1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright 2018 Nexenta Systems, Inc. All rights reserved. 24 */ 25 26 /* 27 * Authentication support for SMB session setup 28 */ 29 30 #include <sys/types.h> 31 #include <sys/sid.h> 32 #include <sys/priv_names.h> 33 #include <sys/socket.h> 34 #include <sys/un.h> 35 #include <netinet/in.h> 36 #include <smbsrv/smb_idmap.h> 37 #include <smbsrv/smb_kproto.h> 38 #include <smbsrv/smb_token.h> 39 40 static uint32_t smb_authsock_open(smb_request_t *); 41 static int smb_authsock_send(ksocket_t, void *, size_t); 42 static int smb_authsock_recv(ksocket_t, void *, size_t); 43 static uint32_t smb_authsock_sendrecv(smb_request_t *, smb_lsa_msg_hdr_t *hdr, 44 void *sndbuf, void **recvbuf); 45 /* void smb_authsock_close(smb_user_t *); kproto.h */ 46 47 static uint32_t smb_auth_do_clinfo(smb_request_t *); 48 static uint32_t smb_auth_do_oldreq(smb_request_t *); 49 static uint32_t smb_auth_get_token(smb_request_t *); 50 static uint32_t smb_priv_xlate(smb_token_t *); 51 52 /* 53 * Handle old-style session setup (non-extended security) 54 * Note: Used only by SMB1 55 * 56 * The user information is passed to smbd for authentication. 57 * If smbd can authenticate the user an access token is returned and we 58 * generate a cred and new user based on the token. 59 */ 60 int 61 smb_authenticate_old(smb_request_t *sr) 62 { 63 smb_user_t *user = NULL; 64 uint32_t status; 65 66 user = smb_user_new(sr->session); 67 if (user == NULL) 68 return (NT_STATUS_TOO_MANY_SESSIONS); 69 70 /* user cleanup in smb_request_free */ 71 sr->uid_user = user; 72 sr->smb_uid = user->u_uid; 73 sr->smb2_ssnid = 0; 74 75 /* 76 * Open a connection to the local logon service. 77 * If we can't, it may be busy, or not running. 78 * Don't log here - this may be frequent. 79 */ 80 if ((status = smb_authsock_open(sr)) != 0) 81 goto errout; 82 83 /* 84 * Tell the auth. svc who this client is. 85 */ 86 if ((status = smb_auth_do_clinfo(sr)) != 0) 87 goto errout; 88 89 /* 90 * Authentication proper 91 */ 92 if ((status = smb_auth_do_oldreq(sr)) != 0) 93 goto errout; 94 95 /* 96 * Get the final auth. token. 97 */ 98 if ((status = smb_auth_get_token(sr)) != 0) 99 goto errout; 100 101 return (0); 102 103 errout: 104 smb_user_logoff(user); 105 return (status); 106 } 107 108 /* 109 * Build an authentication request message and 110 * send it to the local logon service. 111 */ 112 static uint32_t 113 smb_auth_do_oldreq(smb_request_t *sr) 114 { 115 smb_lsa_msg_hdr_t msg_hdr; 116 smb_logon_t user_info; 117 XDR xdrs; 118 smb_arg_sessionsetup_t *sinfo = sr->sr_ssetup; 119 void *sbuf = NULL; 120 void *rbuf = NULL; 121 uint32_t slen = 0; 122 uint32_t rlen = 0; 123 uint32_t status; 124 bool_t ok; 125 126 bzero(&user_info, sizeof (smb_logon_t)); 127 128 user_info.lg_level = NETR_NETWORK_LOGON; 129 user_info.lg_username = sinfo->ssi_user; 130 user_info.lg_domain = sinfo->ssi_domain; 131 user_info.lg_workstation = sr->session->workstation; 132 user_info.lg_clnt_ipaddr = sr->session->ipaddr; 133 user_info.lg_local_ipaddr = sr->session->local_ipaddr; 134 user_info.lg_local_port = sr->session->s_local_port; 135 user_info.lg_challenge_key.val = sr->session->challenge_key; 136 