xref: /illumos-gate/usr/src/uts/common/fs/smbsrv/smb_session.c (revision 12b65585e720714b31036daaa2b30eb76014048e)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
24  */
25 
26 #include <sys/atomic.h>
27 #include <sys/synch.h>
28 #include <sys/types.h>
29 #include <sys/sdt.h>
30 #include <sys/random.h>
31 #include <smbsrv/netbios.h>
32 #include <smbsrv/smb_kproto.h>
33 #include <smbsrv/string.h>
34 #include <netinet/tcp.h>
35 
36 #define	SMB_NEW_KID()	atomic_inc_64_nv(&smb_kids)
37 
38 static volatile uint64_t smb_kids;
39 
40 /*
41  * We track the keepalive in minutes, but this constant
42  * specifies it in seconds, so convert to minutes.
43  */
44 uint32_t smb_keep_alive = SMB_PI_KEEP_ALIVE_MIN / 60;
45 
46 static void smb_session_cancel(smb_session_t *);
47 static int smb_session_message(smb_session_t *);
48 static int smb_session_xprt_puthdr(smb_session_t *, smb_xprt_t *,
49     uint8_t *, size_t);
50 static smb_tree_t *smb_session_get_tree(smb_session_t *, smb_tree_t *);
51 static void smb_session_logoff(smb_session_t *);
52 static void smb_request_init_command_mbuf(smb_request_t *sr);
53 static void smb_session_genkey(smb_session_t *);
54 
55 void
56 smb_session_timers(smb_llist_t *ll)
57 {
58 	smb_session_t	*session;
59 
60 	smb_llist_enter(ll, RW_READER);
61 	session = smb_llist_head(ll);
62 	while (session != NULL) {
63 		/*
64 		 * Walk through the table and decrement each keep_alive
65 		 * timer that has not timed out yet. (keepalive > 0)
66 		 */
67 		SMB_SESSION_VALID(session);
68 		if (session->keep_alive &&
69 		    (session->keep_alive != (uint32_t)-1))
70 			session->keep_alive--;
71 		session = smb_llist_next(ll, session);
72 	}
73 	smb_llist_exit(ll);
74 }
75 
76 void
77 smb_session_correct_keep_alive_values(smb_llist_t *ll, uint32_t new_keep_alive)
78 {
79 	smb_session_t		*sn;
80 
81 	/*
82 	 * Caller specifies seconds, but we track in minutes, so
83 	 * convert to minutes (rounded up).
84 	 */
85 	new_keep_alive = (new_keep_alive + 59) / 60;
86 
87 	if (new_keep_alive == smb_keep_alive)
88 		return;
89 	/*
90 	 * keep alive == 0 means do not drop connection if it's idle
91 	 */
92 	smb_keep_alive = (new_keep_alive) ? new_keep_alive : -1;
93 
94 	/*
95 	 * Walk through the table and set each session to the new keep_alive
96 	 * value if they have not already timed out.  Block clock interrupts.
97 	 */
98 	smb_llist_enter(ll, RW_READER);
99 	sn = smb_llist_head(ll);
100 	while (sn != NULL) {
101 		SMB_SESSION_VALID(sn);
102 		if (sn->keep_alive != 0)
103 			sn->keep_alive = new_keep_alive;
104 		sn = smb_llist_next(ll, sn);
105 	}
106 	smb_llist_exit(ll);
107 }
108 
109 /*
110  * Send a session message - supports SMB-over-NBT and SMB-over-TCP.
111  *
112  * The mbuf chain is copied into a contiguous buffer so that the whole
113  * message is submitted to smb_sosend as a single request.  This should
114  * help Ethereal/Wireshark delineate the packets correctly even though
115  * TCP_NODELAY has been set on the socket.
116  *
117  * If an mbuf chain is provided, it will be freed and set to NULL here.
118  */
119 int
120 smb_session_send(smb_session_t *session, uint8_t type, mbuf_chain_t *mbc)
121 {
122 	smb_txreq_t	*txr;
123 	smb_xprt_t	hdr;
124 	int		rc;
125 
126 	switch (session->s_state) {
127 	case SMB_SESSION_STATE_DISCONNECTED:
128 	case SMB_SESSION_STATE_TERMINATED:
129 		if ((mbc != NULL) && (mbc->chain != NULL)) {
130 			m_freem(mbc->chain);
131 			mbc->chain = NULL;
132 			mbc->flags = 0;
133 		}
134 		return (ENOTCONN);
135 	default:
136 		break;
137 	}
138 
139 	txr = smb_net_txr_alloc();
140 
141 	if ((mbc != NULL) && (mbc->chain != NULL)) {
142 		rc = mbc_moveout(mbc, (caddr_t)&txr->tr_buf[NETBIOS_HDR_SZ],
143 		    sizeof (txr->tr_buf) - NETBIOS_HDR_SZ, &txr->tr_len);
144 		if (rc != 0) {
145 			smb_net_txr_free(txr);
146 			return (rc);
147 		}
148 	}
149 
150 	hdr.xh_type = type;
151 	hdr.xh_length = (uint32_t)txr->tr_len;
152 
153 	rc = smb_session_xprt_puthdr(session, &hdr, txr->tr_buf,
154 	    NETBIOS_HDR_SZ);
155 
156 	if (rc != 0) {
157 		smb_net_txr_free(txr);
158 		return (rc);
159 	}
160 	txr->tr_len += NETBIOS_HDR_SZ;
161 	smb_server_add_txb(session->s_server, (int64_t)txr->tr_len);
162 	return (smb_net_txr_send(session->sock, &session->s_txlst, txr));
163 }
164 
165 /*
166  * Read, process and respond to a NetBIOS session request.
167  *
168  * A NetBIOS session must be established for SMB-over-NetBIOS.  Validate
169  * the calling and called name format and save the client NetBIOS name,
170  * which is used when a NetBIOS session is established to check for and
171  * cleanup leftover state from a previous session.
172  *
173  * Session requests are not valid for SMB-over-TCP, which is unfortunate
174  * because without the client name leftover state cannot be cleaned up
175  * if the client is behind a NAT server.
