1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22/*
23 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
25 */
26
27/*
28 * SMB requests.
29 *
30 * Request
31 *   Header
32 *	Magic		0xFF 'S' 'M' 'B'
33 *	smb_com 	a byte, the "first" command
34 *	Error		a 4-byte union, ignored in a request
35 *	smb_flg		a one byte set of eight flags
36 *	smb_flg2	a two byte set of 16 flags
37 *	.		twelve reserved bytes, have a role
38 *			in connectionless transports (IPX, UDP?)
39 *	smb_tid		a 16-bit tree ID, a mount point sorta,
40 *			0xFFFF is this command does not have
41 *			or require a tree context
42 *	smb_pid		a 16-bit process ID
43 *	smb_uid		a 16-bit user ID, specific to this "session"
44 *			and mapped to a system (bona-fide) UID
45 *	smb_mid		a 16-bit multiplex ID, used to differentiate
46 *			multiple simultaneous requests from the same
47 *			process (pid) (ref RPC "xid")
48 *
49 *   Chained (AndX) commands (0 or more)
50 *	smb_wct		a byte, number of 16-bit words containing
51 *			command parameters, min 2 for chained command
52 *	andx_com	a byte, the "next" command, 0xFF for none
53 *	.		an unused byte
54 *	andx_off	a 16-bit offset, byte displacement from &Magic
55 *			to the smb_wct field of the "next" command,
56 *			ignore if andx_com is 0xFF, s/b 0 if no next
57 *	smb_vwv[]	0 or more 16-bit (sorta) parameters for
58 *			"this" command (i.e. smb_com if this is the
59 *			first parameters, or the andx_com of the just
60 *			previous block.
61 *	smb_bcc		a 16-bit count of smb_data[] bytes
62 *	smb_data[]	0 or more bytes, format specific to commands
63 *	padding[]	Optional padding
64 *
65 *   Last command
66 *	smb_wct		a byte, number of 16-bit words containing
67 *			command parameters, min 0 for chained command
68 *	smb_vwv[]	0 or more 16-bit (sorta) parameters for
69 *			"this" command (i.e. smb_com if this is the
70 *			first parameters, or the andx_com of the just
71 *			previous block.
72 *	smb_bcc		a 16-bit count of smb_data[] bytes
73 *	smb_data[]	0 or more bytes, format specific to commands
74 *
75 * Reply
76 *   Header
77 *	Magic		0xFF 'S' 'M' 'B'
78 *	smb_com 	a byte, the "first" command, corresponds
79 *			to request
80 *	Error		a 4-byte union, coding depends on dialect in use
81 *			for "DOS" errors
82 *				a byte for error class
83 *				an unused byte
84 *				a 16-bit word for error code
85 *			for "NT" errors
86 *				a 32-bit error code which
87 *				is a packed class and specifier
88 *			for "OS/2" errors
89 *				I don't know
90 *			The error information is specific to the
91 *			last command in the reply chain.
92 *	smb_flg		a one byte set of eight flags, 0x80 bit set
93 *			indicating this message is a reply
94 *	smb_flg2	a two byte set of 16 flags
95 *	.		twelve reserved bytes, have a role
96 *			in connectionless transports (IPX, UDP?)
97 *	smb_tid		a 16-bit tree ID, a mount point sorta,
98 *			should be the same as the request
99 *	smb_pid		a 16-bit process ID, MUST BE the same as request
100 *	smb_uid		a 16-bit user ID, specific to this "session"
101 *			and mapped to a system (bona-fide) UID,
102 *			should be the same as request
103 *	smb_mid		a 16-bit multiplex ID, used to differentiate
104 *			multiple simultaneous requests from the same
105 *			process (pid) (ref RPC "xid"), MUST BE the
106 *			same as request
107 *	padding[]	Optional padding
108 *
109 *   Chained (AndX) commands (0 or more)
110 *	smb_wct		a byte, number of 16-bit words containing
111 *			command parameters, min 2 for chained command,
112 *	andx_com	a byte, the "next" command, 0xFF for none,
113 *			corresponds to request, if this is the chained
114 *			command that had an error set to 0xFF
115 *	.		an unused byte
116 *	andx_off	a 16-bit offset, byte displacement from &Magic
117 *			to the smb_wct field of the "next" command,
118 *			ignore if andx_com is 0xFF, s/b 0 if no next
119 *	smb_vwv[]	0 or more 16-bit (sorta) parameters for
120 *			"this" command (i.e. smb_com if this is the
121 *			first parameters, or the andx_com of the just
122 *			previous block. Empty if an error.
123 *	smb_bcc		a 16-bit count of smb_data[] bytes
124 *	smb_data[]	0 or more bytes, format specific to commands
125 *			empty if an error.
126 *
127 *   Last command
128 *	smb_wct		a byte, number of 16-bit words containing
129 *			command parameters, min 0 for chained command
130 *	smb_vwv[]	0 or more 16-bit (sorta) parameters for
131 *			"this" command (i.e. smb_com if this is the
132 *			first parameters, or the andx_com of the just
133 *			previous block, empty if an error.
134 *	smb_bcc		a 16-bit count of smb_data[] bytes
135 *	smb_data[]	0 or more bytes, format specific to commands,
136 *			empty if an error.
137 */
138
139#include <smbsrv/smb_kproto.h>
140#include <smbsrv/smb_kstat.h>
141#include <sys/sdt.h>
142#include <sys/spl.h>
143
144static int is_andx_com(unsigned char);
145static int smbsr_check_result(struct smb_request *, int, int);
146static void smb1_tq_work(void *);
147
148static const smb_disp_entry_t
149smb_disp_table[SMB_COM_NUM] = {
150	{ "SmbCreateDirectory", SMB_SDT_OPS(create_directory),  /* 0x00 000 */
151	    0x00, PC_NETWORK_PROGRAM_1_0 },
152	{ "SmbDeleteDirectory", SMB_SDT_OPS(delete_directory),	/* 0x01 001 */
153	    0x01, PC_NETWORK_PROGRAM_1_0 },
154	{ "SmbOpen", SMB_SDT_OPS(open),				/* 0x02 002 */
155	    0x02, PC_NETWORK_PROGRAM_1_0 },
156	{ "SmbCreate", SMB_SDT_OPS(create),			/* 0x03 003 */
157	    0x03, PC_NETWORK_PROGRAM_1_0 },
158	{ "SmbClose", SMB_SDT_OPS(close),			/* 0x04 004 */
159	    0x04, PC_NETWORK_PROGRAM_1_0 },
160	{ "SmbFlush", SMB_SDT_OPS(flush),			/* 0x05 005 */
161	    0x05, PC_NETWORK_PROGRAM_1_0 },
162	{ "SmbDelete", SMB_SDT_OPS(delete),			/* 0x06 006 */