user_info.lg_challenge_key.len = sr->session->challenge_len; 137 user_info.lg_nt_password.val = sinfo->ssi_ntpwd; 138 user_info.lg_nt_password.len = sinfo->ssi_ntpwlen; 139 user_info.lg_lm_password.val = sinfo->ssi_lmpwd; 140 user_info.lg_lm_password.len = sinfo->ssi_lmpwlen; 141 user_info.lg_native_os = sr->session->native_os; 142 user_info.lg_native_lm = sr->session->native_lm; 143 /* lg_flags? */ 144 145 slen = xdr_sizeof(smb_logon_xdr, &user_info); 146 sbuf = kmem_alloc(slen, KM_SLEEP); 147 xdrmem_create(&xdrs, sbuf, slen, XDR_ENCODE); 148 ok = smb_logon_xdr(&xdrs, &user_info); 149 xdr_destroy(&xdrs); 150 if (!ok) { 151 status = RPC_NT_BAD_STUB_DATA; 152 goto out; 153 } 154 155 msg_hdr.lmh_msgtype = LSA_MTYPE_OLDREQ; 156 msg_hdr.lmh_msglen = slen; 157 status = smb_authsock_sendrecv(sr, &msg_hdr, sbuf, &rbuf); 158 if (status != 0) 159 goto out; 160 rlen = msg_hdr.lmh_msglen; 161 kmem_free(sbuf, slen); 162 sbuf = NULL; 163 164 /* 165 * Decode the response message. 166 */ 167 switch (msg_hdr.lmh_msgtype) { 168 169 case LSA_MTYPE_OK: 170 status = 0; 171 break; 172 173 case LSA_MTYPE_ERROR: 174 if (rlen == sizeof (smb_lsa_eresp_t)) { 175 smb_lsa_eresp_t *ler = rbuf; 176 status = ler->ler_ntstatus; 177 break; 178 } 179 /* FALLTHROUGH */ 180 181 default: /* Bogus message type */ 182 status = NT_STATUS_INTERNAL_ERROR; 183 break; 184 } 185 186 out: 187 if (rbuf != NULL) 188 kmem_free(rbuf, rlen); 189 if (sbuf != NULL) 190 kmem_free(sbuf, slen); 191 192 return (status); 193 } 194 195 /* 196 * Handle new-style (extended security) session setup. 197 * Returns zero: success, non-zero: error (value not used) 198 * 199 * Note that this style uses a sequence of session setup requests, 200 * where the first has SMB UID=0, and subsequent requests in the 201 * same authentication sequence have the SMB UID returned for that 202 * first request. We allocate a USER object when the first request 203 * in the sequence arrives (SMB_USER_STATE_LOGGING_ON) and use that 204 * to maintain state between requests in this sequence. The state 205 * for one sequence includes an AF_UNIX "authsock" connection to the 206 * user-space smbd. The neat part of this is: in smbd, the handler 207 * for the server-side of one authsock gets only request specific to 208 * one authentication sequence, simplifying it's work immensely. 209 * When the authentication sequence is finished, with either success 210 * or failure, the local side of the authsock is closed. 211 * 212 * As with the old-style authentication, if we succeed, then the 213 * last message from smbd will be an smb_token_t encoding the 214 * information about the new user. 215 * 216 * Outline: 217 * (a) On the first request (UID==0) create a USER object, 218 * and on subsequent requests, find USER by SMB UID. 219 * (b) Send message / recv. response as above, 220 * (c) If response says "we're done", close authsock 221 * (both success and failure must close authsock) 222 */ 223 int 224 smb_authenticate_ext(smb_request_t *sr) 225 { 226 smb_lsa_msg_hdr_t msg_hdr; 227 smb_arg_sessionsetup_t *sinfo = sr->sr_ssetup; 228 smb_user_t *user = NULL; 229 void *rbuf = NULL; 230 uint32_t rlen = 0; 231 uint32_t status; 232 233 