1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
24  */
25 
26 /*
27  * Structures and type definitions for the SMB module.
28  */
29 
30 #ifndef _SMBSRV_SMB_KTYPES_H
31 #define	_SMBSRV_SMB_KTYPES_H
32 
33 #ifdef	__cplusplus
34 extern "C" {
35 #endif
36 
37 #include <sys/note.h>
38 #include <sys/systm.h>
39 #include <sys/param.h>
40 #include <sys/types.h>
41 #include <sys/synch.h>
42 #include <sys/taskq.h>
43 #include <sys/socket.h>
44 #include <sys/acl.h>
45 #include <sys/sdt.h>
46 #include <sys/stat.h>
47 #include <sys/vnode.h>
48 #include <sys/cred.h>
49 #include <netinet/in.h>
50 #include <sys/ksocket.h>
51 #include <sys/fem.h>
52 #include <smbsrv/smb.h>
53 #include <smbsrv/smb2.h>
54 #include <smbsrv/smbinfo.h>
55 #include <smbsrv/mbuf.h>
56 #include <smbsrv/smb_sid.h>
57 #include <smbsrv/smb_xdr.h>
58 #include <smbsrv/netbios.h>
59 #include <smbsrv/smb_vops.h>
60 #include <smbsrv/smb_kstat.h>
61 
62 struct __door_handle;	/* <sys/door.h> */
63 struct edirent;		/* <sys/extdirent.h> */
64 
65 struct smb_disp_entry;
66 struct smb_request;
67 struct smb_server;
68 struct smb_event;
69 struct smb_export;
70 
71 /*
72  * Accumulated time and queue length statistics.
73  *
74  * Accumulated time statistics are kept as a running sum of "active" time.
75  * Queue length statistics are kept as a running sum of the product of queue
76  * length and elapsed time at that length -- i.e., a Riemann sum for queue
77  * length integrated against time.  (You can also think of the active time as a
78  * Riemann sum, for the boolean function (queue_length > 0) integrated against
79  * time, or you can think of it as the Lebesgue measure of the set on which
80  * queue_length > 0.)
81  *
82  *		^
83  *		|			_________
84  *		8			| i4	|
85  *		|			|	|
86  *	Queue	6			|	|
87  *	Length	|	_________	|	|
88  *		4	| i2	|_______|	|
89  *		|	|	    i3		|
90  *		2_______|			|
91  *		|    i1				|
92  *		|_______________________________|
93  *		Time->	t1	t2	t3	t4
94  *
95  * At each change of state (entry or exit from the queue), we add the elapsed
96  * time (since the previous state change) to the active time if the queue length
97  * was non-zero during that interval; and we add the product of the elapsed time
98  * times the queue length to the running length*time sum.
99  *
100  * This method is generalizable to measuring residency in any defined system:
101  * instead of queue lengths, think of "outstanding RPC calls to server X".
102  *
103  * A large number of I/O subsystems have at least two basic "lists" of
104  * transactions they manage: one for transactions that have been accepted for
105  * processing but for which processing has yet to begin, and one for
106  * transactions which are actively being processed (but not done). For this
107  * reason, two cumulative time statistics are defined here: wait (pre-service)
108  * time, and run (service) time.
109  *
110  * All times are 64-bit nanoseconds (hrtime_t), as returned by gethrtime().
111  *
112  * The units of cumulative busy time are accumulated nanoseconds. The units of
113  * cumulative length*time products are elapsed time times queue length.
114  *
115  * Updates to the fields below are performed implicitly by calls to
116  * these functions:
117  *
118  *	smb_srqueue_init()
119  *	smb_srqueue_destroy()
120  *	smb_srqueue_waitq_enter()
121  *	smb_srqueue_runq_exit()
122  *	smb_srqueue_waitq_to_runq()
123  *	smb_srqueue_update()
124  *
125  * These fields should never be updated by any other means.
126  */
127 typedef struct smb_srqueue {
128 	kmutex_t	srq_mutex;
129 	hrtime_t	srq_wlastupdate;
130 	hrtime_t	srq_wtime;
131 	hrtime_t	srq_wlentime;
132 	hrtime_t	srq_rlastupdate;
133 	hrtime_t	srq_rtime;
134 	hrtime_t	srq_rlentime;
135 	uint32_t	srq_wcnt;
136 	uint32_t	srq_rcnt;
137 } smb_srqueue_t;
138 
139 /*
140  * The fields with the prefix 'ly_a' contain the statistics collected since the
141  * server was last started ('a' for 'aggregated'). The fields with the prefix
142  * 'ly_d' contain the statistics collected since the last snapshot ('d' for
143  * 'delta').
144  */
145 typedef struct smb_latency {
146 	kmutex_t	ly_mutex;
147 	uint64_t	ly_a_nreq;
148 	hrtime_t	ly_a_sum;
149 	hrtime_t	ly_a_mean;
150 	hrtime_t	ly_a_stddev;
151 	uint64_t	ly_d_nreq;
152 	hrtime_t	ly_d_sum;
153 	hrtime_t	ly_d_mean;
154 	hrtime_t	ly_d_stddev;
155 } smb_latency_t;
156 
157 typedef struct smb_disp_stats {
158 	volatile uint64_t sdt_txb;
159 	volatile uint64_t sdt_rxb;
160 	smb_latency_t	sdt_lat;
161 } smb_disp_stats_t;
162 
163 int smb_noop(void *, size_t, int);
164 
165 #define	SMB_AUDIT_STACK_DEPTH	16
166 #define	SMB_AUDIT_BUF_MAX_REC	16
167 #define	SMB_AUDIT_NODE		0x00000001
168 
169 /*
170  * Maximum number of records returned in SMBsearch, SMBfind
171  * and SMBfindunique response. Value set to 10 for compatibility
172  * with Windows.
173  */
174 #define	SMB_MAX_SEARCH		10
175 
176 #define	SMB_SEARCH_ATTRIBUTES    \
177 	(FILE_ATTRIBUTE_HIDDEN | \
178 	FILE_ATTRIBUTE_SYSTEM |  \
179 	FILE_ATTRIBUTE_DIRECTORY)
180 
181 #define	SMB_SEARCH_HIDDEN(sattr) ((sattr) & FILE_ATTRIBUTE_HIDDEN)
182 #define	SMB_SEARCH_SYSTEM(sattr) ((sattr) & FILE_ATTRIBUTE_SYSTEM)
183 #define	SMB_SEARCH_DIRECTORY(sattr) ((sattr) & FILE_ATTRIBUTE_DIRECTORY)
184 #define	SMB_SEARCH_ALL(sattr) ((sattr) & SMB_SEARCH_ATTRIBUTES)
185 
186 typedef struct {
187 	uint32_t		anr_refcnt;
188 	int			anr_depth;
189 	pc_t			anr_stack[SMB_AUDIT_STACK_DEPTH];
190 } smb_audit_record_node_t;
191 
192 typedef struct {
193 	int			anb_index;
194 	int			anb_max_index;
195 	smb_audit_record_node_t	anb_records[SMB_AUDIT_BUF_MAX_REC];
196 } smb_audit_buf_node_t;
197 
198 /*
199  * Thread State Machine
200  * --------------------
201  *
202  *			    T5			   T0
203  * smb_thread_destroy()	<-------+		+------- smb_thread_init()
204  *                              |		|
205  *				|		v
206  *			+-----------------------------+
207  *			|   SMB_THREAD_STATE_EXITED   |<---+
208  *			+-----------------------------+	   |
209  *				      | T1		   |
210  *				      v			   |
211  *			+-----------------------------+	   |
212  *			|  SMB_THREAD_STATE_STARTING  |	   |
213  *			+-----------------------------+	   |
214  *				     | T2		   | T4
215  *				     v			   |
216  *			+-----------------------------+	   |
217  *			|  SMB_THREAD_STATE_RUNNING   |	   |
218  *			+-----------------------------+	   |
219  *				     | T3		   |
220  *				     v			   |
221  *			+-----------------------------+	   |
222  *			|  SMB_THREAD_STATE_EXITING   |----+
223  *			+-----------------------------+
224  *
225  * Transition T0
226  *
227  *    This transition is executed in smb_thread_init().
228  *
229  * Transition T1
230  *
231  *    This transition is executed in smb_thread_start().
232  *
233  * Transition T2
234  *
235  *    This transition is executed by the thread itself when it starts running.
236  *
237  * Transition T3
238  *
239  *    This transition is executed by the thread itself in
240  *    smb_thread_entry_point() just before calling thread_exit().
241  *
242  *
243  * Transition T4
244  *
245  *    This transition is executed in smb_thread_stop().
246  *
247  * Transition T5
248  *
249  *    This transition is executed in smb_thread_destroy().
250  */
251 typedef enum smb_thread_state {
252 	SMB_THREAD_STATE_STARTING = 0,
253 	SMB_THREAD_STATE_RUNNING,
254 	SMB_THREAD_STATE_EXITING,
255 	SMB_THREAD_STATE_EXITED,
256 	SMB_THREAD_STATE_FAILED
257 } smb_thread_state_t;
258 
259 struct _smb_thread;
260 
261 typedef void (*smb_thread_ep_t)(struct _smb_thread *, void *ep_arg);
262 
263 #define	SMB_THREAD_MAGIC	0x534D4254	/* SMBT */
264 
265 typedef struct _smb_thread {
266 	uint32_t		sth_magic;
267 	char			sth_name[32];
268 	smb_thread_state_t	sth_state;
269 	kthread_t		*sth_th;
270 	kt_did_t		sth_did;
271 	smb_thread_ep_t		sth_ep;
272 	void			*sth_ep_arg;
273 	pri_t			sth_pri;
274 	boolean_t		sth_kill;
275 	kmutex_t		sth_mtx;
276 	kcondvar_t		sth_cv;
277 } smb_thread_t;
278 
279 /*
280  * Pool of IDs
281  * -----------
282  *
283  *    A pool of IDs is a pool of 16 bit numbers. It is implemented as a bitmap.
284  *    A bit set to '1' indicates that that particular value has been allocated.
285  *    The allocation process is done shifting a bit through the whole bitmap.
286  *    The current position of that index bit is kept in the smb_idpool_t
287  *    structure and represented by a byte index (0 to buffer size minus 1) and
288  *    a bit index (0 to 7).
289  *
290  *    The pools start with a size of 8 bytes or 64 IDs. Each time the pool runs
291  *    out of IDs its current size is doubled until it reaches its maximum size
292  *    (8192 bytes or 65536 IDs). The IDs 0 and 65535 are never given out which
293  *    means that a pool can have a maximum number of 65534 IDs available.
294  */
295 #define	SMB_IDPOOL_MAGIC	0x4944504C	/* IDPL */
296 #define	SMB_IDPOOL_MIN_SIZE	64	/* Number of IDs to begin with */
297 #define	SMB_IDPOOL_MAX_SIZE	64 * 1024
298 
299 typedef struct smb_idpool {
300 	uint32_t	id_magic;
301 	kmutex_t	id_mutex;
302 	uint8_t		*id_pool;
303 	uint32_t	id_size;
304 	uint32_t	id_maxsize;
305 	uint8_t		id_bit;
306 	uint8_t		id_bit_idx;
307 	uint32_t	id_idx;
308 	uint32_t	id_idx_msk;
309 	uint32_t	id_free_counter;
310 	uint32_t	id_max_free_counter;
311 } smb_idpool_t;
312 
313 /*
314  * Maximum size of a Transport Data Unit when CAP_LARGE_READX and
315  * CAP_LARGE_WRITEX are not set.  CAP_LARGE_READX/CAP_LARGE_WRITEX
316  * allow the payload to exceed the negotiated buffer size.
