1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright 2011-2022 Tintri by DDN, Inc.  All rights reserved.
24  * Copyright 2017-2023 RackTop Systems, Inc.
25  */
26 
27 /*
28  * Structures and type definitions for the SMB module.
29  */
30 
31 #ifndef _SMBSRV_SMB_KTYPES_H
32 #define	_SMBSRV_SMB_KTYPES_H
33 
34 #ifdef	__cplusplus
35 extern "C" {
36 #endif
37 
38 #include <sys/note.h>
39 #include <sys/systm.h>
40 #include <sys/param.h>
41 #include <sys/types.h>
42 #include <sys/synch.h>
43 #include <sys/taskq.h>
44 #include <sys/socket.h>
45 #include <sys/acl.h>
46 #include <sys/sdt.h>
47 #include <sys/stat.h>
48 #include <sys/vnode.h>
49 #include <sys/cred.h>
50 #include <netinet/in.h>
51 #include <sys/ksocket.h>
52 #include <sys/fem.h>
53 #include <smbsrv/smb.h>
54 #include <smbsrv/smb2.h>
55 #include <smbsrv/smbinfo.h>
56 #include <smbsrv/mbuf.h>
57 #include <smbsrv/smb_sid.h>
58 #include <smbsrv/smb_xdr.h>
59 #include <smbsrv/netbios.h>
60 #include <smbsrv/smb_vops.h>
61 #include <smbsrv/smb_kstat.h>
62 
63 struct __door_handle;	/* <sys/door.h> */
64 struct edirent;		/* <sys/extdirent.h> */
65 struct nvlist;
66 
67 struct smb_disp_entry;
68 struct smb_request;
69 struct smb_server;
70 struct smb_event;
71 struct smb_export;
72 
73 /*
74  * Accumulated time and queue length statistics.
75  *
76  * Accumulated time statistics are kept as a running sum of "active" time.
77  * Queue length statistics are kept as a running sum of the product of queue
78  * length and elapsed time at that length -- i.e., a Riemann sum for queue
79  * length integrated against time.  (You can also think of the active time as a
80  * Riemann sum, for the boolean function (queue_length > 0) integrated against
81  * time, or you can think of it as the Lebesgue measure of the set on which
82  * queue_length > 0.)
83  *
84  *		^
85  *		|			_________
86  *		8			| i4	|
87  *		|			|	|
88  *	Queue	6			|	|
89  *	Length	|	_________	|	|
90  *		4	| i2	|_______|	|
91  *		|	|	    i3		|
92  *		2_______|			|
93  *		|    i1				|
94  *		|_______________________________|
95  *		Time->	t1	t2	t3	t4
96  *
97  * At each change of state (entry or exit from the queue), we add the elapsed
98  * time (since the previous state change) to the active time if the queue length
99  * was non-zero during that interval; and we add the product of the elapsed time
100  * times the queue length to the running length*time sum.
101  *
102  * This method is generalizable to measuring residency in any defined system:
103  * instead of queue lengths, think of "outstanding RPC calls to server X".
104  *
105  * A large number of I/O subsystems have at least two basic "lists" of
106  * transactions they manage: one for transactions that have been accepted for
107  * processing but for which processing has yet to begin, and one for
108  * transactions which are actively being processed (but not done). For this
109  * reason, two cumulative time statistics are defined here: wait (pre-service)
110  * time, and run (service) time.
111  *
112  * All times are 64-bit nanoseconds (hrtime_t), as returned by gethrtime().
113  *
114  * The units of cumulative busy time are accumulated nanoseconds. The units of
115  * cumulative length*time products are elapsed time times queue length.
116  *
117  * Updates to the fields below are performed implicitly by calls to
118  * these functions:
119  *
120  *	smb_srqueue_init()
121  *	smb_srqueue_destroy()
122  *	smb_srqueue_waitq_enter()
123  *	smb_srqueue_runq_exit()
124  *	smb_srqueue_waitq_to_runq()
125  *	smb_srqueue_update()
126  *
127  * These fields should never be updated by any other means.
128  */
129 typedef struct smb_srqueue {
130 	kmutex_t	srq_mutex;
131 	hrtime_t	srq_wlastupdate;
132 	hrtime_t	srq_wtime;
133 	hrtime_t	srq_wlentime;
134 	hrtime_t	srq_rlastupdate;
135 	hrtime_t	srq_rtime;
136 	hrtime_t	srq_rlentime;
137 	uint32_t	srq_wcnt;
138 	uint32_t	srq_rcnt;
139 } smb_srqueue_t;
140 
141 /*
142  * The fields with the prefix 'ly_a' contain the statistics collected since the
143  * server was last started ('a' for 'aggregated'). The fields with the prefix
144  * 'ly_d' contain the statistics collected since the last snapshot ('d' for
145  * 'delta').
146  */
147 typedef struct smb_latency {
148 	kmutex_t	ly_mutex;
149 	uint64_t	ly_a_nreq;
150 	hrtime_t	ly_a_sum;
151 	hrtime_t	ly_a_mean;
152 	hrtime_t	ly_a_stddev;
153 	uint64_t	ly_d_nreq;
154 	hrtime_t	ly_d_sum;
155 	hrtime_t	ly_d_mean;
156 	hrtime_t	ly_d_stddev;
157 } smb_latency_t;
158 
159 typedef struct smb_disp_stats {
160 	volatile uint64_t sdt_txb;
161 	volatile uint64_t sdt_rxb;
162 	smb_latency_t	sdt_lat;
163 } smb_disp_stats_t;
164 
165 int smb_noop(void *, size_t, int);
166 
167 #define	SMB_AUDIT_STACK_DEPTH	16
168 #define	SMB_AUDIT_BUF_MAX_REC	16
169 #define	SMB_AUDIT_NODE		0x00000001
170 
171 /*
172  * Maximum number of records returned in SMBsearch, SMBfind
173  * and SMBfindunique response. Value set to 10 for compatibility
174  * with Windows.
175  */
176 #define	SMB_MAX_SEARCH		10
177 
178 #define	SMB_SEARCH_ATTRIBUTES    \
179 	(FILE_ATTRIBUTE_HIDDEN | \
180 	FILE_ATTRIBUTE_SYSTEM |  \
181 	FILE_ATTRIBUTE_DIRECTORY)
182 
183 #define	SMB_SEARCH_HIDDEN(sattr) ((sattr) & FILE_ATTRIBUTE_HIDDEN)
184 #define	SMB_SEARCH_SYSTEM(sattr) ((sattr) & FILE_ATTRIBUTE_SYSTEM)
185 #define	SMB_SEARCH_DIRECTORY(sattr) ((sattr) & FILE_ATTRIBUTE_DIRECTORY)
186 #define	SMB_SEARCH_ALL(sattr) ((sattr) & SMB_SEARCH_ATTRIBUTES)
187 
188 typedef struct {
189 	uint32_t		anr_refcnt;
190 	int			anr_depth;
191 	pc_t			anr_stack[SMB_AUDIT_STACK_DEPTH];
192 } smb_audit_record_node_t;
193 
194 typedef struct {
195 	int			anb_index;
196 	int			anb_max_index;
197 	smb_audit_record_node_t	anb_records[SMB_AUDIT_BUF_MAX_REC];
198 } smb_audit_buf_node_t;
199 
200 /*
201  * Thread State Machine
202  * --------------------
203  *
204  *			    T5			   T0
205  * smb_thread_destroy()	<-------+		+------- smb_thread_init()
206  *                              |		|
207  *				|		v
208  *			+-----------------------------+
209  *			|   SMB_THREAD_STATE_EXITED   |<---+
210  *			+-----------------------------+	   |
211  *				      | T1		   |
212  *				      v			   |
213  *			+-----------------------------+	   |
214  *			|  SMB_THREAD_STATE_STARTING  |	   |
215  *			+-----------------------------+	   |
216  *				     | T2		   | T4
217  *				     v			   |
218  *			+-----------------------------+	   |
219  *			|  SMB_THREAD_STATE_RUNNING   |	   |
220  *			+-----------------------------+	   |
221  *				     | T3		   |
222  *				     v			   |
223  *			+-----------------------------+	   |
224  *			|  SMB_THREAD_STATE_EXITING   |----+
225  *			+-----------------------------+
226  *
227  * Transition T0
228  *
229  *    This transition is executed in smb_thread_init().
230  *
231  * Transition T1
232  *
233  *    This transition is executed in smb_thread_start().
234  *
235  * Transition T2
236  *
237  *    This transition is executed by the thread itself when it starts running.
238  *
239  * Transition T3
240  *
241  *    This transition is executed by the thread itself in
242  *    smb_thread_entry_point() just before calling thread_exit().
243  *
244  *
245  * Transition T4
246  *
247  *    This transition is executed in smb_thread_stop().
248  *
249  * Transition T5
250  *
251  *    This transition is executed in smb_thread_destroy().
252  */
253 typedef enum smb_thread_state {
254 	SMB_THREAD_STATE_STARTING = 0,
255 	SMB_THREAD_STATE_RUNNING,
256 	SMB_THREAD_STATE_EXITING,
257 	SMB_THREAD_STATE_EXITED,
258 	SMB_THREAD_STATE_FAILED
259 } smb_thread_state_t;
260 
261 struct _smb_thread;
262 
263 typedef void (*smb_thread_ep_t)(struct _smb_thread *, void *ep_arg);
264 
265 #define	SMB_THREAD_MAGIC	0x534D4254	/* SMBT */
266 
267 typedef struct _smb_thread {
268 	uint32_t		sth_magic;
269 	char			sth_name[32];
270 	smb_thread_state_t	sth_state;
271 	struct smb_server	*sth_server;
272 	kthread_t		*sth_th;
273 	kt_did_t		sth_did;
274 	smb_thread_ep_t		sth_ep;
275 	void			*sth_ep_arg;
276 	pri_t			sth_pri;
277 	boolean_t		sth_kill;
278 	kmutex_t		sth_mtx;
279 	kcondvar_t		sth_cv;
280 } smb_thread_t;
281 
282 /*
283  * Pool of IDs
284  * -----------
285  *
286  *    A pool of IDs is a pool of 16 bit numbers. It is implemented as a bitmap.
287  *    A bit set to '1' indicates that that particular value has been allocated.
288  *    The allocation process is done shifting a bit through the whole bitmap.
289  *    The current position of that index bit is kept in the smb_idpool_t
290  *    structure and represented by a byte index (0 to buffer size minus 1) and
291  *    a bit index (0 to 7).
292  *
293  *    The pools start with a size of 8 bytes or 64 IDs. Each time the pool runs
294  *    out of IDs its current size is doubled until it reaches its maximum size
295  *    (8192 bytes or 65536 IDs). The IDs 0 and 65535 are never given out which
296  *    means that a pool can have a maximum number of 65534 IDs available.
297  */
298 #define	SMB_IDPOOL_MAGIC	0x4944504C	/* IDPL */
299 #define	SMB_IDPOOL_MIN_SIZE	64	/* Number of IDs to begin with */
300 #define	SMB_IDPOOL_MAX_SIZE	64 * 1024
301 
302 typedef struct smb_idpool {
303 	uint32_t	id_magic;
304 	kmutex_t	id_mutex;
305 	uint8_t		*id_pool;
306 	uint32_t	id_size;
307 	uint32_t	id_maxsize;
308 	uint8_t		id_bit;
309 	uint8_t		id_bit_idx;
310 	uint32_t	id_idx;
311 	uint32_t	id_idx_msk;
312 	uint32_t	id_free_counter;
313 	uint32_t	id_max_free_counter;
314 } smb_idpool_t;
315 
316 /*
317  * Maximum size of a Transport Data Unit when CAP_LARGE_READX and
318  * CAP_LARGE_WRITEX are not set.  CAP_LARGE_READX/CAP_LARGE_WRITEX
319  * allow the payload to exceed the negotiated buffer size.
320  *     4 --> NBT/TCP Transport Header.
