3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
24 */
25
26 #include <sys/atomic.h>
27 #include <sys/synch.h>
28 #include <sys/types.h>
29 #include <sys/sdt.h>
30 #include <sys/random.h>
31 #include <smbsrv/netbios.h>
32 #include <smbsrv/smb2_kproto.h>
33 #include <smbsrv/string.h>
34 #include <netinet/tcp.h>
35
36 /* How many iovec we'll handle as a local array (no allocation) */
37 #define SMB_LOCAL_IOV_MAX 16
38
39 #define SMB_NEW_KID() atomic_inc_64_nv(&smb_kids)
40
41 static volatile uint64_t smb_kids;
42
43 /*
44 * We track the keepalive in minutes, but this constant
45 * specifies it in seconds, so convert to minutes.
46 */
47 uint32_t smb_keep_alive = SMB_PI_KEEP_ALIVE_MIN / 60;
48
49 static int smbsr_newrq_initial(smb_request_t *);
50
51 static void smb_session_cancel(smb_session_t *);
52 static int smb_session_reader(smb_session_t *);
53 static int smb_session_xprt_puthdr(smb_session_t *,
54 uint8_t msg_type, uint32_t msg_len,
55 uint8_t *dst, size_t dstlen);
56 static smb_tree_t *smb_session_get_tree(smb_session_t *, smb_tree_t *);
57 static void smb_session_logoff(smb_session_t *);
58 static void smb_request_init_command_mbuf(smb_request_t *sr);
59 static void smb_session_genkey(smb_session_t *);
60
61 void
62 smb_session_timers(smb_llist_t *ll)
63 {
64 smb_session_t *session;
65
66 smb_llist_enter(ll, RW_READER);
67 session = smb_llist_head(ll);
68 while (session != NULL) {
69 /*
70 * Walk through the table and decrement each keep_alive
71 * timer that has not timed out yet. (keepalive > 0)
72 */
73 SMB_SESSION_VALID(session);
74 if (session->keep_alive &&
75 (session->keep_alive != (uint32_t)-1))
76 session->keep_alive--;
77 session = smb_llist_next(ll, session);
78 }
79 smb_llist_exit(ll);
80 }
81
82 void
83 smb_session_correct_keep_alive_values(smb_llist_t *ll, uint32_t new_keep_alive)
84 {
85 smb_session_t *sn;
86
87 /*
88 * Caller specifies seconds, but we track in minutes, so
89 * convert to minutes (rounded up).
90 */
91 new_keep_alive = (new_keep_alive + 59) / 60;
92
93 if (new_keep_alive == smb_keep_alive)
94 return;
95 /*
96 * keep alive == 0 means do not drop connection if it's idle
97 */
98 smb_keep_alive = (new_keep_alive) ? new_keep_alive : -1;
99
100 /*
101 * Walk through the table and set each session to the new keep_alive
102 * value if they have not already timed out. Block clock interrupts.
103 */
104 smb_llist_enter(ll, RW_READER);
105 sn = smb_llist_head(ll);
106 while (sn != NULL) {
107 SMB_SESSION_VALID(sn);
108 if (sn->keep_alive != 0)
109 sn->keep_alive = new_keep_alive;
110 sn = smb_llist_next(ll, sn);
111 }
112 smb_llist_exit(ll);
113 }
114
115 /*
116 * Send a session message - supports SMB-over-NBT and SMB-over-TCP.
117 * If an mbuf chain is provided (optional), it will be freed and
118 * set to NULL -- unconditionally! (error or not)
119 *
120 * Builds a I/O vector (uio/iov) to do the send from mbufs, plus one
121 * segment for the 4-byte NBT header.
122 */
123 int
124 smb_session_send(smb_session_t *session, uint8_t nbt_type, mbuf_chain_t *mbc)
125 {
126 uio_t uio;
127 iovec_t local_iov[SMB_LOCAL_IOV_MAX];
128 iovec_t *alloc_iov = NULL;
129 int alloc_sz = 0;
130 mbuf_t *m;
131 uint8_t nbt_hdr[NETBIOS_HDR_SZ];
132 uint32_t nbt_len;
133 int i, nseg;
134 int rc;
400 {
401
402 /*
403 * Setup mbuf using the buffer we allocated.
404 */
405 MBC_ATTACH_BUF(&sr->command, sr->sr_request_buf, sr->sr_req_length);
406
407 sr->command.flags = 0;
408 sr->command.shadow_of = NULL;
409 }
410
411 /*
412 * smb_request_cancel
413 *
414 * Handle a cancel for a request properly depending on the current request
415 * state.
416 */
417 void
418 smb_request_cancel(smb_request_t *sr)
419 {
420 mutex_enter(&sr->sr_mutex);
421 switch (sr->sr_state) {
422
423 case SMB_REQ_STATE_INITIALIZING:
424 case SMB_REQ_STATE_SUBMITTED:
425 case SMB_REQ_STATE_ACTIVE:
426 case SMB_REQ_STATE_CLEANED_UP:
427 sr->sr_state = SMB_REQ_STATE_CANCELED;
428 break;
429
430 case SMB_REQ_STATE_WAITING_LOCK:
431 /*
432 * This request is waiting on a lock. Wakeup everything
433 * waiting on the lock so that the relevant thread regains
434 * control and notices that is has been canceled. The
435 * other lock request threads waiting on this lock will go
436 * back to sleep when they discover they are still blocked.
437 */
438 sr->sr_state = SMB_REQ_STATE_CANCELED;
439
440 ASSERT(sr->sr_awaiting != NULL);
441 mutex_enter(&sr->sr_awaiting->l_mutex);
442 cv_broadcast(&sr->sr_awaiting->l_cv);
443 mutex_exit(&sr->sr_awaiting->l_mutex);
444 break;
445
446 case SMB_REQ_STATE_WAITING_EVENT:
447 /*
448 * This request is waiting in change notify.
449 */
450 sr->sr_state = SMB_REQ_STATE_CANCELED;
451 cv_signal(&sr->sr_ncr.nc_cv);
452 break;
453
454 case SMB_REQ_STATE_EVENT_OCCURRED:
455 case SMB_REQ_STATE_COMPLETED:
456 case SMB_REQ_STATE_CANCELED:
457 /*
458 * No action required for these states since the request
459 * is completing.
460 */
461 break;
462
463 case SMB_REQ_STATE_FREE:
464 default:
465 SMB_PANIC();
466 }
467 mutex_exit(&sr->sr_mutex);
468 }
469
470 /*
471 * smb_session_receiver
472 *
473 * Receives request from the network and dispatches them to a worker.
474 */
475 void
476 smb_session_receiver(smb_session_t *session)
477 {
478 int rc = 0;
479
480 SMB_SESSION_VALID(session);
481
482 session->s_thread = curthread;
483
484 if (session->s_local_port == IPPORT_NETBIOS_SSN) {
485 rc = smb_netbios_session_request(session);
486 if (rc != 0) {
487 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
488 session->s_state = SMB_SESSION_STATE_DISCONNECTED;
489 smb_rwx_rwexit(&session->s_lock);
490 return;
491 }
492 }
493
494 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
495 session->s_state = SMB_SESSION_STATE_ESTABLISHED;
496 smb_rwx_rwexit(&session->s_lock);
497
498 (void) smb_session_reader(session);
499
500 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
501 session->s_state = SMB_SESSION_STATE_DISCONNECTED;
502 smb_rwx_rwexit(&session->s_lock);
503
504 smb_soshutdown(session->sock);
505
506 DTRACE_PROBE2(session__drop, struct session *, session, int, rc);
507
508 smb_session_cancel(session);
509 /*
510 * At this point everything related to the session should have been
511 * cleaned up and we expect that nothing will attempt to use the
512 * socket.
513 */
514 }
515
516 /*
517 * smb_session_disconnect
518 *
519 * Disconnects the session passed in.
520 */
521 void
522 smb_session_disconnect(smb_session_t *session)
523 {
524 SMB_SESSION_VALID(session);
525
526 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
527 switch (session->s_state) {
528 case SMB_SESSION_STATE_INITIALIZED:
529 case SMB_SESSION_STATE_CONNECTED:
530 case SMB_SESSION_STATE_ESTABLISHED:
531 case SMB_SESSION_STATE_NEGOTIATED:
532 smb_soshutdown(session->sock);
533 session->s_state = SMB_SESSION_STATE_DISCONNECTED;
534 _NOTE(FALLTHRU)
535 case SMB_SESSION_STATE_DISCONNECTED:
536 case SMB_SESSION_STATE_TERMINATED:
537 break;
538 }
539 smb_rwx_rwexit(&session->s_lock);
540 }
541
542 /*
543 * Read and process SMB requests.
544 *
545 * Returns:
546 * 0 Success
547 * 1 Unable to read transport header
548 * 2 Invalid transport header type
549 * 3 Invalid SMB length (too small)
550 * 4 Unable to read SMB header
551 * 5 Invalid SMB header (bad magic number)
552 * 6 Unable to read SMB data
553 */
554 static int
585 continue;
586 }
587 return (EPROTO);
588 }
589
590 if (hdr.xh_length == 0) {
591 /* zero length is another form of keep alive */
592 session->keep_alive = smb_keep_alive;
593 continue;
594 }
595
596 if (hdr.xh_length < SMB_HEADER_LEN)
597 return (EPROTO);
598 if (hdr.xh_length > session->cmd_max_bytes)
599 return (EPROTO);
600
601 session->keep_alive = smb_keep_alive;
602
603 /*
604 * Allocate a request context, read the whole message.
605 */
606 sr = smb_request_alloc(session, hdr.xh_length);
607
608 req_buf = (uint8_t *)sr->sr_request_buf;
609 resid = hdr.xh_length;
610
611 rc = smb_sorecv(session->sock, req_buf, resid);
612 if (rc) {
613 smb_request_free(sr);
614 break;
615 }
616
617 /* accounting: requests, received bytes */
618 smb_server_inc_req(sv);
619 smb_server_add_rxb(sv,
620 (int64_t)(hdr.xh_length + NETBIOS_HDR_SZ));
621
622 /*
623 * Initialize command MBC to represent the received data.
