1da6c28aaSamw /* 2da6c28aaSamw * CDDL HEADER START 3da6c28aaSamw * 4da6c28aaSamw * The contents of this file are subject to the terms of the 5da6c28aaSamw * Common Development and Distribution License (the "License"). 6da6c28aaSamw * You may not use this file except in compliance with the License. 7da6c28aaSamw * 8da6c28aaSamw * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9da6c28aaSamw * or http://www.opensolaris.org/os/licensing. 10da6c28aaSamw * See the License for the specific language governing permissions 11da6c28aaSamw * and limitations under the License. 12da6c28aaSamw * 13da6c28aaSamw * When distributing Covered Code, include this CDDL HEADER in each 14da6c28aaSamw * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15da6c28aaSamw * If applicable, add the following below this CDDL HEADER, with the 16da6c28aaSamw * fields enclosed by brackets "[]" replaced with your own identifying 17da6c28aaSamw * information: Portions Copyright [yyyy] [name of copyright owner] 18da6c28aaSamw * 19da6c28aaSamw * CDDL HEADER END 20da6c28aaSamw */ 21da6c28aaSamw /* 22148c5f43SAlan Wright * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 23*8d94f651SGordon Ross * Copyright 2019 Nexenta Systems, Inc. All rights reserved. 24da6c28aaSamw */ 25b819cea2SGordon Ross 26da6c28aaSamw #include <sys/atomic.h> 27da6c28aaSamw #include <sys/synch.h> 28da6c28aaSamw #include <sys/types.h> 29da6c28aaSamw #include <sys/sdt.h> 30f9bc6dadSDmitry.Savitsky@nexenta.com #include <sys/random.h> 31da6c28aaSamw #include <smbsrv/netbios.h> 32a90cf9f2SGordon Ross #include <smbsrv/smb2_kproto.h> 33bbf6f00cSJordan Brown #include <smbsrv/string.h> 34b819cea2SGordon Ross #include <netinet/tcp.h> 35b819cea2SGordon Ross 36a90cf9f2SGordon Ross /* How many iovec we'll handle as a local array (no allocation) */ 37a90cf9f2SGordon Ross #define SMB_LOCAL_IOV_MAX 16 38a90cf9f2SGordon Ross 39b819cea2SGordon Ross #define SMB_NEW_KID() atomic_inc_64_nv(&smb_kids) 40da6c28aaSamw 41faa1795aSjb static volatile uint64_t smb_kids; 42da6c28aaSamw 43b819cea2SGordon Ross /* 44b819cea2SGordon Ross * We track the keepalive in minutes, but this constant 45b819cea2SGordon Ross * specifies it in seconds, so convert to minutes. 46b819cea2SGordon Ross */ 47b819cea2SGordon Ross uint32_t smb_keep_alive = SMB_PI_KEEP_ALIVE_MIN / 60; 48da6c28aaSamw 490897f7fbSGordon Ross /* 500897f7fbSGordon Ross * There are many smbtorture test cases that send 510897f7fbSGordon Ross * racing requests, and where the tests fail if we 520897f7fbSGordon Ross * don't execute them in exactly the order sent. 530897f7fbSGordon Ross * These are test bugs. The protocol makes no 540897f7fbSGordon Ross * guarantees about execution order of requests 550897f7fbSGordon Ross * that are concurrently active. 560897f7fbSGordon Ross * 570897f7fbSGordon Ross * Nonetheless, smbtorture has many useful tests, 580897f7fbSGordon Ross * so we have this work-around we can enable to 590897f7fbSGordon Ross * basically force sequential execution. When 600897f7fbSGordon Ross * enabled, insert a delay after each request is 610897f7fbSGordon Ross * issued a taskq job. Enable this with mdb by 620897f7fbSGordon Ross * setting smb_reader_delay to 10. Don't make it 630897f7fbSGordon Ross * more than 500 or so or the server will appear 640897f7fbSGordon Ross * to be so slow that tests may time out. 650897f7fbSGordon Ross */ 660897f7fbSGordon Ross int smb_reader_delay = 0; /* mSec. */ 670897f7fbSGordon Ross 68a90cf9f2SGordon Ross static int smbsr_newrq_initial(smb_request_t *); 69a90cf9f2SGordon Ross 702c2961f8Sjose borrego static void smb_session_cancel(smb_session_t *); 71a90cf9f2SGordon Ross static int smb_session_reader(smb_session_t *); 72a90cf9f2SGordon Ross static int smb_session_xprt_puthdr(smb_session_t *, 73a90cf9f2SGordon Ross uint8_t msg_type, uint32_t msg_len, 74a90cf9f2SGordon Ross uint8_t *dst, size_t dstlen); 75811599a4SMatt Barden static void smb_session_disconnect_trees(smb_session_t *); 76faa1795aSjb static void smb_request_init_command_mbuf(smb_request_t *sr); 77f9bc6dadSDmitry.Savitsky@nexenta.com static void smb_session_genkey(smb_session_t *); 78da6c28aaSamw 79811599a4SMatt Barden /* 80811599a4SMatt Barden * This (legacy) code is in support of an "idle timeout" feature, 81811599a4SMatt Barden * which is apparently incomplete. To complete it, we should: 82811599a4SMatt Barden * when the keep_alive timer expires, check whether the client 83811599a4SMatt Barden * has any open files, and if not then kill their session. 84811599a4SMatt Barden * Right now the timers are there, but nothing happens when 85811599a4SMatt Barden * a timer expires. 86811599a4SMatt Barden * 87811599a4SMatt Barden * Todo: complete logic to kill idle sessions. 88811599a4SMatt Barden * 89811599a4SMatt Barden * Only called when sv_cfg.skc_keepalive != 0 90811599a4SMatt Barden */ 91da6c28aaSamw void 92811599a4SMatt Barden smb_session_timers(smb_server_t *sv) 93da6c28aaSamw { 94faa1795aSjb smb_session_t *session; 95811599a4SMatt Barden smb_llist_t *ll; 96da6c28aaSamw 97811599a4SMatt Barden ll = &sv->sv_session_list; 984163af6aSjose borrego smb_llist_enter(ll, RW_READER); 994163af6aSjose borrego session = smb_llist_head(ll); 1004163af6aSjose borrego while (session != NULL) { 101da6c28aaSamw /* 102da6c28aaSamw * Walk through the table and decrement each keep_alive 103da6c28aaSamw * timer that has not timed out yet. (keepalive > 0) 104da6c28aaSamw */ 1054163af6aSjose borrego SMB_SESSION_VALID(session); 106faa1795aSjb if (session->keep_alive && 107faa1795aSjb (session->keep_alive != (uint32_t)-1)) 108faa1795aSjb session->keep_alive--; 109faa1795aSjb 110811599a4SMatt Barden session = smb_llist_next(ll, session); 111faa1795aSjb } 1124163af6aSjose borrego smb_llist_exit(ll); 113da6c28aaSamw } 114da6c28aaSamw 115da6c28aaSamw /* 116da6c28aaSamw * Send a session message - supports SMB-over-NBT and SMB-over-TCP. 117a90cf9f2SGordon Ross * If an mbuf chain is provided (optional), it will be freed and 118a90cf9f2SGordon Ross * set to NULL -- unconditionally! (error or not) 119da6c28aaSamw * 120a90cf9f2SGordon Ross * Builds a I/O vector (uio/iov) to do the send from mbufs, plus one 121a90cf9f2SGordon Ross * segment for the 4-byte NBT header. 122da6c28aaSamw */ 123da6c28aaSamw int 124a90cf9f2SGordon Ross smb_session_send(smb_session_t *session, uint8_t nbt_type, mbuf_chain_t *mbc) 125da6c28aaSamw { 126a90cf9f2SGordon Ross uio_t uio; 127a90cf9f2SGordon Ross iovec_t local_iov[SMB_LOCAL_IOV_MAX]; 128a90cf9f2SGordon Ross iovec_t *alloc_iov = NULL; 129a90cf9f2SGordon Ross int alloc_sz = 0; 130a90cf9f2SGordon Ross mbuf_t *m; 131a90cf9f2SGordon Ross uint8_t nbt_hdr[NETBIOS_HDR_SZ]; 132a90cf9f2SGordon Ross uint32_t nbt_len; 133a90cf9f2SGordon Ross int i, nseg; 1345cdbe942Sjb int rc; 135da6c28aaSamw 136da6c28aaSamw switch (session->s_state) { 137da6c28aaSamw case SMB_SESSION_STATE_DISCONNECTED: 138da6c28aaSamw case SMB_SESSION_STATE_TERMINATED: 139a90cf9f2SGordon Ross rc = ENOTCONN; 140a90cf9f2SGordon Ross goto out; 141da6c28aaSamw default: 142da6c28aaSamw break; 143da6c28aaSamw } 144da6c28aaSamw 145a90cf9f2SGordon Ross /* 146a90cf9f2SGordon Ross * Setup the IOV. First, count the number of IOV segments 147a90cf9f2SGordon Ross * (plus one for the NBT header) and decide whether we 148a90cf9f2SGordon Ross * need to allocate an iovec or can use local_iov; 149a90cf9f2SGordon Ross */ 150a90cf9f2SGordon Ross bzero(&uio, sizeof (uio)); 151a90cf9f2SGordon Ross nseg = 1; 152a90cf9f2SGordon Ross m = (mbc != NULL) ? mbc->chain : NULL; 153a90cf9f2SGordon Ross while (m != NULL) { 154a90cf9f2SGordon Ross nseg++; 155a90cf9f2SGordon Ross m = m->m_next; 156da6c28aaSamw } 157a90cf9f2SGordon Ross if (nseg <= SMB_LOCAL_IOV_MAX) { 158a90cf9f2SGordon Ross uio.uio_iov = local_iov; 159a90cf9f2SGordon Ross } else { 160a90cf9f2SGordon Ross alloc_sz = nseg * sizeof (iovec_t); 161a90cf9f2SGordon Ross alloc_iov = kmem_alloc(alloc_sz, KM_SLEEP); 162a90cf9f2SGordon Ross uio.uio_iov = alloc_iov; 163a90cf9f2SGordon Ross } 164a90cf9f2SGordon Ross uio.uio_iovcnt = nseg; 165a90cf9f2SGordon Ross uio.uio_segflg = UIO_SYSSPACE; 166a90cf9f2SGordon Ross uio.uio_extflg = UIO_COPY_DEFAULT; 167da6c28aaSamw 168a90cf9f2SGordon Ross /* 169a90cf9f2SGordon Ross * Build the iov list, meanwhile computing the length of 170a90cf9f2SGordon Ross * the SMB payload (to put in the NBT header). 