163	    0x06, PC_NETWORK_PROGRAM_1_0 },
164	{ "SmbRename", SMB_SDT_OPS(rename),			/* 0x07 007 */
165	    0x07, PC_NETWORK_PROGRAM_1_0 },
166	{ "SmbQueryInformation", SMB_SDT_OPS(query_information), /* 0x08 008 */
167	    0x08, PC_NETWORK_PROGRAM_1_0 },
168	{ "SmbSetInformation", SMB_SDT_OPS(set_information),	/* 0x09 009 */
169	    0x09, PC_NETWORK_PROGRAM_1_0 },
170	{ "SmbRead", SMB_SDT_OPS(read),				/* 0x0A 010 */
171	    0x0A, PC_NETWORK_PROGRAM_1_0 },
172	{ "SmbWrite", SMB_SDT_OPS(write),			/* 0x0B 011 */
173	    0x0B, PC_NETWORK_PROGRAM_1_0 },
174	{ "SmbLockByteRange", SMB_SDT_OPS(lock_byte_range),	/* 0x0C 012 */
175	    0x0C, PC_NETWORK_PROGRAM_1_0 },
176	{ "SmbUnlockByteRange", SMB_SDT_OPS(unlock_byte_range),	/* 0x0D 013 */
177	    0x0D, PC_NETWORK_PROGRAM_1_0 },
178	{ "SmbCreateTemporary", SMB_SDT_OPS(create_temporary),	/* 0x0E 014 */
179	    0x0E, PC_NETWORK_PROGRAM_1_0 },
180	{ "SmbCreateNew", SMB_SDT_OPS(create_new),		/* 0x0F 015 */
181	    0x0F, PC_NETWORK_PROGRAM_1_0 },
182	{ "SmbCheckDirectory", SMB_SDT_OPS(check_directory),	/* 0x10 016 */
183	    0x10, PC_NETWORK_PROGRAM_1_0 },
184	{ "SmbProcessExit", SMB_SDT_OPS(process_exit),		/* 0x11 017 */
185	    0x11, PC_NETWORK_PROGRAM_1_0,
186	    SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
187	{ "SmbSeek", SMB_SDT_OPS(seek),				/* 0x12 018 */
188	    0x12, PC_NETWORK_PROGRAM_1_0 },
189	{ "SmbLockAndRead", SMB_SDT_OPS(lock_and_read),		/* 0x13 019 */
190	    0x13, LANMAN1_0 },
191	{ "SmbWriteAndUnlock", SMB_SDT_OPS(write_and_unlock),	/* 0x14 020 */
192	    0x14, LANMAN1_0 },
193	{ "Invalid", SMB_SDT_OPS(invalid), 0x15, 0 },		/* 0x15	021 */
194	{ "Invalid", SMB_SDT_OPS(invalid), 0x16, 0 },		/* 0x16 022 */
195	{ "Invalid", SMB_SDT_OPS(invalid), 0x17, 0 },		/* 0x17 023 */
196	{ "Invalid", SMB_SDT_OPS(invalid), 0x18, 0 },		/* 0x18 024 */
197	{ "Invalid", SMB_SDT_OPS(invalid), 0x19, 0 },		/* 0x19 025 */
198	{ "SmbReadRaw", SMB_SDT_OPS(read_raw),			/* 0x1A 026 */
199	    0x1A, LANMAN1_0 },
200	{ "Invalid", SMB_SDT_OPS(invalid), 0x1B, 0 },		/* 0x1B 027 */
201	{ "Invalid", SMB_SDT_OPS(invalid), 0x1C, 0 },		/* 0x1C 028 */
202	{ "SmbWriteRaw", SMB_SDT_OPS(write_raw),		/* 0x1D 029 */
203	    0x1D, LANMAN1_0 },
204	{ "Invalid", SMB_SDT_OPS(invalid), 0x1E, 0 },		/* 0x1E 030 */
205	{ "Invalid", SMB_SDT_OPS(invalid), 0x1F, 0 },		/* 0x1F 031 */
206	{ "Invalid", SMB_SDT_OPS(invalid), 0x20, 0 },		/* 0x20 032 */
207	{ "Invalid", SMB_SDT_OPS(invalid), 0x21, 0 },		/* 0x21 033 */
208	{ "SmbSetInformation2", SMB_SDT_OPS(set_information2),	/* 0x22 034 */
209	    0x22, LANMAN1_0 },
210	{ "SmbQueryInformation2",
211	    SMB_SDT_OPS(query_information2),			/* 0x23 035 */
212	    0x23, LANMAN1_0 },
213	{ "SmbLockingX", SMB_SDT_OPS(locking_andx),		/* 0x24 036 */
214	    0x24, LANMAN1_0 },
215	{ "SmbTransaction", SMB_SDT_OPS(transaction),		/* 0x25 037 */
216	    0x25, LANMAN1_0 },
217	{ "SmbTransactionSecondary",
218	    SMB_SDT_OPS(transaction_secondary),			/* 0x26 038 */
219	    0x26, LANMAN1_0 },
220	{ "SmbIoctl", SMB_SDT_OPS(ioctl),			/* 0x27 039 */
221	    0x27, LANMAN1_0 },
222	{ "Invalid", SMB_SDT_OPS(invalid), 0x28, 0 },	/* 0x28 040 */
223	{ "Invalid", SMB_SDT_OPS(invalid), 0x29, 0 },	/* 0x29 041 */
224	{ "Invalid", SMB_SDT_OPS(invalid), 0x2A, 0 },	/* 0x2A 042 */
225	{ "SmbEcho", SMB_SDT_OPS(echo),				/* 0x2B 043 */
226	    0x2B, LANMAN1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
227	{ "SmbWriteAndClose", SMB_SDT_OPS(write_and_close),	/* 0x2C 044 */
228	    0x2C, LANMAN1_0 },
229	{ "SmbOpenX", SMB_SDT_OPS(open_andx),			/* 0x2D 045 */
230	    0x2D, LANMAN1_0 },
231	{ "SmbReadX", SMB_SDT_OPS(read_andx),			/* 0x2E 046 */
232	    0x2E, LANMAN1_0 },
233	{ "SmbWriteX", SMB_SDT_OPS(write_andx),			/* 0x2F 047 */
234	    0x2F, LANMAN1_0 },
235	{ "Invalid", SMB_SDT_OPS(invalid), 0x30, 0 },	/* 0x30 048 */
236	{ "SmbCloseAndTreeDisconnect",
237	    SMB_SDT_OPS(close_and_tree_disconnect),		/* 0x31 049 */
238	    0x31, LANMAN1_0 },
239	{ "SmbTransaction2", SMB_SDT_OPS(transaction2),		/* 0x32 050 */
240	    0x32, LM1_2X002 },
241	{ "SmbTransaction2Secondary",
242	    SMB_SDT_OPS(transaction2_secondary),		/* 0x33 051 */
243	    0x33, LM1_2X002 },
244	{ "SmbFindClose2", SMB_SDT_OPS(find_close2),		/* 0x34 052 */
245	    0x34, LM1_2X002 },
246	{ "Invalid", SMB_SDT_OPS(invalid), 0x35, 0 },	/* 0x35 053 */
247	{ "Invalid", SMB_SDT_OPS(invalid), 0x36, 0 },	/* 0x36 054 */
248	{ "Invalid", SMB_SDT_OPS(invalid), 0x37, 0 },	/* 0x37 055 */
249	{ "Invalid", SMB_SDT_OPS(invalid), 0x38, 0 },	/* 0x38 056 */
250	{ "Invalid", SMB_SDT_OPS(invalid), 0x39, 0 },	/* 0x39 057 */
251	{ "Invalid", SMB_SDT_OPS(invalid), 0x3A, 0 },	/* 0x3A 058 */
252	{ "Invalid", SMB_SDT_OPS(invalid), 0x3B, 0 },	/* 0x3B 059 */
253	{ "Invalid", SMB_SDT_OPS(invalid), 0x3C, 0 },	/* 0x3C 060 */
254	{ "Invalid", SMB_SDT_OPS(invalid), 0x3D, 0 },	/* 0x3D 061 */
255	{ "Invalid", SMB_SDT_OPS(invalid), 0x3E, 0 },	/* 0x3E 062 */
256	{ "Invalid", SMB_SDT_OPS(invalid), 0x3F, 0 },	/* 0x3F 063 */
257	{ "Invalid", SMB_SDT_OPS(invalid), 0x40, 0 },	/* 0x40 064 */
258	{ "Invalid", SMB_SDT_OPS(invalid), 0x47, 0 },	/* 0x47 065 */
259	{ "Invalid", SMB_SDT_OPS(invalid), 0x48, 0 },	/* 0x48 066 */
260	{ "Invalid", SMB_SDT_OPS(invalid), 0x49, 0 },	/* 0x49 067 */
261	{ "Invalid", SMB_SDT_OPS(invalid), 0x44, 0 },	/* 0x44 068 */
262	{ "Invalid", SMB_SDT_OPS(invalid), 0x45, 0 },	/* 0x45 069 */
263	{ "Invalid", SMB_SDT_OPS(invalid), 0x46, 0 },	/* 0x46 070 */
264	{ "Invalid", SMB_SDT_OPS(invalid), 0x47, 0 },	/* 0x47 071 */
265	{ "Invalid", SMB_SDT_OPS(invalid), 0x48, 0 },	/* 0x48 072 */
266	{ "Invalid", SMB_SDT_OPS(invalid), 0x49, 0 },	/* 0x49 073 */
267	{ "Invalid", SMB_SDT_OPS(invalid), 0x4A, 0 },	/* 0x4A 074 */