321  *    32 --> SMB Header
322  *     1 --> Word Count byte
323  *   510 --> Maximum Number of bytes of the Word Table (2 * 255)
324  *     2 --> Byte count of the data
325  * 65535 --> Maximum size of the data
326  * -----
327  * 66084
328  */
329 #define	SMB_REQ_MAX_SIZE	66560		/* 65KB */
330 #define	SMB_XPRT_MAX_SIZE	(SMB_REQ_MAX_SIZE + NETBIOS_HDR_SZ)
331 
332 #define	SMB_TXREQ_MAGIC		0X54524251	/* 'TREQ' */
333 typedef struct {
334 	list_node_t	tr_lnd;
335 	uint32_t	tr_magic;
336 	int		tr_len;
337 	uint8_t		tr_buf[SMB_XPRT_MAX_SIZE];
338 } smb_txreq_t;
339 
340 #define	SMB_TXLST_MAGIC		0X544C5354	/* 'TLST' */
341 typedef struct {
342 	uint32_t	tl_magic;
343 	kmutex_t	tl_mutex;
344 	kcondvar_t	tl_wait_cv;
345 	boolean_t	tl_active;
346 } smb_txlst_t;
347 
348 /*
349  * Maximum buffer size for NT is 37KB.  If all clients are Windows 2000, this
350  * can be changed to 64KB.  37KB must be used with a mix of NT/Windows 2000
351  * clients because NT loses directory entries when values greater than 37KB are
352  * used.
353  *
354  * Note: NBT_MAXBUF will be subtracted from the specified max buffer size to
355  * account for the NBT header.
356  */
357 #define	NBT_MAXBUF		8
358 #define	SMB_NT_MAXBUF		(37 * 1024)
359 
360 #define	OUTBUFSIZE		(65 * 1024)
361 #define	SMBHEADERSIZE		32
362 #define	SMBND_HASH_MASK		(0xFF)
363 #define	MAX_IOVEC		512
364 #define	MAX_READREF		(8 * 1024)
365 
366 #define	SMB_WORKER_MIN		4
367 #define	SMB_WORKER_DEFAULT	64
368 #define	SMB_WORKER_MAX		1024
369 
370 /*
371  * Destructor object used in the locked-list delete queue.
372  */
373 #define	SMB_DTOR_MAGIC		0x44544F52	/* DTOR */
374 #define	SMB_DTOR_VALID(d)	\
375     ASSERT(((d) != NULL) && ((d)->dt_magic == SMB_DTOR_MAGIC))
376 
377 typedef void (*smb_dtorproc_t)(void *);
378 
379 typedef struct smb_dtor {
380 	list_node_t	dt_lnd;
381 	uint32_t	dt_magic;
382 	void		*dt_object;
383 	smb_dtorproc_t	dt_proc;
384 } smb_dtor_t;
385 
386 typedef struct smb_lavl {
387 	krwlock_t	la_lock;
388 	avl_tree_t	la_tree;
389 	uint64_t	la_wrop;
390 	kmutex_t	la_mutex;
391 	list_t		la_deleteq;
392 	uint32_t	la_deleteq_count;
393 	boolean_t	la_flushing;
394 } smb_lavl_t;
395 
396 typedef struct smb_llist {
397 	krwlock_t	ll_lock;
398 	list_t		ll_list;
399 	uint32_t	ll_count;
400 	uint64_t	ll_wrop;
401 	kmutex_t	ll_mutex;
402 	list_t		ll_deleteq;
403 	uint32_t	ll_deleteq_count;
404 	boolean_t	ll_flushing;
405 } smb_llist_t;
406 
407 typedef struct smb_bucket {
408 	smb_llist_t	b_list;
409 	uint32_t	b_max_seen;
410 } smb_bucket_t;
411 
412 typedef struct smb_hash {
413 	uint32_t	rshift;
414 	uint32_t	num_buckets;
415 	smb_bucket_t	*buckets;
416 } smb_hash_t;
417 
418 typedef struct smb_slist {
419 	kmutex_t	sl_mutex;
420 	kcondvar_t	sl_cv;
421 	list_t		sl_list;
422 	uint32_t	sl_count;
423 	boolean_t	sl_waiting;
424 } smb_slist_t;
425 
426 /*
427  * smb_avl_t State Machine
428  * --------------------
429  *
430  *                      +-----------------------------+
431  *                      |     SMB_AVL_STATE_START     |
432  *                      +-----------------------------+
433  *                                    | T0
434  *                                    v
435  *                      +-----------------------------+
436  *                      |     SMB_AVL_STATE_READY     |
437  *                      +-----------------------------+
438  *                                    | T1
439  *                                    v
440  *                      +-----------------------------+
441  *                      |  SMB_AVL_STATE_DESTROYING   |
442  *                      +-----------------------------+
443  *
444  * Transition T0
445  *
446  *    This transition is executed in smb_avl_create().
447  *
448  * Transition T1
449  *
450  *    This transition is executed in smb_avl_destroy().
451  *
452  */
453 typedef enum {
454 	SMB_AVL_STATE_START = 0,
455 	SMB_AVL_STATE_READY,
456 	SMB_AVL_STATE_DESTROYING
457 } smb_avl_state_t;
458 
459 typedef struct smb_avl_nops {
460 	int		(*avln_cmp) (const void *, const void *);
461 	void		(*avln_hold)(const void *);
462 	boolean_t	(*avln_rele)(const void *);
463 	void		(*avln_destroy)(void *);
464 } smb_avl_nops_t;
465 
466 typedef struct smb_avl_cursor {
467 	void		*avlc_next;
468 	uint32_t	avlc_sequence;
469 } smb_avl_cursor_t;
470 
471 typedef struct smb_avl {
472 	krwlock_t	avl_lock;
473 	avl_tree_t	avl_tree;
474 	kmutex_t	avl_mutex;
475 	kcondvar_t	avl_cv;
476 	smb_avl_state_t	avl_state;
477 	uint32_t	avl_refcnt;
478 	uint32_t	avl_sequence;
479 	const smb_avl_nops_t	*avl_nops;
480 } smb_avl_t;
481 
482 typedef struct {
483 	kcondvar_t	rwx_cv;
484 	kmutex_t	rwx_mutex;
485 	krwlock_t	rwx_lock;
486 	boolean_t	rwx_waiting;
487 } smb_rwx_t;
488 
489 typedef struct smb_export {
490 	kmutex_t	e_mutex;
491 	boolean_t	e_ready;
492 	smb_avl_t	e_share_avl;
493 	smb_slist_t	e_unexport_list;
494 	smb_thread_t	e_unexport_thread;
495 } smb_export_t;
496 
497 /*
498  * NOTIFY CHANGE, a.k.a. File Change Notification (FCN)
499  */
500 
501 /*
502  * These FCN filter mask values are not from MS-FSCC, but
503  * must not overlap with any FILE_NOTIFY_VALID_MASK values.
504  */
505 #define	FILE_NOTIFY_CHANGE_EV_SUBDIR	0x00010000
506 #define	FILE_NOTIFY_CHANGE_EV_DELETE	0x00020000
507 #define	FILE_NOTIFY_CHANGE_EV_CLOSED	0x00040000
508 #define	FILE_NOTIFY_CHANGE_EV_OVERFLOW	0x00080000
509 
510 /*
511  * Note: These FCN action values are not from MS-FSCC, but must
512  * follow in sequence from FILE_ACTION_MODIFIED_STREAM.
513  *
514  * FILE_ACTION_SUBDIR_CHANGED is used internally for
515  * "watch tree" support, posted to all parents of a
516  * directory that had one of the changes above.
517  *
518  * FILE_ACTION_DELETE_PENDING is used internally to tell
519  * notify change requests when the "delete-on-close" flag
520  * has been set on the directory being watched.
521  *
522  * FILE_ACTION_HANDLE_CLOSED is used to wakeup notify change
523  * requests when the watched directory handle is closed.
524  */
525 #define	FILE_ACTION_SUBDIR_CHANGED	0x00000009
526 #define	FILE_ACTION_DELETE_PENDING	0x0000000a
527 #define	FILE_ACTION_HANDLE_CLOSED	0x0000000b
528 
529 /*
530  * Sub-struct within smb_ofile_t
531  */
532 typedef struct smb_notify {
533 	list_t			nc_waiters; /* Waiting SRs */
534 	mbuf_chain_t		nc_buffer;
535 	uint32_t		nc_filter;
536 	uint32_t		nc_events;
537 	int			nc_last_off;
538 	boolean_t		nc_subscribed;
539 } smb_notify_t;
540 
541 /*
542  * SMB operates over a NetBIOS-over-TCP transport (NBT) or directly
543  * over TCP, which is also known as direct hosted NetBIOS-less SMB
544  * or SMB-over-TCP.
545  *
546  * NBT messages have a 4-byte header that defines the message type
547  * (8-bits), a 7-bit flags field and a 17-bit length.
548  *
549  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
550  * |      TYPE     |     FLAGS   |E|            LENGTH             |
551  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
552  *
553  * 8-bit type      Defined in RFC 1002
554  * 7-bit flags     Bits 0-6 reserved (must be 0)
555  *                 Bit 7: Length extension bit (E)
556  * 17-bit length   Includes bit 7 of the flags byte
557  *
558  *
559  * SMB-over-TCP is defined to use a modified version of the NBT header
560  * containing an 8-bit message type and 24-bit message length.
561  *
562  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
563  * |      TYPE     |                  LENGTH                       |
564  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
565  *
566  * 8-bit type      Must be 0
567  * 24-bit length
568  *
569  * The following structure is used to represent a generic, in-memory
570  * SMB transport header; it is not intended to map directly to either
571  * of the over-the-wire formats.
572  */
573 typedef struct {
574 	uint8_t		xh_type;
575 	uint32_t	xh_length;
576 } smb_xprt_t;
577 
578 int MBC_LENGTH(struct mbuf_chain *);
579 int MBC_MAXBYTES(struct mbuf_chain *);
580 void MBC_SETUP(struct mbuf_chain *, uint32_t);
581 void MBC_INIT(struct mbuf_chain *, uint32_t);
582 void MBC_FLUSH(struct mbuf_chain *);
583 void MBC_ATTACH_MBUF(struct mbuf_chain *, struct mbuf *);
584 void MBC_APPEND_MBUF(struct mbuf_chain *, struct mbuf *);
585 void MBC_ATTACH_BUF(struct mbuf_chain *MBC, unsigned char *BUF, int LEN);
586 int MBC_SHADOW_CHAIN(struct mbuf_chain *SUBMBC, struct mbuf_chain *MBC,
587     int OFF, int LEN);
588 
589 #define	MBC_ROOM_FOR(b, n) (((b)->chain_offset + (n)) <= (b)->max_bytes)
590 
591 /*
592  * Per smb_node oplock state
593  */
594 typedef struct smb_oplock {
595 	kmutex_t		ol_mutex;
596 	boolean_t		ol_fem;		/* fem monitor installed? */
597 	struct smb_ofile	*excl_open;
598 	uint32_t		ol_state;
599 	int32_t			cnt_II;
600 	int32_t			cnt_R;
601 	int32_t			cnt_RH;
602 	int32_t			cnt_RHBQ;
603 	int32_t			waiters;
604 	kcondvar_t		WaitingOpenCV;
605 } smb_oplock_t;
606 
607 /*
608  * Per smb_ofile oplock state
609  */
610 typedef struct smb_oplock_grant {
611 	/* smb protocol-level state */
612 	uint32_t		og_state;	/* what client has now */
613 	uint32_t		og_breakto;	/* level breaking to */
614 	boolean_t		og_breaking;
615 	uint16_t		og_dialect;	/* how to send breaks */
616 	kcondvar_t		og_ack_cv;	/* Wait for ACK */
617 	/* File-system level state */
618 	uint8_t			onlist_II;
619 	uint8_t			onlist_R;
620 	uint8_t			onlist_RH;
621 	uint8_t			onlist_RHBQ;
622 	uint8_t			BreakingToRead;
623 } smb_oplock_grant_t;
624 
625 #define	SMB_LEASE_KEY_SZ	16
626 
627 typedef struct smb_lease {
628 	list_node_t		ls_lnd;		/* sv_lease_ht */
629 	kmutex_t		ls_mutex;	/* for ls_refcnt */
630 	smb_llist_t		*ls_bucket;
631 	struct smb_node		*ls_node;
632 	/*
633 	 * With a lease, just one ofile has the oplock.
634 	 * This (used only for comparison) identifies which.
