smb_session.c revision 93bc28dbaee6387120d48b12b3dc1ba5f7418e6e
1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21/*
22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
24 */
25
26#include <sys/atomic.h>
27#include <sys/synch.h>
28#include <sys/types.h>
29#include <sys/sdt.h>
30#include <sys/random.h>
31#include <smbsrv/netbios.h>
32#include <smbsrv/smb2_kproto.h>
33#include <smbsrv/string.h>
34#include <netinet/tcp.h>
35
36/* How many iovec we'll handle as a local array (no allocation) */
37#define	SMB_LOCAL_IOV_MAX	16
38
39#define	SMB_NEW_KID()	atomic_inc_64_nv(&smb_kids)
40
41static volatile uint64_t smb_kids;
42
43/*
44 * We track the keepalive in minutes, but this constant
45 * specifies it in seconds, so convert to minutes.
46 */
47uint32_t smb_keep_alive = SMB_PI_KEEP_ALIVE_MIN / 60;
48
49/*
50 * There are many smbtorture test cases that send
51 * racing requests, and where the tests fail if we
52 * don't execute them in exactly the order sent.
53 * These are test bugs.  The protocol makes no
54 * guarantees about execution order of requests
55 * that are concurrently active.
56 *
57 * Nonetheless, smbtorture has many useful tests,
58 * so we have this work-around we can enable to
59 * basically force sequential execution.  When
60 * enabled, insert a delay after each request is
61 * issued a taskq job.  Enable this with mdb by
62 * setting smb_reader_delay to 10.  Don't make it
63 * more than 500 or so or the server will appear
64 * to be so slow that tests may time out.
65 */
66int smb_reader_delay = 0;  /* mSec. */
67
68static int  smbsr_newrq_initial(smb_request_t *);
69
70static void smb_session_cancel(smb_session_t *);
71static int smb_session_reader(smb_session_t *);
72static int smb_session_xprt_puthdr(smb_session_t *,
73    uint8_t msg_type, uint32_t msg_len,
74    uint8_t *dst, size_t dstlen);
75static smb_tree_t *smb_session_get_tree(smb_session_t *, smb_tree_t *);
76static void smb_session_logoff(smb_session_t *);
77static void smb_request_init_command_mbuf(smb_request_t *sr);
78static void smb_session_genkey(smb_session_t *);
79
80void
81smb_session_timers(smb_llist_t *ll)
82{
83	smb_session_t	*session;
84
85	smb_llist_enter(ll, RW_READER);
86	session = smb_llist_head(ll);
87	while (session != NULL) {
88		/*
89		 * Walk through the table and decrement each keep_alive
90		 * timer that has not timed out yet. (keepalive > 0)
91		 */
92		SMB_SESSION_VALID(session);
93		if (session->keep_alive &&
94		    (session->keep_alive != (uint32_t)-1))
95			session->keep_alive--;
96		session = smb_llist_next(ll, session);
97	}
98	smb_llist_exit(ll);
99}
100
101void
102smb_session_correct_keep_alive_values(smb_llist_t *ll, uint32_t new_keep_alive)
103{
104	smb_session_t		*sn;
105
106	/*
107	 * Caller specifies seconds, but we track in minutes, so
108	 * convert to minutes (rounded up).
109	 */
110	new_keep_alive = (new_keep_alive + 59) / 60;
111
112	if (new_keep_alive == smb_keep_alive)
113		return;
114	/*
115	 * keep alive == 0 means do not drop connection if it's idle
116	 */
117	smb_keep_alive = (new_keep_alive) ? new_keep_alive : -1;
118
119	/*
120	 * Walk through the table and set each session to the new keep_alive
121	 * value if they have not already timed out.  Block clock interrupts.
122	 */
123	smb_llist_enter(ll, RW_READER);
124	sn = smb_llist_head(ll);
125	while (sn != NULL) {
126		SMB_SESSION_VALID(sn);
127		if (sn->keep_alive != 0)
128			sn->keep_alive = new_keep_alive;
129		sn = smb_llist_next(ll, sn);
130	}
131	smb_llist_exit(ll);
132}
133
134/*
135 * Send a session message - supports SMB-over-NBT and SMB-over-TCP.
136 * If an mbuf chain is provided (optional), it will be freed and
137 * set to NULL -- unconditionally!  (error or not)
138 *
139 * Builds a I/O vector (uio/iov) to do the send from mbufs, plus one
140 * segment for the 4-byte NBT header.
141 */
142int
143smb_session_send(smb_session_t *session, uint8_t nbt_type, mbuf_chain_t *mbc)
144{
145	uio_t		uio;
146	iovec_t		local_iov[SMB_LOCAL_IOV_MAX];
147	iovec_t		*alloc_iov = NULL;
148	int		alloc_sz = 0;
149	mbuf_t		*m;
150	uint8_t		nbt_hdr[NETBIOS_HDR_SZ];
151	uint32_t	nbt_len;
152	int		i, nseg;
153	int		rc;
154
155	switch (session->s_state) {
156	case SMB_SESSION_STATE_DISCONNECTED:
157	case SMB_SESSION_STATE_TERMINATED:
158		rc = ENOTCONN;
159		goto out;
160	default:
161		break;
162	}
163
164	/*
165	 * Setup the IOV.  First, count the number of IOV segments
166	 * (plus one for the NBT header) and decide whether we
167	 * need to allocate an iovec or can use local_iov;
168	 */
169	bzero(&uio, sizeof (uio));
170	nseg = 1;
171	m = (mbc != NULL) ? mbc->chain : NULL;
172	while (m != NULL) {
173		nseg++;
174		m = m->m_next;
175	}
176	if (nseg <= SMB_LOCAL_IOV_MAX) {
177		uio.uio_iov = local_iov;
178	} else {
179		alloc_sz = nseg * sizeof (iovec_t);
180		alloc_iov = kmem_alloc(alloc_sz, KM_SLEEP);
181		uio.uio_iov = alloc_iov;
182	}
183	uio.uio_iovcnt = nseg;
184	uio.uio_segflg = UIO_SYSSPACE;
185	uio.uio_extflg = UIO_COPY_DEFAULT;
186
187	/*
188	 * Build the iov list, meanwhile computing the length of
189	 * the SMB payload (to put in the NBT header).
