smb_session.c revision b210fede5519ffcaa92e5409d891c77b945d73bb
1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21/*
22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
24 */
25
26#include <sys/atomic.h>
27#include <sys/synch.h>
28#include <sys/types.h>
29#include <sys/sdt.h>
30#include <sys/random.h>
31#include <smbsrv/netbios.h>
32#include <smbsrv/smb2_kproto.h>
33#include <smbsrv/string.h>
34#include <netinet/tcp.h>
35
36/* How many iovec we'll handle as a local array (no allocation) */
37#define	SMB_LOCAL_IOV_MAX	16
38
39#define	SMB_NEW_KID()	atomic_inc_64_nv(&smb_kids)
40
41static volatile uint64_t smb_kids;
42
43/*
44 * We track the keepalive in minutes, but this constant
45 * specifies it in seconds, so convert to minutes.
46 */
47uint32_t smb_keep_alive = SMB_PI_KEEP_ALIVE_MIN / 60;
48
49static int  smbsr_newrq_initial(smb_request_t *);
50
51static void smb_session_cancel(smb_session_t *);
52static int smb_session_reader(smb_session_t *);
53static int smb_session_xprt_puthdr(smb_session_t *,
54    uint8_t msg_type, uint32_t msg_len,
55    uint8_t *dst, size_t dstlen);
56static smb_tree_t *smb_session_get_tree(smb_session_t *, smb_tree_t *);
57static void smb_session_logoff(smb_session_t *);
58static void smb_request_init_command_mbuf(smb_request_t *sr);
59static void smb_session_genkey(smb_session_t *);
60
61void
62smb_session_timers(smb_llist_t *ll)
63{
64	smb_session_t	*session;
65
66	smb_llist_enter(ll, RW_READER);
67	session = smb_llist_head(ll);
68	while (session != NULL) {
69		/*
70		 * Walk through the table and decrement each keep_alive
71		 * timer that has not timed out yet. (keepalive > 0)
72		 */
73		SMB_SESSION_VALID(session);
74		if (session->keep_alive &&
75		    (session->keep_alive != (uint32_t)-1))
76			session->keep_alive--;
77		session = smb_llist_next(ll, session);
78	}
79	smb_llist_exit(ll);
80}
81
82void
83smb_session_correct_keep_alive_values(smb_llist_t *ll, uint32_t new_keep_alive)
84{
85	smb_session_t		*sn;
86
87	/*
88	 * Caller specifies seconds, but we track in minutes, so
89	 * convert to minutes (rounded up).
90	 */
91	new_keep_alive = (new_keep_alive + 59) / 60;
92
93	if (new_keep_alive == smb_keep_alive)
94		return;
95	/*
96	 * keep alive == 0 means do not drop connection if it's idle
97	 */
98	smb_keep_alive = (new_keep_alive) ? new_keep_alive : -1;
99
100	/*
101	 * Walk through the table and set each session to the new keep_alive
102	 * value if they have not already timed out.  Block clock interrupts.
103	 */
104	smb_llist_enter(ll, RW_READER);
105	sn = smb_llist_head(ll);
106	while (sn != NULL) {
107		SMB_SESSION_VALID(sn);
108		if (sn->keep_alive != 0)
109			sn->keep_alive = new_keep_alive;
110		sn = smb_llist_next(ll, sn);
111	}
112	smb_llist_exit(ll);
113}
114
115/*
116 * Send a session message - supports SMB-over-NBT and SMB-over-TCP.
117 * If an mbuf chain is provided (optional), it will be freed and
118 * set to NULL -- unconditionally!  (error or not)
119 *
120 * Builds a I/O vector (uio/iov) to do the send from mbufs, plus one
121 * segment for the 4-byte NBT header.
122 */
123int
124smb_session_send(smb_session_t *session, uint8_t nbt_type, mbuf_chain_t *mbc)
125{
126	uio_t		uio;
127	iovec_t		local_iov[SMB_LOCAL_IOV_MAX];
128	iovec_t		*alloc_iov = NULL;
129	int		alloc_sz = 0;
130	mbuf_t		*m;
131	uint8_t		nbt_hdr[NETBIOS_HDR_SZ];
132	uint32_t	nbt_len;
133	int		i, nseg;
134	int		rc;
135
136	switch (session->s_state) {
137	case SMB_SESSION_STATE_DISCONNECTED:
138	case SMB_SESSION_STATE_TERMINATED:
139		rc = ENOTCONN;
140		goto out;
141	default:
142		break;
143	}
144
145	/*
146	 * Setup the IOV.  First, count the number of IOV segments
147	 * (plus one for the NBT header) and decide whether we
148	 * need to allocate an iovec or can use local_iov;
149	 */
150	bzero(&uio, sizeof (uio));
151	nseg = 1;
152	m = (mbc != NULL) ? mbc->chain : NULL;
153	while (m != NULL) {
154		nseg++;
155		m = m->m_next;
156	}
157	if (nseg <= SMB_LOCAL_IOV_MAX) {
158		uio.uio_iov = local_iov;
159	} else {
160		alloc_sz = nseg * sizeof (iovec_t);
161		alloc_iov = kmem_alloc(alloc_sz, KM_SLEEP);
162		uio.uio_iov = alloc_iov;
163	}
164	uio.uio_iovcnt = nseg;
165	uio.uio_segflg = UIO_SYSSPACE;
166	uio.uio_extflg = UIO_COPY_DEFAULT;
167
168	/*
169	 * Build the iov list, meanwhile computing the length of
170	 * the SMB payload (to put in the NBT header).
171	 */
172	uio.uio_iov[0].iov_base = (void *)nbt_hdr;
173	uio.uio_iov[0].iov_len = sizeof (nbt_hdr);
174	i = 1;
175	nbt_len = 0;
176	m = (mbc != NULL) ? mbc->chain : NULL;
177	while (m != NULL) {
178		uio.uio_iov[i].iov_base = m->m_data;
179		uio.uio_iov[i++].iov_len = m->m_len;
180		nbt_len += m->m_len;
181		m = m->m_next;
182	}
183	ASSERT3S(i, ==, nseg);
184
185	/*
186	 * Set the NBT header, set uio_resid
187	 */
188	uio.uio_resid = nbt_len + NETBIOS_HDR_SZ;
189	rc = smb_session_xprt_puthdr(session, nbt_type, nbt_len,
190	    nbt_hdr, NETBIOS_HDR_SZ);
191	if (rc != 0)
192		goto out;
193
194	smb_server_add_txb(session->s_server, (int64_t)uio.uio_resid);
195	rc = smb_net_send_uio(session, &uio);
196
197out:
198	if (alloc_iov != NULL)
199		kmem_free(alloc_iov, alloc_sz);
200	if ((mbc != NULL) && (mbc->chain != NULL)) {
201		m_freem(mbc->chain);
202		mbc->chain = NULL;
203		mbc->flags = 0;
204	}
205	return (rc);
206}
207
208/*
209 * Read, process and respond to a NetBIOS session request.
