xref: /titanic_50/usr/src/uts/common/fs/smbsrv/smb_session.c (revision a90cf9f29973990687fa61de9f1f6ea22e924e40)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
24  */
25 
26 #include <sys/atomic.h>
27 #include <sys/synch.h>
28 #include <sys/types.h>
29 #include <sys/sdt.h>
30 #include <sys/random.h>
31 #include <smbsrv/netbios.h>
32 #include <smbsrv/smb2_kproto.h>
33 #include <smbsrv/string.h>
34 #include <netinet/tcp.h>
35 
36 /* How many iovec we'll handle as a local array (no allocation) */
37 #define	SMB_LOCAL_IOV_MAX	16
38 
39 #define	SMB_NEW_KID()	atomic_inc_64_nv(&smb_kids)
40 
41 static volatile uint64_t smb_kids;
42 
43 /*
44  * We track the keepalive in minutes, but this constant
45  * specifies it in seconds, so convert to minutes.
46  */
47 uint32_t smb_keep_alive = SMB_PI_KEEP_ALIVE_MIN / 60;
48 
49 static int  smbsr_newrq_initial(smb_request_t *);
50 
51 static void smb_session_cancel(smb_session_t *);
52 static int smb_session_reader(smb_session_t *);
53 static int smb_session_xprt_puthdr(smb_session_t *,
54     uint8_t msg_type, uint32_t msg_len,
55     uint8_t *dst, size_t dstlen);
56 static smb_tree_t *smb_session_get_tree(smb_session_t *, smb_tree_t *);
57 static void smb_session_logoff(smb_session_t *);
58 static void smb_request_init_command_mbuf(smb_request_t *sr);
59 static void smb_session_genkey(smb_session_t *);
60 
61 void
smb_session_timers(smb_llist_t * ll)62 smb_session_timers(smb_llist_t *ll)
63 {
64 	smb_session_t	*session;
65 
66 	smb_llist_enter(ll, RW_READER);
67 	session = smb_llist_head(ll);
68 	while (session != NULL) {
69 		/*
70 		 * Walk through the table and decrement each keep_alive
71 		 * timer that has not timed out yet. (keepalive > 0)
72 		 */
73 		SMB_SESSION_VALID(session);
74 		if (session->keep_alive &&
75 		    (session->keep_alive != (uint32_t)-1))
76 			session->keep_alive--;
77 		session = smb_llist_next(ll, session);
78 	}
79 	smb_llist_exit(ll);
80 }
81 
82 void
smb_session_correct_keep_alive_values(smb_llist_t * ll,uint32_t new_keep_alive)83 smb_session_correct_keep_alive_values(smb_llist_t *ll, uint32_t new_keep_alive)
84 {
85 	smb_session_t		*sn;
86 
87 	/*
88 	 * Caller specifies seconds, but we track in minutes, so
89 	 * convert to minutes (rounded up).
90 	 */
91 	new_keep_alive = (new_keep_alive + 59) / 60;
92 
93 	if (new_keep_alive == smb_keep_alive)
94 		return;
95 	/*
96 	 * keep alive == 0 means do not drop connection if it's idle
97 	 */
98 	smb_keep_alive = (new_keep_alive) ? new_keep_alive : -1;
99 
100 	/*
101 	 * Walk through the table and set each session to the new keep_alive
102 	 * value if they have not already timed out.  Block clock interrupts.
103 	 */
104 	smb_llist_enter(ll, RW_READER);
105 	sn = smb_llist_head(ll);
106 	while (sn != NULL) {
107 		SMB_SESSION_VALID(sn);
108 		if (sn->keep_alive != 0)
109 			sn->keep_alive = new_keep_alive;
110 		sn = smb_llist_next(ll, sn);
111 	}
112 	smb_llist_exit(ll);
113 }
114 
115 /*
116  * Send a session message - supports SMB-over-NBT and SMB-over-TCP.
117  * If an mbuf chain is provided (optional), it will be freed and
118  * set to NULL -- unconditionally!  (error or not)
119  *
120  * Builds a I/O vector (uio/iov) to do the send from mbufs, plus one
121  * segment for the 4-byte NBT header.
122  */
123 int
smb_session_send(smb_session_t * session,uint8_t nbt_type,mbuf_chain_t * mbc)124 smb_session_send(smb_session_t *session, uint8_t nbt_type, mbuf_chain_t *mbc)
125 {
126 	uio_t		uio;
127 	iovec_t		local_iov[SMB_LOCAL_IOV_MAX];
128 	iovec_t		*alloc_iov = NULL;
129 	int		alloc_sz = 0;
130 	mbuf_t		*m;
131 	uint8_t		nbt_hdr[NETBIOS_HDR_SZ];
132 	uint32_t	nbt_len;
133 	int		i, nseg;
134 	int		rc;
135 
136 	switch (session->s_state) {
137 	case SMB_SESSION_STATE_DISCONNECTED:
138 	case SMB_SESSION_STATE_TERMINATED:
139 		rc = ENOTCONN;
140 		goto out;
141 	default:
142 		break;
143 	}
144 
145 	/*
146 	 * Setup the IOV.  First, count the number of IOV segments
147 	 * (plus one for the NBT header) and decide whether we
148 	 * need to allocate an iovec or can use local_iov;
149 	 */
150 	bzero(&uio, sizeof (uio));
151 	nseg = 1;
152 	m = (mbc != NULL) ? mbc->chain : NULL;
153 	while (m != NULL) {
154 		nseg++;
155 		m = m->m_next;
156 	}
157 	if (nseg <= SMB_LOCAL_IOV_MAX) {
158 		uio.uio_iov = local_iov;
159 	} else {
160 		alloc_sz = nseg * sizeof (iovec_t);
161 		alloc_iov = kmem_alloc(alloc_sz, KM_SLEEP);
162 		uio.uio_iov = alloc_iov;
163 	}
164 	uio.uio_iovcnt = nseg;
165 	uio.uio_segflg = UIO_SYSSPACE;
166 	uio.uio_extflg = UIO_COPY_DEFAULT;
167 
168 	/*
169 	 * Build the iov list, meanwhile computing the length of
170 	 * the SMB payload (to put in the NBT header).
