1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright 2018 Nexenta Systems, Inc. All rights reserved. 24 */ 25 26 /* 27 * This module provides the interface to NDR RPC. 28 */ 29 30 #include <sys/stat.h> 31 #include <sys/uio.h> 32 #include <sys/ksynch.h> 33 #include <sys/stropts.h> 34 #include <sys/socket.h> 35 #include <sys/filio.h> 36 #include <smbsrv/smb_kproto.h> 37 #include <smbsrv/smb_xdr.h> 38 #include <smb/winioctl.h> 39 40 static uint32_t smb_opipe_transceive(smb_request_t *, smb_fsctl_t *); 41 42 /* 43 * Allocate a new opipe and return it, or NULL, in which case 44 * the caller will report "internal error". 45 */ 46 static smb_opipe_t * 47 smb_opipe_alloc(smb_request_t *sr) 48 { 49 smb_server_t *sv = sr->sr_server; 50 smb_opipe_t *opipe; 51 ksocket_t sock; 52 53 if (ksocket_socket(&sock, AF_UNIX, SOCK_STREAM, 0, 54 KSOCKET_SLEEP, sr->user_cr) != 0) 55 return (NULL); 56 57 opipe = kmem_cache_alloc(smb_cache_opipe, KM_SLEEP); 58 59 bzero(opipe, sizeof (smb_opipe_t)); 60 mutex_init(&opipe->p_mutex, NULL, MUTEX_DEFAULT, NULL); 61 cv_init(&opipe->p_cv, NULL, CV_DEFAULT, NULL); 62 opipe->p_magic = SMB_OPIPE_MAGIC; 63 opipe->p_server = sv; 64 opipe->p_refcnt = 1; 65 opipe->p_socket = sock; 66 67 return (opipe); 68 } 69 70 /* 71 * Destroy an opipe. This is normally called from smb_ofile_delete 72 * when the ofile has no more references and is about to be free'd. 73 * This is also called here in error handling code paths, before 74 * the opipe is installed under an ofile. 75 */ 76 void 77 smb_opipe_dealloc(smb_opipe_t *opipe) 78 { 79 smb_server_t *sv; 80 81 SMB_OPIPE_VALID(opipe); 82 sv = opipe->p_server; 83 SMB_SERVER_VALID(sv); 84 85 /* 86 * This is called in the error path when opening, 87 * in which case we close the socket here. 88 */ 89 if (opipe->p_socket != NULL) 90 (void) ksocket_close(opipe->p_socket, zone_kcred()); 91 92 opipe->p_magic = (uint32_t)~SMB_OPIPE_MAGIC; 93 cv_destroy(&opipe->p_cv); 94 mutex_destroy(&opipe->p_mutex); 95 96 kmem_cache_free(smb_cache_opipe, opipe); 97 } 98 99 /* 100 * Unblock a request that might be blocked reading some 101 * pipe (AF_UNIX socket). We don't have an easy way to 102 * interrupt just the thread servicing this request, so 103 * we shutdown(3socket) the socket, waking all readers. 104 * That's a bit heavy-handed, making the socket unusable 105 * after this, so we do this only when disconnecting a 106 * session (i.e. stopping the SMB service), and not when 107 * handling an SMB2_cancel or SMB_nt_cancel request. 108 */ 109 static void 110 smb_opipe_cancel(smb_request_t *sr) 111 { 112 ksocket_t so; 113 114 switch (sr->session->s_state) { 115 case SMB_SESSION_STATE_DISCONNECTED: 116 case SMB_SESSION_STATE_TERMINATED: 117 if ((so = sr->cancel_arg2) != NULL) 118 (void) ksocket_shutdown(so, SHUT_RDWR, sr->user_cr); 119 break; 120 } 121 } 122 123 /* 124 * Helper for open: build pipe name and connect. 