190	 */
191	uio.uio_iov[0].iov_base = (void *)nbt_hdr;
192	uio.uio_iov[0].iov_len = sizeof (nbt_hdr);
193	i = 1;
194	nbt_len = 0;
195	m = (mbc != NULL) ? mbc->chain : NULL;
196	while (m != NULL) {
197		uio.uio_iov[i].iov_base = m->m_data;
198		uio.uio_iov[i++].iov_len = m->m_len;
199		nbt_len += m->m_len;
200		m = m->m_next;
201	}
202	ASSERT3S(i, ==, nseg);
203
204	/*
205	 * Set the NBT header, set uio_resid
206	 */
207	uio.uio_resid = nbt_len + NETBIOS_HDR_SZ;
208	rc = smb_session_xprt_puthdr(session, nbt_type, nbt_len,
209	    nbt_hdr, NETBIOS_HDR_SZ);
210	if (rc != 0)
211		goto out;
212
213	smb_server_add_txb(session->s_server, (int64_t)uio.uio_resid);
214	rc = smb_net_send_uio(session, &uio);
215
216out:
217	if (alloc_iov != NULL)
218		kmem_free(alloc_iov, alloc_sz);
219	if ((mbc != NULL) && (mbc->chain != NULL)) {
220		m_freem(mbc->chain);
221		mbc->chain = NULL;
222		mbc->flags = 0;
223	}
224	return (rc);
225}
226
227/*
228 * Read, process and respond to a NetBIOS session request.
229 *
230 * A NetBIOS session must be established for SMB-over-NetBIOS.  Validate
231 * the calling and called name format and save the client NetBIOS name,
232 * which is used when a NetBIOS session is established to check for and
233 * cleanup leftover state from a previous session.
234 *
235 * Session requests are not valid for SMB-over-TCP, which is unfortunate
236 * because without the client name leftover state cannot be cleaned up
237 * if the client is behind a NAT server.
238 */
239static int
240smb_netbios_session_request(struct smb_session *session)
241{
242	int			rc;
243	char			*calling_name;
244	char			*called_name;
245	char 			client_name[NETBIOS_NAME_SZ];
246	struct mbuf_chain 	mbc;
247	char 			*names = NULL;
248	smb_wchar_t		*wbuf = NULL;
249	smb_xprt_t		hdr;
250	char *p;
251	int rc1, rc2;
252
253	session->keep_alive = smb_keep_alive;
254
255	if ((rc = smb_session_xprt_gethdr(session, &hdr)) != 0)
256		return (rc);
257
258	DTRACE_PROBE2(receive__session__req__xprthdr, struct session *, session,
259	    smb_xprt_t *, &hdr);
260
261	if ((hdr.xh_type != SESSION_REQUEST) ||
262	    (hdr.xh_length != NETBIOS_SESSION_REQUEST_DATA_LENGTH)) {
263		DTRACE_PROBE1(receive__session__req__failed,
264		    struct session *, session);
265		return (EINVAL);
266	}
267
268	names = kmem_alloc(hdr.xh_length, KM_SLEEP);
269
270	if ((rc = smb_sorecv(session->sock, names, hdr.xh_length)) != 0) {
271		kmem_free(names, hdr.xh_length);
272		DTRACE_PROBE1(receive__session__req__failed,
273		    struct session *, session);
274		return (rc);
275	}
276
277	DTRACE_PROBE3(receive__session__req__data, struct session *, session,
278	    char *, names, uint32_t, hdr.xh_length);
279
280	called_name = &names[0];
281	calling_name = &names[NETBIOS_ENCODED_NAME_SZ + 2];
282
283	rc1 = netbios_name_isvalid(called_name, 0);
284	rc2 = netbios_name_isvalid(calling_name, client_name);
285
286	if (rc1 == 0 || rc2 == 0) {
287
288		DTRACE_PROBE3(receive__invalid__session__req,
289		    struct session *, session, char *, names,
290		    uint32_t, hdr.xh_length);
291
292		kmem_free(names, hdr.xh_length);
293		MBC_INIT(&mbc, MAX_DATAGRAM_LENGTH);
294		(void) smb_mbc_encodef(&mbc, "b",
295		    DATAGRAM_INVALID_SOURCE_NAME_FORMAT);
296		(void) smb_session_send(session, NEGATIVE_SESSION_RESPONSE,
297		    &mbc);
298		return (EINVAL);
299	}
300
301	DTRACE_PROBE3(receive__session__req__calling__decoded,
302	    struct session *, session,
303	    char *, calling_name, char *, client_name);
304
305	/*
306	 * The client NetBIOS name is in oem codepage format.
307	 * We need to convert it to unicode and store it in
308	 * multi-byte format.  We also need to strip off any
309	 * spaces added as part of the NetBIOS name encoding.
310	 */
311	wbuf = kmem_alloc((SMB_PI_MAX_HOST * sizeof (smb_wchar_t)), KM_SLEEP);
312	(void) oemtoucs(wbuf, client_name, SMB_PI_MAX_HOST, OEM_CPG_850);
313	(void) smb_wcstombs(session->workstation, wbuf, SMB_PI_MAX_HOST);
314	kmem_free(wbuf, (SMB_PI_MAX_HOST * sizeof (smb_wchar_t)));
315
316	if ((p = strchr(session->workstation, ' ')) != 0)
317		*p = '\0';
318
319	kmem_free(names, hdr.xh_length);
320	return (smb_session_send(session, POSITIVE_SESSION_RESPONSE, NULL));
321}
322
323/*
324 * Read 4-byte header from the session socket and build an in-memory
325 * session transport header.  See smb_xprt_t definition for header
326 * format information.
327 *
328 * Direct hosted NetBIOS-less SMB (SMB-over-TCP) uses port 445.  The
329 * first byte of the four-byte header must be 0 and the next three
330 * bytes contain the length of the remaining data.
331 */
332int
333smb_session_xprt_gethdr(smb_session_t *session, smb_xprt_t *ret_hdr)
334{
335	int		rc;
336	unsigned char	buf[NETBIOS_HDR_SZ];
337
338	if ((rc = smb_sorecv(session->sock, buf, NETBIOS_HDR_SZ)) != 0)
339		return (rc);
340
341	switch (session->s_local_port) {
342	case IPPORT_NETBIOS_SSN:
343		ret_hdr->xh_type = buf[0];
344		ret_hdr->xh_length = (((uint32_t)buf[1] & 1) << 16) |
345		    ((uint32_t)buf[2] << 8) |
346		    ((uint32_t)buf[3]);
347		break;
348
349	case IPPORT_SMB:
350		ret_hdr->xh_type = buf[0];
351
352		if (ret_hdr->xh_type != 0) {
353			cmn_err(CE_WARN, "invalid NBT type (%u) from %s",
354			    ret_hdr->xh_type, session->ip_addr_str);
355			return (EPROTO);
356		}
357
358		ret_hdr->xh_length = ((uint32_t)buf[1] << 16) |
359		    ((uint32_t)buf[2] << 8) |
360		    ((uint32_t)buf[3]);
361		break;
362
363	default:
364		cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
365		return (EPROTO);
366	}
367
368	return (0);
369}
370
371/*
372 * Encode a transport session packet header into a 4-byte buffer.
