xref: /illumos-gate/usr/src/uts/common/smbsrv/smb_ktypes.h (revision eb1d736b1c19f6abeee90c921a9320b67fedd016)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  * Structures and type definitions for the SMB module.
28  */
29 
30 #ifndef _SMBSRV_SMB_KTYPES_H
31 #define	_SMBSRV_SMB_KTYPES_H
32 
33 #ifdef	__cplusplus
34 extern "C" {
35 #endif
36 
37 #include <sys/note.h>
38 #include <sys/systm.h>
39 #include <sys/param.h>
40 #include <sys/types.h>
41 #include <sys/synch.h>
42 #include <sys/taskq.h>
43 #include <sys/socket.h>
44 #include <sys/acl.h>
45 #include <sys/sdt.h>
46 #include <sys/stat.h>
47 #include <sys/vnode.h>
48 #include <sys/cred.h>
49 #include <netinet/in.h>
50 #include <sys/ksocket.h>
51 #include <sys/fem.h>
52 #include <sys/door.h>
53 #include <sys/extdirent.h>
54 #include <smbsrv/smb.h>
55 #include <smbsrv/smbinfo.h>
56 #include <smbsrv/mbuf.h>
57 #include <smbsrv/smb_sid.h>
58 #include <smbsrv/smb_xdr.h>
59 #include <smbsrv/netbios.h>
60 #include <smbsrv/smb_vops.h>
61 
62 struct smb_disp_entry;
63 struct smb_request;
64 struct smb_server;
65 struct smb_sd;
66 
67 int smb_noop(void *, size_t, int);
68 
69 #define	SMB_AUDIT_STACK_DEPTH	16
70 #define	SMB_AUDIT_BUF_MAX_REC	16
71 #define	SMB_AUDIT_NODE		0x00000001
72 
73 /*
74  * Maximum number of records returned in SMBsearch, SMBfind
75  * and SMBfindunique response. Value set to 10 for compatibility
76  * with Windows.
77  */
78 #define	SMB_MAX_SEARCH		10
79 
80 #define	SMB_SEARCH_ATTRIBUTES    \
81 	(FILE_ATTRIBUTE_HIDDEN | \
82 	FILE_ATTRIBUTE_SYSTEM |  \
83 	FILE_ATTRIBUTE_DIRECTORY)
84 
85 #define	SMB_SEARCH_HIDDEN(sattr) ((sattr) & FILE_ATTRIBUTE_HIDDEN)
86 #define	SMB_SEARCH_SYSTEM(sattr) ((sattr) & FILE_ATTRIBUTE_SYSTEM)
87 #define	SMB_SEARCH_DIRECTORY(sattr) ((sattr) & FILE_ATTRIBUTE_DIRECTORY)
88 #define	SMB_SEARCH_ALL(sattr) ((sattr) & SMB_SEARCH_ATTRIBUTES)
89 
90 typedef struct {
91 	uint32_t		anr_refcnt;
92 	int			anr_depth;
93 	pc_t			anr_stack[SMB_AUDIT_STACK_DEPTH];
94 } smb_audit_record_node_t;
95 
96 typedef struct {
97 	int			anb_index;
98 	int			anb_max_index;
99 	smb_audit_record_node_t	anb_records[SMB_AUDIT_BUF_MAX_REC];
100 } smb_audit_buf_node_t;
101 
102 #define	SMB_WORKER_PRIORITY	99
103 /*
104  * Thread State Machine
105  * --------------------
106  *
107  *			    T5			   T0
108  * smb_thread_destroy()	<-------+		+------- smb_thread_init()
109  *                              |		|
110  *				|		v
111  *			+-----------------------------+
112  *			|   SMB_THREAD_STATE_EXITED   |<---+
113  *			+-----------------------------+	   |
114  *				      | T1		   |
115  *				      v			   |
116  *			+-----------------------------+	   |
117  *			|  SMB_THREAD_STATE_STARTING  |	   |
118  *			+-----------------------------+	   |
119  *				     | T2		   | T4
120  *				     v			   |
121  *			+-----------------------------+	   |
122  *			|  SMB_THREAD_STATE_RUNNING   |	   |
123  *			+-----------------------------+	   |
124  *				     | T3		   |
125  *				     v			   |
126  *			+-----------------------------+	   |
127  *			|  SMB_THREAD_STATE_EXITING   |----+
128  *			+-----------------------------+
129  *
130  * Transition T0
131  *
132  *    This transition is executed in smb_thread_init().
133  *
134  * Transition T1
135  *
136  *    This transition is executed in smb_thread_start().
137  *
138  * Transition T2
139  *
140  *    This transition is executed by the thread itself when it starts running.
141  *
142  * Transition T3
143  *
144  *    This transition is executed by the thread itself in
145  *    smb_thread_entry_point() just before calling thread_exit().
146  *
147  *
148  * Transition T4
149  *
150  *    This transition is executed in smb_thread_stop().
151  *
152  * Transition T5
153  *
154  *    This transition is executed in smb_thread_destroy().
155  *
156  * Comments
157  * --------
158  *
159  *    The field smb_thread_aw_t contains a function pointer that knows how to
160  *    awake the thread. It is a temporary solution to work around the fact that
161  *    kernel threads (not part of a userspace process) cannot be signaled.
162  */
163 typedef enum smb_thread_state {
164 	SMB_THREAD_STATE_STARTING = 0,
165 	SMB_THREAD_STATE_RUNNING,
166 	SMB_THREAD_STATE_EXITING,
167 	SMB_THREAD_STATE_EXITED
168 } smb_thread_state_t;
169 
170 struct _smb_thread;
171 
172 typedef void (*smb_thread_ep_t)(struct _smb_thread *, void *ep_arg);
173 typedef void (*smb_thread_aw_t)(struct _smb_thread *, void *aw_arg);
174 
175 #define	SMB_THREAD_MAGIC	0x534D4254	/* SMBT */
176 
177 typedef struct _smb_thread {
178 	uint32_t		sth_magic;
179 	char			sth_name[16];
180 	smb_thread_state_t	sth_state;
181 	kthread_t		*sth_th;
182 	kt_did_t		sth_did;
183 	smb_thread_ep_t		sth_ep;
184 	void			*sth_ep_arg;
185 	smb_thread_aw_t		sth_aw;
186 	void			*sth_aw_arg;
187 	boolean_t		sth_kill;
188 	kmutex_t		sth_mtx;
189 	kcondvar_t		sth_cv;
190 } smb_thread_t;
191 
192 /*
193  * Pool of IDs
194  * -----------
195  *
196  *    A pool of IDs is a pool of 16 bit numbers. It is implemented as a bitmap.
197  *    A bit set to '1' indicates that that particular value has been allocated.
198  *    The allocation process is done shifting a bit through the whole bitmap.
199  *    The current position of that index bit is kept in the smb_idpool_t
200  *    structure and represented by a byte index (0 to buffer size minus 1) and
201  *    a bit index (0 to 7).
202  *
203  *    The pools start with a size of 8 bytes or 64 IDs. Each time the pool runs
204  *    out of IDs its current size is doubled until it reaches its maximum size
205  *    (8192 bytes or 65536 IDs). The IDs 0 and 65535 are never given out which
206  *    means that a pool can have a maximum number of 65534 IDs available.
207  */
208 #define	SMB_IDPOOL_MAGIC	0x4944504C	/* IDPL */
209 #define	SMB_IDPOOL_MIN_SIZE	64	/* Number of IDs to begin with */
210 #define	SMB_IDPOOL_MAX_SIZE	64 * 1024
211 
212 typedef struct smb_idpool {
213 	uint32_t	id_magic;
214 	kmutex_t	id_mutex;
215 	uint8_t		*id_pool;
216 	uint32_t	id_size;
217 	uint8_t		id_bit;
218 	uint8_t		id_bit_idx;
219 	uint32_t	id_idx;
220 	uint32_t	id_idx_msk;
221 	uint32_t	id_free_counter;
222 	uint32_t	id_max_free_counter;
223 } smb_idpool_t;
224 
225 /*
226  * Maximum size of a Transport Data Unit when CAP_LARGE_READX and
227  * CAP_LARGE_WRITEX are not set.  CAP_LARGE_READX/CAP_LARGE_WRITEX
228  * allow the payload to exceed the negotiated buffer size.
229  *     4 --> NBT/TCP Transport Header.
230  *    32 --> SMB Header
231  *     1 --> Word Count byte
232  *   510 --> Maximum Number of bytes of the Word Table (2 * 255)
233  *     2 --> Byte count of the data
234  * 65535 --> Maximum size of the data
235  * -----
236  * 66084
237  */
238 #define	SMB_REQ_MAX_SIZE	66560		/* 65KB */
239 #define	SMB_XPRT_MAX_SIZE	(SMB_REQ_MAX_SIZE + NETBIOS_HDR_SZ)
240 
241 #define	SMB_TXREQ_MAGIC		0X54524251	/* 'TREQ' */
242 typedef struct {
243 	uint32_t	tr_magic;
244 	list_node_t	tr_lnd;
245 	int		tr_len;
246 	uint8_t		tr_buf[SMB_XPRT_MAX_SIZE];
247 } smb_txreq_t;
248 
249 #define	SMB_TXLST_MAGIC		0X544C5354	/* 'TLST' */
250 typedef struct {
251 	uint32_t	tl_magic;
252 	kmutex_t	tl_mutex;
253 	boolean_t	tl_active;
254 	list_t		tl_list;
255 } smb_txlst_t;
256 
257 /*
258  * Maximum buffer size for NT is 37KB.  If all clients are Windows 2000, this
259  * can be changed to 64KB.  37KB must be used with a mix of NT/Windows 2000
260  * clients because NT loses directory entries when values greater than 37KB are
261  * used.
262  *
263  * Note: NBT_MAXBUF will be subtracted from the specified max buffer size to
264  * account for the NBT header.
265  */
266 #define	NBT_MAXBUF		8
267 #define	SMB_NT_MAXBUF		(37 * 1024)
268 
269 #define	OUTBUFSIZE		(65 * 1024)
270 #define	SMBHEADERSIZE		32
271 #define	SMBND_HASH_MASK		(0xFF)
272 #define	MAX_IOVEC		512
273 #define	MAX_READREF		(8 * 1024)
274 
275 #define	SMB_WORKER_MIN		4
276 #define	SMB_WORKER_DEFAULT	64
277 #define	SMB_WORKER_MAX		1024
278 
279 /*
280  * Fix align a pointer or offset appropriately so that fields will not
281  * cross word boundaries.