125 */ 126 static int 127 smb_opipe_connect(smb_request_t *sr, smb_opipe_t *opipe) 128 { 129 struct sockaddr_un saddr; 130 smb_arg_open_t *op = &sr->sr_open; 131 const char *name; 132 int rc; 133 134 name = op->fqi.fq_path.pn_path; 135 name += strspn(name, "\\"); 136 if (smb_strcasecmp(name, "PIPE", 4) == 0) { 137 name += 4; 138 name += strspn(name, "\\"); 139 } 140 (void) strlcpy(opipe->p_name, name, SMB_OPIPE_MAXNAME); 141 (void) smb_strlwr(opipe->p_name); 142 143 bzero(&saddr, sizeof (saddr)); 144 saddr.sun_family = AF_UNIX; 145 (void) snprintf(saddr.sun_path, sizeof (saddr.sun_path), 146 "%s/%s", SMB_PIPE_DIR, opipe->p_name); 147 rc = ksocket_connect(opipe->p_socket, (struct sockaddr *)&saddr, 148 sizeof (saddr), sr->user_cr); 149 150 return (rc); 151 } 152 153 /* 154 * Helper for open: encode and send the user info. 155 * 156 * We send information about this client + user to the 157 * pipe service so it can use it for access checks. 158 * The service MAY deny the open based on this info, 159 * (i.e. anonymous session trying to open a pipe that 160 * requires authentication) in which case we will read 161 * an error status from the service and return that. 162 */ 163 static void 164 smb_opipe_send_userinfo(smb_request_t *sr, smb_opipe_t *opipe, 165 smb_error_t *errp) 166 { 167 XDR xdrs; 168 smb_netuserinfo_t nui; 169 smb_pipehdr_t phdr; 170 char *buf; 171 uint32_t buflen; 172 uint32_t status; 173 size_t iocnt = 0; 174 int rc; 175 176 /* 177 * Any errors building the XDR message etc. 178 */ 179 errp->status = NT_STATUS_INTERNAL_ERROR; 180 181 smb_user_netinfo_init(sr->uid_user, &nui); 182 phdr.ph_magic = SMB_PIPE_HDR_MAGIC; 183 phdr.ph_uilen = xdr_sizeof(smb_netuserinfo_xdr, &nui); 184 185 buflen = sizeof (phdr) + phdr.ph_uilen; 186 buf = kmem_alloc(buflen, KM_SLEEP); 187 188 bcopy(&phdr, buf, sizeof (phdr)); 189 xdrmem_create(&xdrs, buf + sizeof (phdr), 190 buflen - (sizeof (phdr)), XDR_ENCODE); 191 if (!smb_netuserinfo_xdr(&xdrs, &nui)) 192 goto out; 193 194 mutex_enter(&sr->sr_mutex); 195 if (sr->sr_state != SMB_REQ_STATE_ACTIVE) { 196 mutex_exit(&sr->sr_mutex); 197 errp->status = NT_STATUS_CANCELLED; 198 goto out; 199 } 200 sr->sr_state = SMB_REQ_STATE_WAITING_PIPE; 201 sr->cancel_method = smb_opipe_cancel; 202 sr->cancel_arg2 = opipe->p_socket; 203 mutex_exit(&sr->sr_mutex); 204 205 rc = ksocket_send(opipe->p_socket, buf, buflen, 0, 206 &iocnt, sr->user_cr); 207 if (rc == 0 && iocnt != buflen) 208 rc = EIO; 209 if (rc == 0) 210 rc = ksocket_recv(opipe->p_socket, &status, sizeof (status), 211 0, &iocnt, sr->user_cr); 212 if (rc == 0 && iocnt != sizeof (status)) 213 rc = EIO; 214 215 mutex_enter(&sr->sr_mutex); 216 sr->cancel_method = NULL; 217 sr->cancel_arg2 = NULL; 218 switch (sr->sr_state) { 219 case SMB_REQ_STATE_WAITING_PIPE: 220 sr->sr_state = SMB_REQ_STATE_ACTIVE; 221 break; 222 case SMB_REQ_STATE_CANCEL_PENDING: 223 sr->sr_state = SMB_REQ_STATE_CANCELLED; 224 rc = EINTR; 225 break; 226 default: 227 /* keep rc from above */ 228 break; 229 } 230 mutex_exit(&sr->sr_mutex); 231 232 233 /* 234 * Return the status we read from the pipe service, 235 * normally NT_STATUS_SUCCESS, but could be something 236 * else like NT_STATUS_ACCESS_DENIED. 237 */ 238 switch (rc) { 239 case 0: 240 errp->status = status; 241 break; 242 case EINTR: 243 errp->status = NT_STATUS_CANCELLED; 244 break; 245 /* 246 * If we fail sending the netuserinfo or recv'ing the 247 * status reponse, we have probably run into the limit 248 * on the number of open pipes. That's this status: 249 */ 250 default: 251 errp->status = NT_STATUS_PIPE_NOT_AVAILABLE; 252 break; 253 } 254 255 out: 256 xdr_destroy(&xdrs); 257 kmem_free(buf, buflen); 258 smb_user_netinfo_fini(&nui); 259 } 260 261 /* 262 * smb_opipe_open 263 * 264 * Open an RPC named pipe. This routine should be called if 265 * a file open is requested on a share of type STYPE_IPC. 266 * If we recognize the pipe, we setup a new ofile. 267 * 268 * Returns 0 on success, Otherwise an NT status code. 269 */ 270 int 271 smb_opipe_open(smb_request_t *sr, uint32_t uniqid) 272 { 273 smb_arg_open_t *op = &sr->sr_open; 274 smb_attr_t *ap = &op->fqi.fq_fattr; 275 smb_ofile_t *ofile; 276 smb_opipe_t *opipe; 277 smb_error_t err; 278 279 opipe = smb_opipe_alloc(sr); 280 if (opipe == NULL) 281 return (NT_STATUS_INTERNAL_ERROR); 282 283 if (smb_opipe_connect(sr, opipe) != 0) { 284 smb_opipe_dealloc(opipe); 285 return (NT_STATUS_OBJECT_NAME_NOT_FOUND); 286 } 287 288 smb_opipe_send_userinfo(sr, opipe, &err); 289 if (err.status != 0) { 290 smb_opipe_dealloc(opipe); 291 return (err.status); 292 } 293 294 /* 295 * Note: If smb_ofile_open succeeds, the new ofile is 296 * in the FID lists can can be used by I/O requests. 297 */ 298 op->create_options = 0; 299 op->pipe = opipe; 300 ofile = smb_ofile_open(sr, NULL, op, 301 SMB_FTYPE_MESG_PIPE, uniqid, &err); 302 op->pipe = NULL; 303 if (ofile == NULL) { 304 smb_opipe_dealloc(opipe); 305 return (err.status); 306 } 307 308 /* An "up" pointer, for debug. */ 309 opipe->p_ofile = ofile; 310 311 /* 312 * Caller expects attributes in op->fqi 313 */ 314 (void) smb_opipe_getattr(ofile, &op->fqi.fq_fattr); 315 316 op->dsize = 0; 317 op->dattr = ap->sa_dosattr; 318 op->fileid = ap->sa_vattr.va_nodeid; 319 op->ftype = SMB_FTYPE_MESG_PIPE; 320 op->action_taken = SMB_OACT_OPLOCK | SMB_OACT_OPENED; 321 op->devstate = SMB_PIPE_READMODE_MESSAGE 322 | SMB_PIPE_TYPE_MESSAGE 323 | SMB_PIPE_UNLIMITED_INSTANCES; /* 0x05ff */ 324 325 sr->smb_fid = ofile->f_fid; 326 sr->fid_ofile = ofile; 327 328 return (NT_STATUS_SUCCESS); 329 } 330 331 /* 332 * smb_opipe_close 333 * 334 * Called by smb_ofile_close for pipes. 