373 */
374static int
375smb_session_xprt_puthdr(smb_session_t *session,
376    uint8_t msg_type, uint32_t msg_length,
377    uint8_t *buf, size_t buflen)
378{
379	if (buf == NULL || buflen < NETBIOS_HDR_SZ) {
380		return (-1);
381	}
382
383	switch (session->s_local_port) {
384	case IPPORT_NETBIOS_SSN:
385		/* Per RFC 1001, 1002: msg. len < 128KB */
386		if (msg_length >= (1 << 17))
387			return (-1);
388		buf[0] = msg_type;
389		buf[1] = ((msg_length >> 16) & 1);
390		buf[2] = (msg_length >> 8) & 0xff;
391		buf[3] = msg_length & 0xff;
392		break;
393
394	case IPPORT_SMB:
395		/*
396		 * SMB over TCP is like NetBIOS but the one byte
397		 * message type is always zero, and the length
398		 * part is three bytes.  It could actually use
399		 * longer messages, but this is conservative.
400		 */
401		if (msg_length >= (1 << 24))
402			return (-1);
403		buf[0] = msg_type;
404		buf[1] = (msg_length >> 16) & 0xff;
405		buf[2] = (msg_length >> 8) & 0xff;
406		buf[3] = msg_length & 0xff;
407		break;
408
409	default:
410		cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
411		return (-1);
412	}
413
414	return (0);
415}
416
417static void
418smb_request_init_command_mbuf(smb_request_t *sr)
419{
420
421	/*
422	 * Setup mbuf using the buffer we allocated.
423	 */
424	MBC_ATTACH_BUF(&sr->command, sr->sr_request_buf, sr->sr_req_length);
425
426	sr->command.flags = 0;
427	sr->command.shadow_of = NULL;
428}
429
430/*
431 * smb_request_cancel
432 *
433 * Handle a cancel for a request properly depending on the current request
434 * state.
435 */
436void
437smb_request_cancel(smb_request_t *sr)
438{
439	void (*cancel_method)(smb_request_t *) = NULL;
440
441	mutex_enter(&sr->sr_mutex);
442	switch (sr->sr_state) {
443
444	case SMB_REQ_STATE_INITIALIZING:
445	case SMB_REQ_STATE_SUBMITTED:
446	case SMB_REQ_STATE_ACTIVE:
447	case SMB_REQ_STATE_CLEANED_UP:
448		sr->sr_state = SMB_REQ_STATE_CANCELLED;
449		break;
450
451	case SMB_REQ_STATE_WAITING_AUTH:
452	case SMB_REQ_STATE_WAITING_FCN1:
453	case SMB_REQ_STATE_WAITING_LOCK:
454	case SMB_REQ_STATE_WAITING_PIPE:
455		/*
456		 * These are states that have a cancel_method.
457		 * Make the state change now, to ensure that
458		 * we call cancel_method exactly once.  Do the
459		 * method call below, after we drop sr_mutex.
460		 * When the cancelled request thread resumes,
461		 * it should re-take sr_mutex and set sr_state
462		 * to CANCELLED, then return STATUS_CANCELLED.
463		 */
464		sr->sr_state = SMB_REQ_STATE_CANCEL_PENDING;
465		cancel_method = sr->cancel_method;
466		VERIFY(cancel_method != NULL);
467		break;
468
469	case SMB_REQ_STATE_WAITING_FCN2:
470	case SMB_REQ_STATE_COMPLETED:
471	case SMB_REQ_STATE_CANCEL_PENDING:
472	case SMB_REQ_STATE_CANCELLED:
473		/*
474		 * No action required for these states since the request
475		 * is completing.
476		 */
477		break;
478
479	case SMB_REQ_STATE_FREE:
480	default:
481		SMB_PANIC();
482	}
483	mutex_exit(&sr->sr_mutex);
484
485	if (cancel_method != NULL) {
486		cancel_method(sr);
487	}
488}
489
490/*
491 * smb_session_receiver
492 *
493 * Receives request from the network and dispatches them to a worker.
494 */
495void
496smb_session_receiver(smb_session_t *session)
497{
498	int	rc = 0;
499
500	SMB_SESSION_VALID(session);
501
502	session->s_thread = curthread;
503
504	if (session->s_local_port == IPPORT_NETBIOS_SSN) {
505		rc = smb_netbios_session_request(session);
506		if (rc != 0) {
507			smb_rwx_rwenter(&session->s_lock, RW_WRITER);
508			session->s_state = SMB_SESSION_STATE_DISCONNECTED;
509			smb_rwx_rwexit(&session->s_lock);
510			return;
511		}
512	}
513
514	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
515	session->s_state = SMB_SESSION_STATE_ESTABLISHED;
516	smb_rwx_rwexit(&session->s_lock);
517
518	(void) smb_session_reader(session);
519
520	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
521	session->s_state = SMB_SESSION_STATE_DISCONNECTED;
522	smb_rwx_rwexit(&session->s_lock);
523
524	smb_soshutdown(session->sock);
525
526	DTRACE_PROBE2(session__drop, struct session *, session, int, rc);
527
528	smb_session_cancel(session);
529	/*
530	 * At this point everything related to the session should have been
531	 * cleaned up and we expect that nothing will attempt to use the
532	 * socket.
533	 */
534}
535
536/*
537 * smb_session_disconnect
538 *
539 * Disconnects the session passed in.
540 */
541void
542smb_session_disconnect(smb_session_t *session)
543{
544	SMB_SESSION_VALID(session);
545
546	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
547	switch (session->s_state) {
548	case SMB_SESSION_STATE_INITIALIZED:
549	case SMB_SESSION_STATE_CONNECTED:
550	case SMB_SESSION_STATE_ESTABLISHED:
551	case SMB_SESSION_STATE_NEGOTIATED:
552		smb_soshutdown(session->sock);
553		session->s_state = SMB_SESSION_STATE_DISCONNECTED;
554		_NOTE(FALLTHRU)
555	case SMB_SESSION_STATE_DISCONNECTED:
556	case SMB_SESSION_STATE_TERMINATED:
557		break;
558	}
559	smb_rwx_rwexit(&session->s_lock);
560}
561
562/*
563 * Read and process SMB requests.
