQ_STATE_FREE:
464 default:
465 SMB_PANIC();
466 }
467 mutex_exit(&sr->sr_mutex);
468 }
469
470 /*
471 * smb_session_receiver
472 *
473 * Receives request from the network and dispatches them to a worker.
474 */
475 void
476 smb_session_receiver(smb_session_t *session)
477 {
478 int rc = 0;
479
480 SMB_SESSION_VALID(session);
481
482 session->s_thread = curthread;
483
484 if (session->s_local_port == IPPORT_NETBIOS_SSN) {
485 rc = smb_netbios_session_request(session);
486 if (rc != 0) {
487 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
488 session->s_state = SMB_SESSION_STATE_DISCONNECTED;
489 smb_rwx_rwexit(&session->s_lock);
490 return;
491 }
492 }
493
494 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
495 session->s_state = SMB_SESSION_STATE_ESTABLISHED;
496 smb_rwx_rwexit(&session->s_lock);
497
498 (void) smb_session_reader(session);
499
500 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
501 session->s_state = SMB_SESSION_STATE_DISCONNECTED;
502 smb_rwx_rwexit(&session->s_lock);
503
504 smb_soshutdown(session->sock);
505
506 DTRACE_PROBE2(session__drop, struct session *, session, int, rc);
507
508 smb_session_cancel(session);
509 /*
510 * At this point everything related to the session should have been
511 * cleaned up and we expect that nothing will attempt to use the
512 * socket.
513 */
514 }
515
516 /*
517 * smb_session_disconnect
518 *
519 * Disconnects the session passed in.
520 */
521 void
522 smb_session_disconnect(smb_session_t *session)
523 {
524 SMB_SESSION_VALID(session);
525
526 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
527 switch (session->s_state) {
528 case SMB_SESSION_STATE_INITIALIZED:
529 case SMB_SESSION_STATE_CONNECTED:
530 case SMB_SESSION_STATE_ESTABLISHED:
531 case SMB_SESSION_STATE_NEGOTIATED:
532 smb_soshutdown(session->sock);
533 session->s_state = SMB_SESSION_STATE_DISCONNECTED;
534 _NOTE(FALLTHRU)
535 case SMB_SESSION_STATE_DISCONNECTED:
536 case SMB_SESSION_STATE_TERMINATED:
537 break;
538 }
539 smb_rwx_rwexit(&session->s_lock);
540 }
541
542 /*
543 * Read and process SMB requests.
544 *
545 * Returns:
546 * 0 Success
547 * 1 Unable to read transport header
548 * 2 Invalid transport header type
549 * 3 Invalid SMB length (too small)
550 * 4 Unable to read SMB header
551 * 5 Invalid SMB header (bad magic number)
552 * 6 Unable to read SMB data
553 */
554 static int
555 smb_session_reader(smb_session_t *session)
556 {
557 smb_server_t *sv;
558 smb_request_t *sr = NULL;
559 smb_xprt_t hdr;
560 uint8_t *req_buf;
561 uint32_t resid;
562 int rc;
563
564 sv = session->s_server;
565
566 for (;;) {
567
568 rc = smb_session_xprt_gethdr(session, &hdr);
569 if (rc)
570 return (rc);
571
572 DTRACE_PROBE2(session__receive__xprthdr, session_t *, session,
573 smb_xprt_t *, &hdr);
574
575 if (hdr.xh_type != SESSION_MESSAGE) {
576 /*
577 * Anything other than SESSION_MESSAGE or
578 * SESSION_KEEP_ALIVE is an error. A SESSION_REQUEST
579 * may indicate a new session request but we need to
580 * close this session and we can treat it as an error
581 * here.
582 */
583 if (hdr.xh_type == SESSION_KEEP_ALIVE) {
584 session->keep_alive = smb_keep_alive;
585 continue;
586 }
587 return (EPROTO);
588 }
589
590 if (hdr.xh_length == 0) {
591 /* zero length is another form of keep alive */
592 session->keep_alive = smb_keep_alive;
593 continue;
594 }
595
596 if (hdr.xh_length < SMB_HEADER_LEN)
597 return (EPROTO);
598 if (hdr.xh_length > session->cmd_max_bytes)
599 return (EPROTO);
600
601 session->keep_alive = smb_keep_alive;
602
603 /*
604 * Allocate a request context, read the whole message.