317  *     4 --> NBT/TCP Transport Header.
318  *    32 --> SMB Header
319  *     1 --> Word Count byte
320  *   510 --> Maximum Number of bytes of the Word Table (2 * 255)
321  *     2 --> Byte count of the data
322  * 65535 --> Maximum size of the data
323  * -----
324  * 66084
325  */
326 #define	SMB_REQ_MAX_SIZE	66560		/* 65KB */
327 #define	SMB_XPRT_MAX_SIZE	(SMB_REQ_MAX_SIZE + NETBIOS_HDR_SZ)
328 
329 #define	SMB_TXREQ_MAGIC		0X54524251	/* 'TREQ' */
330 typedef struct {
331 	list_node_t	tr_lnd;
332 	uint32_t	tr_magic;
333 	int		tr_len;
334 	uint8_t		tr_buf[SMB_XPRT_MAX_SIZE];
335 } smb_txreq_t;
336 
337 #define	SMB_TXLST_MAGIC		0X544C5354	/* 'TLST' */
338 typedef struct {
339 	uint32_t	tl_magic;
340 	kmutex_t	tl_mutex;
341 	kcondvar_t	tl_wait_cv;
342 	boolean_t	tl_active;
343 } smb_txlst_t;
344 
345 /*
346  * Maximum buffer size for NT is 37KB.  If all clients are Windows 2000, this
347  * can be changed to 64KB.  37KB must be used with a mix of NT/Windows 2000
348  * clients because NT loses directory entries when values greater than 37KB are
349  * used.
350  *
351  * Note: NBT_MAXBUF will be subtracted from the specified max buffer size to
352  * account for the NBT header.
353  */
354 #define	NBT_MAXBUF		8
355 #define	SMB_NT_MAXBUF		(37 * 1024)
356 
357 #define	OUTBUFSIZE		(65 * 1024)
358 #define	SMBHEADERSIZE		32
359 #define	SMBND_HASH_MASK		(0xFF)
360 #define	MAX_IOVEC		512
361 #define	MAX_READREF		(8 * 1024)
362 
363 #define	SMB_WORKER_MIN		4
364 #define	SMB_WORKER_DEFAULT	64
365 #define	SMB_WORKER_MAX		1024
366 
367 /*
368  * Destructor object used in the locked-list delete queue.
369  */
370 #define	SMB_DTOR_MAGIC		0x44544F52	/* DTOR */
371 #define	SMB_DTOR_VALID(d)	\
372     ASSERT(((d) != NULL) && ((d)->dt_magic == SMB_DTOR_MAGIC))
373 
374 typedef void (*smb_dtorproc_t)(void *);
375 
376 typedef struct smb_dtor {
377 	list_node_t	dt_lnd;
378 	uint32_t	dt_magic;
379 	void		*dt_object;
380 	smb_dtorproc_t	dt_proc;
381 } smb_dtor_t;
382 
383 typedef struct smb_llist {
384 	krwlock_t	ll_lock;
385 	list_t		ll_list;
386 	uint32_t	ll_count;
387 	uint64_t	ll_wrop;
388 	kmutex_t	ll_mutex;
389 	list_t		ll_deleteq;
390 	uint32_t	ll_deleteq_count;
391 	boolean_t	ll_flushing;
392 } smb_llist_t;
393 
394 typedef struct smb_slist {
395 	kmutex_t	sl_mutex;
396 	kcondvar_t	sl_cv;
397 	list_t		sl_list;
398 	uint32_t	sl_count;
399 	boolean_t	sl_waiting;
400 } smb_slist_t;
401 
402 /*
403  * smb_avl_t State Machine
404  * --------------------
405  *
406  *                      +-----------------------------+
407  *                      |     SMB_AVL_STATE_START     |
408  *                      +-----------------------------+
409  *                                    | T0
410  *                                    v
411  *                      +-----------------------------+
412  *                      |     SMB_AVL_STATE_READY     |
413  *                      +-----------------------------+
414  *                                    | T1
415  *                                    v
416  *                      +-----------------------------+
417  *                      |  SMB_AVL_STATE_DESTROYING   |
418  *                      +-----------------------------+
419  *
420  * Transition T0
421  *
422  *    This transition is executed in smb_avl_create().
423  *
424  * Transition T1
425  *
426  *    This transition is executed in smb_avl_destroy().
427  *
428  */
429 typedef enum {
430 	SMB_AVL_STATE_START = 0,
431 	SMB_AVL_STATE_READY,
432 	SMB_AVL_STATE_DESTROYING
433 } smb_avl_state_t;
434 
435 typedef struct smb_avl_nops {
436 	int		(*avln_cmp) (const void *, const void *);
437 	void		(*avln_hold)(const void *);
438 	boolean_t	(*avln_rele)(const void *);
439 	void		(*avln_destroy)(void *);
440 } smb_avl_nops_t;
441 
442 typedef struct smb_avl_cursor {
443 	void		*avlc_next;
444 	uint32_t	avlc_sequence;
445 } smb_avl_cursor_t;
446 
447 typedef struct smb_avl {
448 	krwlock_t	avl_lock;
449 	avl_tree_t	avl_tree;
450 	kmutex_t	avl_mutex;
451 	kcondvar_t	avl_cv;
452 	smb_avl_state_t	avl_state;
453 	uint32_t	avl_refcnt;
454 	uint32_t	avl_sequence;
455 	const smb_avl_nops_t	*avl_nops;
456 } smb_avl_t;
457 
458 typedef struct {
459 	kcondvar_t	rwx_cv;
460 	kmutex_t	rwx_mutex;
461 	krwlock_t	rwx_lock;
462 	boolean_t	rwx_waiting;
463 } smb_rwx_t;
464 
465 typedef struct smb_export {
466 	kmutex_t	e_mutex;
467 	boolean_t	e_ready;
468 	smb_llist_t	e_vfs_list;
469 	smb_avl_t	e_share_avl;
470 	smb_slist_t	e_unexport_list;
471 	smb_thread_t	e_unexport_thread;
472 } smb_export_t;
473 
474 /*
475  * NOTIFY CHANGE, a.k.a. File Change Notification (FCN)
476  */
477 
478 /*
479  * These FCN filter mask values are not from MS-FSCC, but
480  * must not overlap with any FILE_NOTIFY_VALID_MASK values.
481  */
482 #define	FILE_NOTIFY_CHANGE_EV_SUBDIR	0x00010000
483 #define	FILE_NOTIFY_CHANGE_EV_DELETE	0x00020000
484 #define	FILE_NOTIFY_CHANGE_EV_CLOSED	0x00040000
485 #define	FILE_NOTIFY_CHANGE_EV_OVERFLOW	0x00080000
486 
487 /*
488  * Note: These FCN action values are not from MS-FSCC, but must
489  * follow in sequence from FILE_ACTION_MODIFIED_STREAM.
490  *
491  * FILE_ACTION_SUBDIR_CHANGED is used internally for
492  * "watch tree" support, posted to all parents of a
493  * directory that had one of the changes above.
494  *
495  * FILE_ACTION_DELETE_PENDING is used internally to tell
496  * notify change requests when the "delete-on-close" flag
497  * has been set on the directory being watched.
498  *
499  * FILE_ACTION_HANDLE_CLOSED is used to wakeup notify change
500  * requests when the watched directory handle is closed.
501  */
502 #define	FILE_ACTION_SUBDIR_CHANGED	0x00000009
503 #define	FILE_ACTION_DELETE_PENDING	0x0000000a
504 #define	FILE_ACTION_HANDLE_CLOSED	0x0000000b
505 
506 /*
507  * Sub-struct within smb_ofile_t
508  */
509 typedef struct smb_notify {
510 	list_t			nc_waiters; /* Waiting SRs */
511 	mbuf_chain_t		nc_buffer;
512 	uint32_t		nc_filter;
513 	uint32_t		nc_events;
514 	int			nc_last_off;
515 	boolean_t		nc_subscribed;
516 } smb_notify_t;
517 
518 /*
519  * SMB operates over a NetBIOS-over-TCP transport (NBT) or directly
520  * over TCP, which is also known as direct hosted NetBIOS-less SMB
521  * or SMB-over-TCP.
522  *
523  * NBT messages have a 4-byte header that defines the message type
524  * (8-bits), a 7-bit flags field and a 17-bit length.
525  *
526  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
527  * |      TYPE     |     FLAGS   |E|            LENGTH             |
528  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
529  *
530  * 8-bit type      Defined in RFC 1002
531  * 7-bit flags     Bits 0-6 reserved (must be 0)
532  *                 Bit 7: Length extension bit (E)
533  * 17-bit length   Includes bit 7 of the flags byte
534  *
535  *
536  * SMB-over-TCP is defined to use a modified version of the NBT header
537  * containing an 8-bit message type and 24-bit message length.
538  *
539  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
540  * |      TYPE     |                  LENGTH                       |
541  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
542  *
543  * 8-bit type      Must be 0
544  * 24-bit length
545  *
546  * The following structure is used to represent a generic, in-memory
547  * SMB transport header; it is not intended to map directly to either
548  * of the over-the-wire formats.