635 	 */
636 	void			*ls_oplock_ofile;
637 	uint32_t		ls_refcnt;
638 	uint32_t		ls_state;	/* what client has now */
639 	uint32_t		ls_breakto;	/* level breaking to */
640 	uint16_t		ls_epoch;
641 	uint16_t		ls_version;
642 	boolean_t		ls_breaking;
643 	boolean_t		ls_destroying;
644 	kcondvar_t		ls_ack_cv;	/* Wait for ACK */
645 	uint8_t			ls_key[SMB_LEASE_KEY_SZ];
646 	uint8_t			ls_clnt[SMB_LEASE_KEY_SZ];
647 } smb_lease_t;
648 
649 #define	SMB_NODE_MAGIC		0x4E4F4445	/* 'NODE' */
650 #define	SMB_NODE_VALID(p)	ASSERT((p)->n_magic == SMB_NODE_MAGIC)
651 
652 typedef enum {
653 	SMB_NODE_STATE_AVAILABLE = 0,
654 	SMB_NODE_STATE_DESTROYING
655 } smb_node_state_t;
656 
657 /*
658  * waiting_event        # of clients requesting FCN
659  * n_timestamps         cached timestamps
660  * n_allocsz            cached file allocation size
661  * n_dnode              directory node
662  * n_unode              unnamed stream node
663  * delete_on_close_cred credentials for delayed delete
664  */
665 typedef struct smb_node {
666 	list_node_t		n_lnd;
667 	uint32_t		n_magic;
668 	krwlock_t		n_lock;
669 	kmutex_t		n_mutex;
670 	smb_node_state_t	n_state;
671 	uint32_t		n_refcnt;
672 	uint32_t		n_hashkey;
673 	smb_llist_t		*n_hash_bucket;
674 	uint32_t		n_open_count;
675 	uint32_t		n_opening_count;
676 	smb_llist_t		n_ofile_list;
677 	/* If entering both, go in order n_lock_list, n_wlock_list */
678 	smb_llist_t		n_lock_list;	/* active locks */
679 	smb_llist_t		n_wlock_list;	/* waiting locks */
680 	volatile int		flags;
681 	u_offset_t		n_allocsz;
682 	uint32_t		n_fcn_count;
683 	smb_oplock_t		n_oplock;
684 	struct smb_node		*n_dnode;
685 	struct smb_node		*n_unode;
686 	cred_t			*delete_on_close_cred;
687 	uint32_t		n_delete_on_close_flags;
688 	char			od_name[MAXNAMELEN];
689 	vnode_t			*vp;
690 	smb_audit_buf_node_t	*n_audit_buf;
691 } smb_node_t;
692 
693 #define	NODE_FLAGS_REPARSE		0x00001000
694 #define	NODE_FLAGS_DFSLINK		0x00002000
695 #define	NODE_FLAGS_VFSROOT		0x00004000
696 #define	NODE_FLAGS_SYSTEM		0x00008000
697 #define	NODE_FLAGS_WRITE_THROUGH	0x00100000
698 #define	NODE_XATTR_DIR			0x01000000
699 #define	NODE_FLAGS_DELETE_COMMITTED	0x20000000
700 #define	NODE_FLAGS_DELETE_ON_CLOSE	0x40000000
701 #define	NODE_FLAGS_EXECUTABLE		0x80000000
702 
703 #define	SMB_NODE_VFS(node)	((node)->vp->v_vfsp)
704 #define	SMB_NODE_FSID(node)	((node)->vp->v_vfsp->vfs_fsid)
705 
706 /* Maximum buffer size for encryption key */
707 #define	SMB_ENCRYPT_KEY_MAXLEN		32
708 
709 #define	SMB_SHARE_MAGIC		0x4B534852	/* KSHR */
710 
711 typedef struct smb_kshare {
712 	uint32_t	shr_magic;
713 	avl_node_t	shr_link;
714 	kmutex_t	shr_mutex;
715 	kcondvar_t	shr_cv;
716 	char		*shr_name;
717 	char		*shr_path;
718 	char		*shr_cmnt;
719 	char		*shr_container;
720 	char		*shr_oemname;
721 	uint32_t	shr_flags;
722 	uint32_t	shr_type;
723 	uint32_t	shr_refcnt;
724 	uint32_t	shr_autocnt;
725 	uid_t		shr_uid;
726 	gid_t		shr_gid;
727 	char		*shr_access_none;
728 	char		*shr_access_ro;
729 	char		*shr_access_rw;
730 	smb_node_t	*shr_root_node;
731 	smb_node_t	*shr_ca_dir;
732 	void		*shr_import_busy;
733 	smb_cfg_val_t	shr_encrypt; /* Share.EncryptData */
734 } smb_kshare_t;
735 
736 
737 typedef struct smb_arg_negotiate {
738 	char		*ni_name;
739 	int		ni_dialect;
740 	int		ni_index;
741 	uint32_t	ni_capabilities;
742 	uint16_t	ni_maxmpxcount;
743 	int16_t		ni_tzcorrection;
744 	uint8_t		ni_keylen;
745 	uint8_t		ni_key[SMB_ENCRYPT_KEY_MAXLEN];
746 	timestruc_t	ni_servertime;
747 } smb_arg_negotiate_t;
748 
749 typedef enum {
750 	SMB_SSNSETUP_PRE_NTLM012 = 1,
751 	SMB_SSNSETUP_NTLM012_NOEXT,
752 	SMB_SSNSETUP_NTLM012_EXTSEC
753 } smb_ssnsetup_type_t;
754 
755 typedef struct smb_arg_sessionsetup {
756 	smb_ssnsetup_type_t ssi_type;
757 	char		*ssi_user;
758 	char		*ssi_domain;
759 	/* LM password hash, f.k.a. case-insensitive p/w */
760 	uint16_t	ssi_lmpwlen;
761 	uint8_t		*ssi_lmpwd;
762 	/* NT password hash, f.k.a. case-sensitive p/w */
763 	uint16_t	ssi_ntpwlen;
764 	uint8_t		*ssi_ntpwd;
765 	/* Incoming security blob */
766 	uint16_t	ssi_iseclen;
767 	uint8_t		*ssi_isecblob;
768 	/* Incoming security blob */
769 	uint16_t	ssi_oseclen;
770 	uint8_t		*ssi_osecblob;
771 	/* parameters */
772 	uint16_t	ssi_maxbufsize;
773 	uint16_t	ssi_maxmpxcount;
774 	uint32_t	ssi_capabilities;
775 	int		ssi_native_os;
776 	int		ssi_native_lm;
777 } smb_arg_sessionsetup_t;
778 
779 typedef struct tcon {
780 	char		*name;
781 	char		*path;
782 	char		*service;
783 	int		pwdlen;
784 	char		*password;
785 	uint16_t	flags;
786 	uint16_t	optional_support;
787 	smb_kshare_t	*si;
788 } smb_arg_tcon_t;
789 
790 /*
791  * Based on section 2.6.1.2 (Connection Management) of the June 13,
792  * 1996 CIFS spec, a server may terminate the transport connection
793  * due to inactivity. The client software is expected to be able to
794  * automatically reconnect to the server if this happens. Like much
795  * of the useful background information, this section appears to
796  * have been dropped from later revisions of the document.
797  *
798  * Each session has an activity timestamp that's updated whenever a
799  * request is dispatched. If the session is idle, i.e. receives no
800  * requests, for SMB_SESSION_INACTIVITY_TIMEOUT minutes it will be
801  * closed.
802  *
803  * Each session has an I/O semaphore to serialize communication with
804  * the client. For example, after receiving a raw-read request, the
805  * server is not allowed to send an oplock break to the client until
806  * after it has sent the raw-read data.
807  */
808 #define	SMB_SESSION_INACTIVITY_TIMEOUT		(15 * 60)
809 
810 /* SMB1 signing */
811 struct smb_sign {
812 	unsigned int flags;
813 	uint32_t seqnum;
814 	uint_t mackey_len;
815 	uint8_t *mackey;
816 };
817 
818 /*
819  * SMB2 signing
820  */
821 struct smb_key {
822 	uint_t len;
823 	uint8_t key[32]; /* fit AES-256 key */
824 };
825 
826 #define	SMB_SIGNING_ENABLED	1
827 #define	SMB_SIGNING_CHECK	2
828 
829 /*
830  * Locking notes:
831  * If you hold the mutex/lock on an object, don't flush the deleteq
832  * of the objects directly below it in the logical hierarchy
833  * (i.e. via smb_llist_exit()). I.e. don't drop s_tree_list when
834  * you hold u_mutex, because deleted trees need u_mutex to
835  * lower the refcnt.
836  *
837  * Note that this also applies to u_mutex and t_ofile_list.
838  */
839 
840 /*
841  * The "session" object.
842  *
843  * Note that the smb_session_t object here corresponds to what MS-SMB2
844  * calls a "connection".  Adding to the confusion, what MS calls a
845  * "session" corresponds to our smb_user_t (below).
846  */
847 
848 /*
849  * Session State Machine
850  * ---------------------
851  *
852  *
853  * +-----------------------------+	    +----------------------------+
854  * | SMB_SESSION_STATE_CONNECTED |	    | SMB_SESSION_STATE_SHUTDOWN |
855  * +-----------------------------+	    +----------------------------+
856  *		  |					     ^
857  *		  |					     |T6
858  *		  |			    +------------------------------+
859  *		  |			    | SMB_SESSION_STATE_TERMINATED |
860  *		T0|			    +------------------------------+
861  *		  +--------------------+		     ^
862  *		  v		       |T4                   |T5
863  * +-------------------------------+   |    +--------------------------------+
864  * | SMB_SESSION_STATE_ESTABLISHED |---+--->| SMB_SESSION_STATE_DISCONNECTED |
865  * +-------------------------------+        +--------------------------------+
866  *		T1|				^
867  *		  +----------+			|T3
868  *                           v			|
869  *                  +------------------------------+
870  *                  | SMB_SESSION_STATE_NEGOTIATED |
871  *                  +------------------------------+
872  *
873  *
874  * Transition T0
875  *
876  *
877  *
878  * Transition T1
879  *
880  *
881  *
882  * Transition T2
883  *
884  *
885  *
886  * Transition T3
887  *
888  *
889  *
890  * Transition T4
891  *
892  *
893  *
894  * Transition T5
895  *
896  *
897  *
898  * Transition T6
899  *
900  *
901  *
902  */
903 #define	SMB_SESSION_MAGIC	0x53455353	/* 'SESS' */
904 #define	SMB_SESSION_VALID(p)	\
905     ASSERT(((p) != NULL) && ((p)->s_magic == SMB_SESSION_MAGIC))
906 
907 #define	SMB_CHALLENGE_SZ	8
908 #define	SMB3_PREAUTH_HASHVAL_SZ	64
909 
910 typedef enum {
911 	SMB_SESSION_STATE_INITIALIZED = 0,
912 	SMB_SESSION_STATE_DISCONNECTED,
913 	SMB_SESSION_STATE_CONNECTED,
914 	SMB_SESSION_STATE_ESTABLISHED,
915 	SMB_SESSION_STATE_NEGOTIATED,
916 	SMB_SESSION_STATE_TERMINATED,
917 	SMB_SESSION_STATE_SHUTDOWN,
918 	SMB_SESSION_STATE_SENTINEL
919 } smb_session_state_t;
920 
921 /* Bits in s_flags below */
922 #define	SMB_SSN_AAPL_CCEXT	1	/* Saw "AAPL" create ctx. ext. */
923 #define	SMB_SSN_AAPL_READDIR	2	/* Wants MacOS ext. readdir */
924 
925 typedef struct smb_session {
926 	list_node_t		s_lnd;
927 	uint32_t		s_magic;
928 	smb_rwx_t		s_lock;
929 	uint64_t		s_kid;
930 	smb_session_state_t	s_state;
931 	uint32_t		s_flags;
932 	kthread_t		*s_thread;
933 	kt_did_t		s_ktdid;
934 	int	(*newrq_func)(struct smb_request *);
935 	struct smb_server	*s_server;
936 	smb_kmod_cfg_t		s_cfg;
937 	int32_t			s_gmtoff;
938 	uint32_t		keep_alive;
939 	uint64_t		opentime;
940 	uint16_t		s_local_port;
941 	uint16_t		s_remote_port;
942 	smb_inaddr_t		ipaddr;
943 	smb_inaddr_t		local_ipaddr;
944 	int			dialect;
945 	int			native_os;
946 	int			native_lm;
947 
948 	kmutex_t		s_credits_mutex;
949 	uint16_t		s_cur_credits;
950 	uint16_t		s_max_credits;
951 
952 	uint32_t		capabilities;
953 	uint32_t		srv_cap;
954 
955 	struct smb_sign		signing;	/* SMB1 */
956 	void			*sign_mech;	/* mechanism info */
957 	void			*enc_mech;
958 	void			*preauth_mech;
959 
960 	/* SMB2/SMB3 signing support */
961 	int			(*sign_calc)(struct smb_request *,
962 					struct mbuf_chain *, uint8_t *);
963 	void			(*sign_fini)(struct smb_session *);
964 
965 	ksocket_t		sock;
966 
967 	smb_slist_t		s_req_list;
968 	smb_llist_t		s_xa_list;
969 	smb_llist_t		s_user_list;
970 	smb_llist_t		s_tree_list;
971 	smb_idpool_t		s_uid_pool;
972 	smb_idpool_t		s_tid_pool;
973 	smb_txlst_t		s_txlst;
974 
975 	volatile uint32_t	s_tree_cnt;
976 	volatile uint32_t	s_file_cnt;
977 	volatile uint32_t	s_dir_cnt;
978 
979 	uint16_t		cli_secmode;
980 	uint16_t		srv_secmode;
981 	uint32_t		sesskey;
982 	uint32_t		challenge_len;
983 	unsigned char		challenge_key[SMB_CHALLENGE_SZ];
984 	int64_t			activity_timestamp;
985 	timeout_id_t		s_auth_tmo;
986 
987 	/*
988 	 * Maximum negotiated buffer sizes between SMB client and server
989 	 * in SMB_SESSION_SETUP_ANDX
990 	 */
991 	int			cmd_max_bytes;
992 	int			reply_max_bytes;
993 	uint16_t		smb_msg_size;
994 	uint16_t		smb_max_mpx;
995 	smb_srqueue_t		*s_srqueue;
996 	uint64_t		start_time;
997 
998 	uint16_t		smb31_enc_cipherid;
999 	uint16_t		smb31_preauth_hashid;
1000 	uint8_t			smb31_preauth_hashval[SMB3_PREAUTH_HASHVAL_SZ];
1001 
1002 	unsigned char		MAC_key[44];
1003 	char			ip_addr_str[INET6_ADDRSTRLEN];
1004 	uint8_t			clnt_uuid[16];
1005 	char			workstation[SMB_PI_MAX_HOST];
1006 } smb_session_t;
1007 
1008 /*
1009  * The "user" object.