564 *
565 * Returns:
566 *	0	Success
567 *	1	Unable to read transport header
568 *	2	Invalid transport header type
569 *	3	Invalid SMB length (too small)
570 *	4	Unable to read SMB header
571 *	5	Invalid SMB header (bad magic number)
572 *	6	Unable to read SMB data
573 */
574static int
575smb_session_reader(smb_session_t *session)
576{
577	smb_server_t	*sv;
578	smb_request_t	*sr = NULL;
579	smb_xprt_t	hdr;
580	uint8_t		*req_buf;
581	uint32_t	resid;
582	int		rc;
583
584	sv = session->s_server;
585
586	for (;;) {
587
588		rc = smb_session_xprt_gethdr(session, &hdr);
589		if (rc)
590			return (rc);
591
592		DTRACE_PROBE2(session__receive__xprthdr, session_t *, session,
593		    smb_xprt_t *, &hdr);
594
595		if (hdr.xh_type != SESSION_MESSAGE) {
596			/*
597			 * Anything other than SESSION_MESSAGE or
598			 * SESSION_KEEP_ALIVE is an error.  A SESSION_REQUEST
599			 * may indicate a new session request but we need to
600			 * close this session and we can treat it as an error
601			 * here.
602			 */
603			if (hdr.xh_type == SESSION_KEEP_ALIVE) {
604				session->keep_alive = smb_keep_alive;
605				continue;
606			}
607			return (EPROTO);
608		}
609
610		if (hdr.xh_length == 0) {
611			/* zero length is another form of keep alive */
612			session->keep_alive = smb_keep_alive;
613			continue;
614		}
615
616		if (hdr.xh_length < SMB_HEADER_LEN)
617			return (EPROTO);
618		if (hdr.xh_length > session->cmd_max_bytes)
619			return (EPROTO);
620
621		session->keep_alive = smb_keep_alive;
622
623		/*
624		 * Allocate a request context, read the whole message.
625		 * If the request alloc fails, we've disconnected and
626		 * won't be able to send the reply anyway, so bail now.
627		 */
628		if ((sr = smb_request_alloc(session, hdr.xh_length)) == NULL)
629			break;
630
631		req_buf = (uint8_t *)sr->sr_request_buf;
632		resid = hdr.xh_length;
633
634		rc = smb_sorecv(session->sock, req_buf, resid);
635		if (rc) {
636			smb_request_free(sr);
637			break;
638		}
639
640		/* accounting: received bytes */
641		smb_server_add_rxb(sv,
642		    (int64_t)(hdr.xh_length + NETBIOS_HDR_SZ));
643
644		/*
645		 * Initialize command MBC to represent the received data.
646		 */
647		smb_request_init_command_mbuf(sr);
648
649		DTRACE_PROBE1(session__receive__smb, smb_request_t *, sr);
650
651		rc = session->newrq_func(sr);
652		sr = NULL;	/* enqueued or freed */
653		if (rc != 0)
654			break;
655
656		/* See notes where this is defined (above). */
657		if (smb_reader_delay) {
658			delay(MSEC_TO_TICK(smb_reader_delay));
659		}
660	}
661	return (rc);
662}
663
664/*
665 * This is the initial handler for new smb requests, called from
666 * from smb_session_reader when we have not yet seen any requests.
667 * The first SMB request must be "negotiate", which determines
668 * which protocol and dialect we'll be using.  That's the ONLY
669 * request type handled here, because with all later requests,
670 * we know the protocol and handle those with either the SMB1 or
671 * SMB2 handlers:  smb1sr_post() or smb2sr_post().
672 * Those do NOT allow SMB negotiate, because that's only allowed
673 * as the first request on new session.
674 *
675 * This and other "post a request" handlers must either enqueue
676 * the new request for the session taskq, or smb_request_free it
677 * (in case we've decided to drop this connection).  In this
678 * (special) new request handler, we always free the request.
679 *
680 * Return value is 0 for success, and anything else will
681 * terminate the reader thread (drop the connection).
682 */
683static int
684smbsr_newrq_initial(smb_request_t *sr)
685{
686	uint32_t magic;
687	int rc = EPROTO;
688
689	mutex_enter(&sr->sr_mutex);
690	sr->sr_state = SMB_REQ_STATE_ACTIVE;
691	mutex_exit(&sr->sr_mutex);
692
693	magic = SMB_READ_PROTOCOL(sr->sr_request_buf);
694	if (magic == SMB_PROTOCOL_MAGIC)
695		rc = smb1_newrq_negotiate(sr);
696	if (magic == SMB2_PROTOCOL_MAGIC)
697		rc = smb2_newrq_negotiate(sr);
698
699	mutex_enter(&sr->sr_mutex);
700	sr->sr_state = SMB_REQ_STATE_COMPLETED;
701	mutex_exit(&sr->sr_mutex);
702
703	smb_request_free(sr);
704	return (rc);
705}
706
707/*
708 * Port will be IPPORT_NETBIOS_SSN or IPPORT_SMB.