210 *
211 * A NetBIOS session must be established for SMB-over-NetBIOS.  Validate
212 * the calling and called name format and save the client NetBIOS name,
213 * which is used when a NetBIOS session is established to check for and
214 * cleanup leftover state from a previous session.
215 *
216 * Session requests are not valid for SMB-over-TCP, which is unfortunate
217 * because without the client name leftover state cannot be cleaned up
218 * if the client is behind a NAT server.
219 */
220static int
221smb_netbios_session_request(struct smb_session *session)
222{
223	int			rc;
224	char			*calling_name;
225	char			*called_name;
226	char 			client_name[NETBIOS_NAME_SZ];
227	struct mbuf_chain 	mbc;
228	char 			*names = NULL;
229	smb_wchar_t		*wbuf = NULL;
230	smb_xprt_t		hdr;
231	char *p;
232	int rc1, rc2;
233
234	session->keep_alive = smb_keep_alive;
235
236	if ((rc = smb_session_xprt_gethdr(session, &hdr)) != 0)
237		return (rc);
238
239	DTRACE_PROBE2(receive__session__req__xprthdr, struct session *, session,
240	    smb_xprt_t *, &hdr);
241
242	if ((hdr.xh_type != SESSION_REQUEST) ||
243	    (hdr.xh_length != NETBIOS_SESSION_REQUEST_DATA_LENGTH)) {
244		DTRACE_PROBE1(receive__session__req__failed,
245		    struct session *, session);
246		return (EINVAL);
247	}
248
249	names = kmem_alloc(hdr.xh_length, KM_SLEEP);
250
251	if ((rc = smb_sorecv(session->sock, names, hdr.xh_length)) != 0) {
252		kmem_free(names, hdr.xh_length);
253		DTRACE_PROBE1(receive__session__req__failed,
254		    struct session *, session);
255		return (rc);
256	}
257
258	DTRACE_PROBE3(receive__session__req__data, struct session *, session,
259	    char *, names, uint32_t, hdr.xh_length);
260
261	called_name = &names[0];
262	calling_name = &names[NETBIOS_ENCODED_NAME_SZ + 2];
263
264	rc1 = netbios_name_isvalid(called_name, 0);
265	rc2 = netbios_name_isvalid(calling_name, client_name);
266
267	if (rc1 == 0 || rc2 == 0) {
268
269		DTRACE_PROBE3(receive__invalid__session__req,
270		    struct session *, session, char *, names,
271		    uint32_t, hdr.xh_length);
272
273		kmem_free(names, hdr.xh_length);
274		MBC_INIT(&mbc, MAX_DATAGRAM_LENGTH);
275		(void) smb_mbc_encodef(&mbc, "b",
276		    DATAGRAM_INVALID_SOURCE_NAME_FORMAT);
277		(void) smb_session_send(session, NEGATIVE_SESSION_RESPONSE,
278		    &mbc);
279		return (EINVAL);
280	}
281
282	DTRACE_PROBE3(receive__session__req__calling__decoded,
283	    struct session *, session,
284	    char *, calling_name, char *, client_name);
285
286	/*
287	 * The client NetBIOS name is in oem codepage format.
288	 * We need to convert it to unicode and store it in
289	 * multi-byte format.  We also need to strip off any
290	 * spaces added as part of the NetBIOS name encoding.
291	 */
292	wbuf = kmem_alloc((SMB_PI_MAX_HOST * sizeof (smb_wchar_t)), KM_SLEEP);
293	(void) oemtoucs(wbuf, client_name, SMB_PI_MAX_HOST, OEM_CPG_850);
294	(void) smb_wcstombs(session->workstation, wbuf, SMB_PI_MAX_HOST);
295	kmem_free(wbuf, (SMB_PI_MAX_HOST * sizeof (smb_wchar_t)));
296
297	if ((p = strchr(session->workstation, ' ')) != 0)
298		*p = '\0';
299
300	kmem_free(names, hdr.xh_length);
301	return (smb_session_send(session, POSITIVE_SESSION_RESPONSE, NULL));
302}
303
304/*
305 * Read 4-byte header from the session socket and build an in-memory
306 * session transport header.  See smb_xprt_t definition for header
307 * format information.
308 *
309 * Direct hosted NetBIOS-less SMB (SMB-over-TCP) uses port 445.  The
310 * first byte of the four-byte header must be 0 and the next three
311 * bytes contain the length of the remaining data.
312 */
313int
314smb_session_xprt_gethdr(smb_session_t *session, smb_xprt_t *ret_hdr)
315{
316	int		rc;
317	unsigned char	buf[NETBIOS_HDR_SZ];
318
319	if ((rc = smb_sorecv(session->sock, buf, NETBIOS_HDR_SZ)) != 0)
320		return (rc);
321
322	switch (session->s_local_port) {
323	case IPPORT_NETBIOS_SSN:
324		ret_hdr->xh_type = buf[0];
325		ret_hdr->xh_length = (((uint32_t)buf[1] & 1) << 16) |
326		    ((uint32_t)buf[2] << 8) |
327		    ((uint32_t)buf[3]);
328		break;
329
330	case IPPORT_SMB:
331		ret_hdr->xh_type = buf[0];
332
333		if (ret_hdr->xh_type != 0) {
334			cmn_err(CE_WARN, "invalid NBT type (%u) from %s",
335			    ret_hdr->xh_type, session->ip_addr_str);
336			return (EPROTO);
337		}
338
339		ret_hdr->xh_length = ((uint32_t)buf[1] << 16) |
340		    ((uint32_t)buf[2] << 8) |
341		    ((uint32_t)buf[3]);
342		break;
343
344	default:
345		cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
346		return (EPROTO);
347	}
348
349	return (0);
350}
351
352/*
353 * Encode a transport session packet header into a 4-byte buffer.