549  */
550 typedef struct {
551 	uint8_t		xh_type;
552 	uint32_t	xh_length;
553 } smb_xprt_t;
554 
555 int MBC_LENGTH(struct mbuf_chain *);
556 int MBC_MAXBYTES(struct mbuf_chain *);
557 void MBC_SETUP(struct mbuf_chain *, uint32_t);
558 void MBC_INIT(struct mbuf_chain *, uint32_t);
559 void MBC_FLUSH(struct mbuf_chain *);
560 void MBC_ATTACH_MBUF(struct mbuf_chain *, struct mbuf *);
561 void MBC_APPEND_MBUF(struct mbuf_chain *, struct mbuf *);
562 void MBC_ATTACH_BUF(struct mbuf_chain *MBC, unsigned char *BUF, int LEN);
563 int MBC_SHADOW_CHAIN(struct mbuf_chain *SUBMBC, struct mbuf_chain *MBC,
564     int OFF, int LEN);
565 
566 #define	MBC_ROOM_FOR(b, n) (((b)->chain_offset + (n)) <= (b)->max_bytes)
567 
568 #define	OPLOCK_MIN_TIMEOUT	(5 * 1000)
569 #define	OPLOCK_STD_TIMEOUT	(30 * 1000)
570 
571 /*
572  * Oplock break flags:
573  * SMB_OPLOCK_BREAK_EXCLUSIVE - only break exclusive oplock
574  * (type SMB_OPLOCK_EXCLUSIVE or SMB_OPLOCK_BATCH)
575  * SMB_OPLOCK_BREAK_BATCH - only break exclusive BATCH oplock
576  * SMB_OPLOCK_BREAK_NOWAIT - do not wait for oplock break ack
577  */
578 #define	SMB_OPLOCK_NO_BREAK		0x00
579 #define	SMB_OPLOCK_BREAK_TO_NONE	0x01
580 #define	SMB_OPLOCK_BREAK_TO_LEVEL_II	0x02
581 #define	SMB_OPLOCK_BREAK_EXCLUSIVE	0x04
582 #define	SMB_OPLOCK_BREAK_BATCH		0x08
583 #define	SMB_OPLOCK_BREAK_NOWAIT		0x10
584 
585 /*
586  * Oplocks levels are defined to match the levels in the SMB
587  * protocol (nt_create_andx / nt_transact_create) and should
588  * not be changed
589  */
590 #define	SMB_OPLOCK_NONE		0
591 #define	SMB_OPLOCK_EXCLUSIVE	1
592 #define	SMB_OPLOCK_BATCH	2
593 #define	SMB_OPLOCK_LEVEL_II	3
594 
595 typedef struct smb_oplock {
596 	kmutex_t		ol_mutex;
597 	kcondvar_t		ol_cv;
598 	kthread_t		*ol_xthread;
599 	boolean_t		ol_fem;		/* fem monitor installed? */
600 	uint8_t			ol_brk_pending;
601 	uint8_t			ol_break;
602 	uint32_t		ol_count;	/* number of grants */
603 	list_t			ol_grants;	/* list of smb_oplock_grant_t */
604 } smb_oplock_t;
605 
606 #define	SMB_OPLOCK_GRANT_MAGIC	0x4F4C4B47	/* OLKG */
607 #define	SMB_OPLOCK_GRANT_VALID(p) \
608 	ASSERT((p)->og_magic == SMB_OPLOCK_GRANT_MAGIC)
609 #define	SMB_OFILE_OPLOCK_GRANTED(p) \
610 	((p)->f_oplock_grant.og_magic == SMB_OPLOCK_GRANT_MAGIC)
611 typedef struct smb_oplock_grant {
612 	list_node_t		og_lnd;
613 	uint32_t		og_magic;
614 	uint8_t			og_breaking;
615 	uint8_t			og_level;
616 	struct smb_ofile	*og_ofile;
617 } smb_oplock_grant_t;
618 
619 #define	SMB_OPLOCK_BREAK_MAGIC	0x4F4C4B42	/* OLKB */
620 #define	SMB_OPLOCK_BREAK_VALID(p) \
621 	ASSERT((p)->ob_magic == SMB_OPLOCK_BREAK_MAGIC)
622 typedef struct smb_oplock_break {
623 	list_node_t	ob_lnd;
624 	uint32_t	ob_magic;
625 	struct smb_node	*ob_node;
626 } smb_oplock_break_t;
627 
628 
629 #define	SMB_VFS_MAGIC	0x534D4256	/* 'SMBV' */
630 
631 typedef struct smb_vfs {
632 	list_node_t		sv_lnd;
633 	uint32_t		sv_magic;
634 	uint32_t		sv_refcnt;
635 	vfs_t			*sv_vfsp;
636 	vnode_t			*sv_rootvp;
637 } smb_vfs_t;
638 
639 #define	SMB_NODE_MAGIC		0x4E4F4445	/* 'NODE' */
640 #define	SMB_NODE_VALID(p)	ASSERT((p)->n_magic == SMB_NODE_MAGIC)
641 
642 typedef enum {
643 	SMB_NODE_STATE_AVAILABLE = 0,
644 	SMB_NODE_STATE_DESTROYING
645 } smb_node_state_t;
646 
647 /*
648  * waiting_event        # of clients requesting FCN
649  * n_timestamps         cached timestamps
650  * n_allocsz            cached file allocation size
651  * n_dnode              directory node
652  * n_unode              unnamed stream node
653  * delete_on_close_cred credentials for delayed delete
654  */
655 typedef struct smb_node {
656 	list_node_t		n_lnd;
657 	uint32_t		n_magic;
658 	krwlock_t		n_lock;
659 	kmutex_t		n_mutex;
660 	smb_node_state_t	n_state;
661 	uint32_t		n_refcnt;
662 	uint32_t		n_hashkey;
663 	smb_llist_t		*n_hash_bucket;
664 	uint32_t		n_open_count;
665 	uint32_t		n_opening_count;
666 	smb_llist_t		n_ofile_list;
667 	/* If entering both, go in order n_lock_list, n_wlock_list */
668 	smb_llist_t		n_lock_list;	/* active locks */
669 	smb_llist_t		n_wlock_list;	/* waiting locks */
670 	uint32_t		n_pending_dosattr;
671 	volatile int		flags;
672 	u_offset_t		n_allocsz;
673 	uint32_t		n_fcn_count;
674 	smb_oplock_t		n_oplock;
675 	struct smb_node		*n_dnode;
676 	struct smb_node		*n_unode;
677 	cred_t			*delete_on_close_cred;
678 	uint32_t		n_delete_on_close_flags;
679 	char			od_name[MAXNAMELEN];
680 	vnode_t			*vp;
681 	smb_audit_buf_node_t	*n_audit_buf;
682 } smb_node_t;
683 
684 #define	NODE_FLAGS_REPARSE		0x00001000
685 #define	NODE_FLAGS_DFSLINK		0x00002000
686 #define	NODE_FLAGS_VFSROOT		0x00004000
687 #define	NODE_FLAGS_SYSTEM		0x00008000
688 #define	NODE_FLAGS_WRITE_THROUGH	0x00100000
689 #define	NODE_XATTR_DIR			0x01000000
690 #define	NODE_FLAGS_DELETE_COMMITTED	0x20000000
691 #define	NODE_FLAGS_DELETE_ON_CLOSE	0x40000000
692 #define	NODE_FLAGS_EXECUTABLE		0x80000000
693 
694 #define	SMB_NODE_VFS(node)	((node)->vp->v_vfsp)
695 #define	SMB_NODE_FSID(node)	((node)->vp->v_vfsp->vfs_fsid)
696 
697 /* Maximum buffer size for encryption key */
698 #define	SMB_ENCRYPT_KEY_MAXLEN		32
699 
700 #define	SMB_SHARE_MAGIC		0x4B534852	/* KSHR */
701 
702 typedef struct smb_kshare {
703 	uint32_t	shr_magic;
704 	char		*shr_name;
705 	char		*shr_path;
706 	char		*shr_cmnt;
707 	char		*shr_container;
708 	char		*shr_oemname;
709 	uint32_t	shr_flags;
710 	uint32_t	shr_type;
711 	uint32_t	shr_refcnt;
712 	uint32_t	shr_autocnt;
713 	uid_t		shr_uid;
714 	gid_t		shr_gid;
715 	char		*shr_access_none;
716 	char		*shr_access_ro;
717 	char		*shr_access_rw;
718 	avl_node_t	shr_link;
719 	kmutex_t	shr_mutex;
720 } smb_kshare_t;
721 
722 
723 typedef struct smb_arg_negotiate {
724 	char		*ni_name;
725 	int		ni_dialect;
726 	int		ni_index;
727 	uint32_t	ni_capabilities;
728 	uint16_t	ni_maxmpxcount;
729 	int16_t		ni_tzcorrection;
730 	uint8_t		ni_keylen;
731 	uint8_t		ni_key[SMB_ENCRYPT_KEY_MAXLEN];
732 	timestruc_t	ni_servertime;
733 } smb_arg_negotiate_t;
734 
735 typedef enum {
736 	SMB_SSNSETUP_PRE_NTLM012 = 1,
737 	SMB_SSNSETUP_NTLM012_NOEXT,
738 	SMB_SSNSETUP_NTLM012_EXTSEC
739 } smb_ssnsetup_type_t;
740 
741 typedef struct smb_arg_sessionsetup {
742 	smb_ssnsetup_type_t ssi_type;
743 	char		*ssi_user;
744 	char		*ssi_domain;
745 	/* LM password hash, f.k.a. case-insensitive p/w */
746 	uint16_t	ssi_lmpwlen;
747 	uint8_t		*ssi_lmpwd;
748 	/* NT password hash, f.k.a. case-sensitive p/w */
749 	uint16_t	ssi_ntpwlen;
750 	uint8_t		*ssi_ntpwd;
751 	/* Incoming security blob */
752 	uint16_t	ssi_iseclen;
753 	uint8_t		*ssi_isecblob;
754 	/* Incoming security blob */
755 	uint16_t	ssi_oseclen;
756 	uint8_t		*ssi_osecblob;
757 	/* parameters */
758 	uint16_t	ssi_maxbufsize;
759 	uint16_t	ssi_maxmpxcount;
760 	uint32_t	ssi_capabilities;
761 	int		ssi_native_os;
762 	int		ssi_native_lm;
763 } smb_arg_sessionsetup_t;
764 
765 typedef struct tcon {
766 	char		*name;
767 	char		*path;
768 	char		*service;
769 	int		pwdlen;
770 	char		*password;
771 	uint16_t	flags;
772 	uint16_t	optional_support;
773 	smb_kshare_t	*si;
774 } smb_arg_tcon_t;
775 
776 /*
777  * Based on section 2.6.1.2 (Connection Management) of the June 13,
778  * 1996 CIFS spec, a server may terminate the transport connection
779  * due to inactivity. The client software is expected to be able to
780  * automatically reconnect to the server if this happens. Like much
781  * of the useful background information, this section appears to
782  * have been dropped from later revisions of the document.
783  *
784  * Each session has an activity timestamp that's updated whenever a
785  * request is dispatched. If the session is idle, i.e. receives no
786  * requests, for SMB_SESSION_INACTIVITY_TIMEOUT minutes it will be
787  * closed.
788  *
789  * Each session has an I/O semaphore to serialize communication with
790  * the client. For example, after receiving a raw-read request, the
791  * server is not allowed to send an oplock break to the client until
792  * after it has sent the raw-read data.
