1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  *
25  * Copyright 2019 Nexenta by DDN, Inc. All rights reserved.
26  */
27 
28 /*
29  * SMB mbuf marshaling encode/decode.
30  */
31 
32 #include <smbsrv/smb_kproto.h>
33 
34 
35 #define	MALLOC_QUANTUM	80
36 
37 #define	DECODE_NO_ERROR		0
38 #define	DECODE_NO_MORE_DATA	1
39 #define	DECODE_ALLOCATION_ERROR	2
40 #define	DECODE_CONVERSION_ERROR	3
41 
42 static int mbc_marshal_make_room(mbuf_chain_t *, int32_t);
43 static void mbc_marshal_store_byte(mbuf_chain_t *, uint8_t);
44 static int mbc_marshal_put_char(mbuf_chain_t *mbc, uint8_t);
45 static int mbc_marshal_put_short(mbuf_chain_t *mbc, uint16_t);
46 static int mbc_marshal_put_long(mbuf_chain_t *mbc, uint32_t);
47 static int mbc_marshal_put_long_long(mbuf_chain_t *mbc, uint64_t);
48 static int mbc_marshal_put_oem_string(mbuf_chain_t *, char *, int);
49 static int mbc_marshal_put_unicode_string(mbuf_chain_t *, char *, int);
50 static int mbc_marshal_put_uio(mbuf_chain_t *, struct uio *);
51 static int mbc_marshal_put_mbufs(mbuf_chain_t *mbc, mbuf_t *m);
52 static int mbc_marshal_put_mbuf_chain(mbuf_chain_t *mbc, mbuf_chain_t *nmbc);
53 static uint8_t mbc_marshal_fetch_byte(mbuf_chain_t *mbc);
54 static int mbc_marshal_get_char(mbuf_chain_t *mbc, uint8_t *data);
55 static int mbc_marshal_get_short(mbuf_chain_t *mbc, uint16_t *data);
56 static int mbc_marshal_get_long(mbuf_chain_t *mbc, uint32_t *data);
57 static uint64_t qswap(uint64_t ll);
58 static int mbc_marshal_get_odd_long_long(mbuf_chain_t *mbc, uint64_t *data);
59 static int mbc_marshal_get_long_long(mbuf_chain_t *mbc, uint64_t *data);
60 static int mbc_marshal_get_oem_string(smb_request_t *, mbuf_chain_t *,
61     char **, int);
62 static int mbc_marshal_get_unicode_string(smb_request_t *, mbuf_chain_t *,
63     char **, int);
64 static int mbc_marshal_get_mbufs(mbuf_chain_t *, int32_t, mbuf_t **);
65 static int mbc_marshal_get_mbuf_chain(mbuf_chain_t *, int32_t, mbuf_chain_t *);
66 static int mbc_marshal_get_uio(mbuf_chain_t *, struct uio *);
67 static int mbc_marshal_get_skip(mbuf_chain_t *, uint_t);
68 
69 /*
70  * smb_mbc_vdecodef
71  *
72  * This function reads the contents of the mbc chain passed in under the list
73  * of arguments passed in.
74  *
75  * The format string provides a description of the parameters passed in as well
76  * as an action to be taken by smb_mbc_vdecodef().
77  *
78  *	%	Pointer to an SMB request structure (smb_request_t *). There
79  *		should be only one of these in the string.
80  *
81  *	C	Pointer to an mbuf chain. Copy to that mbuf chain the number of
82  *		bytes specified (number preceding C).
83  *
84  *	m	Pointer to an mbuf. Copy to that mbuf the number of bytes
85  *		specified (number preceding m).
86  *
87  *	M	Read the 32 bit value at the current location of the mbuf chain
88  *		and check if it matches the signature of an SMB1 request (SMBx).
89  *
90  *	N	Read the 32 bit value at the current location of the mbuf chain
91  *		and check if it matches the signature of an SMB2 request (SMBx).
92  *
93  *	b	Pointer to a buffer. Copy to that buffer the number of bytes
94  *		specified (number preceding b).
95  *
96  *	c	Same as 'b'.
97  *
98  *	w	Pointer to a word (16bit value). Copy the next 16bit value into
99  *		that location.
100  *
101  *	l	Pointer to a long (32bit value). Copy the next 32bit value into
102  *		that location.
103  *
104  *	q	Pointer to a quad (64bit value). Copy the next 64bit value into
105  *		that location.
106  *
107  *	Q	Same as above with a call to qswap().
108  *
109  *	B	Pointer to a vardata_block structure. That structure is used to
110  *		retrieve data from the mbuf chain (an iovec type structure is
111  *		embedded in a vardata_block).
112  *
113  *	D	Pointer to a vardata_block structure. That structure is used to
114  *		retrieve data from the mbuf chain, however, two fields of the
115  *		vardata_block structure (tag and len) are first initialized
116  *		using the mbuf chain itself.
117  *
118  *	V	Same as 'D'.
119  *
120  *	L
121  *
122  *	A
123  *
124  *	P	Same as 'A'
125  *
126  *	S	Same as 'A'
127  *
128  *	u	Pointer to a string pointer. Allocate memory and retrieve the
129  *		string at the current location in the mbuf chain. Store the
130  *		address to the buffer allocated at the address specified by
131  *		the pointer. In addition if an sr was passed and it indicates
132  *		that the string is an unicode string, convert it.
133  *
134  *	s	Same as 'u' without convertion.
135  *
136  *	U	Same as 'u'. The string to retrieve is unicode.
137  *
138  *	y	Pointer to a 32bit value. Read the dos time at the current mbuf
139  *		chain location, convert it to unix time and store it at the
140  *		location indicated by the pointer.
141  *
142  *	Y	Same as 'y' bt the dos time coded in the mbuf chain is inverted.
143  *
144  *	.	Skip the number of bytes indicated by the number preceding '.'.
145  *
146  *	,	Same as '.' but take in account it is an unicode string.
147  */
148 int
smb_mbc_vdecodef(mbuf_chain_t * mbc,const char * fmt,va_list ap)149 smb_mbc_vdecodef(mbuf_chain_t *mbc, const char *fmt, va_list ap)
150 {
151 	uint8_t		c;
152 	uint8_t		cval;
153 	uint8_t		*cvalp;
154 	char		**charpp;
155 	uint16_t	wval;
156 	uint16_t	*wvalp;
157 	uint32_t	*lvalp;
158 	uint64_t	*llvalp;
159 	smb_vdb_t	*vdp;
160 	smb_request_t	*sr = NULL;
161 	uint32_t	lval;
162 	int		unicode = 0;
163 	int		repc;
164 	boolean_t	repc_specified;
165 
166 	while ((c = *fmt++) != 0) {
167 		repc_specified = B_FALSE;
168 		repc = 1;
169 
170 		if ('0' <= c && c <= '9') {
171 			repc = 0;
172 			do {
173 				repc = repc * 10 + c - '0';
174 				c = *fmt++;
175 			} while ('0' <= c && c <= '9');
176 			repc_specified = B_TRUE;
177 		} else if (c == '#') {
178 			repc = va_arg(ap, int);
179 			c = *fmt++;
180 			repc_specified = B_TRUE;
181 		}
182 
183 		switch (c) {
184 		case '%':
185 			sr = va_arg(ap, struct smb_request *);
186 			if (sr->session->dialect >= SMB_VERS_2_BASE) {
187 				unicode = 1;
188 				break;
189 			}
190 			unicode = sr->smb_flg2 & SMB_FLAGS2_UNICODE;
191 			break;
192 
193 		case 'C':	/* Mbuf_chain */
194 			if (mbc_marshal_get_mbuf_chain(mbc, repc,
195 			    va_arg(ap, mbuf_chain_t *)) != 0)
196 				return (-1);
197 			break;
198 
199 		case 'm':	/* struct_mbuf */
200 			if (mbc_marshal_get_mbufs(mbc, repc,
201 			    va_arg(ap, mbuf_t **)) != 0)
202 				return (-1);
203 			break;
204 
205 		case 'M':
206 			if (mbc_marshal_get_long(mbc, &lval) != 0)
207 				return (-1);
208 			if (lval != 0x424D53FF) /* 0xFF S M B */
209 				return (-1);
210 			break;
211 
212 		case 'N':
213 			if (mbc_marshal_get_long(mbc, &lval) != 0)