354 */
355static int
356smb_session_xprt_puthdr(smb_session_t *session,
357    uint8_t msg_type, uint32_t msg_length,
358    uint8_t *buf, size_t buflen)
359{
360	if (buf == NULL || buflen < NETBIOS_HDR_SZ) {
361		return (-1);
362	}
363
364	switch (session->s_local_port) {
365	case IPPORT_NETBIOS_SSN:
366		/* Per RFC 1001, 1002: msg. len < 128KB */
367		if (msg_length >= (1 << 17))
368			return (-1);
369		buf[0] = msg_type;
370		buf[1] = ((msg_length >> 16) & 1);
371		buf[2] = (msg_length >> 8) & 0xff;
372		buf[3] = msg_length & 0xff;
373		break;
374
375	case IPPORT_SMB:
376		/*
377		 * SMB over TCP is like NetBIOS but the one byte
378		 * message type is always zero, and the length
379		 * part is three bytes.  It could actually use
380		 * longer messages, but this is conservative.
381		 */
382		if (msg_length >= (1 << 24))
383			return (-1);
384		buf[0] = msg_type;
385		buf[1] = (msg_length >> 16) & 0xff;
386		buf[2] = (msg_length >> 8) & 0xff;
387		buf[3] = msg_length & 0xff;
388		break;
389
390	default:
391		cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
392		return (-1);
393	}
394
395	return (0);
396}
397
398static void
399smb_request_init_command_mbuf(smb_request_t *sr)
400{
401
402	/*
403	 * Setup mbuf using the buffer we allocated.
404	 */
405	MBC_ATTACH_BUF(&sr->command, sr->sr_request_buf, sr->sr_req_length);
406
407	sr->command.flags = 0;
408	sr->command.shadow_of = NULL;
409}
410
411/*
412 * smb_request_cancel
413 *
414 * Handle a cancel for a request properly depending on the current request
415 * state.
416 */
417void
418smb_request_cancel(smb_request_t *sr)
419{
420	void (*cancel_method)(smb_request_t *) = NULL;
421
422	mutex_enter(&sr->sr_mutex);
423	switch (sr->sr_state) {
424
425	case SMB_REQ_STATE_INITIALIZING:
426	case SMB_REQ_STATE_SUBMITTED:
427	case SMB_REQ_STATE_ACTIVE:
428	case SMB_REQ_STATE_CLEANED_UP:
429		sr->sr_state = SMB_REQ_STATE_CANCELLED;
430		break;
431
432	case SMB_REQ_STATE_WAITING_EVENT:
433	case SMB_REQ_STATE_WAITING_LOCK:
434	case SMB_REQ_STATE_WAITING_AUTH:
435	case SMB_REQ_STATE_WAITING_PIPE:
436		/*
437		 * These are states that have a cancel_method.
438		 * Make the state change now, to ensure that
439		 * we call cancel_method exactly once.  Do the
440		 * method call below, after we drop sr_mutex.
441		 * When the cancelled request thread resumes,
442		 * it should re-take sr_mutex and set sr_state
443		 * to CANCELLED, then return STATUS_CANCELLED.
444		 */
445		sr->sr_state = SMB_REQ_STATE_CANCEL_PENDING;
446		cancel_method = sr->cancel_method;
447		VERIFY(cancel_method != NULL);
448		break;
449
450	case SMB_REQ_STATE_EVENT_OCCURRED:
451	case SMB_REQ_STATE_COMPLETED:
452	case SMB_REQ_STATE_CANCELLED:
453		/*
454		 * No action required for these states since the request
455		 * is completing.
456		 */
457		break;
458
459	case SMB_REQ_STATE_FREE:
460	default:
461		SMB_PANIC();
462	}
463	mutex_exit(&sr->sr_mutex);
464
465	if (cancel_method != NULL) {
466		cancel_method(sr);
467	}
468}
469
470/*
471 * smb_session_receiver
472 *
473 * Receives request from the network and dispatches them to a worker.
474 */
475void
476smb_session_receiver(smb_session_t *session)
477{
478	int	rc = 0;
479
480	SMB_SESSION_VALID(session);
481
482	session->s_thread = curthread;
483
484	if (session->s_local_port == IPPORT_NETBIOS_SSN) {
485		rc = smb_netbios_session_request(session);
486		if (rc != 0) {
487			smb_rwx_rwenter(&session->s_lock, RW_WRITER);
488			session->s_state = SMB_SESSION_STATE_DISCONNECTED;
489			smb_rwx_rwexit(&session->s_lock);
490			return;
491		}
492	}
493
494	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
495	session->s_state = SMB_SESSION_STATE_ESTABLISHED;
496	smb_rwx_rwexit(&session->s_lock);
497
498	(void) smb_session_reader(session);
499
500	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
501	session->s_state = SMB_SESSION_STATE_DISCONNECTED;
502	smb_rwx_rwexit(&session->s_lock);
503
504	smb_soshutdown(session->sock);
505
506	DTRACE_PROBE2(session__drop, struct session *, session, int, rc);
507
508	smb_session_cancel(session);
509	/*
510	 * At this point everything related to the session should have been
511	 * cleaned up and we expect that nothing will attempt to use the
512	 * socket.
513	 */
514}
515
516/*
517 * smb_session_disconnect
518 *
519 * Disconnects the session passed in.
520 */
521void
522smb_session_disconnect(smb_session_t *session)
523{
524	SMB_SESSION_VALID(session);
525
526	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
527	switch (session->s_state) {
528	case SMB_SESSION_STATE_INITIALIZED:
529	case SMB_SESSION_STATE_CONNECTED:
530	case SMB_SESSION_STATE_ESTABLISHED:
531	case SMB_SESSION_STATE_NEGOTIATED:
532		smb_soshutdown(session->sock);
533		session->s_state = SMB_SESSION_STATE_DISCONNECTED;
534		_NOTE(FALLTHRU)
535	case SMB_SESSION_STATE_DISCONNECTED:
536	case SMB_SESSION_STATE_TERMINATED:
537		break;
538	}
539	smb_rwx_rwexit(&session->s_lock);
540}
541
542/*
543 * Read and process SMB requests.