793  */
794 #define	SMB_SESSION_INACTIVITY_TIMEOUT		(15 * 60)
795 
796 /* SMB1 signing */
797 struct smb_sign {
798 	unsigned int flags;
799 	uint32_t seqnum;
800 	uint_t mackey_len;
801 	uint8_t *mackey;
802 };
803 
804 /*
805  * SMB2 signing
806  */
807 struct smb_key {
808 	uint_t len;
809 	uint8_t key[SMB2_SESSION_KEY_LEN];
810 };
811 
812 #define	SMB_SIGNING_ENABLED	1
813 #define	SMB_SIGNING_CHECK	2
814 
815 /*
816  * Session State Machine
817  * ---------------------
818  *
819  * +-----------------------------+	     +------------------------------+
820  * | SMB_SESSION_STATE_CONNECTED |           | SMB_SESSION_STATE_TERMINATED |
821  * +-----------------------------+           +------------------------------+
822  *		T0|					     ^
823  *		  +--------------------+		     |T5
824  *		  v		       |T4                   |
825  * +-------------------------------+   |    +--------------------------------+
826  * | SMB_SESSION_STATE_ESTABLISHED |---+--->| SMB_SESSION_STATE_DISCONNECTED |
827  * +-------------------------------+        +--------------------------------+
828  *		T1|				^
829  *		  +----------+			|T3
830  *                           v			|
831  *                  +------------------------------+
832  *                  | SMB_SESSION_STATE_NEGOTIATED |
833  *                  +------------------------------+
834  *
835  *
836  * Transition T0
837  *
838  *
839  *
840  * Transition T1
841  *
842  *
843  *
844  * Transition T2
845  *
846  *
847  *
848  * Transition T3
849  *
850  *
851  *
852  * Transition T4
853  *
854  *
855  *
856  * Transition T5
857  *
858  *
859  *
860  */
861 #define	SMB_SESSION_MAGIC	0x53455353	/* 'SESS' */
862 #define	SMB_SESSION_VALID(p)	\
863     ASSERT(((p) != NULL) && ((p)->s_magic == SMB_SESSION_MAGIC))
864 
865 #define	SMB_CHALLENGE_SZ	8
866 
867 typedef enum {
868 	SMB_SESSION_STATE_INITIALIZED = 0,
869 	SMB_SESSION_STATE_DISCONNECTED,
870 	SMB_SESSION_STATE_CONNECTED,
871 	SMB_SESSION_STATE_ESTABLISHED,
872 	SMB_SESSION_STATE_NEGOTIATED,
873 	SMB_SESSION_STATE_TERMINATED,
874 	SMB_SESSION_STATE_SENTINEL
875 } smb_session_state_t;
876 
877 /* Bits in s_flags below */
878 #define	SMB_SSN_AAPL_CCEXT	1	/* Saw "AAPL" create ctx. ext. */
879 #define	SMB_SSN_AAPL_READDIR	2	/* Wants MacOS ext. readdir */
880 
881 typedef struct smb_session {
882 	list_node_t		s_lnd;
883 	uint32_t		s_magic;
884 	smb_rwx_t		s_lock;
885 	uint64_t		s_kid;
886 	smb_session_state_t	s_state;
887 	uint32_t		s_flags;
888 	taskqid_t		s_receiver_tqid;
889 	kthread_t		*s_thread;
890 	kt_did_t		s_ktdid;
891 	int	(*newrq_func)(struct smb_request *);
892 	struct smb_server	*s_server;
893 	smb_kmod_cfg_t		s_cfg;
894 	int32_t			s_gmtoff;
895 	uint32_t		keep_alive;
896 	uint64_t		opentime;
897 	uint16_t		s_local_port;
898 	uint16_t		s_remote_port;
899 	smb_inaddr_t		ipaddr;
900 	smb_inaddr_t		local_ipaddr;
901 	int			dialect;
902 	int			native_os;
903 	int			native_lm;
904 
905 	kmutex_t		s_credits_mutex;
906 	uint16_t		s_cur_credits;
907 	uint16_t		s_max_credits;
908 
909 	uint32_t		capabilities;
910 
911 	struct smb_sign		signing;	/* SMB1 */
912 	void			*sign_mech;	/* mechanism info */
913 
914 	/* SMB2/SMB3 signing support */
915 	int			(*sign_calc)(struct smb_request *,
916 					struct mbuf_chain *, uint8_t *);
917 	void			(*sign_fini)(struct smb_session *);
918 
919 	ksocket_t		sock;
920 
921 	smb_slist_t		s_req_list;
922 	smb_llist_t		s_xa_list;
923 	smb_llist_t		s_user_list;
924 	smb_llist_t		s_tree_list;
925 	smb_idpool_t		s_uid_pool;
926 	smb_idpool_t		s_tid_pool;
927 	smb_txlst_t		s_txlst;
928 
929 	volatile uint32_t	s_tree_cnt;
930 	volatile uint32_t	s_file_cnt;
931 	volatile uint32_t	s_dir_cnt;
932 
933 	uint16_t		secmode;
934 	uint32_t		sesskey;
935 	uint32_t		challenge_len;
936 	unsigned char		challenge_key[SMB_CHALLENGE_SZ];
937 	int64_t			activity_timestamp;
938 	/*
939 	 * Maximum negotiated buffer sizes between SMB client and server
940 	 * in SMB_SESSION_SETUP_ANDX
941 	 */
942 	int			cmd_max_bytes;
943 	int			reply_max_bytes;
944 	uint16_t		smb_msg_size;
945 	uint16_t		smb_max_mpx;
946 	smb_srqueue_t		*s_srqueue;
947 	uint64_t		start_time;
948 	unsigned char		MAC_key[44];
949 	char			ip_addr_str[INET6_ADDRSTRLEN];
950 	char			clnt_uuid[16];
951 	char 			workstation[SMB_PI_MAX_HOST];
952 } smb_session_t;
953 
954 #define	SMB_USER_MAGIC 0x55534552	/* 'USER' */
955 #define	SMB_USER_VALID(u)	\
956     ASSERT(((u) != NULL) && ((u)->u_magic == SMB_USER_MAGIC))
957 
958 #define	SMB_USER_FLAG_GUEST			SMB_ATF_GUEST
959 #define	SMB_USER_FLAG_ANON			SMB_ATF_ANON
960 #define	SMB_USER_FLAG_ADMIN			SMB_ATF_ADMIN
961 #define	SMB_USER_FLAG_POWER_USER		SMB_ATF_POWERUSER
962 #define	SMB_USER_FLAG_BACKUP_OPERATOR		SMB_ATF_BACKUPOP
963 
964 #define	SMB_USER_IS_ADMIN(U)	(((U)->u_flags & SMB_USER_FLAG_ADMIN) != 0)
965 #define	SMB_USER_IS_GUEST(U)	(((U)->u_flags & SMB_USER_FLAG_GUEST) != 0)
966 
967 #define	SMB_USER_PRIV_TAKE_OWNERSHIP	0x00000001
968 #define	SMB_USER_PRIV_BACKUP		0x00000002
969 #define	SMB_USER_PRIV_RESTORE		0x00000004
970 #define	SMB_USER_PRIV_SECURITY		0x00000008
971 
972 
973 typedef enum {
974 	SMB_USER_STATE_LOGGING_ON = 0,
975 	SMB_USER_STATE_LOGGED_ON,
976 	SMB_USER_STATE_LOGGING_OFF,
977 	SMB_USER_STATE_LOGGED_OFF,
978 	SMB_USER_STATE_SENTINEL
979 } smb_user_state_t;
980 
981 typedef struct smb_user {
982 	list_node_t		u_lnd;
983 	uint32_t		u_magic;
984 	kmutex_t		u_mutex;
985 	smb_user_state_t	u_state;
986 
987 	struct smb_server	*u_server;
988 	smb_session_t		*u_session;
989 	ksocket_t		u_authsock;
990 	timeout_id_t		u_auth_tmo;
991 	uint16_t		u_name_len;
992 	char			*u_name;
993 	uint16_t		u_domain_len;
994 	char			*u_domain;
995 	time_t			u_logon_time;
996 	cred_t			*u_cred;
997 	cred_t			*u_privcred;
998 
999 	uint32_t		u_refcnt;
1000 	uint32_t		u_flags;
1001 	uint32_t		u_privileges;
1002 	uint16_t		u_uid;
1003 	uint32_t		u_audit_sid;
1004 
1005 	uint32_t		u_sign_flags;
1006 	struct smb_key		u_sign_key;	/* SMB2 signing */
1007 } smb_user_t;
1008 
1009 #define	SMB_TREE_MAGIC			0x54524545	/* 'TREE' */
1010 #define	SMB_TREE_VALID(p)	\
1011     ASSERT((p != NULL) && ((p)->t_magic == SMB_TREE_MAGIC))
1012 
1013 #define	SMB_TYPENAMELEN			_ST_FSTYPSZ
1014 #define	SMB_VOLNAMELEN			32
1015 
1016 #define	SMB_TREE_READONLY		0x00000001
1017 #define	SMB_TREE_SUPPORTS_ACLS		0x00000002
1018 #define	SMB_TREE_STREAMS		0x00000004
1019 #define	SMB_TREE_CASEINSENSITIVE	0x00000008
1020 #define	SMB_TREE_NO_CASESENSITIVE	0x00000010
1021 #define	SMB_TREE_NO_EXPORT		0x00000020
1022 #define	SMB_TREE_OPLOCKS		0x00000040
1023 #define	SMB_TREE_SHORTNAMES		0x00000080
1024 #define	SMB_TREE_XVATTR			0x00000100
1025 #define	SMB_TREE_DIRENTFLAGS		0x00000200
1026 #define	SMB_TREE_ACLONCREATE		0x00000400
1027 #define	SMB_TREE_ACEMASKONACCESS	0x00000800
1028 #define	SMB_TREE_NFS_MOUNTED		0x00001000
1029 #define	SMB_TREE_UNICODE_ON_DISK	0x00002000
1030 #define	SMB_TREE_CATIA			0x00004000
1031 #define	SMB_TREE_ABE			0x00008000
1032 #define	SMB_TREE_QUOTA			0x00010000
1033 #define	SMB_TREE_DFSROOT		0x00020000
1034 #define	SMB_TREE_SPARSE			0x00040000
1035 #define	SMB_TREE_TRAVERSE_MOUNTS	0x00080000
1036 
1037 typedef enum {
1038 	SMB_TREE_STATE_CONNECTED = 0,
1039 	SMB_TREE_STATE_DISCONNECTING,
1040 	SMB_TREE_STATE_DISCONNECTED,
1041 	SMB_TREE_STATE_SENTINEL
1042 } smb_tree_state_t;
1043 
1044 typedef struct smb_tree {
1045 	list_node_t		t_lnd;
1046 	uint32_t		t_magic;
1047 	kmutex_t		t_mutex;
1048 	smb_tree_state_t	t_state;
1049 
1050 	struct smb_server	*t_server;
1051 	smb_session_t		*t_session;
1052 	/*
1053 	 * user whose uid was in the tree connect message
1054 	 * ("owner" in MS-CIFS parlance, see section 2.2.1.6 definition of FID)
1055 	 */
1056 	smb_user_t		*t_owner;
1057 	smb_node_t		*t_snode;
1058 
1059 	smb_llist_t		t_ofile_list;
1060 	smb_idpool_t		t_fid_pool;
1061 
1062 	smb_llist_t		t_odir_list;
1063 	smb_idpool_t		t_odid_pool;
1064 
1065 	uint32_t		t_refcnt;
1066 	uint32_t		t_flags;
1067 	int32_t			t_res_type;
1068 	uint16_t		t_tid;
1069 	uint16_t		t_umask;
1070 	char			t_sharename[MAXNAMELEN];
1071 	char			t_resource[MAXPATHLEN];
1072 	char			t_typename[SMB_TYPENAMELEN];
1073 	char			t_volume[SMB_VOLNAMELEN];
1074 	acl_type_t		t_acltype;
1075 	uint32_t		t_access;
1076 	uint32_t		t_execflags;
1077 	time_t			t_connect_time;
1078 	volatile uint32_t	t_open_files;
1079 } smb_tree_t;
1080 
1081 #define	SMB_TREE_VFS(tree)	((tree)->t_snode->vp->v_vfsp)
1082 #define	SMB_TREE_FSID(tree)	((tree)->t_snode->vp->v_vfsp->vfs_fsid)
1083 
1084 #define	SMB_TREE_IS_READONLY(sr)					\
1085 	((sr) != NULL && (sr)->tid_tree != NULL &&			\
1086 	!((sr)->tid_tree->t_access & ACE_ALL_WRITE_PERMS))
1087 
1088 #define	SMB_TREE_IS_CASEINSENSITIVE(sr)                                 \
1089 	(((sr) && (sr)->tid_tree) ?                                     \
1090 	smb_tree_has_feature((sr)->tid_tree, SMB_TREE_CASEINSENSITIVE) : 0)
1091 
1092 #define	SMB_TREE_HAS_ACCESS(sr, acemask)				\
1093 	((sr) == NULL ? ACE_ALL_PERMS : (				\
1094 	(((sr) && (sr)->tid_tree) ?					\
1095 	(((sr)->tid_tree->t_access) & (acemask)) : 0)))
1096 
1097 #define	SMB_TREE_SUPPORTS_CATIA(sr)            				\
1098 	(((sr) && (sr)->tid_tree) ?                                     \
1099 	smb_tree_has_feature((sr)->tid_tree, SMB_TREE_CATIA) : 0)
1100 
1101 #define	SMB_TREE_SUPPORTS_ABE(sr)            				\
1102 	(((sr) && (sr)->tid_tree) ?                                     \
1103 	smb_tree_has_feature((sr)->tid_tree, SMB_TREE_ABE) : 0)
1104 
1105 #define	SMB_TREE_IS_DFSROOT(sr)            				\
1106 	(((sr) && (sr)->tid_tree) ?                                     \
1107 	smb_tree_has_feature((sr)->tid_tree, SMB_TREE_DFSROOT) : 0)
1108 
1109 #define	SMB_TREE_SUPPORTS_SHORTNAMES(sr)				\
1110 	(((sr) && (sr)->tid_tree) ?					\
1111 	smb_tree_has_feature((sr)->tid_tree, SMB_TREE_SHORTNAMES) : 0)
1112 
1113 /*
1114  * SMB_TREE_CONTAINS_NODE is used to check if a node is on the same
1115  * file system as the tree's root filesystem, or if mount point traversal
1116  * should be allowed.  Note that this is also called in some cases with
1117  * sr=NULL, where it is expected to evaluate to TRUE.