282  */
283 #define	PTRALIGN(x) \
284 	(((uintptr_t)(x) + (uintptr_t)(_POINTER_ALIGNMENT) - 1l) & \
285 	    ~((uintptr_t)(_POINTER_ALIGNMENT) - 1l))
286 
287 /*
288  * native os types are defined in win32/smbinfo.h
289  */
290 
291 /*
292  * All 4 different time / date formats that will bee seen in SMB
293  */
294 typedef struct {
295 	uint16_t	Day	: 5;
296 	uint16_t	Month	: 4;
297 	uint16_t	Year	: 7;
298 } SMB_DATE;
299 
300 typedef struct {
301 	uint16_t	TwoSeconds : 5;
302 	uint16_t	Minutes	   : 6;
303 	uint16_t	Hours	   : 5;
304 } SMB_TIME;
305 
306 
307 typedef uint32_t 	UTIME;		/* seconds since Jan 1 1970 */
308 
309 typedef struct smb_malloc_list {
310 	struct smb_malloc_list	*forw;
311 	struct smb_malloc_list	*back;
312 } smb_malloc_list;
313 
314 typedef struct smb_llist {
315 	krwlock_t	ll_lock;
316 	list_t		ll_list;
317 	uint32_t	ll_count;
318 	uint64_t	ll_wrop;
319 } smb_llist_t;
320 
321 typedef struct smb_slist {
322 	kmutex_t	sl_mutex;
323 	kcondvar_t	sl_cv;
324 	list_t		sl_list;
325 	uint32_t	sl_count;
326 	boolean_t	sl_waiting;
327 } smb_slist_t;
328 
329 typedef struct smb_session_list {
330 	krwlock_t	se_lock;
331 	uint64_t	se_wrop;
332 	struct {
333 		list_t		lst;
334 		uint32_t	count;
335 	} se_rdy;
336 	struct {
337 		list_t		lst;
338 		uint32_t	count;
339 	} se_act;
340 } smb_session_list_t;
341 
342 typedef struct {
343 	kcondvar_t	rwx_cv;
344 	kmutex_t	rwx_mutex;
345 	krwlock_t	rwx_lock;
346 	boolean_t	rwx_waiting;
347 } smb_rwx_t;
348 
349 /* NOTIFY CHANGE */
350 
351 typedef struct smb_notify_change_req {
352 	list_node_t		nc_lnd;
353 	struct smb_node		*nc_node;
354 	uint32_t		nc_reply_type;
355 	uint32_t		nc_flags;
356 } smb_notify_change_req_t;
357 
358 /*
359  * SMB operates over a NetBIOS-over-TCP transport (NBT) or directly
360  * over TCP, which is also known as direct hosted NetBIOS-less SMB
361  * or SMB-over-TCP.
362  *
363  * NBT messages have a 4-byte header that defines the message type
364  * (8-bits), a 7-bit flags field and a 17-bit length.
365  *
366  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
367  * |      TYPE     |     FLAGS   |E|            LENGTH             |
368  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
369  *
370  * 8-bit type      Defined in RFC 1002
371  * 7-bit flags     Bits 0-6 reserved (must be 0)
372  *                 Bit 7: Length extension bit (E)
373  * 17-bit length   Includes bit 7 of the flags byte
374  *
375  *
376  * SMB-over-TCP is defined to use a modified version of the NBT header
377  * containing an 8-bit message type and 24-bit message length.
378  *
379  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
380  * |      TYPE     |                  LENGTH                       |
381  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
382  *
383  * 8-bit type      Must be 0
384  * 24-bit length
385  *
386  * The following structure is used to represent a generic, in-memory
387  * SMB transport header; it is not intended to map directly to either
388  * of the over-the-wire formats.
389  */
390 typedef struct {
391 	uint8_t		xh_type;
392 	uint32_t	xh_length;
393 } smb_xprt_t;
394 
395 int MBC_LENGTH(struct mbuf_chain *);
396 int MBC_MAXBYTES(struct mbuf_chain *);
397 void MBC_SETUP(struct mbuf_chain *, uint32_t);
398 void MBC_INIT(struct mbuf_chain *, uint32_t);
399 void MBC_FLUSH(struct mbuf_chain *);
400 void MBC_ATTACH_MBUF(struct mbuf_chain *, struct mbuf *);
401 void MBC_APPEND_MBUF(struct mbuf_chain *, struct mbuf *);
402 void MBC_ATTACH_BUF(struct mbuf_chain *MBC, unsigned char *BUF, int LEN);
403 int MBC_SHADOW_CHAIN(struct mbuf_chain *SUBMBC, struct mbuf_chain *MBC,
404     int OFF, int LEN);
405 
406 #define	MBC_ROOM_FOR(b, n) (((b)->chain_offset + (n)) <= (b)->max_bytes)
407 
408 /*
409  * ol_sess_id:
410  *
411  *	ID of the session holding the oplock (if an oplock was granted).
412  *
413  * ol_xthread:
414  *
415  *	Worker thread treating the command that was granted the oplock. Until
416  *	that thread is done with that command and has submitted the response
417  *	to the network stack, all the other threads will be suspended in
418  *	smb_oplock_enter(). They will be awaken when the worker thread
419  *	referenced in 'ol_xthread' calls smb_oplock_broadcast().
420  *
421  *	The purpose of this mechanism is to prevent another thread from
422  *	triggering a oplock break before the response conveying the grant
423  *	has been sent.
424  *
425  * ol_ofile
426  *
427  *	Open file that was granted the oplock.
428  *
429  * ol_waiters_count
430  *
431  *	Number of threads waiting for a call to smb_oplock_broadcast().
432  *
433  * ol_level
434  *
435  *	Level of the oplock granted.
436  */
437 typedef struct smb_oplock {
438 	uint64_t		ol_sess_id;
439 	kcondvar_t		ol_cv;
440 	kthread_t		*ol_xthread;
441 	struct smb_ofile	*ol_ofile;
442 	uint8_t			ol_level;
443 } smb_oplock_t;
444 
445 #define	DOS_ATTR_VALID	0x80000000
446 
447 #define	SMB_VFS_MAGIC	0x534D4256	/* 'SMBV' */
448 
449 typedef struct smb_vfs {
450 	uint32_t		sv_magic;
451 	list_node_t		sv_lnd;
452 	uint32_t		sv_refcnt;
453 	vfs_t			*sv_vfsp;
454 	vnode_t			*sv_rootvp;
455 } smb_vfs_t;
456 
457 typedef struct smb_unexport {
458 	list_node_t	ux_lnd;
459 	char		ux_sharename[MAXNAMELEN];
460 } smb_unexport_t;
461 
462 #define	SMB_NODE_MAGIC		0x4E4F4445	/* 'NODE' */
463 #define	SMB_NODE_VALID(p)	ASSERT((p)->n_magic == SMB_NODE_MAGIC)
464 
465 typedef enum {
466 	SMB_NODE_STATE_AVAILABLE = 0,
467 	SMB_NODE_STATE_OPLOCK_GRANTED,
468 	SMB_NODE_STATE_OPLOCK_BREAKING,
469 	SMB_NODE_STATE_DESTROYING
470 } smb_node_state_t;
471 
472 typedef struct smb_node {
473 	uint32_t		n_magic;
474 	krwlock_t		n_lock;
475 	kmutex_t		n_mutex;
476 	list_node_t		n_lnd;
477 	smb_node_state_t	n_state;
478 	uint32_t		n_refcnt;
479 	uint32_t		n_hashkey;
480 	smb_llist_t		*n_hash_bucket;
481 	uint32_t		n_orig_uid;
482 	uint32_t		n_open_count;
483 	smb_llist_t		n_ofile_list;
484 	smb_llist_t		n_lock_list;
485 	struct smb_ofile	*readonly_creator;
486 	volatile int		flags;	/* FILE_NOTIFY_CHANGE_* */
487 	volatile int		waiting_event; /* # of clients requesting FCN */
488 	smb_attr_t		attr;
489 	unsigned int		what;
490 	u_offset_t		n_size;
491 	smb_oplock_t		n_oplock;
492 	struct smb_node		*dir_snode; /* Directory of node */
493 	struct smb_node		*unnamed_stream_node; /* set in stream nodes */
494 	/* Credentials for delayed delete */
495 	cred_t			*delete_on_close_cred;
496 	uint32_t		n_delete_on_close_flags;
497 	char			od_name[MAXNAMELEN];
498 	vnode_t			*vp;
499 	smb_audit_buf_node_t	*n_audit_buf;
500 } smb_node_t;
501 
502 #define	NODE_FLAGS_NOTIFY_CHANGE	0x10000fff
503 #define	NODE_OPLOCKS_IN_FORCE		0x0000f000
504 #define	NODE_OPLOCK_NONE		0x00000000
505 #define	NODE_EXCLUSIVE_OPLOCK		0x00001000
506 #define	NODE_BATCH_OPLOCK		0x00002000
507 #define	NODE_LEVEL_II_OPLOCK		0x00003000
508 #define	NODE_CAP_LEVEL_II		0x00010000
509 #define	NODE_PROTOCOL_LOCK		0x00020000
510 #define	NODE_FLAGS_WRITE_THROUGH	0x00100000
511 #define	NODE_FLAGS_SYNCATIME		0x00200000
512 #define	NODE_FLAGS_LOCKED		0x00400000
513 #define	NODE_FLAGS_ATTR_VALID		0x00800000
514 #define	NODE_XATTR_DIR			0x01000000
515 #define	NODE_FLAGS_CREATED		0x04000000
516 #define	NODE_FLAGS_CHANGED		0x08000000
517 #define	NODE_FLAGS_WATCH_TREE		0x10000000
518 #define	NODE_FLAGS_SET_SIZE		0x20000000
519 #define	NODE_FLAGS_DELETE_ON_CLOSE	0x40000000
520 #define	NODE_FLAGS_EXECUTABLE		0x80000000
521 
522 #define	OPLOCK_TYPE(n)			((n)->flags & NODE_OPLOCKS_IN_FORCE)
523 #define	OPLOCKS_IN_FORCE(n)		(OPLOCK_TYPE(n) != NODE_OPLOCK_NONE)
524 #define	EXCLUSIVE_OPLOCK_IN_FORCE(n)	\
525 	(OPLOCK_TYPE(n) == NODE_EXCLUSIVE_OPLOCK)
526 #define	BATCH_OPLOCK_IN_FORCE(n)	(OPLOCK_TYPE(n) == NODE_BATCH_OPLOCK)
527 #define	LEVEL_II_OPLOCK_IN_FORCE(n)	(OPLOCK_TYPE(n) == NODE_LEVEL_II_OPLOCK)
528 
529 #define	SMB_NODE_VFS(node)	((node)->vp->v_vfsp)
530 #define	SMB_NODE_FSID(node)	((node)->vp->v_vfsp->vfs_fsid)
531 
532 /*
533  * Based on section 2.6.1.2 (Connection Management) of the June 13,
534  * 1996 CIFS spec, a server may terminate the transport connection
535  * due to inactivity. The client software is expected to be able to
536  * automatically reconnect to the server if this happens. Like much
537  * of the useful background information, this section appears to
538  * have been dropped from later revisions of the document.
