1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 24 * Copyright 2017 Nexenta Systems, Inc. All rights reserved. 25 */ 26 27 /* 28 * SMB requests. 29 * 30 * Request 31 * Header 32 * Magic 0xFF 'S' 'M' 'B' 33 * smb_com a byte, the "first" command 34 * Error a 4-byte union, ignored in a request 35 * smb_flg a one byte set of eight flags 36 * smb_flg2 a two byte set of 16 flags 37 * . twelve reserved bytes, have a role 38 * in connectionless transports (IPX, UDP?) 39 * smb_tid a 16-bit tree ID, a mount point sorta, 40 * 0xFFFF is this command does not have 41 * or require a tree context 42 * smb_pid a 16-bit process ID 43 * smb_uid a 16-bit user ID, specific to this "session" 44 * and mapped to a system (bona-fide) UID 45 * smb_mid a 16-bit multiplex ID, used to differentiate 46 * multiple simultaneous requests from the same 47 * process (pid) (ref RPC "xid") 48 * 49 * Chained (AndX) commands (0 or more) 50 * smb_wct a byte, number of 16-bit words containing 51 * command parameters, min 2 for chained command 52 * andx_com a byte, the "next" command, 0xFF for none 53 * . an unused byte 54 * andx_off a 16-bit offset, byte displacement from &Magic 55 * to the smb_wct field of the "next" command, 56 * ignore if andx_com is 0xFF, s/b 0 if no next 57 * smb_vwv[] 0 or more 16-bit (sorta) parameters for 58 * "this" command (i.e. smb_com if this is the 59 * first parameters, or the andx_com of the just 60 * previous block. 61 * smb_bcc a 16-bit count of smb_data[] bytes 62 * smb_data[] 0 or more bytes, format specific to commands 63 * padding[] Optional padding 64 * 65 * Last command 66 * smb_wct a byte, number of 16-bit words containing 67 * command parameters, min 0 for chained command 68 * smb_vwv[] 0 or more 16-bit (sorta) parameters for 69 * "this" command (i.e. smb_com if this is the 70 * first parameters, or the andx_com of the just 71 * previous block. 72 * smb_bcc a 16-bit count of smb_data[] bytes 73 * smb_data[] 0 or more bytes, format specific to commands 74 * 75 * Reply 76 * Header 77 * Magic 0xFF 'S' 'M' 'B' 78 * smb_com a byte, the "first" command, corresponds 79 * to request 80 * Error a 4-byte union, coding depends on dialect in use 81 * for "DOS" errors 82 * a byte for error class 83 * an unused byte 84 * a 16-bit word for error code 85 * for "NT" errors 86 * a 32-bit error code which 87 * is a packed class and specifier 88 * for "OS/2" errors 89 * I don't know 90 * The error information is specific to the 91 * last command in the reply chain. 92 * smb_flg a one byte set of eight flags, 0x80 bit set 93 * indicating this message is a reply 94 * smb_flg2 a two byte set of 16 flags 95 * . twelve reserved bytes, have a role 96 * in connectionless transports (IPX, UDP?) 97 * smb_tid a 16-bit tree ID, a mount point sorta, 98 * should be the same as the request 99 * smb_pid a 16-bit process ID, MUST BE the same as request 100 * smb_uid a 16-bit user ID, specific to this "session" 101 * and mapped to a system (bona-fide) UID, 102 * should be the same as request 103 * smb_mid a 16-bit multiplex ID, used to differentiate 104 * multiple simultaneous requests from the same 105 * process (pid) (ref RPC "xid"), MUST BE the 106 * same as request 107 * padding[] Optional padding 108 * 109 * Chained (AndX) commands (0 or more) 110 * smb_wct a byte, number of 16-bit words containing 111 * command parameters, min 2 for chained command, 112 * andx_com a byte, the "next" command, 0xFF for none, 113 * corresponds to request, if this is the chained 114 * command that had an error set to 0xFF 115 * . an unused byte 116 * andx_off a 16-bit offset, byte displacement from &Magic 117 * to the smb_wct field of the "next" command, 118 * ignore if andx_com is 0xFF, s/b 0 if no next 119 * smb_vwv[] 0 or more 16-bit (sorta) parameters for 120 * "this" command (i.e. smb_com if this is the 121 * first parameters, or the andx_com of the just 122 * previous block. Empty if an error. 123 * smb_bcc a 16-bit count of smb_data[] bytes 124 * smb_data[] 0 or more bytes, format specific to commands 125 * empty if an error. 126 * 127 * Last command 128 * smb_wct a byte, number of 16-bit words containing 129 * command parameters, min 0 for chained command 130 * smb_vwv[] 0 or more 16-bit (sorta) parameters for 131 * "this" command (i.e. smb_com if this is the 132 * first parameters, or the andx_com of the just 133 * previous block, empty if an error. 134 * smb_bcc a 16-bit count of smb_data[] bytes 135 * smb_data[] 0 or more bytes, format specific to commands, 136 * empty if an error. 137 */ 138 139 #include <smbsrv/smb_kproto.h> 140 #include <smbsrv/smb_kstat.h> 141 #include <sys/sdt.h> 142 #include <sys/spl.h> 143 144 static int is_andx_com(unsigned char); 145 static int smbsr_check_result(struct smb_request *, int, int); 146 static void smb1_tq_work(void *); 147 148 static const smb_disp_entry_t 149 smb_disp_table[SMB_COM_NUM] = { 150 { "SmbCreateDirectory", SMB_SDT_OPS(create_directory), /* 0x00 000 */ 151 0x00, PC_NETWORK_PROGRAM_1_0 }, 152 { "SmbDeleteDirectory", SMB_SDT_OPS(delete_directory), /* 0x01 001 */ 153 0x01, PC_NETWORK_PROGRAM_1_0 }, 154 { "SmbOpen", SMB_SDT_OPS(open), /* 0x02 002 */ 155 0x02, PC_NETWORK_PROGRAM_1_0 }, 156 { "SmbCreate", SMB_SDT_OPS(create), /* 0x03 003 */ 157 0x03, PC_NETWORK_PROGRAM_1_0 }, 158 { "SmbClose", SMB_SDT_OPS(close), /* 0x04 004 */ 159 0x04, PC_NETWORK_PROGRAM_1_0 }, 160 { "SmbFlush", SMB_SDT_OPS(flush), /* 0x05 005 */ 161 0x05, PC_NETWORK_PROGRAM_1_0 }, 162 { "SmbDelete", SMB_SDT_OPS(delete), /* 0x06 006 */ 163 0x06, PC_NETWORK_PROGRAM_1_0 }, 164 { "SmbRename", SMB_SDT_OPS(rename), /* 0x07 007 */ 165 0x07, PC_NETWORK_PROGRAM_1_0 }, 166 { "SmbQueryInformation", SMB_SDT_OPS(query_information), /* 0x08 008 */ 167 0x08, PC_NETWORK_PROGRAM_1_0 }, 168 { "SmbSetInformation", SMB_SDT_OPS(set_information), /* 0x09 009 */ 