xref: /illumos-gate/usr/src/uts/common/fs/smbsrv/smb_dispatch.c (revision 5677e04907859594bfe1a95ba3bfdb1629b89dac)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
25  */
26 
27 /*
28  * SMB requests.
29  *
30  * Request
31  *   Header
32  *	Magic		0xFF 'S' 'M' 'B'
33  *	smb_com 	a byte, the "first" command
34  *	Error		a 4-byte union, ignored in a request
35  *	smb_flg		a one byte set of eight flags
36  *	smb_flg2	a two byte set of 16 flags
37  *	.		twelve reserved bytes, have a role
38  *			in connectionless transports (IPX, UDP?)
39  *	smb_tid		a 16-bit tree ID, a mount point sorta,
40  *			0xFFFF is this command does not have
41  *			or require a tree context
42  *	smb_pid		a 16-bit process ID
43  *	smb_uid		a 16-bit user ID, specific to this "session"
44  *			and mapped to a system (bona-fide) UID
45  *	smb_mid		a 16-bit multiplex ID, used to differentiate
46  *			multiple simultaneous requests from the same
47  *			process (pid) (ref RPC "xid")
48  *
49  *   Chained (AndX) commands (0 or more)
50  *	smb_wct		a byte, number of 16-bit words containing
51  *			command parameters, min 2 for chained command
52  *	andx_com	a byte, the "next" command, 0xFF for none
53  *	.		an unused byte
54  *	andx_off	a 16-bit offset, byte displacement from &Magic
55  *			to the smb_wct field of the "next" command,
56  *			ignore if andx_com is 0xFF, s/b 0 if no next
57  *	smb_vwv[]	0 or more 16-bit (sorta) parameters for
58  *			"this" command (i.e. smb_com if this is the
59  *			first parameters, or the andx_com of the just
60  *			previous block.
61  *	smb_bcc		a 16-bit count of smb_data[] bytes
62  *	smb_data[]	0 or more bytes, format specific to commands
63  *	padding[]	Optional padding
64  *
65  *   Last command
66  *	smb_wct		a byte, number of 16-bit words containing
67  *			command parameters, min 0 for chained command
68  *	smb_vwv[]	0 or more 16-bit (sorta) parameters for
69  *			"this" command (i.e. smb_com if this is the
70  *			first parameters, or the andx_com of the just
71  *			previous block.
72  *	smb_bcc		a 16-bit count of smb_data[] bytes
73  *	smb_data[]	0 or more bytes, format specific to commands
74  *
75  * Reply
76  *   Header
77  *	Magic		0xFF 'S' 'M' 'B'
78  *	smb_com 	a byte, the "first" command, corresponds
79  *			to request
80  *	Error		a 4-byte union, coding depends on dialect in use
81  *			for "DOS" errors
82  *				a byte for error class
83  *				an unused byte
84  *				a 16-bit word for error code
85  *			for "NT" errors
86  *				a 32-bit error code which
87  *				is a packed class and specifier
88  *			for "OS/2" errors
89  *				I don't know
90  *			The error information is specific to the
91  *			last command in the reply chain.
92  *	smb_flg		a one byte set of eight flags, 0x80 bit set
93  *			indicating this message is a reply
94  *	smb_flg2	a two byte set of 16 flags
95  *	.		twelve reserved bytes, have a role
96  *			in connectionless transports (IPX, UDP?)
97  *	smb_tid		a 16-bit tree ID, a mount point sorta,
98  *			should be the same as the request
99  *	smb_pid		a 16-bit process ID, MUST BE the same as request
100  *	smb_uid		a 16-bit user ID, specific to this "session"
101  *			and mapped to a system (bona-fide) UID,
102  *			should be the same as request
103  *	smb_mid		a 16-bit multiplex ID, used to differentiate
104  *			multiple simultaneous requests from the same
105  *			process (pid) (ref RPC "xid"), MUST BE the
106  *			same as request
107  *	padding[]	Optional padding
108  *
109  *   Chained (AndX) commands (0 or more)
110  *	smb_wct		a byte, number of 16-bit words containing
111  *			command parameters, min 2 for chained command,
112  *	andx_com	a byte, the "next" command, 0xFF for none,
113  *			corresponds to request, if this is the chained
114  *			command that had an error set to 0xFF
115  *	.		an unused byte
116  *	andx_off	a 16-bit offset, byte displacement from &Magic
117  *			to the smb_wct field of the "next" command,
118  *			ignore if andx_com is 0xFF, s/b 0 if no next
119  *	smb_vwv[]	0 or more 16-bit (sorta) parameters for
120  *			"this" command (i.e. smb_com if this is the
121  *			first parameters, or the andx_com of the just
122  *			previous block. Empty if an error.
123  *	smb_bcc		a 16-bit count of smb_data[] bytes
124  *	smb_data[]	0 or more bytes, format specific to commands
125  *			empty if an error.
126  *
127  *   Last command
128  *	smb_wct		a byte, number of 16-bit words containing
129  *			command parameters, min 0 for chained command
130  *	smb_vwv[]	0 or more 16-bit (sorta) parameters for
131  *			"this" command (i.e. smb_com if this is the
132  *			first parameters, or the andx_com of the just
133  *			previous block, empty if an error.
134  *	smb_bcc		a 16-bit count of smb_data[] bytes
135  *	smb_data[]	0 or more bytes, format specific to commands,
136  *			empty if an error.
137  */
138 
139 #include <smbsrv/smb_kproto.h>
140 #include <smbsrv/smb_kstat.h>
141 #include <sys/sdt.h>
142 #include <sys/spl.h>
143 
144 static int is_andx_com(unsigned char);
145 static int smbsr_check_result(struct smb_request *, int, int);
146 static void smb1_tq_work(void *);
147 
148 static const smb_disp_entry_t
149 smb_disp_table[SMB_COM_NUM] = {
150 	{ "SmbCreateDirectory", SMB_SDT_OPS(create_directory),  /* 0x00 000 */
151 	    0x00, PC_NETWORK_PROGRAM_1_0 },
152 	{ "SmbDeleteDirectory", SMB_SDT_OPS(delete_directory),	/* 0x01 001 */
153 	    0x01, PC_NETWORK_PROGRAM_1_0 },
154 	{ "SmbOpen", SMB_SDT_OPS(open),				/* 0x02 002 */
155 	    0x02, PC_NETWORK_PROGRAM_1_0 },
156 	{ "SmbCreate", SMB_SDT_OPS(create),			/* 0x03 003 */
157 	    0x03, PC_NETWORK_PROGRAM_1_0 },
158 	{ "SmbClose", SMB_SDT_OPS(close),			/* 0x04 004 */
159 	    0x04, PC_NETWORK_PROGRAM_1_0 },
160 	{ "SmbFlush", SMB_SDT_OPS(flush),			/* 0x05 005 */
161 	    0x05, PC_NETWORK_PROGRAM_1_0 },
162 	{ "SmbDelete", SMB_SDT_OPS(delete),			/* 0x06 006 */
163 	    0x06, PC_NETWORK_PROGRAM_1_0 },