605 */
606 sr = smb_request_alloc(session, hdr.xh_length);
607
608 req_buf = (uint8_t *)sr->sr_request_buf;
609 resid = hdr.xh_length;
610
611 rc = smb_sorecv(session->sock, req_buf, resid);
612 if (rc) {
613 smb_request_free(sr);
614 break;
615 }
616
617 /* accounting: requests, received bytes */
618 smb_server_inc_req(sv);
619 smb_server_add_rxb(sv,
620 (int64_t)(hdr.xh_length + NETBIOS_HDR_SZ));
621
622 /*
623 * Initialize command MBC to represent the received data.
624 */
625 smb_request_init_command_mbuf(sr);
626
627 DTRACE_PROBE1(session__receive__smb, smb_request_t *, sr);
628
629 rc = session->newrq_func(sr);
630 sr = NULL; /* enqueued or freed */
631 if (rc != 0)
632 break;
633 }
634 return (rc);
635 }
636
637 /*
638 * This is the initial handler for new smb requests, called from
639 * from smb_session_reader when we have not yet seen any requests.
640 * The first SMB request must be "negotiate", which determines
641 * which protocol and dialect we'll be using. That's the ONLY
642 * request type handled here, because with all later requests,
643 * we know the protocol and handle those with either the SMB1 or
644 * SMB2 handlers: smb1sr_post() or smb2sr_post().
645 * Those do NOT allow SMB negotiate, because that's only allowed
646 * as the first request on new session.
647 *
648 * This and other "post a request" handlers must either enqueue
649 * the new request for the session taskq, or smb_request_free it
650 * (in case we've decided to drop this connection). In this
651 * (special) new request handler, we always free the request.
652 */
653 static int
654 smbsr_newrq_initial(smb_request_t *sr)
655 {
656 uint32_t magic;
657 int rc = EPROTO;
658
659 mutex_enter(&sr->sr_mutex);
660 sr->sr_state = SMB_REQ_STATE_ACTIVE;
661 mutex_exit(&sr->sr_mutex);
662
663 magic = SMB_READ_PROTOCOL(sr->sr_request_buf);
664 if (magic == SMB_PROTOCOL_MAGIC)
665 rc = smb1_newrq_negotiate(sr);
666 if (magic == SMB2_PROTOCOL_MAGIC)
667 rc = smb2_newrq_negotiate(sr);
668
669 mutex_enter(&sr->sr_mutex);
670 sr->sr_state = SMB_REQ_STATE_COMPLETED;
671 mutex_exit(&sr->sr_mutex);
672
673 smb_request_free(sr);
674 return (rc);
675 }
676
677 /*
678 * Port will be IPPORT_NETBIOS_SSN or IPPORT_SMB.
679 */
680 smb_session_t *
681 smb_session_create(ksocket_t new_so, uint16_t port, smb_server_t *sv,
682 int family)
683 {
684 struct sockaddr_in sin;
685 socklen_t slen;
686 struct sockaddr_in6 sin6;
687 smb_session_t *session;
688 int64_t now;
689 uint16_t rport;
690
691 session = kmem_cache_alloc(smb_cache_session, KM_SLEEP);
692 bzero(session, sizeof (smb_session_t));
693
694 if (smb_idpool_constructor(&session->s_uid_pool)) {
695 kmem_cache_free(smb_cache_session, session);
696 return (NULL);
697 }
698 if (smb_idpool_constructor(&session->s_tid_pool)) {
699 smb_idpool_destructor(&session->s_uid_pool);
700 kmem_cache_free(smb_cache_session, session);
701 return (NULL);
702 }
703
704 now = ddi_get_lbolt64();
705
706 session->s_kid = SMB_NEW_KID();
707 session->s_state = SMB_SESSION_STATE_INITIALIZED;
708 session->native_os = NATIVE_OS_UNKNOWN;
709 session->opentime = now;
710 session->keep_alive = smb_keep_alive;
711 session->activity_timestamp = now;
712
713 smb_session_genkey(session);
714
715 mutex_init(&session->s_credits_mutex, NULL, MUTEX_DEFAULT, NULL);
716
717 smb_slist_constructor(&session->s_req_list, sizeof (smb_request_t),
718 offsetof(smb_request_t, sr_session_lnd));
719
720 smb_llist_constructor(&session->s_user_list, sizeof (smb_user_t),
721 offsetof(smb_user_t, u_lnd));
722
723 smb_llist_constructor(&session->s_tree_list, sizeof (smb_tree_t),