169 0x09, PC_NETWORK_PROGRAM_1_0 }, 170 { "SmbRead", SMB_SDT_OPS(read), /* 0x0A 010 */ 171 0x0A, PC_NETWORK_PROGRAM_1_0 }, 172 { "SmbWrite", SMB_SDT_OPS(write), /* 0x0B 011 */ 173 0x0B, PC_NETWORK_PROGRAM_1_0 }, 174 { "SmbLockByteRange", SMB_SDT_OPS(lock_byte_range), /* 0x0C 012 */ 175 0x0C, PC_NETWORK_PROGRAM_1_0 }, 176 { "SmbUnlockByteRange", SMB_SDT_OPS(unlock_byte_range), /* 0x0D 013 */ 177 0x0D, PC_NETWORK_PROGRAM_1_0 }, 178 { "SmbCreateTemporary", SMB_SDT_OPS(create_temporary), /* 0x0E 014 */ 179 0x0E, PC_NETWORK_PROGRAM_1_0 }, 180 { "SmbCreateNew", SMB_SDT_OPS(create_new), /* 0x0F 015 */ 181 0x0F, PC_NETWORK_PROGRAM_1_0 }, 182 { "SmbCheckDirectory", SMB_SDT_OPS(check_directory), /* 0x10 016 */ 183 0x10, PC_NETWORK_PROGRAM_1_0 }, 184 { "SmbProcessExit", SMB_SDT_OPS(process_exit), /* 0x11 017 */ 185 0x11, PC_NETWORK_PROGRAM_1_0, 186 SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID }, 187 { "SmbSeek", SMB_SDT_OPS(seek), /* 0x12 018 */ 188 0x12, PC_NETWORK_PROGRAM_1_0 }, 189 { "SmbLockAndRead", SMB_SDT_OPS(lock_and_read), /* 0x13 019 */ 190 0x13, LANMAN1_0 }, 191 { "SmbWriteAndUnlock", SMB_SDT_OPS(write_and_unlock), /* 0x14 020 */ 192 0x14, LANMAN1_0 }, 193 { "Invalid", SMB_SDT_OPS(invalid), 0x15, 0 }, /* 0x15 021 */ 194 { "Invalid", SMB_SDT_OPS(invalid), 0x16, 0 }, /* 0x16 022 */ 195 { "Invalid", SMB_SDT_OPS(invalid), 0x17, 0 }, /* 0x17 023 */ 196 { "Invalid", SMB_SDT_OPS(invalid), 0x18, 0 }, /* 0x18 024 */ 197 { "Invalid", SMB_SDT_OPS(invalid), 0x19, 0 }, /* 0x19 025 */ 198 { "SmbReadRaw", SMB_SDT_OPS(invalid), 0x1A, 0 }, /* 0x1A 026 */ 199 { "Invalid", SMB_SDT_OPS(invalid), 0x1B, 0 }, /* 0x1B 027 */ 200 { "Invalid", SMB_SDT_OPS(invalid), 0x1C, 0 }, /* 0x1C 028 */ 201 { "SmbWriteRaw", SMB_SDT_OPS(invalid), 0x1D, 0 }, /* 0x1D 029 */ 202 { "Invalid", SMB_SDT_OPS(invalid), 0x1E, 0 }, /* 0x1E 030 */ 203 { "Invalid", SMB_SDT_OPS(invalid), 0x1F, 0 }, /* 0x1F 031 */ 204 { "Invalid", SMB_SDT_OPS(invalid), 0x20, 0 }, /* 0x20 032 */ 205 { "Invalid", SMB_SDT_OPS(invalid), 0x21, 0 }, /* 0x21 033 */ 206 { "SmbSetInformation2", SMB_SDT_OPS(set_information2), /* 0x22 034 */ 207 0x22, LANMAN1_0 }, 208 { "SmbQueryInformation2", 209 SMB_SDT_OPS(query_information2), /* 0x23 035 */ 210 0x23, LANMAN1_0 }, 211 { "SmbLockingX", SMB_SDT_OPS(locking_andx), /* 0x24 036 */ 212 0x24, LANMAN1_0 }, 213 { "SmbTransaction", SMB_SDT_OPS(transaction), /* 0x25 037 */ 214 0x25, LANMAN1_0 }, 215 { "SmbTransactionSecondary", 216 SMB_SDT_OPS(transaction_secondary), /* 0x26 038 */ 217 0x26, LANMAN1_0 }, 218 { "SmbIoctl", SMB_SDT_OPS(ioctl), /* 0x27 039 */ 219 0x27, LANMAN1_0 }, 220 { "Invalid", SMB_SDT_OPS(invalid), 0x28, 0 }, /* 0x28 040 */ 221 { "Invalid", SMB_SDT_OPS(invalid), 0x29, 0 }, /* 0x29 041 */ 222 { "Invalid", SMB_SDT_OPS(invalid), 0x2A, 0 }, /* 0x2A 042 */ 223 { "SmbEcho", SMB_SDT_OPS(echo), /* 0x2B 043 */ 224 0x2B, LANMAN1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID }, 225 { "SmbWriteAndClose", SMB_SDT_OPS(write_and_close), /* 0x2C 044 */ 226 0x2C, LANMAN1_0 }, 227 { "SmbOpenX", SMB_SDT_OPS(open_andx), /* 0x2D 045 */ 228 0x2D, LANMAN1_0 }, 229 { "SmbReadX", SMB_SDT_OPS(read_andx), /* 0x2E 046 */ 230 0x2E, LANMAN1_0 }, 231 { "SmbWriteX", SMB_SDT_OPS(write_andx), /* 0x2F 047 */ 232 0x2F, LANMAN1_0 }, 233 { "Invalid", SMB_SDT_OPS(invalid), 0x30, 0 }, /* 0x30 048 */ 234 { "SmbCloseAndTreeDisconnect", 235 SMB_SDT_OPS(close_and_tree_disconnect), /* 0x31 049 */ 236 0x31, LANMAN1_0 }, 237 { "SmbTransaction2", SMB_SDT_OPS(transaction2), /* 0x32 050 */ 238 0x32, LM1_2X002 }, 239 { "SmbTransaction2Secondary", 240 SMB_SDT_OPS(transaction2_secondary), /* 0x33 051 */ 241 0x33, LM1_2X002 }, 242 { "SmbFindClose2", SMB_SDT_OPS(find_close2), /* 0x34 052 */ 243 0x34, LM1_2X002 }, 244 { "Invalid", SMB_SDT_OPS(invalid), 0x35, 0 }, /* 0x35 053 */ 245 { "Invalid", SMB_SDT_OPS(invalid), 0x36, 0 }, /* 0x36 054 */ 246 { "Invalid", SMB_SDT_OPS(invalid), 0x37, 0 }, /* 0x37 055 */ 247 { "Invalid", SMB_SDT_OPS(invalid), 0x38, 0 }, /* 0x38 056 */ 248 { "Invalid", SMB_SDT_OPS(invalid), 0x39, 0 }, /* 0x39 057 */ 249 { "Invalid", SMB_SDT_OPS(invalid), 0x3A, 0 }, /* 0x3A 058 */ 250 { "Invalid", SMB_SDT_OPS(invalid), 0x3B, 0 }, /* 0x3B 059 */ 251 { "Invalid", SMB_SDT_OPS(invalid), 0x3C, 0 }, /* 0x3C 060 */ 252 { "Invalid", SMB_SDT_OPS(invalid), 0x3D, 0 }, /* 0x3D 061 */ 253 { "Invalid", SMB_SDT_OPS(invalid), 0x3E, 0 }, /* 0x3E 062 */ 254 { "Invalid", SMB_SDT_OPS(invalid), 0x3F, 0 }, /* 0x3F 063 */ 255 { "Invalid", SMB_SDT_OPS(invalid), 0x40, 0 }, /* 0x40 064 */ 256 { "Invalid", SMB_SDT_OPS(invalid), 0x47, 0 }, /* 0x47 065 */ 257 { "Invalid", SMB_SDT_OPS(invalid), 0x48, 0 }, /* 0x48 066 */ 258 { "Invalid", SMB_SDT_OPS(invalid), 0x49, 0 }, /* 0x49 067 */ 259 { "Invalid", SMB_SDT_OPS(invalid), 0x44, 0 }, /* 0x44 068 */ 260 { "Invalid", SMB_SDT_OPS(invalid), 0x45, 0 }, /* 0x45 069 */ 261 { "Invalid", SMB_SDT_OPS(invalid), 0x46, 0 }, /* 0x46 070 */ 262 { "Invalid", SMB_SDT_OPS(invalid), 0x47, 0 }, /* 0x47 071 */ 263 { "Invalid", SMB_SDT_OPS(invalid), 0x48, 0 }, /* 0x48 072 */ 264 { "Invalid", SMB_SDT_OPS(invalid), 0x49, 0 }, /* 0x49 073 */ 265 { "Invalid", SMB_SDT_OPS(invalid), 0x4A, 0 }, /* 0x4A 074 */ 266 { "Invalid", SMB_SDT_OPS(invalid), 0x4B, 0 }, /* 0x4B 075 */ 267 { "Invalid", SMB_SDT_OPS(invalid), 0x4C, 0 }, /* 0x4C 076 */ 268 { "Invalid", SMB_SDT_OPS(invalid), 0x4D, 0 }, /* 0x4D 077 */ 269 { "Invalid", SMB_SDT_OPS(invalid), 0x4E, 0 }, /* 0x4E 078 */ 270 { "Invalid", SMB_SDT_OPS(invalid), 0x4F, 0 }, /* 0x4F 079 */ 271 { "Invalid", SMB_SDT_OPS(invalid), 0x50, 0 }, /* 0x50 080 */ 272 { "Invalid", SMB_SDT_OPS(invalid), 0x51, 0 }, /* 0x51 081 */ 273 { "Invalid", SMB_SDT_OPS(invalid), 0x52, 0 }, /* 0x52 082 */ 274 { "Invalid", SMB_SDT_OPS(invalid), 0x53, 0 }, /* 0x53 083 */ 275 { "Invalid", SMB_SDT_OPS(invalid), 0x54, 0 }, /* 0x54 084 */ 276 { "Invalid", SMB_SDT_OPS(invalid), 