164 	{ "SmbRename", SMB_SDT_OPS(rename),			/* 0x07 007 */
165 	    0x07, PC_NETWORK_PROGRAM_1_0 },
166 	{ "SmbQueryInformation", SMB_SDT_OPS(query_information), /* 0x08 008 */
167 	    0x08, PC_NETWORK_PROGRAM_1_0 },
168 	{ "SmbSetInformation", SMB_SDT_OPS(set_information),	/* 0x09 009 */
169 	    0x09, PC_NETWORK_PROGRAM_1_0 },
170 	{ "SmbRead", SMB_SDT_OPS(read),				/* 0x0A 010 */
171 	    0x0A, PC_NETWORK_PROGRAM_1_0 },
172 	{ "SmbWrite", SMB_SDT_OPS(write),			/* 0x0B 011 */
173 	    0x0B, PC_NETWORK_PROGRAM_1_0 },
174 	{ "SmbLockByteRange", SMB_SDT_OPS(lock_byte_range),	/* 0x0C 012 */
175 	    0x0C, PC_NETWORK_PROGRAM_1_0 },
176 	{ "SmbUnlockByteRange", SMB_SDT_OPS(unlock_byte_range),	/* 0x0D 013 */
177 	    0x0D, PC_NETWORK_PROGRAM_1_0 },
178 	{ "SmbCreateTemporary", SMB_SDT_OPS(create_temporary),	/* 0x0E 014 */
179 	    0x0E, PC_NETWORK_PROGRAM_1_0 },
180 	{ "SmbCreateNew", SMB_SDT_OPS(create_new),		/* 0x0F 015 */
181 	    0x0F, PC_NETWORK_PROGRAM_1_0 },
182 	{ "SmbCheckDirectory", SMB_SDT_OPS(check_directory),	/* 0x10 016 */
183 	    0x10, PC_NETWORK_PROGRAM_1_0 },
184 	{ "SmbProcessExit", SMB_SDT_OPS(process_exit),		/* 0x11 017 */
185 	    0x11, PC_NETWORK_PROGRAM_1_0,
186 	    SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
187 	{ "SmbSeek", SMB_SDT_OPS(seek),				/* 0x12 018 */
188 	    0x12, PC_NETWORK_PROGRAM_1_0 },
189 	{ "SmbLockAndRead", SMB_SDT_OPS(lock_and_read),		/* 0x13 019 */
190 	    0x13, LANMAN1_0 },
191 	{ "SmbWriteAndUnlock", SMB_SDT_OPS(write_and_unlock),	/* 0x14 020 */
192 	    0x14, LANMAN1_0 },
193 	{ "Invalid", SMB_SDT_OPS(invalid), 0x15, 0 },		/* 0x15	021 */
194 	{ "Invalid", SMB_SDT_OPS(invalid), 0x16, 0 },		/* 0x16 022 */
195 	{ "Invalid", SMB_SDT_OPS(invalid), 0x17, 0 },		/* 0x17 023 */
196 	{ "Invalid", SMB_SDT_OPS(invalid), 0x18, 0 },		/* 0x18 024 */
197 	{ "Invalid", SMB_SDT_OPS(invalid), 0x19, 0 },		/* 0x19 025 */
198 	{ "SmbReadRaw", SMB_SDT_OPS(invalid), 0x1A, 0 },	/* 0x1A 026 */
199 	{ "Invalid", SMB_SDT_OPS(invalid), 0x1B, 0 },		/* 0x1B 027 */
200 	{ "Invalid", SMB_SDT_OPS(invalid), 0x1C, 0 },		/* 0x1C 028 */
201 	{ "SmbWriteRaw", SMB_SDT_OPS(invalid), 0x1D, 0 },	/* 0x1D 029 */
202 	{ "Invalid", SMB_SDT_OPS(invalid), 0x1E, 0 },		/* 0x1E 030 */
203 	{ "Invalid", SMB_SDT_OPS(invalid), 0x1F, 0 },		/* 0x1F 031 */
204 	{ "Invalid", SMB_SDT_OPS(invalid), 0x20, 0 },		/* 0x20 032 */
205 	{ "Invalid", SMB_SDT_OPS(invalid), 0x21, 0 },		/* 0x21 033 */
206 	{ "SmbSetInformation2", SMB_SDT_OPS(set_information2),	/* 0x22 034 */
207 	    0x22, LANMAN1_0 },
208 	{ "SmbQueryInformation2",
209 	    SMB_SDT_OPS(query_information2),			/* 0x23 035 */
210 	    0x23, LANMAN1_0 },
211 	{ "SmbLockingX", SMB_SDT_OPS(locking_andx),		/* 0x24 036 */
212 	    0x24, LANMAN1_0 },
213 	{ "SmbTransaction", SMB_SDT_OPS(transaction),		/* 0x25 037 */
214 	    0x25, LANMAN1_0 },
215 	{ "SmbTransactionSecondary",
216 	    SMB_SDT_OPS(transaction_secondary),			/* 0x26 038 */
217 	    0x26, LANMAN1_0 },
218 	{ "SmbIoctl", SMB_SDT_OPS(ioctl),			/* 0x27 039 */
219 	    0x27, LANMAN1_0 },
220 	{ "Invalid", SMB_SDT_OPS(invalid), 0x28, 0 },	/* 0x28 040 */
221 	{ "Invalid", SMB_SDT_OPS(invalid), 0x29, 0 },	/* 0x29 041 */
222 	{ "Invalid", SMB_SDT_OPS(invalid), 0x2A, 0 },	/* 0x2A 042 */
223 	{ "SmbEcho", SMB_SDT_OPS(echo),				/* 0x2B 043 */
224 	    0x2B, LANMAN1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
225 	{ "SmbWriteAndClose", SMB_SDT_OPS(write_and_close),	/* 0x2C 044 */
226 	    0x2C, LANMAN1_0 },
227 	{ "SmbOpenX", SMB_SDT_OPS(open_andx),			/* 0x2D 045 */
228 	    0x2D, LANMAN1_0 },
229 	{ "SmbReadX", SMB_SDT_OPS(read_andx),			/* 0x2E 046 */
230 	    0x2E, LANMAN1_0 },
231 	{ "SmbWriteX", SMB_SDT_OPS(write_andx),			/* 0x2F 047 */
232 	    0x2F, LANMAN1_0 },
233 	{ "Invalid", SMB_SDT_OPS(invalid), 0x30, 0 },	/* 0x30 048 */
234 	{ "SmbCloseAndTreeDisconnect",
235 	    SMB_SDT_OPS(close_and_tree_disconnect),		/* 0x31 049 */
236 	    0x31, LANMAN1_0 },
237 	{ "SmbTransaction2", SMB_SDT_OPS(transaction2),		/* 0x32 050 */
238 	    0x32, LM1_2X002 },
239 	{ "SmbTransaction2Secondary",
240 	    SMB_SDT_OPS(transaction2_secondary),		/* 0x33 051 */
241 	    0x33, LM1_2X002 },
242 	{ "SmbFindClose2", SMB_SDT_OPS(find_close2),		/* 0x34 052 */
243 	    0x34, LM1_2X002 },
244 	{ "Invalid", SMB_SDT_OPS(invalid), 0x35, 0 },	/* 0x35 053 */
245 	{ "Invalid", SMB_SDT_OPS(invalid), 0x36, 0 },	/* 0x36 054 */
246 	{ "Invalid", SMB_SDT_OPS(invalid), 0x37, 0 },	/* 0x37 055 */
247 	{ "Invalid", SMB_SDT_OPS(invalid), 0x38, 0 },	/* 0x38 056 */
248 	{ "Invalid", SMB_SDT_OPS(invalid), 0x39, 0 },	/* 0x39 057 */
249 	{ "Invalid", SMB_SDT_OPS(invalid), 0x3A, 0 },	/* 0x3A 058 */
250 	{ "Invalid", SMB_SDT_OPS(invalid), 0x3B, 0 },	/* 0x3B 059 */
251 	{ "Invalid", SMB_SDT_OPS(invalid), 0x3C, 0 },	/* 0x3C 060 */
252 	{ "Invalid", SMB_SDT_OPS(invalid), 0x3D, 0 },	/* 0x3D 061 */
253 	{ "Invalid", SMB_SDT_OPS(invalid), 0x3E, 0 },	/* 0x3E 062 */
254 	{ "Invalid", SMB_SDT_OPS(invalid), 0x3F, 0 },	/* 0x3F 063 */
255 	{ "Invalid", SMB_SDT_OPS(invalid), 0x40, 0 },	/* 0x40 064 */
256 	{ "Invalid", SMB_SDT_OPS(invalid), 0x47, 0 },	/* 0x47 065 */
257 	{ "Invalid", SMB_SDT_OPS(invalid), 0x48, 0 },	/* 0x48 066 */
258 	{ "Invalid", SMB_SDT_OPS(invalid), 0x49, 0 },	/* 0x49 067 */
259 	{ "Invalid", SMB_SDT_OPS(invalid), 0x44, 0 },	/* 0x44 068 */
260 	{ "Invalid", SMB_SDT_OPS(invalid), 0x45, 0 },	/* 0x45 069 */
261 	{ "Invalid", SMB_SDT_OPS(invalid), 0x46, 0 },	/* 0x46 070 */
262 	{ "Invalid", SMB_SDT_OPS(invalid), 0x47, 0 },	/* 0x47 071 */
263 	{ "Invalid", SMB_SDT_OPS(invalid), 0x48, 0 },	/* 0x48 072 */
264 	{ "Invalid", SMB_SDT_OPS(invalid), 0x49, 0 },	/* 0x49 073 */
265 	{ "Invalid", SMB_SDT_OPS(invalid), 0x4A, 0 },	/* 0x4A 074 */
266 	{ "Invalid", SMB_SDT_OPS(invalid), 0x4B, 0 },	/* 0x4B 075 */
267 	{ "Invalid", SMB_SDT_OPS(invalid), 0x4C, 0 },	/* 0x4C 076 */
268 	{ "Invalid", SMB_SDT_OPS(invalid), 0x4D, 0 },	/* 0x4D 077 */
269 	{ "Invalid", SMB_SDT_OPS(invalid), 0x4E, 0 },	/* 0x4E 078 */