268	{ "Invalid", SMB_SDT_OPS(invalid), 0x4B, 0 },	/* 0x4B 075 */
269	{ "Invalid", SMB_SDT_OPS(invalid), 0x4C, 0 },	/* 0x4C 076 */
270	{ "Invalid", SMB_SDT_OPS(invalid), 0x4D, 0 },	/* 0x4D 077 */
271	{ "Invalid", SMB_SDT_OPS(invalid), 0x4E, 0 },	/* 0x4E 078 */
272	{ "Invalid", SMB_SDT_OPS(invalid), 0x4F, 0 },	/* 0x4F 079 */
273	{ "Invalid", SMB_SDT_OPS(invalid), 0x50, 0 },	/* 0x50 080 */
274	{ "Invalid", SMB_SDT_OPS(invalid), 0x51, 0 },	/* 0x51 081 */
275	{ "Invalid", SMB_SDT_OPS(invalid), 0x52, 0 },	/* 0x52 082 */
276	{ "Invalid", SMB_SDT_OPS(invalid), 0x53, 0 },	/* 0x53 083 */
277	{ "Invalid", SMB_SDT_OPS(invalid), 0x54, 0 },	/* 0x54 084 */
278	{ "Invalid", SMB_SDT_OPS(invalid), 0x55, 0 },	/* 0x55 085 */
279	{ "Invalid", SMB_SDT_OPS(invalid), 0x56, 0 },	/* 0x56 086 */
280	{ "Invalid", SMB_SDT_OPS(invalid), 0x57, 0 },	/* 0x57 087 */
281	{ "Invalid", SMB_SDT_OPS(invalid), 0x58, 0 },	/* 0x58 088 */
282	{ "Invalid", SMB_SDT_OPS(invalid), 0x59, 0 },	/* 0x59 089 */
283	{ "Invalid", SMB_SDT_OPS(invalid), 0x5A, 0 },	/* 0x5A 090 */
284	{ "Invalid", SMB_SDT_OPS(invalid), 0x5B, 0 },	/* 0x5B 091 */
285	{ "Invalid", SMB_SDT_OPS(invalid), 0x5C, 0 },	/* 0x5C 092 */
286	{ "Invalid", SMB_SDT_OPS(invalid), 0x5D, 0 },	/* 0x5D 093 */
287	{ "Invalid", SMB_SDT_OPS(invalid), 0x5E, 0 },	/* 0x5E 094 */
288	{ "Invalid", SMB_SDT_OPS(invalid), 0x5F, 0 },	/* 0x5F 095 */
289	{ "Invalid", SMB_SDT_OPS(invalid), 0x60, 0 },	/* 0x60 096 */
290	{ "Invalid", SMB_SDT_OPS(invalid), 0x61, 0 },	/* 0x61 097 */
291	{ "Invalid", SMB_SDT_OPS(invalid), 0x62, 0 },	/* 0x62 098 */
292	{ "Invalid", SMB_SDT_OPS(invalid), 0x63, 0 },	/* 0x63 099 */
293	{ "Invalid", SMB_SDT_OPS(invalid), 0x64, 0 },	/* 0x64 100 */
294	{ "Invalid", SMB_SDT_OPS(invalid), 0x65, 0 },	/* 0x65 101 */
295	{ "Invalid", SMB_SDT_OPS(invalid), 0x66, 0 },	/* 0x66 102 */
296	{ "Invalid", SMB_SDT_OPS(invalid), 0x67, 0 },	/* 0x67 103 */
297	{ "Invalid", SMB_SDT_OPS(invalid), 0x68, 0 },	/* 0x68 104 */
298	{ "Invalid", SMB_SDT_OPS(invalid), 0x69, 0 },	/* 0x69 105 */
299	{ "Invalid", SMB_SDT_OPS(invalid), 0x6A, 0 },	/* 0x6A 106 */
300	{ "Invalid", SMB_SDT_OPS(invalid), 0x6B, 0 },	/* 0x6B 107 */
301	{ "Invalid", SMB_SDT_OPS(invalid), 0x6C, 0 },	/* 0x6C 108 */
302	{ "Invalid", SMB_SDT_OPS(invalid), 0x6D, 0 },	/* 0x6D 109 */
303	{ "Invalid", SMB_SDT_OPS(invalid), 0x6E, 0 },	/* 0x6E 110 */
304	{ "Invalid", SMB_SDT_OPS(invalid), 0x6F, 0 },	/* 0x6F 111 */
305	{ "SmbTreeConnect", SMB_SDT_OPS(tree_connect),		/* 0x70 112 */
306	    0x70, PC_NETWORK_PROGRAM_1_0, SDDF_SUPPRESS_TID },
307	{ "SmbTreeDisconnect", SMB_SDT_OPS(tree_disconnect),	/* 0x71 113 */
308	    0x71, PC_NETWORK_PROGRAM_1_0,
309	    SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
310	/*
311	 * NB: Negotiate gets special handling via
312	 * smb_initial_request_handler.  After that,
313	 * another Negotiate is an invalid request.
314	 */
315	{ "SmbNegotiate", SMB_SDT_OPS(invalid),			/* 0x72 114 */
316	    0x72, PC_NETWORK_PROGRAM_1_0,
317	    SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
318	{ "SmbSessionSetupX", SMB_SDT_OPS(session_setup_andx),	/* 0x73 115 */
319	    0x73, LANMAN1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
320	{ "SmbLogoffX", SMB_SDT_OPS(logoff_andx),		/* 0x74 116 */
321	    0x74, LM1_2X002, SDDF_SUPPRESS_TID },
322	{ "SmbTreeConnectX", SMB_SDT_OPS(tree_connect_andx),	/* 0x75 117 */
323	    0x75, LANMAN1_0, SDDF_SUPPRESS_TID },
324	{ "Invalid", SMB_SDT_OPS(invalid), 0x76, 0, 0 },	/* 0x76 118 */
325	{ "Invalid", SMB_SDT_OPS(invalid), 0x77, 0, 0 },	/* 0x77 119 */
326	{ "Invalid", SMB_SDT_OPS(invalid), 0x78, 0, 0 },	/* 0x78 120 */
327	{ "Invalid", SMB_SDT_OPS(invalid), 0x79, 0, 0 },	/* 0x79 121 */
328	{ "Invalid", SMB_SDT_OPS(invalid), 0x7A, 0, 0 },	/* 0x7A 122 */
329	{ "Invalid", SMB_SDT_OPS(invalid), 0x7B, 0, 0 },	/* 0x7B 123 */
330	{ "Invalid", SMB_SDT_OPS(invalid), 0x7C, 0, 0 },	/* 0x7C 124 */
331	{ "Invalid", SMB_SDT_OPS(invalid), 0x7D, 0, 0 },	/* 0x7D 125 */
332	{ "Invalid", SMB_SDT_OPS(invalid), 0x7E, 0, 0 },	/* 0x7E 126 */
333	{ "Invalid", SMB_SDT_OPS(invalid), 0x7F, 0, 0 },	/* 0x7F 127 */
334	{ "SmbQueryInformationDisk",
335	    SMB_SDT_OPS(query_information_disk),		/* 0x80 128 */
336	    0x80, PC_NETWORK_PROGRAM_1_0, 0 },
337	{ "SmbSearch", SMB_SDT_OPS(search),			/* 0x81 129 */
338	    0x81, PC_NETWORK_PROGRAM_1_0, 0 },
339	{ "SmbFind", SMB_SDT_OPS(find),				/* 0x82 130 */
340	    0x82, LANMAN1_0, 0 },
341	{ "SmbFindUnique", SMB_SDT_OPS(find_unique),		/* 0x83 131 */
342	    0x83, LANMAN1_0, 0 },
343	{ "SmbFindClose", SMB_SDT_OPS(find_close),		/* 0x84 132 */
344	    0x84, LANMAN1_0, 0 },
345	{ "Invalid", SMB_SDT_OPS(invalid), 0x85, 0, 0 },	/* 0x85 133 */
346	{ "Invalid", SMB_SDT_OPS(invalid), 0x86, 0, 0 },	/* 0x86 134 */
347	{ "Invalid", SMB_SDT_OPS(invalid), 0x87, 0, 0 },	/* 0x87 135 */
348	{ "Invalid", SMB_SDT_OPS(invalid), 0x88, 0, 0 },	/* 0x88 136 */
349	{ "Invalid", SMB_SDT_OPS(invalid), 0x89, 0, 0 },	/* 0x89 137 */
350	{ "Invalid", SMB_SDT_OPS(invalid), 0x8A, 0, 0 },	/* 0x8A 138 */
351	{ "Invalid", SMB_SDT_OPS(invalid), 0x8B, 0, 0 },	/* 0x8B 139 */
352	{ "Invalid", SMB_SDT_OPS(invalid), 0x8C, 0, 0 },	/* 0x8C 140 */
353	{ "Invalid", SMB_SDT_OPS(invalid), 0x8D, 0, 0 },	/* 0x8D 141 */
354	{ "Invalid", SMB_SDT_OPS(invalid), 0x8E, 0, 0 },	/* 0x8E 142 */
355	{ "Invalid", SMB_SDT_OPS(invalid), 0x8F, 0, 0 },	/* 0x8F 143 */
356	{ "Invalid", SMB_SDT_OPS(invalid), 0x90, 0, 0 },	/* 0x90 144 */
357	{ "Invalid", SMB_SDT_OPS(invalid), 0x91, 0, 0 },	/* 0x91 145 */
358	{ "Invalid", SMB_SDT_OPS(invalid), 0x92, 0, 0 },	/* 0x92 146 */
359	{ "Invalid", SMB_SDT_OPS(invalid), 0x93, 0, 0 },	/* 0x93 147 */