0x55, 0 }, /* 0x55 085 */ 277 { "Invalid", SMB_SDT_OPS(invalid), 0x56, 0 }, /* 0x56 086 */ 278 { "Invalid", SMB_SDT_OPS(invalid), 0x57, 0 }, /* 0x57 087 */ 279 { "Invalid", SMB_SDT_OPS(invalid), 0x58, 0 }, /* 0x58 088 */ 280 { "Invalid", SMB_SDT_OPS(invalid), 0x59, 0 }, /* 0x59 089 */ 281 { "Invalid", SMB_SDT_OPS(invalid), 0x5A, 0 }, /* 0x5A 090 */ 282 { "Invalid", SMB_SDT_OPS(invalid), 0x5B, 0 }, /* 0x5B 091 */ 283 { "Invalid", SMB_SDT_OPS(invalid), 0x5C, 0 }, /* 0x5C 092 */ 284 { "Invalid", SMB_SDT_OPS(invalid), 0x5D, 0 }, /* 0x5D 093 */ 285 { "Invalid", SMB_SDT_OPS(invalid), 0x5E, 0 }, /* 0x5E 094 */ 286 { "Invalid", SMB_SDT_OPS(invalid), 0x5F, 0 }, /* 0x5F 095 */ 287 { "Invalid", SMB_SDT_OPS(invalid), 0x60, 0 }, /* 0x60 096 */ 288 { "Invalid", SMB_SDT_OPS(invalid), 0x61, 0 }, /* 0x61 097 */ 289 { "Invalid", SMB_SDT_OPS(invalid), 0x62, 0 }, /* 0x62 098 */ 290 { "Invalid", SMB_SDT_OPS(invalid), 0x63, 0 }, /* 0x63 099 */ 291 { "Invalid", SMB_SDT_OPS(invalid), 0x64, 0 }, /* 0x64 100 */ 292 { "Invalid", SMB_SDT_OPS(invalid), 0x65, 0 }, /* 0x65 101 */ 293 { "Invalid", SMB_SDT_OPS(invalid), 0x66, 0 }, /* 0x66 102 */ 294 { "Invalid", SMB_SDT_OPS(invalid), 0x67, 0 }, /* 0x67 103 */ 295 { "Invalid", SMB_SDT_OPS(invalid), 0x68, 0 }, /* 0x68 104 */ 296 { "Invalid", SMB_SDT_OPS(invalid), 0x69, 0 }, /* 0x69 105 */ 297 { "Invalid", SMB_SDT_OPS(invalid), 0x6A, 0 }, /* 0x6A 106 */ 298 { "Invalid", SMB_SDT_OPS(invalid), 0x6B, 0 }, /* 0x6B 107 */ 299 { "Invalid", SMB_SDT_OPS(invalid), 0x6C, 0 }, /* 0x6C 108 */ 300 { "Invalid", SMB_SDT_OPS(invalid), 0x6D, 0 }, /* 0x6D 109 */ 301 { "Invalid", SMB_SDT_OPS(invalid), 0x6E, 0 }, /* 0x6E 110 */ 302 { "Invalid", SMB_SDT_OPS(invalid), 0x6F, 0 }, /* 0x6F 111 */ 303 { "SmbTreeConnect", SMB_SDT_OPS(tree_connect), /* 0x70 112 */ 304 0x70, PC_NETWORK_PROGRAM_1_0, SDDF_SUPPRESS_TID }, 305 { "SmbTreeDisconnect", SMB_SDT_OPS(tree_disconnect), /* 0x71 113 */ 306 0x71, PC_NETWORK_PROGRAM_1_0, 307 SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID }, 308 /* 309 * NB: Negotiate gets special handling via 310 * smb_initial_request_handler. After that, 311 * another Negotiate is an invalid request. 312 */ 313 { "SmbNegotiate", SMB_SDT_OPS(invalid), /* 0x72 114 */ 314 0x72, PC_NETWORK_PROGRAM_1_0, 315 SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID }, 316 { "SmbSessionSetupX", SMB_SDT_OPS(session_setup_andx), /* 0x73 115 */ 317 0x73, LANMAN1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID }, 318 { "SmbLogoffX", SMB_SDT_OPS(logoff_andx), /* 0x74 116 */ 319 0x74, LM1_2X002, SDDF_SUPPRESS_TID }, 320 { "SmbTreeConnectX", SMB_SDT_OPS(tree_connect_andx), /* 0x75 117 */ 321 0x75, LANMAN1_0, SDDF_SUPPRESS_TID }, 322 { "Invalid", SMB_SDT_OPS(invalid), 0x76, 0, 0 }, /* 0x76 118 */ 323 { "Invalid", SMB_SDT_OPS(invalid), 0x77, 0, 0 }, /* 0x77 119 */ 324 { "Invalid", SMB_SDT_OPS(invalid), 0x78, 0, 0 }, /* 0x78 120 */ 325 { "Invalid", SMB_SDT_OPS(invalid), 0x79, 0, 0 }, /* 0x79 121 */ 326 { "Invalid", SMB_SDT_OPS(invalid), 0x7A, 0, 0 }, /* 0x7A 122 */ 327 { "Invalid", SMB_SDT_OPS(invalid), 0x7B, 0, 0 }, /* 0x7B 123 */ 328 { "Invalid", SMB_SDT_OPS(invalid), 0x7C, 0, 0 }, /* 0x7C 124 */ 329 { "Invalid", SMB_SDT_OPS(invalid), 0x7D, 0, 0 }, /* 0x7D 125 */ 330 { "Invalid", SMB_SDT_OPS(invalid), 0x7E, 0, 0 }, /* 0x7E 126 */ 331 { "Invalid", SMB_SDT_OPS(invalid), 0x7F, 0, 0 }, /* 0x7F 127 */ 332 { "SmbQueryInformationDisk", 333 SMB_SDT_OPS(query_information_disk), /* 0x80 128 */ 334 0x80, PC_NETWORK_PROGRAM_1_0, 0 }, 335 { "SmbSearch", SMB_SDT_OPS(search), /* 0x81 129 */ 336 0x81, PC_NETWORK_PROGRAM_1_0, 0 }, 337 { "SmbFind", SMB_SDT_OPS(find), /* 0x82 130 */ 338 0x82, LANMAN1_0, 0 }, 339 { "SmbFindUnique", SMB_SDT_OPS(find_unique), /* 0x83 131 */ 340 0x83, LANMAN1_0, 0 }, 341 { "SmbFindClose", SMB_SDT_OPS(find_close), /* 0x84 132 */ 342 0x84, LANMAN1_0, 0 }, 343 { "Invalid", SMB_SDT_OPS(invalid), 0x85, 0, 0 }, /* 0x85 133 */ 344 { "Invalid", SMB_SDT_OPS(invalid), 0x86, 0, 0 }, /* 0x86 134 */ 345 { "Invalid", SMB_SDT_OPS(invalid), 0x87, 0, 0 }, /* 0x87 135 */ 346 { "Invalid", SMB_SDT_OPS(invalid), 0x88, 0, 0 }, /* 0x88 136 */ 347 { "Invalid", SMB_SDT_OPS(invalid), 0x89, 0, 0 }, /* 0x89 137 */ 348 { "Invalid", SMB_SDT_OPS(invalid), 0x8A, 0, 0 }, /* 0x8A 138 */ 349 { "Invalid", SMB_SDT_OPS(invalid), 0x8B, 0, 0 }, /* 0x8B 139 */ 350 { "Invalid", SMB_SDT_OPS(invalid), 0x8C, 0, 0 }, /* 0x8C 140 */ 351 { "Invalid", SMB_SDT_OPS(invalid), 0x8D, 0, 0 }, /* 0x8D 141 */ 352 { "Invalid", SMB_SDT_OPS(invalid), 0x8E, 0, 0 }, /* 0x8E 142 */ 353 { "Invalid", SMB_SDT_OPS(invalid), 0x8F, 0, 0 }, /* 0x8F 143 */ 354 { "Invalid", SMB_SDT_OPS(invalid), 0x90, 0, 0 }, /* 0x90 144 */ 355 { "Invalid", SMB_SDT_OPS(invalid), 0x91, 0, 0 }, /* 0x91 145 */ 356 { "Invalid", SMB_SDT_OPS(invalid), 0x92, 0, 0 }, /* 0x92 146 */ 357 { "Invalid", SMB_SDT_OPS(invalid), 0x93, 0, 0 }, /* 0x93 147 */ 358 { "Invalid", SMB_SDT_OPS(invalid), 0x94, 0, 0 }, /* 0x94 148 */ 359 { "Invalid", SMB_SDT_OPS(invalid), 0x95, 0, 0 }, /* 0x95 149 */ 360 { "Invalid", SMB_SDT_OPS(invalid), 0x96, 0, 0 }, /* 0x96 150 */ 361 { "Invalid", SMB_SDT_OPS(invalid), 0x97, 0, 0 }, /* 0x97 151 */ 362 { "Invalid", SMB_SDT_OPS(invalid), 0x98, 0, 0 }, /* 0x98 152 */ 363 { "Invalid", SMB_SDT_OPS(invalid), 0x99, 0, 0 }, /* 0x99 153 */ 364 { "Invalid", SMB_SDT_OPS(invalid), 0x9A, 0, 0 }, /* 0x9A 154 */ 365 { "Invalid", SMB_SDT_OPS(invalid), 0x9B, 0, 0 }, /* 0x9B 155 */ 366 { "Invalid", SMB_SDT_OPS(invalid), 0x9C, 0, 0 }, /* 0x9C 156 */ 367 { "Invalid", SMB_SDT_OPS(invalid), 0x9D, 0, 0 }, /* 0x9D 157 */ 368 { "Invalid", SMB_SDT_OPS(invalid), 0x9E, 0, 0 }, /* 0x9E 158 */ 369 { "Invalid", SMB_SDT_OPS(invalid), 0x9F, 0, 0 }, /* 0x9F 159 */ 370 { "SmbNtTransact", SMB_SDT_OPS(nt_transact), /* 0xA0 160 */ 371 0xA0, NT_LM_0_12, 0 }, 372 { "SmbNtTransactSecondary", 373 