ASSERT(sr->uid_user == NULL); 234 235 /* 236 * Paranoid: While finding/creating the user object, make sure 237 * SMB2 ignores smb_uid, and SMB1 ignores smb2_ssnid. The 238 * logic below assumes the "other" one is always zero; both 239 * the "first request" tests and smb_session_lookup_uid_st. 240 */ 241 if (sr->session->dialect >= SMB_VERS_2_BASE) { 242 /* SMB2+ ignores smb_uid */ 243 ASSERT(sr->smb_uid == 0); 244 sr->smb_uid = 0; 245 } else { 246 /* SMB1 ignores smb2_ssnid */ 247 ASSERT(sr->smb2_ssnid == 0); 248 sr->smb2_ssnid = 0; 249 } 250 251 /* 252 * On the first request (UID/ssnid==0) create a USER object. 253 * On subsequent requests (UID/ssnid!=0) find the USER object. 254 * Either way, sr->uid_user is set, so our ref. on the 255 * user object is dropped during normal cleanup work 256 * for the smb_request (sr). Ditto u_authsock. 257 */ 258 if (sr->smb2_ssnid == 0 && sr->smb_uid == 0) { 259 user = smb_user_new(sr->session); 260 if (user == NULL) 261 return (NT_STATUS_TOO_MANY_SESSIONS); 262 263 /* user cleanup in smb_request_free */ 264 sr->uid_user = user; 265 if (sr->session->dialect >= SMB_VERS_2_BASE) { 266 /* Intentionally leave smb_uid=0 for SMB2 */ 267 sr->smb2_ssnid = user->u_ssnid; 268 } else { 269 /* Intentionally leave smb2_ssnid=0 for SMB1 */ 270 sr->smb_uid = user->u_uid; 271 } 272 273 /* 274 * Open a connection to the local logon service. 275 * If we can't, it may be busy, or not running. 276 * Don't log here - this may be frequent. 277 */ 278 if ((status = smb_authsock_open(sr)) != 0) 279 goto errout; 280 281 /* 282 * Tell the auth. svc who this client is. 283 */ 284 if ((status = smb_auth_do_clinfo(sr)) != 0) 285 goto errout; 286 287 msg_hdr.lmh_msgtype = LSA_MTYPE_ESFIRST; 288 } else { 289 user = smb_session_lookup_uid_st(sr->session, 290 sr->smb2_ssnid, sr->smb_uid, SMB_USER_STATE_LOGGING_ON); 291 if (user == NULL) 292 return (NT_STATUS_USER_SESSION_DELETED); 293 294 /* user cleanup in smb_request_free */ 295 sr->uid_user = user; 296 297 msg_hdr.lmh_msgtype = LSA_MTYPE_ESNEXT; 298 } 299 300 /* 301 * Wrap the "security blob" with our header 302 * (LSA_MTYPE_ESFIRST or LSA_MTYPE_ESNEXT) 303 * and send it up the authsock with either 304 */ 305 msg_hdr.lmh_msglen = sinfo->ssi_iseclen; 306 status = smb_authsock_sendrecv(sr, &msg_hdr, 307 sinfo->ssi_isecblob, &rbuf); 308 if (status != 0) 309 goto errout; 310 rlen = msg_hdr.lmh_msglen; 311 312 /* 313 * Decode the response message. 314 * Note: allocated rbuf 315 */ 316 switch (msg_hdr.lmh_msgtype) { 317 318 case LSA_MTYPE_ES_CONT: 319 sinfo->ssi_oseclen = (uint16_t)rlen; 320 sinfo->ssi_osecblob = smb_srm_alloc(sr, sinfo->ssi_oseclen); 321 bcopy(rbuf, sinfo->ssi_osecblob, sinfo->ssi_oseclen); 322 /* 323 * This is not really an error, but tells the client 324 * it should send another session setup request. 325 */ 326 status = NT_STATUS_MORE_PROCESSING_REQUIRED; 327 break; 328 329 case LSA_MTYPE_ES_DONE: 330 sinfo->ssi_oseclen = (uint16_t)rlen; 331 sinfo->ssi_osecblob = smb_srm_alloc(sr, sinfo->ssi_oseclen); 332 bcopy(rbuf, sinfo->ssi_osecblob, sinfo->ssi_oseclen); 333 sinfo->ssi_ntpwlen = 0; 334 /* 335 * Get the final auth. token. 