1118  */
1119 
1120 #define	SMB_TREE_CONTAINS_NODE(sr, node)                                \
1121 	((sr) == NULL || (sr)->tid_tree == NULL ||                      \
1122 	SMB_TREE_VFS((sr)->tid_tree) == SMB_NODE_VFS(node) ||           \
1123 	smb_tree_has_feature((sr)->tid_tree, SMB_TREE_TRAVERSE_MOUNTS))
1124 
1125 /*
1126  * SMB_OFILE_IS_READONLY reflects whether an ofile is readonly or not.
1127  * The macro takes into account read-only settings in any of:
1128  * the tree, the node (pending) and the file-system object.
1129  * all of this is evaluated in smb_ofile_open() and after that
1130  * we can just test the f_flags & SMB_OFLAGS_READONLY
1131  */
1132 #define	SMB_OFILE_IS_READONLY(of)	\
1133 	((of)->f_flags & SMB_OFLAGS_READONLY)
1134 
1135 /*
1136  * SMB_PATHFILE_IS_READONLY indicates whether or not a file is
1137  * readonly when the caller has a path rather than an ofile.
1138  */
1139 #define	SMB_PATHFILE_IS_READONLY(sr, node)			\
1140 	(SMB_TREE_IS_READONLY((sr)) ||				\
1141 	smb_node_file_is_readonly((node)))
1142 
1143 #define	SMB_ODIR_MAGIC 		0x4F444952	/* 'ODIR' */
1144 #define	SMB_ODIR_VALID(p)	\
1145     ASSERT((p != NULL) && ((p)->d_magic == SMB_ODIR_MAGIC))
1146 
1147 #define	SMB_ODIR_BUFSIZE	(8 * 1024)
1148 
1149 #define	SMB_ODIR_FLAG_WILDCARDS		0x0001
1150 #define	SMB_ODIR_FLAG_IGNORE_CASE	0x0002
1151 #define	SMB_ODIR_FLAG_XATTR		0x0004
1152 #define	SMB_ODIR_FLAG_EDIRENT		0x0008
1153 #define	SMB_ODIR_FLAG_CATIA		0x0010
1154 #define	SMB_ODIR_FLAG_ABE		0x0020
1155 #define	SMB_ODIR_FLAG_SHORTNAMES	0x0040
1156 
1157 typedef enum {
1158 	SMB_ODIR_STATE_OPEN = 0,
1159 	SMB_ODIR_STATE_IN_USE,
1160 	SMB_ODIR_STATE_CLOSING,
1161 	SMB_ODIR_STATE_CLOSED,
1162 	SMB_ODIR_STATE_SENTINEL
1163 } smb_odir_state_t;
1164 
1165 typedef enum {
1166 	SMB_ODIR_RESUME_CONT,
1167 	SMB_ODIR_RESUME_IDX,
1168 	SMB_ODIR_RESUME_COOKIE,
1169 	SMB_ODIR_RESUME_FNAME
1170 } smb_odir_resume_type_t;
1171 
1172 typedef struct smb_odir_resume {
1173 	smb_odir_resume_type_t	or_type;
1174 	int			or_idx;
1175 	uint32_t		or_cookie;
1176 	char			*or_fname;
1177 } smb_odir_resume_t;
1178 
1179 /*
1180  * Flags used when opening an odir
1181  */
1182 #define	SMB_ODIR_OPENF_BACKUP_INTENT	0x01
1183 
1184 typedef struct smb_odir {
1185 	list_node_t		d_lnd;
1186 	uint32_t		d_magic;
1187 	kmutex_t		d_mutex;
1188 	smb_odir_state_t	d_state;
1189 	smb_session_t		*d_session;
1190 	smb_user_t		*d_user;
1191 	smb_tree_t		*d_tree;
1192 	smb_node_t		*d_dnode;
1193 	cred_t			*d_cred;
1194 	uint32_t		d_opened_by_pid;
1195 	uint16_t		d_odid;
1196 	uint16_t		d_sattr;
1197 	uint32_t		d_refcnt;
1198 	uint32_t		d_flags;
1199 	boolean_t		d_eof;
1200 	int			d_bufsize;
1201 	uint64_t		d_offset;
1202 	union {
1203 		char		*u_bufptr;
1204 		struct edirent	*u_edp;
1205 		struct dirent64	*u_dp;
1206 	} d_u;
1207 	uint32_t		d_last_cookie;
1208 	uint32_t		d_cookies[SMB_MAX_SEARCH];
1209 	char			d_pattern[MAXNAMELEN];
1210 	char			d_buf[SMB_ODIR_BUFSIZE];
1211 	char			d_last_name[MAXNAMELEN];
1212 } smb_odir_t;
1213 #define	d_bufptr	d_u.u_bufptr
1214 #define	d_edp		d_u.u_edp
1215 #define	d_dp		d_u.u_dp
1216 
1217 typedef struct smb_odirent {
1218 	char		od_name[MAXNAMELEN];	/* on disk name */
1219 	ino64_t		od_ino;
1220 	uint32_t	od_eflags;
1221 } smb_odirent_t;
1222 
1223 #define	SMB_OPIPE_MAGIC		0x50495045	/* 'PIPE' */
1224 #define	SMB_OPIPE_VALID(p)	\
1225     ASSERT(((p) != NULL) && (p)->p_magic == SMB_OPIPE_MAGIC)
1226 #define	SMB_OPIPE_MAXNAME	32
1227 
1228 /*
1229  * Data structure for SMB_FTYPE_MESG_PIPE ofiles, which is used
1230  * at the interface between SMB and NDR RPC.
1231  */
1232 typedef struct smb_opipe {
1233 	uint32_t		p_magic;
1234 	kmutex_t		p_mutex;
1235 	kcondvar_t		p_cv;
1236 	struct smb_ofile	*p_ofile;
1237 	struct smb_server	*p_server;
1238 	uint32_t		p_refcnt;
1239 	ksocket_t		p_socket;
1240 	/* This is the "flat" name, without path prefix */
1241 	char			p_name[SMB_OPIPE_MAXNAME];
1242 } smb_opipe_t;
1243 
1244 /*
1245  * The of_ftype	of an open file should contain the SMB_FTYPE value
1246  * returned when the file/pipe was opened. The following
1247  * assumptions are currently made:
1248  *
1249  * File Type	    Node       PipeInfo
1250  * ---------	    --------   --------
1251  * SMB_FTYPE_DISK       Valid      Null
1252  * SMB_FTYPE_BYTE_PIPE  Undefined  Undefined
1253  * SMB_FTYPE_MESG_PIPE  Null       Valid
1254  * SMB_FTYPE_PRINTER    Undefined  Undefined
1255  * SMB_FTYPE_UNKNOWN    Undefined  Undefined
1256  */
1257 
1258 /*
1259  * Some flags for ofile structure
1260  *
1261  *	SMB_OFLAGS_SET_DELETE_ON_CLOSE
1262  *   Set this flag when the corresponding open operation whose
1263  *   DELETE_ON_CLOSE bit of the CreateOptions is set. If any
1264  *   open file instance has this bit set, the NODE_FLAGS_DELETE_ON_CLOSE
1265  *   will be set for the file node upon close.