171 	 */
172 	uio.uio_iov[0].iov_base = (void *)nbt_hdr;
173 	uio.uio_iov[0].iov_len = sizeof (nbt_hdr);
174 	i = 1;
175 	nbt_len = 0;
176 	m = (mbc != NULL) ? mbc->chain : NULL;
177 	while (m != NULL) {
178 		uio.uio_iov[i].iov_base = m->m_data;
179 		uio.uio_iov[i++].iov_len = m->m_len;
180 		nbt_len += m->m_len;
181 		m = m->m_next;
182 	}
183 	ASSERT3S(i, ==, nseg);
184 
185 	/*
186 	 * Set the NBT header, set uio_resid
187 	 */
188 	uio.uio_resid = nbt_len + NETBIOS_HDR_SZ;
189 	rc = smb_session_xprt_puthdr(session, nbt_type, nbt_len,
190 	    nbt_hdr, NETBIOS_HDR_SZ);
191 	if (rc != 0)
192 		goto out;
193 
194 	smb_server_add_txb(session->s_server, (int64_t)uio.uio_resid);
195 	rc = smb_net_send_uio(session, &uio);
196 
197 out:
198 	if (alloc_iov != NULL)
199 		kmem_free(alloc_iov, alloc_sz);
200 	if ((mbc != NULL) && (mbc->chain != NULL)) {
201 		m_freem(mbc->chain);
202 		mbc->chain = NULL;
203 		mbc->flags = 0;
204 	}
205 	return (rc);
206 }
207 
208 /*
209  * Read, process and respond to a NetBIOS session request.
210  *
211  * A NetBIOS session must be established for SMB-over-NetBIOS.  Validate
212  * the calling and called name format and save the client NetBIOS name,
213  * which is used when a NetBIOS session is established to check for and
214  * cleanup leftover state from a previous session.
215  *
216  * Session requests are not valid for SMB-over-TCP, which is unfortunate
217  * because without the client name leftover state cannot be cleaned up
218  * if the client is behind a NAT server.
219  */
220 static int
smb_netbios_session_request(struct smb_session * session)221 smb_netbios_session_request(struct smb_session *session)
222 {
223 	int			rc;
224 	char			*calling_name;
225 	char			*called_name;
226 	char 			client_name[NETBIOS_NAME_SZ];
227 	struct mbuf_chain 	mbc;
228 	char 			*names = NULL;
229 	smb_wchar_t		*wbuf = NULL;
230 	smb_xprt_t		hdr;
231 	char *p;
232 	int rc1, rc2;
233 
234 	session->keep_alive = smb_keep_alive;
235 
236 	if ((rc = smb_session_xprt_gethdr(session, &hdr)) != 0)
237 		return (rc);
238 
239 	DTRACE_PROBE2(receive__session__req__xprthdr, struct session *, session,
240 	    smb_xprt_t *, &hdr);
241 
242 	if ((hdr.xh_type != SESSION_REQUEST) ||
243 	    (hdr.xh_length != NETBIOS_SESSION_REQUEST_DATA_LENGTH)) {
244 		DTRACE_PROBE1(receive__session__req__failed,
245 		    struct session *, session);
246 		return (EINVAL);
247 	}
248 
249 	names = kmem_alloc(hdr.xh_length, KM_SLEEP);
250 
251 	if ((rc = smb_sorecv(session->sock, names, hdr.xh_length)) != 0) {
252 		kmem_free(names, hdr.xh_length);
253 		DTRACE_PROBE1(receive__session__req__failed,
254 		    struct session *, session);
255 		return (rc);
256 	}
257 
258 	DTRACE_PROBE3(receive__session__req__data, struct session *, session,
259 	    char *, names, uint32_t, hdr.xh_length);
260 
261 	called_name = &names[0];
262 	calling_name = &names[NETBIOS_ENCODED_NAME_SZ + 2];
263 
264 	rc1 = netbios_name_isvalid(called_name, 0);
265 	rc2 = netbios_name_isvalid(calling_name, client_name);
266 
267 	if (rc1 == 0 || rc2 == 0) {
268 
269 		DTRACE_PROBE3(receive__invalid__session__req,
270 		    struct session *, session, char *, names,
271 		    uint32_t, hdr.xh_length);
272 
273 		kmem_free(names, hdr.xh_length);
274 		MBC_INIT(&mbc, MAX_DATAGRAM_LENGTH);
275 		(void) smb_mbc_encodef(&mbc, "b",
276 		    DATAGRAM_INVALID_SOURCE_NAME_FORMAT);
277 		(void) smb_session_send(session, NEGATIVE_SESSION_RESPONSE,
278 		    &mbc);
279 		return (EINVAL);
280 	}
281 
282 	DTRACE_PROBE3(receive__session__req__calling__decoded,
283 	    struct session *, session,
284 	    char *, calling_name, char *, client_name);
285 
286 	/*
287 	 * The client NetBIOS name is in oem codepage format.
288 	 * We need to convert it to unicode and store it in
289 	 * multi-byte format.  We also need to strip off any
290 	 * spaces added as part of the NetBIOS name encoding.
291 	 */
292 	wbuf = kmem_alloc((SMB_PI_MAX_HOST * sizeof (smb_wchar_t)), KM_SLEEP);
293 	(void) oemtoucs(wbuf, client_name, SMB_PI_MAX_HOST, OEM_CPG_850);
294 	(void) smb_wcstombs(session->workstation, wbuf, SMB_PI_MAX_HOST);
295 	kmem_free(wbuf, (SMB_PI_MAX_HOST * sizeof (smb_wchar_t)));
296 
297 	if ((p = strchr(session->workstation, ' ')) != 0)
298 		*p = '\0';
299 
300 	kmem_free(names, hdr.xh_length);
301 	return (smb_session_send(session, POSITIVE_SESSION_RESPONSE, NULL));
302 }
303 
304 /*
305  * Read 4-byte header from the session socket and build an in-memory
306  * session transport header.  See smb_xprt_t definition for header
307  * format information.