360	{ "Invalid", SMB_SDT_OPS(invalid), 0x94, 0, 0 },	/* 0x94 148 */
361	{ "Invalid", SMB_SDT_OPS(invalid), 0x95, 0, 0 },	/* 0x95 149 */
362	{ "Invalid", SMB_SDT_OPS(invalid), 0x96, 0, 0 },	/* 0x96 150 */
363	{ "Invalid", SMB_SDT_OPS(invalid), 0x97, 0, 0 },	/* 0x97 151 */
364	{ "Invalid", SMB_SDT_OPS(invalid), 0x98, 0, 0 },	/* 0x98 152 */
365	{ "Invalid", SMB_SDT_OPS(invalid), 0x99, 0, 0 },	/* 0x99 153 */
366	{ "Invalid", SMB_SDT_OPS(invalid), 0x9A, 0, 0 },	/* 0x9A 154 */
367	{ "Invalid", SMB_SDT_OPS(invalid), 0x9B, 0, 0 },	/* 0x9B 155 */
368	{ "Invalid", SMB_SDT_OPS(invalid), 0x9C, 0, 0 },	/* 0x9C 156 */
369	{ "Invalid", SMB_SDT_OPS(invalid), 0x9D, 0, 0 },	/* 0x9D 157 */
370	{ "Invalid", SMB_SDT_OPS(invalid), 0x9E, 0, 0 },	/* 0x9E 158 */
371	{ "Invalid", SMB_SDT_OPS(invalid), 0x9F, 0, 0 },	/* 0x9F 159 */
372	{ "SmbNtTransact", SMB_SDT_OPS(nt_transact),	/* 0xA0 160 */
373	    0xA0, NT_LM_0_12, 0 },
374	{ "SmbNtTransactSecondary",
375	    SMB_SDT_OPS(nt_transact_secondary),			/* 0xA1 161 */
376	    0xA1, NT_LM_0_12, 0 },
377	{ "SmbNtCreateX", SMB_SDT_OPS(nt_create_andx),		/* 0xA2 162 */
378	    0xA2, NT_LM_0_12, 0 },
379	{ "Invalid", SMB_SDT_OPS(invalid), 0xA3, 0, 0 },	/* 0xA3 163 */
380	{ "SmbNtCancel", SMB_SDT_OPS(nt_cancel),		/* 0xA4 164 */
381	    0xA4, NT_LM_0_12, 0 },
382	{ "SmbNtRename", SMB_SDT_OPS(nt_rename),		/* 0xA5 165 */
383	    0xA5, NT_LM_0_12, 0 },
384	{ "Invalid", SMB_SDT_OPS(invalid), 0xA6, 0, 0 },	/* 0xA6 166 */
385	{ "Invalid", SMB_SDT_OPS(invalid), 0xA7, 0, 0 },	/* 0xA7 167 */
386	{ "Invalid", SMB_SDT_OPS(invalid), 0xA8, 0, 0 },	/* 0xA8 168 */
387	{ "Invalid", SMB_SDT_OPS(invalid), 0xA9, 0, 0 },	/* 0xA9 169 */
388	{ "Invalid", SMB_SDT_OPS(invalid), 0xAA, 0, 0 },	/* 0xAA 170 */
389	{ "Invalid", SMB_SDT_OPS(invalid), 0xAB, 0, 0 },	/* 0xAB 171 */
390	{ "Invalid", SMB_SDT_OPS(invalid), 0xAC, 0, 0 },	/* 0xAC 172 */
391	{ "Invalid", SMB_SDT_OPS(invalid), 0xAD, 0, 0 },	/* 0xAD 173 */
392	{ "Invalid", SMB_SDT_OPS(invalid), 0xAE, 0, 0 },	/* 0xAE 174 */
393	{ "Invalid", SMB_SDT_OPS(invalid), 0xAF, 0, 0 },	/* 0xAF 175 */
394	{ "Invalid", SMB_SDT_OPS(invalid), 0xB0, 0, 0 },	/* 0xB0 176 */
395	{ "Invalid", SMB_SDT_OPS(invalid), 0xB1, 0, 0 },	/* 0xB1 177 */
396	{ "Invalid", SMB_SDT_OPS(invalid), 0xB2, 0, 0 },	/* 0xB2 178 */
397	{ "Invalid", SMB_SDT_OPS(invalid), 0xB3, 0, 0 },	/* 0xB3 179 */
398	{ "Invalid", SMB_SDT_OPS(invalid), 0xB4, 0, 0 },	/* 0xB4 180 */
399	{ "Invalid", SMB_SDT_OPS(invalid), 0xB5, 0, 0 },	/* 0xB5 181 */
400	{ "Invalid", SMB_SDT_OPS(invalid), 0xB6, 0, 0 },	/* 0xB6 182 */
401	{ "Invalid", SMB_SDT_OPS(invalid), 0xB7, 0, 0 },	/* 0xB7 183 */
402	{ "Invalid", SMB_SDT_OPS(invalid), 0xB8, 0, 0 },	/* 0xB8 184 */
403	{ "Invalid", SMB_SDT_OPS(invalid), 0xB9, 0, 0 },	/* 0xB9 185 */
404	{ "Invalid", SMB_SDT_OPS(invalid), 0xBA, 0, 0 },	/* 0xBA 186 */
405	{ "Invalid", SMB_SDT_OPS(invalid), 0xBB, 0, 0 },	/* 0xBB 187 */
406	{ "Invalid", SMB_SDT_OPS(invalid), 0xBC, 0, 0 },	/* 0xBC 188 */
407	{ "Invalid", SMB_SDT_OPS(invalid), 0xBD, 0, 0 },	/* 0xBD 189 */
408	{ "Invalid", SMB_SDT_OPS(invalid), 0xBE, 0, 0 },	/* 0xBE 190 */
409	{ "Invalid", SMB_SDT_OPS(invalid), 0xBF, 0, 0 },	/* 0xBF 191 */
410	{ "SmbOpenPrintFile", SMB_SDT_OPS(open_print_file),	/* 0xC0 192 */
411	    0xC0, PC_NETWORK_PROGRAM_1_0, 0 },
412	{ "SmbWritePrintFile", SMB_SDT_OPS(write_print_file),	/* 0xC1 193 */
413	    0xC1, PC_NETWORK_PROGRAM_1_0, 0 },
414	{ "SmbClosePrintFile", SMB_SDT_OPS(close_print_file),	/* 0xC2 194 */
415	    0xC2, PC_NETWORK_PROGRAM_1_0, 0 },
416	{ "SmbGetPrintQueue", SMB_SDT_OPS(get_print_queue),	/* 0xC3 195 */
417	    0xC3, PC_NETWORK_PROGRAM_1_0, 0 },
418	{ "Invalid", SMB_SDT_OPS(invalid), 0xC4, 0, 0 },	/* 0xC4 196 */
419	{ "Invalid", SMB_SDT_OPS(invalid), 0xC5, 0, 0 },	/* 0xC5 197 */
420	{ "Invalid", SMB_SDT_OPS(invalid), 0xC6, 0, 0 },	/* 0xC6 198 */
421	{ "Invalid", SMB_SDT_OPS(invalid), 0xC7, 0, 0 },	/* 0xC7 199 */
422	{ "Invalid", SMB_SDT_OPS(invalid), 0xC8, 0, 0 },	/* 0xC8 200 */
423	{ "Invalid", SMB_SDT_OPS(invalid), 0xC9, 0, 0 },	/* 0xC9 201 */
424	{ "Invalid", SMB_SDT_OPS(invalid), 0xCA, 0, 0 },	/* 0xCA 202 */
425	{ "Invalid", SMB_SDT_OPS(invalid), 0xCB, 0, 0 },	/* 0xCB 203 */
426	{ "Invalid", SMB_SDT_OPS(invalid), 0xCC, 0, 0 },	/* 0xCC 204 */
427	{ "Invalid", SMB_SDT_OPS(invalid), 0xCD, 0, 0 },	/* 0xCD 205 */
428	{ "Invalid", SMB_SDT_OPS(invalid), 0xCE, 0, 0 },	/* 0xCE 206 */
429	{ "Invalid", SMB_SDT_OPS(invalid), 0xCF, 0, 0 },	/* 0xCF 207 */
430	{ "Invalid", SMB_SDT_OPS(invalid), 0xD0, 0, 0 },	/* 0xD0 208 */
431	{ "Invalid", SMB_SDT_OPS(invalid), 0xD1, 0, 0 },	/* 0xD1 209 */
432	{ "Invalid", SMB_SDT_OPS(invalid), 0xD2, 0, 0 },	/* 0xD2 210 */
433	{ "Invalid", SMB_SDT_OPS(invalid), 0xD3, 0, 0 },	/* 0xD3 211 */
434	{ "Invalid", SMB_SDT_OPS(invalid), 0xD4, 0, 0 },	/* 0xD4 212 */
435	{ "Invalid", SMB_SDT_OPS(invalid), 0xD5, 0, 0 },	/* 0xD5 213 */
436	{ "Invalid", SMB_SDT_OPS(invalid), 0xD6, 0, 0 },	/* 0xD6 214 */
437	{ "Invalid", SMB_SDT_OPS(invalid), 0xD7, 0, 0 },	/* 0xD7 215 */
438	{ "Invalid", SMB_SDT_OPS(invalid), 0xD8, 0, 0 },	/* 0xD8 216 */
439	{ "Invalid", SMB_SDT_OPS(invalid), 0xD9, 0, 0 },	/* 0xD9 217 */
440	{ "Invalid", SMB_SDT_OPS(invalid), 0xDA, 0, 0 },	/* 0xDA 218 */
441	{ "Invalid", SMB_SDT_OPS(invalid), 0xDB, 0, 0 },	/* 0xDB 219 */
442	{ "Invalid", SMB_SDT_OPS(invalid), 0xDC, 0, 0 },	/* 0xDC 220 */
443	{ "Invalid", SMB_SDT_OPS(invalid), 0xDD, 0, 0 },	/* 0xDD 221 */
444	{ "Invalid", SMB_SDT_OPS(invalid), 0xDE, 0, 0 },	/* 0xDE 222 */
445	{ "Invalid", SMB_SDT_OPS(invalid), 0xDF, 0, 0 },	/* 0xDF 223 */
446	{ "Invalid", SMB_SDT_OPS(invalid), 0xE0, 0, 0 },	/* 0xE0 224 */
447	{ "Invalid", SMB_SDT_OPS(invalid), 0xE1, 0, 0 },	/* 0xE1 225 */
448	{ "Invalid", SMB_SDT_OPS(invalid), 0xE2, 0, 0 },	/* 0xE2 226 */