171a90cf9f2SGordon Ross */ 172a90cf9f2SGordon Ross uio.uio_iov[0].iov_base = (void *)nbt_hdr; 173a90cf9f2SGordon Ross uio.uio_iov[0].iov_len = sizeof (nbt_hdr); 174a90cf9f2SGordon Ross i = 1; 175a90cf9f2SGordon Ross nbt_len = 0; 176a90cf9f2SGordon Ross m = (mbc != NULL) ? mbc->chain : NULL; 177a90cf9f2SGordon Ross while (m != NULL) { 178a90cf9f2SGordon Ross uio.uio_iov[i].iov_base = m->m_data; 179a90cf9f2SGordon Ross uio.uio_iov[i++].iov_len = m->m_len; 180a90cf9f2SGordon Ross nbt_len += m->m_len; 181a90cf9f2SGordon Ross m = m->m_next; 182a90cf9f2SGordon Ross } 183a90cf9f2SGordon Ross ASSERT3S(i, ==, nseg); 18421b7895dSjb 185a90cf9f2SGordon Ross /* 186a90cf9f2SGordon Ross * Set the NBT header, set uio_resid 187a90cf9f2SGordon Ross */ 188a90cf9f2SGordon Ross uio.uio_resid = nbt_len + NETBIOS_HDR_SZ; 189a90cf9f2SGordon Ross rc = smb_session_xprt_puthdr(session, nbt_type, nbt_len, 190a90cf9f2SGordon Ross nbt_hdr, NETBIOS_HDR_SZ); 191a90cf9f2SGordon Ross if (rc != 0) 192a90cf9f2SGordon Ross goto out; 193a90cf9f2SGordon Ross 194a90cf9f2SGordon Ross smb_server_add_txb(session->s_server, (int64_t)uio.uio_resid); 195a90cf9f2SGordon Ross rc = smb_net_send_uio(session, &uio); 196a90cf9f2SGordon Ross 197a90cf9f2SGordon Ross out: 198a90cf9f2SGordon Ross if (alloc_iov != NULL) 199a90cf9f2SGordon Ross kmem_free(alloc_iov, alloc_sz); 200a90cf9f2SGordon Ross if ((mbc != NULL) && (mbc->chain != NULL)) { 201a90cf9f2SGordon Ross m_freem(mbc->chain); 202a90cf9f2SGordon Ross mbc->chain = NULL; 203a90cf9f2SGordon Ross mbc->flags = 0; 204da6c28aaSamw } 205a90cf9f2SGordon Ross return (rc); 206da6c28aaSamw } 207da6c28aaSamw 208da6c28aaSamw /* 209da6c28aaSamw * Read, process and respond to a NetBIOS session request. 210da6c28aaSamw * 211da6c28aaSamw * A NetBIOS session must be established for SMB-over-NetBIOS. Validate 212da6c28aaSamw * the calling and called name format and save the client NetBIOS name, 213da6c28aaSamw * which is used when a NetBIOS session is established to check for and 214da6c28aaSamw * cleanup leftover state from a previous session. 215da6c28aaSamw * 216da6c28aaSamw * Session requests are not valid for SMB-over-TCP, which is unfortunate 217da6c28aaSamw * because without the client name leftover state cannot be cleaned up 218da6c28aaSamw * if the client is behind a NAT server. 219da6c28aaSamw */ 220da6c28aaSamw static int 221a90cf9f2SGordon Ross smb_netbios_session_request(struct smb_session *session) 222da6c28aaSamw { 223da6c28aaSamw int rc; 224da6c28aaSamw char *calling_name; 225da6c28aaSamw char *called_name; 226811599a4SMatt Barden char client_name[NETBIOS_NAME_SZ]; 227811599a4SMatt Barden struct mbuf_chain mbc; 228811599a4SMatt Barden char *names = NULL; 229bbf6f00cSJordan Brown smb_wchar_t *wbuf = NULL; 230da6c28aaSamw smb_xprt_t hdr; 231da6c28aaSamw char *p; 232da6c28aaSamw int rc1, rc2; 233da6c28aaSamw 234da6c28aaSamw session->keep_alive = smb_keep_alive; 235da6c28aaSamw 236faa1795aSjb if ((rc = smb_session_xprt_gethdr(session, &hdr)) != 0) 237faa1795aSjb return (rc); 238da6c28aaSamw 239da6c28aaSamw DTRACE_PROBE2(receive__session__req__xprthdr, struct session *, session, 240da6c28aaSamw smb_xprt_t *, &hdr); 241da6c28aaSamw 242da6c28aaSamw if ((hdr.xh_type != SESSION_REQUEST) || 243da6c28aaSamw (hdr.xh_length != NETBIOS_SESSION_REQUEST_DATA_LENGTH)) { 244da6c28aaSamw DTRACE_PROBE1(receive__session__req__failed, 245da6c28aaSamw struct session *, session); 246da6c28aaSamw return (EINVAL); 247da6c28aaSamw } 248da6c28aaSamw 249da6c28aaSamw names = kmem_alloc(hdr.xh_length, KM_SLEEP); 250da6c28aaSamw 251da6c28aaSamw if ((rc = smb_sorecv(session->sock, names, hdr.xh_length)) != 0) { 252da6c28aaSamw kmem_free(names, hdr.xh_length); 253da6c28aaSamw DTRACE_PROBE1(receive__session__req__failed, 254da6c28aaSamw struct session *, session); 255da6c28aaSamw return (rc); 256da6c28aaSamw } 257da6c28aaSamw 258da6c28aaSamw DTRACE_PROBE3(receive__session__req__data, struct session *, session, 259da6c28aaSamw char *, names, uint32_t, hdr.xh_length); 260da6c28aaSamw 261da6c28aaSamw called_name = &names[0]; 262da6c28aaSamw calling_name = &names[NETBIOS_ENCODED_NAME_SZ + 2]; 263da6c28aaSamw 264da6c28aaSamw rc1 = netbios_name_isvalid(called_name, 0); 265da6c28aaSamw rc2 = netbios_name_isvalid(calling_name, client_name); 266da6c28aaSamw 267da6c28aaSamw if (rc1 == 0 || rc2 == 0) { 268da6c28aaSamw 269da6c28aaSamw DTRACE_PROBE3(receive__invalid__session__req, 270da6c28aaSamw struct session *, session, char *, names, 271da6c28aaSamw uint32_t, hdr.xh_length); 272da6c28aaSamw 273da6c28aaSamw kmem_free(names, hdr.xh_length); 274da6c28aaSamw MBC_INIT(&mbc, MAX_DATAGRAM_LENGTH); 2753db3f65cSamw (void) smb_mbc_encodef(&mbc, "b", 276da6c28aaSamw DATAGRAM_INVALID_SOURCE_NAME_FORMAT); 277da6c28aaSamw (void) smb_session_send(session, NEGATIVE_SESSION_RESPONSE, 278da6c28aaSamw &mbc); 279da6c28aaSamw return (EINVAL); 280da6c28aaSamw } 281da6c28aaSamw 282da6c28aaSamw DTRACE_PROBE3(receive__session__req__calling__decoded, 283da6c28aaSamw struct session *, session, 284da6c28aaSamw char *, calling_name, char *, client_name); 285da6c28aaSamw 286da6c28aaSamw /* 287da6c28aaSamw * The client NetBIOS name is in oem codepage format. 288da6c28aaSamw * We need to convert it to unicode and store it in 289da6c28aaSamw * multi-byte format. We also need to strip off any 290da6c28aaSamw * spaces added as part of the NetBIOS name encoding. 291da6c28aaSamw */ 292bbf6f00cSJordan Brown wbuf = kmem_alloc((SMB_PI_MAX_HOST * sizeof (smb_wchar_t)), KM_SLEEP); 293bbf6f00cSJordan Brown (void) oemtoucs(wbuf, client_name, SMB_PI_MAX_HOST, OEM_CPG_850); 294bbf6f00cSJordan Brown (void) smb_wcstombs(session->workstation, wbuf, SMB_PI_MAX_HOST); 295bbf6f00cSJordan Brown kmem_free(wbuf, (SMB_PI_MAX_HOST * sizeof (smb_wchar_t))); 296da6c28aaSamw 297da6c28aaSamw if ((p = strchr(session->workstation, ' ')) != 0) 298da6c28aaSamw *p = '\0'; 299da6c28aaSamw 300da6c28aaSamw kmem_free(names, hdr.xh_length); 301da6c28aaSamw return (smb_session_send(session, POSITIVE_SESSION_RESPONSE, NULL)); 302da6c28aaSamw } 303da6c28aaSamw 304da6c28aaSamw /* 305da6c28aaSamw * Read 4-byte header from the session socket and build an in-memory 306da6c28aaSamw * session transport header. See smb_xprt_t definition for header 307da6c28aaSamw * format information. 308da6c28aaSamw * 309da6c28aaSamw * Direct hosted NetBIOS-less SMB (SMB-over-TCP) uses port 445. The 310da6c28aaSamw * first byte of the four-byte header must be 0 and the next three 311da6c28aaSamw * bytes contain the length of the remaining data. 312da6c28aaSamw */ 313da6c28aaSamw int 314da6c28aaSamw smb_session_xprt_gethdr(smb_session_t *session, smb_xprt_t *ret_hdr) 315da6c28aaSamw { 316faa1795aSjb int rc; 317faa1795aSjb unsigned char buf[NETBIOS_HDR_SZ]; 318da6c28aaSamw 319faa1795aSjb if ((rc = smb_sorecv(session->sock, buf, NETBIOS_HDR_SZ)) != 0) 320faa1795aSjb return (rc); 321da6c28aaSamw 322da6c28aaSamw switch (session->s_local_port) { 323a0aa776eSAlan Wright case IPPORT_NETBIOS_SSN: 324da6c28aaSamw ret_hdr->xh_type = buf[0]; 325da6c28aaSamw ret_hdr->xh_length = (((uint32_t)buf[1] & 1) << 16) | 326da6c28aaSamw ((uint32_t)buf[2] << 8) | 327da6c28aaSamw ((uint32_t)buf[3]); 328da6c28aaSamw break; 329da6c28aaSamw 330a0aa776eSAlan Wright case IPPORT_SMB: 331da6c28aaSamw ret_hdr->xh_type = buf[0]; 332da6c28aaSamw 333da6c28aaSamw if (ret_hdr->xh_type != 0) { 33449b5df1eSGordon Ross cmn_err(CE_WARN, "invalid NBT type (%u) from %s", 33549b5df1eSGordon Ross ret_hdr->xh_type, session->ip_addr_str); 336faa1795aSjb return (EPROTO); 337da6c28aaSamw } 338da6c28aaSamw 339da6c28aaSamw ret_hdr->xh_length = ((uint32_t)buf[1] << 16) | 340da6c28aaSamw ((uint32_t)buf[2] << 8) | 341da6c28aaSamw ((uint32_t)buf[3]); 342da6c28aaSamw break; 343da6c28aaSamw 344da6c28aaSamw default: 3457f667e74Sjose borrego cmn_err(CE_WARN, "invalid port %u", session->s_local_port); 346faa1795aSjb return (EPROTO); 347da6c28aaSamw } 348da6c28aaSamw 349da6c28aaSamw return (0); 350da6c28aaSamw } 351da6c28aaSamw 352da6c28aaSamw /* 353da6c28aaSamw * Encode a transport session packet header into a 4-byte buffer. 354da6c28aaSamw */ 355da6c28aaSamw static int 356a90cf9f2SGordon Ross smb_session_xprt_puthdr(smb_session_t *session, 357a90cf9f2SGordon Ross uint8_t msg_type, uint32_t msg_length, 358da6c28aaSamw uint8_t *buf, size_t buflen) 359da6c28aaSamw { 360a90cf9f2SGordon Ross if (buf == NULL || buflen < NETBIOS_HDR_SZ) { 361da6c28aaSamw return (-1); 362da6c28aaSamw } 363da6c28aaSamw 364da6c28aaSamw switch (session->s_local_port) { 365a0aa776eSAlan Wright case IPPORT_NETBIOS_SSN: 366a90cf9f2SGordon Ross /* Per RFC 1001, 1002: msg. len < 128KB */ 367a90cf9f2SGordon Ross if (msg_length >= (1 << 17)) 368a90cf9f2SGordon Ross return (-1); 369a90cf9f2SGordon Ross buf[0] = msg_type; 370a90cf9f2SGordon Ross buf[1] = ((msg_length >> 16) & 1); 371a90cf9f2SGordon Ross buf[2] = (msg_length >> 8) & 0xff; 372a90cf9f2SGordon Ross buf[3] = msg_length & 0xff; 373da6c28aaSamw break; 374da6c28aaSamw 375a0aa776eSAlan Wright case IPPORT_SMB: 376a90cf9f2SGordon Ross /* 377a90cf9f2SGordon Ross * SMB over TCP is like NetBIOS but the one byte 378a90cf9f2SGordon Ross * message type is always zero, and the length 379a90cf9f2SGordon Ross * part is three bytes. It could actually use 380a90cf9f2SGordon Ross * longer messages, but this is conservative. 