709 */
710smb_session_t *
711smb_session_create(ksocket_t new_so, uint16_t port, smb_server_t *sv,
712    int family)
713{
714	struct sockaddr_in	sin;
715	socklen_t		slen;
716	struct sockaddr_in6	sin6;
717	smb_session_t		*session;
718	int64_t			now;
719	uint16_t		rport;
720
721	session = kmem_cache_alloc(smb_cache_session, KM_SLEEP);
722	bzero(session, sizeof (smb_session_t));
723
724	if (smb_idpool_constructor(&session->s_uid_pool)) {
725		kmem_cache_free(smb_cache_session, session);
726		return (NULL);
727	}
728	if (smb_idpool_constructor(&session->s_tid_pool)) {
729		smb_idpool_destructor(&session->s_uid_pool);
730		kmem_cache_free(smb_cache_session, session);
731		return (NULL);
732	}
733
734	now = ddi_get_lbolt64();
735
736	session->s_kid = SMB_NEW_KID();
737	session->s_state = SMB_SESSION_STATE_INITIALIZED;
738	session->native_os = NATIVE_OS_UNKNOWN;
739	session->opentime = now;
740	session->keep_alive = smb_keep_alive;
741	session->activity_timestamp = now;
742
743	smb_session_genkey(session);
744
745	mutex_init(&session->s_credits_mutex, NULL, MUTEX_DEFAULT, NULL);
746
747	smb_slist_constructor(&session->s_req_list, sizeof (smb_request_t),
748	    offsetof(smb_request_t, sr_session_lnd));
749
750	smb_llist_constructor(&session->s_user_list, sizeof (smb_user_t),
751	    offsetof(smb_user_t, u_lnd));
752
753	smb_llist_constructor(&session->s_tree_list, sizeof (smb_tree_t),
754	    offsetof(smb_tree_t, t_lnd));
755
756	smb_llist_constructor(&session->s_xa_list, sizeof (smb_xa_t),
757	    offsetof(smb_xa_t, xa_lnd));
758
759	smb_net_txl_constructor(&session->s_txlst);
760
761	smb_rwx_init(&session->s_lock);
762
763	if (new_so != NULL) {
764		if (family == AF_INET) {
765			slen = sizeof (sin);
766			(void) ksocket_getsockname(new_so,
767			    (struct sockaddr *)&sin, &slen, CRED());
768			bcopy(&sin.sin_addr,
769			    &session->local_ipaddr.au_addr.au_ipv4,
770			    sizeof (in_addr_t));
771			slen = sizeof (sin);
772			(void) ksocket_getpeername(new_so,
773			    (struct sockaddr *)&sin, &slen, CRED());
774			bcopy(&sin.sin_addr,
775			    &session->ipaddr.au_addr.au_ipv4,
776			    sizeof (in_addr_t));
777			rport = sin.sin_port;
778		} else {
779			slen = sizeof (sin6);
780			(void) ksocket_getsockname(new_so,
781			    (struct sockaddr *)&sin6, &slen, CRED());
782			bcopy(&sin6.sin6_addr,
783			    &session->local_ipaddr.au_addr.au_ipv6,
784			    sizeof (in6_addr_t));
785			slen = sizeof (sin6);
786			(void) ksocket_getpeername(new_so,
787			    (struct sockaddr *)&sin6, &slen, CRED());
788			bcopy(&sin6.sin6_addr,
789			    &session->ipaddr.au_addr.au_ipv6,
790			    sizeof (in6_addr_t));
791			rport = sin6.sin6_port;
792		}
793		session->ipaddr.a_family = family;
794		session->local_ipaddr.a_family = family;
795		session->s_local_port = port;
796		session->s_remote_port = ntohs(rport);
797		session->sock = new_so;
798		(void) smb_inet_ntop(&session->ipaddr,
799		    session->ip_addr_str, INET6_ADDRSTRLEN);
800		if (port == IPPORT_NETBIOS_SSN)
801			smb_server_inc_nbt_sess(sv);
802		else
803			smb_server_inc_tcp_sess(sv);
804	}
805	session->s_server = sv;
806	smb_server_get_cfg(sv, &session->s_cfg);
807	session->s_srqueue = &sv->sv_srqueue;
808
809	/*
810	 * The initial new request handler is special,
811	 * and only accepts negotiation requests.
812	 */
813	session->newrq_func = smbsr_newrq_initial;
814
815	/* These may increase in SMB2 negotiate. */
816	session->cmd_max_bytes = SMB_REQ_MAX_SIZE;
817	session->reply_max_bytes = SMB_REQ_MAX_SIZE;
818
819	session->s_magic = SMB_SESSION_MAGIC;
820	return (session);
821}
822
823void
824smb_session_delete(smb_session_t *session)
825{
826
827	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
828
829	if (session->sign_fini != NULL)
830		session->sign_fini(session);
831
832	if (session->signing.mackey != NULL) {
833		kmem_free(session->signing.mackey,
834		    session->signing.mackey_len);
835	}
836
837	session->s_magic = 0;
838
839	smb_rwx_destroy(&session->s_lock);
840	smb_net_txl_destructor(&session->s_txlst);
841
842	mutex_destroy(&session->s_credits_mutex);
843
844	smb_slist_destructor(&session->s_req_list);
845	smb_llist_destructor(&session->s_tree_list);
846	smb_llist_destructor(&session->s_user_list);
847	smb_llist_destructor(&session->s_xa_list);
848
849	ASSERT(session->s_tree_cnt == 0);
850	ASSERT(session->s_file_cnt == 0);
851	ASSERT(session->s_dir_cnt == 0);
852
853	smb_idpool_destructor(&session->s_tid_pool);
854	smb_idpool_destructor(&session->s_uid_pool);
855	if (session->sock != NULL) {
856		if (session->s_local_port == IPPORT_NETBIOS_SSN)
857			smb_server_dec_nbt_sess(session->s_server);
858		else
859			smb_server_dec_tcp_sess(session->s_server);
860		smb_sodestroy(session->sock);
861	}
862	kmem_cache_free(smb_cache_session, session);
863}
864
865static void
866smb_session_cancel(smb_session_t *session)
867{
868	smb_xa_t	*xa, *nextxa;
869
870	/* All the request currently being treated must be canceled. */
871	smb_session_cancel_requests(session, NULL, NULL);
872
873	/*
874	 * We wait for the completion of all the requests associated with
875	 * this session.
876	 */
877	smb_slist_wait_for_empty(&session->s_req_list);
878
879	/*
880	 * At this point the reference count of the users, trees, files,
881	 * directories should be zero. It should be possible to destroy them
882	 * without any problem.
883	 */
884	xa = smb_llist_head(&session->s_xa_list);
885	while (xa) {
886		nextxa = smb_llist_next(&session->s_xa_list, xa);
887		smb_xa_close(xa);
888		xa = nextxa;
889	}
890
891	smb_session_logoff(session);
892}
893
894/*
895 * Cancel requests.  If a non-null tree is specified, only requests specific
896 * to that tree will be cancelled.  If a non-null sr is specified, that sr
897 * will be not be cancelled - this would typically be the caller's sr.
898 */
899void
900smb_session_cancel_requests(
901    smb_session_t	*session,
902    smb_tree_t		*tree,
903    smb_request_t	*exclude_sr)
904{
905	smb_request_t	*sr;
906
907	smb_slist_enter(&session->s_req_list);
908	sr = smb_slist_head(&session->s_req_list);
909
910	while (sr) {
911		ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
912		if ((sr != exclude_sr) &&
913		    (tree == NULL || sr->tid_tree == tree))
914			smb_request_cancel(sr);
915
916		sr = smb_slist_next(&session->s_req_list, sr);
917	}
918
919	smb_slist_exit(&session->s_req_list);
920}
921
922/*
923 * Find a user on the specified session by SMB UID.
