1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2017 Nexenta Systems, Inc. All rights reserved.
25 * Copyright 2022 RackTop Systems.
26 */
27
28 /*
29 * SMB specific functions
30 */
31 #include <stdio.h>
32 #include <string.h>
33 #include <ctype.h>
34 #include <stdlib.h>
35 #include <unistd.h>
36 #include <zone.h>
37 #include <errno.h>
38 #include <locale.h>
39 #include <fcntl.h>
40 #include <sys/types.h>
41 #include <sys/stat.h>
42 #include <syslog.h>
43 #include "libshare.h"
44 #include "libshare_impl.h"
45 #include <pwd.h>
46 #include <limits.h>
47 #include <libscf.h>
48 #include <libscf_priv.h>
49 #include <strings.h>
50 #include "libshare_smb.h"
51 #include <rpcsvc/daemon_utils.h>
52 #include <smbsrv/smb_share.h>
53 #include <smbsrv/smbinfo.h>
54 #include <smbsrv/libsmb.h>
55 #include <libdlpi.h>
56
57 #define SMB_CSC_BUFSZ 64
58
59 #define SMB_VALID_SUB_CHRS "UDhMLmIiSPu" /* substitution characters */
60
61 /* internal functions */
62 static int smb_share_init(void);
63 static void smb_share_fini(void);
64 static int smb_enable_share(sa_share_t);
65 static int smb_share_changed(sa_share_t);
66 static int smb_resource_changed(sa_resource_t);
67 static int smb_rename_resource(sa_handle_t, sa_resource_t, char *);
68 static int smb_disable_share(sa_share_t share, char *);
69 static int smb_validate_property(sa_handle_t, sa_property_t, sa_optionset_t);
70 static int smb_set_proto_prop(sa_property_t);
71 static sa_protocol_properties_t smb_get_proto_set(void);
72 static char *smb_get_status(void);
73 static int smb_parse_optstring(sa_group_t, char *);
74 static char *smb_format_options(sa_group_t, int);
75
76 static int smb_enable_service(void);
77
78 static int range_check_validator(int, char *);
79 static int range_check_validator_zero_ok(int, char *);
80 static int string_length_check_validator(int, char *);
81 static int print_enable_validator(int, char *);
82 static int true_false_validator(int, char *);
83 static int ipv4_validator(int, char *);
84 static int hostname_validator(int, char *);
85 static int path_validator(int, char *);
86 static int cmd_validator(int, char *);
87 static int disposition_validator(int, char *);
88 static int protocol_validator(int, char *);
89 static int require_validator(int, char *);
90 static int ciphers_validator(int, char *);
91
92 static int smb_enable_resource(sa_resource_t);
93 static int smb_disable_resource(sa_resource_t);
94 static uint64_t smb_share_features(void);
95 static int smb_list_transient(sa_handle_t);
96
97 static int smb_build_shareinfo(sa_share_t, sa_resource_t, smb_share_t *);
98 static void smb_csc_option(const char *, smb_share_t *);
99 static char *smb_csc_name(const smb_share_t *);
100 static sa_group_t smb_get_defaultgrp(sa_handle_t);
101 static int interface_validator(int, char *);
102 static int smb_update_optionset_props(sa_handle_t, sa_resource_t, nvlist_t *);
103
104 static boolean_t smb_saprop_getbool(sa_optionset_t, char *, boolean_t);
105 static boolean_t smb_saprop_getstr(sa_optionset_t, char *, char *, size_t);
106
107 static struct {
108 char *value;
109 uint32_t flag;
110 } cscopt[] = {
111 { "disabled", SMB_SHRF_CSC_DISABLED },
112 { "manual", SMB_SHRF_CSC_MANUAL },
113 { "auto", SMB_SHRF_CSC_AUTO },
114 { "vdo", SMB_SHRF_CSC_VDO }
115 };
116
117 /* size of basic format allocation */
118 #define OPT_CHUNK 1024
119
120 /* size of string for types - big enough to hold "dependency" */
121 #define SCFTYPE_LEN 32
122
123 /*
124 * Indexes of entries in smb_proto_options table.
125 * Changes to smb_proto_options table may require
126 * an update to these values.
127 */
128 #define PROTO_OPT_WINS1 6
129 #define PROTO_OPT_WINS_EXCLUDE 8
130
131 typedef struct smb_hostifs_walker {
132 const char *hiw_ifname;
133 boolean_t hiw_matchfound;
134 } smb_hostifs_walker_t;
135
136
137 /*
138 * ops vector that provides the protocol specific info and operations
139 * for share management.
140 */
141
142 struct sa_plugin_ops sa_plugin_ops = {
143 SA_PLUGIN_VERSION,
144 SMB_PROTOCOL_NAME,
145 smb_share_init,
146 smb_share_fini,
147 smb_enable_share,
148 smb_disable_share,
149 smb_validate_property,
150 NULL, /* valid_space */
151 NULL, /* security_prop */
152 smb_parse_optstring,
153 smb_format_options,
154 smb_set_proto_prop,
155 smb_get_proto_set,
156 smb_get_status,
157 NULL, /* space_alias */
158 NULL, /* update_legacy */
159 NULL, /* delete_legacy */
160 smb_share_changed,
161 smb_enable_resource,
162 smb_disable_resource,
163 smb_share_features,
164 smb_list_transient,
165 smb_resource_changed,
166 smb_rename_resource,
167 NULL, /* run_command */
168 NULL, /* command_help */
169 NULL /* delete_proto_section */
170 };
171
172 struct option_defs optdefs[] = {
173 { SHOPT_AD_CONTAINER, OPT_TYPE_STRING },
174 { SHOPT_ABE, OPT_TYPE_BOOLEAN },
175 { SHOPT_NAME, OPT_TYPE_NAME },
176 { SHOPT_RO, OPT_TYPE_ACCLIST },
177 { SHOPT_RW, OPT_TYPE_ACCLIST },
178 { SHOPT_NONE, OPT_TYPE_ACCLIST },
179 { SHOPT_CATIA, OPT_TYPE_BOOLEAN },
180 { SHOPT_CSC, OPT_TYPE_CSC },
181 { SHOPT_GUEST, OPT_TYPE_BOOLEAN },
182 { SHOPT_DFSROOT, OPT_TYPE_BOOLEAN },
183 { SHOPT_DESCRIPTION, OPT_TYPE_STRING },
184 { SHOPT_CA, OPT_TYPE_BOOLEAN },
185 { SHOPT_FSO, OPT_TYPE_BOOLEAN },
186 { SHOPT_QUOTAS, OPT_TYPE_BOOLEAN },
187 { SHOPT_ENCRYPT, OPT_TYPE_STRING },
188 { NULL, 0 }
189 };
190
191 /*
192 * findopt(name)
193 *
194 * Lookup option "name" in the option table and return the table
195 * index.
196 */
197 static int
findopt(char * name)198 findopt(char *name)
199 {
200 int i;
201 if (name != NULL) {
202 for (i = 0; optdefs[i].tag != NULL; i++) {
203 if (strcmp(optdefs[i].tag, name) == 0)
204 return (i);
205 }
206 }
207 return (-1);
208 }
209
210 /*
211 * is_a_number(number)
212 *
213 * is the string a number in one of the forms we want to use?
214 */
215 static boolean_t
is_a_number(char * number)216 is_a_number(char *number)
217 {
218 boolean_t isnum = B_TRUE;
219 boolean_t ishex = B_FALSE;
220
221 if (number == NULL || *number == '\0')
222 return (B_FALSE);
223
224 if (strncasecmp(number, "0x", 2) == 0) {
225 number += 2;
226 ishex = B_TRUE;
227 } else if (*number == '-') {
228 number++;
229 }
230
231 while (isnum && (*number != '\0')) {
232 isnum = (ishex) ? isxdigit(*number) : isdigit(*number);
233 number++;
234 }
235
236 return (isnum);
237 }
238
239 /*
240 * check ro vs rw values. Over time this may get beefed up.
241 * for now it just does simple checks.
242 */
243
244 static int
check_rorw(char * v1,char * v2)245 check_rorw(char *v1, char *v2)
246 {
247 int ret = SA_OK;
248 if (strcmp(v1, v2) == 0)
249 ret = SA_VALUE_CONFLICT;
250 return (ret);
251 }
252
253 /*
254 * validresource(name)
255 *
256 * Check that name only has valid characters in it. The current valid
257 * set are the printable characters but not including:
258 * " / \ [ ] : | < > + ; , ? * = \t
259 * Note that space is included and there is a maximum length.
260 */
261 static boolean_t
validresource(const char * name)262 validresource(const char *name)
263 {
264 const char *cp;
265 size_t len;
266
267 if (name == NULL)
268 return (B_FALSE);
269
270 len = strlen(name);
271 if (len == 0 || len > SA_MAX_RESOURCE_NAME)
272 return (B_FALSE);
273
274 if (strpbrk(name, "\"/\\[]:|<>+;,?*=\t") != NULL) {
275 return (B_FALSE);
276 }
277
278 for (cp = name; *cp != '\0'; cp++)
279 if (iscntrl(*cp))
280 return (B_FALSE);
281
282 return (B_TRUE);
283 }
284
285 /*
286 * Check that the client-side caching (CSC) option value is valid.
287 */
288 static boolean_t
validcsc(const char * value)289 validcsc(const char *value)
290 {
291 int i;
292
293 for (i = 0; i < (sizeof (cscopt) / sizeof (cscopt[0])); ++i) {
294 if (strcasecmp(value, cscopt[i].value) == 0)
295 return (B_TRUE);
296 }
297
298 return (B_FALSE);
299 }
300
301 /*
302 * smb_isonline()
303 *
304 * Determine if the SMF service instance is in the online state or
305 * not. A number of operations depend on this state.
306 */
307 static boolean_t
smb_isonline(void)308 smb_isonline(void)
309 {
310 char *str;
311 boolean_t ret = B_FALSE;
312
313 if ((str = smf_get_state(SMBD_DEFAULT_INSTANCE_FMRI)) != NULL) {
314 ret = (strcmp(str, SCF_STATE_STRING_ONLINE) == 0);
315 free(str);
316 }
317 return (ret);
318 }
319
320 /*
321 * smb_isdisabled()
322 *
323 * Determine if the SMF service instance is in the disabled state or
324 * not. A number of operations depend on this state.
325 */
326 static boolean_t
smb_isdisabled(void)327 smb_isdisabled(void)
328 {
329 char *str;
330 boolean_t ret = B_FALSE;
331
332 if ((str = smf_get_state(SMBD_DEFAULT_INSTANCE_FMRI)) != NULL) {
333 ret = (strcmp(str, SCF_STATE_STRING_DISABLED) == 0);
334 free(str);
335 }
336 return (ret);
337 }
338
339 /*
340 * smb_isautoenable()
341 *
342 * Determine if the SMF service instance auto_enabled set or not. A
343 * number of operations depend on this state. The property not being
344 * set or being set to true means autoenable. Only being set to false
345 * is not autoenabled.