1010  *
1011  * Note that smb_user_t object here corresponds to what MS-SMB2 calls
1012  * a "session".  (Our smb_session_t is something else -- see above).
1013  */
1014 
1015 #define	SMB_USER_MAGIC 0x55534552	/* 'USER' */
1016 #define	SMB_USER_VALID(u)	\
1017     ASSERT(((u) != NULL) && ((u)->u_magic == SMB_USER_MAGIC))
1018 
1019 /* These flags are all <= 0x00000010 */
1020 #define	SMB_USER_FLAG_GUEST			SMB_ATF_GUEST
1021 #define	SMB_USER_FLAG_ANON			SMB_ATF_ANON
1022 #define	SMB_USER_FLAG_ADMIN			SMB_ATF_ADMIN
1023 #define	SMB_USER_FLAG_POWER_USER		SMB_ATF_POWERUSER
1024 #define	SMB_USER_FLAG_BACKUP_OPERATOR		SMB_ATF_BACKUPOP
1025 
1026 #define	SMB_USER_IS_ADMIN(U)	(((U)->u_flags & SMB_USER_FLAG_ADMIN) != 0)
1027 #define	SMB_USER_IS_GUEST(U)	(((U)->u_flags & SMB_USER_FLAG_GUEST) != 0)
1028 
1029 /*
1030  * Internal privilege flags derived from smb_privilege.h numbers
1031  * Would rather not include that in this file.
1032  */
1033 #define	SMB_USER_PRIV_SECURITY		(1<<8)	/* SE_SECURITY_LUID */
1034 #define	SMB_USER_PRIV_TAKE_OWNERSHIP	(1<<9)	/* SE_TAKE_OWNERSHIP_LUID */
1035 #define	SMB_USER_PRIV_BACKUP		(1<<17)	/* SE_BACKUP_LUID */
1036 #define	SMB_USER_PRIV_RESTORE		(1<<18)	/* SE_RESTORE_LUID */
1037 #define	SMB_USER_PRIV_CHANGE_NOTIFY	(1<<23)	/* SE_CHANGE_NOTIFY_LUID */
1038 #define	SMB_USER_PRIV_READ_FILE		(1<<25)	/* SE_READ_FILE_LUID */
1039 #define	SMB_USER_PRIV_WRITE_FILE	(1<<26)	/* SE_WRITE_FILE_LUID */
1040 
1041 /*
1042  * See the long "User State Machine" comment in smb_user.c
1043  */
1044 typedef enum {
1045 	SMB_USER_STATE_LOGGING_ON = 0,
1046 	SMB_USER_STATE_LOGGED_ON,
1047 	SMB_USER_STATE_LOGGING_OFF,
1048 	SMB_USER_STATE_LOGGED_OFF,
1049 	SMB_USER_STATE_SENTINEL
1050 } smb_user_state_t;
1051 
1052 typedef enum {
1053 	SMB2_DH_PRESERVE_NONE = 0,
1054 	SMB2_DH_PRESERVE_SOME,
1055 	SMB2_DH_PRESERVE_ALL
1056 } smb_preserve_type_t;
1057 
1058 typedef struct smb_user {
1059 	list_node_t		u_lnd;
1060 	uint32_t		u_magic;
1061 	kmutex_t		u_mutex;
1062 	smb_user_state_t	u_state;
1063 
1064 	struct smb_server	*u_server;
1065 	smb_session_t		*u_session;
1066 	ksocket_t		u_authsock;
1067 	timeout_id_t		u_auth_tmo;
1068 	uint16_t		u_name_len;
1069 	char			*u_name;
1070 	uint16_t		u_domain_len;
1071 	char			*u_domain;
1072 	time_t			u_logon_time;
1073 	cred_t			*u_cred;
1074 	cred_t			*u_privcred;
1075 
1076 	uint64_t		u_ssnid;	/* unique server-wide */
1077 	uint32_t		u_refcnt;
1078 	uint32_t		u_flags;
1079 	smb_preserve_type_t	preserve_opens;
1080 	uint32_t		u_privileges;
1081 	uint16_t		u_uid;		/* unique per-session */
1082 	uint32_t		u_audit_sid;
1083 	uint32_t		u_owned_tree_cnt;
1084 	kcondvar_t		u_owned_tree_cv;
1085 
1086 	uint32_t		u_sign_flags;
1087 	struct smb_key		u_sign_key;	/* SMB2 signing */
1088 
1089 	struct smb_key		u_enc_key;
1090 	struct smb_key		u_dec_key;
1091 	volatile uint64_t	u_nonce_cnt;
1092 	uint8_t			u_nonce_fixed[4];
1093 	uint64_t		u_salt;
1094 	smb_cfg_val_t		u_encrypt;
1095 
1096 	/* SMB 3.1.1 preauth session hashval */
1097 	uint8_t			u_preauth_hashval[SMB3_PREAUTH_HASHVAL_SZ];
1098 } smb_user_t;
1099 
1100 #define	SMB_TREE_MAGIC			0x54524545	/* 'TREE' */
1101 #define	SMB_TREE_VALID(p)	\
1102     ASSERT((p != NULL) && ((p)->t_magic == SMB_TREE_MAGIC))
1103 
1104 #define	SMB_TYPENAMELEN			_ST_FSTYPSZ
1105 #define	SMB_VOLNAMELEN			32
1106 
1107 #define	SMB_TREE_READONLY		0x00000001
1108 #define	SMB_TREE_SUPPORTS_ACLS		0x00000002
1109 #define	SMB_TREE_STREAMS		0x00000004
1110 #define	SMB_TREE_CASEINSENSITIVE	0x00000008
1111 #define	SMB_TREE_NO_CASESENSITIVE	0x00000010
1112 #define	SMB_TREE_NO_EXPORT		0x00000020
1113 #define	SMB_TREE_OPLOCKS		0x00000040
1114 #define	SMB_TREE_SHORTNAMES		0x00000080
1115 #define	SMB_TREE_XVATTR			0x00000100
1116 #define	SMB_TREE_DIRENTFLAGS		0x00000200
1117 #define	SMB_TREE_ACLONCREATE		0x00000400
1118 #define	SMB_TREE_ACEMASKONACCESS	0x00000800
1119 #define	SMB_TREE_NFS_MOUNTED		0x00001000
1120 #define	SMB_TREE_UNICODE_ON_DISK	0x00002000
1121 #define	SMB_TREE_CATIA			0x00004000
1122 #define	SMB_TREE_ABE			0x00008000
1123 #define	SMB_TREE_QUOTA			0x00010000
1124 #define	SMB_TREE_DFSROOT		0x00020000
1125 #define	SMB_TREE_SPARSE			0x00040000
1126 #define	SMB_TREE_TRAVERSE_MOUNTS	0x00080000
1127 #define	SMB_TREE_FORCE_L2_OPLOCK	0x00100000
1128 #define	SMB_TREE_CA			0x00200000
1129 /* Note: SMB_TREE_... in the mdb module too. */
1130 
1131 /*
1132  * See the long "Tree State Machine" comment in smb_tree.c
1133  */
1134 typedef enum {
1135 	SMB_TREE_STATE_CONNECTED = 0,
1136 	SMB_TREE_STATE_DISCONNECTING,
1137 	SMB_TREE_STATE_DISCONNECTED,
1138 	SMB_TREE_STATE_SENTINEL
1139 } smb_tree_state_t;
1140 
1141 typedef struct smb_tree {
1142 	list_node_t		t_lnd;
1143 	uint32_t		t_magic;
1144 	kmutex_t		t_mutex;
1145 	smb_tree_state_t	t_state;
1146 
1147 	struct smb_server	*t_server;
1148 	smb_session_t		*t_session;
1149 	/*
1150 	 * user whose uid was in the tree connect message
1151 	 * ("owner" in MS-CIFS parlance, see section 2.2.1.6 definition of FID)
1152 	 */
1153 	smb_user_t		*t_owner;
1154 	smb_node_t		*t_snode;
1155 
1156 	smb_lavl_t		t_ofile_list;
1157 	smb_idpool_t		t_fid_pool;
1158 
1159 	smb_llist_t		t_odir_list;
1160 	smb_idpool_t		t_odid_pool;
1161 
1162 	uint32_t		t_refcnt;
1163 	uint32_t		t_flags;
1164 	int32_t			t_res_type;
1165 	uint16_t		t_tid;
1166 	uint16_t		t_umask;
1167 	char			t_sharename[MAXNAMELEN];
1168 	char			t_resource[MAXPATHLEN];
1169 	char			t_typename[SMB_TYPENAMELEN];
1170 	char			t_volume[SMB_VOLNAMELEN];
1171 	acl_type_t		t_acltype;
1172 	uint32_t		t_access;
1173 	uint32_t		t_execflags;
1174 	time_t			t_connect_time;
1175 	volatile uint32_t	t_open_files;
1176 	smb_cfg_val_t		t_encrypt; /* Share.EncryptData */
1177 	timestruc_t		t_create_time;
1178 } smb_tree_t;
1179 
1180 #define	SMB_TREE_VFS(tree)	((tree)->t_snode->vp->v_vfsp)
1181 #define	SMB_TREE_FSID(tree)	((tree)->t_snode->vp->v_vfsp->vfs_fsid)
1182 
1183 #define	SMB_TREE_IS_READONLY(sr)					\
1184 	((sr) != NULL && (sr)->tid_tree != NULL &&			\
1185 	!((sr)->tid_tree->t_access & ACE_ALL_WRITE_PERMS))
1186 
1187 #define	SMB_TREE_IS_CASEINSENSITIVE(sr)                                 \
1188 	(((sr) && (sr)->tid_tree) ?                                     \
1189 	smb_tree_has_feature((sr)->tid_tree, SMB_TREE_CASEINSENSITIVE) : 0)
1190 
1191 #define	SMB_TREE_HAS_ACCESS(sr, acemask)				\
1192 	((sr) == NULL ? ACE_ALL_PERMS : (				\
1193 	(((sr) && (sr)->tid_tree) ?					\
1194 	(((sr)->tid_tree->t_access) & (acemask)) : 0)))
1195 
1196 #define	SMB_TREE_SUPPORTS_CATIA(sr)					\
1197 	(((sr) && (sr)->tid_tree) ?                                     \
1198 	smb_tree_has_feature((sr)->tid_tree, SMB_TREE_CATIA) : 0)
1199 
1200 #define	SMB_TREE_SUPPORTS_ABE(sr)					\
1201 	(((sr) && (sr)->tid_tree) ?                                     \
1202 	smb_tree_has_feature((sr)->tid_tree, SMB_TREE_ABE) : 0)
1203 
1204 #define	SMB_TREE_IS_DFSROOT(sr)						\
1205 	(((sr) && (sr)->tid_tree) ?                                     \
1206 	smb_tree_has_feature((sr)->tid_tree, SMB_TREE_DFSROOT) : 0)
1207 
1208 #define	SMB_TREE_SUPPORTS_SHORTNAMES(sr)				\
1209 	(((sr) && (sr)->tid_tree) ?					\
1210 	smb_tree_has_feature((sr)->tid_tree, SMB_TREE_SHORTNAMES) : 0)
1211 
1212 /*
1213  * SMB_TREE_CONTAINS_NODE is used to check if a node is on the same
1214  * file system as the tree's root filesystem, or if mount point traversal
1215  * should be allowed.  Note that this is also called in some cases with
1216  * sr=NULL, where it is expected to evaluate to TRUE.