335 * 336 * Note: ksocket_close may block while waiting for 337 * any I/O threads with a hold to get out. 338 */ 339 void 340 smb_opipe_close(smb_ofile_t *of) 341 { 342 smb_opipe_t *opipe; 343 ksocket_t sock; 344 345 ASSERT(of->f_state == SMB_OFILE_STATE_CLOSING); 346 ASSERT(of->f_ftype == SMB_FTYPE_MESG_PIPE); 347 opipe = of->f_pipe; 348 SMB_OPIPE_VALID(opipe); 349 350 mutex_enter(&opipe->p_mutex); 351 sock = opipe->p_socket; 352 opipe->p_socket = NULL; 353 mutex_exit(&opipe->p_mutex); 354 355 (void) ksocket_shutdown(sock, SHUT_RDWR, of->f_cr); 356 (void) ksocket_close(sock, of->f_cr); 357 } 358 359 /* 360 * smb_opipe_write 361 * 362 * Write RPC request data to the pipe. The client should call smb_opipe_read 363 * to complete the exchange and obtain the RPC response. 364 * 365 * Returns 0 on success or an errno on failure. 366 */ 367 int 368 smb_opipe_write(smb_request_t *sr, struct uio *uio) 369 { 370 struct nmsghdr msghdr; 371 smb_ofile_t *ofile; 372 smb_opipe_t *opipe; 373 ksocket_t sock; 374 size_t sent = 0; 375 int rc = 0; 376 377 ofile = sr->fid_ofile; 378 ASSERT(ofile->f_ftype == SMB_FTYPE_MESG_PIPE); 379 opipe = ofile->f_pipe; 380 SMB_OPIPE_VALID(opipe); 381 382 mutex_enter(&opipe->p_mutex); 383 sock = opipe->p_socket; 384 if (sock != NULL) 385 ksocket_hold(sock); 386 mutex_exit(&opipe->p_mutex); 387 if (sock == NULL) 388 return (EBADF); 389 390 bzero(&msghdr, sizeof (msghdr)); 391 msghdr.msg_iov = uio->uio_iov; 392 msghdr.msg_iovlen = uio->uio_iovcnt; 393 394 /* 395 * This should block until we've sent it all, 396 * or given up due to errors (pipe closed). 397 */ 398 while (uio->uio_resid > 0) { 399 rc = ksocket_sendmsg(sock, &msghdr, 0, &sent, ofile->f_cr); 400 if (rc != 0) 401 break; 402 uio->uio_resid -= sent; 403 } 404 405 ksocket_rele(sock); 406 407 return (rc); 408 } 409 410 /* 411 * smb_opipe_read 412 * 413 * This interface may be called from smb_opipe_transact (write, read) 414 * or from smb_read / smb2_read to get the rest of an RPC response. 