544 *
545 * Returns:
546 *	0	Success
547 *	1	Unable to read transport header
548 *	2	Invalid transport header type
549 *	3	Invalid SMB length (too small)
550 *	4	Unable to read SMB header
551 *	5	Invalid SMB header (bad magic number)
552 *	6	Unable to read SMB data
553 */
554static int
555smb_session_reader(smb_session_t *session)
556{
557	smb_server_t	*sv;
558	smb_request_t	*sr = NULL;
559	smb_xprt_t	hdr;
560	uint8_t		*req_buf;
561	uint32_t	resid;
562	int		rc;
563
564	sv = session->s_server;
565
566	for (;;) {
567
568		rc = smb_session_xprt_gethdr(session, &hdr);
569		if (rc)
570			return (rc);
571
572		DTRACE_PROBE2(session__receive__xprthdr, session_t *, session,
573		    smb_xprt_t *, &hdr);
574
575		if (hdr.xh_type != SESSION_MESSAGE) {
576			/*
577			 * Anything other than SESSION_MESSAGE or
578			 * SESSION_KEEP_ALIVE is an error.  A SESSION_REQUEST
579			 * may indicate a new session request but we need to
580			 * close this session and we can treat it as an error
581			 * here.
582			 */
583			if (hdr.xh_type == SESSION_KEEP_ALIVE) {
584				session->keep_alive = smb_keep_alive;
585				continue;
586			}
587			return (EPROTO);
588		}
589
590		if (hdr.xh_length == 0) {
591			/* zero length is another form of keep alive */
592			session->keep_alive = smb_keep_alive;
593			continue;
594		}
595
596		if (hdr.xh_length < SMB_HEADER_LEN)
597			return (EPROTO);
598		if (hdr.xh_length > session->cmd_max_bytes)
599			return (EPROTO);
600
601		session->keep_alive = smb_keep_alive;
602
603		/*
604		 * Allocate a request context, read the whole message.
605		 * If the request alloc fails, we've disconnected and
606		 * won't be able to send the reply anyway, so bail now.
607		 */
608		if ((sr = smb_request_alloc(session, hdr.xh_length)) == NULL)
609			break;
610
611		req_buf = (uint8_t *)sr->sr_request_buf;
612		resid = hdr.xh_length;
613
614		rc = smb_sorecv(session->sock, req_buf, resid);
615		if (rc) {
616			smb_request_free(sr);
617			break;
618		}
619
620		/* accounting: received bytes */
621		smb_server_add_rxb(sv,
622		    (int64_t)(hdr.xh_length + NETBIOS_HDR_SZ));
623
624		/*
625		 * Initialize command MBC to represent the received data.
626		 */
627		smb_request_init_command_mbuf(sr);
628
629		DTRACE_PROBE1(session__receive__smb, smb_request_t *, sr);
630
631		rc = session->newrq_func(sr);
632		sr = NULL;	/* enqueued or freed */
633		if (rc != 0)
634			break;
635	}
636	return (rc);
637}
638
639/*
640 * This is the initial handler for new smb requests, called from
641 * from smb_session_reader when we have not yet seen any requests.
642 * The first SMB request must be "negotiate", which determines
643 * which protocol and dialect we'll be using.  That's the ONLY
644 * request type handled here, because with all later requests,
645 * we know the protocol and handle those with either the SMB1 or
646 * SMB2 handlers:  smb1sr_post() or smb2sr_post().
647 * Those do NOT allow SMB negotiate, because that's only allowed
648 * as the first request on new session.
649 *
650 * This and other "post a request" handlers must either enqueue
651 * the new request for the session taskq, or smb_request_free it
652 * (in case we've decided to drop this connection).  In this
653 * (special) new request handler, we always free the request.
654 */
655static int
656smbsr_newrq_initial(smb_request_t *sr)
657{
658	uint32_t magic;
659	int rc = EPROTO;
660
661	mutex_enter(&sr->sr_mutex);
662	sr->sr_state = SMB_REQ_STATE_ACTIVE;
663	mutex_exit(&sr->sr_mutex);
664
665	magic = SMB_READ_PROTOCOL(sr->sr_request_buf);
666	if (magic == SMB_PROTOCOL_MAGIC)
667		rc = smb1_newrq_negotiate(sr);
668	if (magic == SMB2_PROTOCOL_MAGIC)
669		rc = smb2_newrq_negotiate(sr);
670
671	mutex_enter(&sr->sr_mutex);
672	sr->sr_state = SMB_REQ_STATE_COMPLETED;
673	mutex_exit(&sr->sr_mutex);
674
675	smb_request_free(sr);
676	return (rc);
677}
678
679/*
680 * Port will be IPPORT_NETBIOS_SSN or IPPORT_SMB.
681 */
682smb_session_t *
683smb_session_create(ksocket_t new_so, uint16_t port, smb_server_t *sv,
684    int family)
685{
686	struct sockaddr_in	sin;
687	socklen_t		slen;
688	struct sockaddr_in6	sin6;
689	smb_session_t		*session;
690	int64_t			now;
691	uint16_t		rport;
692
693	session = kmem_cache_alloc(smb_cache_session, KM_SLEEP);
694	bzero(session, sizeof (smb_session_t));
695
696	if (smb_idpool_constructor(&session->s_uid_pool)) {
697		kmem_cache_free(smb_cache_session, session);
698		return (NULL);
699	}
700	if (smb_idpool_constructor(&session->s_tid_pool)) {
701		smb_idpool_destructor(&session->s_uid_pool);
702		kmem_cache_free(smb_cache_session, session);
703		return (NULL);
704	}
705
706	now = ddi_get_lbolt64();
707
708	session->s_kid = SMB_NEW_KID();
709	session->s_state = SMB_SESSION_STATE_INITIALIZED;
710	session->native_os = NATIVE_OS_UNKNOWN;
711	session->opentime = now;
712	session->keep_alive = smb_keep_alive;
713	session->activity_timestamp = now;
714
715	smb_session_genkey(session);
716
717	mutex_init(&session->s_credits_mutex, NULL, MUTEX_DEFAULT, NULL);
718
719	smb_slist_constructor(&session->s_req_list, sizeof (smb_request_t),
720	    offsetof(smb_request_t, sr_session_lnd));
721
722	smb_llist_constructor(&session->s_user_list, sizeof (smb_user_t),