336 */ 337 status = smb_auth_get_token(sr); 338 break; 339 340 case LSA_MTYPE_ERROR: 341 /* 342 * Authentication failed. Return the error 343 * provided in the reply message. 344 */ 345 if (rlen == sizeof (smb_lsa_eresp_t)) { 346 smb_lsa_eresp_t *ler = rbuf; 347 status = ler->ler_ntstatus; 348 goto errout; 349 } 350 /* FALLTHROUGH */ 351 352 default: /* Bogus message type */ 353 status = NT_STATUS_INTERNAL_ERROR; 354 goto errout; 355 } 356 357 if (status != 0 && status != NT_STATUS_MORE_PROCESSING_REQUIRED) { 358 errout: 359 smb_user_logoff(user); 360 } 361 362 if (rbuf != NULL) 363 kmem_free(rbuf, rlen); 364 365 return (status); 366 } 367 368 /* 369 * Send the "client info" up to the auth service. 370 */ 371 static uint32_t 372 smb_auth_do_clinfo(smb_request_t *sr) 373 { 374 smb_lsa_msg_hdr_t msg_hdr; 375 smb_lsa_clinfo_t clinfo; 376 void *rbuf = NULL; 377 uint32_t status; 378 379 /* 380 * Send a message with info. about the client 381 * (IP address, etc) and wait for an ACK. 382 */ 383 msg_hdr.lmh_msgtype = LSA_MTYPE_CLINFO; 384 msg_hdr.lmh_msglen = sizeof (clinfo); 385 clinfo.lci_clnt_ipaddr = sr->session->ipaddr; 386 (void) memcpy(clinfo.lci_challenge_key, 387 sr->session->challenge_key, 388 sizeof (clinfo.lci_challenge_key)); 389 status = smb_authsock_sendrecv(sr, &msg_hdr, &clinfo, &rbuf); 390 /* We don't use this response. */ 391 if (rbuf != NULL) { 392 kmem_free(rbuf, msg_hdr.lmh_msglen); 393 rbuf = NULL; 394 } 395 396 return (status); 397 } 398 399 /* 400 * After a successful authentication, ask the authsvc to 401 * send us the authentication token. 402 */ 403 static uint32_t 404 smb_auth_get_token(smb_request_t *sr) 405 { 406 smb_lsa_msg_hdr_t msg_hdr; 407 XDR xdrs; 408 smb_user_t *user = sr->uid_user; 409 smb_token_t *token = NULL; 410 cred_t *cr = NULL; 411 void *rbuf = NULL; 412 uint32_t rlen = 0; 413 uint32_t privileges; 414 uint32_t status; 415 bool_t ok; 416 417 msg_hdr.lmh_msgtype = LSA_MTYPE_GETTOK; 418 msg_hdr.lmh_msglen = 0; 419 420 status = smb_authsock_sendrecv(sr, &msg_hdr, NULL, &rbuf); 421 if (status != 0) 422 goto errout; 423 424 rlen = msg_hdr.lmh_msglen; 425 switch (msg_hdr.lmh_msgtype) { 426 427 case LSA_MTYPE_TOKEN: 428 status = 0; 429 break; 430 431 case LSA_MTYPE_ERROR: 432 if (rlen == sizeof (smb_lsa_eresp_t)) { 433 smb_lsa_eresp_t *ler = rbuf; 434 status = ler->ler_ntstatus; 435 goto errout; 436 } 437 /* FALLTHROUGH */ 438 439 default: 440 status = NT_STATUS_INTERNAL_ERROR; 441 goto errout; 442 } 443 444 /* 445 * Authenticated. Decode the LSA_MTYPE_TOKEN. 446 */ 447 xdrmem_create(&xdrs, rbuf, rlen, XDR_DECODE); 448 token = kmem_zalloc(sizeof (smb_token_t), KM_SLEEP); 449 ok = smb_token_xdr(&xdrs, token); 450 xdr_destroy(&xdrs); 451 if (!ok) { 452 status = RPC_NT_BAD_STUB_DATA; 453 goto errout; 454 } 455 kmem_free(rbuf, rlen); 456 rbuf = NULL; 457 458 /* 459 * Setup the logon object. 460 */ 461 cr = smb_cred_create(token); 462 if (cr == NULL) 463 goto errout; 464 privileges = smb_priv_xlate(token); 465 (void) smb_user_logon(user, cr, 466 token->tkn_domain_name, token->tkn_account_name, 467 token->tkn_flags, privileges, token->tkn_audit_sid); 468 crfree(cr); 469 470 /* 471 * Save the session key, and (maybe) enable signing, 472 * but only for real logon (not ANON or GUEST). 