214 				return (-1);
215 			if (lval != 0x424D53FE) /* 0xFE S M B */
216 				return (-1);
217 			break;
218 
219 		case 'b':
220 		case 'c':
221 			cvalp = va_arg(ap, uint8_t *);
222 			if (MBC_ROOM_FOR(mbc, repc) == 0)
223 				/* Data will never be available */
224 				return (-1);
225 
226 			while (repc-- > 0)
227 				*cvalp++ = mbc_marshal_fetch_byte(mbc);
228 			break;
229 
230 		case 'w':
231 			wvalp = va_arg(ap, uint16_t *);
232 			while (repc-- > 0)
233 				if (mbc_marshal_get_short(mbc, wvalp++) != 0)
234 					return (-1);
235 			break;
236 
237 		case 'l':
238 			lvalp = va_arg(ap, uint32_t *);
239 			while (repc-- > 0)
240 				if (mbc_marshal_get_long(mbc, lvalp++) != 0)
241 					return (-1);
242 			break;
243 
244 		case 'q':
245 			llvalp = va_arg(ap, uint64_t *);
246 			while (repc-- > 0)
247 				if (mbc_marshal_get_long_long(
248 				    mbc, llvalp++) != 0)
249 					return (-1);
250 			break;
251 
252 		case 'Q':
253 			llvalp = va_arg(ap, uint64_t *);
254 			while (repc-- > 0)
255 				if (mbc_marshal_get_odd_long_long(
256 				    mbc, llvalp++) != 0)
257 					return (-1);
258 			break;
259 
260 		case 'B':
261 			vdp = va_arg(ap, struct vardata_block *);
262 			vdp->vdb_tag = 0;
263 			vdp->vdb_len = repc;
264 			vdp->vdb_uio.uio_iov = &vdp->vdb_iovec[0];
265 			vdp->vdb_uio.uio_iovcnt = MAX_IOVEC;
266 			vdp->vdb_uio.uio_extflg = UIO_COPY_DEFAULT;
267 			vdp->vdb_uio.uio_resid = repc;
268 			if (mbc_marshal_get_uio(mbc, &vdp->vdb_uio) != 0)
269 				return (-1);
270 			break;
271 
272 		case 'D':
273 		case 'V':
274 			vdp = va_arg(ap, struct vardata_block *);
275 			if (mbc_marshal_get_char(mbc, &vdp->vdb_tag) != 0)
276 				return (-1);
277 			if (mbc_marshal_get_short(mbc, &wval) != 0)
278 				return (-1);
279 			vdp->vdb_len = (uint32_t)wval;
280 			vdp->vdb_uio.uio_iov = &vdp->vdb_iovec[0];
281 			vdp->vdb_uio.uio_iovcnt = MAX_IOVEC;
282 			vdp->vdb_uio.uio_extflg = UIO_COPY_DEFAULT;
283 			vdp->vdb_uio.uio_resid = vdp->vdb_len;
284 			if (vdp->vdb_len != 0) {
285 				if (mbc_marshal_get_uio(mbc,
286 				    &vdp->vdb_uio) != 0)
287 					return (-1);
288 			}
289 			break;
290 
291 		case 'L':
292 			if (mbc_marshal_get_char(mbc, &cval) != 0)
293 				return (-1);
294 			if (cval != 2)
295 				return (-1);
296 			goto oem_conversion;
297 
298 		case 'A':
299 		case 'S':
300 			if (mbc_marshal_get_char(mbc, &cval) != 0)
301 				return (-1);
302 			if (((c == 'A' || c == 'S') && cval != 4) ||
303 			    (c == 'L' && cval != 2))
304 				return (-1);
305 			/* FALLTHROUGH */
306 
307 		case 'u': /* Convert from unicode if flags are set */
308 			if (unicode)
309 				goto unicode_translation;
310 			/* FALLTHROUGH */
311 
312 		case 's':	/* get OEM string */
313 oem_conversion:
314 			ASSERT(sr != NULL);
315 			charpp = va_arg(ap, char **);
316 			if (!repc_specified)
317 				repc = 0;
318 			if (mbc_marshal_get_oem_string(sr,
319 			    mbc, charpp, repc) != 0)
320 				return (-1);
321 			break;
322 
323 		case 'U':	/* get UTF-16 string */
324 unicode_translation:
325 			ASSERT(sr != 0);
326 			charpp = va_arg(ap, char **);
327 			if (!repc_specified)
328 				repc = 0;
329 			if (mbc_marshal_get_unicode_string(sr,
330 			    mbc, charpp, repc) != 0)
331 				return (-1);
332 			break;
333 
334 		case 'Y': /* dos time to unix time tt/dd */
335 			lvalp = va_arg(ap, uint32_t *);
336 			while (repc-- > 0) {
337 				short	d, t;
338 
339 				if (mbc_marshal_get_short(mbc,
340 				    (uint16_t *)&t) != 0)
341 					return (-1);
342 				if (mbc_marshal_get_short(mbc,
343 				    (uint16_t *)&d) != 0)
344 					return (-1);
345 				*lvalp++ = smb_time_dos_to_unix(d, t);
346 			}
347 			break;
348 
349 		case 'y': /* dos time to unix time dd/tt */
350 			lvalp = va_arg(ap, uint32_t *);
351 			while (repc-- > 0) {
352 				short	d, t;
353 
354 				if (mbc_marshal_get_short(mbc,
355 				    (uint16_t *)&d) != 0)
356 					return (-1);
357 				if (mbc_marshal_get_short(mbc,
358 				    (uint16_t *)&t) != 0)
359 					return (-1);
360 				*lvalp++ = smb_time_dos_to_unix(d, t);
361 			}
362 			break;
363 
364 		case ',':
365 			if (unicode)
366 				repc *= 2;
367 			/* FALLTHROUGH */
368 
369 		case '.':
370 			if (mbc_marshal_get_skip(mbc, repc) != 0)
371 				return (-1);
372 			break;
373 
374 		default:
375 			ASSERT(0);
376 			return (-1);
377 		}
378 	}
379 	return (0);
380 }
381 
382 /*
383  * smb_mbc_decodef
384  *
385  * This function reads the contents of the mbc chain passed in under the
386  * control of the format fmt.
387  *
388  * (for a description of the format string see smb_mbc_vencodef()).
389  */
390 int
smb_mbc_decodef(mbuf_chain_t * mbc,const char * fmt,...)391 smb_mbc_decodef(mbuf_chain_t *mbc, const char *fmt, ...)
392 {
393 	int	xx;
394 	va_list	ap;
395 
396 	va_start(ap, fmt);
397 	xx = smb_mbc_vdecodef(mbc, fmt, ap);
398 	va_end(ap);
399 	return (xx);
400 }
401 
402 /*
403  * smb_mbc_peek
404  *
405  * This function reads the contents of the mbc passed in at the specified offset
406  * under the control of the format fmt. The offset of the chain passed in is not
407  * modified.
408  *
409  * (for a description of the format string see smb_mbc_vdecodef()).
410  */
411 int
smb_mbc_peek(mbuf_chain_t * mbc,int offset,const char * fmt,...)412 smb_mbc_peek(mbuf_chain_t *mbc, int offset, const char *fmt, ...)
413 {
414 	mbuf_chain_t	tmp;
415 	va_list		ap;
416 	int		xx;
417 
418 	va_start(ap, fmt);
419 
420 	(void) MBC_SHADOW_CHAIN(&tmp, mbc, offset, mbc->max_bytes - offset);
421 	xx = smb_mbc_vdecodef(&tmp, fmt, ap);
422 	va_end(ap);
423 	return (xx);
424 }
425 
426 /*
427  * smb_mbc_vencodef
428  *
429  * This function builds a stream of bytes in the mbc chain passed in under the
430  * control of the list of arguments passed in.
431  *
432  * The format string provides a description of the parameters passed in as well
433  * as an action to be taken by smb_mbc_vencodef().
434  *
435  *	\b	Restore the mbuf chain offset to its initial value.
436  *
437  *	%	Pointer to an SMB request structure (smb_request_t *). There
438  *		should be only one of these in the string. If an sr in present
439  *		it will be used to determine if unicode conversion should be
440  *		applied to the strings.
441  *
442  *	C	Pointer to an mbuf chain. Copy that mbuf chain into the
443  *		destination mbuf chain.
444  *
445  *	D	Pointer to a vardata_block structure. Copy the data described
446  *		by that structure into the mbuf chain. The tag field is hard
447  *		coded to '1'.
448  *
449  *	M	Write the SMB1 request signature ('SMBX') into the mbuf chain.
450  *
451  *	N	Write the SMB2 request signature ('SMBX') into the mbuf chain.