724 offsetof(smb_tree_t, t_lnd));
725
726 smb_llist_constructor(&session->s_xa_list, sizeof (smb_xa_t),
727 offsetof(smb_xa_t, xa_lnd));
728
729 smb_net_txl_constructor(&session->s_txlst);
730
731 smb_rwx_init(&session->s_lock);
732
733 if (new_so != NULL) {
734 if (family == AF_INET) {
735 slen = sizeof (sin);
736 (void) ksocket_getsockname(new_so,
737 (struct sockaddr *)&sin, &slen, CRED());
738 bcopy(&sin.sin_addr,
739 &session->local_ipaddr.au_addr.au_ipv4,
740 sizeof (in_addr_t));
741 slen = sizeof (sin);
742 (void) ksocket_getpeername(new_so,
743 (struct sockaddr *)&sin, &slen, CRED());
744 bcopy(&sin.sin_addr,
745 &session->ipaddr.au_addr.au_ipv4,
746 sizeof (in_addr_t));
747 rport = sin.sin_port;
748 } else {
749 slen = sizeof (sin6);
750 (void) ksocket_getsockname(new_so,
751 (struct sockaddr *)&sin6, &slen, CRED());
752 bcopy(&sin6.sin6_addr,
753 &session->local_ipaddr.au_addr.au_ipv6,
754 sizeof (in6_addr_t));
755 slen = sizeof (sin6);
756 (void) ksocket_getpeername(new_so,
757 (struct sockaddr *)&sin6, &slen, CRED());
758 bcopy(&sin6.sin6_addr,
759 &session->ipaddr.au_addr.au_ipv6,
760 sizeof (in6_addr_t));
761 rport = sin6.sin6_port;
762 }
763 session->ipaddr.a_family = family;
764 session->local_ipaddr.a_family = family;
765 session->s_local_port = port;
766 session->s_remote_port = ntohs(rport);
767 session->sock = new_so;
768 (void) smb_inet_ntop(&session->ipaddr,
769 session->ip_addr_str, INET6_ADDRSTRLEN);
770 if (port == IPPORT_NETBIOS_SSN)
771 smb_server_inc_nbt_sess(sv);
772 else
773 smb_server_inc_tcp_sess(sv);
774 }
775 session->s_server = sv;
776 smb_server_get_cfg(sv, &session->s_cfg);
777 session->s_srqueue = &sv->sv_srqueue;
778
779 /*
780 * The initial new request handler is special,
781 * and only accepts negotiation requests.
782 */
783 session->newrq_func = smbsr_newrq_initial;
784
785 /* These may increase in SMB2 negotiate. */
786 session->cmd_max_bytes = SMB_REQ_MAX_SIZE;
787 session->reply_max_bytes = SMB_REQ_MAX_SIZE;
788
789 session->s_magic = SMB_SESSION_MAGIC;
790 return (session);
791 }
792
793 void
794 smb_session_delete(smb_session_t *session)
795 {
796
797 ASSERT(session->s_magic == SMB_SESSION_MAGIC);
798
799 if (session->sign_fini != NULL)
800 session->sign_fini(session);
801
802 if (session->signing.mackey != NULL) {
803 kmem_free(session->signing.mackey,
804 session->signing.mackey_len);
805 }
806
807 session->s_magic = 0;
808
809 smb_rwx_destroy(&session->s_lock);
810 smb_net_txl_destructor(&session->s_txlst);
811
812 mutex_destroy(&session->s_credits_mutex);
813
814 smb_slist_destructor(&session->s_req_list);
815 smb_llist_destructor(&session->s_tree_list);
816 smb_llist_destructor(&session->s_user_list);
817 smb_llist_destructor(&session->s_xa_list);
818
819 ASSERT(session->s_tree_cnt == 0);
820 ASSERT(session->s_file_cnt == 0);
821 ASSERT(session->s_dir_cnt == 0);
822
823 smb_idpool_destructor(&session->s_tid_pool);
824 smb_idpool_destructor(&session->s_uid_pool);
825 if (session->sock != NULL) {
826 if (session->s_local_port == IPPORT_NETBIOS_SSN)
827 smb_server_dec_nbt_sess(session->s_server);
828 else
829 smb_server_dec_tcp_sess(session->s_server);
830 smb_sodestroy(session->sock);
831 }
832 kmem_cache_free(smb_cache_session, session);
833 }
834
835 static void
836 smb_session_cancel(smb_session_t *session)
837 {
838 smb_xa_t *xa, *nextxa;
839
840 /* All the request currently being treated must be canceled. */
841 smb_session_cancel_requests(session, NULL, NULL);
842
843 /*
844 * We wait for the completion of all the requests associated with
845 * this session.