308  *
309  * Direct hosted NetBIOS-less SMB (SMB-over-TCP) uses port 445.  The
310  * first byte of the four-byte header must be 0 and the next three
311  * bytes contain the length of the remaining data.
312  */
313 int
smb_session_xprt_gethdr(smb_session_t * session,smb_xprt_t * ret_hdr)314 smb_session_xprt_gethdr(smb_session_t *session, smb_xprt_t *ret_hdr)
315 {
316 	int		rc;
317 	unsigned char	buf[NETBIOS_HDR_SZ];
318 
319 	if ((rc = smb_sorecv(session->sock, buf, NETBIOS_HDR_SZ)) != 0)
320 		return (rc);
321 
322 	switch (session->s_local_port) {
323 	case IPPORT_NETBIOS_SSN:
324 		ret_hdr->xh_type = buf[0];
325 		ret_hdr->xh_length = (((uint32_t)buf[1] & 1) << 16) |
326 		    ((uint32_t)buf[2] << 8) |
327 		    ((uint32_t)buf[3]);
328 		break;
329 
330 	case IPPORT_SMB:
331 		ret_hdr->xh_type = buf[0];
332 
333 		if (ret_hdr->xh_type != 0) {
334 			cmn_err(CE_WARN, "invalid NBT type (%u) from %s",
335 			    ret_hdr->xh_type, session->ip_addr_str);
336 			return (EPROTO);
337 		}
338 
339 		ret_hdr->xh_length = ((uint32_t)buf[1] << 16) |
340 		    ((uint32_t)buf[2] << 8) |
341 		    ((uint32_t)buf[3]);
342 		break;
343 
344 	default:
345 		cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
346 		return (EPROTO);
347 	}
348 
349 	return (0);
350 }
351 
352 /*
353  * Encode a transport session packet header into a 4-byte buffer.
354  */
355 static int
smb_session_xprt_puthdr(smb_session_t * session,uint8_t msg_type,uint32_t msg_length,uint8_t * buf,size_t buflen)356 smb_session_xprt_puthdr(smb_session_t *session,
357     uint8_t msg_type, uint32_t msg_length,
358     uint8_t *buf, size_t buflen)
359 {
360 	if (buf == NULL || buflen < NETBIOS_HDR_SZ) {
361 		return (-1);
362 	}
363 
364 	switch (session->s_local_port) {
365 	case IPPORT_NETBIOS_SSN:
366 		/* Per RFC 1001, 1002: msg. len < 128KB */
367 		if (msg_length >= (1 << 17))
368 			return (-1);
369 		buf[0] = msg_type;
370 		buf[1] = ((msg_length >> 16) & 1);
371 		buf[2] = (msg_length >> 8) & 0xff;
372 		buf[3] = msg_length & 0xff;
373 		break;
374 
375 	case IPPORT_SMB:
376 		/*
377 		 * SMB over TCP is like NetBIOS but the one byte
378 		 * message type is always zero, and the length
379 		 * part is three bytes.  It could actually use
380 		 * longer messages, but this is conservative.
381 		 */
382 		if (msg_length >= (1 << 24))
383 			return (-1);
384 		buf[0] = msg_type;
385 		buf[1] = (msg_length >> 16) & 0xff;
386 		buf[2] = (msg_length >> 8) & 0xff;
387 		buf[3] = msg_length & 0xff;
388 		break;
389 
390 	default:
391 		cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
392 		return (-1);
393 	}
394 
395 	return (0);
396 }
397 
398 static void
smb_request_init_command_mbuf(smb_request_t * sr)399 smb_request_init_command_mbuf(smb_request_t *sr)
400 {
401 
402 	/*
403 	 * Setup mbuf using the buffer we allocated.
404 	 */
405 	MBC_ATTACH_BUF(&sr->command, sr->sr_request_buf, sr->sr_req_length);
406 
407 	sr->command.flags = 0;
408 	sr->command.shadow_of = NULL;
409 }
410 
411 /*
412  * smb_request_cancel
413  *
414  * Handle a cancel for a request properly depending on the current request
415  * state.
416  */
417 void
smb_request_cancel(smb_request_t * sr)418 smb_request_cancel(smb_request_t *sr)
419 {
420 	mutex_enter(&sr->sr_mutex);
421 	switch (sr->sr_state) {
422 
423 	case SMB_REQ_STATE_INITIALIZING:
424 	case SMB_REQ_STATE_SUBMITTED:
425 	case SMB_REQ_STATE_ACTIVE:
426 	case SMB_REQ_STATE_CLEANED_UP:
427 		sr->sr_state = SMB_REQ_STATE_CANCELED;
428 		break;
429 
430 	case SMB_REQ_STATE_WAITING_LOCK:
431 		/*
432 		 * This request is waiting on a lock.  Wakeup everything
433 		 * waiting on the lock so that the relevant thread regains
434 		 * control and notices that is has been canceled.  The
435 		 * other lock request threads waiting on this lock will go
436 		 * back to sleep when they discover they are still blocked.
437 		 */
438 		sr->sr_state = SMB_REQ_STATE_CANCELED;
439 
440 		ASSERT(sr->sr_awaiting != NULL);
441 		mutex_enter(&sr->sr_awaiting->l_mutex);
442 		cv_broadcast(&sr->sr_awaiting->l_cv);
443 		mutex_exit(&sr->sr_awaiting->l_mutex);
444 		break;
445 
446 	case SMB_REQ_STATE_WAITING_EVENT:
447 		/*
448 		 * This request is waiting in change notify.