624 */
625 smb_request_init_command_mbuf(sr);
626
627 DTRACE_PROBE1(session__receive__smb, smb_request_t *, sr);
628
629 rc = session->newrq_func(sr);
630 sr = NULL; /* enqueued or freed */
631 if (rc != 0)
632 break;
633 }
634 return (rc);
635 }
636
637 /*
638 * This is the initial handler for new smb requests, called from
639 * from smb_session_reader when we have not yet seen any requests.
640 * The first SMB request must be "negotiate", which determines
641 * which protocol and dialect we'll be using. That's the ONLY
642 * request type handled here, because with all later requests,
643 * we know the protocol and handle those with either the SMB1 or
644 * SMB2 handlers: smb1sr_post() or smb2sr_post().
645 * Those do NOT allow SMB negotiate, because that's only allowed
646 * as the first request on new session.
647 *
648 * This and other "post a request" handlers must either enqueue
649 * the new request for the session taskq, or smb_request_free it
650 * (in case we've decided to drop this connection). In this
651 * (special) new request handler, we always free the request.
652 */
653 static int
654 smbsr_newrq_initial(smb_request_t *sr)
655 {
656 uint32_t magic;
657 int rc = EPROTO;
658
659 mutex_enter(&sr->sr_mutex);
660 sr->sr_state = SMB_REQ_STATE_ACTIVE;
661 mutex_exit(&sr->sr_mutex);
662
663 magic = SMB_READ_PROTOCOL(sr->sr_request_buf);
664 if (magic == SMB_PROTOCOL_MAGIC)
665 rc = smb1_newrq_negotiate(sr);
666 if (magic == SMB2_PROTOCOL_MAGIC)
667 rc = smb2_newrq_negotiate(sr);
668
669 mutex_enter(&sr->sr_mutex);
670 sr->sr_state = SMB_REQ_STATE_COMPLETED;
671 mutex_exit(&sr->sr_mutex);
686 struct sockaddr_in6 sin6;
687 smb_session_t *session;
688 int64_t now;
689 uint16_t rport;
690
691 session = kmem_cache_alloc(smb_cache_session, KM_SLEEP);
692 bzero(session, sizeof (smb_session_t));
693
694 if (smb_idpool_constructor(&session->s_uid_pool)) {
695 kmem_cache_free(smb_cache_session, session);
696 return (NULL);
697 }
698 if (smb_idpool_constructor(&session->s_tid_pool)) {
699 smb_idpool_destructor(&session->s_uid_pool);
700 kmem_cache_free(smb_cache_session, session);
701 return (NULL);
702 }
703
704 now = ddi_get_lbolt64();
705
706 session->s_kid = SMB_NEW_KID();
707 session->s_state = SMB_SESSION_STATE_INITIALIZED;
708 session->native_os = NATIVE_OS_UNKNOWN;
709 session->opentime = now;
710 session->keep_alive = smb_keep_alive;
711 session->activity_timestamp = now;
712
713 smb_session_genkey(session);
714
715 mutex_init(&session->s_credits_mutex, NULL, MUTEX_DEFAULT, NULL);
716
717 smb_slist_constructor(&session->s_req_list, sizeof (smb_request_t),
718 offsetof(smb_request_t, sr_session_lnd));
719
720 smb_llist_constructor(&session->s_user_list, sizeof (smb_user_t),
721 offsetof(smb_user_t, u_lnd));
722
723 smb_llist_constructor(&session->s_tree_list, sizeof (smb_tree_t),
724 offsetof(smb_tree_t, t_lnd));
725
726 smb_llist_constructor(&session->s_xa_list, sizeof (smb_xa_t),
727 offsetof(smb_xa_t, xa_lnd));
728
729 smb_net_txl_constructor(&session->s_txlst);
730
731 smb_rwx_init(&session->s_lock);
732
733 if (new_so != NULL) {
734 if (family == AF_INET) {
735 slen = sizeof (sin);
736 (void) ksocket_getsockname(new_so,
737 (struct sockaddr *)&sin, &slen, CRED());
738 bcopy(&sin.sin_addr,
739 &session->local_ipaddr.au_addr.au_ipv4,
740 sizeof (in_addr_t));
741 slen = sizeof (sin);
742 (void) ksocket_getpeername(new_so,
743 (struct sockaddr *)&sin, &slen, CRED());
744 bcopy(&sin.sin_addr,
745 &session->ipaddr.au_addr.au_ipv4,
746 sizeof (in_addr_t));
747 rport = sin.sin_port;
748 } else {
749 slen = sizeof (sin6);
750 (void) ksocket_getsockname(new_so,
751 (struct sockaddr *)&sin6, &slen, CRED());
752 bcopy(&sin6.sin6_addr,
753 &session->local_ipaddr.au_addr.au_ipv6,
755 slen = sizeof (sin6);
756 (void) ksocket_getpeername(new_so,
757 (struct sockaddr *)&sin6, &slen, CRED());
758 bcopy(&sin6.sin6_addr,
759 &session->ipaddr.au_addr.au_ipv6,
760 sizeof (in6_addr_t));
761 rport = sin6.sin6_port;
762 }
763 session->ipaddr.a_family = family;
764 session->local_ipaddr.a_family = family;
765 session->s_local_port = port;
766 session->s_remote_port = ntohs(rport);
767 session->sock = new_so;
768 (void) smb_inet_ntop(&session->ipaddr,
769 session->ip_addr_str, INET6_ADDRSTRLEN);
770 if (port == IPPORT_NETBIOS_SSN)
771 smb_server_inc_nbt_sess(sv);
772 else
773 smb_server_inc_tcp_sess(sv);
774 }
775 session->s_server = sv;
776 smb_server_get_cfg(sv, &session->s_cfg);
777 session->s_srqueue = &sv->sv_srqueue;
778
779 /*
780 * The initial new request handler is special,
781 * and only accepts negotiation requests.
782 */
783 session->newrq_func = smbsr_newrq_initial;
784
785 /* These may increase in SMB2 negotiate. */
786 session->cmd_max_bytes = SMB_REQ_MAX_SIZE;
787 session->reply_max_bytes = SMB_REQ_MAX_SIZE;
788
789 session->s_magic = SMB_SESSION_MAGIC;
790 return (session);
791 }
792
793 void
794 smb_session_delete(smb_session_t *session)
795 {
796
797 ASSERT(session->s_magic == SMB_SESSION_MAGIC);
798
799 if (session->sign_fini != NULL)
800 session->sign_fini(session);
801
802 if (session->signing.mackey != NULL) {
803 kmem_free(session->signing.mackey,
804 session->signing.mackey_len);
805 }
806
807 session->s_magic = 0;
808
809 smb_rwx_destroy(&session->s_lock);
810 smb_net_txl_destructor(&session->s_txlst);
811
812 mutex_destroy(&session->s_credits_mutex);
813
814 smb_slist_destructor(&session->s_req_list);
815 smb_llist_destructor(&session->s_tree_list);
816 smb_llist_destructor(&session->s_user_list);
817 smb_llist_destructor(&session->s_xa_list);
818
830 smb_sodestroy(session->sock);
831 }
832 kmem_cache_free(smb_cache_session, session);
833 }
834
835 static void
836 smb_session_cancel(smb_session_t *session)
837 {
838 smb_xa_t *xa, *nextxa;
839
840 /* All the request currently being treated must be canceled. */
841 smb_session_cancel_requests(session, NULL, NULL);
842
843 /*
844 * We wait for the completion of all the requests associated with
845 * this session.
846 */
847 smb_slist_wait_for_empty(&session->s_req_list);
848
849 /*
850 * At this point the reference count of the users, trees, files,
851 * directories should be zero. It should be possible to destroy them
852 * without any problem.
853 */
854 xa = smb_llist_head(&session->s_xa_list);
855 while (xa) {
856 nextxa = smb_llist_next(&session->s_xa_list, xa);
857 smb_xa_close(xa);
858 xa = nextxa;
859 }
860
861 smb_session_logoff(session);
862 }
863
864 /*
865 * Cancel requests. If a non-null tree is specified, only requests specific
866 * to that tree will be cancelled. If a non-null sr is specified, that sr
867 * will be not be cancelled - this would typically be the caller's sr.
868 */
869 void
870 smb_session_cancel_requests(
871 smb_session_t *session,
872 smb_tree_t *tree,
873 smb_request_t *exclude_sr)
874 {
875 smb_request_t *sr;
876
877 smb_slist_enter(&session->s_req_list);
878 sr = smb_slist_head(&session->s_req_list);
879
880 while (sr) {
881 ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
882 if ((sr != exclude_sr) &&
883 (tree == NULL || sr->tid_tree == tree))
884 smb_request_cancel(sr);
885
886 sr = smb_slist_next(&session->s_req_list, sr);
887 }
888
889 smb_slist_exit(&session->s_req_list);
890 }
891
892 /*
893 * Find a user on the specified session by SMB UID.
894 */
895 smb_user_t *
896 smb_session_lookup_uid(smb_session_t *session, uint16_t uid)
897 {
898 return (smb_session_lookup_uid_st(session, uid,
899 SMB_USER_STATE_LOGGED_ON));
900 }
901
902 smb_user_t *
903 smb_session_lookup_uid_st(smb_session_t *session, uint16_t uid,
904 smb_user_state_t st)
905 {
906 smb_user_t *user;
907 smb_llist_t *user_list;
908
909 SMB_SESSION_VALID(session);
910
911 user_list = &session->s_user_list;
912 smb_llist_enter(user_list, RW_READER);
913
914 user = smb_llist_head(user_list);
915 while (user) {
916 SMB_USER_VALID(user);
917 ASSERT(user->u_session == session);
918
919 if (user->u_uid == uid && user->u_state == st) {
920 smb_user_hold_internal(user);
921 break;
922 }
923
924 user = smb_llist_next(user_list, user);
925 }
926
927 smb_llist_exit(user_list);
928 return (user);
929 }
930
931 void
932 smb_session_post_user(smb_session_t *session, smb_user_t *user)
933 {
934 SMB_USER_VALID(user);
935 ASSERT(user->u_refcnt == 0);
936 ASSERT(user->u_state == SMB_USER_STATE_LOGGED_OFF);
937 ASSERT(user->u_session == session);
938
939 smb_llist_post(&session->s_user_list, user, smb_user_delete);
940 }
941
942 /*
943 * Find a tree by tree-id.