924 */
925smb_user_t *
926smb_session_lookup_uid(smb_session_t *session, uint16_t uid)
927{
928	return (smb_session_lookup_uid_st(session, uid,
929	    SMB_USER_STATE_LOGGED_ON));
930}
931
932smb_user_t *
933smb_session_lookup_uid_st(smb_session_t *session, uint16_t uid,
934    smb_user_state_t st)
935{
936	smb_user_t	*user;
937	smb_llist_t	*user_list;
938
939	SMB_SESSION_VALID(session);
940
941	user_list = &session->s_user_list;
942	smb_llist_enter(user_list, RW_READER);
943
944	user = smb_llist_head(user_list);
945	while (user) {
946		SMB_USER_VALID(user);
947		ASSERT(user->u_session == session);
948
949		if (user->u_uid == uid && user->u_state == st) {
950			smb_user_hold_internal(user);
951			break;
952		}
953
954		user = smb_llist_next(user_list, user);
955	}
956
957	smb_llist_exit(user_list);
958	return (user);
959}
960
961void
962smb_session_post_user(smb_session_t *session, smb_user_t *user)
963{
964	SMB_USER_VALID(user);
965	ASSERT(user->u_refcnt == 0);
966	ASSERT(user->u_state == SMB_USER_STATE_LOGGED_OFF);
967	ASSERT(user->u_session == session);
968
969	smb_llist_post(&session->s_user_list, user, smb_user_delete);
970}
971
972/*
973 * Find a tree by tree-id.
974 */
975smb_tree_t *
976smb_session_lookup_tree(
977    smb_session_t	*session,
978    uint16_t		tid)
979
980{
981	smb_tree_t	*tree;
982
983	SMB_SESSION_VALID(session);
984
985	smb_llist_enter(&session->s_tree_list, RW_READER);
986	tree = smb_llist_head(&session->s_tree_list);
987
988	while (tree) {
989		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
990		ASSERT(tree->t_session == session);
991
992		if (tree->t_tid == tid) {
993			if (smb_tree_hold(tree)) {
994				smb_llist_exit(&session->s_tree_list);
995				return (tree);
996			} else {
997				smb_llist_exit(&session->s_tree_list);
998				return (NULL);
999			}
1000		}
1001
1002		tree = smb_llist_next(&session->s_tree_list, tree);
1003	}
1004
1005	smb_llist_exit(&session->s_tree_list);
1006	return (NULL);
1007}
1008
1009/*
1010 * Find the first connected tree that matches the specified sharename.
1011 * If the specified tree is NULL the search starts from the beginning of
1012 * the user's tree list.  If a tree is provided the search starts just
1013 * after that tree.
1014 */
1015smb_tree_t *
1016smb_session_lookup_share(
1017    smb_session_t	*session,
1018    const char		*sharename,
1019    smb_tree_t		*tree)
1020{
1021	SMB_SESSION_VALID(session);
1022	ASSERT(sharename);
1023
1024	smb_llist_enter(&session->s_tree_list, RW_READER);
1025
1026	if (tree) {
1027		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1028		ASSERT(tree->t_session == session);
1029		tree = smb_llist_next(&session->s_tree_list, tree);
1030	} else {
1031		tree = smb_llist_head(&session->s_tree_list);
1032	}
1033
1034	while (tree) {
1035		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1036		ASSERT(tree->t_session == session);
1037		if (smb_strcasecmp(tree->t_sharename, sharename, 0) == 0) {
1038			if (smb_tree_hold(tree)) {
1039				smb_llist_exit(&session->s_tree_list);
1040				return (tree);
1041			}
1042		}
1043		tree = smb_llist_next(&session->s_tree_list, tree);
1044	}
1045
1046	smb_llist_exit(&session->s_tree_list);
1047	return (NULL);
1048}
1049
1050/*
1051 * Find the first connected tree that matches the specified volume name.
1052 * If the specified tree is NULL the search starts from the beginning of
1053 * the user's tree list.  If a tree is provided the search starts just
1054 * after that tree.
1055 */
1056smb_tree_t *
1057smb_session_lookup_volume(
1058    smb_session_t	*session,
1059    const char		*name,
1060    smb_tree_t		*tree)
1061{
1062	SMB_SESSION_VALID(session);
1063	ASSERT(name);
1064
1065	smb_llist_enter(&session->s_tree_list, RW_READER);
1066
1067	if (tree) {
1068		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1069		ASSERT(tree->t_session == session);
1070		tree = smb_llist_next(&session->s_tree_list, tree);
1071	} else {
1072		tree = smb_llist_head(&session->s_tree_list);
1073	}
1074
1075	while (tree) {
1076		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1077		ASSERT(tree->t_session == session);
1078
1079		if (smb_strcasecmp(tree->t_volume, name, 0) == 0) {
1080			if (smb_tree_hold(tree)) {
1081				smb_llist_exit(&session->s_tree_list);
1082				return (tree);
1083			}
1084		}
1085
1086		tree = smb_llist_next(&session->s_tree_list, tree);
1087	}
1088
1089	smb_llist_exit(&session->s_tree_list);
1090	return (NULL);
1091}
1092
1093/*
1094 * Disconnect all trees that match the specified client process-id.
1095 */
1096void
1097smb_session_close_pid(
1098    smb_session_t	*session,
1099    uint32_t		pid)
1100{
1101	smb_tree_t	*tree;
1102
1103	SMB_SESSION_VALID(session);
1104
1105	tree = smb_session_get_tree(session, NULL);
1106	while (tree) {
1107		smb_tree_t *next;
1108		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1109		ASSERT(tree->t_session == session);
1110		smb_tree_close_pid(tree, pid);
1111		next = smb_session_get_tree(session, tree);
1112		smb_tree_release(tree);
1113		tree = next;
1114	}
1115}
1116
1117static void
1118smb_session_tree_dtor(void *t)
1119{
1120	smb_tree_t	*tree = (smb_tree_t *)t;
1121
1122	smb_tree_disconnect(tree, B_TRUE);
1123	/* release the ref acquired during the traversal loop */
1124	smb_tree_release(tree);
1125}
1126
1127
1128/*
1129 * Disconnect all trees that this user has connected.
1130 */
1131void
1132smb_session_disconnect_owned_trees(
1133    smb_session_t	*session,
1134    smb_user_t		*owner)
1135{
1136	smb_tree_t	*tree;
1137	smb_llist_t	*tree_list = &session->s_tree_list;
1138
1139	SMB_SESSION_VALID(session);
1140	SMB_USER_VALID(owner);
1141
1142	smb_llist_enter(tree_list, RW_READER);
1143
1144	tree = smb_llist_head(tree_list);
1145	while (tree) {
1146		if ((tree->t_owner == owner) &&
1147		    smb_tree_hold(tree)) {
1148			/*
1149			 * smb_tree_hold() succeeded, hence we are in state
1150			 * SMB_TREE_STATE_CONNECTED; schedule this tree
1151			 * for asynchronous disconnect, which will fire
1152			 * after we drop the llist traversal lock.