449 		 */
450 		sr->sr_state = SMB_REQ_STATE_CANCELED;
451 		cv_signal(&sr->sr_ncr.nc_cv);
452 		break;
453 
454 	case SMB_REQ_STATE_EVENT_OCCURRED:
455 	case SMB_REQ_STATE_COMPLETED:
456 	case SMB_REQ_STATE_CANCELED:
457 		/*
458 		 * No action required for these states since the request
459 		 * is completing.
460 		 */
461 		break;
462 
463 	case SMB_REQ_STATE_FREE:
464 	default:
465 		SMB_PANIC();
466 	}
467 	mutex_exit(&sr->sr_mutex);
468 }
469 
470 /*
471  * smb_session_receiver
472  *
473  * Receives request from the network and dispatches them to a worker.
474  */
475 void
smb_session_receiver(smb_session_t * session)476 smb_session_receiver(smb_session_t *session)
477 {
478 	int	rc = 0;
479 
480 	SMB_SESSION_VALID(session);
481 
482 	session->s_thread = curthread;
483 
484 	if (session->s_local_port == IPPORT_NETBIOS_SSN) {
485 		rc = smb_netbios_session_request(session);
486 		if (rc != 0) {
487 			smb_rwx_rwenter(&session->s_lock, RW_WRITER);
488 			session->s_state = SMB_SESSION_STATE_DISCONNECTED;
489 			smb_rwx_rwexit(&session->s_lock);
490 			return;
491 		}
492 	}
493 
494 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
495 	session->s_state = SMB_SESSION_STATE_ESTABLISHED;
496 	smb_rwx_rwexit(&session->s_lock);
497 
498 	(void) smb_session_reader(session);
499 
500 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
501 	session->s_state = SMB_SESSION_STATE_DISCONNECTED;
502 	smb_rwx_rwexit(&session->s_lock);
503 
504 	smb_soshutdown(session->sock);
505 
506 	DTRACE_PROBE2(session__drop, struct session *, session, int, rc);
507 
508 	smb_session_cancel(session);
509 	/*
510 	 * At this point everything related to the session should have been
511 	 * cleaned up and we expect that nothing will attempt to use the
512 	 * socket.
513 	 */
514 }
515 
516 /*
517  * smb_session_disconnect
518  *
519  * Disconnects the session passed in.
520  */
521 void
smb_session_disconnect(smb_session_t * session)522 smb_session_disconnect(smb_session_t *session)
523 {
524 	SMB_SESSION_VALID(session);
525 
526 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
527 	switch (session->s_state) {
528 	case SMB_SESSION_STATE_INITIALIZED:
529 	case SMB_SESSION_STATE_CONNECTED:
530 	case SMB_SESSION_STATE_ESTABLISHED:
531 	case SMB_SESSION_STATE_NEGOTIATED:
532 		smb_soshutdown(session->sock);
533 		session->s_state = SMB_SESSION_STATE_DISCONNECTED;
534 		_NOTE(FALLTHRU)
535 	case SMB_SESSION_STATE_DISCONNECTED:
536 	case SMB_SESSION_STATE_TERMINATED:
537 		break;
538 	}
539 	smb_rwx_rwexit(&session->s_lock);
540 }
541 
542 /*
543  * Read and process SMB requests.
544  *
545  * Returns:
546  *	0	Success
547  *	1	Unable to read transport header
548  *	2	Invalid transport header type
549  *	3	Invalid SMB length (too small)
550  *	4	Unable to read SMB header
551  *	5	Invalid SMB header (bad magic number)
552  *	6	Unable to read SMB data
553  */
554 static int
smb_session_reader(smb_session_t * session)555 smb_session_reader(smb_session_t *session)
556 {
557 	smb_server_t	*sv;
558 	smb_request_t	*sr = NULL;
559 	smb_xprt_t	hdr;
560 	uint8_t		*req_buf;
561 	uint32_t	resid;
562 	int		rc;
563 
564 	sv = session->s_server;
565 
566 	for (;;) {
567 
568 		rc = smb_session_xprt_gethdr(session, &hdr);
569 		if (rc)
570 			return (rc);
571 
572 		DTRACE_PROBE2(session__receive__xprthdr, session_t *, session,
573 		    smb_xprt_t *, &hdr);
574 
575 		if (hdr.xh_type != SESSION_MESSAGE) {
576 			/*
577 			 * Anything other than SESSION_MESSAGE or
578 			 * SESSION_KEEP_ALIVE is an error.  A SESSION_REQUEST
579 			 * may indicate a new session request but we need to
580 			 * close this session and we can treat it as an error
581 			 * here.
582 			 */
583 			if (hdr.xh_type == SESSION_KEEP_ALIVE) {
584 				session->keep_alive = smb_keep_alive;
585 				continue;
586 			}
587 			return (EPROTO);
588 		}
589 
590 		if (hdr.xh_length == 0) {
591 			/* zero length is another form of keep alive */
592 			session->keep_alive = smb_keep_alive;
593 			continue;
594 		}
595 
596 		if (hdr.xh_length < SMB_HEADER_LEN)
597 			return (EPROTO);
598 		if (hdr.xh_length > session->cmd_max_bytes)
599 			return (EPROTO);
600 
601 		session->keep_alive = smb_keep_alive;
602 
603 		/*
604 		 * Allocate a request context, read the whole message.
605 		 */
606 		sr = smb_request_alloc(session, hdr.xh_length);
607 
608 		req_buf = (uint8_t *)sr->sr_request_buf;
609 		resid = hdr.xh_length;
610 
611 		rc = smb_sorecv(session->sock, req_buf, resid);
612 		if (rc) {
613 			smb_request_free(sr);
614 			break;
615 		}
616 
617 		/* accounting: requests, received bytes */
618 		smb_server_inc_req(sv);
619 		smb_server_add_rxb(sv,
620 		    (int64_t)(hdr.xh_length + NETBIOS_HDR_SZ));
621 
622 		/*
623 		 * Initialize command MBC to represent the received data.