449	{ "Invalid", SMB_SDT_OPS(invalid), 0xE3, 0, 0 },	/* 0xE3 227 */
450	{ "Invalid", SMB_SDT_OPS(invalid), 0xE4, 0, 0 },	/* 0xE4 228 */
451	{ "Invalid", SMB_SDT_OPS(invalid), 0xE5, 0, 0 },	/* 0xE5 229 */
452	{ "Invalid", SMB_SDT_OPS(invalid), 0xE6, 0, 0 },	/* 0xE6 230 */
453	{ "Invalid", SMB_SDT_OPS(invalid), 0xE7, 0, 0 },	/* 0xE7 231 */
454	{ "Invalid", SMB_SDT_OPS(invalid), 0xE8, 0, 0 },	/* 0xE8 232 */
455	{ "Invalid", SMB_SDT_OPS(invalid), 0xE9, 0, 0 },	/* 0xE9 233 */
456	{ "Invalid", SMB_SDT_OPS(invalid), 0xEA, 0, 0 },	/* 0xEA 234 */
457	{ "Invalid", SMB_SDT_OPS(invalid), 0xEB, 0, 0 },	/* 0xEB 235 */
458	{ "Invalid", SMB_SDT_OPS(invalid), 0xEC, 0, 0 },	/* 0xEC 236 */
459	{ "Invalid", SMB_SDT_OPS(invalid), 0xED, 0, 0 },	/* 0xED 237 */
460	{ "Invalid", SMB_SDT_OPS(invalid), 0xEE, 0, 0 },	/* 0xEE 238 */
461	{ "Invalid", SMB_SDT_OPS(invalid), 0xEF, 0, 0 },	/* 0xEF 239 */
462	{ "Invalid", SMB_SDT_OPS(invalid), 0xF0, 0, 0 },	/* 0xF0 240 */
463	{ "Invalid", SMB_SDT_OPS(invalid), 0xF1, 0, 0 },	/* 0xF1 241 */
464	{ "Invalid", SMB_SDT_OPS(invalid), 0xF2, 0, 0 },	/* 0xF2 242 */
465	{ "Invalid", SMB_SDT_OPS(invalid), 0xF3, 0, 0 },	/* 0xF3 243 */
466	{ "Invalid", SMB_SDT_OPS(invalid), 0xF4, 0, 0 },	/* 0xF4 244 */
467	{ "Invalid", SMB_SDT_OPS(invalid), 0xF5, 0, 0 },	/* 0xF5 245 */
468	{ "Invalid", SMB_SDT_OPS(invalid), 0xF6, 0, 0 },	/* 0xF6 246 */
469	{ "Invalid", SMB_SDT_OPS(invalid), 0xF7, 0, 0 },	/* 0xF7 247 */
470	{ "Invalid", SMB_SDT_OPS(invalid), 0xF8, 0, 0 },	/* 0xF8 248 */
471	{ "Invalid", SMB_SDT_OPS(invalid), 0xF9, 0, 0 },	/* 0xF9 249 */
472	{ "Invalid", SMB_SDT_OPS(invalid), 0xFA, 0, 0 },	/* 0xFA 250 */
473	{ "Invalid", SMB_SDT_OPS(invalid), 0xFB, 0, 0 },	/* 0xFB 251 */
474	{ "Invalid", SMB_SDT_OPS(invalid), 0xFC, 0, 0 },	/* 0xFC 252 */
475	{ "Invalid", SMB_SDT_OPS(invalid), 0xFD, 0, 0 },	/* 0xFD 253 */
476	{ "Invalid", SMB_SDT_OPS(invalid), 0xFE, 0, 0 },	/* 0xFE 254 */
477	{ "Invalid", SMB_SDT_OPS(invalid), 0xFF, 0, 0 }	/* 0xFF	255 */
478};
479
480/*
481 * smbsr_cleanup
482 *
483 * If any user/tree/file is used by given request then
484 * the reference count for that resource has been incremented.
485 * This function decrements the reference count and close
486 * the resource if it's needed.
487 */
488
489void
490smbsr_cleanup(smb_request_t *sr)
491{
492	ASSERT((sr->sr_state != SMB_REQ_STATE_CLEANED_UP) &&
493	    (sr->sr_state != SMB_REQ_STATE_COMPLETED));
494
495	if (sr->r_xa) {
496		if (sr->r_xa->xa_flags & SMB_XA_FLAG_COMPLETE)
497			smb_xa_close(sr->r_xa);
498		smb_xa_rele(sr->session, sr->r_xa);
499		sr->r_xa = NULL;
500	}
501
502	/*
503	 * Mark this request so we know that we've already cleaned it up.
504	 * A request should only get cleaned up once so multiple calls to
505	 * smbsr_cleanup for the same request indicate a bug.
506	 */
507	mutex_enter(&sr->sr_mutex);
508	if (sr->sr_state != SMB_REQ_STATE_CANCELLED)
509		sr->sr_state = SMB_REQ_STATE_CLEANED_UP;
510	mutex_exit(&sr->sr_mutex);
511}
512
513int smb_cancel_in_reader = 1;
514
515/*
516 * This is the SMB1 handler for new smb requests, called from
517 * smb_session_reader after SMB negotiate is done.  For most SMB
518 * requests, we just enqueue them for the smb_session_worker to
519 * execute via the task queue, so they can block for resources
520 * without stopping the reader thread.  A few protocol messages
521 * are special cases and are handled directly here in the reader
522 * thread so they don't wait for taskq scheduling.  Later, a few
523 * MORE things could be handled here, such as REPLY messages
524 * (oplock break reply) and things like "NT_cancel".
525 *
526 * This function must either enqueue the new request for
527 * execution via the task queue, or execute it directly
528 * and then free it.  If this returns non-zero, the caller
529 * will drop the session.
530 */
531int
532smb1sr_newrq(smb_request_t *sr)
533{
534	uint16_t pid_hi, pid_lo;
535	int rc, save_offset;
536
537	/*
538	 * Decode the SMB header now (peek) so that
539	 * SMB_COM_NT_CANCEL can find this SR.
540	 */
541	save_offset = sr->command.chain_offset;
542	rc = smb_mbc_decodef(&sr->command, SMB_HEADER_ED_FMT,
543	    &sr->smb_com,
544	    &sr->smb_rcls,
545	    &sr->smb_reh,
546	    &sr->smb_err,
547	    &sr->smb_flg,
548	    &sr->smb_flg2,
549	    &pid_hi,
550	    sr->smb_sig,
551	    &sr->smb_tid,
552	    &pid_lo,
553	    &sr->smb_uid,
554	    &sr->smb_mid);
555	sr->command.chain_offset = save_offset;
556	if (rc != 0) {
557		/* Failed decoding the header. Drop 'em. */
558		smb_request_free(sr);
559		return (EPROTO);
560	}
561	sr->smb_pid = (pid_hi << 16) | pid_lo;
562
563	if (sr->smb_com == SMB_COM_NT_CANCEL) {
564		if (sr->session->signing.flags & SMB_SIGNING_ENABLED) {
565			sr->session->signing.seqnum++;
566			sr->sr_seqnum = sr->session->signing.seqnum + 1;
567			sr->reply_seqnum = 0;
568		}
569
570		/*
571		 * Normally execute cancel requests immediately,
572		 * (here in the reader thread) so they won't wait
573		 * for other commands already in the task queue.
574		 * Disable this via smb_cancel_in_reader=0 for
575		 * testing or diagnostic efforts, in which case
576		 * cancel runs via taskq_dispatch.
577		 */
578		if (smb_cancel_in_reader != 0) {
579			rc = smb1sr_newrq_cancel(sr);
580			smb_request_free(sr);
581			return (rc);
582		}
583	} else {
584		/* not NT cancel */
585		if (sr->session->signing.flags & SMB_SIGNING_ENABLED) {
586			sr->session->signing.seqnum += 2;
587			sr->sr_seqnum = sr->session->signing.seqnum;
588			sr->reply_seqnum = sr->sr_seqnum + 1;
589		}
590	}
591
592	/*
593	 * Submit the request to the task queue, which calls
594	 * smb1_tq_work when the workload permits.