1153			 */
1154			smb_llist_post(tree_list, tree, smb_session_tree_dtor);
1155		}
1156		tree = smb_llist_next(tree_list, tree);
1157	}
1158
1159	/* drop the lock and flush the dtor queue */
1160	smb_llist_exit(tree_list);
1161}
1162
1163/*
1164 * Disconnect all trees that this user has connected.
1165 */
1166void
1167smb_session_disconnect_trees(
1168    smb_session_t	*session)
1169{
1170	smb_tree_t	*tree;
1171
1172	SMB_SESSION_VALID(session);
1173
1174	tree = smb_session_get_tree(session, NULL);
1175	while (tree) {
1176		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1177		ASSERT(tree->t_session == session);
1178		smb_tree_disconnect(tree, B_TRUE);
1179		smb_tree_release(tree);
1180		tree = smb_session_get_tree(session, NULL);
1181	}
1182}
1183
1184/*
1185 * Disconnect all trees that match the specified share name.
1186 */
1187void
1188smb_session_disconnect_share(
1189    smb_session_t	*session,
1190    const char		*sharename)
1191{
1192	smb_tree_t	*tree;
1193	smb_tree_t	*next;
1194
1195	SMB_SESSION_VALID(session);
1196
1197	tree = smb_session_lookup_share(session, sharename, NULL);
1198	while (tree) {
1199		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1200		ASSERT(tree->t_session == session);
1201		smb_tree_disconnect(tree, B_TRUE);
1202		smb_session_cancel_requests(session, tree, NULL);
1203		next = smb_session_lookup_share(session, sharename, tree);
1204		smb_tree_release(tree);
1205		tree = next;
1206	}
1207}
1208
1209void
1210smb_session_post_tree(smb_session_t *session, smb_tree_t *tree)
1211{
1212	SMB_SESSION_VALID(session);
1213	SMB_TREE_VALID(tree);
1214	ASSERT0(tree->t_refcnt);
1215	ASSERT(tree->t_state == SMB_TREE_STATE_DISCONNECTED);
1216	ASSERT(tree->t_session == session);
1217
1218	smb_llist_post(&session->s_tree_list, tree, smb_tree_dealloc);
1219}
1220
1221/*
1222 * Get the next connected tree in the list.  A reference is taken on
1223 * the tree, which can be released later with smb_tree_release().
1224 *
1225 * If the specified tree is NULL the search starts from the beginning of
1226 * the tree list.  If a tree is provided the search starts just after
1227 * that tree.
1228 *
1229 * Returns NULL if there are no connected trees in the list.
1230 */
1231static smb_tree_t *
1232smb_session_get_tree(
1233    smb_session_t	*session,
1234    smb_tree_t		*tree)
1235{
1236	smb_llist_t	*tree_list;
1237
1238	SMB_SESSION_VALID(session);
1239	tree_list = &session->s_tree_list;
1240
1241	smb_llist_enter(tree_list, RW_READER);
1242
1243	if (tree) {
1244		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1245		tree = smb_llist_next(tree_list, tree);
1246	} else {
1247		tree = smb_llist_head(tree_list);
1248	}
1249
1250	while (tree) {
1251		if (smb_tree_hold(tree))
1252			break;
1253
1254		tree = smb_llist_next(tree_list, tree);
1255	}
1256
1257	smb_llist_exit(tree_list);
1258	return (tree);
1259}
1260
1261/*
1262 * Logoff all users associated with the specified session.
1263 */
1264static void
1265smb_session_logoff(smb_session_t *session)
1266{
1267	smb_user_t	*user;
1268
1269	SMB_SESSION_VALID(session);
1270
1271	smb_session_disconnect_trees(session);
1272
1273	smb_llist_enter(&session->s_user_list, RW_READER);
1274
1275	user = smb_llist_head(&session->s_user_list);
1276	while (user) {
1277		SMB_USER_VALID(user);
1278		ASSERT(user->u_session == session);
1279
1280		switch (user->u_state) {
1281		case SMB_USER_STATE_LOGGING_ON:
1282		case SMB_USER_STATE_LOGGED_ON:
1283			smb_user_hold_internal(user);
1284			smb_user_logoff(user);
1285			smb_user_release(user);
1286			break;
1287
1288		case SMB_USER_STATE_LOGGED_OFF:
1289		case SMB_USER_STATE_LOGGING_OFF:
1290			break;
1291
1292		default:
1293			ASSERT(0);
1294			break;
1295		}
1296
1297		user = smb_llist_next(&session->s_user_list, user);
1298	}
1299
1300	smb_llist_exit(&session->s_user_list);
1301}
1302
1303/*
1304 * Copy the session workstation/client name to buf.  If the workstation
1305 * is an empty string (which it will be on TCP connections), use the
1306 * client IP address.
1307 */
1308void
1309smb_session_getclient(smb_session_t *sn, char *buf, size_t buflen)
1310{
1311
1312	*buf = '\0';
1313
1314	if (sn->workstation[0] != '\0') {
1315		(void) strlcpy(buf, sn->workstation, buflen);
1316		return;
1317	}
1318
1319	(void) strlcpy(buf, sn->ip_addr_str, buflen);
1320}
1321
1322/*
1323 * Check whether or not the specified client name is the client of this
1324 * session.  The name may be in UNC format (\\CLIENT).
1325 *
1326 * A workstation/client name is setup on NBT connections as part of the
1327 * NetBIOS session request but that isn't available on TCP connections.
1328 * If the session doesn't have a client name we typically return the
1329 * client IP address as the workstation name on MSRPC requests.  So we
1330 * check for the IP address here in addition to the workstation name.
1331 */
1332boolean_t
1333smb_session_isclient(smb_session_t *sn, const char *client)
1334{
1335
1336	client += strspn(client, "\\");
1337
1338	if (smb_strcasecmp(client, sn->workstation, 0) == 0)
1339		return (B_TRUE);
1340
1341	if (smb_strcasecmp(client, sn->ip_addr_str, 0) == 0)
1342		return (B_TRUE);
1343
1344	return (B_FALSE);
1345}
1346
1347/*
1348 * smb_request_alloc
1349 *
1350 * Allocate an smb_request_t structure from the kmem_cache.  Partially
1351 * initialize the found/new request.
1352 *
1353 * Returns pointer to a request, or NULL if the session state is
1354 * one in which new requests are no longer allowed.