415 * The response data (and length) are returned via the uio. 416 */ 417 int 418 smb_opipe_read(smb_request_t *sr, struct uio *uio) 419 { 420 struct nmsghdr msghdr; 421 smb_ofile_t *ofile; 422 smb_opipe_t *opipe; 423 ksocket_t sock; 424 size_t recvcnt = 0; 425 int rc; 426 427 ofile = sr->fid_ofile; 428 ASSERT(ofile->f_ftype == SMB_FTYPE_MESG_PIPE); 429 opipe = ofile->f_pipe; 430 SMB_OPIPE_VALID(opipe); 431 432 mutex_enter(&opipe->p_mutex); 433 sock = opipe->p_socket; 434 if (sock != NULL) 435 ksocket_hold(sock); 436 mutex_exit(&opipe->p_mutex); 437 if (sock == NULL) 438 return (EBADF); 439 440 mutex_enter(&sr->sr_mutex); 441 if (sr->sr_state != SMB_REQ_STATE_ACTIVE) { 442 mutex_exit(&sr->sr_mutex); 443 rc = EINTR; 444 goto out; 445 } 446 sr->sr_state = SMB_REQ_STATE_WAITING_PIPE; 447 sr->cancel_method = smb_opipe_cancel; 448 sr->cancel_arg2 = sock; 449 mutex_exit(&sr->sr_mutex); 450 451 /* 452 * This should block only if there's no data. 453 * A single call to recvmsg does just that. 454 * (Intentionaly no recv loop here.) 455 */ 456 bzero(&msghdr, sizeof (msghdr)); 457 msghdr.msg_iov = uio->uio_iov; 458 msghdr.msg_iovlen = uio->uio_iovcnt; 459 rc = ksocket_recvmsg(sock, &msghdr, 0, 460 &recvcnt, ofile->f_cr); 461 462 mutex_enter(&sr->sr_mutex); 463 sr->cancel_method = NULL; 464 sr->cancel_arg2 = NULL; 465 switch (sr->sr_state) { 466 case SMB_REQ_STATE_WAITING_PIPE: 467 sr->sr_state = SMB_REQ_STATE_ACTIVE; 468 break; 469 case SMB_REQ_STATE_CANCEL_PENDING: 470 sr->sr_state = SMB_REQ_STATE_CANCELLED; 471 rc = EINTR; 472 break; 473 default: 474 /* keep rc from above */ 475 break; 476 } 477 mutex_exit(&sr->sr_mutex); 478 479 if (rc != 0) 480 goto out; 481 482 if (recvcnt == 0) { 483 /* Other side closed. */ 484 rc = EPIPE; 485 goto out; 486 } 487 uio->uio_resid -= recvcnt; 488 489 out: 490 ksocket_rele(sock); 491 492 return (rc); 493 } 494 495 int 496 smb_opipe_ioctl(smb_request_t *sr, int cmd, void *arg, int *rvalp) 497 { 498 smb_ofile_t *ofile; 499 smb_opipe_t *opipe; 500 ksocket_t sock; 501 int rc; 502 503 ofile = sr->fid_ofile; 504 ASSERT(ofile->f_ftype == SMB_FTYPE_MESG_PIPE); 505 opipe = ofile->f_pipe; 506 SMB_OPIPE_VALID(opipe); 507 508 mutex_enter(&opipe->p_mutex); 509 sock = opipe->p_socket; 510 if (sock != NULL) 511 ksocket_hold(sock); 512 mutex_exit(&opipe->p_mutex); 513 if (sock == NULL) 514 return (EBADF); 515 516 rc = ksocket_ioctl(sock, cmd, (intptr_t)arg, rvalp, ofile->f_cr); 517 518 ksocket_rele(sock); 519 520 return (rc); 521 } 522 523 /* 524 * Get the smb_attr_t for a named pipe. 525 * Caller has already cleared to zero. 526 */ 527 int 528 smb_opipe_getattr(smb_ofile_t *of, smb_attr_t *ap) 529 { 530 531 if (of->f_pipe == NULL) 532 return (EINVAL); 533 534 ap->sa_vattr.va_type = VFIFO; 535 ap->sa_vattr.va_nlink = 1; 536 ap->sa_vattr.va_nodeid = (uintptr_t)of->f_pipe; 537 ap->sa_dosattr = FILE_ATTRIBUTE_NORMAL; 538 ap->sa_allocsz = SMB_PIPE_MAX_MSGSIZE; 539 540 return (0); 541 } 542 543 int 544 smb_opipe_getname(smb_ofile_t *of, char *buf, size_t buflen) 545 { 546 smb_opipe_t *opipe; 547 548 if ((opipe = of->f_pipe) == NULL) 549 return (EINVAL); 550 551 (void) snprintf(buf, buflen, "\\%s", opipe->p_name); 552 return (0); 553 } 554 555 /* 556 * Handler for smb2_ioctl 557 */ 558 /* ARGSUSED */ 559 uint32_t 560 smb_opipe_fsctl(smb_request_t *sr, smb_fsctl_t *fsctl) 561 { 562 uint32_t status; 563 564 switch (fsctl->CtlCode) { 565 case FSCTL_PIPE_TRANSCEIVE: 566 status = smb_opipe_transceive(sr, fsctl); 567 break; 568 569 case FSCTL_PIPE_PEEK: 570 case FSCTL_PIPE_WAIT: 571 /* XXX todo */ 572 status = NT_STATUS_NOT_SUPPORTED; 573 break; 574 575 default: 576 ASSERT(!"CtlCode"); 577 status = NT_STATUS_INTERNAL_ERROR; 578 break; 579 } 580 581 return (status); 582 } 583 584 static uint32_t 585 smb_opipe_transceive(smb_request_t *sr, smb_fsctl_t *fsctl) 586 { 587 smb_vdb_t vdb; 588 smb_ofile_t *ofile; 589 struct mbuf *mb; 590 uint32_t status; 591 int len, rc; 592 593 /* 594 * Caller checked that this is the IPC$ share, 595 * and that this call has a valid open handle. 596 * Just check the type. 597 */ 598 ofile = sr->fid_ofile; 599 if (ofile->f_ftype != SMB_FTYPE_MESG_PIPE) 600 return (NT_STATUS_INVALID_HANDLE); 601 602 rc = smb_mbc_decodef(fsctl->in_mbc, "#B", 603 fsctl->InputCount, &vdb); 604 if (rc != 0) { 605 /* Not enough data sent. */ 606 return (NT_STATUS_INVALID_PARAMETER); 607 } 608 609 rc = smb_opipe_write(sr, &vdb.vdb_uio); 610 if (rc != 0) 611 return (smb_errno2status(rc)); 612 613 vdb.vdb_tag = 0; 614 vdb.vdb_uio.uio_iov = &vdb.vdb_iovec[0]; 615 vdb.vdb_uio.uio_iovcnt = MAX_IOVEC; 616 vdb.vdb_uio.uio_segflg = UIO_SYSSPACE; 617 vdb.vdb_uio.uio_extflg = UIO_COPY_DEFAULT; 618 vdb.vdb_uio.uio_loffset = (offset_t)0; 619 vdb.vdb_uio.uio_resid = fsctl->MaxOutputResp; 620 mb = smb_mbuf_allocate(&vdb.vdb_uio); 621 622 rc = smb_opipe_read(sr, &vdb.vdb_uio); 623 if (rc != 0) { 624 m_freem(mb); 625 return (smb_errno2status(rc)); 626 } 627 628 len = fsctl->MaxOutputResp - vdb.vdb_uio.uio_resid; 629 smb_mbuf_trim(mb, len); 630 MBC_ATTACH_MBUF(fsctl->out_mbc, mb); 631 632 /* 633 * If the output buffer holds a partial pipe message, 634 * we're supposed to return NT_STATUS_BUFFER_OVERFLOW. 635 * As we don't have message boundary markers, the best 636 * we can do is return that status when we have ALL of: 637 * Output buffer was < SMB_PIPE_MAX_MSGSIZE 638 * We filled the output buffer (resid==0) 639 * There's more data (ioctl FIONREAD) 640 */ 641 status = NT_STATUS_SUCCESS; 642 if (fsctl->MaxOutputResp < SMB_PIPE_MAX_MSGSIZE && 643 vdb.vdb_uio.uio_resid == 0) { 644 int nread = 0, trval; 645 rc = smb_opipe_ioctl(sr, FIONREAD, &nread, &trval); 646 if (rc == 0 && nread != 0) 647 status = NT_STATUS_BUFFER_OVERFLOW; 648 } 649 650 return (status); 651 } 652