944 */
945 smb_tree_t *
946 smb_session_lookup_tree(
947 smb_session_t *session,
948 uint16_t tid)
949
950 {
951 smb_tree_t *tree;
952
953 SMB_SESSION_VALID(session);
954
955 smb_llist_enter(&session->s_tree_list, RW_READER);
956 tree = smb_llist_head(&session->s_tree_list);
957
958 while (tree) {
959 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
960 ASSERT(tree->t_session == session);
961
962 if (tree->t_tid == tid) {
963 if (smb_tree_hold(tree)) {
964 smb_llist_exit(&session->s_tree_list);
965 return (tree);
966 } else {
967 smb_llist_exit(&session->s_tree_list);
968 return (NULL);
969 }
970 }
971
972 tree = smb_llist_next(&session->s_tree_list, tree);
973 }
974
975 smb_llist_exit(&session->s_tree_list);
976 return (NULL);
977 }
978
979 /*
980 * Find the first connected tree that matches the specified sharename.
981 * If the specified tree is NULL the search starts from the beginning of
982 * the user's tree list. If a tree is provided the search starts just
983 * after that tree.
984 */
985 smb_tree_t *
986 smb_session_lookup_share(
987 smb_session_t *session,
988 const char *sharename,
989 smb_tree_t *tree)
990 {
991 SMB_SESSION_VALID(session);
992 ASSERT(sharename);
993
994 smb_llist_enter(&session->s_tree_list, RW_READER);
995
996 if (tree) {
997 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
998 ASSERT(tree->t_session == session);
999 tree = smb_llist_next(&session->s_tree_list, tree);
1000 } else {
1001 tree = smb_llist_head(&session->s_tree_list);
1002 }
1003
1004 while (tree) {
1005 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1006 ASSERT(tree->t_session == session);
1007 if (smb_strcasecmp(tree->t_sharename, sharename, 0) == 0) {
1008 if (smb_tree_hold(tree)) {
1009 smb_llist_exit(&session->s_tree_list);
1010 return (tree);
1011 }
1012 }
1013 tree = smb_llist_next(&session->s_tree_list, tree);
1014 }
1015
1016 smb_llist_exit(&session->s_tree_list);
1017 return (NULL);
1018 }
1019
1020 /*
1021 * Find the first connected tree that matches the specified volume name.
1022 * If the specified tree is NULL the search starts from the beginning of
1023 * the user's tree list. If a tree is provided the search starts just
1024 * after that tree.
1025 */
1026 smb_tree_t *
1027 smb_session_lookup_volume(
1028 smb_session_t *session,
1029 const char *name,
1030 smb_tree_t *tree)
1031 {
1032 SMB_SESSION_VALID(session);
1033 ASSERT(name);
1034
1035 smb_llist_enter(&session->s_tree_list, RW_READER);
1036
1037 if (tree) {
1038 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1039 ASSERT(tree->t_session == session);
1040 tree = smb_llist_next(&session->s_tree_list, tree);
1041 } else {
1042 tree = smb_llist_head(&session->s_tree_list);
1043 }
1044
1045 while (tree) {
1046 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1047 ASSERT(tree->t_session == session);
1048
1049 if (smb_strcasecmp(tree->t_volume, name, 0) == 0) {
1050 if (smb_tree_hold(tree)) {
1051 smb_llist_exit(&session->s_tree_list);
1052 return (tree);
1053 }
1054 }
1055
1056 tree = smb_llist_next(&session->s_tree_list, tree);
1057 }
1058
1059 smb_llist_exit(&session->s_tree_list);
1060 return (NULL);
1061 }
1062
1063 /*
1064 * Disconnect all trees that match the specified client process-id.
1065 */
1066 void
1067 smb_session_close_pid(
1068 smb_session_t *session,
1069 uint32_t pid)
1070 {
1071 smb_tree_t *tree;
1072
1073 SMB_SESSION_VALID(session);
1074
1075 tree = smb_session_get_tree(session, NULL);
1076 while (tree) {
1077 smb_tree_t *next;
1078 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1079 ASSERT(tree->t_session == session);
1080 smb_tree_close_pid(tree, pid);
1081 next = smb_session_get_tree(session, tree);
1082 smb_tree_release(tree);
1083 tree = next;
1084 }
1085 }
1086
1087 static void
1088 smb_session_tree_dtor(void *t)
1089 {
1090 smb_tree_t *tree = (smb_tree_t *)t;
1091
1092 smb_tree_disconnect(tree, B_TRUE);
1093 /* release the ref acquired during the traversal loop */
1094 smb_tree_release(tree);
1095 }
1096
1097
1098 /*
1099 * Disconnect all trees that this user has connected.
1100 */
1101 void
1102 smb_session_disconnect_owned_trees(
1103 smb_session_t *session,
1104 smb_user_t *owner)
1105 {
1106 smb_tree_t *tree;
1107 smb_llist_t *tree_list = &session->s_tree_list;
1108
1109 SMB_SESSION_VALID(session);
1110 SMB_USER_VALID(owner);
1111
1112 smb_llist_enter(tree_list, RW_READER);
1113
1114 tree = smb_llist_head(tree_list);
1115 while (tree) {
1116 if ((tree->t_owner == owner) &&
1117 smb_tree_hold(tree)) {
1118 /*
1119 * smb_tree_hold() succeeded, hence we are in state
1120 * SMB_TREE_STATE_CONNECTED; schedule this tree
1121 * for asynchronous disconnect, which will fire
1122 * after we drop the llist traversal lock.
1123 */
1124 smb_llist_post(tree_list, tree, smb_session_tree_dtor);
1125 }
1126 tree = smb_llist_next(tree_list, tree);
1127 }
1128
1129 /* drop the lock and flush the dtor queue */
1130 smb_llist_exit(tree_list);
1131 }
1132
1133 /*
1134 * Disconnect all trees that this user has connected.
1135 */
1136 void
1137 smb_session_disconnect_trees(
1138 smb_session_t *session)
1139 {
1140 smb_tree_t *tree;
1141
1142 SMB_SESSION_VALID(session);
1143
1144 tree = smb_session_get_tree(session, NULL);
1145 while (tree) {
1146 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1147 ASSERT(tree->t_session == session);
1148 smb_tree_disconnect(tree, B_TRUE);
1149 smb_tree_release(tree);
1150 tree = smb_session_get_tree(session, NULL);
1151 }
1152 }
1153
1154 /*
1155 * Disconnect all trees that match the specified share name.
1156 */
1157 void
1158 smb_session_disconnect_share(
1159 smb_session_t *session,
1160 const char *sharename)
1161 {
1162 smb_tree_t *tree;
1163 smb_tree_t *next;
1164
1165 SMB_SESSION_VALID(session);
1166
1167 tree = smb_session_lookup_share(session, sharename, NULL);
1168 while (tree) {
1169 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1170 ASSERT(tree->t_session == session);
1171 smb_session_cancel_requests(session, tree, NULL);
1172 smb_tree_disconnect(tree, B_TRUE);
1173 next = smb_session_lookup_share(session, sharename, tree);
1174 smb_tree_release(tree);
1175 tree = next;
1176 }
1177 }
1178
1179 void
1180 smb_session_post_tree(smb_session_t *session, smb_tree_t *tree)
1181 {
1182 SMB_SESSION_VALID(session);
1183 SMB_TREE_VALID(tree);
1184 ASSERT0(tree->t_refcnt);
1185 ASSERT(tree->t_state == SMB_TREE_STATE_DISCONNECTED);
1186 ASSERT(tree->t_session == session);
1187
1188 smb_llist_post(&session->s_tree_list, tree, smb_tree_dealloc);
1189 }
1190
1191 /*
1192 * Get the next connected tree in the list. A reference is taken on
1193 * the tree, which can be released later with smb_tree_release().
1194 *
1195 * If the specified tree is NULL the search starts from the beginning of
1196 * the tree list. If a tree is provided the search starts just after
1197 * that tree.
1198 *
1199 * Returns NULL if there are no connected trees in the list.
1200 */
1201 static smb_tree_t *
1202 smb_session_get_tree(
1203 smb_session_t *session,
1204 smb_tree_t *tree)
1205 {
1206 smb_llist_t *tree_list;
1207
1208 SMB_SESSION_VALID(session);
1209 tree_list = &session->s_tree_list;
1210
1211 smb_llist_enter(tree_list, RW_READER);
1212
1213 if (tree) {
1214 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1215 tree = smb_llist_next(tree_list, tree);
1216 } else {
1217 tree = smb_llist_head(tree_list);
1218 }
1219
1220 while (tree) {
1221 if (smb_tree_hold(tree))
1222 break;
1223
1224 tree = smb_llist_next(tree_list, tree);
1225 }
1226
1227 smb_llist_exit(tree_list);
1228 return (tree);
1229 }
1230
1231 /*
1232 * Logoff all users associated with the specified session.
1233 */
1234 static void
1235 smb_session_logoff(smb_session_t *session)
1236 {
1237 smb_user_t *user;
1238
1239 SMB_SESSION_VALID(session);
1240
1241 smb_session_disconnect_trees(session);
1242
1243 smb_llist_enter(&session->s_user_list, RW_READER);
1244
1245 user = smb_llist_head(&session->s_user_list);
1246 while (user) {
1247 SMB_USER_VALID(user);
1248 ASSERT(user->u_session == session);
1249
1250 switch (user->u_state) {
1251 case SMB_USER_STATE_LOGGING_ON:
1252 case SMB_USER_STATE_LOGGED_ON:
1253 smb_user_hold_internal(user);
1254 smb_user_logoff(user);
1255 smb_user_release(user);
1256 break;
1257
1258 case SMB_USER_STATE_LOGGED_OFF:
1259 case SMB_USER_STATE_LOGGING_OFF:
1260 break;
1261
1262 default:
1263 ASSERT(0);
1264 break;
1265 }
1266
1267 user = smb_llist_next(&session->s_user_list, user);
1268 }
1269
1270 smb_llist_exit(&session->s_user_list);
1271 }
1272
1273 /*
1274 * Copy the session workstation/client name to buf. If the workstation
1275 * is an empty string (which it will be on TCP connections), use the
1276 * client IP address.