723	    offsetof(smb_user_t, u_lnd));
724
725	smb_llist_constructor(&session->s_tree_list, sizeof (smb_tree_t),
726	    offsetof(smb_tree_t, t_lnd));
727
728	smb_llist_constructor(&session->s_xa_list, sizeof (smb_xa_t),
729	    offsetof(smb_xa_t, xa_lnd));
730
731	smb_net_txl_constructor(&session->s_txlst);
732
733	smb_rwx_init(&session->s_lock);
734
735	if (new_so != NULL) {
736		if (family == AF_INET) {
737			slen = sizeof (sin);
738			(void) ksocket_getsockname(new_so,
739			    (struct sockaddr *)&sin, &slen, CRED());
740			bcopy(&sin.sin_addr,
741			    &session->local_ipaddr.au_addr.au_ipv4,
742			    sizeof (in_addr_t));
743			slen = sizeof (sin);
744			(void) ksocket_getpeername(new_so,
745			    (struct sockaddr *)&sin, &slen, CRED());
746			bcopy(&sin.sin_addr,
747			    &session->ipaddr.au_addr.au_ipv4,
748			    sizeof (in_addr_t));
749			rport = sin.sin_port;
750		} else {
751			slen = sizeof (sin6);
752			(void) ksocket_getsockname(new_so,
753			    (struct sockaddr *)&sin6, &slen, CRED());
754			bcopy(&sin6.sin6_addr,
755			    &session->local_ipaddr.au_addr.au_ipv6,
756			    sizeof (in6_addr_t));
757			slen = sizeof (sin6);
758			(void) ksocket_getpeername(new_so,
759			    (struct sockaddr *)&sin6, &slen, CRED());
760			bcopy(&sin6.sin6_addr,
761			    &session->ipaddr.au_addr.au_ipv6,
762			    sizeof (in6_addr_t));
763			rport = sin6.sin6_port;
764		}
765		session->ipaddr.a_family = family;
766		session->local_ipaddr.a_family = family;
767		session->s_local_port = port;
768		session->s_remote_port = ntohs(rport);
769		session->sock = new_so;
770		(void) smb_inet_ntop(&session->ipaddr,
771		    session->ip_addr_str, INET6_ADDRSTRLEN);
772		if (port == IPPORT_NETBIOS_SSN)
773			smb_server_inc_nbt_sess(sv);
774		else
775			smb_server_inc_tcp_sess(sv);
776	}
777	session->s_server = sv;
778	smb_server_get_cfg(sv, &session->s_cfg);
779	session->s_srqueue = &sv->sv_srqueue;
780
781	/*
782	 * The initial new request handler is special,
783	 * and only accepts negotiation requests.
784	 */
785	session->newrq_func = smbsr_newrq_initial;
786
787	/* These may increase in SMB2 negotiate. */
788	session->cmd_max_bytes = SMB_REQ_MAX_SIZE;
789	session->reply_max_bytes = SMB_REQ_MAX_SIZE;
790
791	session->s_magic = SMB_SESSION_MAGIC;
792	return (session);
793}
794
795void
796smb_session_delete(smb_session_t *session)
797{
798
799	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
800
801	if (session->sign_fini != NULL)
802		session->sign_fini(session);
803
804	if (session->signing.mackey != NULL) {
805		kmem_free(session->signing.mackey,
806		    session->signing.mackey_len);
807	}
808
809	session->s_magic = 0;
810
811	smb_rwx_destroy(&session->s_lock);
812	smb_net_txl_destructor(&session->s_txlst);
813
814	mutex_destroy(&session->s_credits_mutex);
815
816	smb_slist_destructor(&session->s_req_list);
817	smb_llist_destructor(&session->s_tree_list);
818	smb_llist_destructor(&session->s_user_list);
819	smb_llist_destructor(&session->s_xa_list);
820
821	ASSERT(session->s_tree_cnt == 0);
822	ASSERT(session->s_file_cnt == 0);
823	ASSERT(session->s_dir_cnt == 0);
824
825	smb_idpool_destructor(&session->s_tid_pool);
826	smb_idpool_destructor(&session->s_uid_pool);
827	if (session->sock != NULL) {
828		if (session->s_local_port == IPPORT_NETBIOS_SSN)
829			smb_server_dec_nbt_sess(session->s_server);
830		else
831			smb_server_dec_tcp_sess(session->s_server);
832		smb_sodestroy(session->sock);
833	}
834	kmem_cache_free(smb_cache_session, session);
835}
836
837static void
838smb_session_cancel(smb_session_t *session)
839{
840	smb_xa_t	*xa, *nextxa;
841
842	/* All the request currently being treated must be canceled. */
843	smb_session_cancel_requests(session, NULL, NULL);
844
845	/*
846	 * We wait for the completion of all the requests associated with
847	 * this session.
848	 */
849	smb_slist_wait_for_empty(&session->s_req_list);
850
851	/*
852	 * At this point the reference count of the users, trees, files,
853	 * directories should be zero. It should be possible to destroy them
854	 * without any problem.
855	 */
856	xa = smb_llist_head(&session->s_xa_list);
857	while (xa) {
858		nextxa = smb_llist_next(&session->s_xa_list, xa);
859		smb_xa_close(xa);
860		xa = nextxa;
861	}
862
863	smb_session_logoff(session);
864}
865
866/*
867 * Cancel requests.  If a non-null tree is specified, only requests specific
868 * to that tree will be cancelled.  If a non-null sr is specified, that sr
869 * will be not be cancelled - this would typically be the caller's sr.
870 */
871void
872smb_session_cancel_requests(
873    smb_session_t	*session,
874    smb_tree_t		*tree,
875    smb_request_t	*exclude_sr)
876{
877	smb_request_t	*sr;
878
879	smb_slist_enter(&session->s_req_list);
880	sr = smb_slist_head(&session->s_req_list);
881
882	while (sr) {
883		ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
884		if ((sr != exclude_sr) &&
885		    (tree == NULL || sr->tid_tree == tree))
886			smb_request_cancel(sr);
887
888		sr = smb_slist_next(&session->s_req_list, sr);
889	}
890
891	smb_slist_exit(&session->s_req_list);
892}
893
894/*
895 * Find a user on the specified session by SMB UID.