846 */
847 smb_slist_wait_for_empty(&session->s_req_list);
848
849 /*
850 * At this point the reference count of the users, trees, files,
851 * directories should be zero. It should be possible to destroy them
852 * without any problem.
853 */
854 xa = smb_llist_head(&session->s_xa_list);
855 while (xa) {
856 nextxa = smb_llist_next(&session->s_xa_list, xa);
857 smb_xa_close(xa);
858 xa = nextxa;
859 }
860
861 smb_session_logoff(session);
862 }
863
864 /*
865 * Cancel requests. If a non-null tree is specified, only requests specific
866 * to that tree will be cancelled. If a non-null sr is specified, that sr
867 * will be not be cancelled - this would typically be the caller's sr.
868 */
869 void
870 smb_session_cancel_requests(
871 smb_session_t *session,
872 smb_tree_t *tree,
873 smb_request_t *exclude_sr)
874 {
875 smb_request_t *sr;
876
877 smb_slist_enter(&session->s_req_list);
878 sr = smb_slist_head(&session->s_req_list);
879
880 while (sr) {
881 ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
882 if ((sr != exclude_sr) &&
883 (tree == NULL || sr->tid_tree == tree))
884 smb_request_cancel(sr);
885
886 sr = smb_slist_next(&session->s_req_list, sr);
887 }
888
889 smb_slist_exit(&session->s_req_list);
890 }
891
892 /*
893 * Find a user on the specified session by SMB UID.
894 */
895 smb_user_t *
896 smb_session_lookup_uid(smb_session_t *session, uint16_t uid)
897 {
898 return (smb_session_lookup_uid_st(session, uid,
899 SMB_USER_STATE_LOGGED_ON));
900 }
901
902 smb_user_t *
903 smb_session_lookup_uid_st(smb_session_t *session, uint16_t uid,
904 smb_user_state_t st)
905 {
906 smb_user_t *user;
907 smb_llist_t *user_list;
908
909 SMB_SESSION_VALID(session);
910
911 user_list = &session->s_user_list;
912 smb_llist_enter(user_list, RW_READER);
913
914 user = smb_llist_head(user_list);
915 while (user) {
916 SMB_USER_VALID(user);
917 ASSERT(user->u_session == session);
918
919 if (user->u_uid == uid && user->u_state == st) {
920 smb_user_hold_internal(user);
921 break;
922 }
923
924 user = smb_llist_next(user_list, user);
925 }
926
927 smb_llist_exit(user_list);
928 return (user);
929 }
930
931 void
932 smb_session_post_user(smb_session_t *session, smb_user_t *user)
933 {
934 SMB_USER_VALID(user);
935 ASSERT(user->u_refcnt == 0);
936 ASSERT(user->u_state == SMB_USER_STATE_LOGGED_OFF);
937 ASSERT(user->u_session == session);
938
939 smb_llist_post(&session->s_user_list, user, smb_user_delete);
940 }
941
942 /*
943 * Find a tree by tree-id.
944 */
945 smb_tree_t *
946 smb_session_lookup_tree(
947 smb_session_t *session,
948 uint16_t tid)
949
950 {
951 smb_tree_t *tree;
952
953 SMB_SESSION_VALID(session);
954
955 smb_llist_enter(&session->s_tree_list, RW_READER);
956 tree = smb_llist_head(&session->s_tree_list);
957
958 while (tree) {
959 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
960 ASSERT(tree->t_session == session);
961
962 if (tree->t_tid == tid) {
963 if (smb_tree_hold(tree)) {
964 smb_llist_exit(&session->s_tree_list);
965 return (tree);
966 } else {
967 smb_llist_exit(&session->s_tree_list);
968 return (NULL);
969 }
970 }
971
972 tree = smb_llist_next(&session->s_tree_list, tree);
973 }
974
975 smb_llist_exit(&session->s_tree_list);
976 return (NULL);
977 }
978
979 /*
980 * Find the first connected tree that matches the specified sharename.