1277 */
1278 void
1279 smb_session_getclient(smb_session_t *sn, char *buf, size_t buflen)
1280 {
1281
1282 *buf = '\0';
1283
1284 if (sn->workstation[0] != '\0') {
1285 (void) strlcpy(buf, sn->workstation, buflen);
1286 return;
1287 }
1288
1289 (void) strlcpy(buf, sn->ip_addr_str, buflen);
1290 }
1303 smb_session_isclient(smb_session_t *sn, const char *client)
1304 {
1305
1306 client += strspn(client, "\\");
1307
1308 if (smb_strcasecmp(client, sn->workstation, 0) == 0)
1309 return (B_TRUE);
1310
1311 if (smb_strcasecmp(client, sn->ip_addr_str, 0) == 0)
1312 return (B_TRUE);
1313
1314 return (B_FALSE);
1315 }
1316
1317 /*
1318 * smb_request_alloc
1319 *
1320 * Allocate an smb_request_t structure from the kmem_cache. Partially
1321 * initialize the found/new request.
1322 *
1323 * Returns pointer to a request
1324 */
1325 smb_request_t *
1326 smb_request_alloc(smb_session_t *session, int req_length)
1327 {
1328 smb_request_t *sr;
1329
1330 ASSERT(session->s_magic == SMB_SESSION_MAGIC);
1331 ASSERT(req_length <= session->cmd_max_bytes);
1332
1333 sr = kmem_cache_alloc(smb_cache_request, KM_SLEEP);
1334
1335 /*
1336 * Future: Use constructor to pre-initialize some fields. For now
1337 * there are so many fields that it is easiest just to zero the
1338 * whole thing and start over.
1339 */
1340 bzero(sr, sizeof (smb_request_t));
1341
1342 mutex_init(&sr->sr_mutex, NULL, MUTEX_DEFAULT, NULL);
1343 cv_init(&sr->sr_ncr.nc_cv, NULL, CV_DEFAULT, NULL);
1344 smb_srm_init(sr);
1345 sr->session = session;
1346 sr->sr_server = session->s_server;
1347 sr->sr_gmtoff = session->s_server->si_gmtoff;
1348 sr->sr_cfg = &session->s_cfg;
1349 sr->command.max_bytes = req_length;
1350 sr->reply.max_bytes = session->reply_max_bytes;
1351 sr->sr_req_length = req_length;
1352 if (req_length)
1353 sr->sr_request_buf = kmem_alloc(req_length, KM_SLEEP);
1354 sr->sr_magic = SMB_REQ_MAGIC;
1355 sr->sr_state = SMB_REQ_STATE_INITIALIZING;
1356 smb_slist_insert_tail(&session->s_req_list, sr);
1357 return (sr);
1358 }
1359
1360 /*
1361 * smb_request_free
1362 *
1363 * release the memories which have been allocated for a smb request.
1364 */
1365 void
1366 smb_request_free(smb_request_t *sr)
1367 {
1368 ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
1369 ASSERT(sr->session);
1370 ASSERT(sr->r_xa == NULL);
1371 ASSERT(sr->sr_ncr.nc_fname == NULL);
1372
1373 if (sr->fid_ofile != NULL) {
1374 smb_ofile_request_complete(sr->fid_ofile);
1375 smb_ofile_release(sr->fid_ofile);
1376 }
1377
1378 if (sr->tid_tree != NULL)
1379 smb_tree_release(sr->tid_tree);
1380
1381 if (sr->uid_user != NULL)
1382 smb_user_release(sr->uid_user);
1383
1384 smb_slist_remove(&sr->session->s_req_list, sr);
1385
1386 sr->session = NULL;
1387
1388 smb_srm_fini(sr);
1389
1390 if (sr->sr_request_buf)
1391 kmem_free(sr->sr_request_buf, sr->sr_req_length);
1392 if (sr->command.chain)
1393 m_freem(sr->command.chain);
1394 if (sr->reply.chain)
1395 m_freem(sr->reply.chain);
1396 if (sr->raw_data.chain)
1397 m_freem(sr->raw_data.chain);
1398
1399 sr->sr_magic = 0;
1400 cv_destroy(&sr->sr_ncr.nc_cv);
1401 mutex_destroy(&sr->sr_mutex);
1402 kmem_cache_free(smb_cache_request, sr);
1403 }
1404
1405 boolean_t
1406 smb_session_oplocks_enable(smb_session_t *session)
1407 {
1408 SMB_SESSION_VALID(session);
1409 if (session->s_cfg.skc_oplock_enable == 0)
1410 return (B_FALSE);
1411 else
1412 return (B_TRUE);
1413 }
1414
1415 boolean_t
1416 smb_session_levelII_oplocks(smb_session_t *session)
1417 {
1418 SMB_SESSION_VALID(session);
1419
1420 /* Clients using SMB2 and later always know about oplocks. */
1421 if (session->dialect > NT_LM_0_12)
1422 return (B_TRUE);
1423
1424 /* Older clients only do Level II oplocks if negotiated. */
1425 if ((session->capabilities & CAP_LEVEL_II_OPLOCKS) != 0)
1426 return (B_TRUE);
1427
1428 return (B_FALSE);
1429 }
1430
1431 /*
1432 * smb_session_oplock_break
1433 *
1434 * Send an oplock break request to the client,
1435 * recalling some cache delegation.
1436 */
1437 void
1438 smb_session_oplock_break(smb_request_t *sr, uint8_t brk)
1439 {
1440 smb_session_t *session = sr->session;
1441 mbuf_chain_t *mbc = &sr->reply;
1442
1443 SMB_SESSION_VALID(session);
1444
1445 /*
1446 * Build the break message in sr->reply and then send it.
1447 * The mbc is free'd later, in smb_request_free().
1448 */
1449 mbc->max_bytes = MLEN;
1450 if (session->dialect <= NT_LM_0_12) {
1451 smb1_oplock_break_notification(sr, brk);
1452 } else {
1453 smb2_oplock_break_notification(sr, brk);
1454 }
1455
1456 (void) smb_session_send(session, 0, mbc);
1457 }
1458
1459 static void
1460 smb_session_genkey(smb_session_t *session)
1461 {
1462 uint8_t tmp_key[SMB_CHALLENGE_SZ];
1463
1464 (void) random_get_pseudo_bytes(tmp_key, SMB_CHALLENGE_SZ);
1465 bcopy(tmp_key, &session->challenge_key, SMB_CHALLENGE_SZ);
1466 session->challenge_len = SMB_CHALLENGE_SZ;
1467
1468 (void) random_get_pseudo_bytes(tmp_key, 4);
1469 session->sesskey = tmp_key[0] | tmp_key[1] << 8 |
1470 tmp_key[2] << 16 | tmp_key[3] << 24;
1471 }
|
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2019 Nexenta Systems, Inc. All rights reserved.
24 */
25
26 #include <sys/atomic.h>
27 #include <sys/synch.h>
28 #include <sys/types.h>
29 #include <sys/sdt.h>
30 #include <sys/random.h>
31 #include <smbsrv/netbios.h>
32 #include <smbsrv/smb2_kproto.h>
33 #include <smbsrv/string.h>
34 #include <netinet/tcp.h>
35
36 /* How many iovec we'll handle as a local array (no allocation) */
37 #define SMB_LOCAL_IOV_MAX 16
38
39 #define SMB_NEW_KID() atomic_inc_64_nv(&smb_kids)
40
41 static volatile uint64_t smb_kids;
42
43 /*
44 * We track the keepalive in minutes, but this constant
45 * specifies it in seconds, so convert to minutes.
46 */
47 uint32_t smb_keep_alive = SMB_PI_KEEP_ALIVE_MIN / 60;
48
49 /*
50 * There are many smbtorture test cases that send
51 * racing requests, and where the tests fail if we
52 * don't execute them in exactly the order sent.
53 * These are test bugs. The protocol makes no
54 * guarantees about execution order of requests
55 * that are concurrently active.
56 *
57 * Nonetheless, smbtorture has many useful tests,
58 * so we have this work-around we can enable to
59 * basically force sequential execution. When
60 * enabled, insert a delay after each request is
61 * issued a taskq job. Enable this with mdb by
62 * setting smb_reader_delay to 10. Don't make it
63 * more than 500 or so or the server will appear
64 * to be so slow that tests may time out.
65 */
66 int smb_reader_delay = 0; /* mSec. */
67
68 static int smbsr_newrq_initial(smb_request_t *);
69
70 static void smb_session_cancel(smb_session_t *);
71 static int smb_session_reader(smb_session_t *);
72 static int smb_session_xprt_puthdr(smb_session_t *,
73 uint8_t msg_type, uint32_t msg_len,
74 uint8_t *dst, size_t dstlen);
75 static void smb_session_disconnect_trees(smb_session_t *);
76 static void smb_request_init_command_mbuf(smb_request_t *sr);
77 static void smb_session_genkey(smb_session_t *);
78 static int smb_session_kstat_update(kstat_t *, int);
79 void session_stats_init(smb_server_t *, smb_session_t *);
80 void session_stats_fini(smb_session_t *);
81
82 /*
83 * This (legacy) code is in support of an "idle timeout" feature,
84 * which is apparently incomplete. To complete it, we should:
85 * when the keep_alive timer expires, check whether the client
86 * has any open files, and if not then kill their session.
87 * Right now the timers are there, but nothing happens when
88 * a timer expires.
89 *
90 * Todo: complete logic to kill idle sessions.