346 */
347 static boolean_t
smb_isautoenable(void)348 smb_isautoenable(void)
349 {
350 boolean_t ret = B_TRUE;
351 scf_simple_prop_t *prop;
352 uint8_t *retstr;
353
354 prop = scf_simple_prop_get(NULL, SMBD_DEFAULT_INSTANCE_FMRI,
355 "application", "auto_enable");
356 if (prop != NULL) {
357 retstr = scf_simple_prop_next_boolean(prop);
358 ret = *retstr != 0;
359 scf_simple_prop_free(prop);
360 }
361 return (ret);
362 }
363
364 /*
365 * smb_ismaint()
366 *
367 * Determine if the SMF service instance is in the disabled state or
368 * not. A number of operations depend on this state.
369 */
370 static boolean_t
smb_ismaint(void)371 smb_ismaint(void)
372 {
373 char *str;
374 boolean_t ret = B_FALSE;
375
376 if ((str = smf_get_state(SMBD_DEFAULT_INSTANCE_FMRI)) != NULL) {
377 ret = (strcmp(str, SCF_STATE_STRING_MAINT) == 0);
378 free(str);
379 }
380 return (ret);
381 }
382
383 /*
384 * smb_enable_share tells the implementation that it is to enable the share.
385 * This entails converting the path and options into the appropriate ioctl
386 * calls. It is assumed that all error checking of paths, etc. were
387 * done earlier.
388 */
389 static int
smb_enable_share(sa_share_t share)390 smb_enable_share(sa_share_t share)
391 {
392 char *path;
393 smb_share_t si;
394 sa_resource_t resource;
395 boolean_t iszfs;
396 int err = SA_OK;
397 boolean_t online;
398
399 /*
400 * Don't support Trusted Extensions.
401 */
402 if (is_system_labeled()) {
403 (void) printf(dgettext(TEXT_DOMAIN,
404 "SMB: service not supported with Trusted Extensions\n"));
405 return (SA_NOT_SUPPORTED);
406 }
407
408 /* get the path since it is important in several places */
409 path = sa_get_share_attr(share, "path");
410 if (path == NULL)
411 return (SA_NO_SUCH_PATH);
412
413 /*
414 * If administratively disabled, don't try to start anything.
415 */
416 online = smb_isonline();
417 if (!online && !smb_isautoenable() && smb_isdisabled())
418 goto done;
419
420 iszfs = sa_path_is_zfs(path);
421
422 if (!online) {
423 err = smb_enable_service();
424 if (err != SA_OK) {
425 (void) printf(dgettext(TEXT_DOMAIN,
426 "SMB: Unable to enable service\n"));
427 } else {
428 online = B_TRUE;
429 }
430 }
431
432 /*
433 * Don't bother trying to start shares if the service isn't
434 * running.
435 */
436 if (!online)
437 goto done;
438
439 /* Each share can have multiple resources */
440 for (resource = sa_get_share_resource(share, NULL);
441 resource != NULL;
442 resource = sa_get_next_resource(resource)) {
443 err = smb_build_shareinfo(share, resource, &si);
444 if (err != SA_OK) {
445 sa_free_attr_string(path);
446 return (err);
447 }
448
449 if (!iszfs) {
450 err = smb_share_create(&si);
451 } else {
452 share_t sh;
453
454 (void) sa_sharetab_fill_zfs(share, &sh, "smb");
455 err = sa_share_zfs(share, resource, (char *)path, &sh,
456 &si, ZFS_SHARE_SMB);
457 if (err != SA_OK) {
458 errno = err;
459 err = -1;
460 }
461 sa_emptyshare(&sh);
462 }
463 }
464 if (!iszfs)
465 (void) sa_update_sharetab(share, "smb");
466 done:
467 sa_free_attr_string(path);
468
469 return (err == NERR_DuplicateShare ? 0 : err);
470 }
471
472 /*
473 * This is the share for CIFS all shares have resource names.
474 * Enable tells the smb server to update its hash. If it fails
475 * because smb server is down, we just ignore as smb server loads
476 * the resources from sharemanager at startup.
477 */
478
479 static int
smb_enable_resource(sa_resource_t resource)480 smb_enable_resource(sa_resource_t resource)
481 {
482 sa_share_t share;
483 smb_share_t si;
484 int ret = SA_OK;
485 int err;
486 boolean_t isonline;
487
488 share = sa_get_resource_parent(resource);
489 if (share == NULL)
490 return (SA_NO_SUCH_PATH);
491
492 /*
493 * If administratively disabled, don't try to start anything.
494 */
495 isonline = smb_isonline();
496 if (!isonline && !smb_isautoenable() && smb_isdisabled())
497 return (SA_OK);
498
499 if (!isonline) {
500 (void) smb_enable_service();
501
502 if (!smb_isonline())
503 return (SA_OK);
504 }
505
506 if ((ret = smb_build_shareinfo(share, resource, &si)) != SA_OK)
507 return (ret);
508
509 /*
510 * Attempt to add the share. Any error that occurs if it was
511 * online is an error but don't count NERR_DuplicateName if
512 * smb/server had to be brought online since bringing the
513 * service up will enable the share that was just added prior
514 * to the attempt to enable.
515 */
516 err = smb_share_create(&si);
517 if (err == NERR_Success || !(!isonline && err == NERR_DuplicateName))
518 (void) sa_update_sharetab(share, "smb");
519 else
520 return (SA_NOT_SHARED);
521
522 return (SA_OK);
523 }
524
525 /*
526 * Remove it from smb server hash.
527 */
528 static int
smb_disable_resource(sa_resource_t resource)529 smb_disable_resource(sa_resource_t resource)
530 {
531 char *rname;
532 uint32_t res;
533 sa_share_t share;
534
535 rname = sa_get_resource_attr(resource, "name");
536 if (rname == NULL)
537 return (SA_NO_SUCH_RESOURCE);
538
539 if (smb_isonline()) {
540 res = smb_share_delete(rname);
541 if (res != NERR_Success &&
542 res != NERR_NetNameNotFound) {
543 sa_free_attr_string(rname);
544 return (SA_CONFIG_ERR);
545 }
546 }
547
548 sa_free_attr_string(rname);
549
550 share = sa_get_resource_parent(resource);
551 if (share != NULL) {
552 rname = sa_get_share_attr(share, "path");
553 if (rname != NULL) {
554 sa_handle_t handle;
555
556 handle = sa_find_group_handle((sa_group_t)resource);
557 (void) sa_delete_sharetab(handle, rname, "smb");
558 sa_free_attr_string(rname);
559 }
560 }
561 /*
562 * Always return OK as smb/server may be down and
563 * Shares will be picked up when loaded.
564 */
565 return (SA_OK);
566 }
567
568 /*
569 * smb_share_changed(sa_share_t share)
570 *
571 * The specified share has changed.
572 */
573 static int
smb_share_changed(sa_share_t share)574 smb_share_changed(sa_share_t share)
575 {
576 char *path;
577 sa_resource_t resource;
578
579 if (!smb_isonline())
580 return (SA_OK);
581
582 /* get the path since it is important in several places */
583 path = sa_get_share_attr(share, "path");
584 if (path == NULL)
585 return (SA_NO_SUCH_PATH);
586
587 for (resource = sa_get_share_resource(share, NULL);
588 resource != NULL;
589 resource = sa_get_next_resource(resource))
590 (void) smb_resource_changed(resource);
591
592 sa_free_attr_string(path);
593
594 return (SA_OK);
595 }
596
597 /*
598 * smb_resource_changed(sa_resource_t resource)
599 *
600 * The specified resource has changed.
601 */
602 static int
smb_resource_changed(sa_resource_t resource)603 smb_resource_changed(sa_resource_t resource)
604 {
605 uint32_t res;
606 sa_share_t share;
607 smb_share_t si;
608
609 if (!smb_isonline())
610 return (SA_OK);
611
612 if ((share = sa_get_resource_parent(resource)) == NULL)
613 return (SA_CONFIG_ERR);
614
615 if ((res = smb_build_shareinfo(share, resource, &si)) != SA_OK)
616 return (res);
617
618 res = smb_share_modify(&si);
619
620 if (res != NERR_Success)
621 return (SA_CONFIG_ERR);
622
623 return (smb_enable_service());
624 }
625
626 /*
627 * smb_disable_share(sa_share_t share, char *path)
628 *
629 * Unshare the specified share. Note that "path" is the same
630 * path as what is in the "share" object. It is passed in to avoid an
631 * additional lookup. A missing "path" value makes this a no-op
632 * function.
633 */
634 static int
smb_disable_share(sa_share_t share,char * path)635 smb_disable_share(sa_share_t share, char *path)
636 {
637 char *rname;
638 sa_resource_t resource;
639 sa_group_t parent;
640 boolean_t iszfs;
641 int err = SA_OK;
642 int ret = SA_OK;
643 sa_handle_t handle;
644 boolean_t first = B_TRUE; /* work around sharetab issue */
645
646 if (path == NULL)
647 return (ret);
648
649 /*
650 * If the share is in a ZFS group we need to handle it
651 * differently. Just being on a ZFS file system isn't
652 * enough since we may be in a legacy share case.
653 */
654 parent = sa_get_parent_group(share);
655 iszfs = sa_group_is_zfs(parent);
656
657 if (!smb_isonline())
658 goto done;
659
660 for (resource = sa_get_share_resource(share, NULL);
661 resource != NULL;
662 resource = sa_get_next_resource(resource)) {
663 rname = sa_get_resource_attr(resource, "name");
664 if (rname == NULL) {
665 continue;
666 }
667 if (!iszfs) {
668 err = smb_share_delete(rname);
669 switch (err) {
670 case NERR_NetNameNotFound:
671 case NERR_Success:
672 err = SA_OK;
673 break;
674 default:
675 err = SA_CONFIG_ERR;
676 break;
677 }
678 } else {
679 share_t sh;
680
681 (void) sa_sharetab_fill_zfs(share, &sh, "smb");
682 err = sa_share_zfs(share, resource, (char *)path, &sh,
683 rname, ZFS_UNSHARE_SMB);
684 if (err != SA_OK) {
685 switch (err) {
686 case EINVAL:
687 case ENOENT:
688 err = SA_OK;
689 break;
690 default:
691 /*
692 * If we are no longer the first case,
693 * we don't care about the sa_share_zfs
694 * err if it is -1. This works around
695 * a problem in sharefs and should be
696 * removed when sharefs supports
697 * multiple entries per path.