381a90cf9f2SGordon Ross */ 382a90cf9f2SGordon Ross if (msg_length >= (1 << 24)) 383a90cf9f2SGordon Ross return (-1); 384a90cf9f2SGordon Ross buf[0] = msg_type; 385a90cf9f2SGordon Ross buf[1] = (msg_length >> 16) & 0xff; 386a90cf9f2SGordon Ross buf[2] = (msg_length >> 8) & 0xff; 387a90cf9f2SGordon Ross buf[3] = msg_length & 0xff; 388da6c28aaSamw break; 389da6c28aaSamw 390da6c28aaSamw default: 3917f667e74Sjose borrego cmn_err(CE_WARN, "invalid port %u", session->s_local_port); 392da6c28aaSamw return (-1); 393da6c28aaSamw } 394da6c28aaSamw 395da6c28aaSamw return (0); 396da6c28aaSamw } 397da6c28aaSamw 398faa1795aSjb static void 399da6c28aaSamw smb_request_init_command_mbuf(smb_request_t *sr) 400da6c28aaSamw { 401da6c28aaSamw 402da6c28aaSamw /* 4037f3ef643SGordon Ross * Setup mbuf using the buffer we allocated. 404da6c28aaSamw */ 4057f3ef643SGordon Ross MBC_ATTACH_BUF(&sr->command, sr->sr_request_buf, sr->sr_req_length); 406da6c28aaSamw 407da6c28aaSamw sr->command.flags = 0; 4087f3ef643SGordon Ross sr->command.shadow_of = NULL; 409da6c28aaSamw } 410da6c28aaSamw 411da6c28aaSamw /* 412da6c28aaSamw * smb_request_cancel 413da6c28aaSamw * 414da6c28aaSamw * Handle a cancel for a request properly depending on the current request 415da6c28aaSamw * state. 416da6c28aaSamw */ 417da6c28aaSamw void 418da6c28aaSamw smb_request_cancel(smb_request_t *sr) 419da6c28aaSamw { 4205677e049SGordon Ross void (*cancel_method)(smb_request_t *) = NULL; 4215677e049SGordon Ross 422da6c28aaSamw mutex_enter(&sr->sr_mutex); 423da6c28aaSamw switch (sr->sr_state) { 424da6c28aaSamw 425584e0fceSGordon Ross case SMB_REQ_STATE_INITIALIZING: 426da6c28aaSamw case SMB_REQ_STATE_SUBMITTED: 427da6c28aaSamw case SMB_REQ_STATE_ACTIVE: 428da6c28aaSamw case SMB_REQ_STATE_CLEANED_UP: 4295677e049SGordon Ross sr->sr_state = SMB_REQ_STATE_CANCELLED; 430da6c28aaSamw break; 431da6c28aaSamw 432b210fedeSGordon Ross case SMB_REQ_STATE_WAITING_AUTH: 433bfe5e737SGordon Ross case SMB_REQ_STATE_WAITING_FCN1: 434bfe5e737SGordon Ross case SMB_REQ_STATE_WAITING_LOCK: 435b210fedeSGordon Ross case SMB_REQ_STATE_WAITING_PIPE: 436da6c28aaSamw /* 4375677e049SGordon Ross * These are states that have a cancel_method. 4385677e049SGordon Ross * Make the state change now, to ensure that 4395677e049SGordon Ross * we call cancel_method exactly once. Do the 4405677e049SGordon Ross * method call below, after we drop sr_mutex. 4415677e049SGordon Ross * When the cancelled request thread resumes, 4425677e049SGordon Ross * it should re-take sr_mutex and set sr_state 4435677e049SGordon Ross * to CANCELLED, then return STATUS_CANCELLED. 444da6c28aaSamw */ 4455677e049SGordon Ross sr->sr_state = SMB_REQ_STATE_CANCEL_PENDING; 4465677e049SGordon Ross cancel_method = sr->cancel_method; 4475677e049SGordon Ross VERIFY(cancel_method != NULL); 448da6c28aaSamw break; 449da6c28aaSamw 450bfe5e737SGordon Ross case SMB_REQ_STATE_WAITING_FCN2: 451da6c28aaSamw case SMB_REQ_STATE_COMPLETED: 452bfe5e737SGordon Ross case SMB_REQ_STATE_CANCEL_PENDING: 4535677e049SGordon Ross case SMB_REQ_STATE_CANCELLED: 454da6c28aaSamw /* 455da6c28aaSamw * No action required for these states since the request 456da6c28aaSamw * is completing. 457da6c28aaSamw */ 458da6c28aaSamw break; 459584e0fceSGordon Ross 460584e0fceSGordon Ross case SMB_REQ_STATE_FREE: 461da6c28aaSamw default: 4622c2961f8Sjose borrego SMB_PANIC(); 463da6c28aaSamw } 464da6c28aaSamw mutex_exit(&sr->sr_mutex); 4655677e049SGordon Ross 4665677e049SGordon Ross if (cancel_method != NULL) { 4675677e049SGordon Ross cancel_method(sr); 4685677e049SGordon Ross } 469da6c28aaSamw } 470da6c28aaSamw 471da6c28aaSamw /* 4724163af6aSjose borrego * smb_session_receiver 473da6c28aaSamw * 4744163af6aSjose borrego * Receives request from the network and dispatches them to a worker. 475811599a4SMatt Barden * 476811599a4SMatt Barden * When we receive a disconnect here, it _could_ be due to the server 477811599a4SMatt Barden * having initiated disconnect, in which case the session state will be 478811599a4SMatt Barden * SMB_SESSION_STATE_TERMINATED and we want to keep that state so later 479811599a4SMatt Barden * tear-down logic will know which side initiated. 480da6c28aaSamw */ 4814163af6aSjose borrego void 4824163af6aSjose borrego smb_session_receiver(smb_session_t *session) 483da6c28aaSamw { 484b819cea2SGordon Ross int rc = 0; 485da6c28aaSamw 4864163af6aSjose borrego SMB_SESSION_VALID(session); 4874163af6aSjose borrego 4884163af6aSjose borrego session->s_thread = curthread; 489da6c28aaSamw 490a0aa776eSAlan Wright if (session->s_local_port == IPPORT_NETBIOS_SSN) { 491a90cf9f2SGordon Ross rc = smb_netbios_session_request(session); 4924163af6aSjose borrego if (rc != 0) { 493faa1795aSjb smb_rwx_rwenter(&session->s_lock, RW_WRITER); 494811599a4SMatt Barden if (session->s_state != SMB_SESSION_STATE_TERMINATED) 495811599a4SMatt Barden session->s_state = 496811599a4SMatt Barden SMB_SESSION_STATE_DISCONNECTED; 497faa1795aSjb smb_rwx_rwexit(&session->s_lock); 4984163af6aSjose borrego return; 499faa1795aSjb } 500faa1795aSjb } 501da6c28aaSamw 502da6c28aaSamw smb_rwx_rwenter(&session->s_lock, RW_WRITER); 503faa1795aSjb session->s_state = SMB_SESSION_STATE_ESTABLISHED; 504faa1795aSjb smb_rwx_rwexit(&session->s_lock); 505da6c28aaSamw 506a90cf9f2SGordon Ross (void) smb_session_reader(session); 507da6c28aaSamw 508faa1795aSjb smb_rwx_rwenter(&session->s_lock, RW_WRITER); 509811599a4SMatt Barden if (session->s_state != SMB_SESSION_STATE_TERMINATED) 510811599a4SMatt Barden session->s_state = SMB_SESSION_STATE_DISCONNECTED; 511da6c28aaSamw smb_rwx_rwexit(&session->s_lock); 512da6c28aaSamw 513faa1795aSjb smb_soshutdown(session->sock); 514faa1795aSjb 515da6c28aaSamw DTRACE_PROBE2(session__drop, struct session *, session, int, rc); 516da6c28aaSamw 517da6c28aaSamw smb_session_cancel(session); 518da6c28aaSamw /* 519da6c28aaSamw * At this point everything related to the session should have been 520da6c28aaSamw * cleaned up and we expect that nothing will attempt to use the 521da6c28aaSamw * socket. 522da6c28aaSamw */ 5234163af6aSjose borrego } 524da6c28aaSamw 5254163af6aSjose borrego /* 5264163af6aSjose borrego * smb_session_disconnect 5274163af6aSjose borrego * 528811599a4SMatt Barden * Server-initiated disconnect (i.e. server shutdown) 5294163af6aSjose borrego */ 5304163af6aSjose borrego void 5314163af6aSjose borrego smb_session_disconnect(smb_session_t *session) 5324163af6aSjose borrego { 5334163af6aSjose borrego SMB_SESSION_VALID(session); 5344163af6aSjose borrego 5354163af6aSjose borrego smb_rwx_rwenter(&session->s_lock, RW_WRITER); 5364163af6aSjose borrego switch (session->s_state) { 5374163af6aSjose borrego case SMB_SESSION_STATE_INITIALIZED: 5384163af6aSjose borrego case SMB_SESSION_STATE_CONNECTED: 5394163af6aSjose borrego case SMB_SESSION_STATE_ESTABLISHED: 5404163af6aSjose borrego case SMB_SESSION_STATE_NEGOTIATED: 5414163af6aSjose borrego smb_soshutdown(session->sock); 542811599a4SMatt Barden session->s_state = SMB_SESSION_STATE_TERMINATED; 543811599a4SMatt Barden break; 5444163af6aSjose borrego case SMB_SESSION_STATE_DISCONNECTED: 5454163af6aSjose borrego case SMB_SESSION_STATE_TERMINATED: 5464163af6aSjose borrego break; 5474163af6aSjose borrego } 5484163af6aSjose borrego smb_rwx_rwexit(&session->s_lock); 549da6c28aaSamw } 550da6c28aaSamw 551da6c28aaSamw /* 552da6c28aaSamw * Read and process SMB requests. 553da6c28aaSamw * 554da6c28aaSamw * Returns: 555da6c28aaSamw * 0 Success 556da6c28aaSamw * 1 Unable to read transport header 557da6c28aaSamw * 2 Invalid transport header type 558da6c28aaSamw * 3 Invalid SMB length (too small) 559da6c28aaSamw * 4 Unable to read SMB header 560da6c28aaSamw * 5 Invalid SMB header (bad magic number) 561da6c28aaSamw * 6 Unable to read SMB data 562da6c28aaSamw */ 563da6c28aaSamw static int 564a90cf9f2SGordon Ross smb_session_reader(smb_session_t *session) 565da6c28aaSamw { 566148c5f43SAlan Wright smb_server_t *sv; 567faa1795aSjb smb_request_t *sr = NULL; 568faa1795aSjb smb_xprt_t hdr; 569faa1795aSjb uint8_t *req_buf; 570faa1795aSjb uint32_t resid; 571faa1795aSjb int rc; 572da6c28aaSamw 573148c5f43SAlan Wright sv = session->s_server; 574148c5f43SAlan Wright 575faa1795aSjb for (;;) { 576faa1795aSjb 577faa1795aSjb rc = smb_session_xprt_gethdr(session, &hdr); 578faa1795aSjb if (rc) 579faa1795aSjb return (rc); 580faa1795aSjb 581faa1795aSjb DTRACE_PROBE2(session__receive__xprthdr, session_t *, session, 582faa1795aSjb smb_xprt_t *, &hdr); 583faa1795aSjb 584faa1795aSjb if (hdr.xh_type != SESSION_MESSAGE) { 585faa1795aSjb /* 586faa1795aSjb * Anything other than SESSION_MESSAGE or 587faa1795aSjb * SESSION_KEEP_ALIVE is an error. A SESSION_REQUEST 588faa1795aSjb * may indicate a new session request but we need to 589faa1795aSjb * close this session and we can treat it as an error 590faa1795aSjb * here. 591faa1795aSjb */ 592faa1795aSjb if (hdr.xh_type == SESSION_KEEP_ALIVE) { 593faa1795aSjb session->keep_alive = smb_keep_alive; 594da6c28aaSamw continue; 595da6c28aaSamw } 596faa1795aSjb return (EPROTO); 597da6c28aaSamw } 598da6c28aaSamw 599a90cf9f2SGordon Ross if (hdr.xh_length == 0) { 600a90cf9f2SGordon Ross /* zero length is another form of keep alive */ 601a90cf9f2SGordon Ross session->keep_alive = smb_keep_alive; 602a90cf9f2SGordon Ross continue; 603a90cf9f2SGordon Ross } 604a90cf9f2SGordon Ross 605faa1795aSjb if (hdr.xh_length < SMB_HEADER_LEN) 606faa1795aSjb return (EPROTO); 607a90cf9f2SGordon Ross if (hdr.xh_length > session->cmd_max_bytes) 608a90cf9f2SGordon Ross return (EPROTO); 609da6c28aaSamw 610faa1795aSjb session->keep_alive = smb_keep_alive; 611a90cf9f2SGordon Ross 612da6c28aaSamw /* 613a90cf9f2SGordon Ross * Allocate a request context, read the whole message. 