1355 */
1356smb_request_t *
1357smb_request_alloc(smb_session_t *session, int req_length)
1358{
1359	smb_request_t	*sr;
1360
1361	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
1362	ASSERT(req_length <= session->cmd_max_bytes);
1363
1364	sr = kmem_cache_alloc(smb_cache_request, KM_SLEEP);
1365
1366	/*
1367	 * Future:  Use constructor to pre-initialize some fields.  For now
1368	 * there are so many fields that it is easiest just to zero the
1369	 * whole thing and start over.
1370	 */
1371	bzero(sr, sizeof (smb_request_t));
1372
1373	mutex_init(&sr->sr_mutex, NULL, MUTEX_DEFAULT, NULL);
1374	smb_srm_init(sr);
1375	sr->session = session;
1376	sr->sr_server = session->s_server;
1377	sr->sr_gmtoff = session->s_server->si_gmtoff;
1378	sr->sr_cfg = &session->s_cfg;
1379	sr->command.max_bytes = req_length;
1380	sr->reply.max_bytes = session->reply_max_bytes;
1381	sr->sr_req_length = req_length;
1382	if (req_length)
1383		sr->sr_request_buf = kmem_alloc(req_length, KM_SLEEP);
1384	sr->sr_magic = SMB_REQ_MAGIC;
1385	sr->sr_state = SMB_REQ_STATE_INITIALIZING;
1386
1387	/*
1388	 * Only allow new SMB requests in some states.
1389	 */
1390	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
1391	switch (session->s_state) {
1392	case SMB_SESSION_STATE_CONNECTED:
1393	case SMB_SESSION_STATE_INITIALIZED:
1394	case SMB_SESSION_STATE_ESTABLISHED:
1395	case SMB_SESSION_STATE_NEGOTIATED:
1396		smb_slist_insert_tail(&session->s_req_list, sr);
1397		break;
1398
1399	default:
1400		ASSERT(0);
1401		/* FALLTHROUGH */
1402	case SMB_SESSION_STATE_DISCONNECTED:
1403	case SMB_SESSION_STATE_TERMINATED:
1404		/* Disallow new requests in these states. */
1405		if (sr->sr_request_buf)
1406			kmem_free(sr->sr_request_buf, sr->sr_req_length);
1407		sr->session = NULL;
1408		sr->sr_magic = 0;
1409		mutex_destroy(&sr->sr_mutex);
1410		kmem_cache_free(smb_cache_request, sr);
1411		sr = NULL;
1412		break;
1413	}
1414	smb_rwx_rwexit(&session->s_lock);
1415
1416	return (sr);
1417}
1418
1419/*
1420 * smb_request_free
1421 *
1422 * release the memories which have been allocated for a smb request.
1423 */
1424void
1425smb_request_free(smb_request_t *sr)
1426{
1427	ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
1428	ASSERT(sr->session);
1429	ASSERT(sr->r_xa == NULL);
1430
1431	if (sr->fid_ofile != NULL) {
1432		smb_ofile_request_complete(sr->fid_ofile);
1433		smb_ofile_release(sr->fid_ofile);
1434	}
1435
1436	if (sr->tid_tree != NULL)
1437		smb_tree_release(sr->tid_tree);
1438
1439	if (sr->uid_user != NULL)
1440		smb_user_release(sr->uid_user);
1441
1442	/*
1443	 * The above may have left work on the delete queues
1444	 */
1445	smb_llist_flush(&sr->session->s_tree_list);
1446	smb_llist_flush(&sr->session->s_user_list);
1447
1448	smb_slist_remove(&sr->session->s_req_list, sr);
1449
1450	sr->session = NULL;
1451
1452	smb_srm_fini(sr);
1453
1454	if (sr->sr_request_buf)
1455		kmem_free(sr->sr_request_buf, sr->sr_req_length);
1456	if (sr->command.chain)
1457		m_freem(sr->command.chain);
1458	if (sr->reply.chain)
1459		m_freem(sr->reply.chain);
1460	if (sr->raw_data.chain)
1461		m_freem(sr->raw_data.chain);
1462
1463	sr->sr_magic = 0;
1464	mutex_destroy(&sr->sr_mutex);
1465	kmem_cache_free(smb_cache_request, sr);
1466}
1467
1468boolean_t
1469smb_session_oplocks_enable(smb_session_t *session)
1470{
1471	SMB_SESSION_VALID(session);
1472	if (session->s_cfg.skc_oplock_enable == 0)
1473		return (B_FALSE);
1474	else
1475		return (B_TRUE);
1476}
1477
1478boolean_t
1479smb_session_levelII_oplocks(smb_session_t *session)
1480{
1481	SMB_SESSION_VALID(session);
1482
1483	/* Clients using SMB2 and later always know about oplocks. */
1484	if (session->dialect > NT_LM_0_12)
1485		return (B_TRUE);
1486
1487	/* Older clients only do Level II oplocks if negotiated. */
1488	if ((session->capabilities & CAP_LEVEL_II_OPLOCKS) != 0)
1489		return (B_TRUE);
1490
1491	return (B_FALSE);
1492}
1493
1494/*
1495 * smb_session_oplock_break
1496 *
1497 * Send an oplock break request to the client,
1498 * recalling some cache delegation.
1499 */
1500void
1501smb_session_oplock_break(smb_request_t *sr, uint8_t brk)
1502{
1503	smb_session_t	*session = sr->session;
1504	mbuf_chain_t	*mbc = &sr->reply;
1505
1506	SMB_SESSION_VALID(session);
1507
1508	/*
1509	 * Build the break message in sr->reply and then send it.
1510	 * The mbc is free'd later, in smb_request_free().
1511	 */
1512	mbc->max_bytes = MLEN;
1513	if (session->dialect <= NT_LM_0_12) {
1514		smb1_oplock_break_notification(sr, brk);
1515	} else {
1516		smb2_oplock_break_notification(sr, brk);
1517	}
1518
1519	(void) smb_session_send(session, 0, mbc);
1520}
1521
1522static void
1523smb_session_genkey(smb_session_t *session)
1524{
1525	uint8_t		tmp_key[SMB_CHALLENGE_SZ];
1526
1527	(void) random_get_pseudo_bytes(tmp_key, SMB_CHALLENGE_SZ);
1528	bcopy(tmp_key, &session->challenge_key, SMB_CHALLENGE_SZ);
1529	session->challenge_len = SMB_CHALLENGE_SZ;
1530
1531	(void) random_get_pseudo_bytes(tmp_key, 4);
1532	session->sesskey = tmp_key[0] | tmp_key[1] << 8 |
1533	    tmp_key[2] << 16 | tmp_key[3] << 24;
1534}
1535