624 		 */
625 		smb_request_init_command_mbuf(sr);
626 
627 		DTRACE_PROBE1(session__receive__smb, smb_request_t *, sr);
628 
629 		rc = session->newrq_func(sr);
630 		sr = NULL;	/* enqueued or freed */
631 		if (rc != 0)
632 			break;
633 	}
634 	return (rc);
635 }
636 
637 /*
638  * This is the initial handler for new smb requests, called from
639  * from smb_session_reader when we have not yet seen any requests.
640  * The first SMB request must be "negotiate", which determines
641  * which protocol and dialect we'll be using.  That's the ONLY
642  * request type handled here, because with all later requests,
643  * we know the protocol and handle those with either the SMB1 or
644  * SMB2 handlers:  smb1sr_post() or smb2sr_post().
645  * Those do NOT allow SMB negotiate, because that's only allowed
646  * as the first request on new session.
647  *
648  * This and other "post a request" handlers must either enqueue
649  * the new request for the session taskq, or smb_request_free it
650  * (in case we've decided to drop this connection).  In this
651  * (special) new request handler, we always free the request.
652  */
653 static int
smbsr_newrq_initial(smb_request_t * sr)654 smbsr_newrq_initial(smb_request_t *sr)
655 {
656 	uint32_t magic;
657 	int rc = EPROTO;
658 
659 	mutex_enter(&sr->sr_mutex);
660 	sr->sr_state = SMB_REQ_STATE_ACTIVE;
661 	mutex_exit(&sr->sr_mutex);
662 
663 	magic = SMB_READ_PROTOCOL(sr->sr_request_buf);
664 	if (magic == SMB_PROTOCOL_MAGIC)
665 		rc = smb1_newrq_negotiate(sr);
666 	if (magic == SMB2_PROTOCOL_MAGIC)
667 		rc = smb2_newrq_negotiate(sr);
668 
669 	mutex_enter(&sr->sr_mutex);
670 	sr->sr_state = SMB_REQ_STATE_COMPLETED;
671 	mutex_exit(&sr->sr_mutex);
672 
673 	smb_request_free(sr);
674 	return (rc);
675 }
676 
677 /*
678  * Port will be IPPORT_NETBIOS_SSN or IPPORT_SMB.
679  */
680 smb_session_t *
smb_session_create(ksocket_t new_so,uint16_t port,smb_server_t * sv,int family)681 smb_session_create(ksocket_t new_so, uint16_t port, smb_server_t *sv,
682     int family)
683 {
684 	struct sockaddr_in	sin;
685 	socklen_t		slen;
686 	struct sockaddr_in6	sin6;
687 	smb_session_t		*session;
688 	int64_t			now;
689 	uint16_t		rport;
690 
691 	session = kmem_cache_alloc(smb_cache_session, KM_SLEEP);
692 	bzero(session, sizeof (smb_session_t));
693 
694 	if (smb_idpool_constructor(&session->s_uid_pool)) {
695 		kmem_cache_free(smb_cache_session, session);
696 		return (NULL);
697 	}
698 	if (smb_idpool_constructor(&session->s_tid_pool)) {
699 		smb_idpool_destructor(&session->s_uid_pool);
700 		kmem_cache_free(smb_cache_session, session);
701 		return (NULL);
702 	}
703 
704 	now = ddi_get_lbolt64();
705 
706 	session->s_kid = SMB_NEW_KID();
707 	session->s_state = SMB_SESSION_STATE_INITIALIZED;
708 	session->native_os = NATIVE_OS_UNKNOWN;
709 	session->opentime = now;
710 	session->keep_alive = smb_keep_alive;
711 	session->activity_timestamp = now;
712 
713 	smb_session_genkey(session);
714 
715 	mutex_init(&session->s_credits_mutex, NULL, MUTEX_DEFAULT, NULL);
716 
717 	smb_slist_constructor(&session->s_req_list, sizeof (smb_request_t),
718 	    offsetof(smb_request_t, sr_session_lnd));
719 
720 	smb_llist_constructor(&session->s_user_list, sizeof (smb_user_t),
721 	    offsetof(smb_user_t, u_lnd));
722 
723 	smb_llist_constructor(&session->s_tree_list, sizeof (smb_tree_t),
724 	    offsetof(smb_tree_t, t_lnd));
725 
726 	smb_llist_constructor(&session->s_xa_list, sizeof (smb_xa_t),
727 	    offsetof(smb_xa_t, xa_lnd));
728 
729 	smb_net_txl_constructor(&session->s_txlst);
730 
731 	smb_rwx_init(&session->s_lock);
732 
733 	if (new_so != NULL) {
734 		if (family == AF_INET) {
735 			slen = sizeof (sin);
736 			(void) ksocket_getsockname(new_so,
737 			    (struct sockaddr *)&sin, &slen, CRED());
738 			bcopy(&sin.sin_addr,
739 			    &session->local_ipaddr.au_addr.au_ipv4,
740 			    sizeof (in_addr_t));
741 			slen = sizeof (sin);
742 			(void) ksocket_getpeername(new_so,
743 			    (struct sockaddr *)&sin, &slen, CRED());
744 			bcopy(&sin.sin_addr,
745 			    &session->ipaddr.au_addr.au_ipv4,
746 			    sizeof (in_addr_t));
747 			rport = sin.sin_port;
748 		} else {
749 			slen = sizeof (sin6);
750 			(void) ksocket_getsockname(new_so,
751 			    (struct sockaddr *)&sin6, &slen, CRED());
752 			bcopy(&sin6.sin6_addr,
753 			    &session->local_ipaddr.au_addr.au_ipv6,
754 			    sizeof (in6_addr_t));
755 			slen = sizeof (sin6);
756 			(void) ksocket_getpeername(new_so,
757 			    (struct sockaddr *)&sin6, &slen, CRED());
758 			bcopy(&sin6.sin6_addr,
759 			    &session->ipaddr.au_addr.au_ipv6,
760 			    sizeof (in6_addr_t));
761 			rport = sin6.sin6_port;
762 		}
763 		session->ipaddr.a_family = family;
764 		session->local_ipaddr.a_family = family;
765 		session->s_local_port = port;
766 		session->s_remote_port = ntohs(rport);
767 		session->sock = new_so;
768 		(void) smb_inet_ntop(&session->ipaddr,
769 		    session->ip_addr_str, INET6_ADDRSTRLEN);
770 		if (port == IPPORT_NETBIOS_SSN)
771 			smb_server_inc_nbt_sess(sv);
772 		else
773 			smb_server_inc_tcp_sess(sv);
774 	}
775 	session->s_server = sv;
776 	smb_server_get_cfg(sv, &session->s_cfg);
777 	session->s_srqueue = &sv->sv_srqueue;
778 
779 	/*
780 	 * The initial new request handler is special,
781 	 * and only accepts negotiation requests.