1217  */
1218 
1219 #define	SMB_TREE_CONTAINS_NODE(sr, node)                                \
1220 	((sr) == NULL || (sr)->tid_tree == NULL ||                      \
1221 	SMB_TREE_VFS((sr)->tid_tree) == SMB_NODE_VFS(node) ||           \
1222 	smb_tree_has_feature((sr)->tid_tree, SMB_TREE_TRAVERSE_MOUNTS))
1223 
1224 /*
1225  * SMB_PATHFILE_IS_READONLY indicates whether or not a file is
1226  * readonly when the caller has a path rather than an ofile.
1227  */
1228 #define	SMB_PATHFILE_IS_READONLY(sr, node)			\
1229 	(SMB_TREE_IS_READONLY((sr)) ||				\
1230 	smb_node_file_is_readonly((node)))
1231 
1232 #define	SMB_ODIR_MAGIC		0x4F444952	/* 'ODIR' */
1233 #define	SMB_ODIR_VALID(p)	\
1234     ASSERT((p != NULL) && ((p)->d_magic == SMB_ODIR_MAGIC))
1235 
1236 #define	SMB_ODIR_BUFSIZE	(8 * 1024)
1237 
1238 /* smb_odir_t d_flags */
1239 #define	SMB_ODIR_FLAG_WILDCARDS		0x0001
1240 #define	SMB_ODIR_FLAG_IGNORE_CASE	0x0002
1241 #define	SMB_ODIR_FLAG_XATTR		0x0004
1242 #define	SMB_ODIR_FLAG_EDIRENT		0x0008
1243 #define	SMB_ODIR_FLAG_CATIA		0x0010
1244 #define	SMB_ODIR_FLAG_ABE		0x0020
1245 #define	SMB_ODIR_FLAG_SHORTNAMES	0x0040
1246 #define	SMB_ODIR_FLAG_RESTRICTED	0x0080
1247 #define	SMB_ODIR_FLAG_ACEACCESS		0x0100
1248 
1249 typedef enum {
1250 	SMB_ODIR_STATE_OPEN = 0,
1251 	SMB_ODIR_STATE_IN_USE,
1252 	SMB_ODIR_STATE_CLOSING,
1253 	SMB_ODIR_STATE_CLOSED,
1254 	SMB_ODIR_STATE_SENTINEL
1255 } smb_odir_state_t;
1256 
1257 typedef enum {
1258 	SMB_ODIR_RESUME_CONT,
1259 	SMB_ODIR_RESUME_IDX,
1260 	SMB_ODIR_RESUME_COOKIE,
1261 	SMB_ODIR_RESUME_FNAME
1262 } smb_odir_resume_type_t;
1263 
1264 typedef struct smb_odir_resume {
1265 	smb_odir_resume_type_t	or_type;
1266 	int			or_idx;
1267 	uint32_t		or_cookie;
1268 	char			*or_fname;
1269 } smb_odir_resume_t;
1270 
1271 /*
1272  * Flags used when opening an odir
1273  */
1274 #define	SMB_ODIR_OPENF_BACKUP_INTENT	0x01
1275 
1276 typedef struct smb_odir {
1277 	list_node_t		d_lnd;
1278 	uint32_t		d_magic;
1279 	kmutex_t		d_mutex;
1280 	smb_odir_state_t	d_state;
1281 	smb_session_t		*d_session;
1282 	smb_user_t		*d_user;
1283 	smb_tree_t		*d_tree;
1284 	smb_node_t		*d_dnode;
1285 	cred_t			*d_cred;
1286 	uint32_t		d_opened_by_pid;
1287 	uint16_t		d_odid;
1288 	uint16_t		d_sattr;
1289 	uint32_t		d_refcnt;
1290 	uint32_t		d_flags;
1291 	boolean_t		d_eof;
1292 	int			d_bufsize;
1293 	uint64_t		d_offset;
1294 	union {
1295 		char		*u_bufptr;
1296 		struct edirent	*u_edp;
1297 		struct dirent64	*u_dp;
1298 	} d_u;
1299 	uint32_t		d_last_cookie;
1300 	uint32_t		d_cookies[SMB_MAX_SEARCH];
1301 	char			d_pattern[MAXNAMELEN];
1302 	char			d_buf[SMB_ODIR_BUFSIZE];
1303 	char			d_last_name[MAXNAMELEN];
1304 } smb_odir_t;
1305 #define	d_bufptr	d_u.u_bufptr
1306 #define	d_edp		d_u.u_edp
1307 #define	d_dp		d_u.u_dp
1308 
1309 typedef struct smb_odirent {
1310 	char		od_name[MAXNAMELEN];	/* on disk name */
1311 	ino64_t		od_ino;
1312 	uint32_t	od_eflags;
1313 } smb_odirent_t;
1314 
1315 #define	SMB_OPIPE_MAGIC		0x50495045	/* 'PIPE' */
1316 #define	SMB_OPIPE_VALID(p)	\
1317     ASSERT(((p) != NULL) && (p)->p_magic == SMB_OPIPE_MAGIC)
1318 #define	SMB_OPIPE_MAXNAME	32
1319 
1320 /*
1321  * Data structure for SMB_FTYPE_MESG_PIPE ofiles, which is used
1322  * at the interface between SMB and NDR RPC.
1323  */
1324 typedef struct smb_opipe {
1325 	uint32_t		p_magic;
1326 	kmutex_t		p_mutex;
1327 	kcondvar_t		p_cv;
1328 	struct smb_ofile	*p_ofile;
1329 	struct smb_server	*p_server;
1330 	uint32_t		p_refcnt;
1331 	ksocket_t		p_socket;
1332 	/* This is the "flat" name, without path prefix */
1333 	char			p_name[SMB_OPIPE_MAXNAME];
1334 } smb_opipe_t;
1335 
1336 /*
1337  * The of_ftype	of an open file should contain the SMB_FTYPE value
1338  * returned when the file/pipe was opened. The following
1339  * assumptions are currently made:
1340  *
1341  * File Type	    Node       PipeInfo
1342  * ---------	    --------   --------
1343  * SMB_FTYPE_DISK       Valid      Null
1344  * SMB_FTYPE_BYTE_PIPE  Undefined  Undefined
1345  * SMB_FTYPE_MESG_PIPE  Null       Valid
1346  * SMB_FTYPE_PRINTER    Undefined  Undefined
1347  * SMB_FTYPE_UNKNOWN    Undefined  Undefined
1348  */
1349 
1350 /*
1351  * Some flags for ofile structure
1352  *
1353  *	SMB_OFLAGS_SET_DELETE_ON_CLOSE
1354  *   Set this flag when the corresponding open operation whose
1355  *   DELETE_ON_CLOSE bit of the CreateOptions is set. If any
1356  *   open file instance has this bit set, the NODE_FLAGS_DELETE_ON_CLOSE
1357  *   will be set for the file node upon close.
1358  */
1359 
1360 /*	SMB_OFLAGS_READONLY		0x0001 (obsolete) */
1361 #define	SMB_OFLAGS_EXECONLY		0x0002
1362 #define	SMB_OFLAGS_SET_DELETE_ON_CLOSE	0x0004
1363 #define	SMB_OFLAGS_LLF_POS_VALID	0x0008
1364 
1365 #define	SMB_OFILE_MAGIC		0x4F464C45	/* 'OFLE' */
1366 #define	SMB_OFILE_VALID(p)	\
1367     ASSERT((p != NULL) && ((p)->f_magic == SMB_OFILE_MAGIC))
1368 
1369 /*
1370  * This is the size of the per-handle "Lock Sequence" array.
1371  * See LockSequenceIndex in [MS-SMB2] 2.2.26, and smb2_lock.c
1372  */
1373 #define	SMB_OFILE_LSEQ_MAX		64
1374 
1375 /* {arg_open,ofile}->dh_vers values */
1376 typedef enum {
1377 	SMB2_NOT_DURABLE = 0,
1378 	SMB2_DURABLE_V1,
1379 	SMB2_DURABLE_V2,
1380 	SMB2_RESILIENT,
1381 } smb_dh_vers_t;
1382 
1383 /*
1384  * See the long "Ofile State Machine" comment in smb_ofile.c
1385  */
1386 typedef enum {
1387 	SMB_OFILE_STATE_ALLOC = 0,
1388 	SMB_OFILE_STATE_OPEN,
1389 	SMB_OFILE_STATE_SAVE_DH,
1390 	SMB_OFILE_STATE_SAVING,
1391 	SMB_OFILE_STATE_CLOSING,
1392 	SMB_OFILE_STATE_CLOSED,
1393 	SMB_OFILE_STATE_ORPHANED,
1394 	SMB_OFILE_STATE_RECONNECT,
1395 	SMB_OFILE_STATE_EXPIRED,
1396 	SMB_OFILE_STATE_SENTINEL
1397 } smb_ofile_state_t;
1398 
1399 typedef struct smb_ofile {
1400 	uint16_t		f_fid;		/* keep first */
1401 	uint16_t		f_ftype;
1402 	uint32_t		f_magic;
1403 	avl_node_t		f_tree_lnd;	/* t_ofile_list */
1404 	list_node_t		f_node_lnd;	/* n_ofile_list */
1405 	list_node_t		f_dh_lnd;	/* sv_persistid_ht */
1406 	kmutex_t		f_mutex;
1407 	smb_ofile_state_t	f_state;
1408 
1409 	struct smb_server	*f_server;
1410 	smb_session_t		*f_session;
1411 	smb_user_t		*f_user;
1412 	smb_tree_t		*f_tree;
1413 	smb_node_t		*f_node;
1414 	smb_odir_t		*f_odir;
1415 	smb_opipe_t		*f_pipe;
1416 
1417 	kcondvar_t		f_cv;
1418 	/*
1419 	 * Note: f_persistid == 0 means this ofile has no persistid
1420 	 * (same interpretation at the protocol level).  IFF non-zero,
1421 	 * this ofile is linked in the sv_persistid_ht hash table.