595	 */
596	sr->sr_time_submitted = gethrtime();
597	sr->sr_state = SMB_REQ_STATE_SUBMITTED;
598	smb_srqueue_waitq_enter(sr->session->s_srqueue);
599	(void) taskq_dispatch(sr->sr_server->sv_worker_pool,
600	    smb1_tq_work, sr, TQ_SLEEP);
601
602	return (0);
603}
604
605static void
606smb1_tq_work(void *arg)
607{
608	smb_request_t	*sr;
609	smb_srqueue_t	*srq;
610
611	sr = (smb_request_t *)arg;
612	SMB_REQ_VALID(sr);
613
614	srq = sr->session->s_srqueue;
615	smb_srqueue_waitq_to_runq(srq);
616	sr->sr_worker = curthread;
617	sr->sr_time_active = gethrtime();
618
619	/*
620	 * Always dispatch to the work function, because cancelled
621	 * requests need an error reply (NT_STATUS_CANCELLED).
622	 */
623	mutex_enter(&sr->sr_mutex);
624	if (sr->sr_state == SMB_REQ_STATE_SUBMITTED)
625		sr->sr_state = SMB_REQ_STATE_ACTIVE;
626	mutex_exit(&sr->sr_mutex);
627
628	smb1sr_work(sr);
629
630	smb_srqueue_runq_exit(srq);
631}
632
633/*
634 * smb1sr_work
635 *
636 * In most cases, this should free the request before return.
637 * Exceptions are when a dispatch function returns SDRC_SR_KEPT.
638 */
639void
640smb1sr_work(struct smb_request *sr)
641{
642	smb_sdrc_t		sdrc;
643	const smb_disp_entry_t	*sdd;
644	smb_disp_stats_t	*sds;
645	boolean_t		disconnect = B_FALSE;
646	smb_session_t		*session;
647	smb_server_t		*server;
648	uint32_t		byte_count;
649	uint32_t		max_bytes;
650	uint16_t		pid_hi, pid_lo;
651
652	session = sr->session;
653	server = session->s_server;
654
655	ASSERT(sr->tid_tree == 0);
656	ASSERT(sr->uid_user == 0);
657	ASSERT(sr->fid_ofile == 0);
658	sr->smb_fid = (uint16_t)-1;
659
660	/* temporary until we identify a user */
661	sr->user_cr = zone_kcred();
662	sr->orig_request_hdr = sr->command.chain_offset;
663
664	/*
665	 * Decode the SMB header.
666	 */
667	if (smb_mbc_decodef(&sr->command, SMB_HEADER_ED_FMT,
668	    &sr->smb_com,
669	    &sr->smb_rcls,
670	    &sr->smb_reh,
671	    &sr->smb_err,
672	    &sr->smb_flg,
673	    &sr->smb_flg2,
674	    &pid_hi,
675	    sr->smb_sig,
676	    &sr->smb_tid,
677	    &pid_lo,
678	    &sr->smb_uid,
679	    &sr->smb_mid) != 0) {
680		disconnect = B_TRUE;
681		goto drop_connection;
682	}
683	sr->smb_pid = (pid_hi << 16) | pid_lo;
684
685	/*
686	 * The reply "header" is filled in now even though it will,
687	 * most likely, be rewritten under reply_ready below.  We
688	 * could reserve the space but this is convenient in case
689	 * the dialect dispatcher has to send a special reply (like
690	 * TRANSACT).
691	 *
692	 * Ensure that the 32-bit error code flag is turned off.
693	 * Clients seem to set it in transact requests and they may
694	 * get confused if we return success or a 16-bit SMB code.
695	 */
696	sr->smb_rcls = 0;
697	sr->smb_reh = 0;
698	sr->smb_err = 0;
699	sr->smb_flg2 &= ~SMB_FLAGS2_NT_STATUS;
700
701	(void) smb_mbc_encodef(&sr->reply, SMB_HEADER_ED_FMT,
702	    sr->smb_com,
703	    sr->smb_rcls,
704	    sr->smb_reh,
705	    sr->smb_err,
706	    sr->smb_flg,
707	    sr->smb_flg2,
708	    pid_hi,
709	    sr->smb_sig,
710	    sr->smb_tid,
711	    pid_lo,
712	    sr->smb_uid,
713	    sr->smb_mid);
714	sr->first_smb_com = sr->smb_com;
715
716	/* Need this for early goto report_error cases. */
717	sr->cur_reply_offset = sr->reply.chain_offset;
718
719	if ((session->signing.flags & SMB_SIGNING_CHECK) != 0) {
720		if ((sr->smb_flg2 & SMB_FLAGS2_SMB_SECURITY_SIGNATURE) == 0 ||
721		    smb_sign_check_request(sr) != 0) {
722			smbsr_error(sr, NT_STATUS_ACCESS_DENIED,
723			    ERRDOS, ERROR_ACCESS_DENIED);
724			disconnect = B_TRUE;
725			goto report_error;
726		}
727	}
728
729andx_more:
730	sdd = &smb_disp_table[sr->smb_com];
731	ASSERT(sdd->sdt_function);
732	sds = &server->sv_disp_stats1[sr->smb_com];
733
734	if (smb_mbc_decodef(&sr->command, "b", &sr->smb_wct) != 0) {
735		disconnect = B_TRUE;
736		goto report_error;
737	}
738
739	(void) MBC_SHADOW_CHAIN(&sr->smb_vwv, &sr->command,
740	    sr->command.chain_offset, sr->smb_wct * 2);
741
742	if (smb_mbc_decodef(&sr->command, "#.w", sr->smb_wct*2, &sr->smb_bcc)) {
743		disconnect = B_TRUE;
744		goto report_error;
745	}
746
747	atomic_add_64(&sds->sdt_rxb,
748	    (int64_t)(sr->smb_wct * 2 + sr->smb_bcc + 1));
749	sr->sr_txb = sr->reply.chain_offset;
750
751	/*
752	 * Ignore smb_bcc if CAP_LARGE_READX/CAP_LARGE_WRITEX
753	 * and this is SmbReadX/SmbWriteX since this enables
754	 * large reads/write and bcc is only 16-bits.
755	 */
756	max_bytes = sr->command.max_bytes - sr->command.chain_offset;
757	if (sr->smb_com == SMB_COM_WRITE_ANDX) {
758		/* Allow > BCC */
759		byte_count = max_bytes;
760	} else if (max_bytes < (uint32_t)sr->smb_bcc) {
761		/* BCC is bogus.  Will fail later. */
762		byte_count = max_bytes;
763	} else {
764		/* ordinary case */
765		byte_count = (uint32_t)sr->smb_bcc;
766	}
767
768	(void) MBC_SHADOW_CHAIN(&sr->smb_data, &sr->command,
769	    sr->command.chain_offset, byte_count);
770
771	sr->command.chain_offset += byte_count;
772	if (sr->command.chain_offset > sr->command.max_bytes) {
773		disconnect = B_TRUE;
774		goto report_error;
775	}
776
777	/* Store pointers for later */
778	sr->cur_reply_offset = sr->reply.chain_offset;
779
780	if (is_andx_com(sr->smb_com)) {
781		/* Peek ahead and don't disturb vwv */
782		if (smb_mbc_peek(&sr->smb_vwv, sr->smb_vwv.chain_offset, "b.w",
783		    &sr->andx_com, &sr->andx_off) < 0) {
784			disconnect = B_TRUE;
785			goto report_error;
786		}
787	} else {
788		sr->andx_com = (unsigned char)-1;
789	}
790
791	mutex_enter(&sr->sr_mutex);
792	switch (sr->sr_state) {
793	case SMB_REQ_STATE_ACTIVE:
794		break;
795	case SMB_REQ_STATE_CLEANED_UP:
796		sr->sr_state = SMB_REQ_STATE_ACTIVE;
797		break;
798	case SMB_REQ_STATE_CANCELLED:
799		/*
800		 * Keep cancelled.  Handlers that might block will
801		 * check the state and return NT_STATUS_CANCELLED.
802		 */
803		break;
804	default:
805		ASSERT(0);
806		break;
807	}
808	mutex_exit(&sr->sr_mutex);
809
810	/*
811	 * Setup UID and TID information (if required). Both functions
812	 * will set the sr credentials. In domain mode, the user and
813	 * tree credentials should be the same. In share mode, the
814	 * tree credentials (defined in the share definition) should
815	 * override the user credentials.