452  *
453  *	T	Pointer to a timestruc_t. Convert the content of the structure
454  *		into NT time and store the result of the conversion in the
455  *		mbuf chain.
456  *
457  *	V	Same as 'D' but the tag field is hard coded to '5'.
458  *
459  *	b	Byte. Store the byte or the nymber of bytes specified into the
460  *		the mbuf chain. A format string like this "2b" would require 2
461  *		bytes to be passed in.
462  *
463  *	m	Pointer to an mbuf. Copy the contents of the mbuf into the mbuf
464  *		chain.
465  *
466  *	c	Pointer to a buffer. Copy the buffer into the mbuf chain. The
467  *		size of the buffer is indicated by the number preceding 'c'.
468  *
469  *	w	Word (16bit value). Store the word or the number of words
470  *              specified into the the mbuf chain. A format string like this
471  *		"2w" would require 2 words to be passed in.
472  *
473  *	l	Long (32bit value). Store the long or the number of longs
474  *		specified into the the mbuf chain. A format string like this
475  *		"2l" would require 2 longs to be passed in.
476  *
477  *	q	Quad (64bit value). Store the quad or the number of quads
478  *		specified into the the mbuf chain. A format string like this
479  *		"2q" would require 2 quads to be passed in.
480  *
481  *	L	Pointer to a string. Store the string passed in into the mbuf
482  *		chain preceded with a tag value of '2'.
483  *
484  *	S	Pointer to a string. Store the string passed in into the mbuf
485  *		chain preceded with a tag value of '4'. Applied a unicode
486  *		conversion is appropriate.
487  *
488  *	A	Same as 'S'
489  *
490  *	P	Pointer to a string. Store the string passed in into the mbuf
491  *		chain preceded with a tag value of '5'. Applied a unicode
492  *		conversion is appropriate.
493  *
494  *	u	Pointer to a string. Store the string passed in into the mbuf
495  *		chain. Applied a unicode conversion is appropriate.
496  *
497  *	s	Pointer to a string. Store the string passed in into the mbuf
498  *		chain.
499  *
500  *	Y	Date/Time.  Store the Date/Time or the number of Date/Time(s)
501  *		specified into the the mbuf chain. A format string like this
502  *		"2Y" would require 2 Date/Time values. The Date/Time is
503  *		converted to DOS before storing.
504  *
505  *	y	Same as 'Y'. The order of Date and Time is reversed.
506  *
507  *	,	Character. Store the character or number of character specified
508  *		into the mbuf chain.  A format string like this "2c" would
509  *		require 2 characters to be passed in. A unicode conversion is
510  *		applied if appropriate.
511  *
512  *	.	Same as '`' without unicode conversion.
513  *
514  *	U	Align the offset of the mbuf chain on a 16bit boundary.
515  */
516 int
smb_mbc_vencodef(mbuf_chain_t * mbc,const char * fmt,va_list ap)517 smb_mbc_vencodef(mbuf_chain_t *mbc, const char *fmt, va_list ap)
518 {
519 	char		*charp;
520 	uint8_t		*cvalp;
521 	timestruc_t	*tvp;
522 	smb_vdb_t	*vdp;
523 	smb_request_t	*sr = NULL;
524 	uint64_t	llval;
525 	int64_t		nt_time;
526 	uint32_t	lval;
527 	uint_t		tag;
528 	int		unicode = 0;
529 	int		repc;
530 	boolean_t	repc_specified;
531 	uint16_t	wval;
532 	uint8_t		cval;
533 	uint8_t		c;
534 
535 	while ((c = *fmt++) != 0) {
536 		repc_specified = B_FALSE;
537 		repc = 1;
538 
539 		if ('0' <= c && c <= '9') {
540 			repc = 0;
541 			do {
542 				repc = repc * 10 + c - '0';
543 				c = *fmt++;
544 			} while ('0' <= c && c <= '9');
545 			repc_specified = B_TRUE;
546 		} else if (c == '#') {
547 			repc = va_arg(ap, int);
548 			c = *fmt++;
549 			repc_specified = B_TRUE;
550 		}
551 
552 		switch (c) {
553 		case '%':
554 			sr = va_arg(ap, struct smb_request *);
555 			if (sr->session->dialect >= SMB_VERS_2_BASE) {
556 				unicode = 1;
557 				break;
558 			}
559 			unicode = sr->smb_flg2 & SMB_FLAGS2_UNICODE;
560 			break;
561 
562 		case 'C':	/* Mbuf_chain */
563 			if (mbc_marshal_put_mbuf_chain(mbc,
564 			    va_arg(ap, mbuf_chain_t *)) != 0)
565 				return (DECODE_NO_MORE_DATA);
566 			break;
567 
568 		case 'D':
569 			vdp = va_arg(ap, struct vardata_block *);
570 
571 			if (mbc_marshal_put_char(mbc, 1) != 0)
572 				return (DECODE_NO_MORE_DATA);
573 			if (mbc_marshal_put_short(mbc, vdp->vdb_len) != 0)
574 				return (DECODE_NO_MORE_DATA);
575 			if (mbc_marshal_put_uio(mbc, &vdp->vdb_uio) != 0)
576 				return (DECODE_NO_MORE_DATA);
577 			break;
578 
579 		case 'M':
580 			/* 0xFF S M B */
581 			if (mbc_marshal_put_long(mbc, 0x424D53FF))
582 				return (DECODE_NO_MORE_DATA);
583 			break;
584 
585 		case 'N':
586 			/* 0xFE S M B */
587 			if (mbc_marshal_put_long(mbc, 0x424D53FE))
588 				return (DECODE_NO_MORE_DATA);
589 			break;
590 
591 		case 'T':
592 			tvp = va_arg(ap, timestruc_t *);
593 			nt_time = smb_time_unix_to_nt(tvp);
594 			if (mbc_marshal_put_long_long(mbc, nt_time) != 0)
595 				return (DECODE_NO_MORE_DATA);
596 			break;
597 
598 		case 'V':
599 			vdp = va_arg(ap, struct vardata_block *);
600 
601 			if (mbc_marshal_put_char(mbc, 5) != 0)
602 				return (DECODE_NO_MORE_DATA);
603 			if (mbc_marshal_put_short(mbc, vdp->vdb_len) != 0)
604 				return (DECODE_NO_MORE_DATA);
605 			if (mbc_marshal_put_uio(mbc, &vdp->vdb_uio) != 0)
606 				return (DECODE_NO_MORE_DATA);
607 			break;
608 
609 		case 'b':
610 			while (repc-- > 0) {
611 				cval = va_arg(ap, int);
612 				if (mbc_marshal_put_char(mbc, cval) != 0)
613 					return (DECODE_NO_MORE_DATA);
614 			}
615 			break;
616 
617 		case 'm':	/* struct_mbuf */
618 			if (mbc_marshal_put_mbufs(mbc,
619 			    va_arg(ap, mbuf_t *)) != 0)
620 				return (DECODE_NO_MORE_DATA);
621 			break;
622 
623 		case 'c':
624 			cvalp = va_arg(ap, uint8_t *);
625 			while (repc-- > 0) {
626 				if (mbc_marshal_put_char(mbc,
627 				    *cvalp++) != 0)
628 					return (DECODE_NO_MORE_DATA);
629 			}
630 			break;
631 
632 		case 'w':
633 			while (repc-- > 0) {
634 				wval = va_arg(ap, int);
635 				if (mbc_marshal_put_short(mbc, wval) != 0)
636 					return (DECODE_NO_MORE_DATA);
637 			}
638 			break;
639 
640 		case 'l':
641 			while (repc-- > 0) {
642 				lval = va_arg(ap, uint32_t);
643 				if (mbc_marshal_put_long(mbc, lval) != 0)
644 					return (DECODE_NO_MORE_DATA);
645 			}
646 			break;
647 
648 		case 'q':
649 			while (repc-- > 0) {
650 				llval = va_arg(ap, uint64_t);
651 				if (mbc_marshal_put_long_long(mbc, llval) != 0)
652 					return (DECODE_NO_MORE_DATA);
653 			}
654 			break;
655 
656 
657 		case 'L':
658 			tag = 2;
659 			goto oem_conversion;
660 
661 		case 'S':
662 		case 'A':
663 			tag = 4;
664 			goto tagged_str;
665 
666 		case 'P':
667 			tag = 3;
668 			goto tagged_str;