473 */ 474 if ((token->tkn_flags & (SMB_ATF_GUEST | SMB_ATF_ANON)) == 0) { 475 if (sr->session->dialect >= SMB_VERS_2_BASE) { 476 smb2_sign_begin(sr, token); 477 } else { 478 smb_sign_begin(sr, token); 479 } 480 } 481 482 smb_token_free(token); 483 484 sr->user_cr = user->u_cred; 485 return (0); 486 487 errout: 488 if (rbuf != NULL) 489 kmem_free(rbuf, rlen); 490 if (token != NULL) 491 smb_token_free(token); 492 return (status); 493 } 494 495 /* 496 * Tokens are allocated in the kernel via XDR. 497 * Call xdr_free before freeing the token structure. 498 */ 499 void 500 smb_token_free(smb_token_t *token) 501 { 502 if (token != NULL) { 503 xdr_free(smb_token_xdr, (char *)token); 504 kmem_free(token, sizeof (smb_token_t)); 505 } 506 } 507 508 /* 509 * Convert access token privileges to local definitions. 510 */ 511 static uint32_t 512 smb_priv_xlate(smb_token_t *token) 513 { 514 uint32_t privileges = 0; 515 516 if (smb_token_query_privilege(token, SE_BACKUP_LUID)) 517 privileges |= SMB_USER_PRIV_BACKUP; 518 519 if (smb_token_query_privilege(token, SE_RESTORE_LUID)) 520 privileges |= SMB_USER_PRIV_RESTORE; 521 522 if (smb_token_query_privilege(token, SE_TAKE_OWNERSHIP_LUID)) 523 privileges |= SMB_USER_PRIV_TAKE_OWNERSHIP; 524 525 if (smb_token_query_privilege(token, SE_SECURITY_LUID)) 526 privileges |= SMB_USER_PRIV_SECURITY; 527 528 return (privileges); 529 } 530 531 /* 532 * Unblock a request that might be blocked reading some 533 * authentication socket. This can happen when either the 534 * client cancels a session setup or closes the connection. 535 */ 536 static void 537 smb_authsock_cancel(smb_request_t *sr) 538 { 539 smb_user_t *user = sr->cancel_arg2; 540 ksocket_t authsock = NULL; 541 542 if (user == NULL) 543 return; 544 ASSERT(user == sr->uid_user); 545 546 /* 547 * Check user state, and get a hold on the auth socket. 548 */ 549 mutex_enter(&user->u_mutex); 550 if (user->u_state == SMB_USER_STATE_LOGGING_ON) { 551 if ((authsock = user->u_authsock) != NULL) 552 ksocket_hold(authsock); 553 } 554 mutex_exit(&user->u_mutex); 555 556 if (authsock != NULL) { 557 (void) ksocket_shutdown(authsock, SHUT_RDWR, sr->user_cr); 558 ksocket_rele(authsock); 559 } 560 } 561 562 /* 563 * Send/recv a request/reply sequence on the auth socket. 564 * Returns zero or an NT status. 565 * 566 * Errors here mean we can't communicate with the smbd_authsvc. 567 * With limited authsock instances, this should be rare. 568 */ 569 static uint32_t 570 smb_authsock_sendrecv(smb_request_t *sr, smb_lsa_msg_hdr_t *hdr, 571 void *sndbuf, void **recvbuf) 572 { 573 smb_user_t *user = sr->uid_user; 574 ksocket_t so; 575 uint32_t status; 576 int rc; 577 578 /* 579 * Get a hold on the auth socket. 