1422 	 */
1423 	uint64_t		f_persistid;
1424 	uint32_t		f_uniqid;
1425 	uint32_t		f_refcnt;
1426 	uint64_t		f_seek_pos;
1427 	uint32_t		f_flags;
1428 	uint32_t		f_granted_access;
1429 	uint32_t		f_share_access;
1430 	uint32_t		f_create_options;
1431 	uint32_t		f_opened_by_pid;
1432 	uint64_t		f_llf_pos;
1433 	int			f_mode;
1434 	cred_t			*f_cr;
1435 	pid_t			f_pid;
1436 	smb_attr_t		f_pending_attr;
1437 	boolean_t		f_written;
1438 	smb_oplock_grant_t	f_oplock;
1439 	boolean_t		f_oplock_closing;
1440 	uint8_t			TargetOplockKey[SMB_LEASE_KEY_SZ];
1441 	uint8_t			ParentOplockKey[SMB_LEASE_KEY_SZ];
1442 	struct smb_lease	*f_lease;
1443 
1444 	smb_notify_t		f_notify;
1445 
1446 	smb_dh_vers_t		dh_vers;
1447 	hrtime_t		dh_timeout_offset; /* time offset for timeout */
1448 	hrtime_t		dh_expire_time; /* time the handle expires */
1449 	boolean_t		dh_persist;
1450 	kmutex_t		dh_nvlock;
1451 	struct nvlist		*dh_nvlist;
1452 	smb_node_t		*dh_nvfile;
1453 
1454 	uint8_t			dh_create_guid[16];
1455 	char			f_quota_resume[SMB_SID_STRSZ];
1456 	uint8_t			f_lock_seq[SMB_OFILE_LSEQ_MAX];
1457 } smb_ofile_t;
1458 
1459 typedef struct smb_fileinfo {
1460 	char		fi_name[MAXNAMELEN];
1461 	char		fi_shortname[SMB_SHORTNAMELEN];
1462 	uint32_t	fi_cookie;	/* Dir offset (of next entry) */
1463 	uint32_t	fi_dosattr;	/* DOS attributes */
1464 	uint64_t	fi_nodeid;	/* file system node id */
1465 	uint64_t	fi_size;	/* file size in bytes */
1466 	uint64_t	fi_alloc_size;	/* allocation size in bytes */
1467 	timestruc_t	fi_atime;	/* last access */
1468 	timestruc_t	fi_mtime;	/* last modification */
1469 	timestruc_t	fi_ctime;	/* last status change */
1470 	timestruc_t	fi_crtime;	/* file creation */
1471 } smb_fileinfo_t;
1472 
1473 typedef struct smb_streaminfo {
1474 	uint64_t	si_size;
1475 	uint64_t	si_alloc_size;
1476 	char		si_name[MAXPATHLEN];
1477 } smb_streaminfo_t;
1478 
1479 #define	SMB_LOCK_MAGIC	0x4C4F434B	/* 'LOCK' */
1480 
1481 typedef struct smb_lock {
1482 	list_node_t		l_lnd;
1483 	uint32_t		l_magic;
1484 	kmutex_t		l_mutex;
1485 	kcondvar_t		l_cv;
1486 
1487 	smb_ofile_t		*l_file;
1488 
1489 	struct smb_lock		*l_blocked_by; /* Debug info only */
1490 
1491 	uint32_t		l_conflicts;
1492 	uint32_t		l_flags;
1493 	uint32_t		l_pid;
1494 	uint32_t		l_type;
1495 	uint64_t		l_start;
1496 	uint64_t		l_length;
1497 	clock_t			l_end_time;
1498 } smb_lock_t;
1499 
1500 #define	SMB_LOCK_FLAG_INDEFINITE	0x0004
1501 #define	SMB_LOCK_FLAG_CLOSED		0x0008
1502 #define	SMB_LOCK_FLAG_CANCELLED		0x0010
1503 
1504 #define	SMB_LOCK_TYPE_READWRITE		101
1505 #define	SMB_LOCK_TYPE_READONLY		102
1506 
1507 typedef struct vardata_block {
1508 	uint8_t			vdb_tag;
1509 	uint32_t		vdb_len;
1510 	struct uio		vdb_uio;
1511 	struct iovec		vdb_iovec[MAX_IOVEC];
1512 } smb_vdb_t;
1513 
1514 #define	SMB_WRMODE_WRITE_THRU	0x0001
1515 #define	SMB_WRMODE_IS_STABLE(M)	((M) & SMB_WRMODE_WRITE_THRU)
1516 
1517 #define	SMB_RW_MAGIC		0x52445257	/* 'RDRW' */
1518 
1519 typedef struct smb_rw_param {
1520 	uint32_t rw_magic;
1521 	smb_vdb_t rw_vdb;
1522 	uint64_t rw_offset;
1523 	uint32_t rw_last_write;
1524 	uint16_t rw_mode;
1525 	uint32_t rw_count;		/* bytes in this request */
1526 	uint16_t rw_mincnt;
1527 	uint32_t rw_total;		/* total bytes (write-raw) */
1528 	uint16_t rw_dsoff;		/* SMB data offset */
1529 	uint8_t rw_andx;		/* SMB secondary andx command */
1530 } smb_rw_param_t;
1531 
1532 typedef struct smb_pathname {
1533 	char	*pn_path;
1534 	char	*pn_pname;
1535 	char	*pn_fname;
1536 	char	*pn_sname;
1537 	char	*pn_stype;
1538 } smb_pathname_t;
1539 
1540 /*
1541  * fs_query_info
1542  */
1543 typedef struct smb_fqi {
1544 	smb_pathname_t	fq_path;
1545 	uint16_t	fq_sattr;
1546 	smb_node_t	*fq_dnode;
1547 	smb_node_t	*fq_fnode;
1548 	smb_attr_t	fq_fattr;
1549 	char		fq_last_comp[MAXNAMELEN];
1550 } smb_fqi_t;
1551 
1552 typedef struct dirop {
1553 	smb_fqi_t	fqi;
1554 	smb_fqi_t	dst_fqi;
1555 	uint16_t	info_level;
1556 	uint16_t	flags;
1557 } smb_arg_dirop_t;
1558 
1559 typedef struct smb_queryinfo {
1560 	smb_node_t	*qi_node;	/* NULL for pipes */
1561 	uint8_t qi_InfoType;
1562 	uint8_t qi_InfoClass;
1563 	uint8_t	qi_delete_on_close;
1564 	uint8_t qi_isdir;
1565 	uint32_t qi_AddlInfo;
1566 	uint32_t qi_Flags;
1567 	mbuf_chain_t in_data;
1568 	smb_attr_t	qi_attr;
1569 	uint32_t	qi_namelen;
1570 	char		qi_shortname[SMB_SHORTNAMELEN];
1571 	char		qi_name[MAXPATHLEN];
1572 } smb_queryinfo_t;
1573 
1574 typedef struct smb_setinfo {
1575 	smb_node_t *si_node;
1576 	mbuf_chain_t si_data;
1577 	smb_attr_t si_attr;
1578 } smb_setinfo_t;
1579 
1580 /*
1581  * smb_fssize_t
1582  * volume_units and volume avail are the total allocated and
1583  * available units on the volume.
1584  * caller_units and caller_avail are the allocated and available
1585  * units on the volume for the user associated with the calling
1586  * thread.
1587  */
1588 typedef struct smb_fssize {
1589 	uint64_t	fs_volume_units;
1590 	uint64_t	fs_volume_avail;
1591 	uint64_t	fs_caller_units;
1592 	uint64_t	fs_caller_avail;
1593 	uint32_t	fs_sectors_per_unit;
1594 	uint32_t	fs_bytes_per_sector;
1595 } smb_fssize_t;
1596 
1597 /*
1598  * SMB FsCtl operations (SMB2 Ioctl, and some SMB1 trans calls)
1599  */
1600 typedef struct {
1601 	uint32_t CtlCode;
1602 	uint32_t InputCount;
1603 	uint32_t OutputCount;
1604 	uint32_t MaxOutputResp;
1605 	mbuf_chain_t *in_mbc;
1606 	mbuf_chain_t *out_mbc;
1607 } smb_fsctl_t;
1608 
1609 typedef struct {
1610 	uint64_t	persistent;
1611 	uint64_t	temporal;
1612 } smb2fid_t;
1613 
1614 typedef struct {
1615 	uint32_t status;
1616 	uint16_t errcls;
1617 	uint16_t errcode;
1618 } smb_error_t;
1619 
1620 typedef struct open_param {
1621 	smb_fqi_t	fqi;
1622 	uint16_t	omode;
1623 	uint16_t	ofun;
1624 	uint32_t	nt_flags;
1625 	uint32_t	timeo;
1626 	uint32_t	dattr;
1627 	timestruc_t	crtime;
1628 	timestruc_t	mtime;
1629 	timestruc_t	timewarp;
1630 	/*
1631 	 * Careful: dsize is the desired (allocation) size before the
1632 	 * common open function, and the actual size afterwards.
1633 	 */
1634 	uint64_t	dsize;	/* alloc size, actual size */
1635 	uint32_t	desired_access;
1636 	uint32_t	maximum_access;
1637 	uint32_t	share_access;
1638 	uint32_t	create_options;
1639 	uint32_t	create_disposition;
1640 	boolean_t	create_timewarp;
1641 	boolean_t	created_readonly;
1642 	uint32_t	ftype;
1643 	uint32_t	devstate;
1644 	uint32_t	action_taken;
1645 	uint64_t	fileid;
1646 	uint32_t	rootdirfid;
1647 	fsid_t		op_fsid;
1648 	smb_ofile_t	*dir;
1649 	smb_opipe_t	*pipe;	/* for smb_opipe_open */
1650 	struct smb_sd	*sd;	/* for NTTransactCreate */
1651 	void		*create_ctx;
1652 
1653 	uint8_t		op_oplock_level;	/* requested/granted level */
1654 	uint32_t	op_oplock_state;	/* internal type+level */
1655 	uint32_t	lease_state;		/* SMB2_LEASE_... */
1656 	uint32_t	lease_flags;
1657 	uint16_t	lease_epoch;
1658 	uint16_t	lease_version;		/* 1 or 2 */
1659 	uint8_t		lease_key[SMB_LEASE_KEY_SZ];	/* from client */
1660 	uint8_t		parent_lease_key[SMB_LEASE_KEY_SZ]; /* for V2 */
1661 
1662 	smb_dh_vers_t	dh_vers;
1663 	smb2fid_t	dh_fileid;		/* for durable reconnect */
1664 	uint8_t		create_guid[16];
1665 	uint32_t	dh_v2_flags;
1666 	uint32_t	dh_timeout;
1667 } smb_arg_open_t;
1668 
1669 typedef struct smb_arg_lock {
1670 	void		*lvec;
1671 	uint32_t	lcnt;
1672 	uint32_t	lseq;
1673 } smb_arg_lock_t;
1674 
1675 typedef struct smb_arg_olbrk {
1676 	uint32_t	NewLevel;
1677 	uint32_t	OldLevel;
1678 	boolean_t	AckRequired;
1679 	uint8_t		LeaseKey[SMB_LEASE_KEY_SZ];
1680 } smb_arg_olbrk_t;
1681 
1682 /*
1683  * SMB Request State Machine
1684  * -------------------------
1685  *
1686  *                  T4               +------+		T0
1687  *      +--------------------------->| FREE |---------------------------+
1688  *      |                            +------+                           |
1689  * +-----------+                                                        |
1690  * | COMPLETED |                                                        |
1691  * +-----------+
1692  *      ^                                                               |
1693  *      | T15                      +-----------+                        v
1694  * +------------+        T6        |           |                +--------------+
1695  * | CLEANED_UP |<-----------------| CANCELLED |                | INITIALIZING |
1696  * +------------+                  |           |                +--------------+
1697  *      |    ^                     +-----------+                        |
1698  *      |    |                        ^  ^ ^ ^                          |
1699  *      |    |          +-------------+  | | |                          |
1700  *      |    |    T3    |                | | |               T13        | T1
1701  *      |    +-------------------------+ | | +----------------------+   |
1702  *      +----------------------------+ | | |                        |   |
1703  *         T16          |            | | | +-----------+            |   |
1704  *                      |           \/ | | T5          |            |   v
1705  * +-----------------+  |   T12     +--------+         |     T2    +-----------+
1706  * | EVENT_OCCURRED  |------------->| ACTIVE |<--------------------| SUBMITTED |
1707  * +-----------------+  |           +--------+         |           +-----------+
1708  *        ^             |              | ^ |           |
1709  *        |             |           T8 | | |  T7       |
1710  *        | T10      T9 |   +----------+ | +-------+   |  T11
1711  *        |             |   |            +-------+ |   |
1712  *        |             |   |               T14  | |   |
1713  *        |             |   v                    | v   |
1714  *      +----------------------+                +--------------+
1715  *	|     WAITING_EVENT    |                | WAITING_LOCK |
1716  *      +----------------------+                +--------------+
1717  *
1718  *
1719  *
1720  *
1721  *
1722  * Transition T0
1723  *
1724  * This transition occurs when the request is allocated and is still under the
1725  * control of the session thread.