782 	 */
783 	session->newrq_func = smbsr_newrq_initial;
784 
785 	/* These may increase in SMB2 negotiate. */
786 	session->cmd_max_bytes = SMB_REQ_MAX_SIZE;
787 	session->reply_max_bytes = SMB_REQ_MAX_SIZE;
788 
789 	session->s_magic = SMB_SESSION_MAGIC;
790 	return (session);
791 }
792 
793 void
smb_session_delete(smb_session_t * session)794 smb_session_delete(smb_session_t *session)
795 {
796 
797 	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
798 
799 	if (session->sign_fini != NULL)
800 		session->sign_fini(session);
801 
802 	if (session->signing.mackey != NULL) {
803 		kmem_free(session->signing.mackey,
804 		    session->signing.mackey_len);
805 	}
806 
807 	session->s_magic = 0;
808 
809 	smb_rwx_destroy(&session->s_lock);
810 	smb_net_txl_destructor(&session->s_txlst);
811 
812 	mutex_destroy(&session->s_credits_mutex);
813 
814 	smb_slist_destructor(&session->s_req_list);
815 	smb_llist_destructor(&session->s_tree_list);
816 	smb_llist_destructor(&session->s_user_list);
817 	smb_llist_destructor(&session->s_xa_list);
818 
819 	ASSERT(session->s_tree_cnt == 0);
820 	ASSERT(session->s_file_cnt == 0);
821 	ASSERT(session->s_dir_cnt == 0);
822 
823 	smb_idpool_destructor(&session->s_tid_pool);
824 	smb_idpool_destructor(&session->s_uid_pool);
825 	if (session->sock != NULL) {
826 		if (session->s_local_port == IPPORT_NETBIOS_SSN)
827 			smb_server_dec_nbt_sess(session->s_server);
828 		else
829 			smb_server_dec_tcp_sess(session->s_server);
830 		smb_sodestroy(session->sock);
831 	}
832 	kmem_cache_free(smb_cache_session, session);
833 }
834 
835 static void
smb_session_cancel(smb_session_t * session)836 smb_session_cancel(smb_session_t *session)
837 {
838 	smb_xa_t	*xa, *nextxa;
839 
840 	/* All the request currently being treated must be canceled. */
841 	smb_session_cancel_requests(session, NULL, NULL);
842 
843 	/*
844 	 * We wait for the completion of all the requests associated with
845 	 * this session.
846 	 */
847 	smb_slist_wait_for_empty(&session->s_req_list);
848 
849 	/*
850 	 * At this point the reference count of the users, trees, files,
851 	 * directories should be zero. It should be possible to destroy them
852 	 * without any problem.
853 	 */
854 	xa = smb_llist_head(&session->s_xa_list);
855 	while (xa) {
856 		nextxa = smb_llist_next(&session->s_xa_list, xa);
857 		smb_xa_close(xa);
858 		xa = nextxa;
859 	}
860 
861 	smb_session_logoff(session);
862 }
863 
864 /*
865  * Cancel requests.  If a non-null tree is specified, only requests specific
866  * to that tree will be cancelled.  If a non-null sr is specified, that sr
867  * will be not be cancelled - this would typically be the caller's sr.
868  */
869 void
smb_session_cancel_requests(smb_session_t * session,smb_tree_t * tree,smb_request_t * exclude_sr)870 smb_session_cancel_requests(
871     smb_session_t	*session,
872     smb_tree_t		*tree,
873     smb_request_t	*exclude_sr)
874 {
875 	smb_request_t	*sr;
876 
877 	smb_slist_enter(&session->s_req_list);
878 	sr = smb_slist_head(&session->s_req_list);
879 
880 	while (sr) {
881 		ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
882 		if ((sr != exclude_sr) &&
883 		    (tree == NULL || sr->tid_tree == tree))
884 			smb_request_cancel(sr);
885 
886 		sr = smb_slist_next(&session->s_req_list, sr);
887 	}
888 
889 	smb_slist_exit(&session->s_req_list);
890 }
891 
892 /*
893  * Find a user on the specified session by SMB UID.
894  */
895 smb_user_t *
smb_session_lookup_uid(smb_session_t * session,uint16_t uid)896 smb_session_lookup_uid(smb_session_t *session, uint16_t uid)
897 {
898 	return (smb_session_lookup_uid_st(session, uid,
899 	    SMB_USER_STATE_LOGGED_ON));
900 }
901 
902 smb_user_t *
smb_session_lookup_uid_st(smb_session_t * session,uint16_t uid,smb_user_state_t st)903 smb_session_lookup_uid_st(smb_session_t *session, uint16_t uid,
904     smb_user_state_t st)
905 {
906 	smb_user_t	*user;
907 	smb_llist_t	*user_list;
908 
909 	SMB_SESSION_VALID(session);
910 
911 	user_list = &session->s_user_list;
912 	smb_llist_enter(user_list, RW_READER);
913 
914 	user = smb_llist_head(user_list);
915 	while (user) {
916 		SMB_USER_VALID(user);
917 		ASSERT(user->u_session == session);
918 
919 		if (user->u_uid == uid && user->u_state == st) {
920 			smb_user_hold_internal(user);
921 			break;
922 		}
923 
924 		user = smb_llist_next(user_list, user);
925 	}
926 
927 	smb_llist_exit(user_list);
928 	return (user);
929 }
930 
931 void
smb_session_post_user(smb_session_t * session,smb_user_t * user)932 smb_session_post_user(smb_session_t *session, smb_user_t *user)
933 {
934 	SMB_USER_VALID(user);
935 	ASSERT(user->u_refcnt == 0);
936 	ASSERT(user->u_state == SMB_USER_STATE_LOGGED_OFF);
937 	ASSERT(user->u_session == session);
938 
939 	smb_llist_post(&session->s_user_list, user, smb_user_delete);
940 }
941 
942 /*
943  * Find a tree by tree-id.