896 */
897smb_user_t *
898smb_session_lookup_uid(smb_session_t *session, uint16_t uid)
899{
900	return (smb_session_lookup_uid_st(session, uid,
901	    SMB_USER_STATE_LOGGED_ON));
902}
903
904smb_user_t *
905smb_session_lookup_uid_st(smb_session_t *session, uint16_t uid,
906    smb_user_state_t st)
907{
908	smb_user_t	*user;
909	smb_llist_t	*user_list;
910
911	SMB_SESSION_VALID(session);
912
913	user_list = &session->s_user_list;
914	smb_llist_enter(user_list, RW_READER);
915
916	user = smb_llist_head(user_list);
917	while (user) {
918		SMB_USER_VALID(user);
919		ASSERT(user->u_session == session);
920
921		if (user->u_uid == uid && user->u_state == st) {
922			smb_user_hold_internal(user);
923			break;
924		}
925
926		user = smb_llist_next(user_list, user);
927	}
928
929	smb_llist_exit(user_list);
930	return (user);
931}
932
933void
934smb_session_post_user(smb_session_t *session, smb_user_t *user)
935{
936	SMB_USER_VALID(user);
937	ASSERT(user->u_refcnt == 0);
938	ASSERT(user->u_state == SMB_USER_STATE_LOGGED_OFF);
939	ASSERT(user->u_session == session);
940
941	smb_llist_post(&session->s_user_list, user, smb_user_delete);
942}
943
944/*
945 * Find a tree by tree-id.
946 */
947smb_tree_t *
948smb_session_lookup_tree(
949    smb_session_t	*session,
950    uint16_t		tid)
951
952{
953	smb_tree_t	*tree;
954
955	SMB_SESSION_VALID(session);
956
957	smb_llist_enter(&session->s_tree_list, RW_READER);
958	tree = smb_llist_head(&session->s_tree_list);
959
960	while (tree) {
961		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
962		ASSERT(tree->t_session == session);
963
964		if (tree->t_tid == tid) {
965			if (smb_tree_hold(tree)) {
966				smb_llist_exit(&session->s_tree_list);
967				return (tree);
968			} else {
969				smb_llist_exit(&session->s_tree_list);
970				return (NULL);
971			}
972		}
973
974		tree = smb_llist_next(&session->s_tree_list, tree);
975	}
976
977	smb_llist_exit(&session->s_tree_list);
978	return (NULL);
979}
980
981/*
982 * Find the first connected tree that matches the specified sharename.
983 * If the specified tree is NULL the search starts from the beginning of
984 * the user's tree list.  If a tree is provided the search starts just
985 * after that tree.
986 */
987smb_tree_t *
988smb_session_lookup_share(
989    smb_session_t	*session,
990    const char		*sharename,
991    smb_tree_t		*tree)
992{
993	SMB_SESSION_VALID(session);
994	ASSERT(sharename);
995
996	smb_llist_enter(&session->s_tree_list, RW_READER);
997
998	if (tree) {
999		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1000		ASSERT(tree->t_session == session);
1001		tree = smb_llist_next(&session->s_tree_list, tree);
1002	} else {
1003		tree = smb_llist_head(&session->s_tree_list);
1004	}
1005
1006	while (tree) {
1007		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1008		ASSERT(tree->t_session == session);
1009		if (smb_strcasecmp(tree->t_sharename, sharename, 0) == 0) {
1010			if (smb_tree_hold(tree)) {
1011				smb_llist_exit(&session->s_tree_list);
1012				return (tree);
1013			}
1014		}
1015		tree = smb_llist_next(&session->s_tree_list, tree);
1016	}
1017
1018	smb_llist_exit(&session->s_tree_list);
1019	return (NULL);
1020}
1021
1022/*
1023 * Find the first connected tree that matches the specified volume name.
1024 * If the specified tree is NULL the search starts from the beginning of
1025 * the user's tree list.  If a tree is provided the search starts just
1026 * after that tree.
1027 */
1028smb_tree_t *
1029smb_session_lookup_volume(
1030    smb_session_t	*session,
1031    const char		*name,
1032    smb_tree_t		*tree)
1033{
1034	SMB_SESSION_VALID(session);
1035	ASSERT(name);
1036
1037	smb_llist_enter(&session->s_tree_list, RW_READER);
1038
1039	if (tree) {
1040		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1041		ASSERT(tree->t_session == session);
1042		tree = smb_llist_next(&session->s_tree_list, tree);
1043	} else {
1044		tree = smb_llist_head(&session->s_tree_list);
1045	}
1046
1047	while (tree) {
1048		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1049		ASSERT(tree->t_session == session);
1050
1051		if (smb_strcasecmp(tree->t_volume, name, 0) == 0) {
1052			if (smb_tree_hold(tree)) {
1053				smb_llist_exit(&session->s_tree_list);
1054				return (tree);
1055			}
1056		}
1057
1058		tree = smb_llist_next(&session->s_tree_list, tree);
1059	}
1060
1061	smb_llist_exit(&session->s_tree_list);
1062	return (NULL);
1063}
1064
1065/*
1066 * Disconnect all trees that match the specified client process-id.
1067 */
1068void
1069smb_session_close_pid(
1070    smb_session_t	*session,
1071    uint32_t		pid)
1072{
1073	smb_tree_t	*tree;
1074
1075	SMB_SESSION_VALID(session);
1076
1077	tree = smb_session_get_tree(session, NULL);
1078	while (tree) {
1079		smb_tree_t *next;
1080		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1081		ASSERT(tree->t_session == session);
1082		smb_tree_close_pid(tree, pid);
1083		next = smb_session_get_tree(session, tree);
1084		smb_tree_release(tree);
1085		tree = next;
1086	}
1087}
1088
1089static void
1090smb_session_tree_dtor(void *t)
1091{
1092	smb_tree_t	*tree = (smb_tree_t *)t;
1093
1094	smb_tree_disconnect(tree, B_TRUE);
1095	/* release the ref acquired during the traversal loop */
1096	smb_tree_release(tree);
1097}
1098
1099
1100/*
1101 * Disconnect all trees that this user has connected.
1102 */
1103void
1104smb_session_disconnect_owned_trees(
1105    smb_session_t	*session,
1106    smb_user_t		*owner)
1107{
1108	smb_tree_t	*tree;
1109	smb_llist_t	*tree_list = &session->s_tree_list;
1110
1111	SMB_SESSION_VALID(session);
1112	SMB_USER_VALID(owner);
1113
1114	smb_llist_enter(tree_list, RW_READER);
1115
1116	tree = smb_llist_head(tree_list);
1117	while (tree) {
1118		if ((tree->t_owner == owner) &&
1119		    smb_tree_hold(tree)) {
1120			/*
1121			 * smb_tree_hold() succeeded, hence we are in state
1122			 * SMB_TREE_STATE_CONNECTED; schedule this tree
1123			 * for asynchronous disconnect, which will fire
1124			 * after we drop the llist traversal lock.
1125			 */
1126			smb_llist_post(tree_list, tree, smb_session_tree_dtor);
1127		}
1128		tree = smb_llist_next(tree_list, tree);
1129	}
1130
1131	/* drop the lock and flush the dtor queue */
1132	smb_llist_exit(tree_list);
1133}
1134
1135/*
1136 * Disconnect all trees that this user has connected.