176  */
177 static int
178 smb_session_request(struct smb_session *session)
179 {
180 	int			rc;
181 	char			*calling_name;
182 	char			*called_name;
183 	char 			client_name[NETBIOS_NAME_SZ];
184 	struct mbuf_chain 	mbc;
185 	char 			*names = NULL;
186 	smb_wchar_t		*wbuf = NULL;
187 	smb_xprt_t		hdr;
188 	char *p;
189 	int rc1, rc2;
190 
191 	session->keep_alive = smb_keep_alive;
192 
193 	if ((rc = smb_session_xprt_gethdr(session, &hdr)) != 0)
194 		return (rc);
195 
196 	DTRACE_PROBE2(receive__session__req__xprthdr, struct session *, session,
197 	    smb_xprt_t *, &hdr);
198 
199 	if ((hdr.xh_type != SESSION_REQUEST) ||
200 	    (hdr.xh_length != NETBIOS_SESSION_REQUEST_DATA_LENGTH)) {
201 		DTRACE_PROBE1(receive__session__req__failed,
202 		    struct session *, session);
203 		return (EINVAL);
204 	}
205 
206 	names = kmem_alloc(hdr.xh_length, KM_SLEEP);
207 
208 	if ((rc = smb_sorecv(session->sock, names, hdr.xh_length)) != 0) {
209 		kmem_free(names, hdr.xh_length);
210 		DTRACE_PROBE1(receive__session__req__failed,
211 		    struct session *, session);
212 		return (rc);
213 	}
214 
215 	DTRACE_PROBE3(receive__session__req__data, struct session *, session,
216 	    char *, names, uint32_t, hdr.xh_length);
217 
218 	called_name = &names[0];
219 	calling_name = &names[NETBIOS_ENCODED_NAME_SZ + 2];
220 
221 	rc1 = netbios_name_isvalid(called_name, 0);
222 	rc2 = netbios_name_isvalid(calling_name, client_name);
223 
224 	if (rc1 == 0 || rc2 == 0) {
225 
226 		DTRACE_PROBE3(receive__invalid__session__req,
227 		    struct session *, session, char *, names,
228 		    uint32_t, hdr.xh_length);
229 
230 		kmem_free(names, hdr.xh_length);
231 		MBC_INIT(&mbc, MAX_DATAGRAM_LENGTH);
232 		(void) smb_mbc_encodef(&mbc, "b",
233 		    DATAGRAM_INVALID_SOURCE_NAME_FORMAT);
234 		(void) smb_session_send(session, NEGATIVE_SESSION_RESPONSE,
235 		    &mbc);
236 		return (EINVAL);
237 	}
238 
239 	DTRACE_PROBE3(receive__session__req__calling__decoded,
240 	    struct session *, session,
241 	    char *, calling_name, char *, client_name);
242 
243 	/*
244 	 * The client NetBIOS name is in oem codepage format.
245 	 * We need to convert it to unicode and store it in
246 	 * multi-byte format.  We also need to strip off any
247 	 * spaces added as part of the NetBIOS name encoding.
248 	 */
249 	wbuf = kmem_alloc((SMB_PI_MAX_HOST * sizeof (smb_wchar_t)), KM_SLEEP);
250 	(void) oemtoucs(wbuf, client_name, SMB_PI_MAX_HOST, OEM_CPG_850);
251 	(void) smb_wcstombs(session->workstation, wbuf, SMB_PI_MAX_HOST);
252 	kmem_free(wbuf, (SMB_PI_MAX_HOST * sizeof (smb_wchar_t)));
253 
254 	if ((p = strchr(session->workstation, ' ')) != 0)
255 		*p = '\0';
256 
257 	kmem_free(names, hdr.xh_length);
258 	return (smb_session_send(session, POSITIVE_SESSION_RESPONSE, NULL));
259 }
260 
261 /*
262  * Read 4-byte header from the session socket and build an in-memory
263  * session transport header.  See smb_xprt_t definition for header
264  * format information.
265  *
266  * Direct hosted NetBIOS-less SMB (SMB-over-TCP) uses port 445.  The
267  * first byte of the four-byte header must be 0 and the next three
268  * bytes contain the length of the remaining data.
269  */
270 int
271 smb_session_xprt_gethdr(smb_session_t *session, smb_xprt_t *ret_hdr)
272 {
273 	int		rc;
274 	unsigned char	buf[NETBIOS_HDR_SZ];
275 
276 	if ((rc = smb_sorecv(session->sock, buf, NETBIOS_HDR_SZ)) != 0)
277 		return (rc);
278 
279 	switch (session->s_local_port) {
280 	case IPPORT_NETBIOS_SSN:
281 		ret_hdr->xh_type = buf[0];
282 		ret_hdr->xh_length = (((uint32_t)buf[1] & 1) << 16) |
283 		    ((uint32_t)buf[2] << 8) |
284 		    ((uint32_t)buf[3]);
285 		break;
286 
287 	case IPPORT_SMB:
288 		ret_hdr->xh_type = buf[0];
289 
290 		if (ret_hdr->xh_type != 0) {
291 			cmn_err(CE_WARN, "invalid NBT type (%u) from %s",
292 			    ret_hdr->xh_type, session->ip_addr_str);
293 			return (EPROTO);
294 		}
295 
296 		ret_hdr->xh_length = ((uint32_t)buf[1] << 16) |
297 		    ((uint32_t)buf[2] << 8) |
298 		    ((uint32_t)buf[3]);
299 		break;
300 
301 	default:
302 		cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
303 		return (EPROTO);
304 	}
305 
306 	return (0);
307 }
308 
309 /*
310  * Encode a transport session packet header into a 4-byte buffer.
311  * See smb_xprt_t definition for header format information.
312  */
313 static int
314 smb_session_xprt_puthdr(smb_session_t *session, smb_xprt_t *hdr,
315     uint8_t *buf, size_t buflen)
316 {
317 	if (session == NULL || hdr == NULL ||
318 	    buf == NULL || buflen < NETBIOS_HDR_SZ) {
319 		return (-1);
320 	}
321 
322 	switch (session->s_local_port) {
323 	case IPPORT_NETBIOS_SSN:
324 		buf[0] = hdr->xh_type;
325 		buf[1] = ((hdr->xh_length >> 16) & 1);
326 		buf[2] = (hdr->xh_length >> 8) & 0xff;
327 		buf[3] = hdr->xh_length & 0xff;
328 		break;
329 
330 	case IPPORT_SMB:
331 		buf[0] = hdr->xh_type;
332 		buf[1] = (hdr->xh_length >> 16) & 0xff;
333 		buf[2] = (hdr->xh_length >> 8) & 0xff;
334 		buf[3] = hdr->xh_length & 0xff;
335 		break;
336 
337 	default:
338 		cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
339 		return (-1);
340 	}
341 
342 	return (0);
343 }
344 
345 static void
346 smb_request_init_command_mbuf(smb_request_t *sr)
347 {
348 
349 	/*
350 	 * Setup mbuf using the buffer we allocated.