981 * If the specified tree is NULL the search starts from the beginning of
982 * the user's tree list. If a tree is provided the search starts just
983 * after that tree.
984 */
985 smb_tree_t *
986 smb_session_lookup_share(
987 smb_session_t *session,
988 const char *sharename,
989 smb_tree_t *tree)
990 {
991 SMB_SESSION_VALID(session);
992 ASSERT(sharename);
993
994 smb_llist_enter(&session->s_tree_list, RW_READER);
995
996 if (tree) {
997 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
998 ASSERT(tree->t_session == session);
999 tree = smb_llist_next(&session->s_tree_list, tree);
1000 } else {
1001 tree = smb_llist_head(&session->s_tree_list);
1002 }
1003
1004 while (tree) {
1005 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1006 ASSERT(tree->t_session == session);
1007 if (smb_strcasecmp(tree->t_sharename, sharename, 0) == 0) {
1008 if (smb_tree_hold(tree)) {
1009 smb_llist_exit(&session->s_tree_list);
1010 return (tree);
1011 }
1012 }
1013 tree = smb_llist_next(&session->s_tree_list, tree);
1014 }
1015
1016 smb_llist_exit(&session->s_tree_list);
1017 return (NULL);
1018 }
1019
1020 /*
1021 * Find the first connected tree that matches the specified volume name.
1022 * If the specified tree is NULL the search starts from the beginning of
1023 * the user's tree list. If a tree is provided the search starts just
1024 * after that tree.
1025 */
1026 smb_tree_t *
1027 smb_session_lookup_volume(
1028 smb_session_t *session,
1029 const char *name,
1030 smb_tree_t *tree)
1031 {
1032 SMB_SESSION_VALID(session);
1033 ASSERT(name);
1034
1035 smb_llist_enter(&session->s_tree_list, RW_READER);
1036
1037 if (tree) {
1038 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1039 ASSERT(tree->t_session == session);
1040 tree = smb_llist_next(&session->s_tree_list, tree);
1041 } else {
1042 tree = smb_llist_head(&session->s_tree_list);
1043 }
1044
1045 while (tree) {
1046 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1047 ASSERT(tree->t_session == session);
1048
1049 if (smb_strcasecmp(tree->t_volume, name, 0) == 0) {
1050 if (smb_tree_hold(tree)) {
1051 smb_llist_exit(&session->s_tree_list);
1052 return (tree);
1053 }
1054 }
1055
1056 tree = smb_llist_next(&session->s_tree_list, tree);
1057 }
1058
1059 smb_llist_exit(&session->s_tree_list);
1060 return (NULL);
1061 }
1062
1063 /*
1064 * Disconnect all trees that match the specified client process-id.
1065 */
1066 void
1067 smb_session_close_pid(
1068 smb_session_t *session,
1069 uint32_t pid)
1070 {
1071 smb_tree_t *tree;
1072
1073 SMB_SESSION_VALID(session);
1074
1075 tree = smb_session_get_tree(session, NULL);
1076 while (tree) {
1077 smb_tree_t *next;
1078 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1079 ASSERT(tree->t_session == session);
1080 smb_tree_close_pid(tree, pid);
1081 next = smb_session_get_tree(session, tree);
1082 smb_tree_release(tree);
1083 tree = next;
1084 }
1085 }
1086
1087 static void
1088 smb_session_tree_dtor(void *t)
1089 {
1090 smb_tree_t *tree = (smb_tree_t *)t;
1091
1092 smb_tree_disconnect(tree, B_TRUE);
1093 /* release the ref acquired during the traversal loop */
1094 smb_tree_release(tree);
1095 }
1096
1097
1098 /*
1099 * Disconnect all trees that this user has connected.
