1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright 2011-2021 Tintri by DDN, Inc. All rights reserved.
24  * Copyright 2021-2023 RackTop Systems, Inc.
25  */
26 
27 #include <sys/atomic.h>
28 #include <sys/synch.h>
29 #include <sys/types.h>
30 #include <sys/sdt.h>
31 #include <sys/random.h>
32 #include <smbsrv/netbios.h>
33 #include <smbsrv/smb2_kproto.h>
34 #include <smbsrv/string.h>
35 #include <netinet/tcp.h>
36 
37 #define	SMB_NEW_KID()	atomic_inc_64_nv(&smb_kids)
38 
39 static volatile uint64_t smb_kids;
40 
41 /*
42  * We track the keepalive in minutes, but this constant
43  * specifies it in seconds, so convert to minutes.
44  */
45 uint32_t smb_keep_alive = SMB_PI_KEEP_ALIVE_MIN / 60;
46 
47 /*
48  * This is the maximum time we'll allow a "session" to exist with no
49  * authenticated smb_user_t objects on it.  This allows a client to
50  * logoff their "one and only" user session and then logon as some
51  * different user.  (There are some tests that do that.)  The same
52  * timeout mechanism also reduces the impact of clients that might
53  * open TCP connections but never authenticate.
54  */
55 int smb_session_auth_tmo = 30; /* sec. */
56 
57 /*
58  * There are many smbtorture test cases that send
59  * racing requests, and where the tests fail if we
60  * don't execute them in exactly the order sent.
61  * These are test bugs.  The protocol makes no
62  * guarantees about execution order of requests
63  * that are concurrently active.
64  *
65  * Nonetheless, smbtorture has many useful tests,
66  * so we have this work-around we can enable to
67  * basically force sequential execution.  When
68  * enabled, insert a delay after each request is
69  * issued a taskq job.  Enable this with mdb by
70  * setting smb_reader_delay to 10.  Don't make it
71  * more than 500 or so or the server will appear
72  * to be so slow that tests may time out.
73  */
74 int smb_reader_delay = 0;  /* mSec. */
75 
76 static int  smbsr_newrq_initial(smb_request_t *);
77 
78 static void smb_session_cancel(smb_session_t *);
79 static int smb_session_reader(smb_session_t *);
80 static int smb_session_xprt_puthdr(smb_session_t *,
81     uint8_t msg_type, uint32_t msg_len,
82     uint8_t *dst, size_t dstlen);
83 static void smb_session_disconnect_trees(smb_session_t	*);
84 static void smb_session_genkey(smb_session_t *);
85 
86 /*
87  * This (legacy) code is in support of an "idle timeout" feature,
88  * which is apparently incomplete.  To complete it, we should:
89  * when the keep_alive timer expires, check whether the client
90  * has any open files, and if not then kill their session.
91  * Right now the timers are there, but nothing happens when
92  * a timer expires.
93  *
94  * Todo: complete logic to kill idle sessions.
95  *
96  * Only called when sv_cfg.skc_keepalive != 0
97  */
98 void
smb_session_timers(smb_server_t * sv)99 smb_session_timers(smb_server_t *sv)
100 {
101 	smb_session_t	*session;
102 	smb_llist_t	*ll;
103 
104 	ll = &sv->sv_session_list;
105 	smb_llist_enter(ll, RW_READER);
106 	session = smb_llist_head(ll);
107 	while (session != NULL) {
108 		/*
109 		 * Walk through the table and decrement each keep_alive
110 		 * timer that has not timed out yet. (keepalive > 0)
111 		 */
112 		SMB_SESSION_VALID(session);
113 		if (session->keep_alive &&
114 		    (session->keep_alive != (uint32_t)-1))
115 			session->keep_alive--;
116 
117 		session = smb_llist_next(ll, session);
118 	}
119 	smb_llist_exit(ll);
120 }
121 
122 /*
123  * Send a session message - supports SMB-over-NBT and SMB-over-TCP.
124  * If an mbuf chain is provided (optional), it will be freed and
125  * set to NULL -- unconditionally!  (error or not)
126  *
127  * Prepends the 4-byte NBT header before sending.
128  */
129 int
smb_session_send(smb_session_t * session,uint8_t nbt_type,mbuf_chain_t * mbc)130 smb_session_send(smb_session_t *session, uint8_t nbt_type, mbuf_chain_t *mbc)
131 {
132 	mbuf_t		*m = NULL;
133 	uint32_t	nbt_len;
134 	int		rc;
135 
136 	switch (session->s_state) {
137 	case SMB_SESSION_STATE_DISCONNECTED:
138 	case SMB_SESSION_STATE_TERMINATED:
139 		rc = ENOTCONN;
140 		goto out;
141 	default:
142 		break;
143 	}
144 
145 	/*
146 	 * Prepend the NBT header (NetBIOS or SMB/TCP)
147 	 * and fill it in.
148 	 *
149 	 * After this, we "own" the mbuf chain (m) and must
150 	 * either consume it (via send) or free it.
151 	 */
152 	if (mbc != NULL && (m = mbc->chain) != NULL) {
153 		nbt_len = MBC_LENGTH(mbc);
154 		m = m_prepend(mbc->chain, NETBIOS_HDR_SZ, M_WAIT);
155 		mbc->chain = NULL;
156 	} else {
157 		nbt_len = 0;
158 		MGET(m, M_WAIT, MT_DATA);
159 		m->m_len = NETBIOS_HDR_SZ;
160 	}
161 	ASSERT(m->m_len >= NETBIOS_HDR_SZ);
162 	rc = smb_session_xprt_puthdr(session, nbt_type, nbt_len,
163 	    mtod(m, uint8_t *), NETBIOS_HDR_SZ);
164 	if (rc != 0)
165 		goto out;
166 
167 	/* Send "consumes" m unconditionally */
168 	rc = smb_net_send_mbufs(session, m);
169 	if (rc == 0) {
170 		smb_server_add_txb(session->s_server,
171 		    nbt_len + NETBIOS_HDR_SZ);
172 	}
173 	m = NULL; // consumed
174 
175 out:
176 	if (m != NULL)
177 		m_freem(m);
178 	if (mbc != NULL && mbc->chain != NULL) {
179 		m_freem(mbc->chain);
180 		mbc->chain = NULL;
181 	}
182 
183 	return (rc);
184 }
185 
186 /*
187  * Read, process and respond to a NetBIOS session request.
188  *
189  * A NetBIOS session must be established for SMB-over-NetBIOS.  Validate
190  * the calling and called name format and save the client NetBIOS name,
191  * which is used when a NetBIOS session is established to check for and
192  * cleanup leftover state from a previous session.
193  *
194  * Session requests are not valid for SMB-over-TCP, which is unfortunate
195  * because without the client name leftover state cannot be cleaned up
196  * if the client is behind a NAT server.