669 
670 		tagged_str:
671 			if (mbc_marshal_put_char(mbc, tag) != 0)
672 				return (DECODE_NO_MORE_DATA);
673 			/* FALLTHROUGH */
674 
675 		case 'u':	/* Convert from unicode if flags are set */
676 			if (unicode)
677 				goto unicode_translation;
678 			/* FALLTHROUGH */
679 
680 		case 's':	/* put OEM string */
681 oem_conversion:
682 			charp = va_arg(ap, char *);
683 			if (!repc_specified)
684 				repc = 0;
685 			if (mbc_marshal_put_oem_string(mbc,
686 			    charp, repc) != 0)
687 				return (DECODE_NO_MORE_DATA);
688 			break;
689 
690 		case 'U':	/* put UTF-16 string */
691 unicode_translation:
692 			charp = va_arg(ap, char *);
693 			if (!repc_specified)
694 				repc = 0;
695 			if (mbc_marshal_put_unicode_string(mbc,
696 			    charp, repc) != 0)
697 				return (DECODE_NO_MORE_DATA);
698 			break;
699 
700 		case 'Y':		/* int32_t, encode dos date/time */
701 			while (repc-- > 0) {
702 				uint16_t	d, t;
703 
704 				lval = va_arg(ap, uint32_t);
705 				smb_time_unix_to_dos(lval,
706 				    (short *)&d, (short *)&t);
707 				if (mbc_marshal_put_short(mbc, t) != 0)
708 					return (DECODE_NO_MORE_DATA);
709 				if (mbc_marshal_put_short(mbc, d) != 0)
710 					return (DECODE_NO_MORE_DATA);
711 			}
712 			break;
713 
714 		case 'y':		/* int32_t, encode dos date/time */
715 			while (repc-- > 0) {
716 				uint16_t	d, t;
717 
718 				lval = va_arg(ap, uint32_t);
719 				smb_time_unix_to_dos(lval,
720 				    (short *)&d, (short *)&t);
721 				if (mbc_marshal_put_short(mbc, d) != 0)
722 					return (DECODE_NO_MORE_DATA);
723 				if (mbc_marshal_put_short(mbc, t) != 0)
724 					return (DECODE_NO_MORE_DATA);
725 			}
726 			break;
727 
728 		case ',':
729 			if (unicode)
730 				repc *= 2;
731 			/* FALLTHROUGH */
732 
733 		case '.':
734 			while (repc-- > 0)
735 				if (mbc_marshal_put_char(mbc, 0) != 0)
736 					return (DECODE_NO_MORE_DATA);
737 			break;
738 
739 		default:
740 			ASSERT(0);
741 			return (-1);
742 		}
743 	}
744 	return (0);
745 }
746 
747 /*
748  * smb_mbc_encodef
749  *
750  * This function builds a stream of bytes in the mbc chain passed in under the
751  * control of the format fmt.
752  *
753  * (for a description of the format string see smb_mbc_vencodef()).
754  */
755 int
smb_mbc_encodef(mbuf_chain_t * mbc,const char * fmt,...)756 smb_mbc_encodef(mbuf_chain_t *mbc, const char *fmt, ...)
757 {
758 	int	rc;
759 	va_list	ap;
760 
761 	va_start(ap, fmt);
762 	rc = smb_mbc_vencodef(mbc, fmt, ap);
763 	va_end(ap);
764 	return (rc);
765 }
766 
767 /*
768  * smb_mbc_poke
769  *
770  * This function writes a stream of bytes in the mbc passed in at the specified
771  * offset under the control of the format fmt. The offset of the chain passed in
772  * is not modified.
773  *
774  * (for a description of the format string see smb_mbc_vencodef()).
775  */
776 int
smb_mbc_poke(mbuf_chain_t * mbc,int offset,const char * fmt,...)777 smb_mbc_poke(mbuf_chain_t *mbc, int offset, const char *fmt, ...)
778 {
779 	int		len, rc;
780 	mbuf_chain_t	tmp;
781 	va_list		ap;
782 
783 	if ((len = mbc->max_bytes - offset) < 0)
784 		return (DECODE_NO_MORE_DATA);
785 	rc = MBC_SHADOW_CHAIN(&tmp, mbc, offset, len);
786 	if (rc)
787 		return (DECODE_NO_MORE_DATA);
788 
789 	va_start(ap, fmt);
790 	rc = smb_mbc_vencodef(&tmp, fmt, ap);
791 	va_end(ap);
792 
793 	return (rc);
794 }
795 
796 /*
797  * Copy data from the src mbuf chain to the dst mbuf chain,
798  * at the given offset in the src and current offset in dst,
799  * for copy_len bytes.  Does NOT update src->chain_offset.
800  */
801 int
smb_mbc_copy(mbuf_chain_t * dst_mbc,const mbuf_chain_t * src_mbc,int copy_offset,int copy_len)802 smb_mbc_copy(mbuf_chain_t *dst_mbc, const mbuf_chain_t *src_mbc,
803     int copy_offset, int copy_len)
804 {
805 	mbuf_t	*src_m;
806 	int offset, len;
807 	int rc;
808 
809 	if (copy_len <= 0)
810 		return (0);
811 	if (copy_offset < 0)
812 		return (EINVAL);
813 	if ((copy_offset + copy_len) > src_mbc->max_bytes)
814 		return (EMSGSIZE);
815 
816 	/*
817 	 * Advance to the src mbuf where we start copying.
818 	 */
819 	offset = copy_offset;
820 	src_m = src_mbc->chain;
821 	while (src_m && offset >= src_m->m_len) {
822 		offset -= src_m->m_len;
823 		src_m = src_m->m_next;
824 	}
825 	if (src_m == NULL)
826 		return (EFAULT);
827 
828 	/*
829 	 * Copy the first part, which may start somewhere past
830 	 * the beginning of the current mbuf.
831 	 */
832 	len = src_m->m_len - offset;
833 	if (len > copy_len)
834 		len = copy_len;
835 	rc = smb_mbc_put_mem(dst_mbc, src_m->m_data + offset, len);
836 	if (rc != 0)
837 		return (rc);
838 	copy_len -= len;
839 
840 	/*
841 	 * Copy remaining mbufs...
842 	 */
843 	while (copy_len > 0) {
844 		src_m = src_m->m_next;
845 		if (src_m == NULL)
846 			break;
847 		len = src_m->m_len;
848 		if (len > copy_len)
849 			len = copy_len;
850 		rc = smb_mbc_put_mem(dst_mbc, src_m->m_data, len);
851 		copy_len -= len;
852 	}
853 
854 	return (0);
855 }
856 
857 /*
858  * Copy data from the passed memory buffer into the mbuf chain
859  * at the current offset.
860  */
861 int
smb_mbc_put_mem(mbuf_chain_t * mbc,void * vmem,int mem_len)862 smb_mbc_put_mem(mbuf_chain_t *mbc, void *vmem, int mem_len)
863 {
864 	caddr_t mem = vmem;
865 	mbuf_t	*m;
866 	int32_t	offset, tlen;
867 	int rc;
868 
869 	if (mem_len <= 0)
870 		return (0);
871 
872 	if ((rc = mbc_marshal_make_room(mbc, mem_len)) != 0)
873 		return (rc);
874 
875 	/*
876 	 * Advance to the dst mbuf where we start copying.
877 	 * Allocations were done by _make_room().
878 	 */
879 	offset = mbc->chain_offset;
880 	m = mbc->chain;
881 	while (offset >= m->m_len) {
882 		ASSERT(m->m_len > 0);
883 		offset -= m->m_len;
884 		m = m->m_next;
885 	}
886 
887 	/*
888 	 * Copy the first part, which may start somewhere past
889 	 * the beginning of the current mbuf.
890 	 */
891 	tlen = m->m_len - offset;
892 	if (tlen > mem_len)
893 		tlen = mem_len;
894 	bcopy(mem, m->m_data + offset, tlen);
895 	mbc->chain_offset += tlen;
896 	mem += tlen;
897 	mem_len -= tlen;
898 
899 	/*
900 	 * Copy remaining mem into mbufs.  These all start
901 	 * at the beginning of each mbuf, and the last may
902 	 * end somewhere short of m_len.
903 	 */
904 	while (mem_len > 0) {
905 		m = m->m_next;
906 		tlen = m->m_len;
907 		if (tlen > mem_len)
908 			tlen = mem_len;
909 		bcopy(mem, m->m_data, tlen);
910 		mbc->chain_offset += tlen;
911 		mem += tlen;
912 		mem_len -= tlen;
913 	}
914 
915 	return (0);
916 }
917 
918 /*
919  * Put padding sufficient to align to A, where
920  * A is some power of 2 greater than zero.