698 */
699 if (!first)
700 err = SA_OK;
701 else
702 err = SA_SYSTEM_ERR;
703 break;
704 }
705 }
706
707 first = B_FALSE;
708
709 sa_emptyshare(&sh);
710 }
711
712 if (err != SA_OK)
713 ret = err;
714 sa_free_attr_string(rname);
715 }
716 done:
717 if (!iszfs) {
718 handle = sa_find_group_handle((sa_group_t)share);
719 if (handle != NULL)
720 (void) sa_delete_sharetab(handle, path, "smb");
721 else
722 ret = SA_SYSTEM_ERR;
723 }
724 return (ret);
725 }
726
727 /*
728 * smb_validate_property(handle, property, parent)
729 *
730 * Check that the property has a legitimate value for its type.
731 * Handle isn't currently used but may need to be in the future.
732 */
733
734 /*ARGSUSED*/
735 static int
smb_validate_property(sa_handle_t handle,sa_property_t property,sa_optionset_t parent)736 smb_validate_property(sa_handle_t handle, sa_property_t property,
737 sa_optionset_t parent)
738 {
739 int ret = SA_OK;
740 char *propname;
741 int optindex;
742 sa_group_t parent_group;
743 char *value;
744 char *other;
745
746 propname = sa_get_property_attr(property, "type");
747
748 if ((optindex = findopt(propname)) < 0)
749 ret = SA_NO_SUCH_PROP;
750
751 /* need to validate value range here as well */
752 if (ret == SA_OK) {
753 parent_group = sa_get_parent_group((sa_share_t)parent);
754 if (optdefs[optindex].share && !sa_is_share(parent_group))
755 ret = SA_PROP_SHARE_ONLY;
756 }
757 if (ret != SA_OK) {
758 if (propname != NULL)
759 sa_free_attr_string(propname);
760 return (ret);
761 }
762
763 value = sa_get_property_attr(property, "value");
764 if (value != NULL) {
765 /* first basic type checking */
766 switch (optdefs[optindex].type) {
767 case OPT_TYPE_NUMBER:
768 /* check that the value is all digits */
769 if (!is_a_number(value))
770 ret = SA_BAD_VALUE;
771 break;
772 case OPT_TYPE_BOOLEAN:
773 ret = true_false_validator(0, value);
774 break;
775 case OPT_TYPE_NAME:
776 /*
777 * Make sure no invalid characters
778 */
779 if (!validresource(value))
780 ret = SA_BAD_VALUE;
781 break;
782 case OPT_TYPE_STRING:
783 /* whatever is here should be ok */
784 break;
785 case OPT_TYPE_CSC:
786 if (!validcsc(value))
787 ret = SA_BAD_VALUE;
788 break;
789 case OPT_TYPE_ACCLIST: {
790 sa_property_t oprop;
791 char *ovalue;
792 /*
793 * access list handling. Should eventually
794 * validate that all the values make sense.
795 * Also, ro and rw may have cross value
796 * conflicts.
797 */
798 if (parent == NULL)
799 break;
800 if (strcmp(propname, SHOPT_RO) == 0)
801 other = SHOPT_RW;
802 else if (strcmp(propname, SHOPT_RW) == 0)
803 other = SHOPT_RO;
804 else
805 other = NULL;
806 if (other == NULL)
807 break;
808
809 /* compare rw(ro) with ro(rw) */
810 oprop = sa_get_property(parent, other);
811 if (oprop == NULL)
812 break;
813 /*
814 * only potential
815 * confusion if other
816 * exists
817 */
818 ovalue = sa_get_property_attr(oprop, "value");
819 if (ovalue != NULL) {
820 ret = check_rorw(value, ovalue);
821 sa_free_attr_string(ovalue);
822 }
823 break;
824 }
825 default:
826 break;
827 }
828 }
829
830 if (value != NULL)
831 sa_free_attr_string(value);
832 if (ret == SA_OK && optdefs[optindex].check != NULL)
833 /* do the property specific check */
834 ret = optdefs[optindex].check(property);
835
836 if (propname != NULL)
837 sa_free_attr_string(propname);
838 return (ret);
839 }
840
841 /*
842 * Protocol management functions
843 *
844 * properties defined in the default files are defined in
845 * proto_option_defs for parsing and validation.
846 */
847
848 struct smb_proto_option_defs {
849 int smb_index;
850 int32_t minval;
851 int32_t maxval; /* In case of length of string this should be max */
852 int (*validator)(int, char *);
853 int32_t refresh;
854 } smb_proto_options[] = {
855 { SMB_CI_SYS_CMNT, 0, MAX_VALUE_BUFLEN,
856 string_length_check_validator, SMB_REFRESH_REFRESH },
857 { SMB_CI_MAX_WORKERS, SMB_PI_MAX_WORKERS_MIN, SMB_PI_MAX_WORKERS_MAX,
858 range_check_validator, SMB_REFRESH_REFRESH },
859 { SMB_CI_NETBIOS_ENABLE, 0, 0, true_false_validator,
860 SMB_REFRESH_REFRESH },
861 { SMB_CI_NBSCOPE, 0, MAX_VALUE_BUFLEN,
862 string_length_check_validator, 0 },
863 { SMB_CI_LM_LEVEL, 2, 5, range_check_validator, 0 },
864 { SMB_CI_KEEPALIVE, 20, 5400, range_check_validator_zero_ok,
865 SMB_REFRESH_REFRESH },
866 { SMB_CI_WINS_SRV1, 0, MAX_VALUE_BUFLEN,
867 ipv4_validator, SMB_REFRESH_REFRESH },
868 { SMB_CI_WINS_SRV2, 0, MAX_VALUE_BUFLEN,
869 ipv4_validator, SMB_REFRESH_REFRESH },
870 { SMB_CI_WINS_EXCL, 0, MAX_VALUE_BUFLEN,
871 interface_validator, SMB_REFRESH_REFRESH },
872 { SMB_CI_SIGNING_ENABLE, 0, 0, true_false_validator,
873 SMB_REFRESH_REFRESH },
874 { SMB_CI_SIGNING_REQD, 0, 0, true_false_validator,
875 SMB_REFRESH_REFRESH },
876 { SMB_CI_RESTRICT_ANON, 0, 0, true_false_validator,
877 SMB_REFRESH_REFRESH },
878 { SMB_CI_DOMAIN_SRV, 0, MAX_VALUE_BUFLEN,
879 hostname_validator, SMB_REFRESH_REFRESH },
880 { SMB_CI_ADS_SITE, 0, MAX_VALUE_BUFLEN,
881 string_length_check_validator, SMB_REFRESH_REFRESH },
882 { SMB_CI_DYNDNS_ENABLE, 0, 0, true_false_validator, 0 },
883 { SMB_CI_AUTOHOME_MAP, 0, MAX_VALUE_BUFLEN, path_validator, 0 },
884 { SMB_CI_IPV6_ENABLE, 0, 0, true_false_validator,
885 SMB_REFRESH_REFRESH },
886 { SMB_CI_PRINT_ENABLE, 0, 0, print_enable_validator,
887 SMB_REFRESH_REFRESH },
888 { SMB_CI_TRAVERSE_MOUNTS, 0, 0, true_false_validator,
889 SMB_REFRESH_REFRESH },
890 { SMB_CI_MAP, 0, MAX_VALUE_BUFLEN, cmd_validator, SMB_REFRESH_REFRESH },
891 { SMB_CI_UNMAP, 0, MAX_VALUE_BUFLEN, cmd_validator,
892 SMB_REFRESH_REFRESH },
893 { SMB_CI_DISPOSITION, 0, MAX_VALUE_BUFLEN,
894 disposition_validator, SMB_REFRESH_REFRESH },
895 { SMB_CI_MIN_PROTOCOL, 0, MAX_VALUE_BUFLEN, protocol_validator,
896 SMB_REFRESH_REFRESH },
897 { SMB_CI_MAX_PROTOCOL, 0, MAX_VALUE_BUFLEN, protocol_validator,
898 SMB_REFRESH_REFRESH },
899 { SMB_CI_ENCRYPT, 0, MAX_VALUE_BUFLEN, require_validator,
900 SMB_REFRESH_REFRESH },
901 { SMB_CI_ENCRYPT_CIPHERS, 0, MAX_VALUE_BUFLEN, ciphers_validator,
902 SMB_REFRESH_REFRESH },
903 { SMB_CI_BYPASS_TRAVERSE_CHECKING, 0, 0, true_false_validator,
904 SMB_REFRESH_REFRESH },
905 { SMB_CI_OPLOCK_ENABLE, 0, 0, true_false_validator,
906 SMB_REFRESH_REFRESH },
907 { SMB_CI_SHORT_NAMES, 0, 0, true_false_validator,
908 SMB_REFRESH_REFRESH },
909 };
910
911 #define SMB_OPT_NUM \
912 (sizeof (smb_proto_options) / sizeof (smb_proto_options[0]))
913
914 static int
require_validator(int index,char * value)915 require_validator(int index, char *value)
916 {
917 if (string_length_check_validator(index, value) != SA_OK)
918 return (SA_BAD_VALUE);
919
920 if (strcmp(value, "required") == 0)
921 return (SA_OK);
922
923 if (strcmp(value, "disabled") == 0)
924 return (SA_OK);
925
926 if (strcmp(value, "enabled") == 0)
927 return (SA_OK);
928
929 return (SA_BAD_VALUE);
930 }
931
932 /*
933 * Check the range of value as int range.
934 */
935 static int
range_check_validator(int index,char * value)936 range_check_validator(int index, char *value)
937 {
938 int ret = SA_OK;
939
940 if (!is_a_number(value)) {
941 ret = SA_BAD_VALUE;
942 } else {
943 int val;
944 val = strtoul(value, NULL, 0);
945 if (val < smb_proto_options[index].minval ||
946 val > smb_proto_options[index].maxval)
947 ret = SA_BAD_VALUE;
948 }
949 return (ret);
950 }
951
952 /*
953 * Check the range of value as int range.