816	 */
817	if (!(sdd->sdt_flags & SDDF_SUPPRESS_UID) && (sr->uid_user == NULL)) {
818		sr->uid_user = smb_session_lookup_uid(session, sr->smb_uid);
819		if (sr->uid_user == NULL) {
820			smbsr_error(sr, 0, ERRSRV, ERRbaduid);
821			smbsr_cleanup(sr);
822			goto report_error;
823		}
824
825		sr->user_cr = smb_user_getcred(sr->uid_user);
826	}
827	if (!(sdd->sdt_flags & SDDF_SUPPRESS_TID) && (sr->tid_tree == NULL)) {
828		sr->tid_tree = smb_session_lookup_tree(session, sr->smb_tid);
829		if (sr->tid_tree == NULL) {
830			smbsr_error(sr, 0, ERRSRV, ERRinvnid);
831			smbsr_cleanup(sr);
832			goto report_error;
833		}
834	}
835
836	sr->sr_time_start = gethrtime();
837	if ((sdrc = (*sdd->sdt_pre_op)(sr)) == SDRC_SUCCESS)
838		sdrc = (*sdd->sdt_function)(sr);
839
840	if (sdrc != SDRC_SR_KEPT) {
841		(*sdd->sdt_post_op)(sr);
842		smbsr_cleanup(sr);
843	}
844
845	smb_server_inc_req(server);
846	smb_latency_add_sample(&sds->sdt_lat, gethrtime() - sr->sr_time_start);
847
848	atomic_add_64(&sds->sdt_txb,
849	    (int64_t)(sr->reply.chain_offset - sr->sr_txb));
850
851	switch (sdrc) {
852	case SDRC_SUCCESS:
853		break;
854
855	case SDRC_DROP_VC:
856		disconnect = B_TRUE;
857		goto drop_connection;
858
859	case SDRC_NO_REPLY:
860		/* will free sr */
861		goto out;
862
863	case SDRC_SR_KEPT:
864		/* Do NOT free sr */
865		sr = NULL;
866		goto out;
867
868	case SDRC_ERROR:
869		goto report_error;
870
871	case SDRC_NOT_IMPLEMENTED:
872	default:
873		smbsr_error(sr, 0, ERRDOS, ERRbadfunc);
874		goto report_error;
875	}
876
877	/*
878	 * If there's no AndX command, we're done.
879	 */
880	if (sr->andx_com == 0xff)
881		goto reply_ready;
882
883	/*
884	 * Otherwise, we have to back-patch the AndXCommand and AndXOffset
885	 * and continue processing.
886	 */
887	sr->andx_prev_wct = sr->cur_reply_offset;
888	(void) smb_mbc_poke(&sr->reply, sr->andx_prev_wct + 1, "b.w",
889	    sr->andx_com, MBC_LENGTH(&sr->reply));
890
891	sr->command.chain_offset = sr->orig_request_hdr + sr->andx_off;
892	sr->smb_com = sr->andx_com;
893	goto andx_more;
894
895report_error:
896	sr->reply.chain_offset = sr->cur_reply_offset;
897	(void) smb_mbc_encodef(&sr->reply, "bw", 0, 0);
898
899	sr->smb_wct = 0;
900	sr->smb_bcc = 0;
901
902	if (sr->smb_rcls == 0 && sr->smb_reh == 0 && sr->smb_err == 0)
903		smbsr_error(sr, 0, ERRSRV, ERRerror);
904
905reply_ready:
906	smbsr_send_reply(sr);
907
908drop_connection:
909	if (disconnect)
910		smb_session_disconnect(session);
911
912out:
913	if (sr != NULL) {
914		mutex_enter(&sr->sr_mutex);
915		sr->sr_state = SMB_REQ_STATE_COMPLETED;
916		mutex_exit(&sr->sr_mutex);
917		smb_request_free(sr);
918	}
919}
920
921int
922smbsr_encode_empty_result(struct smb_request *sr)
923{
924	return (smbsr_encode_result(sr, 0, 0, "bw", 0, 0));
925}
926
927int
928smbsr_encode_result(struct smb_request *sr, int wct, int bcc,
929    const char *fmt, ...)
930{
931	va_list ap;
932
933	if (MBC_LENGTH(&sr->reply) != sr->cur_reply_offset)
934		return (-1);
935
936	va_start(ap, fmt);
937	(void) smb_mbc_vencodef(&sr->reply, fmt, ap);
938	va_end(ap);
939
940	sr->smb_wct = (unsigned char)wct;
941	sr->smb_bcc = (uint16_t)bcc;
942
943	if (smbsr_check_result(sr, wct, bcc) != 0)
944		return (-1);
945
946	return (0);
947}
948
949static int
950smbsr_check_result(struct smb_request *sr, int wct, int bcc)
951{
952	int		offset = sr->cur_reply_offset;
953	int		total_bytes;
954	unsigned char	temp, temp1;
955	struct mbuf	*m;
956
957	total_bytes = 0;
958	m = sr->reply.chain;
959	while (m != 0) {
960		total_bytes += m->m_len;
961		m = m->m_next;
962	}
963
964	if ((offset + 3) > total_bytes)
965		return (-1);
966
967	(void) smb_mbc_peek(&sr->reply, offset, "b", &temp);
968	if (temp != wct)
969		return (-1);
970
971	if ((offset + (wct * 2 + 1)) > total_bytes)
972		return (-1);
973
974	/* reply wct & vwv seem ok, consider data now */
975	offset += wct * 2 + 1;
976
977	if ((offset + 2) > total_bytes)
978		return (-1);
979
980	(void) smb_mbc_peek(&sr->reply, offset, "bb", &temp, &temp1);
981	if (bcc == VAR_BCC) {
982		if ((temp != 0xFF) || (temp1 != 0xFF)) {
983			return (-1);
984		} else {
985			bcc = (total_bytes - offset) - 2;
986			(void) smb_mbc_poke(&sr->reply, offset, "bb",
987			    bcc, bcc >> 8);
988		}
989	} else {
990		if ((temp != (bcc&0xFF)) || (temp1 != ((bcc>>8)&0xFF)))
991			return (-1);
992	}
993
994	offset += bcc + 2;
995
996	if (offset != total_bytes)
997		return (-1);
998
999	sr->smb_wct = (unsigned char)wct;
1000	sr->smb_bcc = (uint16_t)bcc;
1001	return (0);
1002}
1003
1004int
1005smbsr_decode_vwv(struct smb_request *sr, const char *fmt, ...)
1006{
1007	int rc;
1008	va_list ap;
1009
1010	va_start(ap, fmt);
1011	rc = smb_mbc_vdecodef(&sr->smb_vwv, fmt, ap);
1012	va_end(ap);
1013
1014	if (rc)
1015		smbsr_error(sr, 0, ERRSRV, ERRerror);
1016	return (rc);
1017}
1018
1019int
1020smbsr_decode_data(struct smb_request *sr, const char *fmt, ...)
1021{
1022	int rc;
1023	va_list ap;
1024
1025	va_start(ap, fmt);
1026	rc = smb_mbc_vdecodef(&sr->smb_data, fmt, ap);
1027	va_end(ap);
1028
1029	if (rc)
1030		smbsr_error(sr, 0, ERRSRV, ERRerror);
1031	return (rc);
1032}
1033
1034boolean_t
1035smbsr_decode_data_avail(smb_request_t *sr)
1036{
1037	return (sr->smb_data.chain_offset < sr->smb_data.max_bytes);
1038}
1039
1040void
1041smbsr_send_reply(smb_request_t *sr)
1042{
1043	uint16_t	pid_hi, pid_lo;
1044
1045	if (SMB_TREE_IS_CASEINSENSITIVE(sr))
1046		sr->smb_flg |= SMB_FLAGS_CASE_INSENSITIVE;
1047	else
1048		sr->smb_flg &= ~SMB_FLAGS_CASE_INSENSITIVE;
1049	pid_hi = sr->smb_pid >> 16;
1050	pid_lo = (uint16_t)sr->smb_pid;
1051
1052	(void) smb_mbc_poke(&sr->reply, 0, SMB_HEADER_ED_FMT,
1053	    sr->first_smb_com,
1054	    sr->smb_rcls,
1055	    sr->smb_reh,
1056	    sr->smb_err,
1057	    sr->smb_flg | SMB_FLAGS_REPLY,
1058	    sr->smb_flg2,
1059	    pid_hi,
1060	    sr->smb_sig,
1061	    sr->smb_tid,
1062	    pid_lo,
1063	    sr->smb_uid,
1064	    sr->smb_mid);
1065
1066	if (sr->session->signing.flags & SMB_SIGNING_ENABLED)
1067		smb_sign_reply(sr, NULL);
1068
1069	if (smb_session_send(sr->session, 0, &sr->reply) == 0)
1070		sr->reply.chain = 0;
1071}
1072
1073void
1074smbsr_map_errno(int errnum, smb_error_t *err)
1075{
1076	uint32_t status;
1077	uint16_t doserr;
1078
1079	status = smb_errno2status(errnum);
1080	doserr = smb_status2doserr(status);
1081
1082	err->status  = status;
1083	err->errcls  = ERRDOS;
1084	err->errcode = doserr;
1085}
1086
1087void
1088smbsr_errno(struct smb_request *sr, int errnum)
1089{
1090	smbsr_map_errno(errnum, &sr->smb_error);
1091	smbsr_set_error(sr, &sr->smb_error);
1092}
1093
1094/*
1095 * Report a request processing status (error or warning).