614811599a4SMatt Barden * If the request alloc fails, we've disconnected 615811599a4SMatt Barden * and won't be able to send the reply anyway, so bail now. 616da6c28aaSamw */ 6179c856e86SMatt Barden if ((sr = smb_request_alloc(session, hdr.xh_length)) == NULL) 6189c856e86SMatt Barden break; 619da6c28aaSamw 620faa1795aSjb req_buf = (uint8_t *)sr->sr_request_buf; 621faa1795aSjb resid = hdr.xh_length; 622da6c28aaSamw 623a90cf9f2SGordon Ross rc = smb_sorecv(session->sock, req_buf, resid); 624faa1795aSjb if (rc) { 625faa1795aSjb smb_request_free(sr); 626a90cf9f2SGordon Ross break; 627faa1795aSjb } 628da6c28aaSamw 629ac2bf314SMatt Barden /* accounting: received bytes */ 630148c5f43SAlan Wright smb_server_add_rxb(sv, 631148c5f43SAlan Wright (int64_t)(hdr.xh_length + NETBIOS_HDR_SZ)); 632a90cf9f2SGordon Ross 633faa1795aSjb /* 634faa1795aSjb * Initialize command MBC to represent the received data. 635faa1795aSjb */ 636faa1795aSjb smb_request_init_command_mbuf(sr); 637da6c28aaSamw 638faa1795aSjb DTRACE_PROBE1(session__receive__smb, smb_request_t *, sr); 639da6c28aaSamw 640a90cf9f2SGordon Ross rc = session->newrq_func(sr); 641a90cf9f2SGordon Ross sr = NULL; /* enqueued or freed */ 642a90cf9f2SGordon Ross if (rc != 0) 643a90cf9f2SGordon Ross break; 6440897f7fbSGordon Ross 6450897f7fbSGordon Ross /* See notes where this is defined (above). */ 6460897f7fbSGordon Ross if (smb_reader_delay) { 6470897f7fbSGordon Ross delay(MSEC_TO_TICK(smb_reader_delay)); 6480897f7fbSGordon Ross } 649da6c28aaSamw } 650a90cf9f2SGordon Ross return (rc); 651a90cf9f2SGordon Ross } 652a90cf9f2SGordon Ross 653a90cf9f2SGordon Ross /* 654a90cf9f2SGordon Ross * This is the initial handler for new smb requests, called from 655a90cf9f2SGordon Ross * from smb_session_reader when we have not yet seen any requests. 656a90cf9f2SGordon Ross * The first SMB request must be "negotiate", which determines 657a90cf9f2SGordon Ross * which protocol and dialect we'll be using. That's the ONLY 658a90cf9f2SGordon Ross * request type handled here, because with all later requests, 659a90cf9f2SGordon Ross * we know the protocol and handle those with either the SMB1 or 660a90cf9f2SGordon Ross * SMB2 handlers: smb1sr_post() or smb2sr_post(). 661a90cf9f2SGordon Ross * Those do NOT allow SMB negotiate, because that's only allowed 662a90cf9f2SGordon Ross * as the first request on new session. 663a90cf9f2SGordon Ross * 664a90cf9f2SGordon Ross * This and other "post a request" handlers must either enqueue 665a90cf9f2SGordon Ross * the new request for the session taskq, or smb_request_free it 666a90cf9f2SGordon Ross * (in case we've decided to drop this connection). In this 667a90cf9f2SGordon Ross * (special) new request handler, we always free the request. 66893bc28dbSGordon Ross * 66993bc28dbSGordon Ross * Return value is 0 for success, and anything else will 67093bc28dbSGordon Ross * terminate the reader thread (drop the connection). 671a90cf9f2SGordon Ross */ 672a90cf9f2SGordon Ross static int 673a90cf9f2SGordon Ross smbsr_newrq_initial(smb_request_t *sr) 674a90cf9f2SGordon Ross { 675a90cf9f2SGordon Ross uint32_t magic; 676a90cf9f2SGordon Ross int rc = EPROTO; 677a90cf9f2SGordon Ross 678a90cf9f2SGordon Ross mutex_enter(&sr->sr_mutex); 679a90cf9f2SGordon Ross sr->sr_state = SMB_REQ_STATE_ACTIVE; 680a90cf9f2SGordon Ross mutex_exit(&sr->sr_mutex); 681a90cf9f2SGordon Ross 682a90cf9f2SGordon Ross magic = SMB_READ_PROTOCOL(sr->sr_request_buf); 683a90cf9f2SGordon Ross if (magic == SMB_PROTOCOL_MAGIC) 684a90cf9f2SGordon Ross rc = smb1_newrq_negotiate(sr); 685a90cf9f2SGordon Ross if (magic == SMB2_PROTOCOL_MAGIC) 686a90cf9f2SGordon Ross rc = smb2_newrq_negotiate(sr); 687a90cf9f2SGordon Ross 688a90cf9f2SGordon Ross mutex_enter(&sr->sr_mutex); 689a90cf9f2SGordon Ross sr->sr_state = SMB_REQ_STATE_COMPLETED; 690a90cf9f2SGordon Ross mutex_exit(&sr->sr_mutex); 691a90cf9f2SGordon Ross 692a90cf9f2SGordon Ross smb_request_free(sr); 693a90cf9f2SGordon Ross return (rc); 694da6c28aaSamw } 695da6c28aaSamw 696da6c28aaSamw /* 697a0aa776eSAlan Wright * Port will be IPPORT_NETBIOS_SSN or IPPORT_SMB. 698da6c28aaSamw */ 699da6c28aaSamw smb_session_t * 7007f667e74Sjose borrego smb_session_create(ksocket_t new_so, uint16_t port, smb_server_t *sv, 7017f667e74Sjose borrego int family) 702da6c28aaSamw { 703da6c28aaSamw struct sockaddr_in sin; 7040f1702c5SYu Xiangning socklen_t slen; 7057f667e74Sjose borrego struct sockaddr_in6 sin6; 706da6c28aaSamw smb_session_t *session; 707d3d50737SRafael Vanoni int64_t now; 708a90cf9f2SGordon Ross uint16_t rport; 709da6c28aaSamw 7108622ec45SGordon Ross session = kmem_cache_alloc(smb_cache_session, KM_SLEEP); 711da6c28aaSamw bzero(session, sizeof (smb_session_t)); 712da6c28aaSamw 713da6c28aaSamw if (smb_idpool_constructor(&session->s_uid_pool)) { 7148622ec45SGordon Ross kmem_cache_free(smb_cache_session, session); 715da6c28aaSamw return (NULL); 716da6c28aaSamw } 7173b13a1efSThomas Keiser if (smb_idpool_constructor(&session->s_tid_pool)) { 7183b13a1efSThomas Keiser smb_idpool_destructor(&session->s_uid_pool); 7198622ec45SGordon Ross kmem_cache_free(smb_cache_session, session); 7203b13a1efSThomas Keiser return (NULL); 7213b13a1efSThomas Keiser } 722da6c28aaSamw 723d3d50737SRafael Vanoni now = ddi_get_lbolt64(); 724d3d50737SRafael Vanoni 725811599a4SMatt Barden session->s_server = sv; 726da6c28aaSamw session->s_kid = SMB_NEW_KID(); 727faa1795aSjb session->s_state = SMB_SESSION_STATE_INITIALIZED; 728da6c28aaSamw session->native_os = NATIVE_OS_UNKNOWN; 729d3d50737SRafael Vanoni session->opentime = now; 730da6c28aaSamw session->keep_alive = smb_keep_alive; 731d3d50737SRafael Vanoni session->activity_timestamp = now; 732da6c28aaSamw 733f9bc6dadSDmitry.Savitsky@nexenta.com smb_session_genkey(session); 734f9bc6dadSDmitry.Savitsky@nexenta.com 735a90cf9f2SGordon Ross mutex_init(&session->s_credits_mutex, NULL, MUTEX_DEFAULT, NULL); 736a90cf9f2SGordon Ross 737da6c28aaSamw smb_slist_constructor(&session->s_req_list, sizeof (smb_request_t), 738da6c28aaSamw offsetof(smb_request_t, sr_session_lnd)); 739da6c28aaSamw 740da6c28aaSamw smb_llist_constructor(&session->s_user_list, sizeof (smb_user_t), 741da6c28aaSamw offsetof(smb_user_t, u_lnd)); 742da6c28aaSamw 7433b13a1efSThomas Keiser smb_llist_constructor(&session->s_tree_list, sizeof (smb_tree_t), 7443b13a1efSThomas Keiser offsetof(smb_tree_t, t_lnd)); 7453b13a1efSThomas Keiser 746da6c28aaSamw smb_llist_constructor(&session->s_xa_list, sizeof (smb_xa_t), 747da6c28aaSamw offsetof(smb_xa_t, xa_lnd)); 748da6c28aaSamw 7495cdbe942Sjb smb_net_txl_constructor(&session->s_txlst); 7505cdbe942Sjb 751da6c28aaSamw smb_rwx_init(&session->s_lock); 752da6c28aaSamw 753*8d94f651SGordon Ross session->s_srqueue = &sv->sv_srqueue; 754*8d94f651SGordon Ross smb_server_get_cfg(sv, &session->s_cfg); 755*8d94f651SGordon Ross 756*8d94f651SGordon Ross if (new_so == NULL) { 757*8d94f651SGordon Ross /* 758*8d94f651SGordon Ross * This call is creating the special "server" session, 759*8d94f651SGordon Ross * used for kshare export, oplock breaks, CA import. 760*8d94f651SGordon Ross * CA import creates temporary trees on this session 761*8d94f651SGordon Ross * and those should never get map/unmap up-calls, so 762*8d94f651SGordon Ross * force the map/unmap flags zero on this session. 