351 	 */
352 	MBC_ATTACH_BUF(&sr->command, sr->sr_request_buf, sr->sr_req_length);
353 
354 	sr->command.flags = 0;
355 	sr->command.shadow_of = NULL;
356 }
357 
358 /*
359  * smb_request_cancel
360  *
361  * Handle a cancel for a request properly depending on the current request
362  * state.
363  */
364 void
365 smb_request_cancel(smb_request_t *sr)
366 {
367 	mutex_enter(&sr->sr_mutex);
368 	switch (sr->sr_state) {
369 
370 	case SMB_REQ_STATE_INITIALIZING:
371 	case SMB_REQ_STATE_SUBMITTED:
372 	case SMB_REQ_STATE_ACTIVE:
373 	case SMB_REQ_STATE_CLEANED_UP:
374 		sr->sr_state = SMB_REQ_STATE_CANCELED;
375 		break;
376 
377 	case SMB_REQ_STATE_WAITING_LOCK:
378 		/*
379 		 * This request is waiting on a lock.  Wakeup everything
380 		 * waiting on the lock so that the relevant thread regains
381 		 * control and notices that is has been canceled.  The
382 		 * other lock request threads waiting on this lock will go
383 		 * back to sleep when they discover they are still blocked.
384 		 */
385 		sr->sr_state = SMB_REQ_STATE_CANCELED;
386 
387 		ASSERT(sr->sr_awaiting != NULL);
388 		mutex_enter(&sr->sr_awaiting->l_mutex);
389 		cv_broadcast(&sr->sr_awaiting->l_cv);
390 		mutex_exit(&sr->sr_awaiting->l_mutex);
391 		break;
392 
393 	case SMB_REQ_STATE_WAITING_EVENT:
394 		/*
395 		 * This request is waiting in change notify.
396 		 */
397 		sr->sr_state = SMB_REQ_STATE_CANCELED;
398 		cv_signal(&sr->sr_ncr.nc_cv);
399 		break;
400 
401 	case SMB_REQ_STATE_EVENT_OCCURRED:
402 	case SMB_REQ_STATE_COMPLETED:
403 	case SMB_REQ_STATE_CANCELED:
404 		/*
405 		 * No action required for these states since the request
406 		 * is completing.
407 		 */
408 		break;
409 
410 	case SMB_REQ_STATE_FREE:
411 	default:
412 		SMB_PANIC();
413 	}
414 	mutex_exit(&sr->sr_mutex);
415 }
416 
417 /*
418  * smb_session_receiver
419  *
420  * Receives request from the network and dispatches them to a worker.
421  */
422 void
423 smb_session_receiver(smb_session_t *session)
424 {
425 	int	rc = 0;
426 
427 	SMB_SESSION_VALID(session);
428 
429 	session->s_thread = curthread;
430 
431 	if (session->s_local_port == IPPORT_NETBIOS_SSN) {
432 		rc = smb_session_request(session);
433 		if (rc != 0) {
434 			smb_rwx_rwenter(&session->s_lock, RW_WRITER);
435 			session->s_state = SMB_SESSION_STATE_DISCONNECTED;
436 			smb_rwx_rwexit(&session->s_lock);
437 			return;
438 		}
439 	}
440 
441 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
442 	session->s_state = SMB_SESSION_STATE_ESTABLISHED;
443 	smb_rwx_rwexit(&session->s_lock);
444 
445 	(void) smb_session_message(session);
446 
447 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
448 	session->s_state = SMB_SESSION_STATE_DISCONNECTED;
449 	smb_rwx_rwexit(&session->s_lock);
450 
451 	smb_soshutdown(session->sock);
452 
453 	DTRACE_PROBE2(session__drop, struct session *, session, int, rc);
454 
455 	smb_session_cancel(session);
456 	/*
457 	 * At this point everything related to the session should have been
458 	 * cleaned up and we expect that nothing will attempt to use the
459 	 * socket.
460 	 */
461 }
462 
463 /*
464  * smb_session_disconnect
465  *
466  * Disconnects the session passed in.
467  */
468 void
469 smb_session_disconnect(smb_session_t *session)
470 {
471 	SMB_SESSION_VALID(session);
472 
473 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
474 	switch (session->s_state) {
475 	case SMB_SESSION_STATE_INITIALIZED:
476 	case SMB_SESSION_STATE_CONNECTED:
477 	case SMB_SESSION_STATE_ESTABLISHED:
478 	case SMB_SESSION_STATE_NEGOTIATED:
479 	case SMB_SESSION_STATE_OPLOCK_BREAKING:
480 		smb_soshutdown(session->sock);
481 		session->s_state = SMB_SESSION_STATE_DISCONNECTED;
482 		_NOTE(FALLTHRU)
483 	case SMB_SESSION_STATE_DISCONNECTED:
484 	case SMB_SESSION_STATE_TERMINATED:
485 		break;
486 	}
487 	smb_rwx_rwexit(&session->s_lock);
488 }
489 
490 /*
491  * Read and process SMB requests.
492  *
493  * Returns:
494  *	0	Success
495  *	1	Unable to read transport header
496  *	2	Invalid transport header type
497  *	3	Invalid SMB length (too small)
498  *	4	Unable to read SMB header
499  *	5	Invalid SMB header (bad magic number)
500  *	6	Unable to read SMB data
501  */
502 static int
503 smb_session_message(smb_session_t *session)
504 {
505 	smb_server_t	*sv;
506 	smb_request_t	*sr = NULL;
507 	smb_xprt_t	hdr;
508 	uint8_t		*req_buf;
509 	uint32_t	resid;
510 	int		rc;
511 
512 	sv = session->s_server;
513 
514 	for (;;) {
515 
516 		rc = smb_session_xprt_gethdr(session, &hdr);
517 		if (rc)
518 			return (rc);
519 
520 		DTRACE_PROBE2(session__receive__xprthdr, session_t *, session,
521 		    smb_xprt_t *, &hdr);
522 
523 		if (hdr.xh_type != SESSION_MESSAGE) {
524 			/*
525 			 * Anything other than SESSION_MESSAGE or
526 			 * SESSION_KEEP_ALIVE is an error.  A SESSION_REQUEST
527 			 * may indicate a new session request but we need to
528 			 * close this session and we can treat it as an error
529 			 * here.