921  */
922 int
smb_mbc_put_align(mbuf_chain_t * mbc,int align)923 smb_mbc_put_align(mbuf_chain_t *mbc, int align)
924 {
925 	int mask = align - 1;
926 	int padsz;
927 
928 	ASSERT(align > 0 && (align & mask) == 0);
929 	if ((mbc->chain_offset & mask) == 0)
930 		return (0);
931 	padsz = align - (mbc->chain_offset & mask);
932 	return (smb_mbc_encodef(mbc, "#.", padsz));
933 }
934 
935 /*
936  * Put data into mbuf chain allocating as needed.
937  * Adds room to end of mbuf chain if needed.
938  */
939 static int
mbc_marshal_make_room(mbuf_chain_t * mbc,int32_t bytes_needed)940 mbc_marshal_make_room(mbuf_chain_t *mbc, int32_t bytes_needed)
941 {
942 	mbuf_t	*m;
943 	mbuf_t	*l;
944 	int32_t	bytes_available;
945 
946 	bytes_needed += mbc->chain_offset;
947 	if (bytes_needed > mbc->max_bytes)
948 		return (EMSGSIZE);
949 
950 	if ((m = mbc->chain) == 0) {
951 		MGET(m, M_WAIT, MT_DATA);
952 		m->m_len = 0;
953 		MCLGET(m, M_WAIT);
954 		mbc->chain = m;
955 		/* xxxx */
956 		/* ^    */
957 	}
958 
959 	/* ---- ----- --xx ---xxx */
960 	/* ^			  */
961 
962 	l = 0;
963 	while ((m != 0) && (bytes_needed >= m->m_len)) {
964 		l = m;
965 		bytes_needed -= m->m_len;
966 		m = m->m_next;
967 	}
968 
969 	if ((bytes_needed == 0) || (m != 0)) {
970 		/* We have enough room already */
971 		return (0);
972 	}
973 
974 	/* ---- ----- --xx ---xxx */
975 	/*			 ^ */
976 	/* Back up to start of last mbuf */
977 	m = l;
978 	bytes_needed += m->m_len;
979 
980 	/* ---- ----- --xx ---xxx */
981 	/*		   ^	  */
982 
983 	bytes_available = (m->m_flags & M_EXT) ?
984 	    m->m_ext.ext_size : MLEN;
985 
986 	/* ---- ----- --xx ---xxx */
987 	/*		   ^	  */
988 	while ((bytes_needed != 0) && (bytes_needed > bytes_available)) {
989 		m->m_len = bytes_available;
990 		bytes_needed -= m->m_len;
991 		/* ---- ----- --xx ------ */
992 		/*		   ^	  */
993 
994 		MGET(m->m_next, M_WAIT, MT_DATA);
995 		m = m->m_next;
996 		m->m_len = 0;
997 		MCLGET(m, M_WAIT);
998 
999 		ASSERT((m->m_flags & M_EXT) != 0);
1000 		bytes_available = m->m_ext.ext_size;
1001 
1002 		/* ---- ----- --xx ------ xxxx */
1003 		/*			  ^    */
1004 	}
1005 
1006 	/* ---- ----- --xx ------ xxxx */
1007 	/*			  ^    */
1008 	/* Expand last tail as needed */
1009 	if (m->m_len <= bytes_needed) {
1010 		m->m_len = bytes_needed;
1011 		/* ---- ----- --xx ------ --xx */
1012 		/*			   ^   */
1013 	}
1014 
1015 	return (0);
1016 }
1017 
1018 static void
mbc_marshal_store_byte(mbuf_chain_t * mbc,uint8_t data)1019 mbc_marshal_store_byte(mbuf_chain_t *mbc, uint8_t data)
1020 {
1021 	mbuf_t	*m = mbc->chain;
1022 	int32_t	cur_offset = mbc->chain_offset;
1023 
1024 	/*
1025 	 * Scan forward looking for the last data currently in chain.
1026 	 */
1027 	while (cur_offset >= m->m_len) {
1028 		cur_offset -= m->m_len;
1029 		m = m->m_next;
1030 	}
1031 	((char *)m->m_data)[cur_offset] = data;
1032 	mbc->chain_offset++;
1033 }
1034 
1035 static int
mbc_marshal_put_char(mbuf_chain_t * mbc,uint8_t data)1036 mbc_marshal_put_char(mbuf_chain_t *mbc, uint8_t data)
1037 {
1038 	if (mbc_marshal_make_room(mbc, sizeof (char)) != 0)
1039 		return (DECODE_NO_MORE_DATA);
1040 	mbc_marshal_store_byte(mbc, data);
1041 	return (0);
1042 }
1043 
1044 static int
mbc_marshal_put_short(mbuf_chain_t * mbc,uint16_t data)1045 mbc_marshal_put_short(mbuf_chain_t *mbc, uint16_t data)
1046 {
1047 	if (mbc_marshal_make_room(mbc, sizeof (short)))
1048 		return (DECODE_NO_MORE_DATA);
1049 	mbc_marshal_store_byte(mbc, data);
1050 	mbc_marshal_store_byte(mbc, data >> 8);
1051 	return (0);
1052 }
1053 
1054 static int
mbc_marshal_put_long(mbuf_chain_t * mbc,uint32_t data)1055 mbc_marshal_put_long(mbuf_chain_t *mbc, uint32_t data)
1056 {
1057 	if (mbc_marshal_make_room(mbc, sizeof (int32_t)))
1058 		return (DECODE_NO_MORE_DATA);
1059 	mbc_marshal_store_byte(mbc, data);
1060 	mbc_marshal_store_byte(mbc, data >> 8);
1061 	mbc_marshal_store_byte(mbc, data >> 16);
1062 	mbc_marshal_store_byte(mbc, data >> 24);
1063 	return (0);
1064 }
1065 
1066 static int
mbc_marshal_put_long_long(mbuf_chain_t * mbc,uint64_t data)1067 mbc_marshal_put_long_long(mbuf_chain_t *mbc, uint64_t data)
1068 {
1069 	if (mbc_marshal_make_room(mbc, sizeof (int64_t)))
1070 		return (DECODE_NO_MORE_DATA);
1071 
1072 	mbc_marshal_store_byte(mbc, data);
1073 	mbc_marshal_store_byte(mbc, data >> 8);
1074 	mbc_marshal_store_byte(mbc, data >> 16);
1075 	mbc_marshal_store_byte(mbc, data >> 24);
1076 	mbc_marshal_store_byte(mbc, data >> 32);
1077 	mbc_marshal_store_byte(mbc, data >> 40);
1078 	mbc_marshal_store_byte(mbc, data >> 48);
1079 	mbc_marshal_store_byte(mbc, data >> 56);
1080 	return (0);
1081 }
1082 
1083 /*
1084  * Marshal a UTF-8 string (str) into mbc, converting to OEM codeset.
1085  * Also write a null unless the repc count limits the length we put.
1086  * When (repc > 0) the length we marshal must be exactly repc, and
1087  * truncate or pad the mbc data as necessary.
1088  * See also: msgbuf_put_oem_string
1089  */
1090 static int
mbc_marshal_put_oem_string(mbuf_chain_t * mbc,char * mbs,int repc)1091 mbc_marshal_put_oem_string(mbuf_chain_t *mbc, char *mbs, int repc)
1092 {
1093 	uint8_t		*oembuf = NULL;
1094 	uint8_t		*s;
1095 	int		oemlen;
1096 	int		rlen;
1097 	int		rc;
1098 
1099 	/*
1100 	 * Compute length of converted OEM string,
1101 	 * NOT including null terminator
1102 	 */
1103 	if ((oemlen = smb_sbequiv_strlen(mbs)) == -1)
1104 		return (DECODE_NO_MORE_DATA);
1105 
1106 	/*
1107 	 * If repc not specified, put whole string + NULL,
1108 	 * otherwise will truncate or pad as needed.
1109 	 */
1110 	if (repc <= 0)
1111 		repc = oemlen + 1;
1112 
1113 	/*
1114 	 * Convert into a temporary buffer
1115 	 * Free oembuf before return.
1116 	 */
1117 	oembuf = smb_mem_zalloc(oemlen + 1);
1118 	ASSERT(oembuf != NULL);
1119 	rlen = smb_mbstooem(oembuf, mbs, oemlen);
1120 	if (rlen < 0) {
1121 		rc = DECODE_NO_MORE_DATA;
1122 		goto out;
1123 	}
1124 	if (rlen > oemlen)
1125 		rlen = oemlen;
1126 	oembuf[rlen] = '\0';
1127 
1128 	/*
1129 	 * Copy the converted string into the message,
1130 	 * truncated or paded as required.