91 *
92 * Only called when sv_cfg.skc_keepalive != 0
93 */
94 void
95 smb_session_timers(smb_server_t *sv)
96 {
97 smb_session_t *session;
98 smb_llist_t *ll;
99
100 ll = &sv->sv_session_list;
101 smb_llist_enter(ll, RW_READER);
102 session = smb_llist_head(ll);
103 while (session != NULL) {
104 /*
105 * Walk through the table and decrement each keep_alive
106 * timer that has not timed out yet. (keepalive > 0)
107 */
108 SMB_SESSION_VALID(session);
109 if (session->keep_alive &&
110 (session->keep_alive != (uint32_t)-1))
111 session->keep_alive--;
112
113 session = smb_llist_next(ll, session);
114 }
115 smb_llist_exit(ll);
116 }
117
118 /*
119 * Send a session message - supports SMB-over-NBT and SMB-over-TCP.
120 * If an mbuf chain is provided (optional), it will be freed and
121 * set to NULL -- unconditionally! (error or not)
122 *
123 * Builds a I/O vector (uio/iov) to do the send from mbufs, plus one
124 * segment for the 4-byte NBT header.
125 */
126 int
127 smb_session_send(smb_session_t *session, uint8_t nbt_type, mbuf_chain_t *mbc)
128 {
129 uio_t uio;
130 iovec_t local_iov[SMB_LOCAL_IOV_MAX];
131 iovec_t *alloc_iov = NULL;
132 int alloc_sz = 0;
133 mbuf_t *m;
134 uint8_t nbt_hdr[NETBIOS_HDR_SZ];
135 uint32_t nbt_len;
136 int i, nseg;
137 int rc;
403 {
404
405 /*
406 * Setup mbuf using the buffer we allocated.
407 */
408 MBC_ATTACH_BUF(&sr->command, sr->sr_request_buf, sr->sr_req_length);
409
410 sr->command.flags = 0;
411 sr->command.shadow_of = NULL;
412 }
413
414 /*
415 * smb_request_cancel
416 *
417 * Handle a cancel for a request properly depending on the current request
418 * state.
419 */
420 void
421 smb_request_cancel(smb_request_t *sr)
422 {
423 void (*cancel_method)(smb_request_t *) = NULL;
424
425 mutex_enter(&sr->sr_mutex);
426 switch (sr->sr_state) {
427
428 case SMB_REQ_STATE_INITIALIZING:
429 case SMB_REQ_STATE_SUBMITTED:
430 case SMB_REQ_STATE_ACTIVE:
431 case SMB_REQ_STATE_CLEANED_UP:
432 sr->sr_state = SMB_REQ_STATE_CANCELLED;
433 break;
434
435 case SMB_REQ_STATE_WAITING_AUTH:
436 case SMB_REQ_STATE_WAITING_FCN1:
437 case SMB_REQ_STATE_WAITING_LOCK:
438 case SMB_REQ_STATE_WAITING_PIPE:
439 /*
440 * These are states that have a cancel_method.
441 * Make the state change now, to ensure that
442 * we call cancel_method exactly once. Do the
443 * method call below, after we drop sr_mutex.
444 * When the cancelled request thread resumes,
445 * it should re-take sr_mutex and set sr_state
446 * to CANCELLED, then return STATUS_CANCELLED.
447 */
448 sr->sr_state = SMB_REQ_STATE_CANCEL_PENDING;
449 cancel_method = sr->cancel_method;
450 VERIFY(cancel_method != NULL);
451 break;
452
453 case SMB_REQ_STATE_WAITING_FCN2:
454 case SMB_REQ_STATE_COMPLETED:
455 case SMB_REQ_STATE_CANCEL_PENDING:
456 case SMB_REQ_STATE_CANCELLED:
457 /*
458 * No action required for these states since the request
459 * is completing.
460 */
461 break;
462
463 case SMB_REQ_STATE_FREE:
464 default:
465 SMB_PANIC();
466 }
467 mutex_exit(&sr->sr_mutex);
468
469 if (cancel_method != NULL) {
470 cancel_method(sr);
471 }
472 }
473
474 /*
475 * smb_session_receiver
476 *
477 * Receives request from the network and dispatches them to a worker.
478 *
479 * When we receive a disconnect here, it _could_ be due to the server
480 * having initiated disconnect, in which case the session state will be
481 * SMB_SESSION_STATE_TERMINATED and we want to keep that state so later
482 * tear-down logic will know which side initiated.
483 */
484 void
485 smb_session_receiver(smb_session_t *session)
486 {
487 int rc = 0;
488
489 SMB_SESSION_VALID(session);
490
491 session->s_thread = curthread;
492
493 if (session->s_local_port == IPPORT_NETBIOS_SSN) {
494 rc = smb_netbios_session_request(session);
495 if (rc != 0) {
496 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
497 if (session->s_state != SMB_SESSION_STATE_TERMINATED)
498 session->s_state =
499 SMB_SESSION_STATE_DISCONNECTED;
500 smb_rwx_rwexit(&session->s_lock);
501 return;
502 }
503 }
504
505 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
506 session->s_state = SMB_SESSION_STATE_ESTABLISHED;
507 smb_rwx_rwexit(&session->s_lock);
508
509 (void) smb_session_reader(session);
510
511 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
512 if (session->s_state != SMB_SESSION_STATE_TERMINATED)
513 session->s_state = SMB_SESSION_STATE_DISCONNECTED;
514 smb_rwx_rwexit(&session->s_lock);
515
516 smb_soshutdown(session->sock);
517
518 DTRACE_PROBE2(session__drop, struct session *, session, int, rc);
519
520 smb_session_cancel(session);
521 /*
522 * At this point everything related to the session should have been
523 * cleaned up and we expect that nothing will attempt to use the
524 * socket.
525 */
526 }
527
528 /*
529 * smb_session_disconnect
530 *
531 * Server-initiated disconnect (i.e. server shutdown)
532 */
533 void
534 smb_session_disconnect(smb_session_t *session)
535 {
536 SMB_SESSION_VALID(session);
537
538 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
539 switch (session->s_state) {
540 case SMB_SESSION_STATE_INITIALIZED:
541 case SMB_SESSION_STATE_CONNECTED:
542 case SMB_SESSION_STATE_ESTABLISHED:
543 case SMB_SESSION_STATE_NEGOTIATED:
544 smb_soshutdown(session->sock);
545 session->s_state = SMB_SESSION_STATE_TERMINATED;
546 break;
547 case SMB_SESSION_STATE_DISCONNECTED:
548 case SMB_SESSION_STATE_TERMINATED:
549 break;
550 }
551 smb_rwx_rwexit(&session->s_lock);
552 }
553
554 /*
555 * Read and process SMB requests.
556 *
557 * Returns:
558 * 0 Success
559 * 1 Unable to read transport header
560 * 2 Invalid transport header type
561 * 3 Invalid SMB length (too small)
562 * 4 Unable to read SMB header
563 * 5 Invalid SMB header (bad magic number)
564 * 6 Unable to read SMB data
565 */
566 static int
597 continue;
598 }
599 return (EPROTO);
600 }
601
602 if (hdr.xh_length == 0) {
603 /* zero length is another form of keep alive */
604 session->keep_alive = smb_keep_alive;
605 continue;
606 }
607
608 if (hdr.xh_length < SMB_HEADER_LEN)
609 return (EPROTO);
610 if (hdr.xh_length > session->cmd_max_bytes)
611 return (EPROTO);
612
613 session->keep_alive = smb_keep_alive;
614
615 /*
616 * Allocate a request context, read the whole message.
617 * If the request alloc fails, we've disconnected
618 * and won't be able to send the reply anyway, so bail now.
619 */
620 if ((sr = smb_request_alloc(session, hdr.xh_length)) == NULL)
621 break;
622
623 req_buf = (uint8_t *)sr->sr_request_buf;
624 resid = hdr.xh_length;
625
626 rc = smb_sorecv(session->sock, req_buf, resid);
627 if (rc) {
628 smb_request_free(sr);
629 break;
630 }
631
632 /* accounting: received bytes */
633 smb_server_add_rxb(sv,
634 (int64_t)(hdr.xh_length + NETBIOS_HDR_SZ));
635
636 /*
637 * Initialize command MBC to represent the received data.
638 */
639 smb_request_init_command_mbuf(sr);
640
641 DTRACE_PROBE1(session__receive__smb, smb_request_t *, sr);
642
643 rc = session->newrq_func(sr);
644 sr = NULL; /* enqueued or freed */
645 if (rc != 0)
646 break;
647
648 /* See notes where this is defined (above). */
649 if (smb_reader_delay) {
650 delay(MSEC_TO_TICK(smb_reader_delay));
651 }
652 }
653 return (rc);
654 }
655
656 /*
657 * This is the initial handler for new smb requests, called from
658 * from smb_session_reader when we have not yet seen any requests.
659 * The first SMB request must be "negotiate", which determines
660 * which protocol and dialect we'll be using. That's the ONLY
661 * request type handled here, because with all later requests,
662 * we know the protocol and handle those with either the SMB1 or
663 * SMB2 handlers: smb1sr_post() or smb2sr_post().
664 * Those do NOT allow SMB negotiate, because that's only allowed
665 * as the first request on new session.
666 *
667 * This and other "post a request" handlers must either enqueue
668 * the new request for the session taskq, or smb_request_free it
669 * (in case we've decided to drop this connection). In this
670 * (special) new request handler, we always free the request.
671 *
672 * Return value is 0 for success, and anything else will
673 * terminate the reader thread (drop the connection).