197  */
198 static int
smb_netbios_session_request(struct smb_session * session)199 smb_netbios_session_request(struct smb_session *session)
200 {
201 	int			rc;
202 	char			*calling_name;
203 	char			*called_name;
204 	char			client_name[NETBIOS_NAME_SZ];
205 	struct mbuf_chain	mbc;
206 	char			*names = NULL;
207 	smb_wchar_t		*wbuf = NULL;
208 	smb_xprt_t		hdr;
209 	char *p;
210 	int rc1, rc2;
211 
212 	session->keep_alive = smb_keep_alive;
213 
214 	if ((rc = smb_session_xprt_gethdr(session, &hdr)) != 0)
215 		return (rc);
216 
217 	DTRACE_PROBE2(receive__session__req__xprthdr, struct session *, session,
218 	    smb_xprt_t *, &hdr);
219 
220 	if ((hdr.xh_type != SESSION_REQUEST) ||
221 	    (hdr.xh_length != NETBIOS_SESSION_REQUEST_DATA_LENGTH)) {
222 		DTRACE_PROBE1(receive__session__req__failed,
223 		    struct session *, session);
224 		return (EINVAL);
225 	}
226 
227 	names = kmem_alloc(hdr.xh_length, KM_SLEEP);
228 
229 	if ((rc = smb_sorecv(session->sock, names, hdr.xh_length)) != 0) {
230 		kmem_free(names, hdr.xh_length);
231 		DTRACE_PROBE1(receive__session__req__failed,
232 		    struct session *, session);
233 		return (rc);
234 	}
235 
236 	DTRACE_PROBE3(receive__session__req__data, struct session *, session,
237 	    char *, names, uint32_t, hdr.xh_length);
238 
239 	called_name = &names[0];
240 	calling_name = &names[NETBIOS_ENCODED_NAME_SZ + 2];
241 
242 	rc1 = netbios_name_isvalid(called_name, 0);
243 	rc2 = netbios_name_isvalid(calling_name, client_name);
244 
245 	if (rc1 == 0 || rc2 == 0) {
246 
247 		DTRACE_PROBE3(receive__invalid__session__req,
248 		    struct session *, session, char *, names,
249 		    uint32_t, hdr.xh_length);
250 
251 		kmem_free(names, hdr.xh_length);
252 		MBC_INIT(&mbc, MAX_DATAGRAM_LENGTH);
253 		(void) smb_mbc_encodef(&mbc, "b",
254 		    DATAGRAM_INVALID_SOURCE_NAME_FORMAT);
255 		(void) smb_session_send(session, NEGATIVE_SESSION_RESPONSE,
256 		    &mbc);
257 		return (EINVAL);
258 	}
259 
260 	DTRACE_PROBE3(receive__session__req__calling__decoded,
261 	    struct session *, session,
262 	    char *, calling_name, char *, client_name);
263 
264 	/*
265 	 * The client NetBIOS name is in oem codepage format.
266 	 * We need to convert it to unicode and store it in
267 	 * multi-byte format.  We also need to strip off any
268 	 * spaces added as part of the NetBIOS name encoding.
269 	 */
270 	wbuf = kmem_alloc((SMB_PI_MAX_HOST * sizeof (smb_wchar_t)), KM_SLEEP);
271 	(void) oemtoucs(wbuf, client_name, SMB_PI_MAX_HOST, OEM_CPG_850);
272 	(void) smb_wcstombs(session->workstation, wbuf, SMB_PI_MAX_HOST);
273 	kmem_free(wbuf, (SMB_PI_MAX_HOST * sizeof (smb_wchar_t)));
274 
275 	if ((p = strchr(session->workstation, ' ')) != 0)
276 		*p = '\0';
277 
278 	kmem_free(names, hdr.xh_length);
279 	return (smb_session_send(session, POSITIVE_SESSION_RESPONSE, NULL));
280 }
281 
282 /*
283  * Read 4-byte header from the session socket and build an in-memory
284  * session transport header.  See smb_xprt_t definition for header
285  * format information.
286  *
287  * Direct hosted NetBIOS-less SMB (SMB-over-TCP) uses port 445.  The
288  * first byte of the four-byte header must be 0 and the next three
289  * bytes contain the length of the remaining data.
290  */
291 int
smb_session_xprt_gethdr(smb_session_t * session,smb_xprt_t * ret_hdr)292 smb_session_xprt_gethdr(smb_session_t *session, smb_xprt_t *ret_hdr)
293 {
294 	int		rc;
295 	unsigned char	buf[NETBIOS_HDR_SZ];
296 
297 	if ((rc = smb_sorecv(session->sock, buf, NETBIOS_HDR_SZ)) != 0)
298 		return (rc);
299 
300 	switch (session->s_local_port) {
301 	case IPPORT_NETBIOS_SSN:
302 		ret_hdr->xh_type = buf[0];
303 		ret_hdr->xh_length = (((uint32_t)buf[1] & 1) << 16) |
304 		    ((uint32_t)buf[2] << 8) |
305 		    ((uint32_t)buf[3]);
306 		break;
307 
308 	case IPPORT_SMB:
309 		ret_hdr->xh_type = buf[0];
310 
311 		if (ret_hdr->xh_type != 0) {
312 			cmn_err(CE_WARN, "invalid NBT type (%u) from %s",
313 			    ret_hdr->xh_type, session->ip_addr_str);
314 			return (EPROTO);
315 		}
316 
317 		ret_hdr->xh_length = ((uint32_t)buf[1] << 16) |
318 		    ((uint32_t)buf[2] << 8) |
319 		    ((uint32_t)buf[3]);
320 		break;
321 
322 	default:
323 		cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
324 		return (EPROTO);
325 	}
326 
327 	return (0);
328 }
329 
330 /*
331  * Encode a transport session packet header into a 4-byte buffer.
332  */
333 static int
smb_session_xprt_puthdr(smb_session_t * session,uint8_t msg_type,uint32_t msg_length,uint8_t * buf,size_t buflen)334 smb_session_xprt_puthdr(smb_session_t *session,
335     uint8_t msg_type, uint32_t msg_length,
336     uint8_t *buf, size_t buflen)
337 {
338 	if (buf == NULL || buflen < NETBIOS_HDR_SZ) {
339 		return (-1);
340 	}
341 
342 	switch (session->s_local_port) {
343 	case IPPORT_NETBIOS_SSN:
344 		/* Per RFC 1001, 1002: msg. len < 128KB */
345 		if (msg_length >= (1 << 17))
346 			return (-1);
347 		buf[0] = msg_type;
348 		buf[1] = ((msg_length >> 16) & 1);
349 		buf[2] = (msg_length >> 8) & 0xff;
350 		buf[3] = msg_length & 0xff;
351 		break;
352 
353 	case IPPORT_SMB:
354 		/*
355 		 * SMB over TCP is like NetBIOS but the one byte
356 		 * message type is always zero, and the length
357 		 * part is three bytes.  It could actually use
358 		 * longer messages, but this is conservative.