270 	{ "Invalid", SMB_SDT_OPS(invalid), 0x4F, 0 },	/* 0x4F 079 */
271 	{ "Invalid", SMB_SDT_OPS(invalid), 0x50, 0 },	/* 0x50 080 */
272 	{ "Invalid", SMB_SDT_OPS(invalid), 0x51, 0 },	/* 0x51 081 */
273 	{ "Invalid", SMB_SDT_OPS(invalid), 0x52, 0 },	/* 0x52 082 */
274 	{ "Invalid", SMB_SDT_OPS(invalid), 0x53, 0 },	/* 0x53 083 */
275 	{ "Invalid", SMB_SDT_OPS(invalid), 0x54, 0 },	/* 0x54 084 */
276 	{ "Invalid", SMB_SDT_OPS(invalid), 0x55, 0 },	/* 0x55 085 */
277 	{ "Invalid", SMB_SDT_OPS(invalid), 0x56, 0 },	/* 0x56 086 */
278 	{ "Invalid", SMB_SDT_OPS(invalid), 0x57, 0 },	/* 0x57 087 */
279 	{ "Invalid", SMB_SDT_OPS(invalid), 0x58, 0 },	/* 0x58 088 */
280 	{ "Invalid", SMB_SDT_OPS(invalid), 0x59, 0 },	/* 0x59 089 */
281 	{ "Invalid", SMB_SDT_OPS(invalid), 0x5A, 0 },	/* 0x5A 090 */
282 	{ "Invalid", SMB_SDT_OPS(invalid), 0x5B, 0 },	/* 0x5B 091 */
283 	{ "Invalid", SMB_SDT_OPS(invalid), 0x5C, 0 },	/* 0x5C 092 */
284 	{ "Invalid", SMB_SDT_OPS(invalid), 0x5D, 0 },	/* 0x5D 093 */
285 	{ "Invalid", SMB_SDT_OPS(invalid), 0x5E, 0 },	/* 0x5E 094 */
286 	{ "Invalid", SMB_SDT_OPS(invalid), 0x5F, 0 },	/* 0x5F 095 */
287 	{ "Invalid", SMB_SDT_OPS(invalid), 0x60, 0 },	/* 0x60 096 */
288 	{ "Invalid", SMB_SDT_OPS(invalid), 0x61, 0 },	/* 0x61 097 */
289 	{ "Invalid", SMB_SDT_OPS(invalid), 0x62, 0 },	/* 0x62 098 */
290 	{ "Invalid", SMB_SDT_OPS(invalid), 0x63, 0 },	/* 0x63 099 */
291 	{ "Invalid", SMB_SDT_OPS(invalid), 0x64, 0 },	/* 0x64 100 */
292 	{ "Invalid", SMB_SDT_OPS(invalid), 0x65, 0 },	/* 0x65 101 */
293 	{ "Invalid", SMB_SDT_OPS(invalid), 0x66, 0 },	/* 0x66 102 */
294 	{ "Invalid", SMB_SDT_OPS(invalid), 0x67, 0 },	/* 0x67 103 */
295 	{ "Invalid", SMB_SDT_OPS(invalid), 0x68, 0 },	/* 0x68 104 */
296 	{ "Invalid", SMB_SDT_OPS(invalid), 0x69, 0 },	/* 0x69 105 */
297 	{ "Invalid", SMB_SDT_OPS(invalid), 0x6A, 0 },	/* 0x6A 106 */
298 	{ "Invalid", SMB_SDT_OPS(invalid), 0x6B, 0 },	/* 0x6B 107 */
299 	{ "Invalid", SMB_SDT_OPS(invalid), 0x6C, 0 },	/* 0x6C 108 */
300 	{ "Invalid", SMB_SDT_OPS(invalid), 0x6D, 0 },	/* 0x6D 109 */
301 	{ "Invalid", SMB_SDT_OPS(invalid), 0x6E, 0 },	/* 0x6E 110 */
302 	{ "Invalid", SMB_SDT_OPS(invalid), 0x6F, 0 },	/* 0x6F 111 */
303 	{ "SmbTreeConnect", SMB_SDT_OPS(tree_connect),		/* 0x70 112 */
304 	    0x70, PC_NETWORK_PROGRAM_1_0, SDDF_SUPPRESS_TID },
305 	{ "SmbTreeDisconnect", SMB_SDT_OPS(tree_disconnect),	/* 0x71 113 */
306 	    0x71, PC_NETWORK_PROGRAM_1_0,
307 	    SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
308 	/*
309 	 * NB: Negotiate gets special handling via
310 	 * smb_initial_request_handler.  After that,
311 	 * another Negotiate is an invalid request.
312 	 */
313 	{ "SmbNegotiate", SMB_SDT_OPS(invalid),			/* 0x72 114 */
314 	    0x72, PC_NETWORK_PROGRAM_1_0,
315 	    SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
316 	{ "SmbSessionSetupX", SMB_SDT_OPS(session_setup_andx),	/* 0x73 115 */
317 	    0x73, LANMAN1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
318 	{ "SmbLogoffX", SMB_SDT_OPS(logoff_andx),		/* 0x74 116 */
319 	    0x74, LM1_2X002, SDDF_SUPPRESS_TID },
320 	{ "SmbTreeConnectX", SMB_SDT_OPS(tree_connect_andx),	/* 0x75 117 */
321 	    0x75, LANMAN1_0, SDDF_SUPPRESS_TID },
322 	{ "Invalid", SMB_SDT_OPS(invalid), 0x76, 0, 0 },	/* 0x76 118 */
323 	{ "Invalid", SMB_SDT_OPS(invalid), 0x77, 0, 0 },	/* 0x77 119 */
324 	{ "Invalid", SMB_SDT_OPS(invalid), 0x78, 0, 0 },	/* 0x78 120 */
325 	{ "Invalid", SMB_SDT_OPS(invalid), 0x79, 0, 0 },	/* 0x79 121 */
326 	{ "Invalid", SMB_SDT_OPS(invalid), 0x7A, 0, 0 },	/* 0x7A 122 */
327 	{ "Invalid", SMB_SDT_OPS(invalid), 0x7B, 0, 0 },	/* 0x7B 123 */
328 	{ "Invalid", SMB_SDT_OPS(invalid), 0x7C, 0, 0 },	/* 0x7C 124 */
329 	{ "Invalid", SMB_SDT_OPS(invalid), 0x7D, 0, 0 },	/* 0x7D 125 */
330 	{ "Invalid", SMB_SDT_OPS(invalid), 0x7E, 0, 0 },	/* 0x7E 126 */
331 	{ "Invalid", SMB_SDT_OPS(invalid), 0x7F, 0, 0 },	/* 0x7F 127 */
332 	{ "SmbQueryInformationDisk",
333 	    SMB_SDT_OPS(query_information_disk),		/* 0x80 128 */
334 	    0x80, PC_NETWORK_PROGRAM_1_0, 0 },
335 	{ "SmbSearch", SMB_SDT_OPS(search),			/* 0x81 129 */
336 	    0x81, PC_NETWORK_PROGRAM_1_0, 0 },
337 	{ "SmbFind", SMB_SDT_OPS(find),				/* 0x82 130 */
338 	    0x82, LANMAN1_0, 0 },
339 	{ "SmbFindUnique", SMB_SDT_OPS(find_unique),		/* 0x83 131 */
340 	    0x83, LANMAN1_0, 0 },
341 	{ "SmbFindClose", SMB_SDT_OPS(find_close),		/* 0x84 132 */
342 	    0x84, LANMAN1_0, 0 },
343 	{ "Invalid", SMB_SDT_OPS(invalid), 0x85, 0, 0 },	/* 0x85 133 */
344 	{ "Invalid", SMB_SDT_OPS(invalid), 0x86, 0, 0 },	/* 0x86 134 */
345 	{ "Invalid", SMB_SDT_OPS(invalid), 0x87, 0, 0 },	/* 0x87 135 */
346 	{ "Invalid", SMB_SDT_OPS(invalid), 0x88, 0, 0 },	/* 0x88 136 */
347 	{ "Invalid", SMB_SDT_OPS(invalid), 0x89, 0, 0 },	/* 0x89 137 */
348 	{ "Invalid", SMB_SDT_OPS(invalid), 0x8A, 0, 0 },	/* 0x8A 138 */
349 	{ "Invalid", SMB_SDT_OPS(invalid), 0x8B, 0, 0 },	/* 0x8B 139 */
350 	{ "Invalid", SMB_SDT_OPS(invalid), 0x8C, 0, 0 },	/* 0x8C 140 */
351 	{ "Invalid", SMB_SDT_OPS(invalid), 0x8D, 0, 0 },	/* 0x8D 141 */
352 	{ "Invalid", SMB_SDT_OPS(invalid), 0x8E, 0, 0 },	/* 0x8E 142 */
353 	{ "Invalid", SMB_SDT_OPS(invalid), 0x8F, 0, 0 },	/* 0x8F 143 */
354 	{ "Invalid", SMB_SDT_OPS(invalid), 0x90, 0, 0 },	/* 0x90 144 */
355 	{ "Invalid", SMB_SDT_OPS(invalid), 0x91, 0, 0 },	/* 0x91 145 */
356 	{ "Invalid", SMB_SDT_OPS(invalid), 0x92, 0, 0 },	/* 0x92 146 */
357 	{ "Invalid", SMB_SDT_OPS(invalid), 0x93, 0, 0 },	/* 0x93 147 */
358 	{ "Invalid", SMB_SDT_OPS(invalid), 0x94, 0, 0 },	/* 0x94 148 */
359 	{ "Invalid", SMB_SDT_OPS(invalid), 0x95, 0, 0 },	/* 0x95 149 */
360 	{ "Invalid", SMB_SDT_OPS(invalid), 0x96, 0, 0 },	/* 0x96 150 */
361 	{ "Invalid", SMB_SDT_OPS(invalid), 0x97, 0, 0 },	/* 0x97 151 */
362 	{ "Invalid", SMB_SDT_OPS(invalid), 0x98, 0, 0 },	/* 0x98 152 */
363 	{ "Invalid", SMB_SDT_OPS(invalid), 0x99, 0, 0 },	/* 0x99 153 */
364 	{ "Invalid", SMB_SDT_OPS(invalid), 0x9A, 0, 0 },	/* 0x9A 154 */