763*8d94f651SGordon Ross * Set a "modern" dialect for CA import too, so 764*8d94f651SGordon Ross * pathname parse doesn't do OS/2 stuff, etc. 765*8d94f651SGordon Ross */ 766*8d94f651SGordon Ross session->s_cfg.skc_execflags = 0; 767*8d94f651SGordon Ross session->dialect = session->s_cfg.skc_max_protocol; 768*8d94f651SGordon Ross } else { 7697f667e74Sjose borrego if (family == AF_INET) { 7707f667e74Sjose borrego slen = sizeof (sin); 7717f667e74Sjose borrego (void) ksocket_getsockname(new_so, 7727f667e74Sjose borrego (struct sockaddr *)&sin, &slen, CRED()); 773fc724630SAlan Wright bcopy(&sin.sin_addr, 774fc724630SAlan Wright &session->local_ipaddr.au_addr.au_ipv4, 775fc724630SAlan Wright sizeof (in_addr_t)); 776fc724630SAlan Wright slen = sizeof (sin); 7777f667e74Sjose borrego (void) ksocket_getpeername(new_so, 7787f667e74Sjose borrego (struct sockaddr *)&sin, &slen, CRED()); 779fc724630SAlan Wright bcopy(&sin.sin_addr, 780fc724630SAlan Wright &session->ipaddr.au_addr.au_ipv4, 781fc724630SAlan Wright sizeof (in_addr_t)); 782a90cf9f2SGordon Ross rport = sin.sin_port; 7837f667e74Sjose borrego } else { 7847f667e74Sjose borrego slen = sizeof (sin6); 7857f667e74Sjose borrego (void) ksocket_getsockname(new_so, 7867f667e74Sjose borrego (struct sockaddr *)&sin6, &slen, CRED()); 787fc724630SAlan Wright bcopy(&sin6.sin6_addr, 788fc724630SAlan Wright &session->local_ipaddr.au_addr.au_ipv6, 789fc724630SAlan Wright sizeof (in6_addr_t)); 790fc724630SAlan Wright slen = sizeof (sin6); 7917f667e74Sjose borrego (void) ksocket_getpeername(new_so, 7927f667e74Sjose borrego (struct sockaddr *)&sin6, &slen, CRED()); 793fc724630SAlan Wright bcopy(&sin6.sin6_addr, 794fc724630SAlan Wright &session->ipaddr.au_addr.au_ipv6, 795fc724630SAlan Wright sizeof (in6_addr_t)); 796a90cf9f2SGordon Ross rport = sin6.sin6_port; 7977f667e74Sjose borrego } 7987f667e74Sjose borrego session->ipaddr.a_family = family; 7997f667e74Sjose borrego session->local_ipaddr.a_family = family; 800faa1795aSjb session->s_local_port = port; 801a90cf9f2SGordon Ross session->s_remote_port = ntohs(rport); 802faa1795aSjb session->sock = new_so; 80349b5df1eSGordon Ross (void) smb_inet_ntop(&session->ipaddr, 80449b5df1eSGordon Ross session->ip_addr_str, INET6_ADDRSTRLEN); 805148c5f43SAlan Wright if (port == IPPORT_NETBIOS_SSN) 806148c5f43SAlan Wright smb_server_inc_nbt_sess(sv); 807148c5f43SAlan Wright else 808148c5f43SAlan Wright smb_server_inc_tcp_sess(sv); 809faa1795aSjb } 810148c5f43SAlan Wright 811a90cf9f2SGordon Ross /* 812a90cf9f2SGordon Ross * The initial new request handler is special, 813a90cf9f2SGordon Ross * and only accepts negotiation requests. 814a90cf9f2SGordon Ross */ 815a90cf9f2SGordon Ross session->newrq_func = smbsr_newrq_initial; 816a90cf9f2SGordon Ross 817a90cf9f2SGordon Ross /* These may increase in SMB2 negotiate. */ 818a90cf9f2SGordon Ross session->cmd_max_bytes = SMB_REQ_MAX_SIZE; 819a90cf9f2SGordon Ross session->reply_max_bytes = SMB_REQ_MAX_SIZE; 820a90cf9f2SGordon Ross 821da6c28aaSamw session->s_magic = SMB_SESSION_MAGIC; 822da6c28aaSamw return (session); 823da6c28aaSamw } 824da6c28aaSamw 825da6c28aaSamw void 826da6c28aaSamw smb_session_delete(smb_session_t *session) 827da6c28aaSamw { 8282c2961f8Sjose borrego 829da6c28aaSamw ASSERT(session->s_magic == SMB_SESSION_MAGIC); 830da6c28aaSamw 8311160dcf7SMatt Barden if (session->enc_mech != NULL) 8321160dcf7SMatt Barden smb3_encrypt_fini(session); 8331160dcf7SMatt Barden 834b819cea2SGordon Ross if (session->sign_fini != NULL) 835b819cea2SGordon Ross session->sign_fini(session); 836b819cea2SGordon Ross 83712b65585SGordon Ross if (session->signing.mackey != NULL) { 83812b65585SGordon Ross kmem_free(session->signing.mackey, 83912b65585SGordon Ross session->signing.mackey_len); 84012b65585SGordon Ross } 84112b65585SGordon Ross 84212b65585SGordon Ross session->s_magic = 0; 84312b65585SGordon Ross 844da6c28aaSamw smb_rwx_destroy(&session->s_lock); 8455cdbe942Sjb smb_net_txl_destructor(&session->s_txlst); 8462c2961f8Sjose borrego 847a90cf9f2SGordon Ross mutex_destroy(&session->s_credits_mutex); 848a90cf9f2SGordon Ross 849da6c28aaSamw smb_slist_destructor(&session->s_req_list); 8503b13a1efSThomas Keiser smb_llist_destructor(&session->s_tree_list); 851da6c28aaSamw smb_llist_destructor(&session->s_user_list); 852da6c28aaSamw smb_llist_destructor(&session->s_xa_list); 853da6c28aaSamw 854da6c28aaSamw ASSERT(session->s_tree_cnt == 0); 855da6c28aaSamw ASSERT(session->s_file_cnt == 0); 856da6c28aaSamw ASSERT(session->s_dir_cnt == 0); 857da6c28aaSamw 8583b13a1efSThomas Keiser smb_idpool_destructor(&session->s_tid_pool); 859da6c28aaSamw smb_idpool_destructor(&session->s_uid_pool); 8604163af6aSjose borrego if (session->sock != NULL) { 8614163af6aSjose borrego if (session->s_local_port == IPPORT_NETBIOS_SSN) 8624163af6aSjose borrego smb_server_dec_nbt_sess(session->s_server); 8634163af6aSjose borrego else 8644163af6aSjose borrego smb_server_dec_tcp_sess(session->s_server); 8654163af6aSjose borrego smb_sodestroy(session->sock); 8664163af6aSjose borrego } 8678622ec45SGordon Ross kmem_cache_free(smb_cache_session, session); 868da6c28aaSamw } 869da6c28aaSamw 8702c2961f8Sjose borrego static void 871da6c28aaSamw smb_session_cancel(smb_session_t *session) 872da6c28aaSamw { 873da6c28aaSamw smb_xa_t *xa, *nextxa; 874da6c28aaSamw 875da6c28aaSamw /* All the request currently being treated must be canceled. */ 876c8ec8eeaSjose borrego smb_session_cancel_requests(session, NULL, NULL); 877da6c28aaSamw 878da6c28aaSamw /* 879da6c28aaSamw * We wait for the completion of all the requests associated with 880da6c28aaSamw * this session. 881da6c28aaSamw */ 882da6c28aaSamw smb_slist_wait_for_empty(&session->s_req_list); 883da6c28aaSamw 884da6c28aaSamw /* 885da6c28aaSamw * At this point the reference count of the users, trees, files, 886da6c28aaSamw * directories should be zero. It should be possible to destroy them 887da6c28aaSamw * without any problem. 888da6c28aaSamw */ 889da6c28aaSamw xa = smb_llist_head(&session->s_xa_list); 890da6c28aaSamw while (xa) { 891da6c28aaSamw nextxa = smb_llist_next(&session->s_xa_list, xa); 892da6c28aaSamw smb_xa_close(xa); 893da6c28aaSamw xa = nextxa; 894da6c28aaSamw } 8959fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 8969fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States smb_session_logoff(session); 897da6c28aaSamw } 898da6c28aaSamw 899c8ec8eeaSjose borrego /* 900c8ec8eeaSjose borrego * Cancel requests. If a non-null tree is specified, only requests specific 901c8ec8eeaSjose borrego * to that tree will be cancelled. If a non-null sr is specified, that sr 902c8ec8eeaSjose borrego * will be not be cancelled - this would typically be the caller's sr. 903c8ec8eeaSjose borrego */ 904da6c28aaSamw void 905da6c28aaSamw smb_session_cancel_requests( 906c8ec8eeaSjose borrego smb_session_t *session, 907c8ec8eeaSjose borrego smb_tree_t *tree, 908c8ec8eeaSjose borrego smb_request_t *exclude_sr) 909da6c28aaSamw { 910da6c28aaSamw smb_request_t *sr; 911da6c28aaSamw 912da6c28aaSamw smb_slist_enter(&session->s_req_list); 913da6c28aaSamw sr = smb_slist_head(&session->s_req_list); 914c8ec8eeaSjose borrego 915da6c28aaSamw while (sr) { 916da6c28aaSamw ASSERT(sr->sr_magic == SMB_REQ_MAGIC); 917c8ec8eeaSjose borrego if ((sr != exclude_sr) && 918c8ec8eeaSjose borrego (tree == NULL || sr->tid_tree == tree)) 919c8ec8eeaSjose borrego smb_request_cancel(sr); 920da6c28aaSamw 921c8ec8eeaSjose borrego sr = smb_slist_next(&session->s_req_list, sr); 922da6c28aaSamw } 923c8ec8eeaSjose borrego 924da6c28aaSamw smb_slist_exit(&session->s_req_list); 925da6c28aaSamw } 926da6c28aaSamw 927b89a8333Snatalie li - Sun Microsystems - Irvine United States /* 92812b65585SGordon Ross * Find a user on the specified session by SMB UID. 929b89a8333Snatalie li - Sun Microsystems - Irvine United States */ 930b89a8333Snatalie li - Sun Microsystems - Irvine United States smb_user_t * 93112b65585SGordon Ross smb_session_lookup_uid(smb_session_t *session, uint16_t uid) 932b89a8333Snatalie li - Sun Microsystems - Irvine United States { 933811599a4SMatt Barden return (smb_session_lookup_uid_st(session, 0, uid, 934811599a4SMatt Barden SMB_USER_STATE_LOGGED_ON)); 935811599a4SMatt Barden } 936811599a4SMatt Barden 937811599a4SMatt Barden /* 938811599a4SMatt Barden * Find a user on the specified session by SMB2 SSNID. 