SMB_SDT_OPS(nt_transact_secondary), /* 0xA1 161 */ 374 0xA1, NT_LM_0_12, 0 }, 375 { "SmbNtCreateX", SMB_SDT_OPS(nt_create_andx), /* 0xA2 162 */ 376 0xA2, NT_LM_0_12, 0 }, 377 { "Invalid", SMB_SDT_OPS(invalid), 0xA3, 0, 0 }, /* 0xA3 163 */ 378 { "SmbNtCancel", SMB_SDT_OPS(nt_cancel), /* 0xA4 164 */ 379 0xA4, NT_LM_0_12, 0 }, 380 { "SmbNtRename", SMB_SDT_OPS(nt_rename), /* 0xA5 165 */ 381 0xA5, NT_LM_0_12, 0 }, 382 { "Invalid", SMB_SDT_OPS(invalid), 0xA6, 0, 0 }, /* 0xA6 166 */ 383 { "Invalid", SMB_SDT_OPS(invalid), 0xA7, 0, 0 }, /* 0xA7 167 */ 384 { "Invalid", SMB_SDT_OPS(invalid), 0xA8, 0, 0 }, /* 0xA8 168 */ 385 { "Invalid", SMB_SDT_OPS(invalid), 0xA9, 0, 0 }, /* 0xA9 169 */ 386 { "Invalid", SMB_SDT_OPS(invalid), 0xAA, 0, 0 }, /* 0xAA 170 */ 387 { "Invalid", SMB_SDT_OPS(invalid), 0xAB, 0, 0 }, /* 0xAB 171 */ 388 { "Invalid", SMB_SDT_OPS(invalid), 0xAC, 0, 0 }, /* 0xAC 172 */ 389 { "Invalid", SMB_SDT_OPS(invalid), 0xAD, 0, 0 }, /* 0xAD 173 */ 390 { "Invalid", SMB_SDT_OPS(invalid), 0xAE, 0, 0 }, /* 0xAE 174 */ 391 { "Invalid", SMB_SDT_OPS(invalid), 0xAF, 0, 0 }, /* 0xAF 175 */ 392 { "Invalid", SMB_SDT_OPS(invalid), 0xB0, 0, 0 }, /* 0xB0 176 */ 393 { "Invalid", SMB_SDT_OPS(invalid), 0xB1, 0, 0 }, /* 0xB1 177 */ 394 { "Invalid", SMB_SDT_OPS(invalid), 0xB2, 0, 0 }, /* 0xB2 178 */ 395 { "Invalid", SMB_SDT_OPS(invalid), 0xB3, 0, 0 }, /* 0xB3 179 */ 396 { "Invalid", SMB_SDT_OPS(invalid), 0xB4, 0, 0 }, /* 0xB4 180 */ 397 { "Invalid", SMB_SDT_OPS(invalid), 0xB5, 0, 0 }, /* 0xB5 181 */ 398 { "Invalid", SMB_SDT_OPS(invalid), 0xB6, 0, 0 }, /* 0xB6 182 */ 399 { "Invalid", SMB_SDT_OPS(invalid), 0xB7, 0, 0 }, /* 0xB7 183 */ 400 { "Invalid", SMB_SDT_OPS(invalid), 0xB8, 0, 0 }, /* 0xB8 184 */ 401 { "Invalid", SMB_SDT_OPS(invalid), 0xB9, 0, 0 }, /* 0xB9 185 */ 402 { "Invalid", SMB_SDT_OPS(invalid), 0xBA, 0, 0 }, /* 0xBA 186 */ 403 { "Invalid", SMB_SDT_OPS(invalid), 0xBB, 0, 0 }, /* 0xBB 187 */ 404 { "Invalid", SMB_SDT_OPS(invalid), 0xBC, 0, 0 }, /* 0xBC 188 */ 405 { "Invalid", SMB_SDT_OPS(invalid), 0xBD, 0, 0 }, /* 0xBD 189 */ 406 { "Invalid", SMB_SDT_OPS(invalid), 0xBE, 0, 0 }, /* 0xBE 190 */ 407 { "Invalid", SMB_SDT_OPS(invalid), 0xBF, 0, 0 }, /* 0xBF 191 */ 408 { "SmbOpenPrintFile", SMB_SDT_OPS(open_print_file), /* 0xC0 192 */ 409 0xC0, PC_NETWORK_PROGRAM_1_0, 0 }, 410 { "SmbWritePrintFile", SMB_SDT_OPS(write_print_file), /* 0xC1 193 */ 411 0xC1, PC_NETWORK_PROGRAM_1_0, 0 }, 412 { "SmbClosePrintFile", SMB_SDT_OPS(close_print_file), /* 0xC2 194 */ 413 0xC2, PC_NETWORK_PROGRAM_1_0, 0 }, 414 { "SmbGetPrintQueue", SMB_SDT_OPS(get_print_queue), /* 0xC3 195 */ 415 0xC3, PC_NETWORK_PROGRAM_1_0, 0 }, 416 { "Invalid", SMB_SDT_OPS(invalid), 0xC4, 0, 0 }, /* 0xC4 196 */ 417 { "Invalid", SMB_SDT_OPS(invalid), 0xC5, 0, 0 }, /* 0xC5 197 */ 418 { "Invalid", SMB_SDT_OPS(invalid), 0xC6, 0, 0 }, /* 0xC6 198 */ 419 { "Invalid", SMB_SDT_OPS(invalid), 0xC7, 0, 0 }, /* 0xC7 199 */ 420 { "Invalid", SMB_SDT_OPS(invalid), 0xC8, 0, 0 }, /* 0xC8 200 */ 421 { "Invalid", SMB_SDT_OPS(invalid), 0xC9, 0, 0 }, /* 0xC9 201 */ 422 { "Invalid", SMB_SDT_OPS(invalid), 0xCA, 0, 0 }, /* 0xCA 202 */ 423 { "Invalid", SMB_SDT_OPS(invalid), 0xCB, 0, 0 }, /* 0xCB 203 */ 424 { "Invalid", SMB_SDT_OPS(invalid), 0xCC, 0, 0 }, /* 0xCC 204 */ 425 { "Invalid", SMB_SDT_OPS(invalid), 0xCD, 0, 0 }, /* 0xCD 205 */ 426 { "Invalid", SMB_SDT_OPS(invalid), 0xCE, 0, 0 }, /* 0xCE 206 */ 427 { "Invalid", SMB_SDT_OPS(invalid), 0xCF, 0, 0 }, /* 0xCF 207 */ 428 { "Invalid", SMB_SDT_OPS(invalid), 0xD0, 0, 0 }, /* 0xD0 208 */ 429 { "Invalid", SMB_SDT_OPS(invalid), 0xD1, 0, 0 }, /* 0xD1 209 */ 430 { "Invalid", SMB_SDT_OPS(invalid), 0xD2, 0, 0 }, /* 0xD2 210 */ 431 { "Invalid", SMB_SDT_OPS(invalid), 0xD3, 0, 0 }, /* 0xD3 211 */ 432 { "Invalid", SMB_SDT_OPS(invalid), 0xD4, 0, 0 }, /* 0xD4 212 */ 433 { "Invalid", SMB_SDT_OPS(invalid), 0xD5, 0, 0 }, /* 0xD5 213 */ 434 { "Invalid", SMB_SDT_OPS(invalid), 0xD6, 0, 0 }, /* 0xD6 214 */ 435 { "Invalid", SMB_SDT_OPS(invalid), 0xD7, 0, 0 }, /* 0xD7 215 */ 436 { "Invalid", SMB_SDT_OPS(invalid), 0xD8, 0, 0 }, /* 0xD8 216 */ 437 { "Invalid", SMB_SDT_OPS(invalid), 0xD9, 0, 0 }, /* 0xD9 217 */ 438 { "Invalid", SMB_SDT_OPS(invalid), 0xDA, 0, 0 }, /* 0xDA 218 */ 439 { "Invalid", SMB_SDT_OPS(invalid), 0xDB, 0, 0 }, /* 0xDB 219 */ 440 { "Invalid", SMB_SDT_OPS(invalid), 0xDC, 0, 0 }, /* 0xDC 220 */ 441 { "Invalid", SMB_SDT_OPS(invalid), 0xDD, 0, 0 }, /* 0xDD 221 */ 442 { "Invalid", SMB_SDT_OPS(invalid), 0xDE, 0, 0 }, /* 0xDE 222 */ 443 { "Invalid", SMB_SDT_OPS(invalid), 0xDF, 0, 0 }, /* 0xDF 223 */ 444 { "Invalid", SMB_SDT_OPS(invalid), 0xE0, 0, 0 }, /* 0xE0 224 */ 445 { "Invalid", SMB_SDT_OPS(invalid), 0xE1, 0, 0 }, /* 0xE1 225 */ 446 { "Invalid", SMB_SDT_OPS(invalid), 0xE2, 0, 0 }, /* 0xE2 226 */ 447 { "Invalid", SMB_SDT_OPS(invalid), 0xE3, 0, 0 }, /* 0xE3 227 */ 448 { "Invalid", SMB_SDT_OPS(invalid), 0xE4, 0, 0 }, /* 0xE4 228 */ 449 { "Invalid", SMB_SDT_OPS(invalid), 0xE5, 0, 0 }, /* 0xE5 229 */ 450 { "Invalid", SMB_SDT_OPS(invalid), 0xE6, 0, 0 }, /* 0xE6 230 */ 451 { "Invalid", SMB_SDT_OPS(invalid), 0xE7, 0, 0 }, /* 0xE7 231 */ 452 { "Invalid", SMB_SDT_OPS(invalid), 0xE8, 0, 0 }, /* 0xE8 232 */ 453 { "Invalid", SMB_SDT_OPS(invalid), 0xE9, 0, 0 }, /* 0xE9 233 */ 454 { "Invalid", SMB_SDT_OPS(invalid), 0xEA, 0, 0 }, /* 0xEA 234 */ 455 { "Invalid", SMB_SDT_OPS(invalid), 0xEB, 0, 0 }, /* 0xEB 235 */ 456 { "Invalid", SMB_SDT_OPS(invalid), 0xEC, 0, 0 }, /* 0xEC 236 */ 457 { "Invalid", SMB_SDT_OPS(invalid), 0xED, 0, 0 }, /* 0xED 237 */ 458 { "Invalid", SMB_SDT_OPS(invalid), 0xEE, 0, 0 }, /* 0xEE 238 */ 459 { "Invalid", SMB_SDT_OPS(invalid), 0xEF, 0, 0 }, /* 0xEF 239 */ 460 { "Invalid", SMB_SDT_OPS(invalid), 0xF0, 0, 0 }, /* 0xF0 240 */ 461 { "Invalid", SMB_SDT_OPS(invalid), 0xF1, 0, 0 }, /* 0xF1 241 */ 462 { "Invalid", SMB_SDT_OPS(invalid), 0xF2, 0, 0 }, /* 0xF2 242 */ 463 { "Invalid", SMB_SDT_OPS(invalid), 