539  *
540  * Each session has an activity timestamp that's updated whenever a
541  * request is dispatched. If the session is idle, i.e. receives no
542  * requests, for SMB_SESSION_INACTIVITY_TIMEOUT minutes it will be
543  * closed.
544  *
545  * Each session has an I/O semaphore to serialize communication with
546  * the client. For example, after receiving a raw-read request, the
547  * server is not allowed to send an oplock break to the client until
548  * after it has sent the raw-read data.
549  */
550 #define	SMB_SESSION_INACTIVITY_TIMEOUT		(15 * 60)
551 
552 #define	SMB_SESSION_OFILE_MAX				(16 * 1024)
553 
554 /*
555  * When a connection is set up we need to remember both the client
556  * (peer) IP address and the local IP address used to establish the
557  * connection. When a client connects with a vc number of zero, we
558  * are supposed to abort any existing connections with that client
559  * (see notes in smb_negotiate.c and smb_session_setup_andx.c). For
560  * servers with multiple network interfaces or IP aliases, however,
561  * each interface has to be managed independently since the client
562  * is not aware of the server configuration. We have to allow the
563  * client to establish a connection on each interface with a vc
564  * number of zero without aborting the other connections.
565  *
566  * ipaddr:       the client (peer) IP address for the session.
567  * local_ipaddr: the local IP address used to connect to the server.
568  */
569 
570 #define	SMB_MAC_KEYSZ	512
571 
572 struct smb_sign {
573 	unsigned int seqnum;
574 	unsigned int mackey_len;
575 	unsigned int flags;
576 	unsigned char mackey[SMB_MAC_KEYSZ];
577 };
578 
579 #define	SMB_SIGNING_ENABLED	1
580 #define	SMB_SIGNING_CHECK	2
581 
582 /*
583  * Session State Machine
584  * ---------------------
585  *
586  * +-----------------------------+	     +------------------------------+
587  * | SMB_SESSION_STATE_CONNECTED |           | SMB_SESSION_STATE_TERMINATED |
588  * +-----------------------------+           +------------------------------+
589  *		T0|					     ^
590  *		  +--------------------+		     |T13
591  *		  v		       |T14                  |
592  * +-------------------------------+   |    +--------------------------------+
593  * | SMB_SESSION_STATE_ESTABLISHED |---+--->| SMB_SESSION_STATE_DISCONNECTED |
594  * +-------------------------------+        +--------------------------------+
595  *		T1|				^	   ^ ^ ^
596  *		  +----------+			|T9        | | |
597  *                           v			|          | | |
598  *                  +------------------------------+       | | |
599  *                  | SMB_SESSION_STATE_NEGOTIATED |       | | |
600  *                  +------------------------------+       | | |
601  *	                 ^|   ^|   | ^                     | | |
602  *      +----------------+|   ||   | |                     | | |
603  *      |+----------------+   || T7| |T8                   | | |
604  *      ||                    ||   | |                     | | |
605  *      ||   +----------------+|   | |                     | | |
606  *      ||   |+----------------+   | |                     | | |
607  *	||   ||			   v |                     | | |
608  *      ||   ||   +-----------------------------------+ T10| | |
609  *      ||   ||   | SMB_SESSION_STATE_OPLOCK_BREAKING |----+ | |
610  *      ||   ||   +-----------------------------------+      | |
611  *	||   ||T5                                            | |
612  *      ||   |+-->+-----------------------------------+	  T11| |
613  *      ||   |T6  | SMB_SESSION_STATE_READ_RAW_ACTIVE |------+ |
614  *      ||   +----+-----------------------------------+        |
615  *	||T3                                                   |
616  *      |+------->+------------------------------------+    T12|
617  *      |T4       | SMB_SESSION_STATE_WRITE_RAW_ACTIVE |-------+
618  *      +---------+------------------------------------+
619  *
620  * Transition T0
621  *
622  *
623  *
624  * Transition T1
625  *
626  *
627  *
628  * Transition T2
629  *
630  *
631  *
632  * Transition T3
633  *
634  *
635  *
636  * Transition T4
637  *
638  *
639  *
640  * Transition T5
641  *
642  *
643  *
644  * Transition T6
645  *
646  *
647  *
648  * Transition T7
649  *
650  *
651  *
652  * Transition T8
653  *
654  *
655  *
656  * Transition T9
657  *
658  *
659  *
660  * Transition T10
661  *
662  *
663  *
664  * Transition T11
665  *
666  *
667  *
668  * Transition T12
669  *
670  *
671  *
672  * Transition T13
673  *
674  *
675  *
676  * Transition T14
677  *
678  *
679  *
680  */
681 #define	SMB_SESSION_MAGIC	0x53455353	/* 'SESS' */
682 #define	SMB_SESSION_VALID(p)	ASSERT((p)->s_magic == SMB_SESSION_MAGIC)
683 
684 typedef enum {
685 	SMB_SESSION_STATE_INITIALIZED = 0,
686 	SMB_SESSION_STATE_DISCONNECTED,
687 	SMB_SESSION_STATE_CONNECTED,
688 	SMB_SESSION_STATE_ESTABLISHED,
689 	SMB_SESSION_STATE_NEGOTIATED,
690 	SMB_SESSION_STATE_OPLOCK_BREAKING,
691 	SMB_SESSION_STATE_WRITE_RAW_ACTIVE,
692 	SMB_SESSION_STATE_READ_RAW_ACTIVE,
693 	SMB_SESSION_STATE_TERMINATED,
694 	SMB_SESSION_STATE_SENTINEL
695 } smb_session_state_t;
696 
697 typedef struct smb_session {
698 	uint32_t		s_magic;
699 	smb_rwx_t		s_lock;
700 	list_node_t		s_lnd;
701 	uint64_t		s_kid;
702 	smb_session_state_t	s_state;
703 	uint32_t		s_flags;
704 	int			s_write_raw_status;
705 	kthread_t		*s_thread;
706 	kt_did_t		s_ktdid;
707 	smb_kmod_cfg_t		s_cfg;
708 	kmem_cache_t		*s_cache;
709 	kmem_cache_t		*s_cache_request;
710 	struct smb_server	*s_server;
711 	int32_t			s_gmtoff;
712 	uint32_t		keep_alive;
713 	uint64_t		opentime;
714 	uint16_t		vcnumber;
715 	uint16_t		s_local_port;
716 	smb_inaddr_t		ipaddr;
717 	smb_inaddr_t		local_ipaddr;
718 	char 			workstation[SMB_PI_MAX_HOST];
719 	int			dialect;
720 	int			native_os;
721 	uint32_t		capabilities;
722 	struct smb_sign		signing;
723 
724 	ksocket_t		sock;
725 
726 	smb_slist_t		s_req_list;
727 	smb_llist_t		s_xa_list;
728 	smb_llist_t		s_user_list;
729 	smb_idpool_t		s_uid_pool;
730 	smb_txlst_t		s_txlst;
731 
732 	volatile uint32_t	s_tree_cnt;
733 	volatile uint32_t	s_file_cnt;
734 	volatile uint32_t	s_dir_cnt;
735 
736 	uint16_t		secmode;
737 	uint32_t		sesskey;
738 	uint32_t		challenge_len;
739 	unsigned char		challenge_key[8];
740 	unsigned char		MAC_key[44];
741 	int64_t			activity_timestamp;
742 	/*
743 	 * Maximum negotiated buffer size between SMB client and server
744 	 * in SMB_SESSION_SETUP_ANDX
745 	 */
746 	uint16_t		smb_msg_size;
747 	uchar_t			*outpipe_data;
748 	int			outpipe_datalen;
749 	int			outpipe_cookie;
750 	list_t			s_oplock_brkreqs;
751 } smb_session_t;
752 
753 #define	SMB_USER_MAGIC 0x55534552	/* 'USER' */
754 
755 #define	SMB_USER_FLAG_GUEST			SMB_ATF_GUEST
756 #define	SMB_USER_FLAG_IPC			SMB_ATF_ANON
757 #define	SMB_USER_FLAG_ADMIN			SMB_ATF_ADMIN