580 */ 581 mutex_enter(&user->u_mutex); 582 so = user->u_authsock; 583 if (so == NULL) { 584 mutex_exit(&user->u_mutex); 585 return (NT_STATUS_INTERNAL_ERROR); 586 } 587 ksocket_hold(so); 588 mutex_exit(&user->u_mutex); 589 590 mutex_enter(&sr->sr_mutex); 591 if (sr->sr_state != SMB_REQ_STATE_ACTIVE) { 592 mutex_exit(&sr->sr_mutex); 593 status = NT_STATUS_CANCELLED; 594 goto out; 595 } 596 sr->sr_state = SMB_REQ_STATE_WAITING_AUTH; 597 sr->cancel_method = smb_authsock_cancel; 598 sr->cancel_arg2 = user; 599 mutex_exit(&sr->sr_mutex); 600 601 rc = smb_authsock_send(so, hdr, sizeof (*hdr)); 602 if (rc == 0 && hdr->lmh_msglen != 0) { 603 rc = smb_authsock_send(so, sndbuf, hdr->lmh_msglen); 604 } 605 if (rc == 0) 606 rc = smb_authsock_recv(so, hdr, sizeof (*hdr)); 607 if (rc == 0 && hdr->lmh_msglen != 0) { 608 *recvbuf = kmem_alloc(hdr->lmh_msglen, KM_SLEEP); 609 rc = smb_authsock_recv(so, *recvbuf, hdr->lmh_msglen); 610 } 611 612 switch (rc) { 613 case 0: 614 status = 0; 615 break; 616 case EIO: 617 status = RPC_NT_COMM_FAILURE; 618 break; 619 case ENOTCONN: 620 status = RPC_NT_PIPE_CLOSED; 621 break; 622 default: 623 status = RPC_NT_CALL_FAILED; 624 break; 625 } 626 627 mutex_enter(&sr->sr_mutex); 628 sr->cancel_method = NULL; 629 sr->cancel_arg2 = NULL; 630 switch (sr->sr_state) { 631 case SMB_REQ_STATE_WAITING_AUTH: 632 sr->sr_state = SMB_REQ_STATE_ACTIVE; 633 break; 634 case SMB_REQ_STATE_CANCEL_PENDING: 635 sr->sr_state = SMB_REQ_STATE_CANCELLED; 636 status = NT_STATUS_CANCELLED; 637 break; 638 default: 639 status = NT_STATUS_INTERNAL_ERROR; 640 break; 641 } 642 mutex_exit(&sr->sr_mutex); 643 644 out: 645 ksocket_rele(so); 646 647 if (status != 0 && *recvbuf != NULL) { 648 kmem_free(*recvbuf, hdr->lmh_msglen); 649 *recvbuf = NULL; 650 } 651 return (status); 652 } 653 654 /* 655 * Hope this is interpreted per-zone... 656 */ 657 static struct sockaddr_un smbauth_sockname = { 658 AF_UNIX, SMB_AUTHSVC_SOCKNAME }; 659 660 /* 661 * Limit how long smb_authsock_sendrecv() will wait for a 662 * response from the local authentication service. 663 */ 664 struct timeval smb_auth_recv_tmo = { 45, 0 }; 665 666 /* 667 * Also limit the time smb_authsock_sendrecv() will wait 668 * trying to send a request to the authentication service. 669 */ 670 struct timeval smb_auth_send_tmo = { 15, 0 }; 671 672 /* 673 * Maximum time a user object may stay in state LOGGING_ON 674 */ 675 int smb_auth_total_tmo = 45; /* seconds */ 676 677 static uint32_t 678 smb_authsock_open(smb_request_t *sr) 679 { 680 smb_user_t *user = sr->uid_user; 681 smb_server_t *sv = sr->sr_server; 682 ksocket_t so = NULL; 683 uint32_t status = 0; 684 int rc; 685 686 /* 687 * If the auth. service is busy, wait our turn. This threshold 688 * limits the number of auth sockets we might have trying to 689 * communicate with the auth. service up in smbd. Until we've 690 * set u_authsock, we need to "exit this threshold" in any 691 * error code paths after this "enter". 692 * 693 * Failure to "enter" may be frequent, so don't log. 694 */ 695 if ((rc = smb_threshold_enter(&sv->sv_ssetup_ct)) != 0) 696 return (NT_STATUS_NO_LOGON_SERVERS); 697 698 rc = ksocket_socket(&so, AF_UNIX, SOCK_STREAM, 0, 699 KSOCKET_SLEEP, CRED()); 700 if (rc != 0) { 701 cmn_err(CE_NOTE, "smb_authsock_open: socket, rc=%d", rc); 702 smb_threshold_exit(&sv->sv_ssetup_ct); 703 status = NT_STATUS_INSUFF_SERVER_RESOURCES; 704 goto errout; 705 } 706 707 /* 708 * This (new) user object now gets an authsocket. 709 * Note: u_authsock cleanup in smb_user_logoff. 