359 		 */
360 		if (msg_length >= (1 << 24))
361 			return (-1);
362 		buf[0] = msg_type;
363 		buf[1] = (msg_length >> 16) & 0xff;
364 		buf[2] = (msg_length >> 8) & 0xff;
365 		buf[3] = msg_length & 0xff;
366 		break;
367 
368 	default:
369 		cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
370 		return (-1);
371 	}
372 
373 	return (0);
374 }
375 
376 static int
smb_request_recv(smb_request_t * sr,uint32_t len)377 smb_request_recv(smb_request_t *sr, uint32_t len)
378 {
379 	mbuf_t *mhead = NULL;
380 	int rc;
381 
382 	rc = smb_net_recv_mbufs(sr->session, &mhead, len);
383 	if (rc != 0)
384 		return (rc);
385 
386 	/*
387 	 * Setup command mbuf chain received.
388 	 */
389 	MBC_ATTACH_MBUF(&sr->command, mhead);
390 	sr->command.max_bytes = len;
391 
392 	return (0);
393 }
394 
395 /*
396  * smb_request_cancel
397  *
398  * Handle a cancel for a request properly depending on the current request
399  * state.
400  */
401 void
smb_request_cancel(smb_request_t * sr)402 smb_request_cancel(smb_request_t *sr)
403 {
404 	void (*cancel_method)(smb_request_t *) = NULL;
405 
406 	mutex_enter(&sr->sr_mutex);
407 	switch (sr->sr_state) {
408 
409 	case SMB_REQ_STATE_INITIALIZING:
410 	case SMB_REQ_STATE_SUBMITTED:
411 	case SMB_REQ_STATE_ACTIVE:
412 	case SMB_REQ_STATE_CLEANED_UP:
413 		sr->sr_state = SMB_REQ_STATE_CANCELLED;
414 		break;
415 
416 	case SMB_REQ_STATE_WAITING_AUTH:
417 	case SMB_REQ_STATE_WAITING_FCN1:
418 	case SMB_REQ_STATE_WAITING_LOCK:
419 	case SMB_REQ_STATE_WAITING_PIPE:
420 	case SMB_REQ_STATE_WAITING_OLBRK:
421 		/*
422 		 * These are states that have a cancel_method.
423 		 * Make the state change now, to ensure that
424 		 * we call cancel_method exactly once.
425 		 *
426 		 * Do the method call with sr_mutex not held.
427 		 * When the cancelled request thread resumes,
428 		 * it should re-take sr_mutex and wait for
429 		 * sr_state != CANCEL_PENDING, ensuring that
430 		 * the cancel method has completed.
431 		 */
432 		sr->sr_state = SMB_REQ_STATE_CANCEL_PENDING;
433 		cancel_method = sr->cancel_method;
434 		VERIFY(cancel_method != NULL);
435 		mutex_exit(&sr->sr_mutex);
436 		cancel_method(sr);
437 		mutex_enter(&sr->sr_mutex);
438 		if (sr->sr_state == SMB_REQ_STATE_CANCEL_PENDING)
439 			sr->sr_state = SMB_REQ_STATE_CANCELLED;
440 		cv_broadcast(&sr->sr_st_cv);
441 		break;
442 
443 	case SMB_REQ_STATE_WAITING_FCN2:
444 	case SMB_REQ_STATE_COMPLETED:
445 	case SMB_REQ_STATE_CANCEL_PENDING:
446 	case SMB_REQ_STATE_CANCELLED:
447 		/*
448 		 * No action required for these states since the request
449 		 * is completing.
450 		 */
451 		break;
452 
453 	case SMB_REQ_STATE_FREE:
454 	default:
455 		SMB_PANIC();
456 	}
457 	mutex_exit(&sr->sr_mutex);
458 }
459 
460 /*
461  * smb_session_receiver
462  *
463  * Receives request from the network and dispatches them to a worker.
464  *
465  * When we receive a disconnect here, it _could_ be due to the server
466  * having initiated disconnect, in which case the session state will be
467  * SMB_SESSION_STATE_TERMINATED and we want to keep that state so later
468  * tear-down logic will know which side initiated.
469  */
470 void
smb_session_receiver(smb_session_t * session)471 smb_session_receiver(smb_session_t *session)
472 {
473 	int	rc = 0;
474 	timeout_id_t tmo = NULL;
475 
476 	SMB_SESSION_VALID(session);
477 
478 	session->s_thread = curthread;
479 
480 	if (session->s_local_port == IPPORT_NETBIOS_SSN) {
481 		rc = smb_netbios_session_request(session);
482 		if (rc != 0) {
483 			smb_rwx_rwenter(&session->s_lock, RW_WRITER);
484 			if (session->s_state != SMB_SESSION_STATE_TERMINATED)
485 				session->s_state =
486 				    SMB_SESSION_STATE_DISCONNECTED;
487 			smb_rwx_rwexit(&session->s_lock);
488 			return;
489 		}
490 	}
491 
492 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
493 	session->s_state = SMB_SESSION_STATE_ESTABLISHED;
494 	session->s_auth_tmo = timeout((tmo_func_t)smb_session_disconnect,
495 	    session, SEC_TO_TICK(smb_session_auth_tmo));
496 	smb_rwx_rwexit(&session->s_lock);
497 
498 	(void) smb_session_reader(session);
499 
500 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
501 	if (session->s_state != SMB_SESSION_STATE_TERMINATED)
502 		session->s_state = SMB_SESSION_STATE_DISCONNECTED;
503 	tmo = session->s_auth_tmo;
504 	session->s_auth_tmo = NULL;
505 	smb_rwx_rwexit(&session->s_lock);
506 
507 	/* Timeout callback takes s_lock. See untimeout(9f) */
508 	if (tmo != NULL)
509 		(void) untimeout(tmo);
510 
511 	smb_soshutdown(session->sock);
512 
513 	DTRACE_PROBE2(session__drop, struct session *, session, int, rc);
514 
515 	smb_session_cancel(session);
516 	/*
517 	 * At this point everything related to the session should have been
518 	 * cleaned up and we expect that nothing will attempt to use the
519 	 * socket.
520 	 */
521 }
522 
523 /*
524  * smb_session_disconnect
525  *
526  * Server-initiated disconnect (i.e. server shutdown)
527  */
528 void
smb_session_disconnect(smb_session_t * session)529 smb_session_disconnect(smb_session_t *session)
530 {
531 	SMB_SESSION_VALID(session);
532 
533 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
534 	switch (session->s_state) {
535 	case SMB_SESSION_STATE_INITIALIZED:
536 	case SMB_SESSION_STATE_CONNECTED:
537 	case SMB_SESSION_STATE_ESTABLISHED:
538 	case SMB_SESSION_STATE_NEGOTIATED:
539 		smb_soshutdown(session->sock);
540 		session->s_state = SMB_SESSION_STATE_TERMINATED;
541 		break;
542 	case SMB_SESSION_STATE_DISCONNECTED:
543 	case SMB_SESSION_STATE_TERMINATED:
544 		break;
545 	}
546 	smb_rwx_rwexit(&session->s_lock);
547 }
548 
549 /*
550  * Read and process SMB requests.