530 			 */
531 			if (hdr.xh_type == SESSION_KEEP_ALIVE) {
532 				session->keep_alive = smb_keep_alive;
533 				continue;
534 			}
535 			return (EPROTO);
536 		}
537 
538 		if (hdr.xh_length < SMB_HEADER_LEN)
539 			return (EPROTO);
540 
541 		session->keep_alive = smb_keep_alive;
542 		/*
543 		 * Allocate a request context, read the SMB header and validate
544 		 * it. The sr includes a buffer large enough to hold the SMB
545 		 * request payload.  If the header looks valid, read any
546 		 * remaining data.
547 		 */
548 		sr = smb_request_alloc(session, hdr.xh_length);
549 
550 		req_buf = (uint8_t *)sr->sr_request_buf;
551 		resid = hdr.xh_length;
552 
553 		rc = smb_sorecv(session->sock, req_buf, SMB_HEADER_LEN);
554 		if (rc) {
555 			smb_request_free(sr);
556 			return (rc);
557 		}
558 
559 		if (SMB_PROTOCOL_MAGIC_INVALID(sr)) {
560 			smb_request_free(sr);
561 			return (EPROTO);
562 		}
563 
564 		if (resid > SMB_HEADER_LEN) {
565 			req_buf += SMB_HEADER_LEN;
566 			resid -= SMB_HEADER_LEN;
567 
568 			rc = smb_sorecv(session->sock, req_buf, resid);
569 			if (rc) {
570 				smb_request_free(sr);
571 				return (rc);
572 			}
573 		}
574 		smb_server_add_rxb(sv,
575 		    (int64_t)(hdr.xh_length + NETBIOS_HDR_SZ));
576 		/*
577 		 * Initialize command MBC to represent the received data.
578 		 */
579 		smb_request_init_command_mbuf(sr);
580 
581 		DTRACE_PROBE1(session__receive__smb, smb_request_t *, sr);
582 
583 		if (sr->session->signing.flags & SMB_SIGNING_ENABLED) {
584 			if (SMB_IS_NT_CANCEL(sr)) {
585 				sr->session->signing.seqnum++;
586 				sr->sr_seqnum = sr->session->signing.seqnum + 1;
587 				sr->reply_seqnum = 0;
588 			} else {
589 				sr->session->signing.seqnum += 2;
590 				sr->sr_seqnum = sr->session->signing.seqnum;
591 				sr->reply_seqnum = sr->sr_seqnum + 1;
592 			}
593 		}
594 		sr->sr_time_submitted = gethrtime();
595 		sr->sr_state = SMB_REQ_STATE_SUBMITTED;
596 		smb_srqueue_waitq_enter(session->s_srqueue);
597 		(void) taskq_dispatch(session->s_server->sv_worker_pool,
598 		    smb_session_worker, sr, TQ_SLEEP);
599 	}
600 }
601 
602 /*
603  * Port will be IPPORT_NETBIOS_SSN or IPPORT_SMB.
604  */
605 smb_session_t *
606 smb_session_create(ksocket_t new_so, uint16_t port, smb_server_t *sv,
607     int family)
608 {
609 	struct sockaddr_in	sin;
610 	socklen_t		slen;
611 	struct sockaddr_in6	sin6;
612 	smb_session_t		*session;
613 	int64_t			now;
614 
615 	session = kmem_cache_alloc(smb_cache_session, KM_SLEEP);
616 	bzero(session, sizeof (smb_session_t));
617 
618 	if (smb_idpool_constructor(&session->s_uid_pool)) {
619 		kmem_cache_free(smb_cache_session, session);
620 		return (NULL);
621 	}
622 	if (smb_idpool_constructor(&session->s_tid_pool)) {
623 		smb_idpool_destructor(&session->s_uid_pool);
624 		kmem_cache_free(smb_cache_session, session);
625 		return (NULL);
626 	}
627 
628 	now = ddi_get_lbolt64();
629 
630 	session->s_kid = SMB_NEW_KID();
631 	session->s_state = SMB_SESSION_STATE_INITIALIZED;
632 	session->native_os = NATIVE_OS_UNKNOWN;
633 	session->opentime = now;
634 	session->keep_alive = smb_keep_alive;
635 	session->activity_timestamp = now;
636 
637 	smb_session_genkey(session);
638 
639 	smb_slist_constructor(&session->s_req_list, sizeof (smb_request_t),
640 	    offsetof(smb_request_t, sr_session_lnd));
641 
642 	smb_llist_constructor(&session->s_user_list, sizeof (smb_user_t),
643 	    offsetof(smb_user_t, u_lnd));
644 
645 	smb_llist_constructor(&session->s_tree_list, sizeof (smb_tree_t),
646 	    offsetof(smb_tree_t, t_lnd));
647 
648 	smb_llist_constructor(&session->s_xa_list, sizeof (smb_xa_t),
649 	    offsetof(smb_xa_t, xa_lnd));
650 
651 	smb_net_txl_constructor(&session->s_txlst);
652 
653 	smb_rwx_init(&session->s_lock);
654 
655 	if (new_so != NULL) {
656 		if (family == AF_INET) {
657 			slen = sizeof (sin);
658 			(void) ksocket_getsockname(new_so,
659 			    (struct sockaddr *)&sin, &slen, CRED());
660 			bcopy(&sin.sin_addr,
661 			    &session->local_ipaddr.au_addr.au_ipv4,
662 			    sizeof (in_addr_t));
663 			slen = sizeof (sin);
664 			(void) ksocket_getpeername(new_so,
665 			    (struct sockaddr *)&sin, &slen, CRED());
666 			bcopy(&sin.sin_addr,
667 			    &session->ipaddr.au_addr.au_ipv4,
668 			    sizeof (in_addr_t));
669 		} else {
670 			slen = sizeof (sin6);
671 			(void) ksocket_getsockname(new_so,
672 			    (struct sockaddr *)&sin6, &slen, CRED());
673 			bcopy(&sin6.sin6_addr,
674 			    &session->local_ipaddr.au_addr.au_ipv6,
675 			    sizeof (in6_addr_t));
676 			slen = sizeof (sin6);
677 			(void) ksocket_getpeername(new_so,
678 			    (struct sockaddr *)&sin6, &slen, CRED());
679 			bcopy(&sin6.sin6_addr,
680 			    &session->ipaddr.au_addr.au_ipv6,
681 			    sizeof (in6_addr_t));
682 		}
683 		session->ipaddr.a_family = family;
684 		session->local_ipaddr.a_family = family;
685 		session->s_local_port = port;
686 		session->sock = new_so;
687 		(void) smb_inet_ntop(&session->ipaddr,
688 		    session->ip_addr_str, INET6_ADDRSTRLEN);
689 		if (port == IPPORT_NETBIOS_SSN)
690 			smb_server_inc_nbt_sess(sv);
691 		else
692 			smb_server_inc_tcp_sess(sv);
693 	}
694 	session->s_server = sv;