944  */
945 smb_tree_t *
smb_session_lookup_tree(smb_session_t * session,uint16_t tid)946 smb_session_lookup_tree(
947     smb_session_t	*session,
948     uint16_t		tid)
949 
950 {
951 	smb_tree_t	*tree;
952 
953 	SMB_SESSION_VALID(session);
954 
955 	smb_llist_enter(&session->s_tree_list, RW_READER);
956 	tree = smb_llist_head(&session->s_tree_list);
957 
958 	while (tree) {
959 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
960 		ASSERT(tree->t_session == session);
961 
962 		if (tree->t_tid == tid) {
963 			if (smb_tree_hold(tree)) {
964 				smb_llist_exit(&session->s_tree_list);
965 				return (tree);
966 			} else {
967 				smb_llist_exit(&session->s_tree_list);
968 				return (NULL);
969 			}
970 		}
971 
972 		tree = smb_llist_next(&session->s_tree_list, tree);
973 	}
974 
975 	smb_llist_exit(&session->s_tree_list);
976 	return (NULL);
977 }
978 
979 /*
980  * Find the first connected tree that matches the specified sharename.
981  * If the specified tree is NULL the search starts from the beginning of
982  * the user's tree list.  If a tree is provided the search starts just
983  * after that tree.
984  */
985 smb_tree_t *
smb_session_lookup_share(smb_session_t * session,const char * sharename,smb_tree_t * tree)986 smb_session_lookup_share(
987     smb_session_t	*session,
988     const char		*sharename,
989     smb_tree_t		*tree)
990 {
991 	SMB_SESSION_VALID(session);
992 	ASSERT(sharename);
993 
994 	smb_llist_enter(&session->s_tree_list, RW_READER);
995 
996 	if (tree) {
997 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
998 		ASSERT(tree->t_session == session);
999 		tree = smb_llist_next(&session->s_tree_list, tree);
1000 	} else {
1001 		tree = smb_llist_head(&session->s_tree_list);
1002 	}
1003 
1004 	while (tree) {
1005 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1006 		ASSERT(tree->t_session == session);
1007 		if (smb_strcasecmp(tree->t_sharename, sharename, 0) == 0) {
1008 			if (smb_tree_hold(tree)) {
1009 				smb_llist_exit(&session->s_tree_list);
1010 				return (tree);
1011 			}
1012 		}
1013 		tree = smb_llist_next(&session->s_tree_list, tree);
1014 	}
1015 
1016 	smb_llist_exit(&session->s_tree_list);
1017 	return (NULL);
1018 }
1019 
1020 /*
1021  * Find the first connected tree that matches the specified volume name.
1022  * If the specified tree is NULL the search starts from the beginning of
1023  * the user's tree list.  If a tree is provided the search starts just
1024  * after that tree.
1025  */
1026 smb_tree_t *
smb_session_lookup_volume(smb_session_t * session,const char * name,smb_tree_t * tree)1027 smb_session_lookup_volume(
1028     smb_session_t	*session,
1029     const char		*name,
1030     smb_tree_t		*tree)
1031 {
1032 	SMB_SESSION_VALID(session);
1033 	ASSERT(name);
1034 
1035 	smb_llist_enter(&session->s_tree_list, RW_READER);
1036 
1037 	if (tree) {
1038 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1039 		ASSERT(tree->t_session == session);
1040 		tree = smb_llist_next(&session->s_tree_list, tree);
1041 	} else {
1042 		tree = smb_llist_head(&session->s_tree_list);
1043 	}
1044 
1045 	while (tree) {
1046 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1047 		ASSERT(tree->t_session == session);
1048 
1049 		if (smb_strcasecmp(tree->t_volume, name, 0) == 0) {
1050 			if (smb_tree_hold(tree)) {
1051 				smb_llist_exit(&session->s_tree_list);
1052 				return (tree);
1053 			}
1054 		}
1055 
1056 		tree = smb_llist_next(&session->s_tree_list, tree);
1057 	}
1058 
1059 	smb_llist_exit(&session->s_tree_list);
1060 	return (NULL);
1061 }
1062 
1063 /*
1064  * Disconnect all trees that match the specified client process-id.
1065  */
1066 void
smb_session_close_pid(smb_session_t * session,uint32_t pid)1067 smb_session_close_pid(
1068     smb_session_t	*session,
1069     uint32_t		pid)
1070 {
1071 	smb_tree_t	*tree;
1072 
1073 	SMB_SESSION_VALID(session);
1074 
1075 	tree = smb_session_get_tree(session, NULL);
1076 	while (tree) {
1077 		smb_tree_t *next;
1078 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1079 		ASSERT(tree->t_session == session);
1080 		smb_tree_close_pid(tree, pid);
1081 		next = smb_session_get_tree(session, tree);
1082 		smb_tree_release(tree);
1083 		tree = next;
1084 	}
1085 }
1086 
1087 static void
smb_session_tree_dtor(void * t)1088 smb_session_tree_dtor(void *t)
1089 {
1090 	smb_tree_t	*tree = (smb_tree_t *)t;
1091 
1092 	smb_tree_disconnect(tree, B_TRUE);
1093 	/* release the ref acquired during the traversal loop */
1094 	smb_tree_release(tree);
1095 }
1096 
1097 
1098 /*
1099  * Disconnect all trees that this user has connected.