954 */
955 static int
range_check_validator_zero_ok(int index,char * value)956 range_check_validator_zero_ok(int index, char *value)
957 {
958 int ret = SA_OK;
959
960 if (!is_a_number(value)) {
961 ret = SA_BAD_VALUE;
962 } else {
963 int val;
964 val = strtoul(value, NULL, 0);
965 if (val == 0)
966 ret = SA_OK;
967 else {
968 if (val < smb_proto_options[index].minval ||
969 val > smb_proto_options[index].maxval)
970 ret = SA_BAD_VALUE;
971 }
972 }
973 return (ret);
974 }
975
976 /*
977 * Check the length of the string
978 */
979 static int
string_length_check_validator(int index,char * value)980 string_length_check_validator(int index, char *value)
981 {
982 int ret = SA_OK;
983
984 if (value == NULL)
985 return (SA_BAD_VALUE);
986 if (strlen(value) > smb_proto_options[index].maxval)
987 ret = SA_BAD_VALUE;
988 return (ret);
989 }
990
991 /*
992 * Check yes/no
993 */
994 /*ARGSUSED*/
995 static int
true_false_validator(int index,char * value)996 true_false_validator(int index, char *value)
997 {
998 if (value == NULL)
999 return (SA_BAD_VALUE);
1000 if ((strcasecmp(value, "true") == 0) ||
1001 (strcasecmp(value, "false") == 0))
1002 return (SA_OK);
1003 return (SA_BAD_VALUE);
1004 }
1005
1006 /*
1007 * If printing support is compiled in, this is the same as:
1008 * true_false_validator. Otherwise, only allow false.
1009 */
1010 /*ARGSUSED*/
1011 static int
print_enable_validator(int index,char * value)1012 print_enable_validator(int index, char *value)
1013 {
1014 if (value == NULL)
1015 return (SA_BAD_VALUE);
1016
1017 #ifdef HAVE_CUPS
1018 if (strcasecmp(value, "true") == 0)
1019 return (SA_OK);
1020 #endif
1021 if (strcasecmp(value, "false") == 0)
1022 return (SA_OK);
1023
1024 return (SA_BAD_VALUE);
1025 }
1026
1027 /*
1028 * Check IP v4 address.
1029 */
1030 /*ARGSUSED*/
1031 static int
ipv4_validator(int index,char * value)1032 ipv4_validator(int index, char *value)
1033 {
1034 char sbytes[16];
1035
1036 if (value == NULL)
1037 return (SA_OK);
1038
1039 if (strlen(value) == 0)
1040 return (SA_OK);
1041
1042 if (inet_pton(AF_INET, value, (void *)sbytes) != 1)
1043 return (SA_BAD_VALUE);
1044
1045 return (SA_OK);
1046 }
1047
1048 /*
1049 * Check that the specified name is an IP address (v4 or v6) or a hostname.
1050 * Per RFC 1035 and 1123, names may contain alphanumeric characters, hyphens
1051 * and dots. The first and last character of a label must be alphanumeric.
1052 * Interior characters may be alphanumeric or hypens.
1053 *
1054 * Domain names should not contain underscores but we allow them because
1055 * Windows names are often in non-compliance with this rule.
1056 */
1057 /*ARGSUSED*/
1058 static int
hostname_validator(int index,char * value)1059 hostname_validator(int index, char *value)
1060 {
1061 char sbytes[INET6_ADDRSTRLEN];
1062 boolean_t new_label = B_TRUE;
1063 char *p;
1064 char label_terminator;
1065 int len;
1066
1067 if (value == NULL)
1068 return (SA_OK);
1069
1070 if ((len = strlen(value)) == 0)
1071 return (SA_OK);
1072
1073 if (inet_pton(AF_INET, value, (void *)sbytes) == 1)
1074 return (SA_OK);
1075
1076 if (inet_pton(AF_INET6, value, (void *)sbytes) == 1)
1077 return (SA_OK);
1078
1079 if (len >= MAXHOSTNAMELEN)
1080 return (SA_BAD_VALUE);
1081
1082 if (strspn(value, "0123456789.") == len)
1083 return (SA_BAD_VALUE);
1084
1085 label_terminator = *value;
1086
1087 for (p = value; *p != '\0'; ++p) {
1088 if (new_label) {
1089 if (!isalnum(*p))
1090 return (SA_BAD_VALUE);
1091 new_label = B_FALSE;
1092 label_terminator = *p;
1093 continue;
1094 }
1095
1096 if (*p == '.') {
1097 if (!isalnum(label_terminator))
1098 return (SA_BAD_VALUE);
1099 new_label = B_TRUE;
1100 label_terminator = *p;
1101 continue;
1102 }
1103
1104 label_terminator = *p;
1105
1106 if (isalnum(*p) || *p == '-' || *p == '_')
1107 continue;
1108
1109 return (SA_BAD_VALUE);
1110 }
1111
1112 if (!isalnum(label_terminator))
1113 return (SA_BAD_VALUE);
1114
1115 return (SA_OK);
1116 }
1117
1118 /*
1119 * Call back function for dlpi_walk.
1120 * Returns TRUE if interface name exists on the host.
1121 */
1122 static boolean_t
smb_get_interface(const char * ifname,void * arg)1123 smb_get_interface(const char *ifname, void *arg)
1124 {
1125 smb_hostifs_walker_t *iterp = arg;
1126
1127 iterp->hiw_matchfound = (strcmp(ifname, iterp->hiw_ifname) == 0);
1128
1129 return (iterp->hiw_matchfound);
1130 }
1131
1132 /*
1133 * Checks to see if the input interface exists on the host.
1134 * Returns B_TRUE if the match is found, B_FALSE otherwise.
1135 */
1136 static boolean_t
smb_validate_interface(const char * ifname)1137 smb_validate_interface(const char *ifname)
1138 {
1139 smb_hostifs_walker_t iter;
1140
1141 if ((ifname == NULL) || (*ifname == '\0'))
1142 return (B_FALSE);
1143
1144 iter.hiw_ifname = ifname;
1145 iter.hiw_matchfound = B_FALSE;
1146 dlpi_walk(smb_get_interface, &iter, 0);
1147
1148 return (iter.hiw_matchfound);
1149 }
1150
1151 /*
1152 * Check valid interfaces. Interface names value can be NULL or empty.
1153 * Returns SA_BAD_VALUE if interface cannot be found on the host.
1154 */
1155 /*ARGSUSED*/
1156 static int
interface_validator(int index,char * value)1157 interface_validator(int index, char *value)
1158 {
1159 char buf[16];
1160 int ret = SA_OK;
1161 char *ifname, *tmp, *p;
1162
1163 if (value == NULL || *value == '\0')
1164 return (ret);
1165
1166 if (strlen(value) > MAX_VALUE_BUFLEN)
1167 return (SA_BAD_VALUE);
1168
1169 if ((p = strdup(value)) == NULL)
1170 return (SA_NO_MEMORY);
1171
1172 tmp = p;
1173 while ((ifname = strsep(&tmp, ",")) != NULL) {
1174 if (*ifname == '\0') {
1175 ret = SA_BAD_VALUE;
1176 break;
1177 }
1178
1179 if (!smb_validate_interface(ifname)) {
1180 if (inet_pton(AF_INET, ifname, (void *)buf) == 0) {
1181 ret = SA_BAD_VALUE;
1182 break;
1183 }
1184 }
1185 }
1186
1187 free(p);
1188 return (ret);
1189 }
1190
1191 /*
1192 * Check path
1193 */
1194 /*ARGSUSED*/
1195 static int
path_validator(int index,char * path)1196 path_validator(int index, char *path)
1197 {
1198 struct stat buffer;
1199 int fd, status;
1200
1201 if (path == NULL)
1202 return (SA_BAD_VALUE);
1203
1204 fd = open(path, O_RDONLY);
1205 if (fd < 0)
1206 return (SA_BAD_VALUE);
1207
1208 status = fstat(fd, &buffer);
1209 (void) close(fd);
1210
1211 if (status < 0)
1212 return (SA_BAD_VALUE);
1213
1214 if (buffer.st_mode & S_IFDIR)
1215 return (SA_OK);
1216 return (SA_BAD_VALUE);
1217 }
1218
1219 /*
1220 * the protoset holds the defined options so we don't have to read
1221 * them multiple times
1222 */
1223 static sa_protocol_properties_t protoset;
1224
1225 static int
findprotoopt(char * name)1226 findprotoopt(char *name)
1227 {
1228 int i;
1229 char *sc_name;
1230
1231 for (i = 0; i < SMB_OPT_NUM; i++) {
1232 sc_name = smb_config_getname(smb_proto_options[i].smb_index);
1233 if (strcasecmp(sc_name, name) == 0)
1234 return (i);
1235 }
1236
1237 return (-1);
1238 }
1239
1240 /*
1241 * smb_load_proto_properties()
1242 *
1243 * read the smb config values from SMF.
1244 */
1245
1246 static int
smb_load_proto_properties()1247 smb_load_proto_properties()
1248 {
1249 sa_property_t prop;
1250 char value[MAX_VALUE_BUFLEN];
1251 char *name;
1252 int index;
1253 int ret = SA_OK;
1254 int rc;
1255
1256 protoset = sa_create_protocol_properties(SMB_PROTOCOL_NAME);
1257 if (protoset == NULL)
1258 return (SA_NO_MEMORY);
1259
1260 for (index = 0; index < SMB_OPT_NUM && ret == SA_OK; index++) {
1261 rc = smb_config_get(smb_proto_options[index].smb_index,
1262 value, sizeof (value));
1263 if (rc != SMBD_SMF_OK)
1264 continue;
1265 name = smb_config_getname(smb_proto_options[index].smb_index);
1266 prop = sa_create_property(name, value);
1267 if (prop != NULL)
1268 ret = sa_add_protocol_property(protoset, prop);
1269 else
1270 ret = SA_NO_MEMORY;
1271 }
1272 return (ret);
1273 }
1274
1275 /*
1276 * smb_share_init()
1277 *
1278 * Initialize the smb plugin.
1279 */
1280
1281 static int
smb_share_init(void)1282 smb_share_init(void)
1283 {
1284 if (sa_plugin_ops.sa_init != smb_share_init)
1285 return (SA_SYSTEM_ERR);
1286
1287 smb_share_door_clnt_init();
1288 return (smb_load_proto_properties());
1289 }
1290
1291 /*
1292 * smb_share_fini()
1293 *
1294 */
1295 static void
smb_share_fini(void)1296 smb_share_fini(void)
1297 {
1298 xmlFreeNode(protoset);
1299 protoset = NULL;
1300
1301 smb_share_door_clnt_fini();
1302 }
1303
1304 /*
1305 * smb_get_proto_set()
1306 *
1307 * Return an optionset with all the protocol specific properties in
1308 * it.
1309 */
1310 static sa_protocol_properties_t
smb_get_proto_set(void)1311 smb_get_proto_set(void)
1312 {
1313 return (protoset);
1314 }
1315
1316 /*
1317 * smb_enable_dependencies()
1318 *
1319 * SMBD_DEFAULT_INSTANCE_FMRI may have some dependencies that aren't
1320 * enabled. This will attempt to enable all of them.