551  *
552  * Returns:
553  *	0	Success
554  *	1	Unable to read transport header
555  *	2	Invalid transport header type
556  *	3	Invalid SMB length (too small)
557  *	4	Unable to read SMB header
558  *	5	Invalid SMB header (bad magic number)
559  *	6	Unable to read SMB data
560  */
561 static int
smb_session_reader(smb_session_t * session)562 smb_session_reader(smb_session_t *session)
563 {
564 	smb_server_t	*sv;
565 	smb_request_t	*sr = NULL;
566 	smb_xprt_t	hdr;
567 	int		rc;
568 
569 	sv = session->s_server;
570 
571 	for (;;) {
572 
573 		rc = smb_session_xprt_gethdr(session, &hdr);
574 		if (rc)
575 			return (rc);
576 
577 		DTRACE_PROBE2(session__receive__xprthdr, session_t *, session,
578 		    smb_xprt_t *, &hdr);
579 
580 		if (hdr.xh_type != SESSION_MESSAGE) {
581 			/*
582 			 * Anything other than SESSION_MESSAGE or
583 			 * SESSION_KEEP_ALIVE is an error.  A SESSION_REQUEST
584 			 * may indicate a new session request but we need to
585 			 * close this session and we can treat it as an error
586 			 * here.
587 			 */
588 			if (hdr.xh_type == SESSION_KEEP_ALIVE) {
589 				session->keep_alive = smb_keep_alive;
590 				continue;
591 			}
592 			return (EPROTO);
593 		}
594 
595 		if (hdr.xh_length == 0) {
596 			/* zero length is another form of keep alive */
597 			session->keep_alive = smb_keep_alive;
598 			continue;
599 		}
600 
601 		if (hdr.xh_length < SMB_HEADER_LEN)
602 			return (EPROTO);
603 		if (hdr.xh_length > session->cmd_max_bytes)
604 			return (EPROTO);
605 
606 		session->keep_alive = smb_keep_alive;
607 
608 		/*
609 		 * Allocate a request context, read the whole message.
610 		 * If the request alloc fails, we've disconnected
611 		 * and won't be able to send the reply anyway, so bail now.
612 		 */
613 		if ((sr = smb_request_alloc(session, hdr.xh_length)) == NULL)
614 			break;
615 		if ((rc = smb_request_recv(sr, hdr.xh_length)) != 0) {
616 			smb_request_free(sr);
617 			break;
618 		}
619 
620 		/* accounting: received bytes */
621 		smb_server_add_rxb(sv,
622 		    (int64_t)(hdr.xh_length + NETBIOS_HDR_SZ));
623 
624 		DTRACE_PROBE1(session__receive__smb, smb_request_t *, sr);
625 
626 		rc = session->newrq_func(sr);
627 		sr = NULL;	/* enqueued or freed */
628 		if (rc != 0)
629 			break;
630 
631 		/* See notes where this is defined (above). */
632 		if (smb_reader_delay) {
633 			delay(MSEC_TO_TICK(smb_reader_delay));
634 		}
635 	}
636 	return (rc);
637 }
638 
639 /*
640  * This is the initial handler for new smb requests, called from
641  * from smb_session_reader when we have not yet seen any requests.
642  * The first SMB request must be "negotiate", which determines
643  * which protocol and dialect we'll be using.  That's the ONLY
644  * request type handled here, because with all later requests,
645  * we know the protocol and handle those with either the SMB1 or
646  * SMB2 handlers:  smb1sr_post() or smb2sr_post().
647  * Those do NOT allow SMB negotiate, because that's only allowed
648  * as the first request on new session.
649  *
650  * This and other "post a request" handlers must either enqueue
651  * the new request for the session taskq, or smb_request_free it
652  * (in case we've decided to drop this connection).  In this
653  * (special) new request handler, we always free the request.
654  *
655  * Return value is 0 for success, and anything else will
656  * terminate the reader thread (drop the connection).
657  */
658 static int
smbsr_newrq_initial(smb_request_t * sr)659 smbsr_newrq_initial(smb_request_t *sr)
660 {
661 	uint32_t magic;
662 	int rc;
663 
664 	mutex_enter(&sr->sr_mutex);
665 	sr->sr_state = SMB_REQ_STATE_ACTIVE;
666 	mutex_exit(&sr->sr_mutex);
667 
668 	if ((rc = smb_mbc_peek(&sr->command, 0, "l", &magic)) != 0)
669 		goto done;
670 
671 	switch (magic) {
672 	case SMB_PROTOCOL_MAGIC:
673 		rc = smb1_newrq_negotiate(sr);
674 		break;
675 	case SMB2_PROTOCOL_MAGIC:
676 		rc = smb2_newrq_negotiate(sr);
677 		break;
678 	default:
679 		rc = EPROTO;
680 	}
681 
682 done:
683 	mutex_enter(&sr->sr_mutex);
684 	sr->sr_state = SMB_REQ_STATE_COMPLETED;
685 	mutex_exit(&sr->sr_mutex);
686 
687 	smb_request_free(sr);
688 	return (rc);
689 }
690 
691 /*
692  * Port will be IPPORT_NETBIOS_SSN or IPPORT_SMB.
693  */
694 smb_session_t *
smb_session_create(ksocket_t new_so,uint16_t port,smb_server_t * sv,int family)695 smb_session_create(ksocket_t new_so, uint16_t port, smb_server_t *sv,
696     int family)
697 {
698 	struct sockaddr_in	sin;
699 	socklen_t		slen;
700 	struct sockaddr_in6	sin6;
701 	smb_session_t		*session;
702 	int64_t			now;
703 	uint16_t		rport;
704 
705 	session = kmem_cache_alloc(smb_cache_session, KM_SLEEP);
706 	bzero(session, sizeof (smb_session_t));
707 
708 	if (smb_idpool_constructor(&session->s_uid_pool)) {
709 		kmem_cache_free(smb_cache_session, session);
710 		return (NULL);
711 	}
712 	if (smb_idpool_constructor(&session->s_tid_pool)) {
713 		smb_idpool_destructor(&session->s_uid_pool);
714 		kmem_cache_free(smb_cache_session, session);
715 		return (NULL);
716 	}
717 
718 	now = ddi_get_lbolt64();
719 
720 	session->s_server = sv;
721 	session->s_kid = SMB_NEW_KID();
722 	session->s_state = SMB_SESSION_STATE_INITIALIZED;
723 	session->native_os = NATIVE_OS_UNKNOWN;
724 	session->opentime = now;
725 	session->keep_alive = smb_keep_alive;
726 	session->activity_timestamp = now;
727 	smb_session_genkey(session);
728 
729 	mutex_init(&session->s_credits_mutex, NULL, MUTEX_DEFAULT, NULL);
730 
731 	smb_slist_constructor(&session->s_req_list, sizeof (smb_request_t),
732 	    offsetof(smb_request_t, sr_session_lnd));
733 
734 	smb_llist_constructor(&session->s_user_list, sizeof (smb_user_t),
735 	    offsetof(smb_user_t, u_lnd));
736 
737 	smb_llist_constructor(&session->s_tree_list, sizeof (smb_tree_t),
738 	    offsetof(smb_tree_t, t_lnd));
739 
740 	smb_llist_constructor(&session->s_xa_list, sizeof (smb_xa_t),
741 	    offsetof(smb_xa_t, xa_lnd));
742 
743 	smb_net_txl_constructor(&session->s_txlst);
744 
745 	smb_rwx_init(&session->s_lock);
746 
747 	session->s_srqueue = &sv->sv_srqueue;
748 	smb_server_get_cfg(sv, &session->s_cfg);
749 
750 	if (new_so == NULL) {
751 		/*
752 		 * This call is creating the special "server" session,
753 		 * used for kshare export, oplock breaks, CA import.