1131 	 */
1132 	s = oembuf;
1133 	while (repc > 0) {
1134 		if (mbc_marshal_make_room(mbc, 1)) {
1135 			rc = DECODE_NO_MORE_DATA;
1136 			goto out;
1137 		}
1138 		mbc_marshal_store_byte(mbc, *s);
1139 		if (*s != '\0')
1140 			s++;
1141 		repc--;
1142 	}
1143 	rc = 0;
1144 
1145 out:
1146 	if (oembuf != NULL)
1147 		smb_mem_free(oembuf);
1148 	return (rc);
1149 }
1150 
1151 /*
1152  * Marshal a UTF-8 string (str) into mbc, converting to UTF-16.
1153  * Also write a null unless the repc count limits the length.
1154  * When (repc > 0) the length we marshal must be exactly repc,
1155  * and truncate or pad the mbc data as necessary.
1156  * See also: msgbuf_put_unicode_string
1157  */
1158 static int
mbc_marshal_put_unicode_string(mbuf_chain_t * mbc,char * mbs,int repc)1159 mbc_marshal_put_unicode_string(mbuf_chain_t *mbc, char *mbs, int repc)
1160 {
1161 	smb_wchar_t	*wcsbuf = NULL;
1162 	smb_wchar_t	*wp;
1163 	smb_wchar_t	wchar;
1164 	size_t		wcslen, wcsbytes;
1165 	size_t		rlen;
1166 	int		rc;
1167 
1168 	/* align to word boundary */
1169 	if (mbc->chain_offset & 1) {
1170 		if (mbc_marshal_make_room(mbc, 1))
1171 			return (DECODE_NO_MORE_DATA);
1172 		mbc_marshal_store_byte(mbc, 0);
1173 	}
1174 
1175 	/*
1176 	 * Compute length of converted UTF-16 string,
1177 	 * NOT including null terminator (in bytes).
1178 	 */
1179 	wcsbytes = smb_wcequiv_strlen(mbs);
1180 	if (wcsbytes == (size_t)-1)
1181 		return (DECODE_NO_MORE_DATA);
1182 
1183 	/*
1184 	 * If repc not specified, put whole string + NULL,
1185 	 * otherwise will truncate or pad as needed.
1186 	 */
1187 	if (repc <= 0)
1188 		repc = wcsbytes + 2;
1189 
1190 	/*
1191 	 * Convert into a temporary buffer
1192 	 * Free wcsbuf before return.
1193 	 */
1194 	wcslen = wcsbytes / 2;
1195 	wcsbuf = smb_mem_zalloc(wcsbytes + 2);
1196 	ASSERT(wcsbuf != NULL);
1197 	rlen = smb_mbstowcs(wcsbuf, mbs, wcslen);
1198 	if (rlen == (size_t)-1) {
1199 		rc = DECODE_NO_MORE_DATA;
1200 		goto out;
1201 	}
1202 	if (rlen > wcslen)
1203 		rlen = wcslen;
1204 	wcsbuf[rlen] = 0;
1205 
1206 	/*
1207 	 * Copy the converted string into the message,
1208 	 * truncated or paded as required.  Preserve
1209 	 * little-endian order while copying.
1210 	 */
1211 	wp = wcsbuf;
1212 	while (repc >= sizeof (smb_wchar_t)) {
1213 		if (mbc_marshal_make_room(mbc, sizeof (smb_wchar_t))) {
1214 			rc = DECODE_NO_MORE_DATA;
1215 			goto out;
1216 		}
1217 		wchar = LE_IN16(wp);
1218 		mbc_marshal_store_byte(mbc, wchar);
1219 		mbc_marshal_store_byte(mbc, wchar >> 8);
1220 		if (wchar != 0)
1221 			wp++;
1222 		repc -= sizeof (smb_wchar_t);
1223 	}
1224 	if (repc > 0) {
1225 		if (mbc_marshal_make_room(mbc, 1)) {
1226 			rc = DECODE_NO_MORE_DATA;
1227 			goto out;
1228 		}
1229 		mbc_marshal_store_byte(mbc, 0);
1230 	}
1231 	rc = 0;
1232 
1233 out:
1234 	if (wcsbuf != NULL)
1235 		smb_mem_free(wcsbuf);
1236 	return (rc);
1237 }
1238 
1239 static int /*ARGSUSED*/
uiorefnoop(caddr_t p,int size,int adj)1240 uiorefnoop(caddr_t p, int size, int adj)
1241 {
1242 	return (0);
1243 }
1244 
1245 static int
mbc_marshal_put_uio(mbuf_chain_t * mbc,struct uio * uio)1246 mbc_marshal_put_uio(mbuf_chain_t *mbc, struct uio *uio)
1247 {
1248 	mbuf_t		**t;
1249 	mbuf_t		*m = NULL;
1250 	struct iovec	*iov = uio->uio_iov;
1251 	int32_t		i, iov_cnt = uio->uio_iovcnt;
1252 
1253 	iov = uio->uio_iov;
1254 	t = &mbc->chain;
1255 	for (i = 0; i < iov_cnt; i++) {
1256 		MGET(m, M_WAIT, MT_DATA);
1257 		m->m_ext.ext_buf = iov->iov_base;
1258 		m->m_ext.ext_ref = uiorefnoop;
1259 		m->m_data = m->m_ext.ext_buf;
1260 		m->m_flags |= M_EXT;
1261 		m->m_len = m->m_ext.ext_size = iov->iov_len;
1262 		mbc->max_bytes += m->m_len;
1263 		m->m_next = 0;
1264 		*t = m;
1265 		t = &m->m_next;
1266 		iov++;
1267 	}
1268 	return (0);
1269 }
1270 
1271 static int
mbc_marshal_put_mbufs(mbuf_chain_t * mbc,mbuf_t * m)1272 mbc_marshal_put_mbufs(mbuf_chain_t *mbc, mbuf_t *m)
1273 {
1274 	mbuf_t	*mt;
1275 	mbuf_t	**t;
1276 	int	bytes;
1277 
1278 	if (m != NULL) {
1279 		mt = m;
1280 		bytes = mt->m_len;
1281 		while (mt->m_next != 0) {
1282 			mt = mt->m_next;
1283 			bytes += mt->m_len;
1284 		}
1285 		if (bytes != 0) {
1286 			t = &mbc->chain;
1287 			while (*t != 0) {
1288 				bytes += (*t)->m_len;
1289 				t = &(*t)->m_next;
1290 			}
1291 			*t = m;
1292 			mbc->chain_offset = bytes;
1293 		} else {
1294 			m_freem(m);
1295 		}
1296 	}
1297 	return (0);
1298 }
1299 
1300 static int
mbc_marshal_put_mbuf_chain(mbuf_chain_t * mbc,mbuf_chain_t * nmbc)1301 mbc_marshal_put_mbuf_chain(mbuf_chain_t *mbc, mbuf_chain_t *nmbc)
1302 {
1303 	if (nmbc->chain != 0) {
1304 		if (mbc_marshal_put_mbufs(mbc, nmbc->chain))
1305 			return (DECODE_NO_MORE_DATA);
1306 		MBC_SETUP(nmbc, nmbc->max_bytes);
1307 	}
1308 	return (0);
1309 }
1310 
1311 static uint8_t
mbc_marshal_fetch_byte(mbuf_chain_t * mbc)1312 mbc_marshal_fetch_byte(mbuf_chain_t *mbc)
1313 {
1314 	uint8_t	data;
1315 	mbuf_t	*m = mbc->chain;
1316 	int32_t	offset = mbc->chain_offset;
1317 
1318 	while (offset >= m->m_len) {
1319 		offset -= m->m_len;
1320 		m = m->m_next;
1321 	}
1322 	data = ((uint8_t *)m->m_data)[offset];
1323 	mbc->chain_offset++;
1324 	return (data);
1325 }
1326 
1327 static int
mbc_marshal_get_char(mbuf_chain_t * mbc,uint8_t * data)1328 mbc_marshal_get_char(mbuf_chain_t *mbc, uint8_t *data)
1329 {
1330 	if (MBC_ROOM_FOR(mbc, sizeof (char)) == 0) {
1331 		/* Data will never be available */
1332 		return (DECODE_NO_MORE_DATA);
1333 	}
1334 	*data = mbc_marshal_fetch_byte(mbc);
1335 	return (0);
1336 }
1337 
1338 static int
mbc_marshal_get_short(mbuf_chain_t * mbc,uint16_t * data)1339 mbc_marshal_get_short(mbuf_chain_t *mbc, uint16_t *data)