758 #define	SMB_USER_FLAG_POWER_USER		SMB_ATF_POWERUSER
759 #define	SMB_USER_FLAG_BACKUP_OPERATOR		SMB_ATF_BACKUPOP
760 
761 #define	SMB_USER_PRIV_TAKE_OWNERSHIP	0x00000001
762 #define	SMB_USER_PRIV_BACKUP		0x00000002
763 #define	SMB_USER_PRIV_RESTORE		0x00000004
764 #define	SMB_USER_PRIV_SECURITY		0x00000008
765 
766 
767 typedef enum {
768 	SMB_USER_STATE_LOGGED_IN = 0,
769 	SMB_USER_STATE_LOGGING_OFF,
770 	SMB_USER_STATE_LOGGED_OFF,
771 	SMB_USER_STATE_SENTINEL
772 } smb_user_state_t;
773 
774 typedef struct smb_user {
775 	uint32_t		u_magic;
776 	list_node_t		u_lnd;
777 	kmutex_t		u_mutex;
778 	smb_user_state_t	u_state;
779 
780 	struct smb_server	*u_server;
781 	smb_session_t		*u_session;
782 	uint16_t		u_name_len;
783 	char			*u_name;
784 	uint16_t		u_domain_len;
785 	char			*u_domain;
786 	time_t			u_logon_time;
787 	cred_t			*u_cred;
788 	cred_t			*u_privcred;
789 
790 	smb_llist_t		u_tree_list;
791 	smb_idpool_t		u_tid_pool;
792 
793 	uint32_t		u_refcnt;
794 	uint32_t		u_flags;
795 	uint32_t		u_privileges;
796 	uint16_t		u_uid;
797 	uint32_t		u_audit_sid;
798 } smb_user_t;
799 
800 #define	SMB_TREE_MAGIC			0x54524545	/* 'TREE' */
801 
802 #define	SMB_TYPENAMELEN			_ST_FSTYPSZ
803 #define	SMB_VOLNAMELEN			32
804 
805 #define	SMB_TREE_READONLY		0x00000001
806 #define	SMB_TREE_SUPPORTS_ACLS		0x00000002
807 #define	SMB_TREE_STREAMS		0x00000004
808 #define	SMB_TREE_CASEINSENSITIVE	0x00000008
809 #define	SMB_TREE_NO_CASESENSITIVE	0x00000010
810 #define	SMB_TREE_NO_EXPORT		0x00000020
811 #define	SMB_TREE_NO_OPLOCKS		0x00000040
812 #define	SMB_TREE_NO_ATIME		0x00000080
813 #define	SMB_TREE_XVATTR			0x00000100
814 #define	SMB_TREE_DIRENTFLAGS		0x00000200
815 #define	SMB_TREE_ACLONCREATE		0x00000400
816 #define	SMB_TREE_ACEMASKONACCESS	0x00000800
817 #define	SMB_TREE_NFS_MOUNTED		0x00001000
818 #define	SMB_TREE_UNICODE_ON_DISK	0x00002000
819 #define	SMB_TREE_CATIA			0x00004000
820 
821 typedef enum {
822 	SMB_TREE_STATE_CONNECTED = 0,
823 	SMB_TREE_STATE_DISCONNECTING,
824 	SMB_TREE_STATE_DISCONNECTED,
825 	SMB_TREE_STATE_SENTINEL
826 } smb_tree_state_t;
827 
828 typedef struct smb_tree {
829 	uint32_t		t_magic;
830 	kmutex_t		t_mutex;
831 	list_node_t		t_lnd;
832 	smb_tree_state_t	t_state;
833 
834 	struct smb_server	*t_server;
835 	smb_session_t		*t_session;
836 	smb_user_t		*t_user;
837 	smb_node_t		*t_snode;
838 
839 	smb_llist_t		t_ofile_list;
840 	smb_idpool_t		t_fid_pool;
841 
842 	smb_llist_t		t_odir_list;
843 	smb_idpool_t		t_odid_pool;
844 
845 	uint32_t		t_refcnt;
846 	uint32_t		t_flags;
847 	int32_t			t_res_type;
848 	uint16_t		t_tid;
849 	uint16_t		t_umask;
850 	char			t_sharename[MAXNAMELEN];
851 	char			t_resource[MAXPATHLEN];
852 	char			t_typename[SMB_TYPENAMELEN];
853 	char			t_volume[SMB_VOLNAMELEN];
854 	acl_type_t		t_acltype;
855 	uint32_t		t_access;
856 } smb_tree_t;
857 
858 #define	SMB_TREE_VFS(tree)	((tree)->t_snode->vp->v_vfsp)
859 #define	SMB_TREE_FSID(tree)	((tree)->t_snode->vp->v_vfsp->vfs_fsid)
860 
861 #define	SMB_TREE_IS_READONLY(sr)					\
862 	((sr) != NULL && (sr)->tid_tree != NULL &&			\
863 	!((sr)->tid_tree->t_access & ACE_ALL_WRITE_PERMS))
864 
865 #define	SMB_TREE_IS_CASEINSENSITIVE(sr)                                 \
866 	(((sr) && (sr)->tid_tree) ?                                     \
867 	smb_tree_has_feature((sr)->tid_tree, SMB_TREE_CASEINSENSITIVE) : 0)
868 
869 #define	SMB_TREE_HAS_ACCESS(sr, acemask)				\
870 	((sr) == NULL ? ACE_ALL_PERMS : (				\
871 	(((sr) && (sr)->tid_tree) ?					\
872 	(((sr)->tid_tree->t_access) & (acemask)) : 0)))
873 
874 #define	SMB_TREE_SUPPORTS_CATIA(sr)            				\
875 	(((sr) && (sr)->tid_tree) ?                                     \
876 	smb_tree_has_feature((sr)->tid_tree, SMB_TREE_CATIA) : 0)
877 
878 /*
879  * SMB_TREE_CONTAINS_NODE is used to check that a node is in the same
880  * file system as the tree.
881  */
882 #define	SMB_TREE_CONTAINS_NODE(sr, node)                                \
883 	(((sr) && (sr)->tid_tree) ?                                     \
884 	(SMB_TREE_VFS((sr)->tid_tree) == SMB_NODE_VFS(node)) : 1)
885 
886 /*
887  * SMB_NODE_IS_READONLY(node)
888  *
889  * This macro indicates whether the DOS readonly bit is set in the node's
890  * attribute cache.  The cache reflects what is on-disk.
891  */
892 
893 #define	SMB_NODE_IS_READONLY(node) \
894 	((node) && (node)->attr.sa_dosattr & FILE_ATTRIBUTE_READONLY)
895 
896 /*
897  * SMB_OFILE_IS_READONLY reflects whether an ofile is readonly or not.
898  * The macro takes into account
899  *      - the tree readonly state
900  *      - the node readonly state
901  *      - whether the specified ofile is the readonly creator
902  * The readonly creator has write permission until the ofile is closed.
903  */
904 
905 #define	SMB_OFILE_IS_READONLY(of)                               \
906 	(((of)->f_flags & SMB_OFLAGS_READONLY) ||               \
907 	SMB_NODE_IS_READONLY((of)->f_node) ||                   \
908 	(((of)->f_node->readonly_creator) &&                    \
909 	((of)->f_node->readonly_creator != (of))))
910 
911 /*
912  * SMB_PATHFILE_IS_READONLY indicates whether or not a file is
913  * readonly when the caller has a path rather than an ofile.  Unlike
914  * SMB_OFILE_IS_READONLY, the caller cannot be the readonly creator,
915  * since that requires an ofile.
916  */
917 
918 #define	SMB_PATHFILE_IS_READONLY(sr, node)                       \
919 	(SMB_TREE_IS_READONLY((sr)) ||                           \
920 	SMB_NODE_IS_READONLY((node)) ||                          \
921 	((node)->readonly_creator))
922 
923 #define	PIPE_STATE_AUTH_VERIFY	0x00000001
924 
925 /*
926  * Data structure for SMB_FTYPE_MESG_PIPE ofiles, which is used
927  * at the interface between SMB and NDR RPC.
928  */
929 typedef struct smb_opipe {
930 	kmutex_t p_mutex;
931 	kcondvar_t p_cv;
932 	char *p_name;
933 	uint32_t p_busy;
934 	smb_opipe_hdr_t p_hdr;
935 	smb_opipe_context_t p_context;
936 	uint8_t *p_doorbuf;
937 	uint8_t *p_data;
938 } smb_opipe_t;
939 
940 /*
941  * The of_ftype	of an open file should contain the SMB_FTYPE value
942  * (cifs.h) returned when the file/pipe was opened. The following
943  * assumptions are currently made:
944  *
945  * File Type	    Node       PipeInfo
946  * ---------	    --------   --------
947  * SMB_FTYPE_DISK       Valid      Null
948  * SMB_FTYPE_BYTE_PIPE  Undefined  Undefined
949  * SMB_FTYPE_MESG_PIPE  Null       Valid
950  * SMB_FTYPE_PRINTER    Undefined  Undefined
951  * SMB_FTYPE_UNKNOWN    Undefined  Undefined
952  */
953 
954 /*
955  * Some flags for ofile structure
956  *
957  *	SMB_OFLAGS_SET_DELETE_ON_CLOSE
958  *   Set this flag when the corresponding open operation whose
959  *   DELETE_ON_CLOSE bit of the CreateOptions is set. If any
960  *   open file instance has this bit set, the NODE_FLAGS_DELETE_ON_CLOSE
961  *   will be set for the file node upon close.