674 */
675 static int
676 smbsr_newrq_initial(smb_request_t *sr)
677 {
678 uint32_t magic;
679 int rc = EPROTO;
680
681 mutex_enter(&sr->sr_mutex);
682 sr->sr_state = SMB_REQ_STATE_ACTIVE;
683 mutex_exit(&sr->sr_mutex);
684
685 magic = SMB_READ_PROTOCOL(sr->sr_request_buf);
686 if (magic == SMB_PROTOCOL_MAGIC)
687 rc = smb1_newrq_negotiate(sr);
688 if (magic == SMB2_PROTOCOL_MAGIC)
689 rc = smb2_newrq_negotiate(sr);
690
691 mutex_enter(&sr->sr_mutex);
692 sr->sr_state = SMB_REQ_STATE_COMPLETED;
693 mutex_exit(&sr->sr_mutex);
708 struct sockaddr_in6 sin6;
709 smb_session_t *session;
710 int64_t now;
711 uint16_t rport;
712
713 session = kmem_cache_alloc(smb_cache_session, KM_SLEEP);
714 bzero(session, sizeof (smb_session_t));
715
716 if (smb_idpool_constructor(&session->s_uid_pool)) {
717 kmem_cache_free(smb_cache_session, session);
718 return (NULL);
719 }
720 if (smb_idpool_constructor(&session->s_tid_pool)) {
721 smb_idpool_destructor(&session->s_uid_pool);
722 kmem_cache_free(smb_cache_session, session);
723 return (NULL);
724 }
725
726 now = ddi_get_lbolt64();
727
728 session->s_server = sv;
729 session->s_kid = SMB_NEW_KID();
730 session->s_state = SMB_SESSION_STATE_INITIALIZED;
731 session->native_os = NATIVE_OS_UNKNOWN;
732 session->opentime = now;
733 session->keep_alive = smb_keep_alive;
734 session->activity_timestamp = now;
735 smb_session_genkey(session);
736
737 mutex_init(&session->s_credits_mutex, NULL, MUTEX_DEFAULT, NULL);
738
739 smb_slist_constructor(&session->s_req_list, sizeof (smb_request_t),
740 offsetof(smb_request_t, sr_session_lnd));
741
742 smb_llist_constructor(&session->s_user_list, sizeof (smb_user_t),
743 offsetof(smb_user_t, u_lnd));
744
745 smb_llist_constructor(&session->s_tree_list, sizeof (smb_tree_t),
746 offsetof(smb_tree_t, t_lnd));
747
748 smb_llist_constructor(&session->s_xa_list, sizeof (smb_xa_t),
749 offsetof(smb_xa_t, xa_lnd));
750
751 smb_net_txl_constructor(&session->s_txlst);
752
753 smb_rwx_init(&session->s_lock);
754
755 session->s_srqueue = &sv->sv_srqueue;
756 smb_server_get_cfg(sv, &session->s_cfg);
757
758 if (new_so == NULL) {
759 /*
760 * This call is creating the special "server" session,
761 * used for kshare export, oplock breaks, CA import.
762 * CA import creates temporary trees on this session
763 * and those should never get map/unmap up-calls, so
764 * force the map/unmap flags zero on this session.
765 * Set a "modern" dialect for CA import too, so
766 * pathname parse doesn't do OS/2 stuff, etc.
767 */
768 session->s_cfg.skc_execflags = 0;
769 session->dialect = session->s_cfg.skc_max_protocol;
770 } else {
771 if (family == AF_INET) {
772 slen = sizeof (sin);
773 (void) ksocket_getsockname(new_so,
774 (struct sockaddr *)&sin, &slen, CRED());
775 bcopy(&sin.sin_addr,
776 &session->local_ipaddr.au_addr.au_ipv4,
777 sizeof (in_addr_t));
778 slen = sizeof (sin);
779 (void) ksocket_getpeername(new_so,
780 (struct sockaddr *)&sin, &slen, CRED());
781 bcopy(&sin.sin_addr,
782 &session->ipaddr.au_addr.au_ipv4,
783 sizeof (in_addr_t));
784 rport = sin.sin_port;
785 } else {
786 slen = sizeof (sin6);
787 (void) ksocket_getsockname(new_so,
788 (struct sockaddr *)&sin6, &slen, CRED());
789 bcopy(&sin6.sin6_addr,
790 &session->local_ipaddr.au_addr.au_ipv6,
792 slen = sizeof (sin6);
793 (void) ksocket_getpeername(new_so,
794 (struct sockaddr *)&sin6, &slen, CRED());
795 bcopy(&sin6.sin6_addr,
796 &session->ipaddr.au_addr.au_ipv6,
797 sizeof (in6_addr_t));
798 rport = sin6.sin6_port;
799 }
800 session->ipaddr.a_family = family;
801 session->local_ipaddr.a_family = family;
802 session->s_local_port = port;
803 session->s_remote_port = ntohs(rport);
804 session->sock = new_so;
805 (void) smb_inet_ntop(&session->ipaddr,
806 session->ip_addr_str, INET6_ADDRSTRLEN);
807 if (port == IPPORT_NETBIOS_SSN)
808 smb_server_inc_nbt_sess(sv);
809 else
810 smb_server_inc_tcp_sess(sv);
811 }
812
813 /*
814 * The initial new request handler is special,
815 * and only accepts negotiation requests.
816 */
817 session->newrq_func = smbsr_newrq_initial;
818
819 /* These may increase in SMB2 negotiate. */
820 session->cmd_max_bytes = SMB_REQ_MAX_SIZE;
821 session->reply_max_bytes = SMB_REQ_MAX_SIZE;
822
823 session_stats_init(sv, session);
824
825 session->s_magic = SMB_SESSION_MAGIC;
826
827 return (session);
828 }
829
830 void
831 session_stats_init(smb_server_t *sv, smb_session_t *ss)
832 {
833 static const char *kr_names[] = SMBSRV_CLSH__NAMES;
834 char ks_name[KSTAT_STRLEN];
835 char *ipaddr_str = ss->ip_addr_str;
836 smbsrv_clsh_kstats_t *ksr;
837 int idx;
838
839 /* Don't include the special internal session (sv->sv_session). */
840 if (ss->sock == NULL)
841 return;
842
843 /*
844 * If ipv6_enable is set to true, IPv4 addresses will be prefixed
845 * with ::ffff: (IPv4-mapped IPv6 address), strip it.
846 */
847 if (strncasecmp(ipaddr_str, "::ffff:", 7) == 0)
848 ipaddr_str += 7;
849
850 /*
851 * Create raw kstats for sessions with a name composed as:
852 * cl/$IPADDR and instance ss->s_kid
853 * These will look like: smbsrv:0:cl/10.10.0.5
854 */
855 (void) snprintf(ks_name, sizeof (ks_name), "cl/%s", ipaddr_str);
856
857 ss->s_ksp = kstat_create_zone(SMBSRV_KSTAT_MODULE, ss->s_kid,
858 ks_name, SMBSRV_KSTAT_CLASS, KSTAT_TYPE_RAW,
859 sizeof (smbsrv_clsh_kstats_t), 0, sv->sv_zid);
860
861 if (ss->s_ksp == NULL)
862 return;
863
864 ss->s_ksp->ks_update = smb_session_kstat_update;
865 ss->s_ksp->ks_private = ss;
866
867 /*
868 * In-line equivalent of smb_dispatch_stats_init
869 */
870 ksr = (smbsrv_clsh_kstats_t *)ss->s_ksp->ks_data;
871 for (idx = 0; idx < SMBSRV_CLSH__NREQ; idx++) {
872 smb_latency_init(&ss->s_stats[idx].sdt_lat);
873 (void) strlcpy(ksr->ks_clsh[idx].kr_name, kr_names[idx],
874 KSTAT_STRLEN);
875 }
876
877 kstat_install(ss->s_ksp);
878 }
879
880 void
881 session_stats_fini(smb_session_t *ss)
882 {
883 int idx;
884
885 for (idx = 0; idx < SMBSRV_CLSH__NREQ; idx++)
886 smb_latency_destroy(&ss->s_stats[idx].sdt_lat);
887 }
888
889 /*
890 * Update the kstat data from our private stats.
891 */
892 static int
893 smb_session_kstat_update(kstat_t *ksp, int rw)
894 {
895 smb_session_t *session;
896 smb_disp_stats_t *sds;
897 smbsrv_clsh_kstats_t *clsh;
898 smb_kstat_req_t *ksr;
899 int i;
900
901 if (rw == KSTAT_WRITE)
902 return (EACCES);
903
904 session = ksp->ks_private;
905 SMB_SESSION_VALID(session);
906 sds = session->s_stats;
907
908 clsh = (smbsrv_clsh_kstats_t *)ksp->ks_data;
909 ksr = clsh->ks_clsh;
910
911 for (i = 0; i < SMBSRV_CLSH__NREQ; i++, ksr++, sds++) {
912 ksr->kr_rxb = sds->sdt_rxb;
913 ksr->kr_txb = sds->sdt_txb;
914 mutex_enter(&sds->sdt_lat.ly_mutex);
915 ksr->kr_nreq = sds->sdt_lat.ly_a_nreq;
916 ksr->kr_sum = sds->sdt_lat.ly_a_sum;
917 ksr->kr_a_mean = sds->sdt_lat.ly_a_mean;
918 ksr->kr_a_stddev = sds->sdt_lat.ly_a_stddev;
919 ksr->kr_d_mean = sds->sdt_lat.ly_d_mean;
920 ksr->kr_d_stddev = sds->sdt_lat.ly_d_stddev;
921 sds->sdt_lat.ly_d_mean = 0;
922 sds->sdt_lat.ly_d_nreq = 0;
923 sds->sdt_lat.ly_d_stddev = 0;
924 sds->sdt_lat.ly_d_sum = 0;
925 mutex_exit(&sds->sdt_lat.ly_mutex);
926 }
927
928 return (0);
929 }
930
931 void
932 smb_session_delete(smb_session_t *session)
933 {
934
935 ASSERT(session->s_magic == SMB_SESSION_MAGIC);
936
937 if (session->s_ksp != NULL) {
938 kstat_delete(session->s_ksp);
939 session->s_ksp = NULL;
940 session_stats_fini(session);
941 }
942
943 if (session->enc_mech != NULL)
944 smb3_encrypt_fini(session);
945
946 if (session->sign_fini != NULL)
947 session->sign_fini(session);
948
949 if (session->signing.mackey != NULL) {
950 kmem_free(session->signing.mackey,
951 session->signing.mackey_len);
952 }
953
954 session->s_magic = 0;
955
956 smb_rwx_destroy(&session->s_lock);
957 smb_net_txl_destructor(&session->s_txlst);
958
959 mutex_destroy(&session->s_credits_mutex);
960
961 smb_slist_destructor(&session->s_req_list);
962 smb_llist_destructor(&session->s_tree_list);
963 smb_llist_destructor(&session->s_user_list);
964 smb_llist_destructor(&session->s_xa_list);
965
977 smb_sodestroy(session->sock);
978 }
979 kmem_cache_free(smb_cache_session, session);
980 }
981
982 static void
983 smb_session_cancel(smb_session_t *session)
984 {
985 smb_xa_t *xa, *nextxa;
986
987 /* All the request currently being treated must be canceled. */
988 smb_session_cancel_requests(session, NULL, NULL);
989
990 /*
991 * We wait for the completion of all the requests associated with
992 * this session.