1137 */
1138void
1139smb_session_disconnect_trees(
1140    smb_session_t	*session)
1141{
1142	smb_tree_t	*tree;
1143
1144	SMB_SESSION_VALID(session);
1145
1146	tree = smb_session_get_tree(session, NULL);
1147	while (tree) {
1148		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1149		ASSERT(tree->t_session == session);
1150		smb_tree_disconnect(tree, B_TRUE);
1151		smb_tree_release(tree);
1152		tree = smb_session_get_tree(session, NULL);
1153	}
1154}
1155
1156/*
1157 * Disconnect all trees that match the specified share name.
1158 */
1159void
1160smb_session_disconnect_share(
1161    smb_session_t	*session,
1162    const char		*sharename)
1163{
1164	smb_tree_t	*tree;
1165	smb_tree_t	*next;
1166
1167	SMB_SESSION_VALID(session);
1168
1169	tree = smb_session_lookup_share(session, sharename, NULL);
1170	while (tree) {
1171		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1172		ASSERT(tree->t_session == session);
1173		smb_session_cancel_requests(session, tree, NULL);
1174		smb_tree_disconnect(tree, B_TRUE);
1175		next = smb_session_lookup_share(session, sharename, tree);
1176		smb_tree_release(tree);
1177		tree = next;
1178	}
1179}
1180
1181void
1182smb_session_post_tree(smb_session_t *session, smb_tree_t *tree)
1183{
1184	SMB_SESSION_VALID(session);
1185	SMB_TREE_VALID(tree);
1186	ASSERT0(tree->t_refcnt);
1187	ASSERT(tree->t_state == SMB_TREE_STATE_DISCONNECTED);
1188	ASSERT(tree->t_session == session);
1189
1190	smb_llist_post(&session->s_tree_list, tree, smb_tree_dealloc);
1191}
1192
1193/*
1194 * Get the next connected tree in the list.  A reference is taken on
1195 * the tree, which can be released later with smb_tree_release().
1196 *
1197 * If the specified tree is NULL the search starts from the beginning of
1198 * the tree list.  If a tree is provided the search starts just after
1199 * that tree.
1200 *
1201 * Returns NULL if there are no connected trees in the list.
1202 */
1203static smb_tree_t *
1204smb_session_get_tree(
1205    smb_session_t	*session,
1206    smb_tree_t		*tree)
1207{
1208	smb_llist_t	*tree_list;
1209
1210	SMB_SESSION_VALID(session);
1211	tree_list = &session->s_tree_list;
1212
1213	smb_llist_enter(tree_list, RW_READER);
1214
1215	if (tree) {
1216		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1217		tree = smb_llist_next(tree_list, tree);
1218	} else {
1219		tree = smb_llist_head(tree_list);
1220	}
1221
1222	while (tree) {
1223		if (smb_tree_hold(tree))
1224			break;
1225
1226		tree = smb_llist_next(tree_list, tree);
1227	}
1228
1229	smb_llist_exit(tree_list);
1230	return (tree);
1231}
1232
1233/*
1234 * Logoff all users associated with the specified session.
1235 */
1236static void
1237smb_session_logoff(smb_session_t *session)
1238{
1239	smb_user_t	*user;
1240
1241	SMB_SESSION_VALID(session);
1242
1243	smb_session_disconnect_trees(session);
1244
1245	smb_llist_enter(&session->s_user_list, RW_READER);
1246
1247	user = smb_llist_head(&session->s_user_list);
1248	while (user) {
1249		SMB_USER_VALID(user);
1250		ASSERT(user->u_session == session);
1251
1252		switch (user->u_state) {
1253		case SMB_USER_STATE_LOGGING_ON:
1254		case SMB_USER_STATE_LOGGED_ON:
1255			smb_user_hold_internal(user);
1256			smb_user_logoff(user);
1257			smb_user_release(user);
1258			break;
1259
1260		case SMB_USER_STATE_LOGGED_OFF:
1261		case SMB_USER_STATE_LOGGING_OFF:
1262			break;
1263
1264		default:
1265			ASSERT(0);
1266			break;
1267		}
1268
1269		user = smb_llist_next(&session->s_user_list, user);
1270	}
1271
1272	smb_llist_exit(&session->s_user_list);
1273}
1274
1275/*
1276 * Copy the session workstation/client name to buf.  If the workstation
1277 * is an empty string (which it will be on TCP connections), use the
1278 * client IP address.
1279 */
1280void
1281smb_session_getclient(smb_session_t *sn, char *buf, size_t buflen)
1282{
1283
1284	*buf = '\0';
1285
1286	if (sn->workstation[0] != '\0') {
1287		(void) strlcpy(buf, sn->workstation, buflen);
1288		return;
1289	}
1290
1291	(void) strlcpy(buf, sn->ip_addr_str, buflen);
1292}
1293
1294/*
1295 * Check whether or not the specified client name is the client of this
1296 * session.  The name may be in UNC format (\\CLIENT).
1297 *
1298 * A workstation/client name is setup on NBT connections as part of the
1299 * NetBIOS session request but that isn't available on TCP connections.
1300 * If the session doesn't have a client name we typically return the
1301 * client IP address as the workstation name on MSRPC requests.  So we
1302 * check for the IP address here in addition to the workstation name.
1303 */
1304boolean_t
1305smb_session_isclient(smb_session_t *sn, const char *client)
1306{
1307
1308	client += strspn(client, "\\");
1309
1310	if (smb_strcasecmp(client, sn->workstation, 0) == 0)
1311		return (B_TRUE);
1312
1313	if (smb_strcasecmp(client, sn->ip_addr_str, 0) == 0)
1314		return (B_TRUE);
1315
1316	return (B_FALSE);
1317}
1318
1319/*
1320 * smb_request_alloc
1321 *
1322 * Allocate an smb_request_t structure from the kmem_cache.  Partially
1323 * initialize the found/new request.
1324 *
1325 * Returns pointer to a request, or NULL if the session state is
1326 * one in which new requests are no longer allowed.
1327 */
1328smb_request_t *
1329smb_request_alloc(smb_session_t *session, int req_length)
1330{
1331	smb_request_t	*sr;
1332
1333	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
1334	ASSERT(req_length <= session->cmd_max_bytes);
1335
1336	sr = kmem_cache_alloc(smb_cache_request, KM_SLEEP);
1337
1338	/*
1339	 * Future:  Use constructor to pre-initialize some fields.  For now
1340	 * there are so many fields that it is easiest just to zero the
1341	 * whole thing and start over.