1321 */
1322 static void
smb_enable_dependencies(const char * fmri)1323 smb_enable_dependencies(const char *fmri)
1324 {
1325 scf_handle_t *handle;
1326 scf_service_t *service;
1327 scf_instance_t *inst = NULL;
1328 scf_iter_t *iter;
1329 scf_property_t *prop;
1330 scf_value_t *value;
1331 scf_propertygroup_t *pg;
1332 scf_scope_t *scope;
1333 char type[SCFTYPE_LEN];
1334 char *dependency;
1335 char *servname;
1336 int maxlen;
1337
1338 /*
1339 * Get all required handles and storage.
1340 */
1341 handle = scf_handle_create(SCF_VERSION);
1342 if (handle == NULL)
1343 return;
1344
1345 if (scf_handle_bind(handle) != 0) {
1346 scf_handle_destroy(handle);
1347 return;
1348 }
1349
1350 maxlen = scf_limit(SCF_LIMIT_MAX_VALUE_LENGTH);
1351 if (maxlen == (ssize_t)-1)
1352 maxlen = MAXPATHLEN;
1353
1354 dependency = malloc(maxlen);
1355
1356 service = scf_service_create(handle);
1357
1358 iter = scf_iter_create(handle);
1359
1360 pg = scf_pg_create(handle);
1361
1362 prop = scf_property_create(handle);
1363
1364 value = scf_value_create(handle);
1365
1366 scope = scf_scope_create(handle);
1367
1368 if (service == NULL || iter == NULL || pg == NULL || prop == NULL ||
1369 value == NULL || scope == NULL || dependency == NULL)
1370 goto done;
1371
1372 /*
1373 * We passed in the FMRI for the default instance but for
1374 * some things we need the simple form so construct it. Since
1375 * we reuse the storage that dependency points to, we need to
1376 * use the servname early.
1377 */
1378 (void) snprintf(dependency, maxlen, "%s", fmri + sizeof ("svc:"));
1379 servname = strrchr(dependency, ':');
1380 if (servname == NULL)
1381 goto done;
1382 *servname = '\0';
1383 servname = dependency;
1384
1385 /*
1386 * Setup to iterate over the service property groups, only
1387 * looking at those that are "dependency" types. The "entity"
1388 * property will have the FMRI of the service we are dependent
1389 * on.
1390 */
1391 if (scf_handle_get_scope(handle, SCF_SCOPE_LOCAL, scope) != 0)
1392 goto done;
1393
1394 if (scf_scope_get_service(scope, servname, service) != 0)
1395 goto done;
1396
1397 if (scf_iter_service_pgs(iter, service) != 0)
1398 goto done;
1399
1400 while (scf_iter_next_pg(iter, pg) > 0) {
1401 char *services[2];
1402 /*
1403 * Have a property group for the service. See if it is
1404 * a dependency pg and only do operations on those.
1405 */
1406 if (scf_pg_get_type(pg, type, SCFTYPE_LEN) <= 0)
1407 continue;
1408
1409 if (strncmp(type, SCF_GROUP_DEPENDENCY, SCFTYPE_LEN) != 0)
1410 continue;
1411 /*
1412 * Have a dependency. Attempt to enable it.
1413 */
1414 if (scf_pg_get_property(pg, SCF_PROPERTY_ENTITIES, prop) != 0)
1415 continue;
1416
1417 if (scf_property_get_value(prop, value) != 0)
1418 continue;
1419
1420 services[1] = NULL;
1421
1422 if (scf_value_get_as_string(value, dependency, maxlen) > 0) {
1423 services[0] = dependency;
1424 _check_services(services);
1425 }
1426 }
1427
1428 done:
1429 if (dependency != NULL)
1430 free(dependency);
1431 if (value != NULL)
1432 scf_value_destroy(value);
1433 if (prop != NULL)
1434 scf_property_destroy(prop);
1435 if (pg != NULL)
1436 scf_pg_destroy(pg);
1437 if (iter != NULL)
1438 scf_iter_destroy(iter);
1439 if (scope != NULL)
1440 scf_scope_destroy(scope);
1441 if (inst != NULL)
1442 scf_instance_destroy(inst);
1443 if (service != NULL)
1444 scf_service_destroy(service);
1445
1446 (void) scf_handle_unbind(handle);
1447 scf_handle_destroy(handle);
1448 }
1449
1450 /*
1451 * How long to wait for service to come online
1452 */
1453 #define WAIT_FOR_SERVICE 15
1454
1455 /*
1456 * smb_enable_service()
1457 *
1458 */
1459 static int
smb_enable_service(void)1460 smb_enable_service(void)
1461 {
1462 int i;
1463 int ret = SA_OK;
1464 char *service[] = { SMBD_DEFAULT_INSTANCE_FMRI, NULL };
1465
1466 if (!smb_isonline()) {
1467 /*
1468 * Attempt to start the idmap, and other dependent
1469 * services, first. If it fails, the SMB service will
1470 * ultimately fail so we use that as the error. If we
1471 * don't try to enable idmap, smb won't start the
1472 * first time unless the admin has done it
1473 * manually. The service could be administratively
1474 * disabled so we won't always get started.
1475 */
1476 smb_enable_dependencies(SMBD_DEFAULT_INSTANCE_FMRI);
1477 _check_services(service);
1478
1479 /* Wait for service to come online */
1480 for (i = 0; i < WAIT_FOR_SERVICE; i++) {
1481 if (smb_isonline()) {
1482 ret = SA_OK;
1483 break;
1484 } else if (smb_ismaint()) {
1485 /* maintenance requires help */
1486 ret = SA_SYSTEM_ERR;
1487 break;
1488 } else {
1489 /* try another time */
1490 ret = SA_BUSY;
1491 (void) sleep(1);
1492 }
1493 }
1494 }
1495 return (ret);
1496 }
1497
1498 /*
1499 * smb_set_proto_prop(prop)
1500 *
1501 * check that prop is valid.
1502 */
1503 /*ARGSUSED*/
1504 static int
smb_set_proto_prop(sa_property_t prop)1505 smb_set_proto_prop(sa_property_t prop)
1506 {
1507 int ret = SA_OK;
1508 char *name;
1509 char *value;
1510 int index = -1;
1511 struct smb_proto_option_defs *opt;
1512
1513 name = sa_get_property_attr(prop, "type");
1514 value = sa_get_property_attr(prop, "value");
1515 if (name == NULL || value == NULL) {
1516 ret = SA_NO_SUCH_PROP;
1517 goto out;
1518 }
1519
1520 index = findprotoopt(name);
1521 if (index < 0) {
1522 ret = SA_NO_SUCH_PROP;
1523 goto out;
1524 }
1525 opt = &smb_proto_options[index];
1526
1527 /*
1528 * When setting max_protocol or min_protocol,
1529 * allow"3.1.1" as an alias for "3.11".
1530 */
1531 if (opt->smb_index == SMB_CI_MAX_PROTOCOL ||
1532 opt->smb_index == SMB_CI_MIN_PROTOCOL)
1533 if (strcmp(value, "3.1.1") == 0)
1534 (void) strcpy(value, "3.11");
1535
1536 /* Test for valid value */
1537 if (opt->validator != NULL &&
1538 (ret = opt->validator(index, value)) != SA_OK)
1539 goto out;
1540
1541 /* Save to SMF */
1542 if (smb_config_set(opt->smb_index, value) != 0) {
1543 ret = SA_BAD_VALUE;
1544 goto out;
1545 }
1546
1547 /*
1548 * Specialized refresh mechanisms can
1549 * be flagged in the proto_options and
1550 * processed here.
1551 */
1552 if (opt->refresh & SMB_REFRESH_REFRESH)
1553 (void) smf_refresh_instance(
1554 SMBD_DEFAULT_INSTANCE_FMRI);
1555 else if (opt->refresh & SMB_REFRESH_RESTART)
1556 (void) smf_restart_instance(
1557 SMBD_DEFAULT_INSTANCE_FMRI);
1558
1559 out:
1560 if (name != NULL)
1561 sa_free_attr_string(name);
1562 if (value != NULL)
1563 sa_free_attr_string(value);
1564
1565 return (ret);
1566 }
1567
1568 /*
1569 * smb_get_status()
1570 *
1571 * What is the current status of the smbd? We use the SMF state here.
1572 * Caller must free the returned value.
1573 */
1574
1575 static char *
smb_get_status(void)1576 smb_get_status(void)
1577 {
1578 return (smf_get_state(SMBD_DEFAULT_INSTANCE_FMRI));
1579 }
1580
1581 /*
1582 * This protocol plugin require resource names
1583 */
1584 static uint64_t
smb_share_features(void)1585 smb_share_features(void)
1586 {
1587 return (SA_FEATURE_RESOURCE | SA_FEATURE_ALLOWSUBDIRS |
1588 SA_FEATURE_ALLOWPARDIRS | SA_FEATURE_SERVER);
1589 }
1590
1591 /*
1592 * This should be used to convert smb_share_t to sa_resource_t
1593 * Should only be needed to build transient shares/resources to be
1594 * supplied to sharemgr to display.
1595 */
1596 static int
smb_add_transient(sa_handle_t handle,smb_share_t * si)1597 smb_add_transient(sa_handle_t handle, smb_share_t *si)
1598 {
1599 int err;
1600 sa_share_t share;
1601 sa_group_t group;
1602 sa_resource_t resource;
1603 nvlist_t *nvl;
1604 char *opt;
1605
1606 if (si == NULL)
1607 return (SA_INVALID_NAME);
1608
1609 if ((share = sa_find_share(handle, si->shr_path)) == NULL) {
1610 if ((group = smb_get_defaultgrp(handle)) == NULL)
1611 return (SA_NO_SUCH_GROUP);
1612
1613 share = sa_get_share(group, si->shr_path);
1614 if (share == NULL) {
1615 share = sa_add_share(group, si->shr_path,
1616 SA_SHARE_TRANSIENT, &err);
1617 if (share == NULL)
1618 return (SA_NO_SUCH_PATH);
1619 }
1620 }
1621
1622 /*
1623 * Now handle the resource. Make sure that the resource is
1624 * transient and added to the share.