993 */
994 smb_slist_wait_for_empty(&session->s_req_list);
995
996 /*
997 * Cleanup transact state objects
998 */
999 xa = smb_llist_head(&session->s_xa_list);
1000 while (xa) {
1001 nextxa = smb_llist_next(&session->s_xa_list, xa);
1002 smb_xa_close(xa);
1003 xa = nextxa;
1004 }
1005
1006 /*
1007 * At this point the reference count of the files and directories
1008 * should be zero. It should be possible to destroy them without
1009 * any problem, which should trigger the destruction of other objects.
1010 */
1011 smb_session_logoff(session);
1012 }
1013
1014 /*
1015 * Cancel requests. If a non-null tree is specified, only requests specific
1016 * to that tree will be cancelled. If a non-null sr is specified, that sr
1017 * will be not be cancelled - this would typically be the caller's sr.
1018 */
1019 void
1020 smb_session_cancel_requests(
1021 smb_session_t *session,
1022 smb_tree_t *tree,
1023 smb_request_t *exclude_sr)
1024 {
1025 smb_request_t *sr;
1026
1027 smb_slist_enter(&session->s_req_list);
1028 sr = smb_slist_head(&session->s_req_list);
1029
1030 while (sr) {
1031 ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
1032 if ((sr != exclude_sr) &&
1033 (tree == NULL || sr->tid_tree == tree))
1034 smb_request_cancel(sr);
1035
1036 sr = smb_slist_next(&session->s_req_list, sr);
1037 }
1038
1039 smb_slist_exit(&session->s_req_list);
1040 }
1041
1042 /*
1043 * Find a user on the specified session by SMB UID.
1044 */
1045 smb_user_t *
1046 smb_session_lookup_uid(smb_session_t *session, uint16_t uid)
1047 {
1048 return (smb_session_lookup_uid_st(session, 0, uid,
1049 SMB_USER_STATE_LOGGED_ON));
1050 }
1051
1052 /*
1053 * Find a user on the specified session by SMB2 SSNID.
1054 */
1055 smb_user_t *
1056 smb_session_lookup_ssnid(smb_session_t *session, uint64_t ssnid)
1057 {
1058 return (smb_session_lookup_uid_st(session, ssnid, 0,
1059 SMB_USER_STATE_LOGGED_ON));
1060 }
1061
1062 smb_user_t *
1063 smb_session_lookup_uid_st(smb_session_t *session, uint64_t ssnid,
1064 uint16_t uid, smb_user_state_t st)
1065 {
1066 smb_user_t *user;
1067 smb_llist_t *user_list;
1068
1069 SMB_SESSION_VALID(session);
1070
1071 user_list = &session->s_user_list;
1072 smb_llist_enter(user_list, RW_READER);
1073
1074 for (user = smb_llist_head(user_list);
1075 user != NULL;
1076 user = smb_llist_next(user_list, user)) {
1077
1078 SMB_USER_VALID(user);
1079 ASSERT(user->u_session == session);
1080
1081 if (user->u_ssnid != ssnid && user->u_uid != uid)
1082 continue;
1083
1084 mutex_enter(&user->u_mutex);
1085 if (user->u_state == st) {
1086 // smb_user_hold_internal(user);
1087 user->u_refcnt++;
1088 mutex_exit(&user->u_mutex);
1089 break;
1090 }
1091 mutex_exit(&user->u_mutex);
1092 }
1093
1094 smb_llist_exit(user_list);
1095 return (user);
1096 }
1097
1098 /*
1099 * Find a tree by tree-id.
1100 */
1101 smb_tree_t *
1102 smb_session_lookup_tree(
1103 smb_session_t *session,
1104 uint16_t tid)
1105 {
1106 smb_tree_t *tree;
1107
1108 SMB_SESSION_VALID(session);
1109
1110 smb_llist_enter(&session->s_tree_list, RW_READER);
1111 tree = smb_llist_head(&session->s_tree_list);
1112
1113 while (tree) {
1114 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1115 ASSERT(tree->t_session == session);
1116
1117 if (tree->t_tid == tid) {
1118 if (smb_tree_hold(tree)) {
1119 smb_llist_exit(&session->s_tree_list);
1120 return (tree);
1121 } else {
1122 smb_llist_exit(&session->s_tree_list);
1123 return (NULL);
1124 }
1125 }
1126
1127 tree = smb_llist_next(&session->s_tree_list, tree);
1128 }
1129
1130 smb_llist_exit(&session->s_tree_list);
1131 return (NULL);
1132 }
1133
1134 /*
1135 * Disconnect all trees that match the specified client process-id.
1136 * Used by the SMB1 "process exit" request.
1137 */
1138 void
1139 smb_session_close_pid(
1140 smb_session_t *session,
1141 uint32_t pid)
1142 {
1143 smb_llist_t *tree_list = &session->s_tree_list;
1144 smb_tree_t *tree;
1145
1146 smb_llist_enter(tree_list, RW_READER);
1147
1148 tree = smb_llist_head(tree_list);
1149 while (tree) {
1150 if (smb_tree_hold(tree)) {
1151 smb_tree_close_pid(tree, pid);
1152 smb_tree_release(tree);
1153 }
1154 tree = smb_llist_next(tree_list, tree);
1155 }
1156
1157 smb_llist_exit(tree_list);
1158 }
1159
1160 static void
1161 smb_session_tree_dtor(void *arg)
1162 {
1163 smb_tree_t *tree = arg;
1164
1165 smb_tree_disconnect(tree, B_TRUE);
1166 /* release the ref acquired during the traversal loop */
1167 smb_tree_release(tree);
1168 }
1169
1170
1171 /*
1172 * Disconnect all trees that this user has connected.
1173 */
1174 void
1175 smb_session_disconnect_owned_trees(
1176 smb_session_t *session,
1177 smb_user_t *owner)
1178 {
1179 smb_tree_t *tree;
1180 smb_llist_t *tree_list = &session->s_tree_list;
1181
1182 SMB_SESSION_VALID(session);
1183 SMB_USER_VALID(owner);
1184
1185 smb_llist_enter(tree_list, RW_READER);
1186
1187 tree = smb_llist_head(tree_list);
1188 while (tree) {
1189 if ((tree->t_owner == owner) &&
1190 smb_tree_hold(tree)) {
1191 /*
1192 * smb_tree_hold() succeeded, hence we are in state
1193 * SMB_TREE_STATE_CONNECTED; schedule this tree
1194 * for disconnect after smb_llist_exit because
1195 * the "unmap exec" up-call can block, and we'd
1196 * rather not block with the tree list locked.
1197 */
1198 smb_llist_post(tree_list, tree, smb_session_tree_dtor);
1199 }
1200 tree = smb_llist_next(tree_list, tree);
1201 }
1202
1203 /* drop the lock and flush the dtor queue */
1204 smb_llist_exit(tree_list);
1205 }
1206
1207 /*
1208 * Disconnect all trees that this user has connected.
1209 */
1210 static void
1211 smb_session_disconnect_trees(
1212 smb_session_t *session)
1213 {
1214 smb_llist_t *tree_list = &session->s_tree_list;
1215 smb_tree_t *tree;
1216
1217 smb_llist_enter(tree_list, RW_READER);
1218
1219 tree = smb_llist_head(tree_list);
1220 while (tree) {
1221 if (smb_tree_hold(tree)) {
1222 smb_llist_post(tree_list, tree,
1223 smb_session_tree_dtor);
1224 }
1225 tree = smb_llist_next(tree_list, tree);
1226 }
1227
1228 /* drop the lock and flush the dtor queue */
1229 smb_llist_exit(tree_list);
1230 }
1231
1232 /*
1233 * Variant of smb_session_tree_dtor that also
1234 * cancels requests using this tree.
1235 */
1236 static void
1237 smb_session_tree_kill(void *arg)
1238 {
1239 smb_tree_t *tree = arg;
1240
1241 SMB_TREE_VALID(tree);
1242
1243 smb_tree_disconnect(tree, B_TRUE);
1244 smb_session_cancel_requests(tree->t_session, tree, NULL);
1245
1246 /* release the ref acquired during the traversal loop */
1247 smb_tree_release(tree);
1248 }
1249
1250 /*
1251 * Disconnect all trees that match the specified share name,
1252 * and kill requests using those trees.
1253 */
1254 void
1255 smb_session_disconnect_share(
1256 smb_session_t *session,
1257 const char *sharename)
1258 {
1259 smb_llist_t *ll;
1260 smb_tree_t *tree;
1261
1262 SMB_SESSION_VALID(session);
1263
1264 ll = &session->s_tree_list;
1265 smb_llist_enter(ll, RW_READER);
1266
1267 for (tree = smb_llist_head(ll);
1268 tree != NULL;
1269 tree = smb_llist_next(ll, tree)) {
1270
1271 SMB_TREE_VALID(tree);
1272 ASSERT(tree->t_session == session);
1273
1274 if (smb_strcasecmp(tree->t_sharename, sharename, 0) != 0)
1275 continue;
1276
1277 if (smb_tree_hold(tree)) {
1278 smb_llist_post(ll, tree,
1279 smb_session_tree_kill);
1280 }
1281 }
1282
1283 smb_llist_exit(ll);
1284 }
1285
1286 /*
1287 * Logoff all users associated with the specified session.
1288 *
1289 * This is called for both server-initiated disconnect
1290 * (SMB_SESSION_STATE_TERMINATED) and client-initiated
1291 * disconnect (SMB_SESSION_STATE_DISCONNECTED).
1292 * If client-initiated, save durable handles.