962  */
963 
964 #define	SMB_OFLAGS_READONLY		0x0001
965 #define	SMB_OFLAGS_EXECONLY		0x0002
966 #define	SMB_OFLAGS_SET_DELETE_ON_CLOSE	0x0004
967 #define	SMB_OFLAGS_LLF_POS_VALID	0x0008
968 
969 #define	SMB_OFILE_MAGIC 	0x4F464C45	/* 'OFLE' */
970 #define	SMB_OFILE_VALID(p)	ASSERT((p)->f_magic == SMB_OFILE_MAGIC)
971 
972 typedef enum {
973 	SMB_OFILE_STATE_OPEN = 0,
974 	SMB_OFILE_STATE_CLOSING,
975 	SMB_OFILE_STATE_CLOSED,
976 	SMB_OFILE_STATE_SENTINEL
977 } smb_ofile_state_t;
978 
979 typedef struct smb_ofile {
980 	uint32_t		f_magic;
981 	kmutex_t		f_mutex;
982 	list_node_t		f_lnd;
983 	list_node_t		f_nnd;
984 	smb_ofile_state_t	f_state;
985 
986 	struct smb_server	*f_server;
987 	smb_session_t		*f_session;
988 	smb_user_t		*f_user;
989 	smb_tree_t		*f_tree;
990 	smb_node_t		*f_node;
991 	smb_opipe_t		*f_pipe;
992 
993 	uint32_t		f_uniqid;
994 	uint32_t		f_refcnt;
995 	uint64_t		f_seek_pos;
996 	uint32_t		f_flags;
997 	uint32_t		f_granted_access;
998 	uint32_t		f_share_access;
999 	uint32_t		f_create_options;
1000 	uint16_t		f_fid;
1001 	uint16_t		f_opened_by_pid;
1002 	uint16_t		f_ftype;
1003 	uint64_t		f_llf_pos;
1004 	int			f_mode;
1005 	cred_t			*f_cr;
1006 	pid_t			f_pid;
1007 	boolean_t		f_oplock_granted;
1008 	boolean_t		f_oplock_exit;
1009 } smb_ofile_t;
1010 
1011 #define	SMB_ODIR_MAGIC 		0x4F444952	/* 'ODIR' */
1012 #define	SMB_ODIR_BUFSIZE	(8 * 1024)
1013 
1014 #define	SMB_ODIR_FLAG_WILDCARDS		0x0001
1015 #define	SMB_ODIR_FLAG_IGNORE_CASE	0x0002
1016 #define	SMB_ODIR_FLAG_XATTR		0x0004
1017 #define	SMB_ODIR_FLAG_EDIRENT		0x0008
1018 #define	SMB_ODIR_FLAG_CATIA		0x0010
1019 
1020 typedef enum {
1021 	SMB_ODIR_STATE_OPEN = 0,
1022 	SMB_ODIR_STATE_CLOSING,
1023 	SMB_ODIR_STATE_CLOSED,
1024 	SMB_ODIR_STATE_SENTINEL
1025 } smb_odir_state_t;
1026 
1027 typedef enum {
1028 	SMB_ODIR_RESUME_IDX,
1029 	SMB_ODIR_RESUME_COOKIE,
1030 	SMB_ODIR_RESUME_FNAME
1031 } smb_odir_resume_type_t;
1032 
1033 typedef struct smb_odir_resume {
1034 	smb_odir_resume_type_t	or_type;
1035 	int			or_idx;
1036 	uint32_t		or_cookie;
1037 	char			*or_fname;
1038 } smb_odir_resume_t;
1039 
1040 /*
1041  * Flags used when opening an odir
1042  */
1043 #define	SMB_ODIR_OPENF_BACKUP_INTENT	0x01
1044 
1045 typedef struct smb_odir {
1046 	uint32_t		d_magic;
1047 	kmutex_t		d_mutex;
1048 	list_node_t		d_lnd;
1049 	smb_odir_state_t	d_state;
1050 	smb_session_t		*d_session;
1051 	smb_tree_t		*d_tree;
1052 	smb_node_t		*d_dnode;
1053 	cred_t			*d_cred;
1054 	uint16_t		d_odid;
1055 	uint16_t		d_opened_by_pid;
1056 	uint16_t		d_sattr;
1057 	uint32_t		d_refcnt;
1058 	uint32_t		d_flags;
1059 	boolean_t		d_eof;
1060 	int			d_bufsize;
1061 	uint64_t		d_offset;
1062 	union {
1063 		char		*u_bufptr;
1064 		edirent_t	*u_edp;
1065 		dirent64_t	*u_dp;
1066 	} d_u;
1067 	uint32_t		d_cookies[SMB_MAX_SEARCH];
1068 	char			d_pattern[MAXNAMELEN];
1069 	char			d_buf[SMB_ODIR_BUFSIZE];
1070 } smb_odir_t;
1071 #define	d_bufptr	d_u.u_bufptr
1072 #define	d_edp		d_u.u_edp
1073 #define	d_dp		d_u.u_dp
1074 
1075 typedef struct smb_odirent {
1076 	char		od_name[MAXNAMELEN];	/* on disk name */
1077 	ino64_t		od_ino;
1078 	uint32_t	od_eflags;
1079 } smb_odirent_t;
1080 
1081 typedef struct smb_fileinfo {
1082 	char		fi_name[MAXNAMELEN];
1083 	char		fi_name83[SMB_SHORTNAMELEN];
1084 	char		fi_shortname[SMB_SHORTNAMELEN];
1085 	uint32_t	fi_cookie;
1086 	uint32_t	fi_dosattr;	/* DOS attributes */
1087 	uint64_t	fi_nodeid;	/* file system node id */
1088 	uint64_t	fi_size;	/* file size in bytes */
1089 	uint64_t	fi_alloc_size;	/* allocation size in bytes */
1090 	timestruc_t	fi_atime;	/* last access */
1091 	timestruc_t	fi_mtime;	/* last modification */
1092 	timestruc_t	fi_ctime;	/* last status change */
1093 	timestruc_t	fi_crtime;	/* file creation */
1094 } smb_fileinfo_t;
1095 
1096 typedef struct smb_streaminfo {
1097 	uint64_t	si_size;
1098 	char		si_name[MAXPATHLEN];
1099 } smb_streaminfo_t;
1100 
1101 #define	SMB_LOCK_MAGIC 	0x4C4F434B	/* 'LOCK' */
1102 
1103 typedef struct smb_lock {
1104 	uint32_t		l_magic;
1105 	kmutex_t		l_mutex;
1106 	list_node_t		l_lnd;
1107 	kcondvar_t		l_cv;
1108 
1109 	list_node_t		l_conflict_lnd;
1110 	smb_slist_t		l_conflict_list;
1111 
1112 	smb_session_t		*l_session;
1113 	smb_ofile_t		*l_file;
1114 	struct smb_request	*l_sr;
1115 
1116 	uint32_t		l_flags;
1117 	uint64_t		l_session_kid;
1118 	struct smb_lock		*l_blocked_by; /* Debug info only */
1119 
1120 	uint16_t		l_pid;
1121 	uint16_t		l_uid;
1122 	uint32_t		l_type;
1123 	uint64_t		l_start;
1124 	uint64_t		l_length;
1125 	clock_t			l_end_time;
1126 } smb_lock_t;
1127 
1128 #define	SMB_LOCK_FLAG_INDEFINITE	0x0004
1129 #define	SMB_LOCK_INDEFINITE_WAIT(lock) \
1130 	((lock)->l_flags & SMB_LOCK_FLAG_INDEFINITE)
1131 
1132 #define	SMB_LOCK_TYPE_READWRITE		101
1133 #define	SMB_LOCK_TYPE_READONLY		102
1134 
1135 typedef struct vardata_block {
1136 	uint8_t			vdb_tag;
1137 	uint32_t		vdb_len;
1138 	struct uio 		vdb_uio;
1139 	struct iovec		vdb_iovec[MAX_IOVEC];
1140 } smb_vdb_t;
1141 
1142 #define	SMB_RW_MAGIC		0x52445257	/* 'RDRW' */
1143 
1144 typedef struct smb_rw_param {
1145 	uint32_t rw_magic;
1146 	smb_vdb_t rw_vdb;
1147 	uint64_t rw_offset;
1148 	uint32_t rw_last_write;
1149 	uint16_t rw_mode;
1150 	uint32_t rw_count;
1151 	uint16_t rw_mincnt;
1152 	uint16_t rw_dsoff;		/* SMB data offset */
1153 	uint8_t rw_andx;		/* SMB secondary andx command */
1154 } smb_rw_param_t;
1155 
1156 typedef struct smb_pathname {
1157 	char	*pn_path;
1158 	char	*pn_pname;
1159 	char	*pn_fname;
1160 	char	*pn_sname;
1161 	char	*pn_stype;
1162 } smb_pathname_t;
1163 
1164 /*
1165  * fs_query_info
1166  */
1167 typedef struct smb_fqi {
1168 	smb_pathname_t	fq_path;
1169 	uint16_t	fq_sattr;
1170 	smb_node_t	*fq_dnode;
1171 	smb_node_t	*fq_fnode;
1172 	smb_attr_t	fq_fattr;
1173 	char		fq_last_comp[MAXNAMELEN];
1174 	char		fq_od_name[MAXNAMELEN];
1175 } smb_fqi_t;
1176 
1177 #define	SMB_NULL_FQI_NODES(fqi) \
1178 	(fqi).fq_fnode = NULL;	\
1179 	(fqi).fq_dnode = NULL;
1180 
1181 #define	FQM_DIR_MUST_EXIST	1
1182 #define	FQM_PATH_MUST_EXIST	2
1183 #define	FQM_PATH_MUST_NOT_EXIST 3
1184 
1185 #define	OPLOCK_MIN_TIMEOUT	(5 * 1000)
1186 #define	OPLOCK_STD_TIMEOUT	(15 * 1000)
1187 #define	OPLOCK_RETRIES		2
1188 
1189 typedef struct {
1190 	uint32_t severity;
1191 	uint32_t status;
1192 	uint16_t errcls;
1193 	uint16_t errcode;
1194 } smb_error_t;
1195 
1196 typedef struct open_param {
1197 	smb_fqi_t	fqi;
1198 	uint16_t	omode;
1199 	uint16_t	ofun;
1200 	uint32_t	nt_flags;
1201 	uint32_t	timeo;
1202 	uint32_t	dattr;
1203 	timestruc_t	crtime;
1204 	timestruc_t	mtime;
1205 	uint64_t	dsize;
1206 	uint32_t	desired_access;
1207 	uint32_t	share_access;
1208 	uint32_t	create_options;
1209 	uint32_t	create_disposition;
1210 	boolean_t	created_readonly;
1211 	uint32_t	ftype;
1212 	uint32_t	devstate;
1213 	uint32_t	action_taken;
1214 	uint64_t	fileid;
1215 	uint32_t	rootdirfid;
1216 	/* This is only set by NTTransactCreate */
1217 	struct smb_sd	*sd;
1218 	uint8_t		op_oplock_level;
1219 } open_param_t;
1220 
1221 #define	SMB_OPLOCK_NONE		0
1222 #define	SMB_OPLOCK_EXCLUSIVE	1
1223 #define	SMB_OPLOCK_BATCH	2
1224 #define	SMB_OPLOCK_LEVEL_II	3
1225 
1226 /*
1227  * SMB Request State Machine
1228  * -------------------------
1229  *
1230  *                  T4               +------+		T0
1231  *      +--------------------------->| FREE |---------------------------+
1232  *      |                            +------+                           |
1233  * +-----------+                                                        |
1234  * | COMPLETED |                                                        |
1235  * +-----------+
1236  *      ^                                                               |
1237  *      | T15                      +----------+                         v
1238  * +------------+        T6        |          |                 +--------------+
1239  * | CLEANED_UP |<-----------------| CANCELED |                 | INITIALIZING |
1240  * +------------+                  |          |                 +--------------+
1241  *      |    ^                     +----------+                         |
1242  *      |    |                        ^  ^ ^ ^                          |
1243  *      |    |          +-------------+  | | |                          |
1244  *      |    |    T3    |                | | |               T13        | T1
1245  *      |    +-------------------------+ | | +----------------------+   |
1246  *      +----------------------------+ | | |                        |   |
1247  *         T16          |            | | | +-----------+            |   |
1248  *                      |           \/ | | T5          |            |   v
1249  * +-----------------+  |   T12     +--------+         |     T2    +-----------+
1250  * | EVENT_OCCURRED  |------------->| ACTIVE |<--------------------| SUBMITTED |
1251  * +-----------------+  |           +--------+         |           +-----------+
1252  *        ^             |              | ^ |           |
1253  *        |             |           T8 | | |  T7       |
1254  *        | T10      T9 |   +----------+ | +-------+   |  T11
1255  *        |             |   |            +-------+ |   |
1256  *        |             |   |               T14  | |   |
1257  *        |             |   v                    | v   |
1258  *      +----------------------+                +--------------+
1259  *	|     WAITING_EVENT    |                | WAITING_LOCK |
1260  *      +----------------------+                +--------------+
1261  *
1262  *
1263  *
1264  *
1265  *
1266  * Transition T0
1267  *
1268  * This transition occurs when the request is allocated and is still under the
1269  * control of the session thread.