0xF3, 0, 0 }, /* 0xF3 243 */ 464 { "Invalid", SMB_SDT_OPS(invalid), 0xF4, 0, 0 }, /* 0xF4 244 */ 465 { "Invalid", SMB_SDT_OPS(invalid), 0xF5, 0, 0 }, /* 0xF5 245 */ 466 { "Invalid", SMB_SDT_OPS(invalid), 0xF6, 0, 0 }, /* 0xF6 246 */ 467 { "Invalid", SMB_SDT_OPS(invalid), 0xF7, 0, 0 }, /* 0xF7 247 */ 468 { "Invalid", SMB_SDT_OPS(invalid), 0xF8, 0, 0 }, /* 0xF8 248 */ 469 { "Invalid", SMB_SDT_OPS(invalid), 0xF9, 0, 0 }, /* 0xF9 249 */ 470 { "Invalid", SMB_SDT_OPS(invalid), 0xFA, 0, 0 }, /* 0xFA 250 */ 471 { "Invalid", SMB_SDT_OPS(invalid), 0xFB, 0, 0 }, /* 0xFB 251 */ 472 { "Invalid", SMB_SDT_OPS(invalid), 0xFC, 0, 0 }, /* 0xFC 252 */ 473 { "Invalid", SMB_SDT_OPS(invalid), 0xFD, 0, 0 }, /* 0xFD 253 */ 474 { "Invalid", SMB_SDT_OPS(invalid), 0xFE, 0, 0 }, /* 0xFE 254 */ 475 { "Invalid", SMB_SDT_OPS(invalid), 0xFF, 0, 0 } /* 0xFF 255 */ 476 }; 477 478 /* 479 * smbsr_cleanup 480 * 481 * If any user/tree/file is used by given request then 482 * the reference count for that resource has been incremented. 483 * This function decrements the reference count and close 484 * the resource if it's needed. 485 */ 486 487 void 488 smbsr_cleanup(smb_request_t *sr) 489 { 490 ASSERT((sr->sr_state != SMB_REQ_STATE_CLEANED_UP) && 491 (sr->sr_state != SMB_REQ_STATE_COMPLETED)); 492 493 if (sr->r_xa) { 494 if (sr->r_xa->xa_flags & SMB_XA_FLAG_COMPLETE) 495 smb_xa_close(sr->r_xa); 496 smb_xa_rele(sr->session, sr->r_xa); 497 sr->r_xa = NULL; 498 } 499 500 /* 501 * Mark this request so we know that we've already cleaned it up. 502 * A request should only get cleaned up once so multiple calls to 503 * smbsr_cleanup for the same request indicate a bug. 504 */ 505 mutex_enter(&sr->sr_mutex); 506 if (sr->sr_state != SMB_REQ_STATE_CANCELLED) 507 sr->sr_state = SMB_REQ_STATE_CLEANED_UP; 508 mutex_exit(&sr->sr_mutex); 509 } 510 511 int smb_cancel_in_reader = 1; 512 513 /* 514 * This is the SMB1 handler for new smb requests, called from 515 * smb_session_reader after SMB negotiate is done. For most SMB 516 * requests, we just enqueue them for the smb_session_worker to 517 * execute via the task queue, so they can block for resources 518 * without stopping the reader thread. A few protocol messages 519 * are special cases and are handled directly here in the reader 520 * thread so they don't wait for taskq scheduling. Later, a few 521 * MORE things could be handled here, such as REPLY messages 522 * (oplock break reply) and things like "NT_cancel". 523 * 524 * This function must either enqueue the new request for 525 * execution via the task queue, or execute it directly 526 * and then free it. If this returns non-zero, the caller 527 * will drop the session. 528 */ 529 int 530 smb1sr_newrq(smb_request_t *sr) 531 { 532 uint16_t pid_hi, pid_lo; 533 int rc, save_offset; 534 535 /* 536 * Decode the SMB header now (peek) so that 537 * SMB_COM_NT_CANCEL can find this SR. 538 */ 539 save_offset = sr->command.chain_offset; 540 rc = smb_mbc_decodef(&sr->command, SMB_HEADER_ED_FMT, 541 &sr->smb_com, 542 &sr->smb_rcls, 543 &sr->smb_reh, 544 &sr->smb_err, 545 &sr->smb_flg, 546 &sr->smb_flg2, 547 &pid_hi, 548 sr->smb_sig, 549 &sr->smb_tid, 550 &pid_lo, 551 &sr->smb_uid, 552 &sr->smb_mid); 553 sr->command.chain_offset = save_offset; 554 if (rc != 0) { 555 /* Failed decoding the header. Drop 'em. */ 556 smb_request_free(sr); 557 return (EPROTO); 558 } 559 sr->smb_pid = (pid_hi << 16) | pid_lo; 560 561 if (sr->smb_com == SMB_COM_NT_CANCEL) { 562 if (sr->session->signing.flags & SMB_SIGNING_ENABLED) { 563 sr->session->signing.seqnum++; 564 sr->sr_seqnum = sr->session->signing.seqnum + 1; 565 sr->reply_seqnum = 0; 566 } 567 568 /* 569 * Normally execute cancel requests immediately, 570 * (here in the reader thread) so they won't wait 571 * for other commands already in the task queue. 572 * Disable this via smb_cancel_in_reader=0 for 573 * testing or diagnostic efforts, in which case 574 * cancel runs via taskq_dispatch. 575 */ 576 if (smb_cancel_in_reader != 0) { 577 rc = smb1sr_newrq_cancel(sr); 578 smb_request_free(sr); 579 return (rc); 580 } 581 } else { 582 /* not NT cancel */ 583 if (sr->session->signing.flags & SMB_SIGNING_ENABLED) { 584 sr->session->signing.seqnum += 2; 585 sr->sr_seqnum = sr->session->signing.seqnum; 586 sr->reply_seqnum = sr->sr_seqnum + 1; 587 } 588 } 589 590 /* 591 * Submit the request to the task queue, which calls 592 * smb1_tq_work when the workload permits. 593 */ 594 sr->sr_time_submitted = gethrtime(); 595 sr->sr_state = SMB_REQ_STATE_SUBMITTED; 596 smb_srqueue_waitq_enter(sr->session->s_srqueue); 597 (void) taskq_dispatch(sr->sr_server->sv_worker_pool, 598 smb1_tq_work, sr, TQ_SLEEP); 599 600 return (0); 601 } 602 603 static void 604 smb1_tq_work(void *arg) 605 { 606 smb_request_t *sr; 607 smb_srqueue_t *srq; 608 609 sr = (smb_request_t *)arg; 610 SMB_REQ_VALID(sr); 611 612 srq = sr->session->s_srqueue; 613 smb_srqueue_waitq_to_runq(srq); 614 sr->sr_worker = curthread; 615 sr->sr_time_active = gethrtime(); 616 617 /* 618 * Always dispatch to the work function, because cancelled 619 * requests need an error reply (NT_STATUS_CANCELLED). 620 */ 621 mutex_enter(&sr->sr_mutex); 622 if (sr->sr_state == SMB_REQ_STATE_SUBMITTED) 623 sr->sr_state = SMB_REQ_STATE_ACTIVE; 624 mutex_exit(&sr->sr_mutex); 625 626 smb1sr_work(sr); 627 628 smb_srqueue_runq_exit(srq); 629 } 630 631 /* 632 * smb1sr_work 633 * 634 * In most cases, this should free the request before return. 635 * Exceptions are when a dispatch function returns SDRC_SR_KEPT. 636 */ 637 void 638 smb1sr_work(struct smb_request *sr) 639 { 640 smb_sdrc_t sdrc; 641 const smb_disp_entry_t *sdd; 642 smb_disp_stats_t *sds; 643 boolean_t disconnect = B_FALSE; 644 smb_session_t *session; 645 smb_server_t *server; 646 uint32_t byte_count; 647 uint32_t max_bytes; 648 uint16_t pid_hi, pid_lo; 649 650 session = sr->session; 651 server = session->s_server; 652 653 ASSERT(sr->tid_tree == 0); 654 ASSERT(sr->uid_user == 0); 655 ASSERT(sr->fid_ofile == 0); 656 sr->smb_fid = (uint16_t)-1; 657 658 /* temporary until we identify a user */ 659 sr->user_cr = zone_kcred(); 660 sr->orig_request_hdr = sr->command.chain_offset; 661 662 /* 663 * Decode the SMB header. 