365 	{ "Invalid", SMB_SDT_OPS(invalid), 0x9B, 0, 0 },	/* 0x9B 155 */
366 	{ "Invalid", SMB_SDT_OPS(invalid), 0x9C, 0, 0 },	/* 0x9C 156 */
367 	{ "Invalid", SMB_SDT_OPS(invalid), 0x9D, 0, 0 },	/* 0x9D 157 */
368 	{ "Invalid", SMB_SDT_OPS(invalid), 0x9E, 0, 0 },	/* 0x9E 158 */
369 	{ "Invalid", SMB_SDT_OPS(invalid), 0x9F, 0, 0 },	/* 0x9F 159 */
370 	{ "SmbNtTransact", SMB_SDT_OPS(nt_transact),	/* 0xA0 160 */
371 	    0xA0, NT_LM_0_12, 0 },
372 	{ "SmbNtTransactSecondary",
373 	    SMB_SDT_OPS(nt_transact_secondary),			/* 0xA1 161 */
374 	    0xA1, NT_LM_0_12, 0 },
375 	{ "SmbNtCreateX", SMB_SDT_OPS(nt_create_andx),		/* 0xA2 162 */
376 	    0xA2, NT_LM_0_12, 0 },
377 	{ "Invalid", SMB_SDT_OPS(invalid), 0xA3, 0, 0 },	/* 0xA3 163 */
378 	{ "SmbNtCancel", SMB_SDT_OPS(nt_cancel),		/* 0xA4 164 */
379 	    0xA4, NT_LM_0_12, 0 },
380 	{ "SmbNtRename", SMB_SDT_OPS(nt_rename),		/* 0xA5 165 */
381 	    0xA5, NT_LM_0_12, 0 },
382 	{ "Invalid", SMB_SDT_OPS(invalid), 0xA6, 0, 0 },	/* 0xA6 166 */
383 	{ "Invalid", SMB_SDT_OPS(invalid), 0xA7, 0, 0 },	/* 0xA7 167 */
384 	{ "Invalid", SMB_SDT_OPS(invalid), 0xA8, 0, 0 },	/* 0xA8 168 */
385 	{ "Invalid", SMB_SDT_OPS(invalid), 0xA9, 0, 0 },	/* 0xA9 169 */
386 	{ "Invalid", SMB_SDT_OPS(invalid), 0xAA, 0, 0 },	/* 0xAA 170 */
387 	{ "Invalid", SMB_SDT_OPS(invalid), 0xAB, 0, 0 },	/* 0xAB 171 */
388 	{ "Invalid", SMB_SDT_OPS(invalid), 0xAC, 0, 0 },	/* 0xAC 172 */
389 	{ "Invalid", SMB_SDT_OPS(invalid), 0xAD, 0, 0 },	/* 0xAD 173 */
390 	{ "Invalid", SMB_SDT_OPS(invalid), 0xAE, 0, 0 },	/* 0xAE 174 */
391 	{ "Invalid", SMB_SDT_OPS(invalid), 0xAF, 0, 0 },	/* 0xAF 175 */
392 	{ "Invalid", SMB_SDT_OPS(invalid), 0xB0, 0, 0 },	/* 0xB0 176 */
393 	{ "Invalid", SMB_SDT_OPS(invalid), 0xB1, 0, 0 },	/* 0xB1 177 */
394 	{ "Invalid", SMB_SDT_OPS(invalid), 0xB2, 0, 0 },	/* 0xB2 178 */
395 	{ "Invalid", SMB_SDT_OPS(invalid), 0xB3, 0, 0 },	/* 0xB3 179 */
396 	{ "Invalid", SMB_SDT_OPS(invalid), 0xB4, 0, 0 },	/* 0xB4 180 */
397 	{ "Invalid", SMB_SDT_OPS(invalid), 0xB5, 0, 0 },	/* 0xB5 181 */
398 	{ "Invalid", SMB_SDT_OPS(invalid), 0xB6, 0, 0 },	/* 0xB6 182 */
399 	{ "Invalid", SMB_SDT_OPS(invalid), 0xB7, 0, 0 },	/* 0xB7 183 */
400 	{ "Invalid", SMB_SDT_OPS(invalid), 0xB8, 0, 0 },	/* 0xB8 184 */
401 	{ "Invalid", SMB_SDT_OPS(invalid), 0xB9, 0, 0 },	/* 0xB9 185 */
402 	{ "Invalid", SMB_SDT_OPS(invalid), 0xBA, 0, 0 },	/* 0xBA 186 */
403 	{ "Invalid", SMB_SDT_OPS(invalid), 0xBB, 0, 0 },	/* 0xBB 187 */
404 	{ "Invalid", SMB_SDT_OPS(invalid), 0xBC, 0, 0 },	/* 0xBC 188 */
405 	{ "Invalid", SMB_SDT_OPS(invalid), 0xBD, 0, 0 },	/* 0xBD 189 */
406 	{ "Invalid", SMB_SDT_OPS(invalid), 0xBE, 0, 0 },	/* 0xBE 190 */
407 	{ "Invalid", SMB_SDT_OPS(invalid), 0xBF, 0, 0 },	/* 0xBF 191 */
408 	{ "SmbOpenPrintFile", SMB_SDT_OPS(open_print_file),	/* 0xC0 192 */
409 	    0xC0, PC_NETWORK_PROGRAM_1_0, 0 },
410 	{ "SmbWritePrintFile", SMB_SDT_OPS(write_print_file),	/* 0xC1 193 */
411 	    0xC1, PC_NETWORK_PROGRAM_1_0, 0 },
412 	{ "SmbClosePrintFile", SMB_SDT_OPS(close_print_file),	/* 0xC2 194 */
413 	    0xC2, PC_NETWORK_PROGRAM_1_0, 0 },
414 	{ "SmbGetPrintQueue", SMB_SDT_OPS(get_print_queue),	/* 0xC3 195 */
415 	    0xC3, PC_NETWORK_PROGRAM_1_0, 0 },
416 	{ "Invalid", SMB_SDT_OPS(invalid), 0xC4, 0, 0 },	/* 0xC4 196 */
417 	{ "Invalid", SMB_SDT_OPS(invalid), 0xC5, 0, 0 },	/* 0xC5 197 */
418 	{ "Invalid", SMB_SDT_OPS(invalid), 0xC6, 0, 0 },	/* 0xC6 198 */
419 	{ "Invalid", SMB_SDT_OPS(invalid), 0xC7, 0, 0 },	/* 0xC7 199 */
420 	{ "Invalid", SMB_SDT_OPS(invalid), 0xC8, 0, 0 },	/* 0xC8 200 */
421 	{ "Invalid", SMB_SDT_OPS(invalid), 0xC9, 0, 0 },	/* 0xC9 201 */
422 	{ "Invalid", SMB_SDT_OPS(invalid), 0xCA, 0, 0 },	/* 0xCA 202 */
423 	{ "Invalid", SMB_SDT_OPS(invalid), 0xCB, 0, 0 },	/* 0xCB 203 */
424 	{ "Invalid", SMB_SDT_OPS(invalid), 0xCC, 0, 0 },	/* 0xCC 204 */
425 	{ "Invalid", SMB_SDT_OPS(invalid), 0xCD, 0, 0 },	/* 0xCD 205 */
426 	{ "Invalid", SMB_SDT_OPS(invalid), 0xCE, 0, 0 },	/* 0xCE 206 */
427 	{ "Invalid", SMB_SDT_OPS(invalid), 0xCF, 0, 0 },	/* 0xCF 207 */
428 	{ "Invalid", SMB_SDT_OPS(invalid), 0xD0, 0, 0 },	/* 0xD0 208 */
429 	{ "Invalid", SMB_SDT_OPS(invalid), 0xD1, 0, 0 },	/* 0xD1 209 */
430 	{ "Invalid", SMB_SDT_OPS(invalid), 0xD2, 0, 0 },	/* 0xD2 210 */
431 	{ "Invalid", SMB_SDT_OPS(invalid), 0xD3, 0, 0 },	/* 0xD3 211 */
432 	{ "Invalid", SMB_SDT_OPS(invalid), 0xD4, 0, 0 },	/* 0xD4 212 */
433 	{ "Invalid", SMB_SDT_OPS(invalid), 0xD5, 0, 0 },	/* 0xD5 213 */
434 	{ "Invalid", SMB_SDT_OPS(invalid), 0xD6, 0, 0 },	/* 0xD6 214 */
435 	{ "Invalid", SMB_SDT_OPS(invalid), 0xD7, 0, 0 },	/* 0xD7 215 */
436 	{ "Invalid", SMB_SDT_OPS(invalid), 0xD8, 0, 0 },	/* 0xD8 216 */
437 	{ "Invalid", SMB_SDT_OPS(invalid), 0xD9, 0, 0 },	/* 0xD9 217 */
438 	{ "Invalid", SMB_SDT_OPS(invalid), 0xDA, 0, 0 },	/* 0xDA 218 */
439 	{ "Invalid", SMB_SDT_OPS(invalid), 0xDB, 0, 0 },	/* 0xDB 219 */
440 	{ "Invalid", SMB_SDT_OPS(invalid), 0xDC, 0, 0 },	/* 0xDC 220 */
441 	{ "Invalid", SMB_SDT_OPS(invalid), 0xDD, 0, 0 },	/* 0xDD 221 */
442 	{ "Invalid", SMB_SDT_OPS(invalid), 0xDE, 0, 0 },	/* 0xDE 222 */
443 	{ "Invalid", SMB_SDT_OPS(invalid), 0xDF, 0, 0 },	/* 0xDF 223 */
444 	{ "Invalid", SMB_SDT_OPS(invalid), 0xE0, 0, 0 },	/* 0xE0 224 */
445 	{ "Invalid", SMB_SDT_OPS(invalid), 0xE1, 0, 0 },	/* 0xE1 225 */
446 	{ "Invalid", SMB_SDT_OPS(invalid), 0xE2, 0, 0 },	/* 0xE2 226 */
447 	{ "Invalid", SMB_SDT_OPS(invalid), 0xE3, 0, 0 },	/* 0xE3 227 */
448 	{ "Invalid", SMB_SDT_OPS(invalid), 0xE4, 0, 0 },	/* 0xE4 228 */
449 	{ "Invalid", SMB_SDT_OPS(invalid), 0xE5, 0, 0 },	/* 0xE5 229 */
450 	{ "Invalid", SMB_SDT_OPS(invalid), 0xE6, 0, 0 },	/* 0xE6 230 */
451 	{ "Invalid", SMB_SDT_OPS(invalid), 0xE7, 0, 0 },	/* 0xE7 231 */
452 	{ "Invalid", SMB_SDT_OPS(invalid), 0xE8, 0, 0 },	/* 0xE8 232 */
453 	{ "Invalid", SMB_SDT_OPS(invalid), 0xE9, 0, 0 },	/* 0xE9 233 */
454 	{ "Invalid", SMB_SDT_OPS(invalid), 0xEA, 0, 0 },	/* 0xEA 234 */
455 	{ "Invalid", SMB_SDT_OPS(invalid), 0xEB, 0, 0 },	/* 0xEB 235 */