1625 */
1626 resource = sa_get_share_resource(share, si->shr_name);
1627 if (resource == NULL) {
1628 resource = sa_add_resource(share,
1629 si->shr_name, SA_SHARE_TRANSIENT, &err);
1630 if (resource == NULL)
1631 return (SA_NO_SUCH_RESOURCE);
1632 }
1633
1634 if (si->shr_cmnt[0] != '\0')
1635 (void) sa_set_resource_description(resource, si->shr_cmnt);
1636
1637 if (si->shr_container[0] != '\0')
1638 (void) sa_set_resource_attr(resource, SHOPT_AD_CONTAINER,
1639 si->shr_container);
1640
1641 if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0)
1642 return (SA_NO_MEMORY);
1643
1644 if ((opt = smb_csc_name(si)) != NULL)
1645 err |= nvlist_add_string(nvl, SHOPT_CSC, opt);
1646
1647 opt = (si->shr_flags & SMB_SHRF_ABE) ? "true" : "false";
1648 err |= nvlist_add_string(nvl, SHOPT_ABE, opt);
1649
1650 if ((si->shr_flags & SMB_SHRF_AUTOHOME) == 0) {
1651 opt = (si->shr_flags & SMB_SHRF_GUEST_OK) ? "true" : "false";
1652 err |= nvlist_add_string(nvl, SHOPT_GUEST, opt);
1653 }
1654
1655 if (si->shr_access_ro[0] != '\0')
1656 err |= nvlist_add_string(nvl, SHOPT_RO, si->shr_access_ro);
1657
1658 if (si->shr_access_rw[0] != '\0')
1659 err |= nvlist_add_string(nvl, SHOPT_RW, si->shr_access_rw);
1660
1661 if (si->shr_access_none[0] != '\0')
1662 err |= nvlist_add_string(nvl, SHOPT_NONE, si->shr_access_none);
1663
1664 if (err) {
1665 nvlist_free(nvl);
1666 return (SA_CONFIG_ERR);
1667 }
1668
1669 err = smb_update_optionset_props(handle, resource, nvl);
1670
1671 nvlist_free(nvl);
1672 return (err);
1673 }
1674
1675 /*
1676 * Return smb transient shares.
1677 */
1678 static int
smb_list_transient(sa_handle_t handle)1679 smb_list_transient(sa_handle_t handle)
1680 {
1681 int i, offset;
1682 smb_shrlist_t list;
1683 int res;
1684
1685 if (smb_share_count() <= 0)
1686 return (SA_OK);
1687
1688 offset = 0;
1689 while (smb_share_list(offset, &list) == NERR_Success) {
1690 if (list.sl_cnt == 0)
1691 break;
1692
1693 for (i = 0; i < list.sl_cnt; i++) {
1694 res = smb_add_transient(handle, &(list.sl_shares[i]));
1695 if (res != SA_OK)
1696 return (res);
1697 }
1698 offset += list.sl_cnt;
1699 }
1700
1701 return (SA_OK);
1702 }
1703
1704 /*
1705 * fix_resource_name(share, name, prefix)
1706 *
1707 * Construct a name where the ZFS dataset has the prefix replaced with "name".
1708 */
1709 static char *
fix_resource_name(sa_share_t share,char * name,char * prefix)1710 fix_resource_name(sa_share_t share, char *name, char *prefix)
1711 {
1712 char buf[SA_MAX_RESOURCE_NAME + 1];
1713 char *dataset;
1714 size_t bufsz = SA_MAX_RESOURCE_NAME + 1;
1715 size_t prelen;
1716
1717 if (prefix == NULL)
1718 return (strdup(name));
1719
1720 dataset = sa_get_share_attr(share, "dataset");
1721 if (dataset == NULL)
1722 return (strdup(name));
1723
1724 (void) strlcpy(buf, name, bufsz);
1725 prelen = strlen(prefix);
1726
1727 if (strncmp(dataset, prefix, prelen) == 0)
1728 (void) strlcat(buf, dataset + prelen, bufsz);
1729
1730 sa_free_attr_string(dataset);
1731 sa_fix_resource_name(buf);
1732 return (strdup(buf));
1733 }
1734
1735 /*
1736 * smb_parse_optstring(group, options)
1737 *
1738 * parse a compact option string into individual options. This allows
1739 * ZFS sharesmb and sharemgr "share" command to work. group can be a
1740 * group, a share or a resource.
1741 */
1742 static int
smb_parse_optstring(sa_group_t group,char * options)1743 smb_parse_optstring(sa_group_t group, char *options)
1744 {
1745 char *dup;
1746 char *base;
1747 char *lasts;
1748 char *token;
1749 sa_optionset_t optionset;
1750 sa_group_t parent = NULL;
1751 sa_resource_t resource = NULL;
1752 int iszfs = 0;
1753 int persist = 0;
1754 int need_optionset = 0;
1755 int ret = SA_OK;
1756 sa_property_t prop;
1757
1758 /*
1759 * In order to not attempt to change ZFS properties unless
1760 * absolutely necessary, we never do it in the legacy parsing
1761 * so we need to keep track of this.
1762 */
1763 if (sa_is_share(group)) {
1764 char *zfs;
1765
1766 parent = sa_get_parent_group(group);
1767 if (parent != NULL) {
1768 zfs = sa_get_group_attr(parent, "zfs");
1769 if (zfs != NULL) {
1770 sa_free_attr_string(zfs);
1771 iszfs = 1;
1772 }
1773 }
1774 } else {
1775 iszfs = sa_group_is_zfs(group);
1776 /*
1777 * If a ZFS group, then we need to see if a resource
1778 * name is being set. If so, bail with
1779 * SA_PROP_SHARE_ONLY, so we come back in with a share
1780 * instead of a group.
1781 */
1782 if (iszfs ||
1783 strncmp(options, "name=", sizeof ("name=") - 1) == 0 ||
1784 strstr(options, ",name=") != NULL) {
1785 return (SA_PROP_SHARE_ONLY);
1786 }
1787 }
1788
1789 /* do we have an existing optionset? */
1790 optionset = sa_get_optionset(group, "smb");
1791 if (optionset == NULL) {
1792 /* didn't find existing optionset so create one */
1793 optionset = sa_create_optionset(group, "smb");
1794 if (optionset == NULL)
1795 return (SA_NO_MEMORY);
1796 } else {
1797 /*
1798 * If an optionset already exists, we've come through
1799 * twice so ignore the second time.
1800 */
1801 return (ret);
1802 }
1803
1804 /* We need a copy of options for the next part. */
1805 dup = strdup(options);
1806 if (dup == NULL)
1807 return (SA_NO_MEMORY);
1808
1809 /*
1810 * SMB properties are straightforward and are strings,
1811 * integers or booleans. Properties are separated by
1812 * commas. It will be necessary to parse quotes due to some
1813 * strings not having a restricted characters set.
1814 *
1815 * Note that names will create a resource. For now, if there
1816 * is a set of properties "before" the first name="", those
1817 * properties will be placed on the group.
1818 */
1819 persist = sa_is_persistent(group);
1820 base = dup;
1821 token = dup;
1822 lasts = NULL;
1823 while (token != NULL && ret == SA_OK) {
1824 ret = SA_OK;
1825 token = strtok_r(base, ",", &lasts);
1826 base = NULL;
1827 if (token != NULL) {
1828 char *value;
1829 /*
1830 * All SMB properties have values so there
1831 * MUST be an '=' character. If it doesn't,
1832 * it is a syntax error.
1833 */
1834 value = strchr(token, '=');
1835 if (value != NULL) {
1836 *value++ = '\0';
1837 } else {
1838 ret = SA_SYNTAX_ERR;
1839 break;
1840 }
1841 /*
1842 * We may need to handle a "name" property
1843 * that is a ZFS imposed resource name. Each
1844 * name would trigger getting a new "resource"
1845 * to put properties on. For now, assume no
1846 * "name" property for special handling.
1847 */
1848
1849 if (strcmp(token, SHOPT_NAME) == 0) {
1850 char *prefix;
1851 char *name = NULL;
1852 /*
1853 * We have a name, so now work on the
1854 * resource level. We have a "share"
1855 * in "group" due to the caller having
1856 * added it. If we are called with a
1857 * group, the check for group/share
1858 * at the beginning of this function
1859 * will bail out the parse if there is a
1860 * "name" but no share.
1861 */
1862 if (!iszfs) {
1863 ret = SA_SYNTAX_ERR;
1864 break;
1865 }
1866 /*
1867 * Make sure the parent group has the
1868 * "prefix" property since we will
1869 * need to use this for constructing
1870 * inherited name= values.
1871 */
1872 prefix = sa_get_group_attr(parent, "prefix");
1873 if (prefix == NULL) {
1874 prefix = sa_get_group_attr(parent,
1875 "name");
1876 if (prefix != NULL) {
1877 (void) sa_set_group_attr(parent,
1878 "prefix", prefix);
1879 }
1880 }
1881 name = fix_resource_name((sa_share_t)group,
1882 value, prefix);
1883 if (name != NULL) {
1884 resource = sa_add_resource(
1885 (sa_share_t)group, name,
1886 SA_SHARE_TRANSIENT, &ret);
1887 sa_free_attr_string(name);
1888 } else {
1889 ret = SA_NO_MEMORY;
1890 }
1891 if (prefix != NULL)
1892 sa_free_attr_string(prefix);
1893
1894 /* A resource level optionset is needed */
1895
1896 need_optionset = 1;
1897 if (resource == NULL) {
1898 ret = SA_NO_MEMORY;
1899 break;
1900 }
1901 continue;
1902 }
1903
1904 if (iszfs && strcmp(token, SHOPT_DESCRIPTION) == 0) {
1905 if (resource == NULL)
1906 (void) sa_set_share_description(
1907 (sa_share_t)group, value);
1908 else
1909 (void) sa_set_resource_description(
1910 resource, value);
1911 continue;
1912 }
1913
1914 if (need_optionset) {
1915 optionset = sa_create_optionset(resource,
1916 "smb");
1917 need_optionset = 0;
1918 }
1919
1920 prop = sa_create_property(token, value);
1921 if (prop == NULL)
1922 ret = SA_NO_MEMORY;
1923 else
1924 ret = sa_add_property(optionset, prop);
1925 if (ret != SA_OK)
1926 break;
1927 if (!iszfs)
1928 ret = sa_commit_properties(optionset, !persist);
1929 }
1930 }
1931 free(dup);
1932 return (ret);
1933 }
1934
1935 /*
1936 * smb_sprint_option(rbuff, rbuffsize, incr, prop, sep)
1937 *
1938 * provides a mechanism to format SMB properties into legacy output
1939 * format. If the buffer would overflow, it is reallocated and grown
1940 * as appropriate. Special cases of converting internal form of values
1941 * to those used by "share" are done. this function does one property
1942 * at a time.
1943 */
1944
1945 static void
smb_sprint_option(char ** rbuff,size_t * rbuffsize,size_t incr,sa_property_t prop,int sep)1946 smb_sprint_option(char **rbuff, size_t *rbuffsize, size_t incr,
1947 sa_property_t prop, int sep)
1948 {
1949 char *name;
1950 char *value;
1951 int curlen;
1952 char *buff = *rbuff;
1953 size_t buffsize = *rbuffsize;
1954
1955 name = sa_get_property_attr(prop, "type");
1956 value = sa_get_property_attr(prop, "value");
1957 if (buff != NULL)
1958 curlen = strlen(buff);
1959 else
1960 curlen = 0;
1961 if (name != NULL) {
1962 int len;
1963 len = strlen(name) + sep;
1964
1965 /*
1966 * A future RFE would be to replace this with more
1967 * generic code and to possibly handle more types.