1100 */
1101 void
1102 smb_session_disconnect_owned_trees(
1103 smb_session_t *session,
1104 smb_user_t *owner)
1105 {
1106 smb_tree_t *tree;
1107 smb_llist_t *tree_list = &session->s_tree_list;
1108
1109 SMB_SESSION_VALID(session);
1110 SMB_USER_VALID(owner);
1111
1112 smb_llist_enter(tree_list, RW_READER);
1113
1114 tree = smb_llist_head(tree_list);
1115 while (tree) {
1116 if ((tree->t_owner == owner) &&
1117 smb_tree_hold(tree)) {
1118 /*
1119 * smb_tree_hold() succeeded, hence we are in state
1120 * SMB_TREE_STATE_CONNECTED; schedule this tree
1121 * for asynchronous disconnect, which will fire
1122 * after we drop the llist traversal lock.
1123 */
1124 smb_llist_post(tree_list, tree, smb_session_tree_dtor);
1125 }
1126 tree = smb_llist_next(tree_list, tree);
1127 }
1128
1129 /* drop the lock and flush the dtor queue */
1130 smb_llist_exit(tree_list);
1131 }
1132
1133 /*
1134 * Disconnect all trees that this user has connected.
1135 */
1136 void
1137 smb_session_disconnect_trees(
1138 smb_session_t *session)
1139 {
1140 smb_tree_t *tree;
1141
1142 SMB_SESSION_VALID(session);
1143
1144 tree = smb_session_get_tree(session, NULL);
1145 while (tree) {
1146 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1147 ASSERT(tree->t_session == session);
1148 smb_tree_disconnect(tree, B_TRUE);
1149 smb_tree_release(tree);
1150 tree = smb_session_get_tree(session, NULL);
1151 }
1152 }
1153
1154 /*
1155 * Disconnect all trees that match the specified share name.
1156 */
1157 void
1158 smb_session_disconnect_share(
1159 smb_session_t *session,
1160 const char *sharename)
1161 {
1162 smb_tree_t *tree;
1163 smb_tree_t *next;
1164
1165 SMB_SESSION_VALID(session);
1166
1167 tree = smb_session_lookup_share(session, sharename, NULL);
1168 while (tree) {
1169 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1170 ASSERT(tree->t_session == session);
1171 smb_session_cancel_requests(session, tree, NULL);
1172 smb_tree_disconnect(tree, B_TRUE);
1173 next = smb_session_lookup_share(session, sharename, tree);
1174 smb_tree_release(tree);
1175 tree = next;
1176 }
1177 }
1178
1179 void
1180 smb_session_post_tree(smb_session_t *session, smb_tree_t *tree)
1181 {
1182 SMB_SESSION_VALID(session);
1183 SMB_TREE_VALID(tree);
1184 ASSERT0(tree->t_refcnt);
1185 ASSERT(tree->t_state == SMB_TREE_STATE_DISCONNECTED);
1186 ASSERT(tree->t_session == session);
1187
1188 smb_llist_post(&session->s_tree_list, tree, smb_tree_dealloc);
1189 }
1190
1191 /*
1192 * Get the next connected tree in the list. A reference is taken on
1193 * the tree, which can be released later with smb_tree_release().
1194 *
1195 * If the specified tree is NULL the search starts from the beginning of
1196 * the tree list. If a tree is provided the search starts just after
1197 * that tree.
1198 *
1199 * Returns NULL if there are no connected trees in the list.
1200 */
1201 static smb_tree_t *
1202 smb_session_get_tree(
1203 smb_session_t *session,
1204 smb_tree_t *tree)
1205 {
1206 smb_llist_t *tree_list;
1207
1208 SMB_SESSION_VALID(session);
1209 tree_list = &session->s_tree_list;
1210
1211 smb_llist_enter(tree_list, RW_READER);
1212
1213 if (tree) {
1214 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1215 tree = smb_llist_next(tree_list, tree);
1216 } else {
1217 tree = smb_llist_head(tree_list);
1218 }
1219
1220 while (tree) {
1221 if (smb_tree_hold(tree))
1222 break;
1223
1224 tree = smb_llist_next(tree_list, tree);
1225 }
1226
1227 smb_llist_exit(tree_list);
1228 return (tree);
1229 }
1230
1231 /*
1232 * Logoff all users associated with the specified session.