456 	{ "Invalid", SMB_SDT_OPS(invalid), 0xEC, 0, 0 },	/* 0xEC 236 */
457 	{ "Invalid", SMB_SDT_OPS(invalid), 0xED, 0, 0 },	/* 0xED 237 */
458 	{ "Invalid", SMB_SDT_OPS(invalid), 0xEE, 0, 0 },	/* 0xEE 238 */
459 	{ "Invalid", SMB_SDT_OPS(invalid), 0xEF, 0, 0 },	/* 0xEF 239 */
460 	{ "Invalid", SMB_SDT_OPS(invalid), 0xF0, 0, 0 },	/* 0xF0 240 */
461 	{ "Invalid", SMB_SDT_OPS(invalid), 0xF1, 0, 0 },	/* 0xF1 241 */
462 	{ "Invalid", SMB_SDT_OPS(invalid), 0xF2, 0, 0 },	/* 0xF2 242 */
463 	{ "Invalid", SMB_SDT_OPS(invalid), 0xF3, 0, 0 },	/* 0xF3 243 */
464 	{ "Invalid", SMB_SDT_OPS(invalid), 0xF4, 0, 0 },	/* 0xF4 244 */
465 	{ "Invalid", SMB_SDT_OPS(invalid), 0xF5, 0, 0 },	/* 0xF5 245 */
466 	{ "Invalid", SMB_SDT_OPS(invalid), 0xF6, 0, 0 },	/* 0xF6 246 */
467 	{ "Invalid", SMB_SDT_OPS(invalid), 0xF7, 0, 0 },	/* 0xF7 247 */
468 	{ "Invalid", SMB_SDT_OPS(invalid), 0xF8, 0, 0 },	/* 0xF8 248 */
469 	{ "Invalid", SMB_SDT_OPS(invalid), 0xF9, 0, 0 },	/* 0xF9 249 */
470 	{ "Invalid", SMB_SDT_OPS(invalid), 0xFA, 0, 0 },	/* 0xFA 250 */
471 	{ "Invalid", SMB_SDT_OPS(invalid), 0xFB, 0, 0 },	/* 0xFB 251 */
472 	{ "Invalid", SMB_SDT_OPS(invalid), 0xFC, 0, 0 },	/* 0xFC 252 */
473 	{ "Invalid", SMB_SDT_OPS(invalid), 0xFD, 0, 0 },	/* 0xFD 253 */
474 	{ "Invalid", SMB_SDT_OPS(invalid), 0xFE, 0, 0 },	/* 0xFE 254 */
475 	{ "Invalid", SMB_SDT_OPS(invalid), 0xFF, 0, 0 }	/* 0xFF	255 */
476 };
477 
478 /*
479  * smbsr_cleanup
480  *
481  * If any user/tree/file is used by given request then
482  * the reference count for that resource has been incremented.
483  * This function decrements the reference count and close
484  * the resource if it's needed.
485  */
486 
487 void
488 smbsr_cleanup(smb_request_t *sr)
489 {
490 	ASSERT((sr->sr_state != SMB_REQ_STATE_CLEANED_UP) &&
491 	    (sr->sr_state != SMB_REQ_STATE_COMPLETED));
492 
493 	if (sr->r_xa) {
494 		if (sr->r_xa->xa_flags & SMB_XA_FLAG_COMPLETE)
495 			smb_xa_close(sr->r_xa);
496 		smb_xa_rele(sr->session, sr->r_xa);
497 		sr->r_xa = NULL;
498 	}
499 
500 	/*
501 	 * Mark this request so we know that we've already cleaned it up.
502 	 * A request should only get cleaned up once so multiple calls to
503 	 * smbsr_cleanup for the same request indicate a bug.
504 	 */
505 	mutex_enter(&sr->sr_mutex);
506 	if (sr->sr_state != SMB_REQ_STATE_CANCELLED)
507 		sr->sr_state = SMB_REQ_STATE_CLEANED_UP;
508 	mutex_exit(&sr->sr_mutex);
509 }
510 
511 int smb_cancel_in_reader = 1;
512 
513 /*
514  * This is the SMB1 handler for new smb requests, called from
515  * smb_session_reader after SMB negotiate is done.  For most SMB
516  * requests, we just enqueue them for the smb_session_worker to
517  * execute via the task queue, so they can block for resources
518  * without stopping the reader thread.  A few protocol messages
519  * are special cases and are handled directly here in the reader
520  * thread so they don't wait for taskq scheduling.  Later, a few
521  * MORE things could be handled here, such as REPLY messages
522  * (oplock break reply) and things like "NT_cancel".
523  *
524  * This function must either enqueue the new request for
525  * execution via the task queue, or execute it directly
526  * and then free it.  If this returns non-zero, the caller
527  * will drop the session.
528  */
529 int
530 smb1sr_newrq(smb_request_t *sr)
531 {
532 	uint16_t pid_hi, pid_lo;
533 	int rc, save_offset;
534 
535 	/*
536 	 * Decode the SMB header now (peek) so that
537 	 * SMB_COM_NT_CANCEL can find this SR.
538 	 */
539 	save_offset = sr->command.chain_offset;
540 	rc = smb_mbc_decodef(&sr->command, SMB_HEADER_ED_FMT,
541 	    &sr->smb_com,
542 	    &sr->smb_rcls,
543 	    &sr->smb_reh,
544 	    &sr->smb_err,
545 	    &sr->smb_flg,
546 	    &sr->smb_flg2,
547 	    &pid_hi,
548 	    sr->smb_sig,
549 	    &sr->smb_tid,
550 	    &pid_lo,
551 	    &sr->smb_uid,
552 	    &sr->smb_mid);
553 	sr->command.chain_offset = save_offset;
554 	if (rc != 0) {
555 		/* Failed decoding the header. Drop 'em. */
556 		smb_request_free(sr);
557 		return (EPROTO);
558 	}
559 	sr->smb_pid = (pid_hi << 16) | pid_lo;
560 
561 	if (sr->smb_com == SMB_COM_NT_CANCEL) {
562 		if (sr->session->signing.flags & SMB_SIGNING_ENABLED) {
563 			sr->session->signing.seqnum++;
564 			sr->sr_seqnum = sr->session->signing.seqnum + 1;
565 			sr->reply_seqnum = 0;
566 		}
567 
568 		/*
569 		 * Normally execute cancel requests immediately,
570 		 * (here in the reader thread) so they won't wait
571 		 * for other commands already in the task queue.
572 		 * Disable this via smb_cancel_in_reader=0 for
573 		 * testing or diagnostic efforts, in which case
574 		 * cancel runs via taskq_dispatch.
575 		 */
576 		if (smb_cancel_in_reader != 0) {
577 			rc = smb1sr_newrq_cancel(sr);
578 			smb_request_free(sr);
579 			return (rc);
580 		}
581 	} else {
582 		/* not NT cancel */
583 		if (sr->session->signing.flags & SMB_SIGNING_ENABLED) {
584 			sr->session->signing.seqnum += 2;
585 			sr->sr_seqnum = sr->session->signing.seqnum;
586 			sr->reply_seqnum = sr->sr_seqnum + 1;
587 		}
588 	}
589 
590 	/*
591 	 * Submit the request to the task queue, which calls
592 	 * smb1_tq_work when the workload permits.
593 	 */
594 	sr->sr_time_submitted = gethrtime();
595 	sr->sr_state = SMB_REQ_STATE_SUBMITTED;
596 	smb_srqueue_waitq_enter(sr->session->s_srqueue);
597 	(void) taskq_dispatch(sr->sr_server->sv_worker_pool,
598 	    smb1_tq_work, sr, TQ_SLEEP);
599 
600 	return (0);
601 }
602 
603 static void
604 smb1_tq_work(void *arg)
605 {
606 	smb_request_t	*sr;
607 	smb_srqueue_t	*srq;
608 
609 	sr = (smb_request_t *)arg;
610 	SMB_REQ_VALID(sr);
611 
612 	srq = sr->session->s_srqueue;
613 	smb_srqueue_waitq_to_runq(srq);
614 	sr->sr_worker = curthread;
615 	sr->sr_time_active = gethrtime();
616 
617 	/*
618 	 * Always dispatch to the work function, because cancelled
619 	 * requests need an error reply (NT_STATUS_CANCELLED).