710 * After we've set u_authsock, smb_threshold_exit 711 * is done in smb_authsock_close(). If we somehow 712 * already have an authsock, close the new one and 713 * error out. 714 */ 715 mutex_enter(&user->u_mutex); 716 if (user->u_authsock != NULL) { 717 mutex_exit(&user->u_mutex); 718 smb_authsock_close(user, so); 719 status = NT_STATUS_INTERNAL_ERROR; 720 goto errout; 721 } 722 user->u_authsock = so; 723 if (smb_auth_total_tmo != 0) { 724 user->u_auth_tmo = timeout(smb_user_auth_tmo, user, 725 SEC_TO_TICK(smb_auth_total_tmo)); 726 } 727 mutex_exit(&user->u_mutex); 728 729 /* 730 * Set the send/recv timeouts. 731 */ 732 (void) ksocket_setsockopt(so, SOL_SOCKET, SO_SNDTIMEO, 733 &smb_auth_send_tmo, sizeof (smb_auth_send_tmo), CRED()); 734 (void) ksocket_setsockopt(so, SOL_SOCKET, SO_RCVTIMEO, 735 &smb_auth_recv_tmo, sizeof (smb_auth_recv_tmo), CRED()); 736 737 /* 738 * Connect to the smbd auth. service. 739 * 740 * Would like to set the connect timeout too, but there's 741 * apparently no easy way to do that for AF_UNIX. 742 */ 743 mutex_enter(&sr->sr_mutex); 744 if (sr->sr_state != SMB_REQ_STATE_ACTIVE) { 745 mutex_exit(&sr->sr_mutex); 746 status = NT_STATUS_CANCELLED; 747 goto errout; 748 } 749 sr->sr_state = SMB_REQ_STATE_WAITING_AUTH; 750 sr->cancel_method = smb_authsock_cancel; 751 sr->cancel_arg2 = user; 752 mutex_exit(&sr->sr_mutex); 753 754 rc = ksocket_connect(so, (struct sockaddr *)&smbauth_sockname, 755 sizeof (smbauth_sockname), CRED()); 756 if (rc != 0) { 757 DTRACE_PROBE1(error, int, rc); 758 status = NT_STATUS_NETLOGON_NOT_STARTED; 759 } 760 761 mutex_enter(&sr->sr_mutex); 762 sr->cancel_method = NULL; 763 sr->cancel_arg2 = NULL; 764 switch (sr->sr_state) { 765 case SMB_REQ_STATE_WAITING_AUTH: 766 sr->sr_state = SMB_REQ_STATE_ACTIVE; 767 break; 768 case SMB_REQ_STATE_CANCEL_PENDING: 769 sr->sr_state = SMB_REQ_STATE_CANCELLED; 770 status = NT_STATUS_CANCELLED; 771 break; 772 default: 773 status = NT_STATUS_INTERNAL_ERROR; 774 break; 775 } 776 mutex_exit(&sr->sr_mutex); 777 778 errout: 779 return (status); 780 } 781 782 static int 783 smb_authsock_send(ksocket_t so, void *buf, size_t len) 784 { 785 int rc; 786 size_t iocnt = 0; 787 788 rc = ksocket_send(so, buf, len, 0, &iocnt, CRED()); 789 if (rc == 0 && iocnt != len) { 790 DTRACE_PROBE1(short, size_t, iocnt); 791 rc = EIO; 792 } 793 if (rc != 0) { 794 DTRACE_PROBE1(error, int, rc); 795 } 796 797 return (rc); 798 } 799 800 static int 801 smb_authsock_recv(ksocket_t so, void *buf, size_t len) 802 { 803 int rc; 804 size_t iocnt = 0; 805 806 rc = ksocket_recv(so, buf, len, MSG_WAITALL, &iocnt, CRED()); 807 if (rc == 0) { 808 if (iocnt == 0) { 809 DTRACE_PROBE1(discon, struct sonode *, so); 810 rc = ENOTCONN; 811 } else if (iocnt != len) { 812 /* Should not happen with MSG_WAITALL */ 813 DTRACE_PROBE1(short, size_t, iocnt); 814 rc = EIO; 815 } 816 } 817 if (rc != 0) { 818 DTRACE_PROBE1(error, int, rc); 819 } 820 821 return (rc); 822 } 823 824 /* 825 * Caller has cleared user->u_authsock, passing the last ref 826 * as the 2nd arg here. This can block, so it's called 827 * after exiting u_mutex. 828 */ 829 void 830 smb_authsock_close(smb_user_t *user, ksocket_t so) 831 { 832 833 (void) ksocket_shutdown(so, SHUT_RDWR, CRED()); 834 (void) ksocket_close(so, CRED()); 835 smb_threshold_exit(&user->u_server->sv_ssetup_ct); 836 } 837