754 		 * CA import creates temporary trees on this session
755 		 * and those should never get map/unmap up-calls, so
756 		 * force the map/unmap flags zero on this session.
757 		 * Set a "modern" dialect for CA import too, so
758 		 * pathname parse doesn't do OS/2 stuff, etc.
759 		 */
760 		session->s_cfg.skc_execflags = 0;
761 		session->dialect = session->s_cfg.skc_max_protocol;
762 	} else {
763 		if (family == AF_INET) {
764 			slen = sizeof (sin);
765 			(void) ksocket_getsockname(new_so,
766 			    (struct sockaddr *)&sin, &slen, CRED());
767 			bcopy(&sin.sin_addr,
768 			    &session->local_ipaddr.au_addr.au_ipv4,
769 			    sizeof (in_addr_t));
770 			slen = sizeof (sin);
771 			(void) ksocket_getpeername(new_so,
772 			    (struct sockaddr *)&sin, &slen, CRED());
773 			bcopy(&sin.sin_addr,
774 			    &session->ipaddr.au_addr.au_ipv4,
775 			    sizeof (in_addr_t));
776 			rport = sin.sin_port;
777 		} else {
778 			slen = sizeof (sin6);
779 			(void) ksocket_getsockname(new_so,
780 			    (struct sockaddr *)&sin6, &slen, CRED());
781 			bcopy(&sin6.sin6_addr,
782 			    &session->local_ipaddr.au_addr.au_ipv6,
783 			    sizeof (in6_addr_t));
784 			slen = sizeof (sin6);
785 			(void) ksocket_getpeername(new_so,
786 			    (struct sockaddr *)&sin6, &slen, CRED());
787 			bcopy(&sin6.sin6_addr,
788 			    &session->ipaddr.au_addr.au_ipv6,
789 			    sizeof (in6_addr_t));
790 			rport = sin6.sin6_port;
791 		}
792 		session->ipaddr.a_family = family;
793 		session->local_ipaddr.a_family = family;
794 		session->s_local_port = port;
795 		session->s_remote_port = ntohs(rport);
796 		session->sock = new_so;
797 		(void) smb_inet_ntop(&session->ipaddr,
798 		    session->ip_addr_str, INET6_ADDRSTRLEN);
799 		if (port == IPPORT_NETBIOS_SSN)
800 			smb_server_inc_nbt_sess(sv);
801 		else
802 			smb_server_inc_tcp_sess(sv);
803 	}
804 
805 	/*
806 	 * The initial new request handler is special,
807 	 * and only accepts negotiation requests.
808 	 */
809 	session->newrq_func = smbsr_newrq_initial;
810 
811 	/* These may increase in SMB2 negotiate. */
812 	session->cmd_max_bytes = SMB_REQ_MAX_SIZE;
813 	session->reply_max_bytes = SMB_REQ_MAX_SIZE;
814 
815 	session->s_magic = SMB_SESSION_MAGIC;
816 	return (session);
817 }
818 
819 void
smb_session_delete(smb_session_t * session)820 smb_session_delete(smb_session_t *session)
821 {
822 
823 	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
824 
825 	if (session->enc_mech != NULL)
826 		smb3_encrypt_ssn_fini(session);
827 
828 	if (session->sign_fini != NULL)
829 		session->sign_fini(session);
830 
831 	if (session->signing.mackey != NULL) {
832 		kmem_free(session->signing.mackey,
833 		    session->signing.mackey_len);
834 	}
835 
836 	if (session->preauth_mech != NULL)
837 		smb31_preauth_fini(session);
838 
839 	session->s_magic = 0;
840 
841 	smb_rwx_destroy(&session->s_lock);
842 	smb_net_txl_destructor(&session->s_txlst);
843 
844 	mutex_destroy(&session->s_credits_mutex);
845 
846 	smb_slist_destructor(&session->s_req_list);
847 	smb_llist_destructor(&session->s_tree_list);
848 	smb_llist_destructor(&session->s_user_list);
849 	smb_llist_destructor(&session->s_xa_list);
850 
851 	ASSERT(session->s_tree_cnt == 0);
852 	ASSERT(session->s_file_cnt == 0);
853 	ASSERT(session->s_dir_cnt == 0);
854 
855 	smb_idpool_destructor(&session->s_tid_pool);
856 	smb_idpool_destructor(&session->s_uid_pool);
857 	if (session->sock != NULL) {
858 		if (session->s_local_port == IPPORT_NETBIOS_SSN)
859 			smb_server_dec_nbt_sess(session->s_server);
860 		else
861 			smb_server_dec_tcp_sess(session->s_server);
862 		smb_sodestroy(session->sock);
863 	}
864 	kmem_cache_free(smb_cache_session, session);
865 }
866 
867 static void
smb_session_cancel(smb_session_t * session)868 smb_session_cancel(smb_session_t *session)
869 {
870 	smb_xa_t	*xa, *nextxa;
871 
872 	/* All the request currently being treated must be canceled. */
873 	smb_session_cancel_requests(session, NULL, NULL);
874 
875 	/*
876 	 * We wait for the completion of all the requests associated with
877 	 * this session.
878 	 */
879 	smb_slist_wait_for_empty(&session->s_req_list);
880 
881 	/*
882 	 * Cleanup transact state objects
883 	 */
884 	xa = smb_llist_head(&session->s_xa_list);
885 	while (xa) {
886 		nextxa = smb_llist_next(&session->s_xa_list, xa);
887 		smb_xa_close(xa);
888 		xa = nextxa;
889 	}
890 
891 	/*
892 	 * At this point the reference count of the files and directories
893 	 * should be zero. It should be possible to destroy them without
894 	 * any problem, which should trigger the destruction of other objects.
895 	 */
896 	smb_session_logoff(session);
897 }
898 
899 /*
900  * Cancel requests.  If a non-null tree is specified, only requests specific
901  * to that tree will be cancelled.  If a non-null sr is specified, that sr
902  * will be not be cancelled - this would typically be the caller's sr.
903  */
904 void
smb_session_cancel_requests(smb_session_t * session,smb_tree_t * tree,smb_request_t * exclude_sr)905 smb_session_cancel_requests(
906     smb_session_t	*session,
907     smb_tree_t		*tree,
908     smb_request_t	*exclude_sr)
909 {
910 	smb_request_t	*sr;
911 
912 	smb_slist_enter(&session->s_req_list);
913 	sr = smb_slist_head(&session->s_req_list);
914 
915 	while (sr) {
916 		ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
917 		if ((sr != exclude_sr) &&
918 		    (tree == NULL || sr->tid_tree == tree))
919 			smb_request_cancel(sr);
920 
921 		sr = smb_slist_next(&session->s_req_list, sr);
922 	}
923 
924 	smb_slist_exit(&session->s_req_list);
925 }
926 
927 /*
928  * Find a user on the specified session by SMB UID.