1266  */
1267 
1268 #define	SMB_OFLAGS_READONLY		0x0001
1269 #define	SMB_OFLAGS_EXECONLY		0x0002
1270 #define	SMB_OFLAGS_SET_DELETE_ON_CLOSE	0x0004
1271 #define	SMB_OFLAGS_LLF_POS_VALID	0x0008
1272 
1273 #define	SMB_OFILE_MAGIC 	0x4F464C45	/* 'OFLE' */
1274 #define	SMB_OFILE_VALID(p)	\
1275     ASSERT((p != NULL) && ((p)->f_magic == SMB_OFILE_MAGIC))
1276 
1277 typedef enum {
1278 	SMB_OFILE_STATE_OPEN = 0,
1279 	SMB_OFILE_STATE_CLOSING,
1280 	SMB_OFILE_STATE_CLOSED,
1281 	SMB_OFILE_STATE_SENTINEL
1282 } smb_ofile_state_t;
1283 
1284 typedef struct smb_ofile {
1285 	list_node_t		f_lnd;	/* t_ofile_list */
1286 	list_node_t		f_nnd;	/* n_ofile_list */
1287 	uint32_t		f_magic;
1288 	kmutex_t		f_mutex;
1289 	smb_ofile_state_t	f_state;
1290 
1291 	struct smb_server	*f_server;
1292 	smb_session_t		*f_session;
1293 	smb_user_t		*f_user;
1294 	smb_tree_t		*f_tree;
1295 	smb_node_t		*f_node;
1296 	smb_odir_t		*f_odir;
1297 	smb_opipe_t		*f_pipe;
1298 
1299 	uint32_t		f_uniqid;
1300 	uint32_t		f_refcnt;
1301 	uint64_t		f_seek_pos;
1302 	uint32_t		f_flags;
1303 	uint32_t		f_granted_access;
1304 	uint32_t		f_share_access;
1305 	uint32_t		f_create_options;
1306 	uint32_t		f_opened_by_pid;
1307 	uint16_t		f_fid;
1308 	uint16_t		f_ftype;
1309 	uint64_t		f_llf_pos;
1310 	int			f_mode;
1311 	cred_t			*f_cr;
1312 	pid_t			f_pid;
1313 	smb_attr_t		f_pending_attr;
1314 	boolean_t		f_written;
1315 	char			f_quota_resume[SMB_SID_STRSZ];
1316 	smb_oplock_grant_t	f_oplock_grant;
1317 	smb_notify_t		f_notify;
1318 } smb_ofile_t;
1319 
1320 typedef struct smb_fileinfo {
1321 	char		fi_name[MAXNAMELEN];
1322 	char		fi_shortname[SMB_SHORTNAMELEN];
1323 	uint32_t	fi_cookie;	/* Dir offset (of next entry) */
1324 	uint32_t	fi_dosattr;	/* DOS attributes */
1325 	uint64_t	fi_nodeid;	/* file system node id */
1326 	uint64_t	fi_size;	/* file size in bytes */
1327 	uint64_t	fi_alloc_size;	/* allocation size in bytes */
1328 	timestruc_t	fi_atime;	/* last access */
1329 	timestruc_t	fi_mtime;	/* last modification */
1330 	timestruc_t	fi_ctime;	/* last status change */
1331 	timestruc_t	fi_crtime;	/* file creation */
1332 } smb_fileinfo_t;
1333 
1334 typedef struct smb_streaminfo {
1335 	uint64_t	si_size;
1336 	uint64_t	si_alloc_size;
1337 	char		si_name[MAXPATHLEN];
1338 } smb_streaminfo_t;
1339 
1340 #define	SMB_LOCK_MAGIC 	0x4C4F434B	/* 'LOCK' */
1341 
1342 typedef struct smb_lock {
1343 	list_node_t		l_lnd;
1344 	uint32_t		l_magic;
1345 	kmutex_t		l_mutex;
1346 	kcondvar_t		l_cv;
1347 
1348 	smb_ofile_t		*l_file;
1349 
1350 	struct smb_lock		*l_blocked_by; /* Debug info only */
1351 
1352 	uint32_t		l_conflicts;
1353 	uint32_t		l_flags;
1354 	uint32_t		l_pid;
1355 	uint32_t		l_type;
1356 	uint64_t		l_start;
1357 	uint64_t		l_length;
1358 	clock_t			l_end_time;
1359 } smb_lock_t;
1360 
1361 #define	SMB_LOCK_FLAG_INDEFINITE	0x0004
1362 #define	SMB_LOCK_FLAG_CLOSED		0x0008
1363 #define	SMB_LOCK_FLAG_CANCELLED		0x0010
1364 
1365 #define	SMB_LOCK_TYPE_READWRITE		101
1366 #define	SMB_LOCK_TYPE_READONLY		102
1367 
1368 typedef struct vardata_block {
1369 	uint8_t			vdb_tag;
1370 	uint32_t		vdb_len;
1371 	struct uio 		vdb_uio;
1372 	struct iovec		vdb_iovec[MAX_IOVEC];
1373 } smb_vdb_t;
1374 
1375 #define	SMB_WRMODE_WRITE_THRU	0x0001
1376 #define	SMB_WRMODE_IS_STABLE(M)	((M) & SMB_WRMODE_WRITE_THRU)
1377 
1378 #define	SMB_RW_MAGIC		0x52445257	/* 'RDRW' */
1379 
1380 typedef struct smb_rw_param {
1381 	uint32_t rw_magic;
1382 	smb_vdb_t rw_vdb;
1383 	uint64_t rw_offset;
1384 	uint32_t rw_last_write;
1385 	uint16_t rw_mode;
1386 	uint32_t rw_count;		/* bytes in this request */
1387 	uint16_t rw_mincnt;
1388 	uint32_t rw_total;		/* total bytes (write-raw) */
1389 	uint16_t rw_dsoff;		/* SMB data offset */
1390 	uint8_t rw_andx;		/* SMB secondary andx command */
1391 } smb_rw_param_t;
1392 
1393 typedef struct smb_pathname {
1394 	char	*pn_path;
1395 	char	*pn_pname;
1396 	char	*pn_fname;
1397 	char	*pn_sname;
1398 	char	*pn_stype;
1399 } smb_pathname_t;
1400 
1401 /*
1402  * fs_query_info
1403  */
1404 typedef struct smb_fqi {
1405 	smb_pathname_t	fq_path;
1406 	uint16_t	fq_sattr;
1407 	smb_node_t	*fq_dnode;
1408 	smb_node_t	*fq_fnode;
1409 	smb_attr_t	fq_fattr;
1410 	char		fq_last_comp[MAXNAMELEN];
1411 } smb_fqi_t;
1412 
1413 typedef struct dirop {
1414 	smb_fqi_t	fqi;
1415 	smb_fqi_t	dst_fqi;
1416 	uint16_t	info_level;
1417 	uint16_t	flags;
1418 } smb_arg_dirop_t;
1419 
1420 typedef struct smb_queryinfo {
1421 	smb_node_t	*qi_node;	/* NULL for pipes */
1422 	uint8_t qi_InfoType;
1423 	uint8_t qi_InfoClass;
1424 	uint8_t	qi_delete_on_close;
1425 	uint8_t qi_isdir;
1426 	uint32_t qi_AddlInfo;
1427 	uint32_t qi_Flags;
1428 	mbuf_chain_t in_data;
1429 	smb_attr_t	qi_attr;
1430 	uint32_t	qi_namelen;
1431 	char		qi_shortname[SMB_SHORTNAMELEN];
1432 	char		qi_name[MAXPATHLEN];
1433 } smb_queryinfo_t;
1434 
1435 typedef struct smb_setinfo {
1436 	smb_node_t *si_node;
1437 	mbuf_chain_t si_data;
1438 	smb_attr_t si_attr;
1439 } smb_setinfo_t;
1440 
1441 /*
1442  * smb_fssize_t
1443  * volume_units and volume avail are the total allocated and
1444  * available units on the volume.
1445  * caller_units and caller_avail are the allocated and available
1446  * units on the volume for the user associated with the calling
1447  * thread.
1448  */
1449 typedef struct smb_fssize {
1450 	uint64_t	fs_volume_units;
1451 	uint64_t	fs_volume_avail;
1452 	uint64_t	fs_caller_units;
1453 	uint64_t	fs_caller_avail;
1454 	uint32_t	fs_sectors_per_unit;
1455 	uint32_t	fs_bytes_per_sector;
1456 } smb_fssize_t;
1457 
1458 /*
1459  * SMB FsCtl operations (SMB2 Ioctl, and some SMB1 trans calls)
1460  */
1461 typedef struct {
1462 	uint32_t CtlCode;
1463 	uint32_t InputCount;
1464 	uint32_t OutputCount;
1465 	uint32_t MaxOutputResp;
1466 	mbuf_chain_t *in_mbc;
1467 	mbuf_chain_t *out_mbc;
1468 } smb_fsctl_t;
1469 
1470 typedef struct {
1471 	uint64_t	persistent;
1472 	uint64_t	temporal;
1473 } smb2fid_t;
1474 
1475 typedef struct {
1476 	uint32_t status;
1477 	uint16_t errcls;
1478 	uint16_t errcode;
1479 } smb_error_t;
1480 
1481 typedef struct open_param {
1482 	smb_fqi_t	fqi;
1483 	uint16_t	omode;
1484 	uint16_t	ofun;
1485 	uint32_t	nt_flags;
1486 	uint32_t	timeo;
1487 	uint32_t	dattr;
1488 	timestruc_t	crtime;
1489 	timestruc_t	mtime;
1490 	timestruc_t	timewarp;
1491 	/*
1492 	 * Careful: dsize is the desired (allocation) size before the
1493 	 * common open function, and the actual size afterwards.
1494 	 */
1495 	uint64_t	dsize;	/* alloc size, actual size */
1496 	uint32_t	desired_access;
1497 	uint32_t	maximum_access;
1498 	uint32_t	share_access;
1499 	uint32_t	create_options;
1500 	uint32_t	create_disposition;
1501 	boolean_t	create_timewarp;
1502 	boolean_t	created_readonly;
1503 	uint32_t	ftype;
1504 	uint32_t	devstate;
1505 	uint32_t	action_taken;
1506 	uint64_t	fileid;
1507 	uint32_t	rootdirfid;
1508 	fsid_t		op_fsid;
1509 	smb_ofile_t	*dir;
1510 	smb_opipe_t	*pipe;	/* for smb_opipe_open */
1511 	struct smb_sd	*sd;	/* for NTTransactCreate */
1512 	void		*create_ctx;
1513 	uint8_t		op_oplock_level;	/* requested/granted level */
1514 	boolean_t	op_oplock_levelII;	/* TRUE if levelII supported */
1515 } smb_arg_open_t;
1516 
1517 typedef struct smb_arg_lock {
1518 	void		*lvec;
1519 	uint32_t	lcnt;
1520 	uint32_t	lseq;
1521 } smb_arg_lock_t;
1522 
1523 struct smb_async_req;
1524 
1525 /*
1526  * SMB Request State Machine
1527  * -------------------------
1528  *
1529  *                  T4               +------+		T0
1530  *      +--------------------------->| FREE |---------------------------+
1531  *      |                            +------+                           |
1532  * +-----------+                                                        |
1533  * | COMPLETED |                                                        |
1534  * +-----------+
1535  *      ^                                                               |
1536  *      | T15                      +-----------+                        v
1537  * +------------+        T6        |           |                +--------------+
1538  * | CLEANED_UP |<-----------------| CANCELLED |                | INITIALIZING |
1539  * +------------+                  |           |                +--------------+
1540  *      |    ^                     +-----------+                        |
1541  *      |    |                        ^  ^ ^ ^                          |
1542  *      |    |          +-------------+  | | |                          |
1543  *      |    |    T3    |                | | |               T13        | T1
1544  *      |    +-------------------------+ | | +----------------------+   |
1545  *      +----------------------------+ | | |                        |   |
1546  *         T16          |            | | | +-----------+            |   |
1547  *                      |           \/ | | T5          |            |   v
1548  * +-----------------+  |   T12     +--------+         |     T2    +-----------+
1549  * | EVENT_OCCURRED  |------------->| ACTIVE |<--------------------| SUBMITTED |
1550  * +-----------------+  |           +--------+         |           +-----------+
1551  *        ^             |              | ^ |           |
1552  *        |             |           T8 | | |  T7       |
1553  *        | T10      T9 |   +----------+ | +-------+   |  T11
1554  *        |             |   |            +-------+ |   |
1555  *        |             |   |               T14  | |   |
1556  *        |             |   v                    | v   |
1557  *      +----------------------+                +--------------+
1558  *	|     WAITING_EVENT    |                | WAITING_LOCK |
1559  *      +----------------------+                +--------------+
1560  *
1561  *
1562  *
1563  *
1564  *
1565  * Transition T0
1566  *
1567  * This transition occurs when the request is allocated and is still under the
1568  * control of the session thread.
1569  *
1570  * Transition T1
1571  *
1572  * This transition occurs when the session thread dispatches a task to treat the
1573  * request.
1574  *
1575  * Transition T2
1576  *
1577  *
1578  *
1579  * Transition T3
1580  *
1581  * A request completes and smbsr_cleanup is called to release resources
1582  * associated with the request (but not the smb_request_t itself).  This
1583  * includes references on smb_ofile_t, smb_node_t, and other structures.
1584  * CLEANED_UP state exists to detect if we attempt to cleanup a request
1585  * multiple times and to allow us to detect that we are accessing a
1586  * request that has already been cleaned up.