695 	smb_server_get_cfg(sv, &session->s_cfg);
696 	session->s_srqueue = &sv->sv_srqueue;
697 
698 	session->s_magic = SMB_SESSION_MAGIC;
699 	return (session);
700 }
701 
702 void
703 smb_session_delete(smb_session_t *session)
704 {
705 
706 	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
707 
708 	if (session->sign_fini != NULL)
709 		session->sign_fini(session);
710 
711 	if (session->signing.mackey != NULL) {
712 		kmem_free(session->signing.mackey,
713 		    session->signing.mackey_len);
714 	}
715 
716 	session->s_magic = 0;
717 
718 	smb_rwx_destroy(&session->s_lock);
719 	smb_net_txl_destructor(&session->s_txlst);
720 
721 	smb_slist_destructor(&session->s_req_list);
722 	smb_llist_destructor(&session->s_tree_list);
723 	smb_llist_destructor(&session->s_user_list);
724 	smb_llist_destructor(&session->s_xa_list);
725 
726 	ASSERT(session->s_tree_cnt == 0);
727 	ASSERT(session->s_file_cnt == 0);
728 	ASSERT(session->s_dir_cnt == 0);
729 
730 	smb_idpool_destructor(&session->s_tid_pool);
731 	smb_idpool_destructor(&session->s_uid_pool);
732 	if (session->sock != NULL) {
733 		if (session->s_local_port == IPPORT_NETBIOS_SSN)
734 			smb_server_dec_nbt_sess(session->s_server);
735 		else
736 			smb_server_dec_tcp_sess(session->s_server);
737 		smb_sodestroy(session->sock);
738 	}
739 	kmem_cache_free(smb_cache_session, session);
740 }
741 
742 static void
743 smb_session_cancel(smb_session_t *session)
744 {
745 	smb_xa_t	*xa, *nextxa;
746 
747 	/* All the request currently being treated must be canceled. */
748 	smb_session_cancel_requests(session, NULL, NULL);
749 
750 	/*
751 	 * We wait for the completion of all the requests associated with
752 	 * this session.
753 	 */
754 	smb_slist_wait_for_empty(&session->s_req_list);
755 
756 	/*
757 	 * At this point the reference count of the users, trees, files,
758 	 * directories should be zero. It should be possible to destroy them
759 	 * without any problem.
760 	 */
761 	xa = smb_llist_head(&session->s_xa_list);
762 	while (xa) {
763 		nextxa = smb_llist_next(&session->s_xa_list, xa);
764 		smb_xa_close(xa);
765 		xa = nextxa;
766 	}
767 
768 	smb_session_logoff(session);
769 }
770 
771 /*
772  * Cancel requests.  If a non-null tree is specified, only requests specific
773  * to that tree will be cancelled.  If a non-null sr is specified, that sr
774  * will be not be cancelled - this would typically be the caller's sr.
775  */
776 void
777 smb_session_cancel_requests(
778     smb_session_t	*session,
779     smb_tree_t		*tree,
780     smb_request_t	*exclude_sr)
781 {
782 	smb_request_t	*sr;
783 
784 	smb_slist_enter(&session->s_req_list);
785 	sr = smb_slist_head(&session->s_req_list);
786 
787 	while (sr) {
788 		ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
789 		if ((sr != exclude_sr) &&
790 		    (tree == NULL || sr->tid_tree == tree))
791 			smb_request_cancel(sr);
792 
793 		sr = smb_slist_next(&session->s_req_list, sr);
794 	}
795 
796 	smb_slist_exit(&session->s_req_list);
797 }
798 
799 void
800 smb_session_worker(void	*arg)
801 {
802 	smb_request_t	*sr;
803 	smb_srqueue_t	*srq;
804 
805 	sr = (smb_request_t *)arg;
806 	SMB_REQ_VALID(sr);
807 
808 	srq = sr->session->s_srqueue;
809 	smb_srqueue_waitq_to_runq(srq);
810 	sr->sr_worker = curthread;
811 	mutex_enter(&sr->sr_mutex);
812 	sr->sr_time_active = gethrtime();
813 	switch (sr->sr_state) {
814 	case SMB_REQ_STATE_SUBMITTED:
815 		mutex_exit(&sr->sr_mutex);
816 		if (smb_dispatch_request(sr)) {
817 			mutex_enter(&sr->sr_mutex);
818 			sr->sr_state = SMB_REQ_STATE_COMPLETED;
819 			mutex_exit(&sr->sr_mutex);
820 			smb_request_free(sr);
821 		}
822 		break;
823 
824 	default:
825 		ASSERT(sr->sr_state == SMB_REQ_STATE_CANCELED);
826 		sr->sr_state = SMB_REQ_STATE_COMPLETED;
827 		mutex_exit(&sr->sr_mutex);
828 		smb_request_free(sr);
829 		break;
830 	}
831 	smb_srqueue_runq_exit(srq);
832 }
833 
834 /*
835  * Find a user on the specified session by SMB UID.
836  */
837 smb_user_t *
838 smb_session_lookup_uid(smb_session_t *session, uint16_t uid)
839 {
840 	return (smb_session_lookup_uid_st(session, uid,
841 	    SMB_USER_STATE_LOGGED_ON));
842 }
843 
844 smb_user_t *
845 smb_session_lookup_uid_st(smb_session_t *session, uint16_t uid,
846     smb_user_state_t st)
847 {
848 	smb_user_t	*user;
849 	smb_llist_t	*user_list;
850 
851 	SMB_SESSION_VALID(session);
852 
853 	user_list = &session->s_user_list;
854 	smb_llist_enter(user_list, RW_READER);
855 
856 	user = smb_llist_head(user_list);
857 	while (user) {
858 		SMB_USER_VALID(user);
859 		ASSERT(user->u_session == session);
860 
861 		if (user->u_uid == uid && user->u_state == st) {
862 			smb_user_hold_internal(user);
863 			break;
864 		}
865 
866 		user = smb_llist_next(user_list, user);
867 	}
868 
869 	smb_llist_exit(user_list);
870 	return (user);
871 }
872 
873 void
874 smb_session_post_user(smb_session_t *session, smb_user_t *user)
875 {
876 	SMB_USER_VALID(user);
877 	ASSERT(user->u_refcnt == 0);
878 	ASSERT(user->u_state == SMB_USER_STATE_LOGGED_OFF);
879 	ASSERT(user->u_session == session);
880 
881 	smb_llist_post(&session->s_user_list, user, smb_user_delete);
882 }
883 
884 /*
885  * Find a tree by tree-id.