1726  *
1727  * Transition T1
1728  *
1729  * This transition occurs when the session thread dispatches a task to treat the
1730  * request.
1731  *
1732  * Transition T2
1733  *
1734  *
1735  *
1736  * Transition T3
1737  *
1738  * A request completes and smbsr_cleanup is called to release resources
1739  * associated with the request (but not the smb_request_t itself).  This
1740  * includes references on smb_ofile_t, smb_node_t, and other structures.
1741  * CLEANED_UP state exists to detect if we attempt to cleanup a request
1742  * multiple times and to allow us to detect that we are accessing a
1743  * request that has already been cleaned up.
1744  *
1745  * Transition T4
1746  *
1747  *
1748  *
1749  * Transition T5
1750  *
1751  *
1752  *
1753  * Transition T6
1754  *
1755  *
1756  *
1757  * Transition T7
1758  *
1759  *
1760  *
1761  * Transition T8
1762  *
1763  *
1764  *
1765  * Transition T9
1766  *
1767  *
1768  *
1769  * Transition T10
1770  *
1771  *
1772  *
1773  * Transition T11
1774  *
1775  *
1776  *
1777  * Transition T12
1778  *
1779  *
1780  *
1781  * Transition T13
1782  *
1783  *
1784  *
1785  * Transition T14
1786  *
1787  *
1788  *
1789  * Transition T15
1790  *
1791  * Request processing is completed (control returns from smb_dispatch)
1792  *
1793  * Transition T16
1794  *
1795  * Multipart (andx) request was cleaned up with smbsr_cleanup but more "andx"
1796  * sections remain to be processed.
1797  *
1798  */
1799 
1800 #define	SMB_REQ_MAGIC		0x534D4252	/* 'SMBR' */
1801 #define	SMB_REQ_VALID(p)	ASSERT((p)->sr_magic == SMB_REQ_MAGIC)
1802 
1803 typedef enum smb_req_state {
1804 	SMB_REQ_STATE_FREE = 0,
1805 	SMB_REQ_STATE_INITIALIZING,
1806 	SMB_REQ_STATE_SUBMITTED,
1807 	SMB_REQ_STATE_ACTIVE,
1808 	SMB_REQ_STATE_WAITING_AUTH,
1809 	SMB_REQ_STATE_WAITING_FCN1,
1810 	SMB_REQ_STATE_WAITING_FCN2,
1811 	SMB_REQ_STATE_WAITING_LOCK,
1812 	SMB_REQ_STATE_WAITING_PIPE,
1813 	SMB_REQ_STATE_WAITING_OLBRK,
1814 	SMB_REQ_STATE_COMPLETED,
1815 	SMB_REQ_STATE_CANCEL_PENDING,
1816 	SMB_REQ_STATE_CANCELLED,
1817 	SMB_REQ_STATE_CLEANED_UP,
1818 	SMB_REQ_STATE_SENTINEL
1819 } smb_req_state_t;
1820 
1821 typedef struct smb_request {
1822 	list_node_t		sr_session_lnd;
1823 	uint32_t		sr_magic;
1824 	kmutex_t		sr_mutex;
1825 	smb_req_state_t		sr_state;
1826 	kcondvar_t		sr_st_cv;
1827 	struct smb_server	*sr_server;
1828 	pid_t			*sr_pid;
1829 	int32_t			sr_gmtoff;
1830 	smb_session_t		*session;
1831 	smb_kmod_cfg_t		*sr_cfg;
1832 	void			(*cancel_method)(struct smb_request *);
1833 	void			*cancel_arg2;
1834 
1835 	/* Queue used by smb_request_append_postwork. */
1836 	struct smb_request	*sr_postwork;
1837 
1838 	list_node_t		sr_waiters;	/* smb_notify.c */
1839 
1840 	struct mbuf_chain	command;
1841 	struct mbuf_chain	reply;
1842 	struct mbuf_chain	raw_data;
1843 	list_t			sr_storage;
1844 	struct smb_xa		*r_xa;
1845 	int			andx_prev_wct;
1846 	int			cur_reply_offset;
1847 	int			orig_request_hdr;
1848 	unsigned int		reply_seqnum;	/* reply sequence number */
1849 	unsigned char		first_smb_com;	/* command code */
1850 	unsigned char		smb_com;	/* command code */
1851 
1852 	uint8_t			smb_rcls;	/* error code class */
1853 	uint8_t			smb_reh;	/* rsvd (AH DOS INT-24 ERR) */
1854 	uint16_t		smb_err;	/* error code */
1855 	smb_error_t		smb_error;
1856 
1857 	uint8_t			smb_flg;	/* flags */
1858 	uint16_t		smb_flg2;	/* flags */
1859 	unsigned char		smb_sig[8];	/* signiture */
1860 	uint16_t		smb_tid;	/* tree id #  */
1861 	uint32_t		smb_pid;	/* caller's process id # */
1862 	uint16_t		smb_uid;	/* local (smb1) user id # */
1863 	uint16_t		smb_mid;	/* mutiplex id #  */
1864 	unsigned char		smb_wct;	/* count of parameter words */
1865 	uint16_t		smb_bcc;	/* data byte count */
1866 
1867 	/*
1868 	 * Beginning offsets (in the mbuf chain) for the
1869 	 * command and reply headers, and the next reply.
1870 	 */
1871 	uint32_t		smb2_cmd_hdr;
1872 	uint32_t		smb2_reply_hdr;
1873 	uint32_t		smb2_next_reply;
1874 
1875 	/*
1876 	 * SMB2 header fields.  [MS-SMB2 2.2.1.2]
1877 	 * XXX: Later do a union w smb1 members
1878 	 */
1879 	uint16_t		smb2_credit_charge;
1880 	uint16_t		smb2_chan_seq;	/* cmd only */
1881 	uint32_t		smb2_status;
1882 	uint16_t		smb2_cmd_code;
1883 	uint16_t		smb2_credit_request;
1884 	uint16_t		smb2_credit_response;
1885 	uint16_t		smb2_total_credits; /* in compound */
1886 	uint32_t		smb2_hdr_flags;
1887 	uint32_t		smb2_next_command;
1888 	uint64_t		smb2_messageid;
1889 	uint64_t		smb2_first_msgid;
1890 	/* uint32_t		smb2_pid; use smb_pid */
1891 	/* uint32_t		smb2_tid; use smb_tid */
1892 	uint64_t		smb2_ssnid;	/* See u_ssnid */
1893 	uint8_t			smb2_sig[16];	/* signature */
1894 
1895 	/*
1896 	 * SMB3 transform header fields. [MS-SMB2 2.2.41]
1897 	 */
1898 	uint64_t		th_ssnid;
1899 	smb_user_t		*th_sid_user;
1900 	uint32_t		th_msglen;
1901 	uint8_t			th_nonce[16];
1902 
1903 	boolean_t		encrypted;
1904 	boolean_t		dh_nvl_dirty;
1905 
1906 	boolean_t		smb2_async;
1907 	uint64_t		smb2_async_id;
1908 	/* Parameters */
1909 	struct mbuf_chain	smb_vwv;	/* variable width value */
1910 
1911 	/* Data */
1912 	struct mbuf_chain	smb_data;
1913 
1914 	uint16_t		smb_fid;	/* not in hdr, but common */
1915 
1916 	unsigned char		andx_com;
1917 	uint16_t		andx_off;
1918 
1919 	struct smb_tree		*tid_tree;
1920 	struct smb_ofile	*fid_ofile;
1921 	smb_user_t		*uid_user;
1922 
1923 	cred_t			*user_cr;
1924 	kthread_t		*sr_worker;
1925 	hrtime_t		sr_time_submitted;
1926 	hrtime_t		sr_time_active;
1927 	hrtime_t		sr_time_start;
1928 	int32_t			sr_txb;
1929 	uint32_t		sr_seqnum;
1930 
1931 	union {
1932 		smb_arg_negotiate_t	*negprot;
1933 		smb_arg_sessionsetup_t	*ssetup;
1934 		smb_arg_tcon_t		tcon;
1935 		smb_arg_dirop_t		dirop;
1936 		smb_arg_open_t		open;
1937 		smb_arg_lock_t		lock;
1938 		smb_arg_olbrk_t		olbrk;	/* for async oplock break */
1939 		smb_rw_param_t		*rw;
1940 		int32_t			timestamp;
1941 		void			*other;
1942 	} arg;
1943 } smb_request_t;
1944 
1945 #define	sr_ssetup	arg.ssetup
1946 #define	sr_negprot	arg.negprot
1947 #define	sr_tcon		arg.tcon
1948 #define	sr_dirop	arg.dirop
1949 #define	sr_open		arg.open
1950 #define	sr_rw		arg.rw
1951 #define	sr_timestamp	arg.timestamp
1952 
1953 #define	SMB_READ_PROTOCOL(hdr) \
1954 	LE_IN32(((smb_hdr_t *)(hdr))->protocol)
1955 
1956 #define	SMB_PROTOCOL_MAGIC_INVALID(rd_sr) \
1957 	(SMB_READ_PROTOCOL((rd_sr)->sr_request_buf) != SMB_PROTOCOL_MAGIC)
1958 
1959 #define	SMB_READ_COMMAND(hdr) \
1960 	(((smb_hdr_t *)(hdr))->command)
1961 
1962 #define	SMB_IS_NT_CANCEL(rd_sr) \
1963 	(SMB_READ_COMMAND((rd_sr)->sr_request_buf) == SMB_COM_NT_CANCEL)
1964 
1965 #define	SMB_IS_SESSION_SETUP_ANDX(rd_sr) \
1966 	(SMB_READ_COMMAND((rd_sr)->sr_request_buf) == \
1967 	    SMB_COM_SESSION_SETUP_ANDX)
1968 
1969 #define	SMB_IS_NT_NEGOTIATE(rd_sr) \
1970 	(SMB_READ_COMMAND((rd_sr)->sr_request_buf) == SMB_COM_NEGOTIATE)
1971 
1972 #define	SMB_IS_TREE_CONNECT_ANDX(rd_sr) \
1973 	(SMB_READ_COMMAND((rd_sr)->sr_request_buf) == SMB_COM_TREE_CONNECT_ANDX)
1974 
1975 #define	SMB_XA_FLAG_OPEN	0x0001
1976 #define	SMB_XA_FLAG_CLOSE	0x0002
1977 #define	SMB_XA_FLAG_COMPLETE	0x0004
1978 #define	SMB_XA_CLOSED(xa) (!((xa)->xa_flags & SMB_XA_FLAG_OPEN))
1979 
1980 #define	SMB_XA_MAGIC		0x534D4258	/* 'SMBX' */
1981 
1982 typedef struct smb_xa {
1983 	list_node_t		xa_lnd;
1984 	uint32_t		xa_magic;
1985 	kmutex_t		xa_mutex;
1986 
1987 	uint32_t		xa_refcnt;
1988 	uint32_t		xa_flags;
1989 
1990 	struct smb_session	*xa_session;
1991 
1992 	unsigned char		smb_com;	/* which TRANS type */
1993 	unsigned char		smb_flg;	/* flags */
1994 	uint16_t		smb_flg2;	/* flags */
1995 	uint16_t		smb_tid;	/* tree id number */
1996 	uint32_t		smb_pid;	/* caller's process id */
1997 	uint16_t		smb_uid;	/* user id number */
1998 	uint32_t		smb_func;	/* NT_TRANS function */
1999 
2000 	uint16_t		xa_smb_mid;	/* mutiplex id number */
2001 	uint16_t		xa_smb_fid;	/* TRANS2 secondary */
2002 
2003 	unsigned int		reply_seqnum;	/* reply sequence number */
2004 
2005 	uint32_t	smb_tpscnt;	/* total parameter bytes being sent */
2006 	uint32_t	smb_tdscnt;	/* total data bytes being sent */
2007 	uint32_t	smb_mprcnt;	/* max parameter bytes to return */
2008 	uint32_t	smb_mdrcnt;	/* max data bytes to return */
2009 	uint32_t	smb_msrcnt;	/* max setup words to return */
2010 	uint32_t	smb_flags;	/* additional information: */
2011 				/*  bit 0 - if set, disconnect TID in smb_tid */
2012 				/*  bit 1 - if set, transaction is one way */
2013 				/*  (no final response) */
2014 	int32_t	smb_timeout;	/* number of milliseconds to await completion */
2015 	uint32_t	smb_suwcnt;	/* set up word count */
2016 
2017 	char			*xa_pipe_name;
2018 
2019 	/*
2020 	 * These are the param and data count received so far,
2021 	 * used to decide if the whole trans is here yet.