1233 */
1234 static void
1235 smb_session_logoff(smb_session_t *session)
1236 {
1237 smb_user_t *user;
1238
1239 SMB_SESSION_VALID(session);
1240
1241 smb_session_disconnect_trees(session);
1242
1243 smb_llist_enter(&session->s_user_list, RW_READER);
1244
1245 user = smb_llist_head(&session->s_user_list);
1246 while (user) {
1247 SMB_USER_VALID(user);
1248 ASSERT(user->u_session == session);
1249
1250 switch (user->u_state) {
1251 case SMB_USER_STATE_LOGGING_ON:
1252 case SMB_USER_STATE_LOGGED_ON:
1253 smb_user_hold_internal(user);
1254 smb_user_logoff(user);
1255 smb_user_release(user);
1256 break;
1257
1258 case SMB_USER_STATE_LOGGED_OFF:
1259 case SMB_USER_STATE_LOGGING_OFF:
1260 break;
1261
1262 default:
1263 ASSERT(0);
1264 break;
1265 }
1266
1267 user = smb_llist_next(&session->s_user_list, user);
1268 }
1269
1270 smb_llist_exit(&session->s_user_list);
1271 }
1272
1273 /*
1274 * Copy the session workstation/client name to buf. If the workstation
1275 * is an empty string (which it will be on TCP connections), use the
1276 * client IP address.
1277 */
1278 void
1279 smb_session_getclient(smb_session_t *sn, char *buf, size_t buflen)
1280 {
1281
1282 *buf = '\0';
1283
1284 if (sn->workstation[0] != '\0') {
1285 (void) strlcpy(buf, sn->workstation, buflen);
1286 return;
1287 }
1288
1289 (void) strlcpy(buf, sn->ip_addr_str, buflen);
1290 }
1291
1292 /*
1293 * Check whether or not the specified client name is the client of this
1294 * session. The name may be in UNC format (\\CLIENT).
1295 *
1296 * A workstation/client name is setup on NBT connections as part of the
1297 * NetBIOS session request but that isn't available on TCP connections.
1298 * If the session doesn't have a client name we typically return the
1299 * client IP address as the workstation name on MSRPC requests. So we
1300 * check for the IP address here in addition to the workstation name.
1301 */
1302 boolean_t
1303 smb_session_isclient(smb_session_t *sn, const char *client)
1304 {
1305
1306 client += strspn(client, "\\");
1307
1308 if (smb_strcasecmp(client, sn->workstation, 0) == 0)
1309 return (B_TRUE);
1310
1311 if (smb_strcasecmp(client, sn->ip_addr_str, 0) == 0)
1312 return (B_TRUE);
1313
1314 return (B_FALSE);
1315 }
1316
1317 /*
1318 * smb_request_alloc
1319 *
1320 * Allocate an smb_request_t structure from the kmem_cache. Partially
1321 * initialize the found/new request.
1322 *
1323 * Returns pointer to a request
1324 */
1325 smb_request_t *
1326 smb_request_alloc(smb_session_t *session, int req_length)
1327 {
1328 smb_request_t *sr;
1329
1330 ASSERT(session->s_magic == SMB_SESSION_MAGIC);
1331 ASSERT(req_length <= session->cmd_max_bytes);
1332
1333 sr = kmem_cache_alloc(smb_cache_request, KM_SLEEP);
1334
1335 /*
1336 * Future: Use constructor to pre-initialize some fields. For now
1337 * there are so many fields that it is easiest just to zero the
1338 * whole thing and start over.
1339 */
1340 bzero(sr, sizeof (smb_request_t));
1341
1342 mutex_init(&sr->sr_mutex, NULL, MUTEX_DEFAULT, NULL);
1343 cv_init(&sr->sr_ncr.nc_cv, NULL, CV_DEFAULT, NULL);
1344 smb_srm_init(sr);
1345 sr->session = session;
1346 sr->sr_server = session->s_server;
1347 sr->sr_gmtoff = session->s_server->si_gmtoff;
1348 sr->sr_cfg = &session->s_cfg;
1349 sr->command.max_bytes = req_length;
1350 sr->reply.max_bytes = session->reply_max_bytes;
1351 sr->sr_req_length = req_length;
1352 if (req_length)
1353 sr->sr_request_buf = kmem_alloc(req_length, KM_SLEEP);
1354 sr->sr_magic = SMB_REQ_MAGIC;
1355 sr->sr_state = SMB_REQ_STATE_INITIALIZING;
1356 smb_slist_insert_tail(&session->s_req_list, sr);
1357 return (sr);
1358 }
1359
1360 /*
1361 * smb_request_free
1362 *
1363 * release the memories which have been allocated for a smb request.