664 */ 665 if (smb_mbc_decodef(&sr->command, SMB_HEADER_ED_FMT, 666 &sr->smb_com, 667 &sr->smb_rcls, 668 &sr->smb_reh, 669 &sr->smb_err, 670 &sr->smb_flg, 671 &sr->smb_flg2, 672 &pid_hi, 673 sr->smb_sig, 674 &sr->smb_tid, 675 &pid_lo, 676 &sr->smb_uid, 677 &sr->smb_mid) != 0) { 678 disconnect = B_TRUE; 679 goto drop_connection; 680 } 681 sr->smb_pid = (pid_hi << 16) | pid_lo; 682 683 /* 684 * The reply "header" is filled in now even though it will, 685 * most likely, be rewritten under reply_ready below. We 686 * could reserve the space but this is convenient in case 687 * the dialect dispatcher has to send a special reply (like 688 * TRANSACT). 689 * 690 * Ensure that the 32-bit error code flag is turned off. 691 * Clients seem to set it in transact requests and they may 692 * get confused if we return success or a 16-bit SMB code. 693 */ 694 sr->smb_rcls = 0; 695 sr->smb_reh = 0; 696 sr->smb_err = 0; 697 sr->smb_flg2 &= ~SMB_FLAGS2_NT_STATUS; 698 699 (void) smb_mbc_encodef(&sr->reply, SMB_HEADER_ED_FMT, 700 sr->smb_com, 701 sr->smb_rcls, 702 sr->smb_reh, 703 sr->smb_err, 704 sr->smb_flg, 705 sr->smb_flg2, 706 pid_hi, 707 sr->smb_sig, 708 sr->smb_tid, 709 pid_lo, 710 sr->smb_uid, 711 sr->smb_mid); 712 sr->first_smb_com = sr->smb_com; 713 714 /* Need this for early goto report_error cases. */ 715 sr->cur_reply_offset = sr->reply.chain_offset; 716 717 if ((session->signing.flags & SMB_SIGNING_CHECK) != 0) { 718 if ((sr->smb_flg2 & SMB_FLAGS2_SMB_SECURITY_SIGNATURE) == 0 || 719 smb_sign_check_request(sr) != 0) { 720 smbsr_error(sr, NT_STATUS_ACCESS_DENIED, 721 ERRDOS, ERROR_ACCESS_DENIED); 722 disconnect = B_TRUE; 723 goto report_error; 724 } 725 } 726 727 andx_more: 728 sdd = &smb_disp_table[sr->smb_com]; 729 ASSERT(sdd->sdt_function); 730 sds = &server->sv_disp_stats1[sr->smb_com]; 731 732 if (smb_mbc_decodef(&sr->command, "b", &sr->smb_wct) != 0) { 733 disconnect = B_TRUE; 734 goto report_error; 735 } 736 737 (void) MBC_SHADOW_CHAIN(&sr->smb_vwv, &sr->command, 738 sr->command.chain_offset, sr->smb_wct * 2); 739 740 if (smb_mbc_decodef(&sr->command, "#.w", sr->smb_wct*2, &sr->smb_bcc)) { 741 disconnect = B_TRUE; 742 goto report_error; 743 } 744 745 atomic_add_64(&sds->sdt_rxb, 746 (int64_t)(sr->smb_wct * 2 + sr->smb_bcc + 1)); 747 sr->sr_txb = sr->reply.chain_offset; 748 749 /* 750 * Ignore smb_bcc if CAP_LARGE_READX/CAP_LARGE_WRITEX 751 * and this is SmbReadX/SmbWriteX since this enables 752 * large reads/write and bcc is only 16-bits. 753 */ 754 max_bytes = sr->command.max_bytes - sr->command.chain_offset; 755 if (sr->smb_com == SMB_COM_WRITE_ANDX) { 756 /* Allow > BCC */ 757 byte_count = max_bytes; 758 } else if (max_bytes < (uint32_t)sr->smb_bcc) { 759 /* BCC is bogus. Will fail later. */ 760 byte_count = max_bytes; 761 } else { 762 /* ordinary case */ 763 byte_count = (uint32_t)sr->smb_bcc; 764 } 765 766 (void) MBC_SHADOW_CHAIN(&sr->smb_data, &sr->command, 767 sr->command.chain_offset, byte_count); 768 769 sr->command.chain_offset += byte_count; 770 if (sr->command.chain_offset > sr->command.max_bytes) { 771 disconnect = B_TRUE; 772 goto report_error; 773 } 774 775 /* Store pointers for later */ 776 sr->cur_reply_offset = sr->reply.chain_offset; 777 778 if (is_andx_com(sr->smb_com)) { 779 /* Peek ahead and don't disturb vwv */ 780 if (smb_mbc_peek(&sr->smb_vwv, sr->smb_vwv.chain_offset, "b.w", 781 &sr->andx_com, &sr->andx_off) < 0) { 782 disconnect = B_TRUE; 783 goto report_error; 784 } 785 } else { 786 sr->andx_com = (unsigned char)-1; 787 } 788 789 mutex_enter(&sr->sr_mutex); 790 switch (sr->sr_state) { 791 case SMB_REQ_STATE_ACTIVE: 792 break; 793 case SMB_REQ_STATE_CLEANED_UP: 794 sr->sr_state = SMB_REQ_STATE_ACTIVE; 795 break; 796 case SMB_REQ_STATE_CANCELLED: 797 /* 798 * Keep cancelled. Handlers that might block will 799 * check the state and return NT_STATUS_CANCELLED. 800 */ 801 break; 802 default: 803 ASSERT(0); 804 break; 805 } 806 mutex_exit(&sr->sr_mutex); 807 808 /* 809 * Setup UID and TID information (if required). Both functions 810 * will set the sr credentials. In domain mode, the user and 811 * tree credentials should be the same. In share mode, the 812 * tree credentials (defined in the share definition) should 813 * override the user credentials. 814 */ 815 if (!(sdd->sdt_flags & SDDF_SUPPRESS_UID) && (sr->uid_user == NULL)) { 816 sr->uid_user = smb_session_lookup_uid(session, sr->smb_uid); 817 if (sr->uid_user == NULL) { 818 smbsr_error(sr, 0, ERRSRV, ERRbaduid); 819 smbsr_cleanup(sr); 820 goto report_error; 821 } 822 823 sr->user_cr = smb_user_getcred(sr->uid_user); 824 } 825 if (!(sdd->sdt_flags & SDDF_SUPPRESS_TID) && (sr->tid_tree == NULL)) { 826 sr->tid_tree = smb_session_lookup_tree(session, sr->smb_tid); 827 if (sr->tid_tree == NULL) { 828 smbsr_error(sr, 0, ERRSRV, ERRinvnid); 829 smbsr_cleanup(sr); 830 goto report_error; 831 } 832 } 833 834 sr->sr_time_start = gethrtime(); 835 if ((sdrc = (*sdd->sdt_pre_op)(sr)) == SDRC_SUCCESS) 836 sdrc = (*sdd->sdt_function)(sr); 837 838 if (sdrc != SDRC_SR_KEPT) { 839 (*sdd->sdt_post_op)(sr); 840 smbsr_cleanup(sr); 841 } 842 843 smb_server_inc_req(server); 844 smb_latency_add_sample(&sds->sdt_lat, gethrtime() - sr->sr_time_start); 845 846 atomic_add_64(&sds->sdt_txb, 847 (int64_t)(sr->reply.chain_offset - sr->sr_txb)); 848 849 switch (sdrc) { 850 case SDRC_SUCCESS: 851 break; 852 853 case SDRC_DROP_VC: 854 disconnect = B_TRUE; 855 goto drop_connection; 856 857 case SDRC_NO_REPLY: 858 /* will free sr */ 859 goto out; 860 861 case SDRC_SR_KEPT: 862 /* Do NOT free sr */ 863 sr = NULL; 864 goto out; 865 866 case SDRC_ERROR: 867 goto report_error; 868 869 case SDRC_NOT_IMPLEMENTED: 870 default: 871 smbsr_error(sr, 0, ERRDOS, ERRbadfunc); 872 goto report_error; 873 } 874 875 /* 876 * If there's no AndX command, we're done. 877 */ 878 if (sr->andx_com == 0xff) 879 goto reply_ready; 880 881 /* 882 * Otherwise, we have to back-patch the AndXCommand and AndXOffset 883 * and continue processing. 