1270  *
1271  * Transition T1
1272  *
1273  * This transition occurs when the session thread dispatches a task to treat the
1274  * request.
1275  *
1276  * Transition T2
1277  *
1278  *
1279  *
1280  * Transition T3
1281  *
1282  * A request completes and smbsr_cleanup is called to release resources
1283  * associated with the request (but not the smb_request_t itself).  This
1284  * includes references on smb_ofile_t, smb_node_t, and other structures.
1285  * CLEANED_UP state exists to detect if we attempt to cleanup a request
1286  * multiple times and to allow us to detect that we are accessing a
1287  * request that has already been cleaned up.
1288  *
1289  * Transition T4
1290  *
1291  *
1292  *
1293  * Transition T5
1294  *
1295  *
1296  *
1297  * Transition T6
1298  *
1299  *
1300  *
1301  * Transition T7
1302  *
1303  *
1304  *
1305  * Transition T8
1306  *
1307  *
1308  *
1309  * Transition T9
1310  *
1311  *
1312  *
1313  * Transition T10
1314  *
1315  *
1316  *
1317  * Transition T11
1318  *
1319  *
1320  *
1321  * Transition T12
1322  *
1323  *
1324  *
1325  * Transition T13
1326  *
1327  *
1328  *
1329  * Transition T14
1330  *
1331  *
1332  *
1333  * Transition T15
1334  *
1335  * Request processing is completed (control returns from smb_dispatch)
1336  *
1337  * Transition T16
1338  *
1339  * Multipart (andx) request was cleaned up with smbsr_cleanup but more "andx"
1340  * sections remain to be processed.
1341  *
1342  */
1343 
1344 #define	SMB_REQ_MAGIC 		0x534D4252	/* 'SMBR' */
1345 #define	SMB_REQ_VALID(p)	ASSERT((p)->sr_magic == SMB_REQ_MAGIC)
1346 
1347 typedef enum smb_req_state {
1348 	SMB_REQ_STATE_FREE = 0,
1349 	SMB_REQ_STATE_INITIALIZING,
1350 	SMB_REQ_STATE_SUBMITTED,
1351 	SMB_REQ_STATE_ACTIVE,
1352 	SMB_REQ_STATE_WAITING_EVENT,
1353 	SMB_REQ_STATE_EVENT_OCCURRED,
1354 	SMB_REQ_STATE_WAITING_LOCK,
1355 	SMB_REQ_STATE_COMPLETED,
1356 	SMB_REQ_STATE_CANCELED,
1357 	SMB_REQ_STATE_CLEANED_UP,
1358 	SMB_REQ_STATE_SENTINEL
1359 } smb_req_state_t;
1360 
1361 typedef struct smb_request {
1362 	uint32_t		sr_magic;
1363 	kmutex_t		sr_mutex;
1364 	list_node_t		sr_session_lnd;
1365 	smb_req_state_t		sr_state;
1366 	boolean_t		sr_keep;
1367 	kmem_cache_t		*sr_cache;
1368 	struct smb_server	*sr_server;
1369 	pid_t			*sr_pid;
1370 	int32_t			sr_gmtoff;
1371 	smb_session_t		*session;
1372 	smb_kmod_cfg_t		*sr_cfg;
1373 	smb_notify_change_req_t	sr_ncr;
1374 
1375 	/* Info from session service header */
1376 	uint32_t		sr_req_length; /* Excluding NBT header */
1377 
1378 	/* Request buffer excluding NBT header */
1379 	void			*sr_request_buf;
1380 
1381 	/* Fields for raw writes */
1382 	uint32_t		sr_raw_data_length;
1383 	void			*sr_raw_data_buf;
1384 
1385 	smb_lock_t		*sr_awaiting;
1386 	struct mbuf_chain	command;
1387 	struct mbuf_chain	reply;
1388 	struct mbuf_chain	raw_data;
1389 	smb_malloc_list		request_storage;
1390 	struct smb_xa		*r_xa;
1391 	int			andx_prev_wct;
1392 	int 			cur_reply_offset;
1393 	int			orig_request_hdr;
1394 	unsigned int		reply_seqnum;	/* reply sequence number */
1395 	unsigned char		first_smb_com;	/* command code */
1396 	unsigned char		smb_com;	/* command code */
1397 
1398 	uint8_t			smb_rcls;	/* error code class */
1399 	uint8_t			smb_reh;	/* rsvd (AH DOS INT-24 ERR) */
1400 	uint16_t		smb_err;	/* error code */
1401 	smb_error_t		smb_error;
1402 
1403 	uint8_t			smb_flg;	/* flags */
1404 	uint16_t		smb_flg2;	/* flags */
1405 	uint16_t		smb_pid_high;	/* high part of pid */
1406 	unsigned char		smb_sig[8];	/* signiture */
1407 	uint16_t		smb_tid;	/* tree id #  */
1408 	uint16_t		smb_pid;	/* caller's process id # */
1409 	uint16_t		smb_uid;	/* user id # */
1410 	uint16_t		smb_mid;	/* mutiplex id #  */
1411 	unsigned char		smb_wct;	/* count of parameter words */
1412 	uint16_t		smb_bcc;	/* data byte count */
1413 
1414 	/* Parameters */
1415 	struct mbuf_chain	smb_vwv;	/* variable width value */
1416 
1417 	/* Data */
1418 	struct mbuf_chain	smb_data;
1419 
1420 	uint16_t		smb_fid;	/* not in hdr, but common */
1421 
1422 	unsigned char		andx_com;
1423 	uint16_t		andx_off;
1424 
1425 	struct smb_tree		*tid_tree;
1426 	struct smb_ofile	*fid_ofile;
1427 	smb_user_t		*uid_user;
1428 
1429 	union {
1430 	    struct tcon {
1431 		char		*path;
1432 		char		*service;
1433 		int		pwdlen;
1434 		char		*password;
1435 		uint16_t	flags;
1436 		uint16_t	optional_support;
1437 	    } tcon;
1438 
1439 	    struct dirop {
1440 		smb_fqi_t	fqi;
1441 		smb_fqi_t	dst_fqi;
1442 	    } dirop;
1443 
1444 	    open_param_t	open;
1445 	    smb_rw_param_t	*rw;
1446 	    uint32_t		timestamp;
1447 	} arg;
1448 
1449 	cred_t			*user_cr;
1450 	kthread_t		*sr_worker;
1451 } smb_request_t;
1452 
1453 #define	SMB_READ_PROTOCOL(smb_nh_ptr) \
1454 	LE_IN32(((smb_nethdr_t *)(smb_nh_ptr))->sh_protocol)
1455 
1456 #define	SMB_PROTOCOL_MAGIC_INVALID(rd_sr) \
1457 	(SMB_READ_PROTOCOL((rd_sr)->sr_request_buf) != SMB_PROTOCOL_MAGIC)
1458 
1459 #define	SMB_READ_COMMAND(smb_nh_ptr) \
1460 	(((smb_nethdr_t *)(smb_nh_ptr))->sh_command)
1461 
1462 #define	SMB_IS_WRITERAW(rd_sr) \
1463 	(SMB_READ_COMMAND((rd_sr)->sr_request_buf) == SMB_COM_WRITE_RAW)
1464 
1465 
1466 #define	SR_FLG_OFFSET			9
1467 
1468 #define	MAX_TRANS_NAME	64
1469 
1470 #define	SMB_XA_FLAG_OPEN	0x0001
1471 #define	SMB_XA_FLAG_CLOSE	0x0002
1472 #define	SMB_XA_FLAG_COMPLETE	0x0004
1473 #define	SMB_XA_CLOSED(xa) (!((xa)->xa_flags & SMB_XA_FLAG_OPEN))
1474 
1475 #define	SMB_XA_MAGIC		0x534D4258	/* 'SMBX' */
1476 
1477 typedef struct smb_xa {
1478 	uint32_t		xa_magic;
1479 	kmutex_t		xa_mutex;
1480 	list_node_t		xa_lnd;
1481 
1482 	uint32_t		xa_refcnt;
1483 	uint32_t		xa_flags;
1484 
1485 	struct smb_session	*xa_session;
1486 
1487 	unsigned char		smb_com;	/* which TRANS type */
1488 	unsigned char		smb_flg;	/* flags */
1489 	uint16_t		smb_flg2;	/* flags */
1490 	uint16_t		smb_tid;	/* tree id number */
1491 	uint16_t		smb_pid;	/* caller's process id number */
1492 	uint16_t		smb_uid;	/* user id number */
1493 	uint32_t		smb_func;	/* NT_TRANS function */
1494 
1495 	uint16_t		xa_smb_mid;	/* mutiplex id number */
1496 	uint16_t		xa_smb_fid;	/* TRANS2 secondary */
1497 
1498 	unsigned int		reply_seqnum;	/* reply sequence number */
1499 
1500 	uint32_t	smb_tpscnt;	/* total parameter bytes being sent */
1501 	uint32_t	smb_tdscnt;	/* total data bytes being sent */
1502 	uint32_t	smb_mprcnt;	/* max parameter bytes to return */
1503 	uint32_t	smb_mdrcnt;	/* max data bytes to return */
1504 	uint32_t	smb_msrcnt;	/* max setup words to return */
1505 	uint32_t	smb_flags;	/* additional information: */
1506 				/*  bit 0 - if set, disconnect TID in smb_tid */
1507 				/*  bit 1 - if set, transaction is one way */
1508 				/*  (no final response) */
1509 	int32_t	smb_timeout;	/* number of milliseconds to await completion */
1510 	uint32_t	smb_suwcnt;	/* set up word count */
1511 
1512 
1513 	char			*xa_smb_trans_name;
1514 
1515 	int			req_disp_param;
1516 	int			req_disp_data;
1517 
1518 	struct mbuf_chain	req_setup_mb;
1519 	struct mbuf_chain	req_param_mb;
1520 	struct mbuf_chain	req_data_mb;
1521 
1522 	struct mbuf_chain	rep_setup_mb;
1523 	struct mbuf_chain	rep_param_mb;
1524 	struct mbuf_chain	rep_data_mb;
1525 } smb_xa_t;
1526 
1527 
1528 #define	SDDF_NO_FLAGS			0
1529 #define	SDDF_SUPPRESS_TID		0x0001
1530 #define	SDDF_SUPPRESS_UID		0x0002
1531 
1532 /*
1533  * SMB dispatch return codes.