1096 */
1097void
1098smbsr_status(smb_request_t *sr, DWORD status, uint16_t errcls, uint16_t errcode)
1099{
1100
1101	sr->smb_error.status   = status;
1102
1103	/*
1104	 * This function is SMB1 specific.  While adding SMB2 support,
1105	 * calls to this function have been removed from common code.
1106	 * In case we missed any, check for SMB2 callers here, and
1107	 * vector into a wrapper function that we can watch for...
1108	 * (and track down with dtrace:)
1109	 */
1110	if (sr->session->dialect >= SMB_VERS_2_BASE) {
1111		smbsr_status_smb2(sr, status);
1112		return;
1113	}
1114
1115	if (status != 0 && errcls == 0 && errcode == 0) {
1116		errcls = ERRDOS;
1117		errcode = smb_status2doserr(status);
1118	}
1119
1120	sr->smb_error.errcls   = errcls;
1121	sr->smb_error.errcode  = errcode;
1122
1123	smbsr_set_error(sr, &sr->smb_error);
1124}
1125
1126/*
1127 * Setup a request processing error.  This function can be used to
1128 * report 32-bit status codes or DOS errors.  Set the status code
1129 * to 0 (NT_STATUS_SUCCESS) to explicitly report a DOS error,
1130 * regardless of the client capabilities.
1131 *
1132 * If status is non-zero and the client supports 32-bit status
1133 * codes, report the status.  Otherwise, report the DOS error.
1134 */
1135void
1136smbsr_set_error(smb_request_t *sr, smb_error_t *err)
1137{
1138	uint32_t status;
1139	uint32_t capabilities;
1140
1141	ASSERT(sr);
1142	ASSERT(err);
1143
1144	status = err->status;
1145	capabilities = sr->session->capabilities;
1146
1147	if ((err->errcls == 0) && (err->errcode == 0)) {
1148		capabilities |= CAP_STATUS32;
1149		if (status == 0)
1150			status = NT_STATUS_INTERNAL_ERROR;
1151	}
1152
1153	if ((capabilities & CAP_STATUS32) && (status != 0)) {
1154		sr->smb_rcls = status & 0xff;
1155		sr->smb_reh = (status >> 8) & 0xff;
1156		sr->smb_err  = status >> 16;
1157		sr->smb_flg2 |= SMB_FLAGS2_NT_STATUS;
1158	} else {
1159		if ((err->errcls == 0) || (err->errcode == 0)) {
1160			sr->smb_rcls = ERRSRV;
1161			sr->smb_err  = ERRerror;
1162		} else {
1163			sr->smb_rcls = (uint8_t)err->errcls;
1164			sr->smb_err  = (uint16_t)err->errcode;
1165		}
1166	}
1167}
1168
1169smb_xa_t *
1170smbsr_lookup_xa(smb_request_t *sr)
1171{
1172	ASSERT(sr->r_xa == 0);
1173
1174	sr->r_xa = smb_xa_find(sr->session, sr->smb_pid, sr->smb_mid);
1175	return (sr->r_xa);
1176}
1177
1178void
1179smbsr_release_file(smb_request_t *sr)
1180{
1181	smb_ofile_t	*of = sr->fid_ofile;
1182
1183	sr->fid_ofile = NULL;
1184	(void) smb_ofile_release(of);
1185}
1186
1187void
1188smbsr_lookup_file(smb_request_t *sr)
1189{
1190	if (sr->fid_ofile == NULL)
1191		sr->fid_ofile = smb_ofile_lookup_by_fid(sr, sr->smb_fid);
1192}
1193
1194static int
1195is_andx_com(unsigned char com)
1196{
1197	switch (com) {
1198	case SMB_COM_LOCKING_ANDX:
1199	case SMB_COM_OPEN_ANDX:
1200	case SMB_COM_READ_ANDX:
1201	case SMB_COM_WRITE_ANDX:
1202	case SMB_COM_SESSION_SETUP_ANDX:
1203	case SMB_COM_LOGOFF_ANDX:
1204	case SMB_COM_TREE_CONNECT_ANDX:
1205	case SMB_COM_NT_CREATE_ANDX:
1206		return (1);
1207	}
1208	return (0);
1209}
1210
1211/*
1212 * Invalid command stubs.
1213 *
1214 * The Read/Write Block Multiplexed (mpx) protocol is used to maximize
1215 * performance when reading/writing a large block of data: it can be
1216 * used in parallel with other client/server operations.  The mpx sub-
1217 * protocol is not supported because we support only connection oriented
1218 * transports and NT supports mpx only over connectionless transports.
1219 */
1220smb_sdrc_t
1221smb_pre_invalid(smb_request_t *sr)
1222{
1223	DTRACE_SMB_START(op__Invalid, smb_request_t *, sr);
1224	return (SDRC_SUCCESS);
1225}
1226
1227void
1228smb_post_invalid(smb_request_t *sr)
1229{
1230	DTRACE_SMB_DONE(op__Invalid, smb_request_t *, sr);
1231}
1232
1233smb_sdrc_t
1234smb_com_invalid(smb_request_t *sr)
1235{
1236	smb_sdrc_t sdrc;
1237
1238	switch (sr->smb_com) {
1239	case SMB_COM_WRITE_COMPLETE:
1240		smbsr_error(sr, 0, ERRSRV, ERRerror);
1241		sdrc = SDRC_ERROR;
1242		break;
1243
1244	default:
1245		smbsr_error(sr, NT_STATUS_NOT_IMPLEMENTED,
1246		    ERRDOS, ERROR_INVALID_FUNCTION);
1247		sdrc = SDRC_NOT_IMPLEMENTED;
1248		break;
1249	}
1250
1251	return (sdrc);
1252}
1253
1254/*
1255 * smb_dispatch_stats_init
1256 *
1257 * Initializes dispatch statistics.
1258 */
1259void
1260smb_dispatch_stats_init(smb_server_t *sv)
1261{
1262	smb_disp_stats_t *sds = sv->sv_disp_stats1;
1263	smb_kstat_req_t *ksr;
1264	int		i;
1265
1266	ksr = ((smbsrv_kstats_t *)sv->sv_ksp->ks_data)->ks_reqs1;
1267
1268	for (i = 0; i < SMB_COM_NUM; i++, ksr++) {
1269		smb_latency_init(&sds[i].sdt_lat);
1270		(void) strlcpy(ksr->kr_name, smb_disp_table[i].sdt_name,
1271		    sizeof (ksr->kr_name));
1272	}
1273}
1274
1275/*
1276 * smb_dispatch_stats_fini
1277 *
1278 * Frees and destroyes the resources used for statistics.
1279 */
1280void
1281smb_dispatch_stats_fini(smb_server_t *sv)
1282{
1283	smb_disp_stats_t *sds = sv->sv_disp_stats1;
1284	int	i;
1285
1286	for (i = 0; i < SMB_COM_NUM; i++)
1287		smb_latency_destroy(&sds[i].sdt_lat);
1288}
1289
1290void
1291smb_dispatch_stats_update(smb_server_t *sv,
1292    smb_kstat_req_t *ksr, int first, int nreq)
1293{
1294	smb_disp_stats_t *sds = sv->sv_disp_stats1;
1295	int	i;
1296	int	last;
1297
1298	last = first + nreq - 1;
1299
1300	if ((first < SMB_COM_NUM) && (last < SMB_COM_NUM))  {
1301		for (i = first; i <= last; i++, ksr++) {
1302			ksr->kr_rxb = sds[i].sdt_rxb;
1303			ksr->kr_txb = sds[i].sdt_txb;
1304			mutex_enter(&sds[i].sdt_lat.ly_mutex);
1305			ksr->kr_nreq = sds[i].sdt_lat.ly_a_nreq;
1306			ksr->kr_sum = sds[i].sdt_lat.ly_a_sum;
1307			ksr->kr_a_mean = sds[i].sdt_lat.ly_a_mean;
1308			ksr->kr_a_stddev =
1309			    sds[i].sdt_lat.ly_a_stddev;
1310			ksr->kr_d_mean = sds[i].sdt_lat.ly_d_mean;
1311			ksr->kr_d_stddev =
1312			    sds[i].sdt_lat.ly_d_stddev;
1313			sds[i].sdt_lat.ly_d_mean = 0;
1314			sds[i].sdt_lat.ly_d_nreq = 0;
1315			sds[i].sdt_lat.ly_d_stddev = 0;
1316			sds[i].sdt_lat.ly_d_sum = 0;
1317			mutex_exit(&sds[i].sdt_lat.ly_mutex);
1318		}
1319	}
1320}
1321