620 	 */
621 	mutex_enter(&sr->sr_mutex);
622 	if (sr->sr_state == SMB_REQ_STATE_SUBMITTED)
623 		sr->sr_state = SMB_REQ_STATE_ACTIVE;
624 	mutex_exit(&sr->sr_mutex);
625 
626 	smb1sr_work(sr);
627 
628 	smb_srqueue_runq_exit(srq);
629 }
630 
631 /*
632  * smb1sr_work
633  *
634  * In most cases, this should free the request before return.
635  * Exceptions are when a dispatch function returns SDRC_SR_KEPT.
636  */
637 void
638 smb1sr_work(struct smb_request *sr)
639 {
640 	smb_sdrc_t		sdrc;
641 	const smb_disp_entry_t	*sdd;
642 	smb_disp_stats_t	*sds;
643 	boolean_t		disconnect = B_FALSE;
644 	smb_session_t		*session;
645 	smb_server_t		*server;
646 	uint32_t		byte_count;
647 	uint32_t		max_bytes;
648 	uint16_t		pid_hi, pid_lo;
649 
650 	session = sr->session;
651 	server = session->s_server;
652 
653 	ASSERT(sr->tid_tree == 0);
654 	ASSERT(sr->uid_user == 0);
655 	ASSERT(sr->fid_ofile == 0);
656 	sr->smb_fid = (uint16_t)-1;
657 
658 	/* temporary until we identify a user */
659 	sr->user_cr = zone_kcred();
660 	sr->orig_request_hdr = sr->command.chain_offset;
661 
662 	/*
663 	 * Decode the SMB header.
664 	 */
665 	if (smb_mbc_decodef(&sr->command, SMB_HEADER_ED_FMT,
666 	    &sr->smb_com,
667 	    &sr->smb_rcls,
668 	    &sr->smb_reh,
669 	    &sr->smb_err,
670 	    &sr->smb_flg,
671 	    &sr->smb_flg2,
672 	    &pid_hi,
673 	    sr->smb_sig,
674 	    &sr->smb_tid,
675 	    &pid_lo,
676 	    &sr->smb_uid,
677 	    &sr->smb_mid) != 0) {
678 		disconnect = B_TRUE;
679 		goto drop_connection;
680 	}
681 	sr->smb_pid = (pid_hi << 16) | pid_lo;
682 
683 	/*
684 	 * The reply "header" is filled in now even though it will,
685 	 * most likely, be rewritten under reply_ready below.  We
686 	 * could reserve the space but this is convenient in case
687 	 * the dialect dispatcher has to send a special reply (like
688 	 * TRANSACT).
689 	 *
690 	 * Ensure that the 32-bit error code flag is turned off.
691 	 * Clients seem to set it in transact requests and they may
692 	 * get confused if we return success or a 16-bit SMB code.
693 	 */
694 	sr->smb_rcls = 0;
695 	sr->smb_reh = 0;
696 	sr->smb_err = 0;
697 	sr->smb_flg2 &= ~SMB_FLAGS2_NT_STATUS;
698 
699 	(void) smb_mbc_encodef(&sr->reply, SMB_HEADER_ED_FMT,
700 	    sr->smb_com,
701 	    sr->smb_rcls,
702 	    sr->smb_reh,
703 	    sr->smb_err,
704 	    sr->smb_flg,
705 	    sr->smb_flg2,
706 	    pid_hi,
707 	    sr->smb_sig,
708 	    sr->smb_tid,
709 	    pid_lo,
710 	    sr->smb_uid,
711 	    sr->smb_mid);
712 	sr->first_smb_com = sr->smb_com;
713 
714 	/* Need this for early goto report_error cases. */
715 	sr->cur_reply_offset = sr->reply.chain_offset;
716 
717 	if ((session->signing.flags & SMB_SIGNING_CHECK) != 0) {
718 		if ((sr->smb_flg2 & SMB_FLAGS2_SMB_SECURITY_SIGNATURE) == 0 ||
719 		    smb_sign_check_request(sr) != 0) {
720 			smbsr_error(sr, NT_STATUS_ACCESS_DENIED,
721 			    ERRDOS, ERROR_ACCESS_DENIED);
722 			disconnect = B_TRUE;
723 			goto report_error;
724 		}
725 	}
726 
727 andx_more:
728 	sdd = &smb_disp_table[sr->smb_com];
729 	ASSERT(sdd->sdt_function);
730 	sds = &server->sv_disp_stats1[sr->smb_com];
731 
732 	if (smb_mbc_decodef(&sr->command, "b", &sr->smb_wct) != 0) {
733 		disconnect = B_TRUE;
734 		goto report_error;
735 	}
736 
737 	(void) MBC_SHADOW_CHAIN(&sr->smb_vwv, &sr->command,
738 	    sr->command.chain_offset, sr->smb_wct * 2);
739 
740 	if (smb_mbc_decodef(&sr->command, "#.w", sr->smb_wct*2, &sr->smb_bcc)) {
741 		disconnect = B_TRUE;
742 		goto report_error;
743 	}
744 
745 	atomic_add_64(&sds->sdt_rxb,
746 	    (int64_t)(sr->smb_wct * 2 + sr->smb_bcc + 1));
747 	sr->sr_txb = sr->reply.chain_offset;
748 
749 	/*
750 	 * Ignore smb_bcc if CAP_LARGE_READX/CAP_LARGE_WRITEX
751 	 * and this is SmbReadX/SmbWriteX since this enables
752 	 * large reads/write and bcc is only 16-bits.
753 	 */
754 	max_bytes = sr->command.max_bytes - sr->command.chain_offset;
755 	if (sr->smb_com == SMB_COM_WRITE_ANDX) {
756 		/* Allow > BCC */
757 		byte_count = max_bytes;
758 	} else if (max_bytes < (uint32_t)sr->smb_bcc) {
759 		/* BCC is bogus.  Will fail later. */
760 		byte_count = max_bytes;
761 	} else {
762 		/* ordinary case */
763 		byte_count = (uint32_t)sr->smb_bcc;
764 	}
765 
766 	(void) MBC_SHADOW_CHAIN(&sr->smb_data, &sr->command,
767 	    sr->command.chain_offset, byte_count);
768 
769 	sr->command.chain_offset += byte_count;
770 	if (sr->command.chain_offset > sr->command.max_bytes) {
771 		disconnect = B_TRUE;
772 		goto report_error;
773 	}
774 
775 	/* Store pointers for later */
776 	sr->cur_reply_offset = sr->reply.chain_offset;
777 
778 	if (is_andx_com(sr->smb_com)) {
779 		/* Peek ahead and don't disturb vwv */
780 		if (smb_mbc_peek(&sr->smb_vwv, sr->smb_vwv.chain_offset, "b.w",
781 		    &sr->andx_com, &sr->andx_off) < 0) {
782 			disconnect = B_TRUE;
783 			goto report_error;
784 		}
785 	} else {
786 		sr->andx_com = (unsigned char)-1;
787 	}
788 
789 	mutex_enter(&sr->sr_mutex);
790 	switch (sr->sr_state) {
791 	case SMB_REQ_STATE_ACTIVE:
792 		break;
793 	case SMB_REQ_STATE_CLEANED_UP:
794 		sr->sr_state = SMB_REQ_STATE_ACTIVE;
795 		break;
796 	case SMB_REQ_STATE_CANCELLED:
797 		/*
798 		 * Keep cancelled.  Handlers that might block will
799 		 * check the state and return NT_STATUS_CANCELLED.
800 		 */
801 		break;
802 	default:
803 		ASSERT(0);
804 		break;
805 	}
806 	mutex_exit(&sr->sr_mutex);
807 
808 	/*
809 	 * Setup UID and TID information (if required). Both functions
810 	 * will set the sr credentials. In domain mode, the user and
811 	 * tree credentials should be the same. In share mode, the
812 	 * tree credentials (defined in the share definition) should
813 	 * override the user credentials.