1364 */
1365 void
1366 smb_request_free(smb_request_t *sr)
1367 {
1368 ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
1369 ASSERT(sr->session);
1370 ASSERT(sr->r_xa == NULL);
1371 ASSERT(sr->sr_ncr.nc_fname == NULL);
1372
1373 if (sr->fid_ofile != NULL) {
1374 smb_ofile_request_complete(sr->fid_ofile);
1375 smb_ofile_release(sr->fid_ofile);
1376 }
1377
1378 if (sr->tid_tree != NULL)
1379 smb_tree_release(sr->tid_tree);
1380
1381 if (sr->uid_user != NULL)
1382 smb_user_release(sr->uid_user);
1383
1384 smb_slist_remove(&sr->session->s_req_list, sr);
1385
1386 sr->session = NULL;
1387
1388 smb_srm_fini(sr);
1389
1390 if (sr->sr_request_buf)
1391 kmem_free(sr->sr_request_buf, sr->sr_req_length);
1392 if (sr->command.chain)
1393 m_freem(sr->command.chain);
1394 if (sr->reply.chain)
1395 m_freem(sr->reply.chain);
1396 if (sr->raw_data.chain)
1397 m_freem(sr->raw_data.chain);
1398
1399 sr->sr_magic = 0;
1400 cv_destroy(&sr->sr_ncr.nc_cv);
1401 mutex_destroy(&sr->sr_mutex);
1402 kmem_cache_free(smb_cache_request, sr);
1403 }
1404
1405 boolean_t
1406 smb_session_oplocks_enable(smb_session_t *session)
1407 {
1408 SMB_SESSION_VALID(session);
1409 if (session->s_cfg.skc_oplock_enable == 0)
1410 return (B_FALSE);
1411 else
1412 return (B_TRUE);
1413 }
1414
1415 boolean_t
1416 smb_session_levelII_oplocks(smb_session_t *session)
1417 {
1418 SMB_SESSION_VALID(session);
1419
1420 /* Clients using SMB2 and later always know about oplocks. */
1421 if (session->dialect > NT_LM_0_12)
1422 return (B_TRUE);
1423
1424 /* Older clients only do Level II oplocks if negotiated. */
1425 if ((session->capabilities & CAP_LEVEL_II_OPLOCKS) != 0)
1426 return (B_TRUE);
1427
1428 return (B_FALSE);
1429 }
1430
1431 /*
1432 * smb_session_oplock_break
1433 *
1434 * Send an oplock break request to the client,
1435 * recalling some cache delegation.
1436 */
1437 void
1438 smb_session_oplock_break(smb_request_t *sr, uint8_t brk)
1439 {
1440 smb_session_t *session = sr->session;
1441 mbuf_chain_t *mbc = &sr->reply;
1442
1443 SMB_SESSION_VALID(session);
1444
1445 /*
1446 * Build the break message in sr->reply and then send it.
1447 * The mbc is free'd later, in smb_request_free().
1448 */
1449 mbc->max_bytes = MLEN;
1450 if (session->dialect <= NT_LM_0_12) {
1451 smb1_oplock_break_notification(sr, brk);
1452 } else {
1453 smb2_oplock_break_notification(sr, brk);
1454 }
1455
1456 (void) smb_session_send(session, 0, mbc);
1457 }
1458
1459 static void
1460 smb_session_genkey(smb_session_t *session)
1461 {
1462 uint8_t tmp_key[SMB_CHALLENGE_SZ];
1463
1464 (void) random_get_pseudo_bytes(tmp_key, SMB_CHALLENGE_SZ);
1465 bcopy(tmp_key, &session->challenge_key, SMB_CHALLENGE_SZ);
1466 session->challenge_len = SMB_CHALLENGE_SZ;
1467
1468 (void) random_get_pseudo_bytes(tmp_key, 4);
1469 session->sesskey = tmp_key[0] | tmp_key[1] << 8 |
1470 tmp_key[2] << 16 | tmp_key[3] << 24;
1471 }