884 */ 885 sr->andx_prev_wct = sr->cur_reply_offset; 886 (void) smb_mbc_poke(&sr->reply, sr->andx_prev_wct + 1, "b.w", 887 sr->andx_com, MBC_LENGTH(&sr->reply)); 888 889 sr->command.chain_offset = sr->orig_request_hdr + sr->andx_off; 890 sr->smb_com = sr->andx_com; 891 goto andx_more; 892 893 report_error: 894 sr->reply.chain_offset = sr->cur_reply_offset; 895 (void) smb_mbc_encodef(&sr->reply, "bw", 0, 0); 896 897 sr->smb_wct = 0; 898 sr->smb_bcc = 0; 899 900 if (sr->smb_rcls == 0 && sr->smb_reh == 0 && sr->smb_err == 0) 901 smbsr_error(sr, 0, ERRSRV, ERRerror); 902 903 reply_ready: 904 smbsr_send_reply(sr); 905 906 drop_connection: 907 if (disconnect) { 908 smb_rwx_rwenter(&session->s_lock, RW_WRITER); 909 switch (session->s_state) { 910 case SMB_SESSION_STATE_DISCONNECTED: 911 case SMB_SESSION_STATE_TERMINATED: 912 break; 913 default: 914 smb_soshutdown(session->sock); 915 session->s_state = SMB_SESSION_STATE_DISCONNECTED; 916 break; 917 } 918 smb_rwx_rwexit(&session->s_lock); 919 } 920 921 out: 922 if (sr != NULL) { 923 mutex_enter(&sr->sr_mutex); 924 sr->sr_state = SMB_REQ_STATE_COMPLETED; 925 mutex_exit(&sr->sr_mutex); 926 smb_request_free(sr); 927 } 928 } 929 930 int 931 smbsr_encode_empty_result(struct smb_request *sr) 932 { 933 return (smbsr_encode_result(sr, 0, 0, "bw", 0, 0)); 934 } 935 936 int 937 smbsr_encode_result(struct smb_request *sr, int wct, int bcc, 938 const char *fmt, ...) 939 { 940 va_list ap; 941 942 if (MBC_LENGTH(&sr->reply) != sr->cur_reply_offset) 943 return (-1); 944 945 va_start(ap, fmt); 946 (void) smb_mbc_vencodef(&sr->reply, fmt, ap); 947 va_end(ap); 948 949 sr->smb_wct = (unsigned char)wct; 950 sr->smb_bcc = (uint16_t)bcc; 951 952 if (smbsr_check_result(sr, wct, bcc) != 0) 953 return (-1); 954 955 return (0); 956 } 957 958 static int 959 smbsr_check_result(struct smb_request *sr, int wct, int bcc) 960 { 961 int offset = sr->cur_reply_offset; 962 int total_bytes; 963 unsigned char temp, temp1; 964 struct mbuf *m; 965 966 total_bytes = 0; 967 m = sr->reply.chain; 968 while (m != 0) { 969 total_bytes += m->m_len; 970 m = m->m_next; 971 } 972 973 if ((offset + 3) > total_bytes) 974 return (-1); 975 976 (void) smb_mbc_peek(&sr->reply, offset, "b", &temp); 977 if (temp != wct) 978 return (-1); 979 980 if ((offset + (wct * 2 + 1)) > total_bytes) 981 return (-1); 982 983 /* reply wct & vwv seem ok, consider data now */ 984 offset += wct * 2 + 1; 985 986 if ((offset + 2) > total_bytes) 987 return (-1); 988 989 (void) smb_mbc_peek(&sr->reply, offset, "bb", &temp, &temp1); 990 if (bcc == VAR_BCC) { 991 if ((temp != 0xFF) || (temp1 != 0xFF)) { 992 return (-1); 993 } else { 994 bcc = (total_bytes - offset) - 2; 995 (void) smb_mbc_poke(&sr->reply, offset, "bb", 996 bcc, bcc >> 8); 997 } 998 } else { 999 if ((temp != (bcc&0xFF)) || (temp1 != ((bcc>>8)&0xFF))) 1000 return (-1); 1001 } 1002 1003 offset += bcc + 2; 1004 1005 if (offset != total_bytes) 1006 return (-1); 1007 1008 sr->smb_wct = (unsigned char)wct; 1009 sr->smb_bcc = (uint16_t)bcc; 1010 return (0); 1011 } 1012 1013 int 1014 smbsr_decode_vwv(struct smb_request *sr, const char *fmt, ...) 1015 { 1016 int rc; 1017 va_list ap; 1018 1019 va_start(ap, fmt); 1020 rc = smb_mbc_vdecodef(&sr->smb_vwv, fmt, ap); 1021 va_end(ap); 1022 1023 if (rc) 1024 smbsr_error(sr, 0, ERRSRV, ERRerror); 1025 return (rc); 1026 } 1027 1028 int 1029 smbsr_decode_data(struct smb_request *sr, const char *fmt, ...) 1030 { 1031 int rc; 1032 va_list ap; 1033 1034 va_start(ap, fmt); 1035 rc = smb_mbc_vdecodef(&sr->smb_data, fmt, ap); 1036 va_end(ap); 1037 1038 if (rc) 1039 smbsr_error(sr, 0, ERRSRV, ERRerror); 1040 return (rc); 1041 } 1042 1043 boolean_t 1044 smbsr_decode_data_avail(smb_request_t *sr) 1045 { 1046 return (sr->smb_data.chain_offset < sr->smb_data.max_bytes); 1047 } 1048 1049 void 1050 smbsr_send_reply(smb_request_t *sr) 1051 { 1052 uint16_t pid_hi, pid_lo; 1053 1054 if (SMB_TREE_IS_CASEINSENSITIVE(sr)) 1055 sr->smb_flg |= SMB_FLAGS_CASE_INSENSITIVE; 1056 else 1057 sr->smb_flg &= ~SMB_FLAGS_CASE_INSENSITIVE; 1058 pid_hi = sr->smb_pid >> 16; 1059 pid_lo = (uint16_t)sr->smb_pid; 1060 1061 (void) smb_mbc_poke(&sr->reply, 0, SMB_HEADER_ED_FMT, 1062 sr->first_smb_com, 1063 sr->smb_rcls, 1064 sr->smb_reh, 1065 sr->smb_err, 1066 sr->smb_flg | SMB_FLAGS_REPLY, 1067 sr->smb_flg2, 1068 pid_hi, 1069 sr->smb_sig, 1070 sr->smb_tid, 1071 pid_lo, 1072 sr->smb_uid, 1073 sr->smb_mid); 1074 1075 if (sr->session->signing.flags & SMB_SIGNING_ENABLED) 1076 smb_sign_reply(sr, NULL); 1077 1078 if (smb_session_send(sr->session, 0, &sr->reply) == 0) 1079 sr->reply.chain = 0; 1080 } 1081 1082 void 1083 smbsr_map_errno(int errnum, smb_error_t *err) 1084 { 1085 uint32_t status; 1086 uint16_t doserr; 1087 1088 status = smb_errno2status(errnum); 1089 doserr = smb_status2doserr(status); 1090 1091 err->status = status; 1092 err->errcls = ERRDOS; 1093 err->errcode = doserr; 1094 } 1095 1096 void 1097 smbsr_errno(struct smb_request *sr, int errnum) 1098 { 1099 smbsr_map_errno(errnum, &sr->smb_error); 1100 smbsr_set_error(sr, &sr->smb_error); 1101 } 1102 1103 /* 1104 * Report a request processing status (error or warning). 