1968 *
1969 * For now, everything else is treated as a string. If
1970 * we get any properties that aren't exactly
1971 * name/value pairs, we may need to
1972 * interpret/transform.
1973 */
1974 if (value != NULL)
1975 len += 1 + strlen(value);
1976
1977 while (buffsize <= (curlen + len)) {
1978 /* need more room */
1979 buffsize += incr;
1980 buff = realloc(buff, buffsize);
1981 *rbuff = buff;
1982 *rbuffsize = buffsize;
1983 if (buff == NULL) {
1984 /* realloc failed so free everything */
1985 if (*rbuff != NULL)
1986 free(*rbuff);
1987 goto err;
1988 }
1989 }
1990 if (buff == NULL)
1991 goto err;
1992 (void) snprintf(buff + curlen, buffsize - curlen,
1993 "%s%s=%s", sep ? "," : "",
1994 name, value != NULL ? value : "\"\"");
1995
1996 }
1997 err:
1998 if (name != NULL)
1999 sa_free_attr_string(name);
2000 if (value != NULL)
2001 sa_free_attr_string(value);
2002 }
2003
2004 /*
2005 * smb_format_resource_options(resource, hier)
2006 *
2007 * format all the options on the group into a flattened option
2008 * string. If hier is non-zero, walk up the tree to get inherited
2009 * options.
2010 */
2011
2012 static char *
smb_format_options(sa_group_t group,int hier)2013 smb_format_options(sa_group_t group, int hier)
2014 {
2015 sa_optionset_t options = NULL;
2016 sa_property_t prop;
2017 int sep = 0;
2018 char *buff;
2019 size_t buffsize;
2020
2021
2022 buff = malloc(OPT_CHUNK);
2023 if (buff == NULL)
2024 return (NULL);
2025
2026 buff[0] = '\0';
2027 buffsize = OPT_CHUNK;
2028
2029 /*
2030 * We may have a an optionset relative to this item. format
2031 * these if we find them and then add any security definitions.
2032 */
2033
2034 options = sa_get_derived_optionset(group, "smb", hier);
2035
2036 /*
2037 * do the default set first but skip any option that is also
2038 * in the protocol specific optionset.
2039 */
2040 if (options != NULL) {
2041 for (prop = sa_get_property(options, NULL);
2042 prop != NULL; prop = sa_get_next_property(prop)) {
2043 /*
2044 * use this one since we skipped any
2045 * of these that were also in
2046 * optdefault
2047 */
2048 smb_sprint_option(&buff, &buffsize, OPT_CHUNK,
2049 prop, sep);
2050 if (buff == NULL) {
2051 /*
2052 * buff could become NULL if there
2053 * isn't enough memory for
2054 * smb_sprint_option to realloc()
2055 * as necessary. We can't really
2056 * do anything about it at this
2057 * point so we return NULL. The
2058 * caller should handle the
2059 * failure.
2060 */
2061 if (options != NULL)
2062 sa_free_derived_optionset(
2063 options);
2064 return (buff);
2065 }
2066 sep = 1;
2067 }
2068 }
2069
2070 if (options != NULL)
2071 sa_free_derived_optionset(options);
2072 return (buff);
2073 }
2074
2075 /*
2076 * smb_rename_resource(resource, newname)
2077 *
2078 * Change the current exported name of the resource to newname.
2079 */
2080 /*ARGSUSED*/
2081 int
smb_rename_resource(sa_handle_t handle,sa_resource_t resource,char * newname)2082 smb_rename_resource(sa_handle_t handle, sa_resource_t resource, char *newname)
2083 {
2084 int ret = SA_OK;
2085 int err;
2086 char *oldname;
2087
2088 if (!smb_isonline())
2089 return (SA_OK);
2090
2091 oldname = sa_get_resource_attr(resource, "name");
2092 if (oldname == NULL)
2093 return (SA_NO_SUCH_RESOURCE);
2094
2095 err = smb_share_rename(oldname, newname);
2096
2097 sa_free_attr_string(oldname);
2098
2099 /* improve error values somewhat */
2100 switch (err) {
2101 case NERR_Success:
2102 break;
2103 case NERR_InternalError:
2104 ret = SA_SYSTEM_ERR;
2105 break;
2106 case NERR_DuplicateShare:
2107 ret = SA_DUPLICATE_NAME;
2108 break;
2109 default:
2110 ret = SA_CONFIG_ERR;
2111 break;
2112 }
2113
2114 return (ret);
2115 }
2116
2117 static int
smb_build_shareinfo(sa_share_t share,sa_resource_t resource,smb_share_t * si)2118 smb_build_shareinfo(sa_share_t share, sa_resource_t resource, smb_share_t *si)
2119 {
2120 sa_optionset_t opts;
2121 char *path;
2122 char *rname;
2123 char *val = NULL;
2124 char csc_value[SMB_CSC_BUFSZ];
2125 char strbuf[sizeof ("required")];
2126
2127 bzero(si, sizeof (smb_share_t));
2128
2129 if ((path = sa_get_share_attr(share, "path")) == NULL)
2130 return (SA_NO_SUCH_PATH);
2131
2132 if ((rname = sa_get_resource_attr(resource, "name")) == NULL) {
2133 sa_free_attr_string(path);
2134 return (SA_NO_SUCH_RESOURCE);
2135 }
2136
2137 (void) strlcpy(si->shr_path, path, sizeof (si->shr_path));
2138 (void) strlcpy(si->shr_name, rname, sizeof (si->shr_name));
2139 sa_free_attr_string(path);
2140 sa_free_attr_string(rname);
2141
2142 val = sa_get_resource_description(resource);
2143 if (val == NULL)
2144 val = sa_get_share_description(share);
2145
2146 if (val != NULL) {
2147 (void) strlcpy(si->shr_cmnt, val, sizeof (si->shr_cmnt));
2148 sa_free_share_description(val);
2149 }
2150
2151 si->shr_flags = (sa_is_persistent(share))
2152 ? SMB_SHRF_PERM : SMB_SHRF_TRANS;
2153
2154 opts = sa_get_derived_optionset(resource, SMB_PROTOCOL_NAME, 1);
2155 if (opts == NULL)
2156 return (SA_OK);
2157
2158 if (smb_saprop_getbool(opts, SHOPT_CATIA, B_FALSE))
2159 si->shr_flags |= SMB_SHRF_CATIA;
2160
2161 if (smb_saprop_getbool(opts, SHOPT_ABE, B_FALSE))
2162 si->shr_flags |= SMB_SHRF_ABE;
2163
2164 if (smb_saprop_getbool(opts, SHOPT_GUEST, B_FALSE))
2165 si->shr_flags |= SMB_SHRF_GUEST_OK;
2166
2167 if (smb_saprop_getbool(opts, SHOPT_DFSROOT, B_FALSE))
2168 si->shr_flags |= SMB_SHRF_DFSROOT;
2169
2170 if (smb_saprop_getbool(opts, SHOPT_CA, B_FALSE))
2171 si->shr_flags |= SMB_SHRF_CA;
2172
2173 if (smb_saprop_getbool(opts, SHOPT_FSO, B_FALSE))
2174 si->shr_flags |= SMB_SHRF_FSO;
2175
2176 /* Quotas are enabled by default. */
2177 if (smb_saprop_getbool(opts, SHOPT_QUOTAS, B_TRUE))
2178 si->shr_flags |= SMB_SHRF_QUOTAS;
2179
2180 if (smb_saprop_getstr(opts, SHOPT_ENCRYPT, strbuf, sizeof (strbuf)))
2181 smb_cfg_set_require(strbuf, &si->shr_encrypt);
2182
2183 (void) smb_saprop_getstr(opts, SHOPT_AD_CONTAINER, si->shr_container,
2184 sizeof (si->shr_container));
2185
2186 if (smb_saprop_getstr(opts, SHOPT_CSC, csc_value, sizeof (csc_value)))
2187 smb_csc_option(csc_value, si);
2188
2189 if (smb_saprop_getstr(opts, SHOPT_RO, si->shr_access_ro,
2190 sizeof (si->shr_access_ro)))
2191 si->shr_flags |= SMB_SHRF_ACC_RO;
2192
2193 if (smb_saprop_getstr(opts, SHOPT_RW, si->shr_access_rw,
2194 sizeof (si->shr_access_rw)))
2195 si->shr_flags |= SMB_SHRF_ACC_RW;
2196
2197 if (smb_saprop_getstr(opts, SHOPT_NONE, si->shr_access_none,
2198 sizeof (si->shr_access_none)))
2199 si->shr_flags |= SMB_SHRF_ACC_NONE;
2200
2201 sa_free_derived_optionset(opts);
2202 return (SA_OK);
2203 }
2204
2205 /*
2206 * Map a client-side caching (CSC) option to the appropriate share
2207 * flag. Only one option is allowed; an error will be logged if
2208 * multiple options have been specified. We don't need to do anything
2209 * about multiple values here because the SRVSVC will not recognize
2210 * a value containing multiple flags and will return the default value.
2211 *
2212 * If the option value is not recognized, it will be ignored: invalid
2213 * values will typically be caught and rejected by sharemgr.
2214 */
2215 static void
smb_csc_option(const char * value,smb_share_t * si)2216 smb_csc_option(const char *value, smb_share_t *si)
2217 {
2218 char buf[SMB_CSC_BUFSZ];
2219 int i;
2220
2221 for (i = 0; i < (sizeof (cscopt) / sizeof (cscopt[0])); ++i) {
2222 if (strcasecmp(value, cscopt[i].value) == 0) {
2223 si->shr_flags |= cscopt[i].flag;
2224 break;
2225 }
2226 }
2227
2228 switch (si->shr_flags & SMB_SHRF_CSC_MASK) {
2229 case 0:
2230 case SMB_SHRF_CSC_DISABLED:
2231 case SMB_SHRF_CSC_MANUAL:
2232 case SMB_SHRF_CSC_AUTO:
2233 case SMB_SHRF_CSC_VDO:
2234 break;
2235
2236 default:
2237 buf[0] = '\0';
2238
2239 for (i = 0; i < (sizeof (cscopt) / sizeof (cscopt[0])); ++i) {
2240 if (si->shr_flags & cscopt[i].flag) {
2241 (void) strlcat(buf, " ", SMB_CSC_BUFSZ);
2242 (void) strlcat(buf, cscopt[i].value,
2243 SMB_CSC_BUFSZ);
2244 }
2245 }
2246
2247 syslog(LOG_ERR, "csc option conflict:%s", buf);
2248 break;
2249 }
2250 }
2251
2252 /*
2253 * Return the option name for the first CSC flag (there should be only
2254 * one) encountered in the share flags.