814 	 */
815 	if (!(sdd->sdt_flags & SDDF_SUPPRESS_UID) && (sr->uid_user == NULL)) {
816 		sr->uid_user = smb_session_lookup_uid(session, sr->smb_uid);
817 		if (sr->uid_user == NULL) {
818 			smbsr_error(sr, 0, ERRSRV, ERRbaduid);
819 			smbsr_cleanup(sr);
820 			goto report_error;
821 		}
822 
823 		sr->user_cr = smb_user_getcred(sr->uid_user);
824 	}
825 	if (!(sdd->sdt_flags & SDDF_SUPPRESS_TID) && (sr->tid_tree == NULL)) {
826 		sr->tid_tree = smb_session_lookup_tree(session, sr->smb_tid);
827 		if (sr->tid_tree == NULL) {
828 			smbsr_error(sr, 0, ERRSRV, ERRinvnid);
829 			smbsr_cleanup(sr);
830 			goto report_error;
831 		}
832 	}
833 
834 	sr->sr_time_start = gethrtime();
835 	if ((sdrc = (*sdd->sdt_pre_op)(sr)) == SDRC_SUCCESS)
836 		sdrc = (*sdd->sdt_function)(sr);
837 
838 	if (sdrc != SDRC_SR_KEPT) {
839 		(*sdd->sdt_post_op)(sr);
840 		smbsr_cleanup(sr);
841 	}
842 
843 	smb_server_inc_req(server);
844 	smb_latency_add_sample(&sds->sdt_lat, gethrtime() - sr->sr_time_start);
845 
846 	atomic_add_64(&sds->sdt_txb,
847 	    (int64_t)(sr->reply.chain_offset - sr->sr_txb));
848 
849 	switch (sdrc) {
850 	case SDRC_SUCCESS:
851 		break;
852 
853 	case SDRC_DROP_VC:
854 		disconnect = B_TRUE;
855 		goto drop_connection;
856 
857 	case SDRC_NO_REPLY:
858 		/* will free sr */
859 		goto out;
860 
861 	case SDRC_SR_KEPT:
862 		/* Do NOT free sr */
863 		sr = NULL;
864 		goto out;
865 
866 	case SDRC_ERROR:
867 		goto report_error;
868 
869 	case SDRC_NOT_IMPLEMENTED:
870 	default:
871 		smbsr_error(sr, 0, ERRDOS, ERRbadfunc);
872 		goto report_error;
873 	}
874 
875 	/*
876 	 * If there's no AndX command, we're done.
877 	 */
878 	if (sr->andx_com == 0xff)
879 		goto reply_ready;
880 
881 	/*
882 	 * Otherwise, we have to back-patch the AndXCommand and AndXOffset
883 	 * and continue processing.
884 	 */
885 	sr->andx_prev_wct = sr->cur_reply_offset;
886 	(void) smb_mbc_poke(&sr->reply, sr->andx_prev_wct + 1, "b.w",
887 	    sr->andx_com, MBC_LENGTH(&sr->reply));
888 
889 	sr->command.chain_offset = sr->orig_request_hdr + sr->andx_off;
890 	sr->smb_com = sr->andx_com;
891 	goto andx_more;
892 
893 report_error:
894 	sr->reply.chain_offset = sr->cur_reply_offset;
895 	(void) smb_mbc_encodef(&sr->reply, "bw", 0, 0);
896 
897 	sr->smb_wct = 0;
898 	sr->smb_bcc = 0;
899 
900 	if (sr->smb_rcls == 0 && sr->smb_reh == 0 && sr->smb_err == 0)
901 		smbsr_error(sr, 0, ERRSRV, ERRerror);
902 
903 reply_ready:
904 	smbsr_send_reply(sr);
905 
906 drop_connection:
907 	if (disconnect) {
908 		smb_rwx_rwenter(&session->s_lock, RW_WRITER);
909 		switch (session->s_state) {
910 		case SMB_SESSION_STATE_DISCONNECTED:
911 		case SMB_SESSION_STATE_TERMINATED:
912 			break;
913 		default:
914 			smb_soshutdown(session->sock);
915 			session->s_state = SMB_SESSION_STATE_DISCONNECTED;
916 			break;
917 		}
918 		smb_rwx_rwexit(&session->s_lock);
919 	}
920 
921 out:
922 	if (sr != NULL) {
923 		mutex_enter(&sr->sr_mutex);
924 		sr->sr_state = SMB_REQ_STATE_COMPLETED;
925 		mutex_exit(&sr->sr_mutex);
926 		smb_request_free(sr);
927 	}
928 }
929 
930 int
931 smbsr_encode_empty_result(struct smb_request *sr)
932 {
933 	return (smbsr_encode_result(sr, 0, 0, "bw", 0, 0));
934 }
935 
936 int
937 smbsr_encode_result(struct smb_request *sr, int wct, int bcc,
938     const char *fmt, ...)
939 {
940 	va_list ap;
941 
942 	if (MBC_LENGTH(&sr->reply) != sr->cur_reply_offset)
943 		return (-1);
944 
945 	va_start(ap, fmt);
946 	(void) smb_mbc_vencodef(&sr->reply, fmt, ap);
947 	va_end(ap);
948 
949 	sr->smb_wct = (unsigned char)wct;
950 	sr->smb_bcc = (uint16_t)bcc;
951 
952 	if (smbsr_check_result(sr, wct, bcc) != 0)
953 		return (-1);
954 
955 	return (0);
956 }
957 
958 static int
959 smbsr_check_result(struct smb_request *sr, int wct, int bcc)
960 {
961 	int		offset = sr->cur_reply_offset;
962 	int		total_bytes;
963 	unsigned char	temp, temp1;
964 	struct mbuf	*m;
965 
966 	total_bytes = 0;
967 	m = sr->reply.chain;
968 	while (m != 0) {
969 		total_bytes += m->m_len;
970 		m = m->m_next;
971 	}
972 
973 	if ((offset + 3) > total_bytes)
974 		return (-1);
975 
976 	(void) smb_mbc_peek(&sr->reply, offset, "b", &temp);
977 	if (temp != wct)
978 		return (-1);
979 
980 	if ((offset + (wct * 2 + 1)) > total_bytes)
981 		return (-1);
982 
983 	/* reply wct & vwv seem ok, consider data now */
984 	offset += wct * 2 + 1;
985 
986 	if ((offset + 2) > total_bytes)
987 		return (-1);
988 
989 	(void) smb_mbc_peek(&sr->reply, offset, "bb", &temp, &temp1);
990 	if (bcc == VAR_BCC) {
991 		if ((temp != 0xFF) || (temp1 != 0xFF)) {
992 			return (-1);
993 		} else {
994 			bcc = (total_bytes - offset) - 2;
995 			(void) smb_mbc_poke(&sr->reply, offset, "bb",
996 			    bcc, bcc >> 8);
997 		}
998 	} else {
999 		if ((temp != (bcc&0xFF)) || (temp1 != ((bcc>>8)&0xFF)))
1000 			return (-1);
1001 	}
1002 
1003 	offset += bcc + 2;
1004 
1005 	if (offset != total_bytes)
1006 		return (-1);
1007 
1008 	sr->smb_wct = (unsigned char)wct;
1009 	sr->smb_bcc = (uint16_t)bcc;
1010 	return (0);
1011 }
1012 
1013 int
1014 smbsr_decode_vwv(struct smb_request *sr, const char *fmt, ...)
1015 {
1016 	int rc;
1017 	va_list ap;
1018 
1019 	va_start(ap, fmt);
1020 	rc = smb_mbc_vdecodef(&sr->smb_vwv, fmt, ap);
1021 	va_end(ap);
1022 
1023 	if (rc)
1024 		smbsr_error(sr, 0, ERRSRV, ERRerror);
1025 	return (rc);
1026 }
1027 
1028 int
1029 smbsr_decode_data(struct smb_request *sr, const char *fmt, ...)
1030 {
1031 	int rc;
1032 	va_list ap;
1033 
1034 	va_start(ap, fmt);
1035 	rc = smb_mbc_vdecodef(&sr->smb_data, fmt, ap);
1036 	va_end(ap);
1037 
1038 	if (rc)
1039 		smbsr_error(sr, 0, ERRSRV, ERRerror);
1040 	return (rc);
1041 }
1042 
1043 boolean_t
1044 smbsr_decode_data_avail(smb_request_t *sr)
1045 {
1046 	return (sr->smb_data.chain_offset < sr->smb_data.max_bytes);
1047 }
1048 
1049 void
1050 smbsr_send_reply(smb_request_t *sr)
1051 {
1052 	uint16_t	pid_hi, pid_lo;
1053 
1054 	if (SMB_TREE_IS_CASEINSENSITIVE(sr))
1055 		sr->smb_flg |= SMB_FLAGS_CASE_INSENSITIVE;
1056 	else
1057 		sr->smb_flg &= ~SMB_FLAGS_CASE_INSENSITIVE;
1058 	pid_hi = sr->smb_pid >> 16;
1059 	pid_lo = (uint16_t)sr->smb_pid;
1060 
1061 	(void) smb_mbc_poke(&sr->reply, 0, SMB_HEADER_ED_FMT,
1062 	    sr->first_smb_com,
1063 	    sr->smb_rcls,
1064 	    sr->smb_reh,
1065 	    sr->smb_err,
1066 	    sr->smb_flg | SMB_FLAGS_REPLY,
1067 	    sr->smb_flg2,
1068 	    pid_hi,
1069 	    sr->smb_sig,
1070 	    sr->smb_tid,
1071 	    pid_lo,
1072 	    sr->smb_uid,
1073 	    sr->smb_mid);
1074 
1075 	if (sr->session->signing.flags & SMB_SIGNING_ENABLED)
1076 		smb_sign_reply(sr, NULL);
1077 
1078 	if (smb_session_send(sr->session, 0, &sr->reply) == 0)
1079 		sr->reply.chain = 0;
1080 }
1081 
1082 void
1083 smbsr_map_errno(int errnum, smb_error_t *err)
1084 {
1085 	uint32_t status;
1086 	uint16_t doserr;
1087 
1088 	status = smb_errno2status(errnum);
1089 	doserr = smb_status2doserr(status);
1090 
1091 	err->status  = status;
1092 	err->errcls  = ERRDOS;
1093 	err->errcode = doserr;
1094 }
1095 
1096 void
1097 smbsr_errno(struct smb_request *sr, int errnum)
1098 {
1099 	smbsr_map_errno(errnum, &sr->smb_error);
1100 	smbsr_set_error(sr, &sr->smb_error);
1101 }
1102 
1103 /*
1104  * Report a request processing status (error or warning).