939811599a4SMatt Barden */ 940811599a4SMatt Barden smb_user_t * 941811599a4SMatt Barden smb_session_lookup_ssnid(smb_session_t *session, uint64_t ssnid) 942811599a4SMatt Barden { 943811599a4SMatt Barden return (smb_session_lookup_uid_st(session, ssnid, 0, 94412b65585SGordon Ross SMB_USER_STATE_LOGGED_ON)); 945b89a8333Snatalie li - Sun Microsystems - Irvine United States } 946b89a8333Snatalie li - Sun Microsystems - Irvine United States 9479fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States smb_user_t * 948811599a4SMatt Barden smb_session_lookup_uid_st(smb_session_t *session, uint64_t ssnid, 949811599a4SMatt Barden uint16_t uid, smb_user_state_t st) 9509fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States { 9519fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States smb_user_t *user; 9529fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States smb_llist_t *user_list; 9539fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 9549fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States SMB_SESSION_VALID(session); 9559fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 9569fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States user_list = &session->s_user_list; 9579fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States smb_llist_enter(user_list, RW_READER); 9589fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 959811599a4SMatt Barden for (user = smb_llist_head(user_list); 960811599a4SMatt Barden user != NULL; 961811599a4SMatt Barden user = smb_llist_next(user_list, user)) { 962811599a4SMatt Barden 9639fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States SMB_USER_VALID(user); 9649fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States ASSERT(user->u_session == session); 9659fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 966811599a4SMatt Barden if (user->u_ssnid != ssnid && user->u_uid != uid) 967811599a4SMatt Barden continue; 968811599a4SMatt Barden 969811599a4SMatt Barden mutex_enter(&user->u_mutex); 970811599a4SMatt Barden if (user->u_state == st) { 971811599a4SMatt Barden // smb_user_hold_internal(user); 972811599a4SMatt Barden user->u_refcnt++; 973811599a4SMatt Barden mutex_exit(&user->u_mutex); 97412b65585SGordon Ross break; 9759fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } 976811599a4SMatt Barden mutex_exit(&user->u_mutex); 9779fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } 9789fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 9799fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States smb_llist_exit(user_list); 98012b65585SGordon Ross return (user); 9819fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } 9829fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 9839fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States /* 9843b13a1efSThomas Keiser * Find a tree by tree-id. 9859fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States */ 9863b13a1efSThomas Keiser smb_tree_t * 9873b13a1efSThomas Keiser smb_session_lookup_tree( 9883b13a1efSThomas Keiser smb_session_t *session, 9893b13a1efSThomas Keiser uint16_t tid) 9909fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States { 9913b13a1efSThomas Keiser smb_tree_t *tree; 9929fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 9939fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States SMB_SESSION_VALID(session); 9949fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 9953b13a1efSThomas Keiser smb_llist_enter(&session->s_tree_list, RW_READER); 9963b13a1efSThomas Keiser tree = smb_llist_head(&session->s_tree_list); 9979fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 9983b13a1efSThomas Keiser while (tree) { 9993b13a1efSThomas Keiser ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC); 10003b13a1efSThomas Keiser ASSERT(tree->t_session == session); 10019fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 10023b13a1efSThomas Keiser if (tree->t_tid == tid) { 10033b13a1efSThomas Keiser if (smb_tree_hold(tree)) { 10043b13a1efSThomas Keiser smb_llist_exit(&session->s_tree_list); 10053b13a1efSThomas Keiser return (tree); 10063b13a1efSThomas Keiser } else { 10073b13a1efSThomas Keiser smb_llist_exit(&session->s_tree_list); 10083b13a1efSThomas Keiser return (NULL); 10093b13a1efSThomas Keiser } 10109fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } 10119fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 10123b13a1efSThomas Keiser tree = smb_llist_next(&session->s_tree_list, tree); 10139fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } 10149fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 10153b13a1efSThomas Keiser smb_llist_exit(&session->s_tree_list); 10163b13a1efSThomas Keiser return (NULL); 10173b13a1efSThomas Keiser } 10183b13a1efSThomas Keiser 10193b13a1efSThomas Keiser /* 10203b13a1efSThomas Keiser * Disconnect all trees that match the specified client process-id. 1021*8d94f651SGordon Ross * Used by the SMB1 "process exit" request. 10223b13a1efSThomas Keiser */ 10233b13a1efSThomas Keiser void 10243b13a1efSThomas Keiser smb_session_close_pid( 10253b13a1efSThomas Keiser smb_session_t *session, 1026a90cf9f2SGordon Ross uint32_t pid) 10273b13a1efSThomas Keiser { 1028*8d94f651SGordon Ross smb_llist_t *tree_list = &session->s_tree_list; 10293b13a1efSThomas Keiser smb_tree_t *tree; 10303b13a1efSThomas Keiser 1031*8d94f651SGordon Ross smb_llist_enter(tree_list, RW_READER); 10323b13a1efSThomas Keiser 1033*8d94f651SGordon Ross tree = smb_llist_head(tree_list); 10343b13a1efSThomas Keiser while (tree) { 1035*8d94f651SGordon Ross if (smb_tree_hold(tree)) { 1036*8d94f651SGordon Ross smb_tree_close_pid(tree, pid); 1037*8d94f651SGordon Ross smb_tree_release(tree); 1038*8d94f651SGordon Ross } 1039*8d94f651SGordon Ross tree = smb_llist_next(tree_list, tree); 10403b13a1efSThomas Keiser } 1041*8d94f651SGordon Ross 1042*8d94f651SGordon Ross smb_llist_exit(tree_list); 10433b13a1efSThomas Keiser } 10443b13a1efSThomas Keiser 10453b13a1efSThomas Keiser static void 1046*8d94f651SGordon Ross smb_session_tree_dtor(void *arg) 10473b13a1efSThomas Keiser { 1048*8d94f651SGordon Ross smb_tree_t *tree = arg; 10493b13a1efSThomas Keiser 10503b13a1efSThomas Keiser smb_tree_disconnect(tree, B_TRUE); 10513b13a1efSThomas Keiser /* release the ref acquired during the traversal loop */ 10523b13a1efSThomas Keiser smb_tree_release(tree); 10539fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } 10549fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 10553b13a1efSThomas Keiser 10569fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States /* 10573b13a1efSThomas Keiser * Disconnect all trees that this user has connected. 10589fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States */ 10599fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States void 10603b13a1efSThomas Keiser smb_session_disconnect_owned_trees( 10613b13a1efSThomas Keiser smb_session_t *session, 10623b13a1efSThomas Keiser smb_user_t *owner) 10633b13a1efSThomas Keiser { 10643b13a1efSThomas Keiser smb_tree_t *tree; 10653b13a1efSThomas Keiser smb_llist_t *tree_list = &session->s_tree_list; 10663b13a1efSThomas Keiser 10673b13a1efSThomas Keiser SMB_SESSION_VALID(session); 10683b13a1efSThomas Keiser SMB_USER_VALID(owner); 10693b13a1efSThomas Keiser 10703b13a1efSThomas Keiser smb_llist_enter(tree_list, RW_READER); 10713b13a1efSThomas Keiser 10723b13a1efSThomas Keiser tree = smb_llist_head(tree_list); 10733b13a1efSThomas Keiser while (tree) { 10743b13a1efSThomas Keiser if ((tree->t_owner == owner) && 10753b13a1efSThomas Keiser smb_tree_hold(tree)) { 10763b13a1efSThomas Keiser /* 10773b13a1efSThomas Keiser * smb_tree_hold() succeeded, hence we are in state 10783b13a1efSThomas Keiser * SMB_TREE_STATE_CONNECTED; schedule this tree 1079811599a4SMatt Barden * for disconnect after smb_llist_exit because 1080811599a4SMatt Barden * the "unmap exec" up-call can block, and we'd 1081811599a4SMatt Barden * rather not block with the tree list locked. 10823b13a1efSThomas Keiser */ 10833b13a1efSThomas Keiser smb_llist_post(tree_list, tree, smb_session_tree_dtor); 10843b13a1efSThomas Keiser } 10853b13a1efSThomas Keiser tree = smb_llist_next(tree_list, tree); 10863b13a1efSThomas Keiser } 10873b13a1efSThomas Keiser 10883b13a1efSThomas Keiser /* drop the lock and flush the dtor queue */ 10893b13a1efSThomas Keiser smb_llist_exit(tree_list); 10903b13a1efSThomas Keiser } 10913b13a1efSThomas Keiser 10923b13a1efSThomas Keiser /* 10933b13a1efSThomas Keiser * Disconnect all trees that this user has connected. 10943b13a1efSThomas Keiser */ 1095811599a4SMatt Barden static void 10963b13a1efSThomas Keiser smb_session_disconnect_trees( 10973b13a1efSThomas Keiser smb_session_t *session) 10983b13a1efSThomas Keiser { 1099*8d94f651SGordon Ross smb_llist_t *tree_list = &session->s_tree_list; 1100*8d94f651SGordon Ross smb_tree_t *tree; 11013b13a1efSThomas Keiser 1102*8d94f651SGordon Ross smb_llist_enter(tree_list, RW_READER); 11033b13a1efSThomas Keiser 1104*8d94f651SGordon Ross tree = smb_llist_head(tree_list); 11053b13a1efSThomas Keiser while (tree) { 1106*8d94f651SGordon Ross if (smb_tree_hold(tree)) { 1107*8d94f651SGordon Ross smb_llist_post(tree_list, tree, 1108*8d94f651SGordon Ross smb_session_tree_dtor); 1109*8d94f651SGordon Ross } 1110*8d94f651SGordon Ross tree = smb_llist_next(tree_list, tree); 11113b13a1efSThomas Keiser } 1112*8d94f651SGordon Ross 1113*8d94f651SGordon Ross /* drop the lock and flush the dtor queue */ 1114*8d94f651SGordon Ross smb_llist_exit(tree_list); 11153b13a1efSThomas Keiser } 11163b13a1efSThomas Keiser 11173b13a1efSThomas Keiser /* 1118*8d94f651SGordon Ross * Variant of smb_session_tree_dtor that also 1119*8d94f651SGordon Ross * cancels requests using this tree. 11203b13a1efSThomas Keiser */ 1121*8d94f651SGordon Ross static void 1122*8d94f651SGordon Ross smb_session_tree_kill(void *arg) 11233b13a1efSThomas Keiser { 1124*8d94f651SGordon Ross smb_tree_t *tree = arg; 11253b13a1efSThomas Keiser 1126*8d94f651SGordon Ross SMB_TREE_VALID(tree); 11273b13a1efSThomas Keiser 1128*8d94f651SGordon Ross smb_tree_disconnect(tree, B_TRUE); 1129*8d94f651SGordon Ross smb_session_cancel_requests(tree->t_session, tree, NULL); 1130*8d94f651SGordon Ross 1131*8d94f651SGordon Ross /* release the ref acquired during the traversal loop */ 1132*8d94f651SGordon Ross smb_tree_release(tree); 11333b13a1efSThomas Keiser } 11343b13a1efSThomas Keiser 11353b13a1efSThomas Keiser /* 1136*8d94f651SGordon Ross * Disconnect all trees that match the specified share name, 1137*8d94f651SGordon Ross * and kill requests using those trees. 