1587  *
1588  * Transition T4
1589  *
1590  *
1591  *
1592  * Transition T5
1593  *
1594  *
1595  *
1596  * Transition T6
1597  *
1598  *
1599  *
1600  * Transition T7
1601  *
1602  *
1603  *
1604  * Transition T8
1605  *
1606  *
1607  *
1608  * Transition T9
1609  *
1610  *
1611  *
1612  * Transition T10
1613  *
1614  *
1615  *
1616  * Transition T11
1617  *
1618  *
1619  *
1620  * Transition T12
1621  *
1622  *
1623  *
1624  * Transition T13
1625  *
1626  *
1627  *
1628  * Transition T14
1629  *
1630  *
1631  *
1632  * Transition T15
1633  *
1634  * Request processing is completed (control returns from smb_dispatch)
1635  *
1636  * Transition T16
1637  *
1638  * Multipart (andx) request was cleaned up with smbsr_cleanup but more "andx"
1639  * sections remain to be processed.
1640  *
1641  */
1642 
1643 #define	SMB_REQ_MAGIC 		0x534D4252	/* 'SMBR' */
1644 #define	SMB_REQ_VALID(p)	ASSERT((p)->sr_magic == SMB_REQ_MAGIC)
1645 
1646 typedef enum smb_req_state {
1647 	SMB_REQ_STATE_FREE = 0,
1648 	SMB_REQ_STATE_INITIALIZING,
1649 	SMB_REQ_STATE_SUBMITTED,
1650 	SMB_REQ_STATE_ACTIVE,
1651 	SMB_REQ_STATE_WAITING_AUTH,
1652 	SMB_REQ_STATE_WAITING_FCN1,
1653 	SMB_REQ_STATE_WAITING_FCN2,
1654 	SMB_REQ_STATE_WAITING_LOCK,
1655 	SMB_REQ_STATE_WAITING_PIPE,
1656 	SMB_REQ_STATE_COMPLETED,
1657 	SMB_REQ_STATE_CANCEL_PENDING,
1658 	SMB_REQ_STATE_CANCELLED,
1659 	SMB_REQ_STATE_CLEANED_UP,
1660 	SMB_REQ_STATE_SENTINEL
1661 } smb_req_state_t;
1662 
1663 typedef struct smb_request {
1664 	list_node_t		sr_session_lnd;
1665 	uint32_t		sr_magic;
1666 	kmutex_t		sr_mutex;
1667 	smb_req_state_t		sr_state;
1668 	struct smb_server	*sr_server;
1669 	pid_t			*sr_pid;
1670 	int32_t			sr_gmtoff;
1671 	smb_session_t		*session;
1672 	smb_kmod_cfg_t		*sr_cfg;
1673 	void			(*cancel_method)(struct smb_request *);
1674 	void			*cancel_arg2;
1675 
1676 	list_node_t		sr_waiters;	/* smb_notify.c */
1677 
1678 	/* Info from session service header */
1679 	uint32_t		sr_req_length; /* Excluding NBT header */
1680 
1681 	/* Request buffer excluding NBT header */
1682 	void			*sr_request_buf;
1683 
1684 	struct mbuf_chain	command;
1685 	struct mbuf_chain	reply;
1686 	struct mbuf_chain	raw_data;
1687 	list_t			sr_storage;
1688 	struct smb_xa		*r_xa;
1689 	int			andx_prev_wct;
1690 	int 			cur_reply_offset;
1691 	int			orig_request_hdr;
1692 	unsigned int		reply_seqnum;	/* reply sequence number */
1693 	unsigned char		first_smb_com;	/* command code */
1694 	unsigned char		smb_com;	/* command code */
1695 
1696 	uint8_t			smb_rcls;	/* error code class */
1697 	uint8_t			smb_reh;	/* rsvd (AH DOS INT-24 ERR) */
1698 	uint16_t		smb_err;	/* error code */
1699 	smb_error_t		smb_error;
1700 
1701 	uint8_t			smb_flg;	/* flags */
1702 	uint16_t		smb_flg2;	/* flags */
1703 	unsigned char		smb_sig[8];	/* signiture */
1704 	uint16_t		smb_tid;	/* tree id #  */
1705 	uint32_t		smb_pid;	/* caller's process id # */
1706 	uint16_t		smb_uid;	/* user id # */
1707 	uint16_t		smb_mid;	/* mutiplex id #  */
1708 	unsigned char		smb_wct;	/* count of parameter words */
1709 	uint16_t		smb_bcc;	/* data byte count */
1710 
1711 	/*
1712 	 * Beginning offsets (in the mbuf chain) for the
1713 	 * command and reply headers, and the next reply.
1714 	 */
1715 	uint32_t		smb2_cmd_hdr;
1716 	uint32_t		smb2_reply_hdr;
1717 	uint32_t		smb2_next_reply;
1718 
1719 	/*
1720 	 * SMB2 header fields.  [MS-SMB2 2.2.1.2]
1721 	 * XXX: Later do a union w smb1 members
1722 	 */
1723 	uint16_t		smb2_credit_charge;
1724 	uint16_t		smb2_chan_seq;	/* cmd only */
1725 	uint32_t		smb2_status;
1726 	uint16_t		smb2_cmd_code;
1727 	uint16_t		smb2_credit_request;
1728 	uint16_t		smb2_credit_response;
1729 	uint16_t		smb2_total_credits; /* in compound */
1730 	uint32_t		smb2_hdr_flags;
1731 	uint32_t		smb2_next_command;
1732 	uint64_t		smb2_messageid;
1733 	uint64_t		smb2_first_msgid;
1734 	/* uint32_t		smb2_pid; use smb_pid */
1735 	/* uint32_t		smb2_tid; use smb_tid */
1736 	/* uint64_t		smb2_ssnid; use smb_uid */
1737 	unsigned char		smb2_sig[16];	/* signiture */
1738 
1739 	uint64_t		smb2_async_id;
1740 	struct smb2_async_req	*sr_async_req;
1741 
1742 	/* Parameters */
1743 	struct mbuf_chain	smb_vwv;	/* variable width value */
1744 
1745 	/* Data */
1746 	struct mbuf_chain	smb_data;
1747 
1748 	uint16_t		smb_fid;	/* not in hdr, but common */
1749 
1750 	unsigned char		andx_com;
1751 	uint16_t		andx_off;
1752 
1753 	struct smb_tree		*tid_tree;
1754 	struct smb_ofile	*fid_ofile;
1755 	smb_user_t		*uid_user;
1756 
1757 	cred_t			*user_cr;
1758 	kthread_t		*sr_worker;
1759 	hrtime_t		sr_time_submitted;
1760 	hrtime_t		sr_time_active;
1761 	hrtime_t		sr_time_start;
1762 	int32_t			sr_txb;
1763 	uint32_t		sr_seqnum;
1764 
1765 	union {
1766 		smb_arg_negotiate_t	*negprot;
1767 		smb_arg_sessionsetup_t	*ssetup;
1768 		smb_arg_tcon_t		tcon;
1769 		smb_arg_dirop_t		dirop;
1770 		smb_arg_open_t		open;
1771 		smb_arg_lock_t		lock;
1772 		smb_rw_param_t		*rw;
1773 		smb_oplock_grant_t	olbrk;	/* for async oplock break */
1774 		int32_t			timestamp;
1775 	} arg;
1776 } smb_request_t;
1777 
1778 #define	sr_ssetup	arg.ssetup
1779 #define	sr_negprot	arg.negprot
1780 #define	sr_tcon		arg.tcon
1781 #define	sr_dirop	arg.dirop
1782 #define	sr_open		arg.open
1783 #define	sr_rw		arg.rw
1784 #define	sr_timestamp	arg.timestamp
1785 
1786 #define	SMB_READ_PROTOCOL(hdr) \
1787 	LE_IN32(((smb_hdr_t *)(hdr))->protocol)
1788 
1789 #define	SMB_PROTOCOL_MAGIC_INVALID(rd_sr) \
1790 	(SMB_READ_PROTOCOL((rd_sr)->sr_request_buf) != SMB_PROTOCOL_MAGIC)
1791 
1792 #define	SMB_READ_COMMAND(hdr) \
1793 	(((smb_hdr_t *)(hdr))->command)
1794 
1795 #define	SMB_IS_NT_CANCEL(rd_sr) \
1796 	(SMB_READ_COMMAND((rd_sr)->sr_request_buf) == SMB_COM_NT_CANCEL)
1797 
1798 #define	SMB_IS_SESSION_SETUP_ANDX(rd_sr) \
1799 	(SMB_READ_COMMAND((rd_sr)->sr_request_buf) == \
1800 	    SMB_COM_SESSION_SETUP_ANDX)
1801 
1802 #define	SMB_IS_NT_NEGOTIATE(rd_sr) \
1803 	(SMB_READ_COMMAND((rd_sr)->sr_request_buf) == SMB_COM_NEGOTIATE)
1804 
1805 #define	SMB_IS_TREE_CONNECT_ANDX(rd_sr) \
1806 	(SMB_READ_COMMAND((rd_sr)->sr_request_buf) == SMB_COM_TREE_CONNECT_ANDX)
1807 
1808 #define	SMB_XA_FLAG_OPEN	0x0001
1809 #define	SMB_XA_FLAG_CLOSE	0x0002
1810 #define	SMB_XA_FLAG_COMPLETE	0x0004
1811 #define	SMB_XA_CLOSED(xa) (!((xa)->xa_flags & SMB_XA_FLAG_OPEN))
1812 
1813 #define	SMB_XA_MAGIC		0x534D4258	/* 'SMBX' */
1814 
1815 typedef struct smb_xa {
1816 	list_node_t		xa_lnd;
1817 	uint32_t		xa_magic;
1818 	kmutex_t		xa_mutex;
1819 
1820 	uint32_t		xa_refcnt;
1821 	uint32_t		xa_flags;
1822 
1823 	struct smb_session	*xa_session;
1824 
1825 	unsigned char		smb_com;	/* which TRANS type */
1826 	unsigned char		smb_flg;	/* flags */
1827 	uint16_t		smb_flg2;	/* flags */
1828 	uint16_t		smb_tid;	/* tree id number */
1829 	uint32_t		smb_pid;	/* caller's process id */
1830 	uint16_t		smb_uid;	/* user id number */
1831 	uint32_t		smb_func;	/* NT_TRANS function */
1832 
1833 	uint16_t		xa_smb_mid;	/* mutiplex id number */
1834 	uint16_t		xa_smb_fid;	/* TRANS2 secondary */
1835 
1836 	unsigned int		reply_seqnum;	/* reply sequence number */
1837 
1838 	uint32_t	smb_tpscnt;	/* total parameter bytes being sent */
1839 	uint32_t	smb_tdscnt;	/* total data bytes being sent */
1840 	uint32_t	smb_mprcnt;	/* max parameter bytes to return */
1841 	uint32_t	smb_mdrcnt;	/* max data bytes to return */
1842 	uint32_t	smb_msrcnt;	/* max setup words to return */
1843 	uint32_t	smb_flags;	/* additional information: */
1844 				/*  bit 0 - if set, disconnect TID in smb_tid */
1845 				/*  bit 1 - if set, transaction is one way */
1846 				/*  (no final response) */
1847 	int32_t	smb_timeout;	/* number of milliseconds to await completion */
1848 	uint32_t	smb_suwcnt;	/* set up word count */
1849 
1850 	char			*xa_pipe_name;
1851 
1852 	/*
1853 	 * These are the param and data count received so far,
1854 	 * used to decide if the whole trans is here yet.