1342	 */
1343	bzero(sr, sizeof (smb_request_t));
1344
1345	mutex_init(&sr->sr_mutex, NULL, MUTEX_DEFAULT, NULL);
1346	cv_init(&sr->sr_ncr.nc_cv, NULL, CV_DEFAULT, NULL);
1347	smb_srm_init(sr);
1348	sr->session = session;
1349	sr->sr_server = session->s_server;
1350	sr->sr_gmtoff = session->s_server->si_gmtoff;
1351	sr->sr_cfg = &session->s_cfg;
1352	sr->command.max_bytes = req_length;
1353	sr->reply.max_bytes = session->reply_max_bytes;
1354	sr->sr_req_length = req_length;
1355	if (req_length)
1356		sr->sr_request_buf = kmem_alloc(req_length, KM_SLEEP);
1357	sr->sr_magic = SMB_REQ_MAGIC;
1358	sr->sr_state = SMB_REQ_STATE_INITIALIZING;
1359
1360	/*
1361	 * Only allow new SMB requests in some states.
1362	 */
1363	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
1364	switch (session->s_state) {
1365	case SMB_SESSION_STATE_CONNECTED:
1366	case SMB_SESSION_STATE_INITIALIZED:
1367	case SMB_SESSION_STATE_ESTABLISHED:
1368	case SMB_SESSION_STATE_NEGOTIATED:
1369		smb_slist_insert_tail(&session->s_req_list, sr);
1370		break;
1371
1372	default:
1373		ASSERT(0);
1374		/* FALLTHROUGH */
1375	case SMB_SESSION_STATE_DISCONNECTED:
1376	case SMB_SESSION_STATE_TERMINATED:
1377		/* Disallow new requests in these states. */
1378		if (sr->sr_request_buf)
1379			kmem_free(sr->sr_request_buf, sr->sr_req_length);
1380		sr->session = NULL;
1381		sr->sr_magic = 0;
1382		mutex_destroy(&sr->sr_mutex);
1383		kmem_cache_free(smb_cache_request, sr);
1384		sr = NULL;
1385		break;
1386	}
1387	smb_rwx_rwexit(&session->s_lock);
1388
1389	return (sr);
1390}
1391
1392/*
1393 * smb_request_free
1394 *
1395 * release the memories which have been allocated for a smb request.
1396 */
1397void
1398smb_request_free(smb_request_t *sr)
1399{
1400	ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
1401	ASSERT(sr->session);
1402	ASSERT(sr->r_xa == NULL);
1403	ASSERT(sr->sr_ncr.nc_fname == NULL);
1404
1405	if (sr->fid_ofile != NULL) {
1406		smb_ofile_request_complete(sr->fid_ofile);
1407		smb_ofile_release(sr->fid_ofile);
1408	}
1409
1410	if (sr->tid_tree != NULL)
1411		smb_tree_release(sr->tid_tree);
1412
1413	if (sr->uid_user != NULL)
1414		smb_user_release(sr->uid_user);
1415
1416	smb_slist_remove(&sr->session->s_req_list, sr);
1417
1418	sr->session = NULL;
1419
1420	smb_srm_fini(sr);
1421
1422	if (sr->sr_request_buf)
1423		kmem_free(sr->sr_request_buf, sr->sr_req_length);
1424	if (sr->command.chain)
1425		m_freem(sr->command.chain);
1426	if (sr->reply.chain)
1427		m_freem(sr->reply.chain);
1428	if (sr->raw_data.chain)
1429		m_freem(sr->raw_data.chain);
1430
1431	sr->sr_magic = 0;
1432	cv_destroy(&sr->sr_ncr.nc_cv);
1433	mutex_destroy(&sr->sr_mutex);
1434	kmem_cache_free(smb_cache_request, sr);
1435}
1436
1437boolean_t
1438smb_session_oplocks_enable(smb_session_t *session)
1439{
1440	SMB_SESSION_VALID(session);
1441	if (session->s_cfg.skc_oplock_enable == 0)
1442		return (B_FALSE);
1443	else
1444		return (B_TRUE);
1445}
1446
1447boolean_t
1448smb_session_levelII_oplocks(smb_session_t *session)
1449{
1450	SMB_SESSION_VALID(session);
1451
1452	/* Clients using SMB2 and later always know about oplocks. */
1453	if (session->dialect > NT_LM_0_12)
1454		return (B_TRUE);
1455
1456	/* Older clients only do Level II oplocks if negotiated. */
1457	if ((session->capabilities & CAP_LEVEL_II_OPLOCKS) != 0)
1458		return (B_TRUE);
1459
1460	return (B_FALSE);
1461}
1462
1463/*
1464 * smb_session_oplock_break
1465 *
1466 * Send an oplock break request to the client,
1467 * recalling some cache delegation.
1468 */
1469void
1470smb_session_oplock_break(smb_request_t *sr, uint8_t brk)
1471{
1472	smb_session_t	*session = sr->session;
1473	mbuf_chain_t	*mbc = &sr->reply;
1474
1475	SMB_SESSION_VALID(session);
1476
1477	/*
1478	 * Build the break message in sr->reply and then send it.
1479	 * The mbc is free'd later, in smb_request_free().
1480	 */
1481	mbc->max_bytes = MLEN;
1482	if (session->dialect <= NT_LM_0_12) {
1483		smb1_oplock_break_notification(sr, brk);
1484	} else {
1485		smb2_oplock_break_notification(sr, brk);
1486	}
1487
1488	(void) smb_session_send(session, 0, mbc);
1489}
1490
1491static void
1492smb_session_genkey(smb_session_t *session)
1493{
1494	uint8_t		tmp_key[SMB_CHALLENGE_SZ];
1495
1496	(void) random_get_pseudo_bytes(tmp_key, SMB_CHALLENGE_SZ);
1497	bcopy(tmp_key, &session->challenge_key, SMB_CHALLENGE_SZ);
1498	session->challenge_len = SMB_CHALLENGE_SZ;
1499
1500	(void) random_get_pseudo_bytes(tmp_key, 4);
1501	session->sesskey = tmp_key[0] | tmp_key[1] << 8 |
1502	    tmp_key[2] << 16 | tmp_key[3] << 24;
1503}
1504