1340 {
1341 	uint16_t	tmp;
1342 	mbuf_t		*m = mbc->chain;
1343 	int32_t		offset = mbc->chain_offset;
1344 
1345 	if (MBC_ROOM_FOR(mbc, sizeof (short)) == 0) {
1346 		/* Data will never be available */
1347 		return (DECODE_NO_MORE_DATA);
1348 	}
1349 
1350 	while (offset >= m->m_len) {
1351 		offset -= m->m_len;
1352 		m = m->m_next;
1353 	}
1354 	if ((m->m_len - offset) >= sizeof (short)) {
1355 		*data = LE_IN16(m->m_data + offset);
1356 		mbc->chain_offset += sizeof (short);
1357 	} else {
1358 		tmp = (uint16_t)mbc_marshal_fetch_byte(mbc);
1359 		tmp |= ((uint16_t)mbc_marshal_fetch_byte(mbc)) << 8;
1360 		*data = tmp;
1361 	}
1362 	return (0);
1363 }
1364 
1365 static int
mbc_marshal_get_long(mbuf_chain_t * mbc,uint32_t * data)1366 mbc_marshal_get_long(mbuf_chain_t *mbc, uint32_t *data)
1367 {
1368 	uint32_t	tmp;
1369 	mbuf_t		*m = mbc->chain;
1370 	int32_t		offset = mbc->chain_offset;
1371 
1372 	if (MBC_ROOM_FOR(mbc, sizeof (int32_t)) == 0) {
1373 		/* Data will never be available */
1374 		return (DECODE_NO_MORE_DATA);
1375 	}
1376 	while (offset >= m->m_len) {
1377 		offset -= m->m_len;
1378 		m = m->m_next;
1379 	}
1380 	if ((m->m_len - offset) >= sizeof (int32_t)) {
1381 		*data = LE_IN32(m->m_data + offset);
1382 		mbc->chain_offset += sizeof (int32_t);
1383 	} else {
1384 		tmp = (uint32_t)mbc_marshal_fetch_byte(mbc);
1385 		tmp |= ((uint32_t)mbc_marshal_fetch_byte(mbc)) << 8;
1386 		tmp |= ((uint32_t)mbc_marshal_fetch_byte(mbc)) << 16;
1387 		tmp |= ((uint32_t)mbc_marshal_fetch_byte(mbc)) << 24;
1388 		*data = tmp;
1389 	}
1390 	return (0);
1391 }
1392 
1393 static uint64_t
qswap(uint64_t ll)1394 qswap(uint64_t ll)
1395 {
1396 	uint64_t v;
1397 
1398 	v = ll >> 32;
1399 	v |= ll << 32;
1400 
1401 	return (v);
1402 }
1403 
1404 static int
mbc_marshal_get_odd_long_long(mbuf_chain_t * mbc,uint64_t * data)1405 mbc_marshal_get_odd_long_long(mbuf_chain_t *mbc, uint64_t *data)
1406 {
1407 	uint64_t	tmp;
1408 	mbuf_t		*m = mbc->chain;
1409 	int32_t		offset = mbc->chain_offset;
1410 
1411 	if (MBC_ROOM_FOR(mbc, sizeof (int64_t)) == 0) {
1412 		/* Data will never be available */
1413 		return (DECODE_NO_MORE_DATA);
1414 	}
1415 	while (offset >= m->m_len) {
1416 		offset -= m->m_len;
1417 		m = m->m_next;
1418 	}
1419 
1420 	if ((m->m_len - offset) >= sizeof (int64_t)) {
1421 		*data = qswap(LE_IN64(m->m_data + offset));
1422 		mbc->chain_offset += sizeof (int64_t);
1423 	} else {
1424 		tmp = (uint64_t)mbc_marshal_fetch_byte(mbc) << 32;
1425 		tmp |= (uint64_t)mbc_marshal_fetch_byte(mbc) << 40;
1426 		tmp |= (uint64_t)mbc_marshal_fetch_byte(mbc) << 48;
1427 		tmp |= (uint64_t)mbc_marshal_fetch_byte(mbc) << 56;
1428 		tmp |= (uint64_t)mbc_marshal_fetch_byte(mbc);
1429 		tmp |= (uint64_t)mbc_marshal_fetch_byte(mbc) << 8;
1430 		tmp |= (uint64_t)mbc_marshal_fetch_byte(mbc) << 16;
1431 		tmp |= (uint64_t)mbc_marshal_fetch_byte(mbc) << 24;
1432 
1433 		*(uint64_t *)data = tmp;
1434 	}
1435 	return (0);
1436 }
1437 
1438 static int
mbc_marshal_get_long_long(mbuf_chain_t * mbc,uint64_t * data)1439 mbc_marshal_get_long_long(mbuf_chain_t *mbc, uint64_t *data)
1440 {
1441 	uint64_t	tmp;
1442 	mbuf_t		*m = mbc->chain;
1443 	int32_t		offset = mbc->chain_offset;
1444 
1445 	if (MBC_ROOM_FOR(mbc, sizeof (int64_t)) == 0) {
1446 		/* Data will never be available */
1447 		return (DECODE_NO_MORE_DATA);
1448 	}
1449 	while (offset >= m->m_len) {
1450 		offset -= m->m_len;
1451 		m = m->m_next;
1452 	}
1453 	if ((m->m_len - offset) >= sizeof (int64_t)) {
1454 		*data = LE_IN64(m->m_data + offset);
1455 		mbc->chain_offset += sizeof (int64_t);
1456 	} else {
1457 		tmp = (uint32_t)mbc_marshal_fetch_byte(mbc);
1458 		tmp |= ((uint64_t)mbc_marshal_fetch_byte(mbc)) << 8;
1459 		tmp |= ((uint64_t)mbc_marshal_fetch_byte(mbc)) << 16;
1460 		tmp |= ((uint64_t)mbc_marshal_fetch_byte(mbc)) << 24;
1461 		tmp |= ((uint64_t)mbc_marshal_fetch_byte(mbc)) << 32;
1462 		tmp |= ((uint64_t)mbc_marshal_fetch_byte(mbc)) << 40;
1463 		tmp |= ((uint64_t)mbc_marshal_fetch_byte(mbc)) << 48;
1464 		tmp |= ((uint64_t)mbc_marshal_fetch_byte(mbc)) << 56;
1465 		*(uint64_t *)data = tmp;
1466 	}
1467 	return (0);
1468 }
1469 
1470 /*
1471  * mbc_marshal_get_oem_string
1472  *
1473  * Decode an OEM string, returning its UTF-8 form in strpp,
1474  * allocated using smb_srm_zalloc (automatically freed).
1475  * If max_bytes != 0, consume at most max_bytes of the mbc.
1476  * See also: msgbuf_get_oem_string
1477  */
1478 static int
mbc_marshal_get_oem_string(smb_request_t * sr,mbuf_chain_t * mbc,char ** strpp,int max_bytes)1479 mbc_marshal_get_oem_string(smb_request_t *sr,
1480     mbuf_chain_t *mbc, char **strpp, int max_bytes)
1481 {
1482 	char		*mbs;
1483 	uint8_t		*oembuf = NULL;
1484 	int		oemlen, oemmax;
1485 	int		mbsmax;
1486 	int		rlen;
1487 	int		rc;
1488 
1489 	if (max_bytes == 0)
1490 		max_bytes = 0xffff;
1491 
1492 	/*
1493 	 * Get the OtW data into a temporary buffer.
1494 	 * Free oembuf before return.
1495 	 */
1496 	oemlen = 0;
1497 	oemmax = MALLOC_QUANTUM;
1498 	oembuf = smb_mem_alloc(oemmax);
1499 	for (;;) {
1500 		uint8_t ch;
1501 
1502 		if (oemlen >= max_bytes)
1503 			break;
1504 		if ((oemlen + 2) >= oemmax) {
1505 			oemmax += MALLOC_QUANTUM;
1506 			oembuf = smb_mem_realloc(oembuf, oemmax);
1507 		}
1508 		if (mbc_marshal_get_char(mbc, &ch) != 0) {
1509 			rc = DECODE_NO_MORE_DATA;
1510 			goto out;
1511 		}
1512 		if (ch == 0)
1513 			break;
1514 		oembuf[oemlen++] = ch;
1515 	}
1516 	oembuf[oemlen] = '\0';
1517 
1518 	/*
1519 	 * Get the buffer we'll return and convert to UTF-8.