1105 */ 1106 void 1107 smbsr_status(smb_request_t *sr, DWORD status, uint16_t errcls, uint16_t errcode) 1108 { 1109 1110 sr->smb_error.status = status; 1111 1112 /* 1113 * This function is SMB1 specific. While adding SMB2 support, 1114 * calls to this function have been removed from common code. 1115 * In case we missed any, check for SMB2 callers here, and 1116 * vector into a wrapper function that we can watch for... 1117 * (and track down with dtrace:) 1118 */ 1119 if (sr->session->dialect >= SMB_VERS_2_BASE) { 1120 smbsr_status_smb2(sr, status); 1121 return; 1122 } 1123 1124 if (status != 0 && errcls == 0 && errcode == 0) { 1125 errcls = ERRDOS; 1126 errcode = smb_status2doserr(status); 1127 } 1128 1129 sr->smb_error.errcls = errcls; 1130 sr->smb_error.errcode = errcode; 1131 1132 smbsr_set_error(sr, &sr->smb_error); 1133 } 1134 1135 /* 1136 * Setup a request processing error. This function can be used to 1137 * report 32-bit status codes or DOS errors. Set the status code 1138 * to 0 (NT_STATUS_SUCCESS) to explicitly report a DOS error, 1139 * regardless of the client capabilities. 1140 * 1141 * If status is non-zero and the client supports 32-bit status 1142 * codes, report the status. Otherwise, report the DOS error. 1143 */ 1144 void 1145 smbsr_set_error(smb_request_t *sr, smb_error_t *err) 1146 { 1147 uint32_t status; 1148 uint32_t capabilities; 1149 1150 ASSERT(sr); 1151 ASSERT(err); 1152 1153 status = err->status; 1154 capabilities = sr->session->capabilities; 1155 1156 if ((err->errcls == 0) && (err->errcode == 0)) { 1157 capabilities |= CAP_STATUS32; 1158 if (status == 0) 1159 status = NT_STATUS_INTERNAL_ERROR; 1160 } 1161 1162 if ((capabilities & CAP_STATUS32) && (status != 0)) { 1163 sr->smb_rcls = status & 0xff; 1164 sr->smb_reh = (status >> 8) & 0xff; 1165 sr->smb_err = status >> 16; 1166 sr->smb_flg2 |= SMB_FLAGS2_NT_STATUS; 1167 } else { 1168 if ((err->errcls == 0) || (err->errcode == 0)) { 1169 sr->smb_rcls = ERRSRV; 1170 sr->smb_err = ERRerror; 1171 } else { 1172 sr->smb_rcls = (uint8_t)err->errcls; 1173 sr->smb_err = (uint16_t)err->errcode; 1174 } 1175 } 1176 } 1177 1178 smb_xa_t * 1179 smbsr_lookup_xa(smb_request_t *sr) 1180 { 1181 ASSERT(sr->r_xa == 0); 1182 1183 sr->r_xa = smb_xa_find(sr->session, sr->smb_pid, sr->smb_mid); 1184 return (sr->r_xa); 1185 } 1186 1187 void 1188 smbsr_release_file(smb_request_t *sr) 1189 { 1190 smb_ofile_t *of = sr->fid_ofile; 1191 1192 sr->fid_ofile = NULL; 1193 (void) smb_ofile_release(of); 1194 } 1195 1196 void 1197 smbsr_lookup_file(smb_request_t *sr) 1198 { 1199 if (sr->fid_ofile == NULL) 1200 sr->fid_ofile = smb_ofile_lookup_by_fid(sr, sr->smb_fid); 1201 } 1202 1203 static int 1204 is_andx_com(unsigned char com) 1205 { 1206 switch (com) { 1207 case SMB_COM_LOCKING_ANDX: 1208 case SMB_COM_OPEN_ANDX: 1209 case SMB_COM_READ_ANDX: 1210 case SMB_COM_WRITE_ANDX: 1211 case SMB_COM_SESSION_SETUP_ANDX: 1212 case SMB_COM_LOGOFF_ANDX: 1213 case SMB_COM_TREE_CONNECT_ANDX: 1214 case SMB_COM_NT_CREATE_ANDX: 1215 return (1); 1216 } 1217 return (0); 1218 } 1219 1220 /* 1221 * Invalid command stubs. 1222 * 1223 * The Read/Write Block Multiplexed (mpx) protocol is used to maximize 1224 * performance when reading/writing a large block of data: it can be 1225 * used in parallel with other client/server operations. The mpx sub- 1226 * protocol is not supported because we support only connection oriented 1227 * transports and NT supports mpx only over connectionless transports. 1228 */ 1229 smb_sdrc_t 1230 smb_pre_invalid(smb_request_t *sr) 1231 { 1232 DTRACE_SMB_1(op__Invalid__start, smb_request_t *, sr); 1233 return (SDRC_SUCCESS); 1234 } 1235 1236 void 1237 smb_post_invalid(smb_request_t *sr) 1238 { 1239 DTRACE_SMB_1(op__Invalid__done, smb_request_t *, sr); 1240 } 1241 1242 smb_sdrc_t 1243 smb_com_invalid(smb_request_t *sr) 1244 { 1245 smb_sdrc_t sdrc; 1246 1247 switch (sr->smb_com) { 1248 case SMB_COM_WRITE_COMPLETE: 1249 smbsr_error(sr, 0, ERRSRV, ERRerror); 1250 sdrc = SDRC_ERROR; 1251 break; 1252 1253 default: 1254 smbsr_error(sr, NT_STATUS_NOT_IMPLEMENTED, 1255 ERRDOS, ERROR_INVALID_FUNCTION); 1256 sdrc = SDRC_NOT_IMPLEMENTED; 1257 break; 1258 } 1259 1260 return (sdrc); 1261 } 1262 1263 /* 1264 * smb_dispatch_stats_init 1265 * 1266 * Initializes dispatch statistics. 1267 */ 1268 void 1269 smb_dispatch_stats_init(smb_server_t *sv) 1270 { 1271 smb_disp_stats_t *sds = sv->sv_disp_stats1; 1272 smb_kstat_req_t *ksr; 1273 int i; 1274 1275 ksr = ((smbsrv_kstats_t *)sv->sv_ksp->ks_data)->ks_reqs1; 1276 1277 for (i = 0; i < SMB_COM_NUM; i++, ksr++) { 1278 smb_latency_init(&sds[i].sdt_lat); 1279 (void) strlcpy(ksr->kr_name, smb_disp_table[i].sdt_name, 1280 sizeof (ksr->kr_name)); 1281 } 1282 } 1283 1284 /* 1285 * smb_dispatch_stats_fini 1286 * 1287 * Frees and destroyes the resources used for statistics. 1288 */ 1289 void 1290 smb_dispatch_stats_fini(smb_server_t *sv) 1291 { 1292 smb_disp_stats_t *sds = sv->sv_disp_stats1; 1293 int i; 1294 1295 for (i = 0; i < SMB_COM_NUM; i++) 1296 smb_latency_destroy(&sds[i].sdt_lat); 1297 } 1298 1299 void 1300 smb_dispatch_stats_update(smb_server_t *sv, 1301 smb_kstat_req_t *ksr, int first, int nreq) 1302 { 1303 smb_disp_stats_t *sds = sv->sv_disp_stats1; 1304 int i; 1305 int last; 1306 1307 last = first + nreq - 1; 1308 1309 if ((first < SMB_COM_NUM) && (last < SMB_COM_NUM)) { 1310 for (i = first; i <= last; i++, ksr++) { 1311 ksr->kr_rxb = sds[i].sdt_rxb; 1312 ksr->kr_txb = sds[i].sdt_txb; 1313 mutex_enter(&sds[i].sdt_lat.ly_mutex); 1314 ksr->kr_nreq = sds[i].sdt_lat.ly_a_nreq; 1315 ksr->kr_sum = sds[i].sdt_lat.ly_a_sum; 1316 ksr->kr_a_mean = sds[i].sdt_lat.ly_a_mean; 1317 ksr->kr_a_stddev = 1318 sds[i].sdt_lat.ly_a_stddev; 1319 ksr->kr_d_mean = sds[i].sdt_lat.ly_d_mean; 1320 ksr->kr_d_stddev = 1321 sds[i].sdt_lat.ly_d_stddev; 1322 sds[i].sdt_lat.ly_d_mean = 0; 1323 sds[i].sdt_lat.ly_d_nreq = 0; 1324 sds[i].sdt_lat.ly_d_stddev = 0; 1325 sds[i].sdt_lat.ly_d_sum = 0; 1326 mutex_exit(&sds[i].sdt_lat.ly_mutex); 1327 } 1328 } 1329 } 1330