1855 	 */
1856 	int			req_disp_param;
1857 	int			req_disp_data;
1858 
1859 	struct mbuf_chain	req_setup_mb;
1860 	struct mbuf_chain	req_param_mb;
1861 	struct mbuf_chain	req_data_mb;
1862 
1863 	struct mbuf_chain	rep_setup_mb;
1864 	struct mbuf_chain	rep_param_mb;
1865 	struct mbuf_chain	rep_data_mb;
1866 } smb_xa_t;
1867 
1868 
1869 #define	SDDF_NO_FLAGS			0
1870 #define	SDDF_SUPPRESS_TID		0x0001
1871 #define	SDDF_SUPPRESS_UID		0x0002
1872 
1873 /*
1874  * SMB dispatch return codes.
1875  */
1876 typedef enum {
1877 	SDRC_SUCCESS = 0,
1878 	SDRC_ERROR,
1879 	SDRC_DROP_VC,
1880 	SDRC_NO_REPLY,
1881 	SDRC_SR_KEPT,
1882 	SDRC_NOT_IMPLEMENTED
1883 } smb_sdrc_t;
1884 
1885 #define	VAR_BCC		((short)-1)
1886 
1887 #define	SMB_SERVER_MAGIC	0x53534552	/* 'SSER' */
1888 #define	SMB_SERVER_VALID(s)	\
1889     ASSERT(((s) != NULL) && ((s)->sv_magic == SMB_SERVER_MAGIC))
1890 
1891 #define	SMB_LISTENER_MAGIC	0x4C53544E	/* 'LSTN' */
1892 #define	SMB_LISTENER_VALID(ld)	\
1893     ASSERT(((ld) != NULL) && ((ld)->ld_magic == SMB_LISTENER_MAGIC))
1894 
1895 typedef struct {
1896 	uint32_t		ld_magic;
1897 	struct smb_server	*ld_sv;
1898 	smb_thread_t		ld_thread;
1899 	ksocket_t		ld_so;
1900 	in_port_t		ld_port;
1901 	int			ld_family;
1902 	struct sockaddr_in	ld_sin;
1903 	struct sockaddr_in6	ld_sin6;
1904 	smb_llist_t		ld_session_list;
1905 } smb_listener_daemon_t;
1906 
1907 #define	SMB_SSETUP_CMD			"authentication"
1908 #define	SMB_TCON_CMD			"share mapping"
1909 #define	SMB_OPIPE_CMD			"pipe open"
1910 #define	SMB_THRESHOLD_REPORT_THROTTLE	50
1911 typedef struct smb_cmd_threshold {
1912 	char			*ct_cmd;
1913 	kmutex_t		ct_mutex;
1914 	volatile uint32_t	ct_active_cnt;
1915 	volatile uint32_t	ct_blocked_cnt;
1916 	uint32_t		ct_threshold;
1917 	uint32_t		ct_timeout; /* milliseconds */
1918 	kcondvar_t		ct_cond;
1919 } smb_cmd_threshold_t;
1920 
1921 typedef struct {
1922 	kstat_named_t		ls_files;
1923 	kstat_named_t		ls_trees;
1924 	kstat_named_t		ls_users;
1925 } smb_server_legacy_kstat_t;
1926 
1927 typedef enum smb_server_state {
1928 	SMB_SERVER_STATE_CREATED = 0,
1929 	SMB_SERVER_STATE_CONFIGURED,
1930 	SMB_SERVER_STATE_RUNNING,
1931 	SMB_SERVER_STATE_STOPPING,
1932 	SMB_SERVER_STATE_DELETING,
1933 	SMB_SERVER_STATE_SENTINEL
1934 } smb_server_state_t;
1935 
1936 typedef struct {
1937 	/* protected by sv_mutex */
1938 	kcondvar_t		sp_cv;
1939 	uint32_t 		sp_cnt;
1940 	smb_llist_t		sp_list;
1941 	smb_llist_t		sp_fidlist;
1942 } smb_spool_t;
1943 
1944 #define	SMB_SERVER_STATE_VALID(S)               \
1945     ASSERT(((S) == SMB_SERVER_STATE_CREATED) || \
1946 	    ((S) == SMB_SERVER_STATE_CONFIGURED) || \
1947 	    ((S) == SMB_SERVER_STATE_RUNNING) ||    \
1948 	    ((S) == SMB_SERVER_STATE_STOPPING) ||   \
1949 	    ((S) == SMB_SERVER_STATE_DELETING))
1950 
1951 typedef struct smb_server {
1952 	list_node_t		sv_lnd;
1953 	uint32_t		sv_magic;
1954 	kcondvar_t		sv_cv;
1955 	kmutex_t		sv_mutex;
1956 	smb_server_state_t	sv_state;
1957 	uint32_t		sv_refcnt;
1958 	pid_t			sv_pid;
1959 	zoneid_t		sv_zid;
1960 	smb_listener_daemon_t	sv_nbt_daemon;
1961 	smb_listener_daemon_t	sv_tcp_daemon;
1962 	krwlock_t		sv_cfg_lock;
1963 	smb_kmod_cfg_t		sv_cfg;
1964 	smb_session_t		*sv_session;
1965 
1966 	struct smb_export	sv_export;
1967 	struct __door_handle	*sv_lmshrd;
1968 
1969 	/* Internal door for up-calls to smbd */
1970 	struct __door_handle	*sv_kdoor_hd;
1971 	int			sv_kdoor_id; /* init -1 */
1972 	uint64_t		sv_kdoor_ncall;
1973 	kmutex_t		sv_kdoor_mutex;
1974 	kcondvar_t		sv_kdoor_cv;
1975 
1976 	int32_t			si_gmtoff;
1977 
1978 	smb_thread_t		si_thread_timers;
1979 
1980 	taskq_t			*sv_worker_pool;
1981 	taskq_t			*sv_receiver_pool;
1982 
1983 	smb_node_t		*si_root_smb_node;
1984 	smb_llist_t		sv_opipe_list;
1985 	smb_llist_t		sv_event_list;
1986 
1987 	/* Statistics */
1988 	hrtime_t		sv_start_time;
1989 	kstat_t			*sv_ksp;
1990 	volatile uint32_t	sv_nbt_sess;
1991 	volatile uint32_t	sv_tcp_sess;
1992 	volatile uint32_t	sv_users;
1993 	volatile uint32_t	sv_trees;
1994 	volatile uint32_t	sv_files;
1995 	volatile uint32_t	sv_pipes;
1996 	volatile uint64_t	sv_txb;
1997 	volatile uint64_t	sv_rxb;
1998 	volatile uint64_t	sv_nreq;
1999 	smb_srqueue_t		sv_srqueue;
2000 	smb_spool_t		sp_info;
2001 	smb_cmd_threshold_t	sv_ssetup_ct;
2002 	smb_cmd_threshold_t	sv_tcon_ct;
2003 	smb_cmd_threshold_t	sv_opipe_ct;
2004 	kstat_t			*sv_legacy_ksp;
2005 	kmutex_t		sv_legacy_ksmtx;
2006 	smb_disp_stats_t	*sv_disp_stats1;
2007 	smb_disp_stats_t	*sv_disp_stats2;
2008 } smb_server_t;
2009 
2010 #define	SMB_EVENT_MAGIC		0x45564E54	/* EVNT */
2011 #define	SMB_EVENT_TIMEOUT	45		/* seconds */
2012 #define	SMB_EVENT_VALID(e)	\
2013     ASSERT(((e) != NULL) && ((e)->se_magic == SMB_EVENT_MAGIC))
2014 typedef struct smb_event {
2015 	list_node_t		se_lnd;
2016 	uint32_t		se_magic;
2017 	kmutex_t		se_mutex;
2018 	kcondvar_t		se_cv;
2019 	smb_server_t		*se_server;
2020 	uint32_t		se_txid;
2021 	boolean_t		se_notified;
2022 	int			se_waittime;
2023 	int			se_timeout;
2024 	int			se_errno;
2025 } smb_event_t;
2026 
2027 typedef struct smb_kspooldoc {
2028 	list_node_t	sd_lnd;
2029 	uint32_t	sd_magic;
2030 	smb_inaddr_t	sd_ipaddr;
2031 	uint32_t	sd_spool_num;
2032 	uint16_t	sd_fid;
2033 	char		sd_username[MAXNAMELEN];
2034 	char		sd_path[MAXPATHLEN];
2035 } smb_kspooldoc_t;
2036 
2037 typedef struct smb_spoolfid {
2038 	list_node_t	sf_lnd;
2039 	uint32_t	sf_magic;
2040 	uint16_t	sf_fid;
2041 } smb_spoolfid_t;
2042 
2043 #define	SMB_INFO_NETBIOS_SESSION_SVC_RUNNING	0x0001
2044 #define	SMB_INFO_NETBIOS_SESSION_SVC_FAILED	0x0002
2045 #define	SMB_INFO_USER_LEVEL_SECURITY		0x40000000
2046 #define	SMB_INFO_ENCRYPT_PASSWORDS		0x80000000
2047 
2048 #define	SMB_IS_STREAM(node) ((node)->n_unode)
2049 
2050 typedef struct smb_tsd {
2051 	void (*proc)();
2052 	void *arg;
2053 	char name[100];
2054 } smb_tsd_t;
2055 
2056 typedef struct smb_disp_entry {
2057 	char		sdt_name[KSTAT_STRLEN];
2058 	smb_sdrc_t	(*sdt_pre_op)(smb_request_t *);
2059 	smb_sdrc_t	(*sdt_function)(smb_request_t *);
2060 	void		(*sdt_post_op)(smb_request_t *);
2061 	uint8_t		sdt_com;
2062 	char		sdt_dialect;
2063 	uint8_t		sdt_flags;
2064 } smb_disp_entry_t;
2065 
2066 typedef struct smb_xlate {
2067 	int	code;
2068 	char	*str;
2069 } smb_xlate_t;
2070 
2071 /*
2072  * This structure is a helper for building RAP NetShareEnum response
2073  *
2074  * es_posix_uid UID of the user requesting the shares list which
2075  *              is used to detect if the user has any autohome
2076  * es_bufsize   size of the response buffer
2077  * es_buf       pointer to the response buffer
2078  * es_ntotal    total number of shares exported by server which
2079  *              their OEM names is less then 13 chars
2080  * es_nsent     number of shares that can fit in the specified buffer
2081  * es_datasize  actual data size (share's data) which was encoded
2082  *              in the response buffer
2083  */
2084 typedef struct smb_enumshare_info {
2085 	uid_t		es_posix_uid;
2086 	uint16_t	es_bufsize;
2087 	char		*es_buf;
2088 	uint16_t	es_ntotal;
2089 	uint16_t	es_nsent;
2090 	uint16_t	es_datasize;
2091 } smb_enumshare_info_t;
2092 
2093 #ifdef	__cplusplus
2094 }
2095 #endif
2096 
2097 #endif /* _SMBSRV_SMB_KTYPES_H */
2098