1534  */
1535 typedef enum {
1536 	SDRC_SUCCESS = 0,
1537 	SDRC_ERROR,
1538 	SDRC_DROP_VC,
1539 	SDRC_NO_REPLY,
1540 	SDRC_SR_KEPT,
1541 	SDRC_NOT_IMPLEMENTED
1542 } smb_sdrc_t;
1543 
1544 #define	VAR_BCC		((short)-1)
1545 
1546 #define	SMB_SERVER_MAGIC	0x53534552	/* 'SSER' */
1547 
1548 typedef struct {
1549 	kstat_named_t	open_files;
1550 	kstat_named_t	open_trees;
1551 	kstat_named_t	open_users;
1552 } smb_server_stats_t;
1553 
1554 typedef struct {
1555 	kthread_t		*ld_kth;
1556 	kt_did_t		ld_ktdid;
1557 	ksocket_t		ld_so;
1558 	struct sockaddr_in	ld_sin;
1559 	struct sockaddr_in6	ld_sin6;
1560 	smb_session_list_t	ld_session_list;
1561 } smb_listener_daemon_t;
1562 
1563 typedef enum smb_server_state {
1564 	SMB_SERVER_STATE_CREATED = 0,
1565 	SMB_SERVER_STATE_CONFIGURED,
1566 	SMB_SERVER_STATE_RUNNING,
1567 	SMB_SERVER_STATE_DELETING,
1568 	SMB_SERVER_STATE_SENTINEL
1569 } smb_server_state_t;
1570 
1571 typedef struct smb_server {
1572 	uint32_t		sv_magic;
1573 	kcondvar_t		sv_cv;
1574 	kmutex_t		sv_mutex;
1575 	list_node_t		sv_lnd;
1576 	smb_server_state_t	sv_state;
1577 	uint32_t		sv_refcnt;
1578 	pid_t			sv_pid;
1579 	zoneid_t		sv_zid;
1580 	smb_listener_daemon_t	sv_nbt_daemon;
1581 	smb_listener_daemon_t	sv_tcp_daemon;
1582 	krwlock_t		sv_cfg_lock;
1583 	smb_kmod_cfg_t		sv_cfg;
1584 	smb_session_t		*sv_session;
1585 
1586 	kstat_t			*sv_ksp;
1587 	kmutex_t		sv_ksp_mutex;
1588 	char			sv_ksp_name[KSTAT_STRLEN];
1589 	smb_server_stats_t	sv_ks_data;
1590 
1591 	door_handle_t		sv_lmshrd;
1592 
1593 	int32_t			si_gmtoff;
1594 
1595 	smb_thread_t		si_thread_timers;
1596 	smb_thread_t		si_thread_unexport;
1597 
1598 	taskq_t			*sv_thread_pool;
1599 
1600 	kmem_cache_t		*si_cache_unexport;
1601 	kmem_cache_t		*si_cache_vfs;
1602 	kmem_cache_t		*si_cache_request;
1603 	kmem_cache_t		*si_cache_session;
1604 	kmem_cache_t		*si_cache_user;
1605 	kmem_cache_t		*si_cache_tree;
1606 	kmem_cache_t		*si_cache_ofile;
1607 	kmem_cache_t		*si_cache_odir;
1608 
1609 	volatile uint32_t	sv_open_trees;
1610 	volatile uint32_t	sv_open_files;
1611 	volatile uint32_t	sv_open_users;
1612 
1613 	smb_node_t		*si_root_smb_node;
1614 	smb_llist_t		sv_vfs_list;
1615 	smb_slist_t		sv_unexport_list;
1616 } smb_server_t;
1617 
1618 #define	SMB_INFO_NETBIOS_SESSION_SVC_RUNNING	0x0001
1619 #define	SMB_INFO_NETBIOS_SESSION_SVC_FAILED	0x0002
1620 #define	SMB_INFO_USER_LEVEL_SECURITY		0x40000000
1621 #define	SMB_INFO_ENCRYPT_PASSWORDS		0x80000000
1622 
1623 #define	SMB_NEW_KID()	atomic_inc_64_nv(&smb_kids)
1624 #define	SMB_UNIQ_FID()	atomic_inc_32_nv(&smb_fids)
1625 
1626 /*
1627  * This is to be used by Trans2SetFileInfo
1628  * and Trans2SetPathInfo
1629  */
1630 typedef struct smb_trans2_setinfo {
1631 	uint16_t level;
1632 	struct smb_xa *ts_xa;
1633 	struct smb_node *node;
1634 	char *path;
1635 	char name[MAXNAMELEN];
1636 } smb_trans2_setinfo_t;
1637 
1638 #define	SMB_IS_STREAM(node) ((node)->unnamed_stream_node)
1639 
1640 typedef struct smb_tsd {
1641 	void (*proc)();
1642 	void *arg;
1643 	char name[100];
1644 } smb_tsd_t;
1645 
1646 typedef struct smb_disp_entry {
1647 	smb_sdrc_t		(*sdt_pre_op)(smb_request_t *);
1648 	smb_sdrc_t		(*sdt_function)(smb_request_t *);
1649 	void			(*sdt_post_op)(smb_request_t *);
1650 	char			sdt_dialect;
1651 	unsigned char		sdt_flags;
1652 	kstat_named_t		sdt_dispatch_stats; /* invocations */
1653 } smb_disp_entry_t;
1654 
1655 /*
1656  * Discretionary Access Control List (DACL)
1657  *
1658  * A Discretionary Access Control List (DACL), often abbreviated to
1659  * ACL, is a list of access controls which either allow or deny access
1660  * for users or groups to a resource. There is a list header followed
1661  * by a list of access control entries (ACE). Each ACE specifies the
1662  * access allowed or denied to a single user or group (identified by
1663  * a SID).
1664  *
1665  * There is another access control list object called a System Access
1666  * Control List (SACL), which is used to control auditing, but no
1667  * support is provideed for SACLs at this time.
1668  *
1669  * ACL header format:
1670  *
1671  *    3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
1672  *    1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
1673  *   +-------------------------------+---------------+---------------+
1674  *   |            AclSize            |      Sbz1     |  AclRevision  |
1675  *   +-------------------------------+---------------+---------------+
1676  *   |              Sbz2             |           AceCount            |
1677  *   +-------------------------------+-------------------------------+
1678  *
1679  * AclRevision specifies the revision level of the ACL. This value should
1680  * be ACL_REVISION, unless the ACL contains an object-specific ACE, in which
1681  * case this value must be ACL_REVISION_DS. All ACEs in an ACL must be at the
1682  * same revision level.
1683  *
1684  * ACE header format:
1685  *
1686  *    3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
1687  *    1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
1688  *   +---------------+-------+-------+---------------+---------------+
1689  *   |            AceSize            |    AceFlags   |     AceType   |
1690  *   +---------------+-------+-------+---------------+---------------+
1691  *
1692  * Access mask format:
1693  *
1694  *    3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
1695  *    1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
1696  *   +---------------+---------------+-------------------------------+
1697  *   |G|G|G|G|Res'd|A| StandardRights|         SpecificRights        |
1698  *   |R|W|E|A|     |S|               |                               |
1699  *   +-+-------------+---------------+-------------------------------+
1700  *
1701  *   typedef struct ACCESS_MASK {
1702  *       WORD SpecificRights;
1703  *       BYTE StandardRights;
1704  *       BYTE AccessSystemAcl : 1;
1705  *       BYTE Reserved : 3;
1706  *       BYTE GenericAll : 1;
1707  *       BYTE GenericExecute : 1;
1708  *       BYTE GenericWrite : 1;
1709  *       BYTE GenericRead : 1;
1710  *   } ACCESS_MASK;
1711  *
1712  */
1713 
1714 #define	ACL_REVISION1			1
1715 #define	ACL_REVISION2			2
1716 #define	MIN_ACL_REVISION2		ACL_REVISION2
1717 #define	ACL_REVISION3			3
1718 #define	ACL_REVISION4			4
1719 #define	MAX_ACL_REVISION		ACL_REVISION4
1720 
1721 /*
1722  * Current ACE and ACL revision Levels
1723  */
1724 #define	ACE_REVISION			1
1725 #define	ACL_REVISION			ACL_REVISION2
1726 #define	ACL_REVISION_DS			ACL_REVISION4
1727 
1728 
1729 #define	ACCESS_ALLOWED_ACE_TYPE		0
1730 #define	ACCESS_DENIED_ACE_TYPE		1
1731 #define	SYSTEM_AUDIT_ACE_TYPE		2
1732 #define	SYSTEM_ALARM_ACE_TYPE		3
1733 
1734 /*
1735  *  se_flags
1736  * ----------
1737  * Specifies a set of ACE type-specific control flags. This member can be a
1738  * combination of the following values.
1739  *
1740  * CONTAINER_INHERIT_ACE: Child objects that are containers, such as
1741  *		directories, inherit the ACE as an effective ACE. The inherited
1742  *		ACE is inheritable unless the NO_PROPAGATE_INHERIT_ACE bit flag
1743  *		is also set.
1744  *
1745  * INHERIT_ONLY_ACE: Indicates an inherit-only ACE which does not control
1746  *		access to the object to which it is attached.