929  */
930 smb_user_t *
smb_session_lookup_uid(smb_session_t * session,uint16_t uid)931 smb_session_lookup_uid(smb_session_t *session, uint16_t uid)
932 {
933 	return (smb_session_lookup_uid_st(session, 0, uid,
934 	    SMB_USER_STATE_LOGGED_ON));
935 }
936 
937 /*
938  * Find a user on the specified session by SMB2 SSNID.
939  */
940 smb_user_t *
smb_session_lookup_ssnid(smb_session_t * session,uint64_t ssnid)941 smb_session_lookup_ssnid(smb_session_t *session, uint64_t ssnid)
942 {
943 	return (smb_session_lookup_uid_st(session, ssnid, 0,
944 	    SMB_USER_STATE_LOGGED_ON));
945 }
946 
947 smb_user_t *
smb_session_lookup_uid_st(smb_session_t * session,uint64_t ssnid,uint16_t uid,smb_user_state_t st)948 smb_session_lookup_uid_st(smb_session_t *session, uint64_t ssnid,
949     uint16_t uid, smb_user_state_t st)
950 {
951 	smb_user_t	*user;
952 	smb_llist_t	*user_list;
953 
954 	SMB_SESSION_VALID(session);
955 
956 	user_list = &session->s_user_list;
957 	smb_llist_enter(user_list, RW_READER);
958 
959 	for (user = smb_llist_head(user_list);
960 	    user != NULL;
961 	    user = smb_llist_next(user_list, user)) {
962 
963 		SMB_USER_VALID(user);
964 		ASSERT(user->u_session == session);
965 
966 		if (user->u_ssnid != ssnid && user->u_uid != uid)
967 			continue;
968 
969 		mutex_enter(&user->u_mutex);
970 		if (user->u_state == st) {
971 			// smb_user_hold_internal(user);
972 			user->u_refcnt++;
973 			mutex_exit(&user->u_mutex);
974 			break;
975 		}
976 		mutex_exit(&user->u_mutex);
977 	}
978 
979 	smb_llist_exit(user_list);
980 	return (user);
981 }
982 
983 /*
984  * Find a tree by tree-id.
985  */
986 smb_tree_t *
smb_session_lookup_tree(smb_session_t * session,uint16_t tid)987 smb_session_lookup_tree(
988     smb_session_t	*session,
989     uint16_t		tid)
990 {
991 	smb_tree_t	*tree;
992 
993 	SMB_SESSION_VALID(session);
994 
995 	smb_llist_enter(&session->s_tree_list, RW_READER);
996 	tree = smb_llist_head(&session->s_tree_list);
997 
998 	while (tree) {
999 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1000 		ASSERT(tree->t_session == session);
1001 
1002 		if (tree->t_tid == tid) {
1003 			if (smb_tree_hold(tree)) {
1004 				smb_llist_exit(&session->s_tree_list);
1005 				return (tree);
1006 			} else {
1007 				smb_llist_exit(&session->s_tree_list);
1008 				return (NULL);
1009 			}
1010 		}
1011 
1012 		tree = smb_llist_next(&session->s_tree_list, tree);
1013 	}
1014 
1015 	smb_llist_exit(&session->s_tree_list);
1016 	return (NULL);
1017 }
1018 
1019 /*
1020  * Disconnect all trees that match the specified client process-id.
1021  * Used by the SMB1 "process exit" request.
1022  */
1023 void
smb_session_close_pid(smb_session_t * session,uint32_t pid)1024 smb_session_close_pid(
1025     smb_session_t	*session,
1026     uint32_t		pid)
1027 {
1028 	smb_llist_t	*tree_list = &session->s_tree_list;
1029 	smb_tree_t	*tree;
1030 
1031 	smb_llist_enter(tree_list, RW_READER);
1032 
1033 	tree = smb_llist_head(tree_list);
1034 	while (tree) {
1035 		if (smb_tree_hold(tree)) {
1036 			smb_tree_close_pid(tree, pid);
1037 			smb_tree_release(tree);
1038 		}
1039 		tree = smb_llist_next(tree_list, tree);
1040 	}
1041 
1042 	smb_llist_exit(tree_list);
1043 }
1044 
1045 static void
smb_session_tree_dtor(void * arg)1046 smb_session_tree_dtor(void *arg)
1047 {
1048 	smb_tree_t	*tree = arg;
1049 
1050 	smb_tree_disconnect(tree, B_TRUE);
1051 	/* release the ref acquired during the traversal loop */
1052 	smb_tree_release(tree);
1053 }
1054 
1055 
1056 /*
1057  * Disconnect all trees that this user has connected.
1058  */
1059 void
smb_session_disconnect_owned_trees(smb_session_t * session,smb_user_t * owner)1060 smb_session_disconnect_owned_trees(
1061     smb_session_t	*session,
1062     smb_user_t		*owner)
1063 {
1064 	smb_tree_t	*tree;
1065 	smb_llist_t	*tree_list = &session->s_tree_list;
1066 
1067 	SMB_SESSION_VALID(session);
1068 	SMB_USER_VALID(owner);
1069 
1070 	smb_llist_enter(tree_list, RW_READER);
1071 
1072 	tree = smb_llist_head(tree_list);
1073 	while (tree) {
1074 		if ((tree->t_owner == owner) &&
1075 		    smb_tree_hold(tree)) {
1076 			/*
1077 			 * smb_tree_hold() succeeded, hence we are in state
1078 			 * SMB_TREE_STATE_CONNECTED; schedule this tree
1079 			 * for disconnect after smb_llist_exit because
1080 			 * the "unmap exec" up-call can block, and we'd
1081 			 * rather not block with the tree list locked.
1082 			 */
1083 			smb_llist_post(tree_list, tree, smb_session_tree_dtor);
1084 		}
1085 		tree = smb_llist_next(tree_list, tree);
1086 	}
1087 
1088 	/* drop the lock and flush the dtor queue */
1089 	smb_llist_exit(tree_list);
1090 }
1091 
1092 /*
1093  * Disconnect all trees that this user has connected.
1094  */
1095 static void
smb_session_disconnect_trees(smb_session_t * session)1096 smb_session_disconnect_trees(
1097     smb_session_t	*session)
1098 {
1099 	smb_llist_t	*tree_list = &session->s_tree_list;
1100 	smb_tree_t	*tree;
1101 
1102 	smb_llist_enter(tree_list, RW_READER);
1103 
1104 	tree = smb_llist_head(tree_list);
1105 	while (tree) {
1106 		if (smb_tree_hold(tree)) {
1107 			smb_llist_post(tree_list, tree,
1108 			    smb_session_tree_dtor);
1109 		}
1110 		tree = smb_llist_next(tree_list, tree);
1111 	}
1112 
1113 	/* drop the lock and flush the dtor queue */
1114 	smb_llist_exit(tree_list);
1115 }
1116 
1117 /*
1118  * Variant of smb_session_tree_dtor that also
1119  * cancels requests using this tree.