1520 	 * May take as much as double the space.
1521 	 */
1522 	mbsmax = oemlen * 2;
1523 	mbs = smb_srm_zalloc(sr, mbsmax + 1);
1524 	ASSERT(mbs != NULL);
1525 	rlen = smb_oemtombs(mbs, oembuf, mbsmax);
1526 	if (rlen < 0) {
1527 		rc = DECODE_NO_MORE_DATA;
1528 		goto out;
1529 	}
1530 	if (rlen > mbsmax)
1531 		rlen = mbsmax;
1532 	mbs[rlen] = '\0';
1533 	*strpp = mbs;
1534 	rc = 0;
1535 
1536 out:
1537 	if (oembuf != NULL)
1538 		smb_mem_free(oembuf);
1539 	return (rc);
1540 }
1541 
1542 /*
1543  * mbc_marshal_get_unicode_string
1544  *
1545  * Decode a UTF-16 string, returning its UTF-8 form in strpp,
1546  * allocated using smb_srm_zalloc (automatically freed).
1547  * If max_bytes != 0, consume at most max_bytes of the mbc.
1548  * See also: msgbuf_get_unicode_string
1549  */
1550 static int
mbc_marshal_get_unicode_string(smb_request_t * sr,mbuf_chain_t * mbc,char ** strpp,int max_bytes)1551 mbc_marshal_get_unicode_string(smb_request_t *sr,
1552     mbuf_chain_t *mbc, char **strpp, int max_bytes)
1553 {
1554 	char		*mbs;
1555 	uint16_t	*wcsbuf = NULL;
1556 	int		wcslen;		// wchar count
1557 	int		wcsmax;		// byte count
1558 	size_t		mbsmax;
1559 	size_t		rlen;
1560 	int		rc;
1561 
1562 	if (max_bytes == 0)
1563 		max_bytes = 0xffff;
1564 
1565 	/*
1566 	 * Unicode strings are always word aligned.
1567 	 */
1568 	if (mbc->chain_offset & 1) {
1569 		if (MBC_ROOM_FOR(mbc, sizeof (char)) == 0)
1570 			return (DECODE_NO_MORE_DATA);
1571 		mbc->chain_offset++;
1572 	}
1573 
1574 	/*
1575 	 * Get the OtW data into a temporary buffer.
1576 	 * Free wcsbuf before return.
1577 	 */
1578 	wcslen = 0;
1579 	wcsmax = MALLOC_QUANTUM;
1580 	wcsbuf = smb_mem_alloc(wcsmax);
1581 	for (;;) {
1582 		uint16_t	wchar;
1583 
1584 		if ((wcslen * 2) >= max_bytes)
1585 			break;
1586 		if (((wcslen * 2) + 4) >= wcsmax) {
1587 			wcsmax += MALLOC_QUANTUM;
1588 			wcsbuf = smb_mem_realloc(wcsbuf, wcsmax);
1589 		}
1590 		if (mbc_marshal_get_short(mbc, &wchar) != 0) {
1591 			rc = DECODE_NO_MORE_DATA;
1592 			goto out;
1593 		}
1594 		if (wchar == 0)
1595 			break;
1596 		/* Keep in little-endian form. */
1597 		LE_OUT16(wcsbuf + wcslen, wchar);
1598 		wcslen++;
1599 	}
1600 	wcsbuf[wcslen] = 0;
1601 
1602 	/*
1603 	 * Get the buffer we'll return and convert to UTF-8.
1604 	 * May take as much 4X number of wide chars.
1605 	 */
1606 	mbsmax = wcslen * MTS_MB_CUR_MAX;
1607 	mbs = smb_srm_zalloc(sr, mbsmax + 1);
1608 	ASSERT(mbs != NULL);
1609 	rlen = smb_wcstombs(mbs, wcsbuf, mbsmax);
1610 	if (rlen == (size_t)-1) {
1611 		rc = DECODE_NO_MORE_DATA;
1612 		goto out;
1613 	}
1614 	if (rlen > mbsmax)
1615 		rlen = mbsmax;
1616 	mbs[rlen] = '\0';
1617 	*strpp = mbs;
1618 	rc = 0;
1619 
1620 out:
1621 	if (wcsbuf != NULL)
1622 		smb_mem_free(wcsbuf);
1623 	return (rc);
1624 }
1625 
1626 static int /*ARGSUSED*/
mbc_marshal_get_mbufs(mbuf_chain_t * mbc,int32_t bytes,mbuf_t ** m)1627 mbc_marshal_get_mbufs(mbuf_chain_t *mbc, int32_t bytes, mbuf_t **m)
1628 {
1629 	*m = NULL;
1630 	if (MBC_ROOM_FOR(mbc, bytes) == 0) {
1631 		/* Data will never be available */
1632 		return (DECODE_NO_MORE_DATA);
1633 	}
1634 	/* not yet implemented */
1635 	return (-1);
1636 }
1637 
1638 static int
mbc_marshal_get_mbuf_chain(mbuf_chain_t * mbc,int32_t bytes,mbuf_chain_t * nmbc)1639 mbc_marshal_get_mbuf_chain(mbuf_chain_t *mbc, int32_t bytes, mbuf_chain_t *nmbc)
1640 {
1641 	int	rc;
1642 	mbuf_t	*m;
1643 
1644 	if (bytes == 0) {
1645 		/* Get all the rest */
1646 		bytes = mbc->max_bytes - mbc->chain_offset;
1647 	}
1648 
1649 	MBC_SETUP(nmbc, mbc->max_bytes);
1650 	if ((rc = mbc_marshal_get_mbufs(mbc, bytes, &m)) != 0) {
1651 		if (m)
1652 			m_freem(m);
1653 		return (rc);
1654 	}
1655 	nmbc->chain = m;
1656 	while (m != 0) {
1657 		bytes += m->m_len;
1658 		m = m->m_next;
1659 	}
1660 	nmbc->max_bytes = bytes;
1661 	return (0);
1662 }
1663 
1664 static int
mbc_marshal_get_uio(mbuf_chain_t * mbc,struct uio * uio)1665 mbc_marshal_get_uio(mbuf_chain_t *mbc, struct uio *uio)
1666 {
1667 	int		i, offset;
1668 	int32_t		bytes = uio->uio_resid;
1669 	int32_t		remainder;
1670 	struct iovec	*iov;
1671 	mbuf_t		*m;
1672 
1673 	/*
1674 	 * The residual count is tested because in the case of write requests
1675 	 * with no data (smbtorture RAW-WRITE test will generate that type of
1676 	 * request) this function is called with a residual count of zero
1677 	 * bytes.
1678 	 */
1679 	if (bytes != 0) {
1680 		iov = uio->uio_iov;
1681 		uio->uio_segflg = UIO_SYSSPACE;
1682 		uio->uio_extflg = UIO_COPY_DEFAULT;
1683 
1684 		if (MBC_ROOM_FOR(mbc, bytes) == 0) {
1685 			/* Data will never be available */
1686 			return (DECODE_NO_MORE_DATA);
1687 		}
1688 
1689 		m = mbc->chain;
1690 		offset = mbc->chain_offset;
1691 		while (offset >= m->m_len) {
1692 			offset -= m->m_len;
1693 			m = m->m_next;
1694 			ASSERT((offset == 0) || (offset && m));
1695 		}
1696 
1697 		for (i = 0; (bytes > 0) && (i < uio->uio_iovcnt); i++) {
1698 			iov[i].iov_base = &m->m_data[offset];
1699 			remainder = m->m_len - offset;
1700 			if (remainder >= bytes) {
1701 				iov[i].iov_len = bytes;
1702 				mbc->chain_offset += bytes;
1703 				uio->uio_iovcnt = i + 1;
1704 				return (0);
1705 			}
1706 			iov[i].iov_len = remainder;
1707 			mbc->chain_offset += remainder;
1708 			bytes -= remainder;
1709 			m = m->m_next;
1710 			offset = 0;
1711 		}
1712 		return (DECODE_NO_MORE_DATA);
1713 	}
1714 	return (0);
1715 }
1716 
1717 static int
mbc_marshal_get_skip(mbuf_chain_t * mbc,uint_t skip)1718 mbc_marshal_get_skip(mbuf_chain_t *mbc, uint_t skip)
1719 {
1720 	if (MBC_ROOM_FOR(mbc, skip) == 0)
1721 		return (DECODE_NO_MORE_DATA);
1722 	mbc->chain_offset += skip;
1723 	return (0);
1724 }
1725