11383b13a1efSThomas Keiser */ 1139*8d94f651SGordon Ross void 1140*8d94f651SGordon Ross smb_session_disconnect_share( 11413b13a1efSThomas Keiser smb_session_t *session, 1142*8d94f651SGordon Ross const char *sharename) 11433b13a1efSThomas Keiser { 1144*8d94f651SGordon Ross smb_llist_t *ll; 1145*8d94f651SGordon Ross smb_tree_t *tree; 11463b13a1efSThomas Keiser 11473b13a1efSThomas Keiser SMB_SESSION_VALID(session); 11483b13a1efSThomas Keiser 1149*8d94f651SGordon Ross ll = &session->s_tree_list; 1150*8d94f651SGordon Ross smb_llist_enter(ll, RW_READER); 11513b13a1efSThomas Keiser 1152*8d94f651SGordon Ross for (tree = smb_llist_head(ll); 1153*8d94f651SGordon Ross tree != NULL; 1154*8d94f651SGordon Ross tree = smb_llist_next(ll, tree)) { 11553b13a1efSThomas Keiser 1156*8d94f651SGordon Ross SMB_TREE_VALID(tree); 1157*8d94f651SGordon Ross ASSERT(tree->t_session == session); 11583b13a1efSThomas Keiser 1159*8d94f651SGordon Ross if (smb_strcasecmp(tree->t_sharename, sharename, 0) != 0) 1160*8d94f651SGordon Ross continue; 1161*8d94f651SGordon Ross 1162*8d94f651SGordon Ross if (smb_tree_hold(tree)) { 1163*8d94f651SGordon Ross smb_llist_post(ll, tree, 1164*8d94f651SGordon Ross smb_session_tree_kill); 1165*8d94f651SGordon Ross } 11663b13a1efSThomas Keiser } 11673b13a1efSThomas Keiser 1168*8d94f651SGordon Ross smb_llist_exit(ll); 11693b13a1efSThomas Keiser } 11703b13a1efSThomas Keiser 11713b13a1efSThomas Keiser /* 11723b13a1efSThomas Keiser * Logoff all users associated with the specified session. 1173811599a4SMatt Barden * 1174811599a4SMatt Barden * This is called for both server-initiated disconnect 1175811599a4SMatt Barden * (SMB_SESSION_STATE_TERMINATED) and client-initiated 1176811599a4SMatt Barden * disconnect (SMB_SESSION_STATE_DISCONNECTED). 1177811599a4SMatt Barden * If client-initiated, save durable handles. 11783b13a1efSThomas Keiser */ 1179*8d94f651SGordon Ross void 11803b13a1efSThomas Keiser smb_session_logoff(smb_session_t *session) 11819fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States { 1182811599a4SMatt Barden smb_llist_t *ulist; 11839fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States smb_user_t *user; 11849fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 11859fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States SMB_SESSION_VALID(session); 11869fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 1187811599a4SMatt Barden top: 1188811599a4SMatt Barden ulist = &session->s_user_list; 1189811599a4SMatt Barden smb_llist_enter(ulist, RW_READER); 11909fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 1191811599a4SMatt Barden user = smb_llist_head(ulist); 11929fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States while (user) { 11939fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States SMB_USER_VALID(user); 11949fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States ASSERT(user->u_session == session); 11959fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 1196811599a4SMatt Barden mutex_enter(&user->u_mutex); 119712b65585SGordon Ross switch (user->u_state) { 119812b65585SGordon Ross case SMB_USER_STATE_LOGGING_ON: 119912b65585SGordon Ross case SMB_USER_STATE_LOGGED_ON: 1200811599a4SMatt Barden // smb_user_hold_internal(user); 1201811599a4SMatt Barden user->u_refcnt++; 1202811599a4SMatt Barden mutex_exit(&user->u_mutex); 12033b13a1efSThomas Keiser smb_user_logoff(user); 12049fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States smb_user_release(user); 120512b65585SGordon Ross break; 120612b65585SGordon Ross 120712b65585SGordon Ross case SMB_USER_STATE_LOGGED_OFF: 120812b65585SGordon Ross case SMB_USER_STATE_LOGGING_OFF: 1209811599a4SMatt Barden mutex_exit(&user->u_mutex); 121012b65585SGordon Ross break; 121112b65585SGordon Ross 121212b65585SGordon Ross default: 121312b65585SGordon Ross ASSERT(0); 1214811599a4SMatt Barden mutex_exit(&user->u_mutex); 121512b65585SGordon Ross break; 12169fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } 12179fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 1218811599a4SMatt Barden user = smb_llist_next(ulist, user); 1219811599a4SMatt Barden } 1220811599a4SMatt Barden 1221811599a4SMatt Barden /* Needed below (Was the list empty?) */ 1222811599a4SMatt Barden user = smb_llist_head(ulist); 1223811599a4SMatt Barden 1224811599a4SMatt Barden smb_llist_exit(ulist); 1225811599a4SMatt Barden 1226811599a4SMatt Barden /* 1227811599a4SMatt Barden * It's possible for user objects to remain due to references 1228811599a4SMatt Barden * obtained via smb_server_lookup_ssnid(), when an SMB2 1229811599a4SMatt Barden * session setup is destroying a previous session. 1230811599a4SMatt Barden * 1231811599a4SMatt Barden * Wait for user objects to clear out (last refs. go away, 1232811599a4SMatt Barden * then smb_user_delete takes them out of the list). When 1233811599a4SMatt Barden * the last user object is removed, the session state is 1234811599a4SMatt Barden * set to SHUTDOWN and s_lock is signaled. 1235811599a4SMatt Barden * 1236811599a4SMatt Barden * Not all places that call smb_user_release necessarily 1237811599a4SMatt Barden * flush the delete queue, so after we wait for the list 1238811599a4SMatt Barden * to empty out, go back to the top and recheck the list 1239811599a4SMatt Barden * delete queue to make sure smb_user_delete happens. 1240811599a4SMatt Barden */ 1241811599a4SMatt Barden if (user == NULL) { 1242811599a4SMatt Barden /* User list is empty. */ 1243811599a4SMatt Barden smb_rwx_rwenter(&session->s_lock, RW_WRITER); 1244811599a4SMatt Barden session->s_state = SMB_SESSION_STATE_SHUTDOWN; 1245811599a4SMatt Barden smb_rwx_rwexit(&session->s_lock); 1246811599a4SMatt Barden } else { 1247811599a4SMatt Barden smb_rwx_rwenter(&session->s_lock, RW_READER); 1248811599a4SMatt Barden if (session->s_state != SMB_SESSION_STATE_SHUTDOWN) { 1249811599a4SMatt Barden (void) smb_rwx_cvwait(&session->s_lock, 1250811599a4SMatt Barden MSEC_TO_TICK(200)); 1251811599a4SMatt Barden smb_rwx_rwexit(&session->s_lock); 1252811599a4SMatt Barden goto top; 1253811599a4SMatt Barden } 1254811599a4SMatt Barden smb_rwx_rwexit(&session->s_lock); 1255811599a4SMatt Barden } 1256811599a4SMatt Barden ASSERT(session->s_state == SMB_SESSION_STATE_SHUTDOWN); 1257811599a4SMatt Barden 1258811599a4SMatt Barden /* 1259811599a4SMatt Barden * User list should be empty now. 1260811599a4SMatt Barden */ 1261811599a4SMatt Barden #ifdef DEBUG 1262811599a4SMatt Barden if (ulist->ll_count != 0) { 1263811599a4SMatt Barden cmn_err(CE_WARN, "user list not empty?"); 1264811599a4SMatt Barden debug_enter("s_user_list"); 12659fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } 1266811599a4SMatt Barden #endif 12679fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 1268811599a4SMatt Barden /* 1269811599a4SMatt Barden * User logoff happens first so we'll set preserve_opens 1270811599a4SMatt Barden * for client-initiated disconnect. When that's done 1271811599a4SMatt Barden * there should be no trees left, but check anyway. 1272811599a4SMatt Barden */ 1273811599a4SMatt Barden smb_session_disconnect_trees(session); 12749fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States } 12759fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States 12761fcced4cSJordan Brown /* 12771fcced4cSJordan Brown * Copy the session workstation/client name to buf. If the workstation 12781fcced4cSJordan Brown * is an empty string (which it will be on TCP connections), use the 12791fcced4cSJordan Brown * client IP address. 12801fcced4cSJordan Brown */ 12811fcced4cSJordan Brown void 12821fcced4cSJordan Brown smb_session_getclient(smb_session_t *sn, char *buf, size_t buflen) 12831fcced4cSJordan Brown { 12841fcced4cSJordan Brown 12851fcced4cSJordan Brown *buf = '\0'; 12861fcced4cSJordan Brown 12871fcced4cSJordan Brown if (sn->workstation[0] != '\0') { 12881fcced4cSJordan Brown (void) strlcpy(buf, sn->workstation, buflen); 12891fcced4cSJordan Brown return; 12901fcced4cSJordan Brown } 12911fcced4cSJordan Brown 129249b5df1eSGordon Ross (void) strlcpy(buf, sn->ip_addr_str, buflen); 12931fcced4cSJordan Brown } 12941fcced4cSJordan Brown 12951fcced4cSJordan Brown /* 12961fcced4cSJordan Brown * Check whether or not the specified client name is the client of this 12971fcced4cSJordan Brown * session. The name may be in UNC format (\\CLIENT). 