1747  *		If this flag is not set,
1748  *		the ACE is an effective ACE which controls access to the object
1749  *		to which it is attached.
1750  * 		Both effective and inherit-only ACEs can be inherited
1751  *		depending on the state of the other inheritance flags.
1752  *
1753  * INHERITED_ACE: Windows 2000/XP: Indicates that the ACE was inherited.
1754  *		The system sets this bit when it propagates an
1755  *		inherited ACE to a child object.
1756  *
1757  * NO_PROPAGATE_INHERIT_ACE: If the ACE is inherited by a child object, the
1758  *		system clears the OBJECT_INHERIT_ACE and CONTAINER_INHERIT_ACE
1759  *		flags in the inherited ACE.
1760  *		This prevents the ACE from being inherited by
1761  *		subsequent generations of objects.
1762  *
1763  * OBJECT_INHERIT_ACE: Noncontainer child objects inherit the ACE as an
1764  *		effective ACE.  For child objects that are containers,
1765  *		the ACE is inherited as an inherit-only ACE unless the
1766  *		NO_PROPAGATE_INHERIT_ACE bit flag is also set.
1767  */
1768 #define	OBJECT_INHERIT_ACE		0x01
1769 #define	CONTAINER_INHERIT_ACE		0x02
1770 #define	NO_PROPOGATE_INHERIT_ACE	0x04
1771 #define	INHERIT_ONLY_ACE		0x08
1772 #define	INHERITED_ACE			0x10
1773 #define	INHERIT_MASK_ACE		0x1F
1774 
1775 
1776 /*
1777  * These flags are only used in system audit or alarm ACEs to
1778  * indicate when an audit message should be generated, i.e.
1779  * on successful access or on unsuccessful access.
1780  */
1781 #define	SUCCESSFUL_ACCESS_ACE_FLAG	0x40
1782 #define	FAILED_ACCESS_ACE_FLAG		0x80
1783 
1784 /*
1785  * se_bsize is the size, in bytes, of ACE as it appears on the wire.
1786  * se_sln is used to sort the ACL when it's required.
1787  */
1788 typedef struct smb_acehdr {
1789 	uint8_t		se_type;
1790 	uint8_t		se_flags;
1791 	uint16_t	se_bsize;
1792 } smb_acehdr_t;
1793 
1794 typedef struct smb_ace {
1795 	smb_acehdr_t	se_hdr;
1796 	uint32_t	se_mask;
1797 	list_node_t	se_sln;
1798 	smb_sid_t	*se_sid;
1799 } smb_ace_t;
1800 
1801 /*
1802  * sl_bsize is the size of ACL in bytes as it appears on the wire.
1803  */
1804 typedef struct smb_acl {
1805 	uint8_t		sl_revision;
1806 	uint16_t	sl_bsize;
1807 	uint16_t	sl_acecnt;
1808 	smb_ace_t	*sl_aces;
1809 	list_t		sl_sorted;
1810 } smb_acl_t;
1811 
1812 /*
1813  * ACE/ACL header size, in byte, as it appears on the wire
1814  */
1815 #define	SMB_ACE_HDRSIZE		4
1816 #define	SMB_ACL_HDRSIZE		8
1817 
1818 /*
1819  * Security Descriptor (SD)
1820  *
1821  * Security descriptors provide protection for objects, for example
1822  * files and directories. It identifies the owner and primary group
1823  * (SIDs) and contains an access control list. When a user tries to
1824  * access an object his SID is compared to the permissions in the
1825  * DACL to determine if access should be allowed or denied. Note that
1826  * this is a simplification because there are other factors, such as
1827  * default behavior and privileges to be taken into account (see also
1828  * access tokens).
1829  *
1830  * The boolean flags have the following meanings when set:
1831  *
1832  * SE_OWNER_DEFAULTED indicates that the SID pointed to by the Owner
1833  * field was provided by a defaulting mechanism rather than explicitly
1834  * provided by the original provider of the security descriptor. This
1835  * may affect the treatment of the SID with respect to inheritance of
1836  * an owner.
1837  *
1838  * SE_GROUP_DEFAULTED indicates that the SID in the Group field was
1839  * provided by a defaulting mechanism rather than explicitly provided
1840  * by the original provider of the security descriptor.  This may
1841  * affect the treatment of the SID with respect to inheritance of a
1842  * primary group.
1843  *
1844  * SE_DACL_PRESENT indicates that the security descriptor contains a
1845  * discretionary ACL. If this flag is set and the Dacl field of the
1846  * SECURITY_DESCRIPTOR is null, then a null ACL is explicitly being
1847  * specified.
1848  *
1849  * SE_DACL_DEFAULTED indicates that the ACL pointed to by the Dacl
1850  * field was provided by a defaulting mechanism rather than explicitly
1851  * provided by the original provider of the security descriptor. This
1852  * may affect the treatment of the ACL with respect to inheritance of
1853  * an ACL. This flag is ignored if the DaclPresent flag is not set.
1854  *
1855  * SE_SACL_PRESENT indicates that the security descriptor contains a
1856  * system ACL pointed to by the Sacl field. If this flag is set and
1857  * the Sacl field of the SECURITY_DESCRIPTOR is null, then an empty
1858  * (but present) ACL is being specified.
1859  *
1860  * SE_SACL_DEFAULTED indicates that the ACL pointed to by the Sacl
1861  * field was provided by a defaulting mechanism rather than explicitly
1862  * provided by the original provider of the security descriptor. This
1863  * may affect the treatment of the ACL with respect to inheritance of
1864  * an ACL. This flag is ignored if the SaclPresent flag is not set.
1865  *
1866  * SE_DACL_PROTECTED Prevents ACEs set on the DACL of the parent container
1867  * (and any objects above the parent container in the directory hierarchy)
1868  * from being applied to the object's DACL.
1869  *
1870  * SE_SACL_PROTECTED Prevents ACEs set on the SACL of the parent container
1871  * (and any objects above the parent container in the directory hierarchy)
1872  * from being applied to the object's SACL.
1873  *
1874  * Note that the SE_DACL_PRESENT flag needs to be present to set
1875  * SE_DACL_PROTECTED and SE_SACL_PRESENT needs to be present to set
1876  * SE_SACL_PROTECTED.
1877  *
1878  * SE_SELF_RELATIVE indicates that the security descriptor is in self-
1879  * relative form. In this form, all fields of the security descriptor
1880  * are contiguous in memory and all pointer fields are expressed as
1881  * offsets from the beginning of the security descriptor.
1882  *
1883  *    3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
1884  *    1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
1885  *   +---------------------------------------------------------------+
1886  *   |            Control            |Reserved1 (SBZ)|   Revision    |
1887  *   +---------------------------------------------------------------+
1888  *   |                            Owner                              |
1889  *   +---------------------------------------------------------------+
1890  *   |                            Group                              |
1891  *   +---------------------------------------------------------------+
1892  *   |                            Sacl                               |
1893  *   +---------------------------------------------------------------+
1894  *   |                            Dacl                               |
1895  *   +---------------------------------------------------------------+
1896  *
1897  */
1898 
1899 #define	SMB_OWNER_SECINFO	0x0001
1900 #define	SMB_GROUP_SECINFO	0x0002
1901 #define	SMB_DACL_SECINFO	0x0004
1902 #define	SMB_SACL_SECINFO	0x0008
1903 #define	SMB_ALL_SECINFO		0x000F
1904 #define	SMB_ACL_SECINFO		(SMB_DACL_SECINFO | SMB_SACL_SECINFO)
1905 
1906 #define	SECURITY_DESCRIPTOR_REVISION	1
1907 
1908 
1909 #define	SE_OWNER_DEFAULTED		0x0001
1910 #define	SE_GROUP_DEFAULTED		0x0002
1911 #define	SE_DACL_PRESENT			0x0004
1912 #define	SE_DACL_DEFAULTED		0x0008
1913 #define	SE_SACL_PRESENT			0x0010
1914 #define	SE_SACL_DEFAULTED		0x0020
1915 #define	SE_DACL_AUTO_INHERIT_REQ	0x0100
1916 #define	SE_SACL_AUTO_INHERIT_REQ	0x0200
1917 #define	SE_DACL_AUTO_INHERITED		0x0400
1918 #define	SE_SACL_AUTO_INHERITED		0x0800
1919 #define	SE_DACL_PROTECTED		0x1000
1920 #define	SE_SACL_PROTECTED		0x2000
1921 #define	SE_SELF_RELATIVE		0x8000
1922 
1923 #define	SE_DACL_INHERITANCE_MASK	0x1500
1924 #define	SE_SACL_INHERITANCE_MASK	0x2A00
1925 
1926 /*
1927  * Security descriptor structures:
1928  *
1929  * smb_sd_t     SD in SMB pointer form
1930  * smb_fssd_t   SD in filesystem form
1931  *
1932  * Filesystems (e.g. ZFS/UFS) don't have something equivalent
1933  * to SD. The items comprising a SMB SD are kept separately in
1934  * filesystem. smb_fssd_t is introduced as a helper to provide
1935  * the required abstraction for CIFS code.
1936  */
1937 
1938 typedef struct smb_sd {
1939 	uint8_t		sd_revision;
1940 	uint16_t	sd_control;
1941 	smb_sid_t 	*sd_owner;	/* SID file owner */
1942 	smb_sid_t 	*sd_group;	/* SID group (for POSIX) */
1943 	smb_acl_t 	*sd_sacl;	/* ACL System (audits) */
1944 	smb_acl_t 	*sd_dacl;	/* ACL Discretionary (perm) */
1945 } smb_sd_t;
1946 
1947 /*
1948  * SD header size as it appears on the wire
1949  */
1950 #define	SMB_SD_HDRSIZE	20
1951 
1952 /*
1953  * values for smb_fssd.sd_flags
1954  */
1955 #define	SMB_FSSD_FLAGS_DIR	0x01
1956 
1957 typedef struct smb_fssd {
1958 	uint32_t	sd_secinfo;
1959 	uint32_t	sd_flags;
1960 	uid_t		sd_uid;
1961 	gid_t		sd_gid;
1962 	acl_t		*sd_zdacl;
1963 	acl_t		*sd_zsacl;
1964 } smb_fssd_t;
1965 
1966 #ifdef	__cplusplus
1967 }
1968 #endif
1969 
1970 #endif /* _SMBSRV_SMB_KTYPES_H */
1971