886  */
887 smb_tree_t *
888 smb_session_lookup_tree(
889     smb_session_t	*session,
890     uint16_t		tid)
891 
892 {
893 	smb_tree_t	*tree;
894 
895 	SMB_SESSION_VALID(session);
896 
897 	smb_llist_enter(&session->s_tree_list, RW_READER);
898 	tree = smb_llist_head(&session->s_tree_list);
899 
900 	while (tree) {
901 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
902 		ASSERT(tree->t_session == session);
903 
904 		if (tree->t_tid == tid) {
905 			if (smb_tree_hold(tree)) {
906 				smb_llist_exit(&session->s_tree_list);
907 				return (tree);
908 			} else {
909 				smb_llist_exit(&session->s_tree_list);
910 				return (NULL);
911 			}
912 		}
913 
914 		tree = smb_llist_next(&session->s_tree_list, tree);
915 	}
916 
917 	smb_llist_exit(&session->s_tree_list);
918 	return (NULL);
919 }
920 
921 /*
922  * Find the first connected tree that matches the specified sharename.
923  * If the specified tree is NULL the search starts from the beginning of
924  * the user's tree list.  If a tree is provided the search starts just
925  * after that tree.
926  */
927 smb_tree_t *
928 smb_session_lookup_share(
929     smb_session_t	*session,
930     const char		*sharename,
931     smb_tree_t		*tree)
932 {
933 	SMB_SESSION_VALID(session);
934 	ASSERT(sharename);
935 
936 	smb_llist_enter(&session->s_tree_list, RW_READER);
937 
938 	if (tree) {
939 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
940 		ASSERT(tree->t_session == session);
941 		tree = smb_llist_next(&session->s_tree_list, tree);
942 	} else {
943 		tree = smb_llist_head(&session->s_tree_list);
944 	}
945 
946 	while (tree) {
947 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
948 		ASSERT(tree->t_session == session);
949 		if (smb_strcasecmp(tree->t_sharename, sharename, 0) == 0) {
950 			if (smb_tree_hold(tree)) {
951 				smb_llist_exit(&session->s_tree_list);
952 				return (tree);
953 			}
954 		}
955 		tree = smb_llist_next(&session->s_tree_list, tree);
956 	}
957 
958 	smb_llist_exit(&session->s_tree_list);
959 	return (NULL);
960 }
961 
962 /*
963  * Find the first connected tree that matches the specified volume name.
964  * If the specified tree is NULL the search starts from the beginning of
965  * the user's tree list.  If a tree is provided the search starts just
966  * after that tree.
967  */
968 smb_tree_t *
969 smb_session_lookup_volume(
970     smb_session_t	*session,
971     const char		*name,
972     smb_tree_t		*tree)
973 {
974 	SMB_SESSION_VALID(session);
975 	ASSERT(name);
976 
977 	smb_llist_enter(&session->s_tree_list, RW_READER);
978 
979 	if (tree) {
980 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
981 		ASSERT(tree->t_session == session);
982 		tree = smb_llist_next(&session->s_tree_list, tree);
983 	} else {
984 		tree = smb_llist_head(&session->s_tree_list);
985 	}
986 
987 	while (tree) {
988 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
989 		ASSERT(tree->t_session == session);
990 
991 		if (smb_strcasecmp(tree->t_volume, name, 0) == 0) {
992 			if (smb_tree_hold(tree)) {
993 				smb_llist_exit(&session->s_tree_list);
994 				return (tree);
995 			}
996 		}
997 
998 		tree = smb_llist_next(&session->s_tree_list, tree);
999 	}
1000 
1001 	smb_llist_exit(&session->s_tree_list);
1002 	return (NULL);
1003 }
1004 
1005 /*
1006  * Disconnect all trees that match the specified client process-id.
1007  */
1008 void
1009 smb_session_close_pid(
1010     smb_session_t	*session,
1011     uint16_t		pid)
1012 {
1013 	smb_tree_t	*tree;
1014 
1015 	SMB_SESSION_VALID(session);
1016 
1017 	tree = smb_session_get_tree(session, NULL);
1018 	while (tree) {
1019 		smb_tree_t *next;
1020 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1021 		ASSERT(tree->t_session == session);
1022 		smb_tree_close_pid(tree, pid);
1023 		next = smb_session_get_tree(session, tree);
1024 		smb_tree_release(tree);
1025 		tree = next;
1026 	}
1027 }
1028 
1029 static void
1030 smb_session_tree_dtor(void *t)
1031 {
1032 	smb_tree_t	*tree = (smb_tree_t *)t;
1033 
1034 	smb_tree_disconnect(tree, B_TRUE);
1035 	/* release the ref acquired during the traversal loop */
1036 	smb_tree_release(tree);
1037 }
1038 
1039 
1040 /*
1041  * Disconnect all trees that this user has connected.
1042  */
1043 void
1044 smb_session_disconnect_owned_trees(
1045     smb_session_t	*session,
1046     smb_user_t		*owner)
1047 {
1048 	smb_tree_t	*tree;
1049 	smb_llist_t	*tree_list = &session->s_tree_list;
1050 
1051 	SMB_SESSION_VALID(session);
1052 	SMB_USER_VALID(owner);
1053 
1054 	smb_llist_enter(tree_list, RW_READER);
1055 
1056 	tree = smb_llist_head(tree_list);
1057 	while (tree) {
1058 		if ((tree->t_owner == owner) &&
1059 		    smb_tree_hold(tree)) {
1060 			/*
1061 			 * smb_tree_hold() succeeded, hence we are in state
1062 			 * SMB_TREE_STATE_CONNECTED; schedule this tree
1063 			 * for asynchronous disconnect, which will fire
1064 			 * after we drop the llist traversal lock.