12981fcced4cSJordan Brown * 12991fcced4cSJordan Brown * A workstation/client name is setup on NBT connections as part of the 13001fcced4cSJordan Brown * NetBIOS session request but that isn't available on TCP connections. 13011fcced4cSJordan Brown * If the session doesn't have a client name we typically return the 13021fcced4cSJordan Brown * client IP address as the workstation name on MSRPC requests. So we 13031fcced4cSJordan Brown * check for the IP address here in addition to the workstation name. 13041fcced4cSJordan Brown */ 13051fcced4cSJordan Brown boolean_t 13061fcced4cSJordan Brown smb_session_isclient(smb_session_t *sn, const char *client) 13071fcced4cSJordan Brown { 13081fcced4cSJordan Brown 13091fcced4cSJordan Brown client += strspn(client, "\\"); 13101fcced4cSJordan Brown 1311bbf6f00cSJordan Brown if (smb_strcasecmp(client, sn->workstation, 0) == 0) 13121fcced4cSJordan Brown return (B_TRUE); 13131fcced4cSJordan Brown 131449b5df1eSGordon Ross if (smb_strcasecmp(client, sn->ip_addr_str, 0) == 0) 13151fcced4cSJordan Brown return (B_TRUE); 13161fcced4cSJordan Brown 13171fcced4cSJordan Brown return (B_FALSE); 13181fcced4cSJordan Brown } 13191fcced4cSJordan Brown 1320faa1795aSjb /* 1321faa1795aSjb * smb_request_alloc 1322faa1795aSjb * 1323faa1795aSjb * Allocate an smb_request_t structure from the kmem_cache. Partially 1324faa1795aSjb * initialize the found/new request. 1325faa1795aSjb * 13269c856e86SMatt Barden * Returns pointer to a request, or NULL if the session state is 13279c856e86SMatt Barden * one in which new requests are no longer allowed. 1328faa1795aSjb */ 1329faa1795aSjb smb_request_t * 1330faa1795aSjb smb_request_alloc(smb_session_t *session, int req_length) 1331faa1795aSjb { 1332faa1795aSjb smb_request_t *sr; 1333faa1795aSjb 1334faa1795aSjb ASSERT(session->s_magic == SMB_SESSION_MAGIC); 1335a90cf9f2SGordon Ross ASSERT(req_length <= session->cmd_max_bytes); 1336faa1795aSjb 13378622ec45SGordon Ross sr = kmem_cache_alloc(smb_cache_request, KM_SLEEP); 1338faa1795aSjb 1339faa1795aSjb /* 1340faa1795aSjb * Future: Use constructor to pre-initialize some fields. For now 1341faa1795aSjb * there are so many fields that it is easiest just to zero the 1342faa1795aSjb * whole thing and start over. 1343faa1795aSjb */ 1344faa1795aSjb bzero(sr, sizeof (smb_request_t)); 1345faa1795aSjb 1346faa1795aSjb mutex_init(&sr->sr_mutex, NULL, MUTEX_DEFAULT, NULL); 1347bbf6f00cSJordan Brown smb_srm_init(sr); 1348faa1795aSjb sr->session = session; 1349faa1795aSjb sr->sr_server = session->s_server; 1350faa1795aSjb sr->sr_gmtoff = session->s_server->si_gmtoff; 1351faa1795aSjb sr->sr_cfg = &session->s_cfg; 1352faa1795aSjb sr->command.max_bytes = req_length; 1353a90cf9f2SGordon Ross sr->reply.max_bytes = session->reply_max_bytes; 1354faa1795aSjb sr->sr_req_length = req_length; 1355faa1795aSjb if (req_length) 1356faa1795aSjb sr->sr_request_buf = kmem_alloc(req_length, KM_SLEEP); 1357faa1795aSjb sr->sr_magic = SMB_REQ_MAGIC; 1358faa1795aSjb sr->sr_state = SMB_REQ_STATE_INITIALIZING; 13599c856e86SMatt Barden 13609c856e86SMatt Barden /* 13619c856e86SMatt Barden * Only allow new SMB requests in some states. 13629c856e86SMatt Barden */ 13639c856e86SMatt Barden smb_rwx_rwenter(&session->s_lock, RW_WRITER); 13649c856e86SMatt Barden switch (session->s_state) { 13659c856e86SMatt Barden case SMB_SESSION_STATE_CONNECTED: 13669c856e86SMatt Barden case SMB_SESSION_STATE_INITIALIZED: 13679c856e86SMatt Barden case SMB_SESSION_STATE_ESTABLISHED: 13689c856e86SMatt Barden case SMB_SESSION_STATE_NEGOTIATED: 13699c856e86SMatt Barden smb_slist_insert_tail(&session->s_req_list, sr); 13709c856e86SMatt Barden break; 13719c856e86SMatt Barden 13729c856e86SMatt Barden default: 13739c856e86SMatt Barden ASSERT(0); 13749c856e86SMatt Barden /* FALLTHROUGH */ 13759c856e86SMatt Barden case SMB_SESSION_STATE_DISCONNECTED: 1376811599a4SMatt Barden case SMB_SESSION_STATE_SHUTDOWN: 13779c856e86SMatt Barden case SMB_SESSION_STATE_TERMINATED: 13789c856e86SMatt Barden /* Disallow new requests in these states. */ 13799c856e86SMatt Barden if (sr->sr_request_buf) 13809c856e86SMatt Barden kmem_free(sr->sr_request_buf, sr->sr_req_length); 13819c856e86SMatt Barden sr->session = NULL; 13829c856e86SMatt Barden sr->sr_magic = 0; 13839c856e86SMatt Barden mutex_destroy(&sr->sr_mutex); 13849c856e86SMatt Barden kmem_cache_free(smb_cache_request, sr); 13859c856e86SMatt Barden sr = NULL; 13869c856e86SMatt Barden break; 13879c856e86SMatt Barden } 13889c856e86SMatt Barden smb_rwx_rwexit(&session->s_lock); 13899c856e86SMatt Barden 1390faa1795aSjb return (sr); 1391faa1795aSjb } 1392faa1795aSjb 1393faa1795aSjb /* 1394faa1795aSjb * smb_request_free 1395faa1795aSjb * 1396faa1795aSjb * release the memories which have been allocated for a smb request. 1397faa1795aSjb */ 1398faa1795aSjb void 1399faa1795aSjb smb_request_free(smb_request_t *sr) 1400faa1795aSjb { 1401faa1795aSjb ASSERT(sr->sr_magic == SMB_REQ_MAGIC); 1402faa1795aSjb ASSERT(sr->session); 1403faa1795aSjb ASSERT(sr->r_xa == NULL); 1404faa1795aSjb 1405cb174861Sjoyce mcintosh if (sr->fid_ofile != NULL) { 14062c2961f8Sjose borrego smb_ofile_release(sr->fid_ofile); 1407cb174861Sjoyce mcintosh } 14082c2961f8Sjose borrego 14092c2961f8Sjose borrego if (sr->tid_tree != NULL) 1410faa1795aSjb smb_tree_release(sr->tid_tree); 1411faa1795aSjb 14122c2961f8Sjose borrego if (sr->uid_user != NULL) 1413faa1795aSjb smb_user_release(sr->uid_user); 1414faa1795aSjb 14151160dcf7SMatt Barden if (sr->tform_ssn != NULL) 14161160dcf7SMatt Barden smb_user_release(sr->tform_ssn); 14171160dcf7SMatt Barden 14188f70e16bSGordon Ross /* 14198f70e16bSGordon Ross * The above may have left work on the delete queues 14208f70e16bSGordon Ross */ 14218f70e16bSGordon Ross smb_llist_flush(&sr->session->s_tree_list); 14228f70e16bSGordon Ross smb_llist_flush(&sr->session->s_user_list); 14238f70e16bSGordon Ross 1424faa1795aSjb smb_slist_remove(&sr->session->s_req_list, sr); 1425faa1795aSjb 1426faa1795aSjb sr->session = NULL; 1427faa1795aSjb 1428bbf6f00cSJordan Brown smb_srm_fini(sr); 1429faa1795aSjb 1430faa1795aSjb if (sr->sr_request_buf) 1431faa1795aSjb kmem_free(sr->sr_request_buf, sr->sr_req_length); 1432faa1795aSjb if (sr->command.chain) 1433faa1795aSjb m_freem(sr->command.chain); 1434faa1795aSjb if (sr->reply.chain) 1435faa1795aSjb m_freem(sr->reply.chain); 1436faa1795aSjb if (sr->raw_data.chain) 1437faa1795aSjb m_freem(sr->raw_data.chain); 1438faa1795aSjb 1439faa1795aSjb sr->sr_magic = 0; 1440faa1795aSjb mutex_destroy(&sr->sr_mutex); 14418622ec45SGordon Ross kmem_cache_free(smb_cache_request, sr); 1442da6c28aaSamw } 14437f667e74Sjose borrego 14442c2961f8Sjose borrego boolean_t 14452c2961f8Sjose borrego smb_session_oplocks_enable(smb_session_t *session) 14462c2961f8Sjose borrego { 14472c2961f8Sjose borrego SMB_SESSION_VALID(session); 14482c2961f8Sjose borrego if (session->s_cfg.skc_oplock_enable == 0) 14492c2961f8Sjose borrego return (B_FALSE); 14502c2961f8Sjose borrego else 14512c2961f8Sjose borrego return (B_TRUE); 14522c2961f8Sjose borrego } 14532c2961f8Sjose borrego 1454cb174861Sjoyce mcintosh boolean_t 1455cb174861Sjoyce mcintosh smb_session_levelII_oplocks(smb_session_t *session) 1456cb174861Sjoyce mcintosh { 1457cb174861Sjoyce mcintosh SMB_SESSION_VALID(session); 1458a90cf9f2SGordon Ross 1459a90cf9f2SGordon Ross /* Older clients only do Level II oplocks if negotiated. */ 1460a90cf9f2SGordon Ross if ((session->capabilities & CAP_LEVEL_II_OPLOCKS) != 0) 1461a90cf9f2SGordon Ross return (B_TRUE); 1462a90cf9f2SGordon Ross 1463a90cf9f2SGordon Ross return (B_FALSE); 1464cb174861Sjoyce mcintosh } 1465cb174861Sjoyce mcintosh 1466f9bc6dadSDmitry.Savitsky@nexenta.com static void 1467f9bc6dadSDmitry.Savitsky@nexenta.com smb_session_genkey(smb_session_t *session) 1468f9bc6dadSDmitry.Savitsky@nexenta.com { 1469f9bc6dadSDmitry.Savitsky@nexenta.com uint8_t tmp_key[SMB_CHALLENGE_SZ]; 1470f9bc6dadSDmitry.Savitsky@nexenta.com 1471f9bc6dadSDmitry.Savitsky@nexenta.com (void) random_get_pseudo_bytes(tmp_key, SMB_CHALLENGE_SZ); 1472f9bc6dadSDmitry.Savitsky@nexenta.com bcopy(tmp_key, &session->challenge_key, SMB_CHALLENGE_SZ); 1473f9bc6dadSDmitry.Savitsky@nexenta.com session->challenge_len = SMB_CHALLENGE_SZ; 1474f9bc6dadSDmitry.Savitsky@nexenta.com 1475f9bc6dadSDmitry.Savitsky@nexenta.com (void) random_get_pseudo_bytes(tmp_key, 4); 1476f9bc6dadSDmitry.Savitsky@nexenta.com session->sesskey = tmp_key[0] | tmp_key[1] << 8 | 1477f9bc6dadSDmitry.Savitsky@nexenta.com tmp_key[2] << 16 | tmp_key[3] << 24; 1478f9bc6dadSDmitry.Savitsky@nexenta.com } 1479