1105  */
1106 void
1107 smbsr_status(smb_request_t *sr, DWORD status, uint16_t errcls, uint16_t errcode)
1108 {
1109 
1110 	sr->smb_error.status   = status;
1111 
1112 	/*
1113 	 * This function is SMB1 specific.  While adding SMB2 support,
1114 	 * calls to this function have been removed from common code.
1115 	 * In case we missed any, check for SMB2 callers here, and
1116 	 * vector into a wrapper function that we can watch for...
1117 	 * (and track down with dtrace:)
1118 	 */
1119 	if (sr->session->dialect >= SMB_VERS_2_BASE) {
1120 		smbsr_status_smb2(sr, status);
1121 		return;
1122 	}
1123 
1124 	if (status != 0 && errcls == 0 && errcode == 0) {
1125 		errcls = ERRDOS;
1126 		errcode = smb_status2doserr(status);
1127 	}
1128 
1129 	sr->smb_error.errcls   = errcls;
1130 	sr->smb_error.errcode  = errcode;
1131 
1132 	smbsr_set_error(sr, &sr->smb_error);
1133 }
1134 
1135 /*
1136  * Setup a request processing error.  This function can be used to
1137  * report 32-bit status codes or DOS errors.  Set the status code
1138  * to 0 (NT_STATUS_SUCCESS) to explicitly report a DOS error,
1139  * regardless of the client capabilities.
1140  *
1141  * If status is non-zero and the client supports 32-bit status
1142  * codes, report the status.  Otherwise, report the DOS error.
1143  */
1144 void
1145 smbsr_set_error(smb_request_t *sr, smb_error_t *err)
1146 {
1147 	uint32_t status;
1148 	uint32_t capabilities;
1149 
1150 	ASSERT(sr);
1151 	ASSERT(err);
1152 
1153 	status = err->status;
1154 	capabilities = sr->session->capabilities;
1155 
1156 	if ((err->errcls == 0) && (err->errcode == 0)) {
1157 		capabilities |= CAP_STATUS32;
1158 		if (status == 0)
1159 			status = NT_STATUS_INTERNAL_ERROR;
1160 	}
1161 
1162 	if ((capabilities & CAP_STATUS32) && (status != 0)) {
1163 		sr->smb_rcls = status & 0xff;
1164 		sr->smb_reh = (status >> 8) & 0xff;
1165 		sr->smb_err  = status >> 16;
1166 		sr->smb_flg2 |= SMB_FLAGS2_NT_STATUS;
1167 	} else {
1168 		if ((err->errcls == 0) || (err->errcode == 0)) {
1169 			sr->smb_rcls = ERRSRV;
1170 			sr->smb_err  = ERRerror;
1171 		} else {
1172 			sr->smb_rcls = (uint8_t)err->errcls;
1173 			sr->smb_err  = (uint16_t)err->errcode;
1174 		}
1175 	}
1176 }
1177 
1178 smb_xa_t *
1179 smbsr_lookup_xa(smb_request_t *sr)
1180 {
1181 	ASSERT(sr->r_xa == 0);
1182 
1183 	sr->r_xa = smb_xa_find(sr->session, sr->smb_pid, sr->smb_mid);
1184 	return (sr->r_xa);
1185 }
1186 
1187 void
1188 smbsr_release_file(smb_request_t *sr)
1189 {
1190 	smb_ofile_t	*of = sr->fid_ofile;
1191 
1192 	sr->fid_ofile = NULL;
1193 	(void) smb_ofile_release(of);
1194 }
1195 
1196 void
1197 smbsr_lookup_file(smb_request_t *sr)
1198 {
1199 	if (sr->fid_ofile == NULL)
1200 		sr->fid_ofile = smb_ofile_lookup_by_fid(sr, sr->smb_fid);
1201 }
1202 
1203 static int
1204 is_andx_com(unsigned char com)
1205 {
1206 	switch (com) {
1207 	case SMB_COM_LOCKING_ANDX:
1208 	case SMB_COM_OPEN_ANDX:
1209 	case SMB_COM_READ_ANDX:
1210 	case SMB_COM_WRITE_ANDX:
1211 	case SMB_COM_SESSION_SETUP_ANDX:
1212 	case SMB_COM_LOGOFF_ANDX:
1213 	case SMB_COM_TREE_CONNECT_ANDX:
1214 	case SMB_COM_NT_CREATE_ANDX:
1215 		return (1);
1216 	}
1217 	return (0);
1218 }
1219 
1220 /*
1221  * Invalid command stubs.
1222  *
1223  * The Read/Write Block Multiplexed (mpx) protocol is used to maximize
1224  * performance when reading/writing a large block of data: it can be
1225  * used in parallel with other client/server operations.  The mpx sub-
1226  * protocol is not supported because we support only connection oriented
1227  * transports and NT supports mpx only over connectionless transports.
1228  */
1229 smb_sdrc_t
1230 smb_pre_invalid(smb_request_t *sr)
1231 {
1232 	DTRACE_SMB_1(op__Invalid__start, smb_request_t *, sr);
1233 	return (SDRC_SUCCESS);
1234 }
1235 
1236 void
1237 smb_post_invalid(smb_request_t *sr)
1238 {
1239 	DTRACE_SMB_1(op__Invalid__done, smb_request_t *, sr);
1240 }
1241 
1242 smb_sdrc_t
1243 smb_com_invalid(smb_request_t *sr)
1244 {
1245 	smb_sdrc_t sdrc;
1246 
1247 	switch (sr->smb_com) {
1248 	case SMB_COM_WRITE_COMPLETE:
1249 		smbsr_error(sr, 0, ERRSRV, ERRerror);
1250 		sdrc = SDRC_ERROR;
1251 		break;
1252 
1253 	default:
1254 		smbsr_error(sr, NT_STATUS_NOT_IMPLEMENTED,
1255 		    ERRDOS, ERROR_INVALID_FUNCTION);
1256 		sdrc = SDRC_NOT_IMPLEMENTED;
1257 		break;
1258 	}
1259 
1260 	return (sdrc);
1261 }
1262 
1263 /*
1264  * smb_dispatch_stats_init
1265  *
1266  * Initializes dispatch statistics.
1267  */
1268 void
1269 smb_dispatch_stats_init(smb_server_t *sv)
1270 {
1271 	smb_disp_stats_t *sds = sv->sv_disp_stats1;
1272 	smb_kstat_req_t *ksr;
1273 	int		i;
1274 
1275 	ksr = ((smbsrv_kstats_t *)sv->sv_ksp->ks_data)->ks_reqs1;
1276 
1277 	for (i = 0; i < SMB_COM_NUM; i++, ksr++) {
1278 		smb_latency_init(&sds[i].sdt_lat);
1279 		(void) strlcpy(ksr->kr_name, smb_disp_table[i].sdt_name,
1280 		    sizeof (ksr->kr_name));
1281 	}
1282 }
1283 
1284 /*
1285  * smb_dispatch_stats_fini
1286  *
1287  * Frees and destroyes the resources used for statistics.
1288  */
1289 void
1290 smb_dispatch_stats_fini(smb_server_t *sv)
1291 {
1292 	smb_disp_stats_t *sds = sv->sv_disp_stats1;
1293 	int	i;
1294 
1295 	for (i = 0; i < SMB_COM_NUM; i++)
1296 		smb_latency_destroy(&sds[i].sdt_lat);
1297 }
1298 
1299 void
1300 smb_dispatch_stats_update(smb_server_t *sv,
1301     smb_kstat_req_t *ksr, int first, int nreq)
1302 {
1303 	smb_disp_stats_t *sds = sv->sv_disp_stats1;
1304 	int	i;
1305 	int	last;
1306 
1307 	last = first + nreq - 1;
1308 
1309 	if ((first < SMB_COM_NUM) && (last < SMB_COM_NUM))  {
1310 		for (i = first; i <= last; i++, ksr++) {
1311 			ksr->kr_rxb = sds[i].sdt_rxb;
1312 			ksr->kr_txb = sds[i].sdt_txb;
1313 			mutex_enter(&sds[i].sdt_lat.ly_mutex);
1314 			ksr->kr_nreq = sds[i].sdt_lat.ly_a_nreq;
1315 			ksr->kr_sum = sds[i].sdt_lat.ly_a_sum;
1316 			ksr->kr_a_mean = sds[i].sdt_lat.ly_a_mean;
1317 			ksr->kr_a_stddev =
1318 			    sds[i].sdt_lat.ly_a_stddev;
1319 			ksr->kr_d_mean = sds[i].sdt_lat.ly_d_mean;
1320 			ksr->kr_d_stddev =
1321 			    sds[i].sdt_lat.ly_d_stddev;
1322 			sds[i].sdt_lat.ly_d_mean = 0;
1323 			sds[i].sdt_lat.ly_d_nreq = 0;
1324 			sds[i].sdt_lat.ly_d_stddev = 0;
1325 			sds[i].sdt_lat.ly_d_sum = 0;
1326 			mutex_exit(&sds[i].sdt_lat.ly_mutex);
1327 		}
1328 	}
1329 }
1330