1065 			 */
1066 			smb_llist_post(tree_list, tree, smb_session_tree_dtor);
1067 		}
1068 		tree = smb_llist_next(tree_list, tree);
1069 	}
1070 
1071 	/* drop the lock and flush the dtor queue */
1072 	smb_llist_exit(tree_list);
1073 }
1074 
1075 /*
1076  * Disconnect all trees that this user has connected.
1077  */
1078 void
1079 smb_session_disconnect_trees(
1080     smb_session_t	*session)
1081 {
1082 	smb_tree_t	*tree;
1083 
1084 	SMB_SESSION_VALID(session);
1085 
1086 	tree = smb_session_get_tree(session, NULL);
1087 	while (tree) {
1088 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1089 		ASSERT(tree->t_session == session);
1090 		smb_tree_disconnect(tree, B_TRUE);
1091 		smb_tree_release(tree);
1092 		tree = smb_session_get_tree(session, NULL);
1093 	}
1094 }
1095 
1096 /*
1097  * Disconnect all trees that match the specified share name.
1098  */
1099 void
1100 smb_session_disconnect_share(
1101     smb_session_t	*session,
1102     const char		*sharename)
1103 {
1104 	smb_tree_t	*tree;
1105 	smb_tree_t	*next;
1106 
1107 	SMB_SESSION_VALID(session);
1108 
1109 	tree = smb_session_lookup_share(session, sharename, NULL);
1110 	while (tree) {
1111 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1112 		ASSERT(tree->t_session == session);
1113 		smb_session_cancel_requests(session, tree, NULL);
1114 		smb_tree_disconnect(tree, B_TRUE);
1115 		next = smb_session_lookup_share(session, sharename, tree);
1116 		smb_tree_release(tree);
1117 		tree = next;
1118 	}
1119 }
1120 
1121 void
1122 smb_session_post_tree(smb_session_t *session, smb_tree_t *tree)
1123 {
1124 	SMB_SESSION_VALID(session);
1125 	SMB_TREE_VALID(tree);
1126 	ASSERT0(tree->t_refcnt);
1127 	ASSERT(tree->t_state == SMB_TREE_STATE_DISCONNECTED);
1128 	ASSERT(tree->t_session == session);
1129 
1130 	smb_llist_post(&session->s_tree_list, tree, smb_tree_dealloc);
1131 }
1132 
1133 /*
1134  * Get the next connected tree in the list.  A reference is taken on
1135  * the tree, which can be released later with smb_tree_release().
1136  *
1137  * If the specified tree is NULL the search starts from the beginning of
1138  * the tree list.  If a tree is provided the search starts just after
1139  * that tree.
1140  *
1141  * Returns NULL if there are no connected trees in the list.
1142  */
1143 static smb_tree_t *
1144 smb_session_get_tree(
1145     smb_session_t	*session,
1146     smb_tree_t		*tree)
1147 {
1148 	smb_llist_t	*tree_list;
1149 
1150 	SMB_SESSION_VALID(session);
1151 	tree_list = &session->s_tree_list;
1152 
1153 	smb_llist_enter(tree_list, RW_READER);
1154 
1155 	if (tree) {
1156 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1157 		tree = smb_llist_next(tree_list, tree);
1158 	} else {
1159 		tree = smb_llist_head(tree_list);
1160 	}
1161 
1162 	while (tree) {
1163 		if (smb_tree_hold(tree))
1164 			break;
1165 
1166 		tree = smb_llist_next(tree_list, tree);
1167 	}
1168 
1169 	smb_llist_exit(tree_list);
1170 	return (tree);
1171 }
1172 
1173 /*
1174  * Logoff all users associated with the specified session.
1175  */
1176 static void
1177 smb_session_logoff(smb_session_t *session)
1178 {
1179 	smb_user_t	*user;
1180 
1181 	SMB_SESSION_VALID(session);
1182 
1183 	smb_session_disconnect_trees(session);
1184 
1185 	smb_llist_enter(&session->s_user_list, RW_READER);
1186 
1187 	user = smb_llist_head(&session->s_user_list);
1188 	while (user) {
1189 		SMB_USER_VALID(user);
1190 		ASSERT(user->u_session == session);
1191 
1192 		switch (user->u_state) {
1193 		case SMB_USER_STATE_LOGGING_ON:
1194 		case SMB_USER_STATE_LOGGED_ON:
1195 			smb_user_hold_internal(user);
1196 			smb_user_logoff(user);
1197 			smb_user_release(user);
1198 			break;
1199 
1200 		case SMB_USER_STATE_LOGGED_OFF:
1201 		case SMB_USER_STATE_LOGGING_OFF:
1202 			break;
1203 
1204 		default:
1205 			ASSERT(0);
1206 			break;
1207 		}
1208 
1209 		user = smb_llist_next(&session->s_user_list, user);
1210 	}
1211 
1212 	smb_llist_exit(&session->s_user_list);
1213 }
1214 
1215 /*
1216  * Copy the session workstation/client name to buf.  If the workstation
1217  * is an empty string (which it will be on TCP connections), use the
1218  * client IP address.
1219  */
1220 void
1221 smb_session_getclient(smb_session_t *sn, char *buf, size_t buflen)
1222 {
1223 
1224 	*buf = '\0';
1225 
1226 	if (sn->workstation[0] != '\0') {
1227 		(void) strlcpy(buf, sn->workstation, buflen);
1228 		return;
1229 	}
1230 
1231 	(void) strlcpy(buf, sn->ip_addr_str, buflen);
1232 }
1233 
1234 /*
1235  * Check whether or not the specified client name is the client of this
1236  * session.  The name may be in UNC format (\\CLIENT).
1237  *
1238  * A workstation/client name is setup on NBT connections as part of the
1239  * NetBIOS session request but that isn't available on TCP connections.
1240  * If the session doesn't have a client name we typically return the
1241  * client IP address as the workstation name on MSRPC requests.  So we
1242  * check for the IP address here in addition to the workstation name.
1243  */
1244 boolean_t
1245 smb_session_isclient(smb_session_t *sn, const char *client)
1246 {
1247 
1248 	client += strspn(client, "\\");
1249 
1250 	if (smb_strcasecmp(client, sn->workstation, 0) == 0)
1251 		return (B_TRUE);
1252 
1253 	if (smb_strcasecmp(client, sn->ip_addr_str, 0) == 0)
1254 		return (B_TRUE);
1255 
1256 	return (B_FALSE);
1257 }
1258 
1259 /*
1260  * smb_request_alloc
1261  *
1262  * Allocate an smb_request_t structure from the kmem_cache.  Partially
1263  * initialize the found/new request.