1293 */
1294 void
1295 smb_session_logoff(smb_session_t *session)
1296 {
1297 smb_llist_t *ulist;
1298 smb_user_t *user;
1299
1300 SMB_SESSION_VALID(session);
1301
1302 top:
1303 ulist = &session->s_user_list;
1304 smb_llist_enter(ulist, RW_READER);
1305
1306 user = smb_llist_head(ulist);
1307 while (user) {
1308 SMB_USER_VALID(user);
1309 ASSERT(user->u_session == session);
1310
1311 mutex_enter(&user->u_mutex);
1312 switch (user->u_state) {
1313 case SMB_USER_STATE_LOGGING_ON:
1314 case SMB_USER_STATE_LOGGED_ON:
1315 // smb_user_hold_internal(user);
1316 user->u_refcnt++;
1317 mutex_exit(&user->u_mutex);
1318 smb_user_logoff(user);
1319 smb_user_release(user);
1320 break;
1321
1322 case SMB_USER_STATE_LOGGED_OFF:
1323 case SMB_USER_STATE_LOGGING_OFF:
1324 mutex_exit(&user->u_mutex);
1325 break;
1326
1327 default:
1328 mutex_exit(&user->u_mutex);
1329 ASSERT(0);
1330 break;
1331 }
1332
1333 user = smb_llist_next(ulist, user);
1334 }
1335
1336 /* Needed below (Was the list empty?) */
1337 user = smb_llist_head(ulist);
1338
1339 smb_llist_exit(ulist);
1340
1341 /*
1342 * It's possible for user objects to remain due to references
1343 * obtained via smb_server_lookup_ssnid(), when an SMB2
1344 * session setup is destroying a previous session.
1345 *
1346 * Wait for user objects to clear out (last refs. go away,
1347 * then smb_user_delete takes them out of the list). When
1348 * the last user object is removed, the session state is
1349 * set to SHUTDOWN and s_lock is signaled.
1350 *
1351 * Not all places that call smb_user_release necessarily
1352 * flush the delete queue, so after we wait for the list
1353 * to empty out, go back to the top and recheck the list
1354 * delete queue to make sure smb_user_delete happens.
1355 */
1356 if (user == NULL) {
1357 /* User list is empty. */
1358 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
1359 session->s_state = SMB_SESSION_STATE_SHUTDOWN;
1360 smb_rwx_rwexit(&session->s_lock);
1361 } else {
1362 smb_rwx_rwenter(&session->s_lock, RW_READER);
1363 if (session->s_state != SMB_SESSION_STATE_SHUTDOWN) {
1364 (void) smb_rwx_cvwait(&session->s_lock,
1365 MSEC_TO_TICK(200));
1366 smb_rwx_rwexit(&session->s_lock);
1367 goto top;
1368 }
1369 smb_rwx_rwexit(&session->s_lock);
1370 }
1371 ASSERT(session->s_state == SMB_SESSION_STATE_SHUTDOWN);
1372
1373 /*
1374 * User list should be empty now.
1375 */
1376 #ifdef DEBUG
1377 if (ulist->ll_count != 0) {
1378 cmn_err(CE_WARN, "user list not empty?");
1379 debug_enter("s_user_list");
1380 }
1381 #endif
1382
1383 /*
1384 * User logoff happens first so we'll set preserve_opens
1385 * for client-initiated disconnect. When that's done
1386 * there should be no trees left, but check anyway.
1387 */
1388 smb_session_disconnect_trees(session);
1389 }
1390
1391 /*
1392 * Copy the session workstation/client name to buf. If the workstation
1393 * is an empty string (which it will be on TCP connections), use the
1394 * client IP address.
1395 */
1396 void
1397 smb_session_getclient(smb_session_t *sn, char *buf, size_t buflen)
1398 {
1399
1400 *buf = '\0';
1401
1402 if (sn->workstation[0] != '\0') {
1403 (void) strlcpy(buf, sn->workstation, buflen);
1404 return;
1405 }
1406
1407 (void) strlcpy(buf, sn->ip_addr_str, buflen);
1408 }
1421 smb_session_isclient(smb_session_t *sn, const char *client)
1422 {
1423
1424 client += strspn(client, "\\");
1425
1426 if (smb_strcasecmp(client, sn->workstation, 0) == 0)
1427 return (B_TRUE);
1428
1429 if (smb_strcasecmp(client, sn->ip_addr_str, 0) == 0)
1430 return (B_TRUE);
1431
1432 return (B_FALSE);
1433 }
1434
1435 /*
1436 * smb_request_alloc
1437 *
1438 * Allocate an smb_request_t structure from the kmem_cache. Partially
1439 * initialize the found/new request.
1440 *
1441 * Returns pointer to a request, or NULL if the session state is
1442 * one in which new requests are no longer allowed.
1443 */
1444 smb_request_t *
1445 smb_request_alloc(smb_session_t *session, int req_length)
1446 {
1447 smb_request_t *sr;
1448
1449 ASSERT(session->s_magic == SMB_SESSION_MAGIC);
1450 ASSERT(req_length <= session->cmd_max_bytes);
1451
1452 sr = kmem_cache_alloc(smb_cache_request, KM_SLEEP);
1453
1454 /*
1455 * Future: Use constructor to pre-initialize some fields. For now
1456 * there are so many fields that it is easiest just to zero the
1457 * whole thing and start over.
1458 */
1459 bzero(sr, sizeof (smb_request_t));
1460
1461 mutex_init(&sr->sr_mutex, NULL, MUTEX_DEFAULT, NULL);
1462 smb_srm_init(sr);
1463 sr->session = session;
1464 sr->sr_server = session->s_server;
1465 sr->sr_gmtoff = session->s_server->si_gmtoff;
1466 sr->sr_cfg = &session->s_cfg;
1467 sr->command.max_bytes = req_length;
1468 sr->reply.max_bytes = session->reply_max_bytes;
1469 sr->sr_req_length = req_length;
1470 if (req_length)
1471 sr->sr_request_buf = kmem_alloc(req_length, KM_SLEEP);
1472 sr->sr_magic = SMB_REQ_MAGIC;
1473 sr->sr_state = SMB_REQ_STATE_INITIALIZING;
1474
1475 /*
1476 * Only allow new SMB requests in some states.
1477 */
1478 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
1479 switch (session->s_state) {
1480 case SMB_SESSION_STATE_CONNECTED:
1481 case SMB_SESSION_STATE_INITIALIZED:
1482 case SMB_SESSION_STATE_ESTABLISHED:
1483 case SMB_SESSION_STATE_NEGOTIATED:
1484 smb_slist_insert_tail(&session->s_req_list, sr);
1485 break;
1486
1487 default:
1488 ASSERT(0);
1489 /* FALLTHROUGH */
1490 case SMB_SESSION_STATE_DISCONNECTED:
1491 case SMB_SESSION_STATE_SHUTDOWN:
1492 case SMB_SESSION_STATE_TERMINATED:
1493 /* Disallow new requests in these states. */
1494 if (sr->sr_request_buf)
1495 kmem_free(sr->sr_request_buf, sr->sr_req_length);
1496 sr->session = NULL;
1497 sr->sr_magic = 0;
1498 mutex_destroy(&sr->sr_mutex);
1499 kmem_cache_free(smb_cache_request, sr);
1500 sr = NULL;
1501 break;
1502 }
1503 smb_rwx_rwexit(&session->s_lock);
1504
1505 return (sr);
1506 }
1507
1508 /*
1509 * smb_request_free
1510 *
1511 * release the memories which have been allocated for a smb request.
1512 */
1513 void
1514 smb_request_free(smb_request_t *sr)
1515 {
1516 ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
1517 ASSERT(sr->session);
1518 ASSERT(sr->r_xa == NULL);
1519
1520 if (sr->fid_ofile != NULL) {
1521 smb_ofile_release(sr->fid_ofile);
1522 }
1523
1524 if (sr->tid_tree != NULL)
1525 smb_tree_release(sr->tid_tree);
1526
1527 if (sr->uid_user != NULL)
1528 smb_user_release(sr->uid_user);
1529
1530 if (sr->tform_ssn != NULL)
1531 smb_user_release(sr->tform_ssn);
1532
1533 /*
1534 * The above may have left work on the delete queues
1535 */
1536 smb_llist_flush(&sr->session->s_tree_list);
1537 smb_llist_flush(&sr->session->s_user_list);
1538
1539 smb_slist_remove(&sr->session->s_req_list, sr);
1540
1541 sr->session = NULL;
1542
1543 smb_srm_fini(sr);
1544
1545 if (sr->sr_request_buf)
1546 kmem_free(sr->sr_request_buf, sr->sr_req_length);
1547 if (sr->command.chain)
1548 m_freem(sr->command.chain);
1549 if (sr->reply.chain)
1550 m_freem(sr->reply.chain);
1551 if (sr->raw_data.chain)
1552 m_freem(sr->raw_data.chain);
1553
1554 sr->sr_magic = 0;
1555 mutex_destroy(&sr->sr_mutex);
1556 kmem_cache_free(smb_cache_request, sr);
1557 }
1558
1559 boolean_t
1560 smb_session_oplocks_enable(smb_session_t *session)
1561 {
1562 SMB_SESSION_VALID(session);
1563 if (session->s_cfg.skc_oplock_enable == 0)
1564 return (B_FALSE);
1565 else
1566 return (B_TRUE);
1567 }
1568
1569 boolean_t
1570 smb_session_levelII_oplocks(smb_session_t *session)
1571 {
1572 SMB_SESSION_VALID(session);
1573
1574 /* Older clients only do Level II oplocks if negotiated. */
1575 if ((session->capabilities & CAP_LEVEL_II_OPLOCKS) != 0)
1576 return (B_TRUE);
1577
1578 return (B_FALSE);
1579 }
1580
1581 static void
1582 smb_session_genkey(smb_session_t *session)
1583 {
1584 uint8_t tmp_key[SMB_CHALLENGE_SZ];
1585
1586 (void) random_get_pseudo_bytes(tmp_key, SMB_CHALLENGE_SZ);
1587 bcopy(tmp_key, &session->challenge_key, SMB_CHALLENGE_SZ);
1588 session->challenge_len = SMB_CHALLENGE_SZ;
1589
1590 (void) random_get_pseudo_bytes(tmp_key, 4);
1591 session->sesskey = tmp_key[0] | tmp_key[1] << 8 |
1592 tmp_key[2] << 16 | tmp_key[3] << 24;
1593 }
|