1120  */
1121 static void
smb_session_tree_kill(void * arg)1122 smb_session_tree_kill(void *arg)
1123 {
1124 	smb_tree_t	*tree = arg;
1125 
1126 	SMB_TREE_VALID(tree);
1127 
1128 	smb_tree_disconnect(tree, B_TRUE);
1129 	smb_session_cancel_requests(tree->t_session, tree, NULL);
1130 
1131 	/* release the ref acquired during the traversal loop */
1132 	smb_tree_release(tree);
1133 }
1134 
1135 /*
1136  * Disconnect all trees that match the specified share name,
1137  * and kill requests using those trees.
1138  */
1139 void
smb_session_disconnect_share(smb_session_t * session,const char * sharename)1140 smb_session_disconnect_share(
1141     smb_session_t	*session,
1142     const char		*sharename)
1143 {
1144 	smb_llist_t	*ll;
1145 	smb_tree_t	*tree;
1146 
1147 	SMB_SESSION_VALID(session);
1148 
1149 	ll = &session->s_tree_list;
1150 	smb_llist_enter(ll, RW_READER);
1151 
1152 	for (tree = smb_llist_head(ll);
1153 	    tree != NULL;
1154 	    tree = smb_llist_next(ll, tree)) {
1155 
1156 		SMB_TREE_VALID(tree);
1157 		ASSERT(tree->t_session == session);
1158 
1159 		if (smb_strcasecmp(tree->t_sharename, sharename, 0) != 0)
1160 			continue;
1161 
1162 		if (smb_tree_hold(tree)) {
1163 			smb_llist_post(ll, tree,
1164 			    smb_session_tree_kill);
1165 		}
1166 	}
1167 
1168 	smb_llist_exit(ll);
1169 }
1170 
1171 int smb_session_logoff_maxwait = 5;	/* seconds */
1172 
1173 /*
1174  * Logoff all users associated with the specified session.
1175  *
1176  * This is called for both server-initiated disconnect
1177  * (SMB_SESSION_STATE_TERMINATED) and client-initiated
1178  * disconnect (SMB_SESSION_STATE_DISCONNECTED).
1179  * If client-initiated, save durable handles.
1180  * All requests on this session have finished.
1181  */
1182 void
smb_session_logoff(smb_session_t * session)1183 smb_session_logoff(smb_session_t *session)
1184 {
1185 	smb_llist_t	*ulist;
1186 	smb_user_t	*user;
1187 	int		count;
1188 	int		timeleft = SEC_TO_TICK(smb_session_logoff_maxwait);
1189 
1190 	SMB_SESSION_VALID(session);
1191 
1192 top:
1193 	ulist = &session->s_user_list;
1194 	smb_llist_enter(ulist, RW_READER);
1195 
1196 	user = smb_llist_head(ulist);
1197 	while (user) {
1198 		SMB_USER_VALID(user);
1199 		ASSERT(user->u_session == session);
1200 
1201 		mutex_enter(&user->u_mutex);
1202 		switch (user->u_state) {
1203 		case SMB_USER_STATE_LOGGING_ON:
1204 		case SMB_USER_STATE_LOGGED_ON:
1205 			// smb_user_hold_internal(user);
1206 			user->u_refcnt++;
1207 			mutex_exit(&user->u_mutex);
1208 			smb_user_logoff(user);
1209 			smb_user_release(user);
1210 			break;
1211 
1212 		case SMB_USER_STATE_LOGGED_OFF:
1213 		case SMB_USER_STATE_LOGGING_OFF:
1214 			mutex_exit(&user->u_mutex);
1215 			break;
1216 
1217 		default:
1218 			mutex_exit(&user->u_mutex);
1219 			ASSERT(0);
1220 			break;
1221 		}
1222 
1223 		user = smb_llist_next(ulist, user);
1224 	}
1225 
1226 	count = smb_llist_get_count(ulist);
1227 
1228 	/* drop the lock and flush the dtor queue */
1229 	smb_llist_exit(ulist);
1230 
1231 	/*
1232 	 * Wait (briefly) for user objects to go away.
1233 	 * They might linger, eg. if some ofile ref has been
1234 	 * forgotten, which holds, a tree and a user.
1235 	 * See smb_session_destroy.
1236 	 */
1237 	if (count == 0) {
1238 		/* User list is empty. */
1239 		smb_rwx_rwenter(&session->s_lock, RW_WRITER);
1240 		session->s_state = SMB_SESSION_STATE_SHUTDOWN;
1241 		smb_rwx_rwexit(&session->s_lock);
1242 	} else {
1243 		smb_rwx_rwenter(&session->s_lock, RW_READER);
1244 		if (session->s_state != SMB_SESSION_STATE_SHUTDOWN &&
1245 		    timeleft > 0) {
1246 			/* May be signaled in smb_user_delete */
1247 			(void) smb_rwx_cvwait(&session->s_lock,
1248 			    MSEC_TO_TICK(200));
1249 			timeleft -= 200;
1250 			smb_rwx_rwexit(&session->s_lock);
1251 			goto top;
1252 		}
1253 		smb_rwx_rwexit(&session->s_lock);
1254 
1255 		cmn_err(CE_NOTE, "!session logoff waited %d seconds"
1256 		    " with %d logons remaining",
1257 		    smb_session_logoff_maxwait, count);
1258 		DTRACE_PROBE1(max__wait, smb_session_t *, session);
1259 	}
1260 
1261 	/*
1262 	 * User list should be empty now, but might not be if we
1263 	 * timed out waiting for smb_user objects to go away.
1264 	 * Checked in smb_server_destroy_session
1265 	 *
1266 	 * User logoff happens first so we'll set preserve_opens
1267 	 * for client-initiated disconnect.  When that's done
1268 	 * there should be no trees left, but check anyway.
1269 	 */
1270 	smb_session_disconnect_trees(session);
1271 }
1272 
1273 /*
1274  * Copy the session workstation/client name to buf.  If the workstation
1275  * is an empty string (which it will be on TCP connections), use the
1276  * client IP address.
1277  */
1278 void
smb_session_getclient(smb_session_t * sn,char * buf,size_t buflen)1279 smb_session_getclient(smb_session_t *sn, char *buf, size_t buflen)
1280 {
1281 
1282 	*buf = '\0';
1283 
1284 	if (sn->workstation[0] != '\0') {
1285 		(void) strlcpy(buf, sn->workstation, buflen);
1286 		return;
1287 	}
1288 
1289 	(void) strlcpy(buf, sn->ip_addr_str, buflen);
1290 }
1291 
1292 /*
1293  * Check whether or not the specified client name is the client of this
1294  * session.  The name may be in UNC format (\\CLIENT).
1295  *
1296  * A workstation/client name is setup on NBT connections as part of the
1297  * NetBIOS session request but that isn't available on TCP connections.