1264  *
1265  * Returns pointer to a request
1266  */
1267 smb_request_t *
1268 smb_request_alloc(smb_session_t *session, int req_length)
1269 {
1270 	smb_request_t	*sr;
1271 
1272 	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
1273 
1274 	sr = kmem_cache_alloc(smb_cache_request, KM_SLEEP);
1275 
1276 	/*
1277 	 * Future:  Use constructor to pre-initialize some fields.  For now
1278 	 * there are so many fields that it is easiest just to zero the
1279 	 * whole thing and start over.
1280 	 */
1281 	bzero(sr, sizeof (smb_request_t));
1282 
1283 	mutex_init(&sr->sr_mutex, NULL, MUTEX_DEFAULT, NULL);
1284 	cv_init(&sr->sr_ncr.nc_cv, NULL, CV_DEFAULT, NULL);
1285 	smb_srm_init(sr);
1286 	sr->session = session;
1287 	sr->sr_server = session->s_server;
1288 	sr->sr_gmtoff = session->s_server->si_gmtoff;
1289 	sr->sr_cfg = &session->s_cfg;
1290 	sr->command.max_bytes = req_length;
1291 	sr->reply.max_bytes = smb_maxbufsize;
1292 	sr->sr_req_length = req_length;
1293 	if (req_length)
1294 		sr->sr_request_buf = kmem_alloc(req_length, KM_SLEEP);
1295 	sr->sr_magic = SMB_REQ_MAGIC;
1296 	sr->sr_state = SMB_REQ_STATE_INITIALIZING;
1297 	smb_slist_insert_tail(&session->s_req_list, sr);
1298 	return (sr);
1299 }
1300 
1301 /*
1302  * smb_request_free
1303  *
1304  * release the memories which have been allocated for a smb request.
1305  */
1306 void
1307 smb_request_free(smb_request_t *sr)
1308 {
1309 	ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
1310 	ASSERT(sr->session);
1311 	ASSERT(sr->r_xa == NULL);
1312 	ASSERT(sr->sr_ncr.nc_fname == NULL);
1313 
1314 	if (sr->fid_ofile != NULL) {
1315 		smb_ofile_request_complete(sr->fid_ofile);
1316 		smb_ofile_release(sr->fid_ofile);
1317 	}
1318 
1319 	if (sr->tid_tree != NULL)
1320 		smb_tree_release(sr->tid_tree);
1321 
1322 	if (sr->uid_user != NULL)
1323 		smb_user_release(sr->uid_user);
1324 
1325 	smb_slist_remove(&sr->session->s_req_list, sr);
1326 
1327 	sr->session = NULL;
1328 
1329 	smb_srm_fini(sr);
1330 
1331 	if (sr->sr_request_buf)
1332 		kmem_free(sr->sr_request_buf, sr->sr_req_length);
1333 	if (sr->command.chain)
1334 		m_freem(sr->command.chain);
1335 	if (sr->reply.chain)
1336 		m_freem(sr->reply.chain);
1337 	if (sr->raw_data.chain)
1338 		m_freem(sr->raw_data.chain);
1339 
1340 	sr->sr_magic = 0;
1341 	cv_destroy(&sr->sr_ncr.nc_cv);
1342 	mutex_destroy(&sr->sr_mutex);
1343 	kmem_cache_free(smb_cache_request, sr);
1344 }
1345 
1346 boolean_t
1347 smb_session_oplocks_enable(smb_session_t *session)
1348 {
1349 	SMB_SESSION_VALID(session);
1350 	if (session->s_cfg.skc_oplock_enable == 0)
1351 		return (B_FALSE);
1352 	else
1353 		return (B_TRUE);
1354 }
1355 
1356 boolean_t
1357 smb_session_levelII_oplocks(smb_session_t *session)
1358 {
1359 	SMB_SESSION_VALID(session);
1360 	return (session->capabilities & CAP_LEVEL_II_OPLOCKS);
1361 }
1362 
1363 /*
1364  * smb_session_oplock_break
1365  *
1366  * The session lock must NOT be held by the caller of this thread;
1367  * as this would cause a deadlock.
1368  */
1369 void
1370 smb_session_oplock_break(smb_session_t *session,
1371     uint16_t tid, uint16_t fid, uint8_t brk)
1372 {
1373 	mbuf_chain_t	*mbc;
1374 
1375 	SMB_SESSION_VALID(session);
1376 
1377 	mbc = smb_mbc_alloc(MLEN);
1378 
1379 	(void) smb_mbc_encodef(mbc, "Mb19.wwwwbb3.wbb10.",
1380 	    SMB_COM_LOCKING_ANDX,
1381 	    tid,
1382 	    0xFFFF, 0, 0xFFFF, 8, 0xFF,
1383 	    fid,
1384 	    LOCKING_ANDX_OPLOCK_RELEASE,
1385 	    (brk == SMB_OPLOCK_BREAK_TO_LEVEL_II) ? 1 : 0);
1386 
1387 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
1388 	switch (session->s_state) {
1389 	case SMB_SESSION_STATE_NEGOTIATED:
1390 	case SMB_SESSION_STATE_OPLOCK_BREAKING:
1391 		session->s_state = SMB_SESSION_STATE_OPLOCK_BREAKING;
1392 		(void) smb_session_send(session, 0, mbc);
1393 		smb_mbc_free(mbc);
1394 		break;
1395 
1396 	case SMB_SESSION_STATE_DISCONNECTED:
1397 	case SMB_SESSION_STATE_TERMINATED:
1398 		smb_mbc_free(mbc);
1399 		break;
1400 
1401 	default:
1402 		SMB_PANIC();
1403 	}
1404 	smb_rwx_rwexit(&session->s_lock);
1405 }
1406 
1407 static void
1408 smb_session_genkey(smb_session_t *session)
1409 {
1410 	uint8_t		tmp_key[SMB_CHALLENGE_SZ];
1411 
1412 	(void) random_get_pseudo_bytes(tmp_key, SMB_CHALLENGE_SZ);
1413 	bcopy(tmp_key, &session->challenge_key, SMB_CHALLENGE_SZ);
1414 	session->challenge_len = SMB_CHALLENGE_SZ;
1415 
1416 	(void) random_get_pseudo_bytes(tmp_key, 4);
1417 	session->sesskey = tmp_key[0] | tmp_key[1] << 8 |
1418 	    tmp_key[2] << 16 | tmp_key[3] << 24;
1419 }
1420