2255 */
2256 static char *
smb_csc_name(const smb_share_t * si)2257 smb_csc_name(const smb_share_t *si)
2258 {
2259 int i;
2260
2261 for (i = 0; i < (sizeof (cscopt) / sizeof (cscopt[0])); ++i) {
2262 if (si->shr_flags & cscopt[i].flag)
2263 return (cscopt[i].value);
2264 }
2265
2266 return (NULL);
2267 }
2268
2269 /*
2270 * smb_get_defaultgrp
2271 *
2272 * If default group for CIFS shares (i.e. "smb") exists
2273 * then it will return the group handle, otherwise it will
2274 * create the group and return the handle.
2275 *
2276 * All the shares created by CIFS clients (this is only possible
2277 * via RPC) will be added to "smb" groups.
2278 */
2279 static sa_group_t
smb_get_defaultgrp(sa_handle_t handle)2280 smb_get_defaultgrp(sa_handle_t handle)
2281 {
2282 sa_group_t group = NULL;
2283 int err;
2284
2285 group = sa_get_group(handle, SMB_DEFAULT_SHARE_GROUP);
2286 if (group != NULL)
2287 return (group);
2288
2289 group = sa_create_group(handle, SMB_DEFAULT_SHARE_GROUP, &err);
2290 if (group == NULL)
2291 return (NULL);
2292
2293 if (sa_create_optionset(group, SMB_DEFAULT_SHARE_GROUP) == NULL) {
2294 (void) sa_remove_group(group);
2295 group = NULL;
2296 }
2297
2298 return (group);
2299 }
2300
2301 /*
2302 * Checks to see if the command args are the supported substitution specifier.
2303 * i.e. <cmd> %U %S
2304 */
2305 static int
cmd_validator(int index,char * value)2306 cmd_validator(int index, char *value)
2307 {
2308 char cmd[MAXPATHLEN];
2309 char *ptr, *v;
2310 boolean_t skip_cmdname;
2311
2312 if (string_length_check_validator(index, value) != SA_OK)
2313 return (SA_BAD_VALUE);
2314
2315 if (*value == '\0')
2316 return (SA_OK);
2317
2318 (void) strlcpy(cmd, value, sizeof (cmd));
2319
2320 ptr = cmd;
2321 skip_cmdname = B_TRUE;
2322 do {
2323 if ((v = strsep(&ptr, " ")) == NULL)
2324 break;
2325
2326 if (*v != '\0') {
2327
2328 if (skip_cmdname) {
2329 skip_cmdname = B_FALSE;
2330 continue;
2331 }
2332
2333 if ((strlen(v) != 2) || *v != '%')
2334 return (SA_BAD_VALUE);
2335
2336 if (strpbrk(v, SMB_VALID_SUB_CHRS) == NULL)
2337 return (SA_BAD_VALUE);
2338 }
2339
2340 } while (v != NULL);
2341
2342 /*
2343 * If skip_cmdname is still true then the string contains
2344 * only spaces. Don't allow such a string.
2345 */
2346 if (skip_cmdname)
2347 return (SA_BAD_VALUE);
2348
2349 return (SA_OK);
2350 }
2351
2352 /*ARGSUSED*/
2353 static int
disposition_validator(int index,char * value)2354 disposition_validator(int index, char *value)
2355 {
2356 if (value == NULL)
2357 return (SA_BAD_VALUE);
2358
2359 if (*value == '\0')
2360 return (SA_OK);
2361
2362 if ((strcasecmp(value, SMB_EXEC_DISP_CONTINUE) == 0) ||
2363 (strcasecmp(value, SMB_EXEC_DISP_TERMINATE) == 0))
2364 return (SA_OK);
2365
2366 return (SA_BAD_VALUE);
2367 }
2368
2369 static int
protocol_validator(int index,char * value)2370 protocol_validator(int index, char *value)
2371 {
2372 struct smb_proto_option_defs *opt;
2373 smb_cfg_val_t encrypt;
2374 uint32_t max;
2375 uint32_t min;
2376 uint32_t val;
2377
2378 if (value == NULL)
2379 return (SA_BAD_VALUE);
2380
2381 /* Allow setting back to empty (use defaults) */
2382 if (*value == '\0')
2383 return (SA_OK);
2384
2385 val = smb_convert_version_str(value);
2386 if (val == 0)
2387 return (SA_BAD_VALUE);
2388
2389 /*
2390 * We don't want people who care enough about protecting their data
2391 * by requiring encryption to accidentally expose their data by
2392 * lowering the max protocol, so prevent them from going below 3.0
2393 * if encryption is required.
2394 * Also, ensure that max_protocol >= min_protocol.
2395 */
2396 opt = &smb_proto_options[index];
2397 switch (opt->smb_index) {
2398
2399 case SMB_CI_MAX_PROTOCOL:
2400
2401 encrypt = smb_config_get_require(SMB_CI_ENCRYPT);
2402 if (encrypt == SMB_CONFIG_REQUIRED && val < SMB_VERS_3_0) {
2403 syslog(LOG_ERR, "Cannot set smbd/max_protocol below 3.0"
2404 " while smbd/encrypt == required.");
2405 return (SA_VALUE_CONFLICT);
2406 }
2407 min = smb_config_get_min_protocol();
2408 if (val < min) {
2409 syslog(LOG_ERR, "Cannot set smbd/max_protocol to less"
2410 " than smbd/min_protocol.");
2411 return (SA_VALUE_CONFLICT);
2412 }
2413 break;
2414
2415 case SMB_CI_MIN_PROTOCOL:
2416
2417 max = smb_config_get_max_protocol();
2418 if (val > max) {
2419 syslog(LOG_ERR, "Cannot set smbd/min_protocol to more"
2420 " than smbd/max_protocol.");
2421 return (SA_VALUE_CONFLICT);
2422 }
2423 break;
2424
2425 default:
2426 syslog(LOG_ERR, "Unexpected smb protocol validator index %d",
2427 opt->smb_index);
2428 return (SA_BAD_VALUE);
2429 }
2430
2431 return (SA_OK);
2432 }
2433
2434 /*ARGSUSED*/
2435 static int
ciphers_validator(int index,char * value)2436 ciphers_validator(int index, char *value)
2437 {
2438
2439 if (value == NULL)
2440 return (SA_BAD_VALUE);
2441
2442 /* Allow setting back to empty (use defaults) */
2443 if (*value == '\0')
2444 return (SA_OK);
2445
2446 if (smb_convert_encrypt_ciphers(value) <= 0)
2447 return (SA_BAD_VALUE);
2448
2449 return (SA_OK);
2450 }
2451
2452 /*
2453 * Updates the optionset properties of the share resource.
2454 * The properties are given as a list of name-value pair.
2455 * The name argument should be the optionset property name and the value
2456 * should be a valid value for the specified property.
2457 *
2458 * When calling this function for permanent shares, the caller must also
2459 * call sa_commit_properties() to commit the changes to SMF.
2460 */
2461 static int
smb_update_optionset_props(sa_handle_t handle,sa_resource_t resource,nvlist_t * nvl)2462 smb_update_optionset_props(sa_handle_t handle, sa_resource_t resource,
2463 nvlist_t *nvl)
2464 {
2465 sa_property_t prop;
2466 sa_optionset_t opts;
2467 int err = SA_OK;
2468 nvpair_t *cur;
2469 char *name, *val;
2470
2471 if ((opts = sa_get_optionset(resource, SMB_PROTOCOL_NAME)) == NULL) {
2472 opts = sa_create_optionset(resource, SMB_PROTOCOL_NAME);
2473 if (opts == NULL)
2474 return (SA_CONFIG_ERR);
2475 }
2476
2477 cur = nvlist_next_nvpair(nvl, NULL);
2478 while (cur != NULL) {
2479 name = nvpair_name(cur);
2480 err = nvpair_value_string(cur, &val);
2481 if ((err != 0) || (name == NULL) || (val == NULL)) {
2482 err = SA_CONFIG_ERR;
2483 break;
2484 }
2485
2486 prop = NULL;
2487 if ((prop = sa_get_property(opts, name)) == NULL) {
2488 prop = sa_create_property(name, val);
2489 if (prop != NULL) {
2490 err = sa_valid_property(handle, opts,
2491 SMB_PROTOCOL_NAME, prop);
2492 if (err != SA_OK) {
2493 (void) sa_remove_property(prop);
2494 break;
2495 }
2496 }
2497 err = sa_add_property(opts, prop);
2498 if (err != SA_OK)
2499 break;
2500 } else {
2501 err = sa_update_property(prop, val);
2502 if (err != SA_OK)
2503 break;
2504 }
2505
2506 cur = nvlist_next_nvpair(nvl, cur);
2507 }
2508
2509 return (err);
2510 }
2511
2512 static boolean_t
smb_saprop_getbool(sa_optionset_t opts,char * propname,boolean_t def)2513 smb_saprop_getbool(sa_optionset_t opts, char *propname, boolean_t def)
2514 {
2515 sa_property_t prop;
2516 char *val;
2517 boolean_t ret = def;
2518
2519 prop = sa_get_property(opts, propname);
2520 if ((val = sa_get_property_attr(prop, "value")) != NULL) {
2521 if (def) {
2522 /* Default is true, ret false if... */
2523 if ((strcasecmp(val, "false") == 0) ||
2524 (strcmp(val, "0") == 0))
2525 ret = B_FALSE;
2526 } else {
2527 /* Default is false, ret true if... */
2528 if ((strcasecmp(val, "true") == 0) ||
2529 (strcmp(val, "1") == 0))
2530 ret = B_TRUE;
2531 }
2532 free(val);
2533 }
2534
2535 return (ret);
2536 }
2537
2538 static boolean_t
smb_saprop_getstr(sa_optionset_t opts,char * propname,char * buf,size_t bufsz)2539 smb_saprop_getstr(sa_optionset_t opts, char *propname, char *buf, size_t bufsz)
2540 {
2541 sa_property_t prop;
2542 char *val;
2543
2544 prop = sa_get_property(opts, propname);
2545 if ((val = sa_get_property_attr(prop, "value")) != NULL) {
2546 (void) strlcpy(buf, val, bufsz);
2547 free(val);
2548 return (B_TRUE);
2549 }
2550
2551 return (B_FALSE);
2552 }
2553