1298  * If the session doesn't have a client name we typically return the
1299  * client IP address as the workstation name on MSRPC requests.  So we
1300  * check for the IP address here in addition to the workstation name.
1301  */
1302 boolean_t
smb_session_isclient(smb_session_t * sn,const char * client)1303 smb_session_isclient(smb_session_t *sn, const char *client)
1304 {
1305 
1306 	client += strspn(client, "\\");
1307 
1308 	if (smb_strcasecmp(client, sn->workstation, 0) == 0)
1309 		return (B_TRUE);
1310 
1311 	if (smb_strcasecmp(client, sn->ip_addr_str, 0) == 0)
1312 		return (B_TRUE);
1313 
1314 	return (B_FALSE);
1315 }
1316 
1317 /*
1318  * smb_request_alloc
1319  *
1320  * Allocate an smb_request_t structure from the kmem_cache.  Partially
1321  * initialize the found/new request.
1322  *
1323  * Returns pointer to a request, or NULL if the session state is
1324  * one in which new requests are no longer allowed.
1325  */
1326 smb_request_t *
smb_request_alloc(smb_session_t * session,int req_length)1327 smb_request_alloc(smb_session_t *session, int req_length)
1328 {
1329 	smb_request_t	*sr;
1330 
1331 	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
1332 	ASSERT(req_length <= session->cmd_max_bytes);
1333 
1334 	sr = kmem_cache_alloc(smb_cache_request, KM_SLEEP);
1335 
1336 	/*
1337 	 * Future:  Use constructor to pre-initialize some fields.  For now
1338 	 * there are so many fields that it is easiest just to zero the
1339 	 * whole thing and start over.
1340 	 */
1341 	bzero(sr, sizeof (smb_request_t));
1342 
1343 	mutex_init(&sr->sr_mutex, NULL, MUTEX_DEFAULT, NULL);
1344 	cv_init(&sr->sr_st_cv, NULL, CV_DEFAULT, NULL);
1345 	smb_srm_init(sr);
1346 	sr->session = session;
1347 	sr->sr_server = session->s_server;
1348 	sr->sr_gmtoff = session->s_server->si_gmtoff;
1349 	sr->sr_cfg = &session->s_cfg;
1350 	sr->reply.max_bytes = session->reply_max_bytes;
1351 
1352 	sr->sr_magic = SMB_REQ_MAGIC;
1353 	sr->sr_state = SMB_REQ_STATE_INITIALIZING;
1354 
1355 	/*
1356 	 * Only allow new SMB requests in some states.
1357 	 */
1358 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
1359 	switch (session->s_state) {
1360 	case SMB_SESSION_STATE_CONNECTED:
1361 	case SMB_SESSION_STATE_INITIALIZED:
1362 	case SMB_SESSION_STATE_ESTABLISHED:
1363 	case SMB_SESSION_STATE_NEGOTIATED:
1364 		smb_slist_insert_tail(&session->s_req_list, sr);
1365 		break;
1366 
1367 	default:
1368 		ASSERT(0);
1369 		/* FALLTHROUGH */
1370 	case SMB_SESSION_STATE_DISCONNECTED:
1371 	case SMB_SESSION_STATE_SHUTDOWN:
1372 	case SMB_SESSION_STATE_TERMINATED:
1373 		/* Disallow new requests in these states. */
1374 		sr->session = NULL;
1375 		sr->sr_magic = 0;
1376 		cv_destroy(&sr->sr_st_cv);
1377 		mutex_destroy(&sr->sr_mutex);
1378 		kmem_cache_free(smb_cache_request, sr);
1379 		sr = NULL;
1380 		break;
1381 	}
1382 	smb_rwx_rwexit(&session->s_lock);
1383 
1384 	return (sr);
1385 }
1386 
1387 /*
1388  * smb_request_free
1389  *
1390  * release the memories which have been allocated for a smb request.
1391  */
1392 void
smb_request_free(smb_request_t * sr)1393 smb_request_free(smb_request_t *sr)
1394 {
1395 	ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
1396 	ASSERT(sr->session);
1397 	ASSERT(sr->r_xa == NULL);
1398 
1399 	if (sr->fid_ofile != NULL) {
1400 		smb_ofile_release(sr->fid_ofile);
1401 	}
1402 
1403 	if (sr->tid_tree != NULL)
1404 		smb_tree_release(sr->tid_tree);
1405 
1406 	if (sr->uid_user != NULL)
1407 		smb_user_release(sr->uid_user);
1408 
1409 	if (sr->th_sid_user != NULL)
1410 		smb_user_release(sr->th_sid_user);
1411 
1412 	/*
1413 	 * The above may have left work on the delete queues
1414 	 */
1415 	smb_llist_flush(&sr->session->s_tree_list);
1416 	smb_llist_flush(&sr->session->s_user_list);
1417 
1418 	smb_slist_remove(&sr->session->s_req_list, sr);
1419 
1420 	sr->session = NULL;
1421 
1422 	smb_srm_fini(sr);
1423 
1424 	if (sr->command.chain)
1425 		m_freem(sr->command.chain);
1426 	if (sr->reply.chain)
1427 		m_freem(sr->reply.chain);
1428 	if (sr->raw_data.chain)
1429 		m_freem(sr->raw_data.chain);
1430 
1431 	sr->sr_magic = 0;
1432 	mutex_destroy(&sr->sr_mutex);
1433 	kmem_cache_free(smb_cache_request, sr);
1434 }
1435 
1436 boolean_t
smb_session_oplocks_enable(smb_session_t * session)1437 smb_session_oplocks_enable(smb_session_t *session)
1438 {
1439 	SMB_SESSION_VALID(session);
1440 	if (session->s_cfg.skc_oplock_enable == 0)
1441 		return (B_FALSE);
1442 	else
1443 		return (B_TRUE);
1444 }
1445 
1446 boolean_t
smb_session_levelII_oplocks(smb_session_t * session)1447 smb_session_levelII_oplocks(smb_session_t *session)
1448 {
1449 	SMB_SESSION_VALID(session);
1450 
1451 	/* Older clients only do Level II oplocks if negotiated. */
1452 	if ((session->capabilities & CAP_LEVEL_II_OPLOCKS) != 0)
1453 		return (B_TRUE);
1454 
1455 	return (B_FALSE);
1456 }
1457 
1458 static void
smb_session_genkey(smb_session_t * session)1459 smb_session_genkey(smb_session_t *session)
1460 {
1461 	uint8_t		tmp_key[SMB_CHALLENGE_SZ];
1462 
1463 	(void) random_get_pseudo_bytes(tmp_key, SMB_CHALLENGE_SZ);
1464 	bcopy(tmp_key, &session->challenge_key, SMB_CHALLENGE_SZ);
1465 	session->challenge_len = SMB_CHALLENGE_SZ;
1466 
1467 	(void) random_get_pseudo_bytes(tmp_key, 4);
1468 	session->sesskey = tmp_key[0] | tmp_key[1] << 8 |
1469 	    tmp_key[2] << 16 | tmp_key[3] << 24;
1470 }
1471