2022 	 */
2023 	int			req_disp_param;
2024 	int			req_disp_data;
2025 
2026 	struct mbuf_chain	req_setup_mb;
2027 	struct mbuf_chain	req_param_mb;
2028 	struct mbuf_chain	req_data_mb;
2029 
2030 	struct mbuf_chain	rep_setup_mb;
2031 	struct mbuf_chain	rep_param_mb;
2032 	struct mbuf_chain	rep_data_mb;
2033 } smb_xa_t;
2034 
2035 
2036 #define	SDDF_NO_FLAGS			0
2037 #define	SDDF_SUPPRESS_TID		0x0001
2038 #define	SDDF_SUPPRESS_UID		0x0002
2039 
2040 /*
2041  * SMB dispatch return codes.
2042  */
2043 typedef enum {
2044 	SDRC_SUCCESS = 0,
2045 	SDRC_ERROR,
2046 	SDRC_DROP_VC,
2047 	SDRC_NO_REPLY,
2048 	SDRC_SR_KEPT,
2049 	SDRC_NOT_IMPLEMENTED
2050 } smb_sdrc_t;
2051 
2052 #define	VAR_BCC		((short)-1)
2053 
2054 #define	SMB_SERVER_MAGIC	0x53534552	/* 'SSER' */
2055 #define	SMB_SERVER_VALID(s)	\
2056     ASSERT(((s) != NULL) && ((s)->sv_magic == SMB_SERVER_MAGIC))
2057 
2058 #define	SMB_LISTENER_MAGIC	0x4C53544E	/* 'LSTN' */
2059 #define	SMB_LISTENER_VALID(ld)	\
2060     ASSERT(((ld) != NULL) && ((ld)->ld_magic == SMB_LISTENER_MAGIC))
2061 
2062 typedef struct {
2063 	uint32_t		ld_magic;
2064 	struct smb_server	*ld_sv;
2065 	smb_thread_t		ld_thread;
2066 	ksocket_t		ld_so;
2067 	in_port_t		ld_port;
2068 	int			ld_family;
2069 	struct sockaddr_in	ld_sin;
2070 	struct sockaddr_in6	ld_sin6;
2071 	clock_t			ld_quiet;
2072 } smb_listener_daemon_t;
2073 
2074 #define	SMB_SSETUP_CMD			"authentication"
2075 #define	SMB_TCON_CMD			"share mapping"
2076 #define	SMB_OPIPE_CMD			"pipe open"
2077 #define	SMB_LOGOFF_CMD			"logoff"
2078 #define	SMB_THRESHOLD_REPORT_THROTTLE	50
2079 typedef struct smb_cmd_threshold {
2080 	char			*ct_cmd;
2081 	kmutex_t		ct_mutex;
2082 	volatile uint32_t	ct_active_cnt;
2083 	volatile uint32_t	ct_blocked_cnt;
2084 	uint32_t		ct_threshold;
2085 	uint32_t		ct_timeout; /* milliseconds */
2086 	kcondvar_t		ct_cond;
2087 } smb_cmd_threshold_t;
2088 
2089 typedef struct {
2090 	kstat_named_t		ls_files;
2091 	kstat_named_t		ls_trees;
2092 	kstat_named_t		ls_users;
2093 } smb_server_legacy_kstat_t;
2094 
2095 typedef enum smb_server_state {
2096 	SMB_SERVER_STATE_CREATED = 0,
2097 	SMB_SERVER_STATE_CONFIGURED,
2098 	SMB_SERVER_STATE_RUNNING,
2099 	SMB_SERVER_STATE_STOPPING,
2100 	SMB_SERVER_STATE_DELETING,
2101 	SMB_SERVER_STATE_SENTINEL
2102 } smb_server_state_t;
2103 
2104 typedef struct {
2105 	/* protected by sv_mutex */
2106 	kcondvar_t		sp_cv;
2107 	uint32_t		sp_cnt;
2108 	smb_llist_t		sp_list;
2109 	smb_llist_t		sp_fidlist;
2110 } smb_spool_t;
2111 
2112 #define	SMB_SERVER_STATE_VALID(S)               \
2113     ASSERT(((S) == SMB_SERVER_STATE_CREATED) || \
2114 	    ((S) == SMB_SERVER_STATE_CONFIGURED) || \
2115 	    ((S) == SMB_SERVER_STATE_RUNNING) ||    \
2116 	    ((S) == SMB_SERVER_STATE_STOPPING) ||   \
2117 	    ((S) == SMB_SERVER_STATE_DELETING))
2118 
2119 typedef struct smb_server {
2120 	list_node_t		sv_lnd;
2121 	uint32_t		sv_magic;
2122 	kcondvar_t		sv_cv;
2123 	kmutex_t		sv_mutex;
2124 	smb_server_state_t	sv_state;
2125 	uint32_t		sv_refcnt;
2126 	pid_t			sv_pid;
2127 	zoneid_t		sv_zid;
2128 	smb_listener_daemon_t	sv_nbt_daemon;
2129 	smb_listener_daemon_t	sv_tcp_daemon;
2130 	krwlock_t		sv_cfg_lock;
2131 	smb_kmod_cfg_t		sv_cfg;
2132 
2133 	kmutex_t		sv_proc_lock;
2134 	kcondvar_t		sv_proc_cv;
2135 	smb_thread_state_t	sv_proc_state;
2136 	uint64_t		sv_proc_did;
2137 	struct proc		*sv_proc_p;
2138 
2139 	smb_session_t		*sv_session;
2140 	smb_user_t		*sv_rootuser;
2141 	smb_llist_t		sv_session_list;
2142 	smb_hash_t		*sv_persistid_ht;
2143 	smb_hash_t		*sv_lease_ht;
2144 
2145 	smb_export_t		sv_export;
2146 	struct __door_handle	*sv_lmshrd;
2147 
2148 	/* Internal door for up-calls to smbd */
2149 	struct __door_handle	*sv_kdoor_hd;
2150 	int			sv_kdoor_id; /* init -1 */
2151 	uint64_t		sv_kdoor_ncall;
2152 	kmutex_t		sv_kdoor_mutex;
2153 	kcondvar_t		sv_kdoor_cv;
2154 
2155 	int32_t			si_gmtoff;
2156 
2157 	smb_thread_t		si_thread_timers;
2158 
2159 	taskq_t			*sv_notify_pool;
2160 	taskq_t			*sv_worker_pool;
2161 	taskq_t			*sv_receiver_pool;
2162 
2163 	smb_node_t		*si_root_smb_node;
2164 	smb_llist_t		sv_opipe_list;
2165 	smb_llist_t		sv_event_list;
2166 
2167 	/* Statistics */
2168 	hrtime_t		sv_start_time;
2169 	kstat_t			*sv_ksp;
2170 	volatile uint32_t	sv_nbt_sess;
2171 	volatile uint32_t	sv_tcp_sess;
2172 	volatile uint32_t	sv_users;
2173 	volatile uint32_t	sv_trees;
2174 	volatile uint32_t	sv_files;
2175 	volatile uint32_t	sv_pipes;
2176 	volatile uint64_t	sv_txb;
2177 	volatile uint64_t	sv_rxb;
2178 	volatile uint64_t	sv_nreq;
2179 	smb_srqueue_t		sv_srqueue;
2180 	smb_spool_t		sp_info;
2181 	smb_cmd_threshold_t	sv_ssetup_ct;
2182 	smb_cmd_threshold_t	sv_tcon_ct;
2183 	smb_cmd_threshold_t	sv_opipe_ct;
2184 	smb_cmd_threshold_t	sv_logoff_ct;
2185 	kstat_t			*sv_legacy_ksp;
2186 	kmutex_t		sv_legacy_ksmtx;
2187 	smb_disp_stats_t	*sv_disp_stats1;
2188 	smb_disp_stats_t	*sv_disp_stats2;
2189 } smb_server_t;
2190 
2191 #define	SMB_EVENT_MAGIC		0x45564E54	/* EVNT */
2192 #define	SMB_EVENT_TIMEOUT	45		/* seconds */
2193 #define	SMB_EVENT_VALID(e)	\
2194     ASSERT(((e) != NULL) && ((e)->se_magic == SMB_EVENT_MAGIC))
2195 typedef struct smb_event {
2196 	list_node_t		se_lnd;
2197 	uint32_t		se_magic;
2198 	kmutex_t		se_mutex;
2199 	kcondvar_t		se_cv;
2200 	smb_server_t		*se_server;
2201 	uint32_t		se_txid;
2202 	boolean_t		se_notified;
2203 	int			se_waittime;
2204 	int			se_timeout;
2205 	int			se_errno;
2206 } smb_event_t;
2207 
2208 typedef struct smb_kspooldoc {
2209 	list_node_t	sd_lnd;
2210 	uint32_t	sd_magic;
2211 	smb_inaddr_t	sd_ipaddr;
2212 	uint32_t	sd_spool_num;
2213 	uint16_t	sd_fid;
2214 	char		sd_username[MAXNAMELEN];
2215 	char		sd_path[MAXPATHLEN];
2216 } smb_kspooldoc_t;
2217 
2218 typedef struct smb_spoolfid {
2219 	list_node_t	sf_lnd;
2220 	uint32_t	sf_magic;
2221 	uint16_t	sf_fid;
2222 } smb_spoolfid_t;
2223 
2224 #define	SMB_INFO_NETBIOS_SESSION_SVC_RUNNING	0x0001
2225 #define	SMB_INFO_NETBIOS_SESSION_SVC_FAILED	0x0002
2226 #define	SMB_INFO_USER_LEVEL_SECURITY		0x40000000
2227 #define	SMB_INFO_ENCRYPT_PASSWORDS		0x80000000
2228 
2229 #define	SMB_IS_STREAM(node) ((node)->n_unode)
2230 
2231 typedef struct smb_tsd {
2232 	void (*proc)();
2233 	void *arg;
2234 	char name[100];
2235 } smb_tsd_t;
2236 
2237 typedef struct smb_disp_entry {
2238 	char		sdt_name[KSTAT_STRLEN];
2239 	smb_sdrc_t	(*sdt_pre_op)(smb_request_t *);
2240 	smb_sdrc_t	(*sdt_function)(smb_request_t *);
2241 	void		(*sdt_post_op)(smb_request_t *);
2242 	uint8_t		sdt_com;
2243 	char		sdt_dialect;
2244 	uint8_t		sdt_flags;
2245 } smb_disp_entry_t;
2246 
2247 typedef struct smb_xlate {
2248 	int	code;
2249 	char	*str;
2250 } smb_xlate_t;
2251 
2252 /*
2253  * This structure is a helper for building RAP NetShareEnum response
2254  *
2255  * es_posix_uid UID of the user requesting the shares list which
2256  *              is used to detect if the user has any autohome
2257  * es_bufsize   size of the response buffer
2258  * es_buf       pointer to the response buffer
2259  * es_ntotal    total number of shares exported by server which
2260  *              their OEM names is less then 13 chars
2261  * es_nsent     number of shares that can fit in the specified buffer
2262  * es_datasize  actual data size (share's data) which was encoded
2263  *              in the response buffer
2264  */
2265 typedef struct smb_enumshare_info {
2266 	uid_t		es_posix_uid;
2267 	uint16_t	es_bufsize;
2268 	char		*es_buf;
2269 	uint16_t	es_ntotal;
2270 	uint16_t	es_nsent;
2271 	uint16_t	es_datasize;
2272 } smb_enumshare_info_t;
2273 
2274 /*
2275  * SMB 3.1.1 error id for error ctxs
2276  */
2277 enum smb2_error_id {
2278 	SMB2_ERROR_ID_DEFAULT		= 0,
2279 	SMB2_ERROR_ID_SHARE_REDIRECT	= 0x72645253	/* not used */
2280 };
2281 
2282 #ifdef	__cplusplus
2283 }
2284 #endif
2285 
2286 #endif /* _SMBSRV_SMB_KTYPES_H */
2287