1100  */
1101 void
smb_session_disconnect_owned_trees(smb_session_t * session,smb_user_t * owner)1102 smb_session_disconnect_owned_trees(
1103     smb_session_t	*session,
1104     smb_user_t		*owner)
1105 {
1106 	smb_tree_t	*tree;
1107 	smb_llist_t	*tree_list = &session->s_tree_list;
1108 
1109 	SMB_SESSION_VALID(session);
1110 	SMB_USER_VALID(owner);
1111 
1112 	smb_llist_enter(tree_list, RW_READER);
1113 
1114 	tree = smb_llist_head(tree_list);
1115 	while (tree) {
1116 		if ((tree->t_owner == owner) &&
1117 		    smb_tree_hold(tree)) {
1118 			/*
1119 			 * smb_tree_hold() succeeded, hence we are in state
1120 			 * SMB_TREE_STATE_CONNECTED; schedule this tree
1121 			 * for asynchronous disconnect, which will fire
1122 			 * after we drop the llist traversal lock.
1123 			 */
1124 			smb_llist_post(tree_list, tree, smb_session_tree_dtor);
1125 		}
1126 		tree = smb_llist_next(tree_list, tree);
1127 	}
1128 
1129 	/* drop the lock and flush the dtor queue */
1130 	smb_llist_exit(tree_list);
1131 }
1132 
1133 /*
1134  * Disconnect all trees that this user has connected.
1135  */
1136 void
smb_session_disconnect_trees(smb_session_t * session)1137 smb_session_disconnect_trees(
1138     smb_session_t	*session)
1139 {
1140 	smb_tree_t	*tree;
1141 
1142 	SMB_SESSION_VALID(session);
1143 
1144 	tree = smb_session_get_tree(session, NULL);
1145 	while (tree) {
1146 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1147 		ASSERT(tree->t_session == session);
1148 		smb_tree_disconnect(tree, B_TRUE);
1149 		smb_tree_release(tree);
1150 		tree = smb_session_get_tree(session, NULL);
1151 	}
1152 }
1153 
1154 /*
1155  * Disconnect all trees that match the specified share name.
1156  */
1157 void
smb_session_disconnect_share(smb_session_t * session,const char * sharename)1158 smb_session_disconnect_share(
1159     smb_session_t	*session,
1160     const char		*sharename)
1161 {
1162 	smb_tree_t	*tree;
1163 	smb_tree_t	*next;
1164 
1165 	SMB_SESSION_VALID(session);
1166 
1167 	tree = smb_session_lookup_share(session, sharename, NULL);
1168 	while (tree) {
1169 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1170 		ASSERT(tree->t_session == session);
1171 		smb_session_cancel_requests(session, tree, NULL);
1172 		smb_tree_disconnect(tree, B_TRUE);
1173 		next = smb_session_lookup_share(session, sharename, tree);
1174 		smb_tree_release(tree);
1175 		tree = next;
1176 	}
1177 }
1178 
1179 void
smb_session_post_tree(smb_session_t * session,smb_tree_t * tree)1180 smb_session_post_tree(smb_session_t *session, smb_tree_t *tree)
1181 {
1182 	SMB_SESSION_VALID(session);
1183 	SMB_TREE_VALID(tree);
1184 	ASSERT0(tree->t_refcnt);
1185 	ASSERT(tree->t_state == SMB_TREE_STATE_DISCONNECTED);
1186 	ASSERT(tree->t_session == session);
1187 
1188 	smb_llist_post(&session->s_tree_list, tree, smb_tree_dealloc);
1189 }
1190 
1191 /*
1192  * Get the next connected tree in the list.  A reference is taken on
1193  * the tree, which can be released later with smb_tree_release().
1194  *
1195  * If the specified tree is NULL the search starts from the beginning of
1196  * the tree list.  If a tree is provided the search starts just after
1197  * that tree.
1198  *
1199  * Returns NULL if there are no connected trees in the list.
1200  */
1201 static smb_tree_t *
smb_session_get_tree(smb_session_t * session,smb_tree_t * tree)1202 smb_session_get_tree(
1203     smb_session_t	*session,
1204     smb_tree_t		*tree)
1205 {
1206 	smb_llist_t	*tree_list;
1207 
1208 	SMB_SESSION_VALID(session);
1209 	tree_list = &session->s_tree_list;
1210 
1211 	smb_llist_enter(tree_list, RW_READER);
1212 
1213 	if (tree) {
1214 		ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1215 		tree = smb_llist_next(tree_list, tree);
1216 	} else {
1217 		tree = smb_llist_head(tree_list);
1218 	}
1219 
1220 	while (tree) {
1221 		if (smb_tree_hold(tree))
1222 			break;
1223 
1224 		tree = smb_llist_next(tree_list, tree);
1225 	}
1226 
1227 	smb_llist_exit(tree_list);
1228 	return (tree);
1229 }
1230 
1231 /*
1232  * Logoff all users associated with the specified session.
1233  */
1234 static void
smb_session_logoff(smb_session_t * session)1235 smb_session_logoff(smb_session_t *session)
1236 {
1237 	smb_user_t	*user;
1238 
1239 	SMB_SESSION_VALID(session);
1240 
1241 	smb_session_disconnect_trees(session);
1242 
1243 	smb_llist_enter(&session->s_user_list, RW_READER);
1244 
1245 	user = smb_llist_head(&session->s_user_list);
1246 	while (user) {
1247 		SMB_USER_VALID(user);
1248 		ASSERT(user->u_session == session);
1249 
1250 		switch (user->u_state) {
1251 		case SMB_USER_STATE_LOGGING_ON:
1252 		case SMB_USER_STATE_LOGGED_ON:
1253 			smb_user_hold_internal(user);
1254 			smb_user_logoff(user);
1255 			smb_user_release(user);
1256 			break;
1257 
1258 		case SMB_USER_STATE_LOGGED_OFF:
1259 		case SMB_USER_STATE_LOGGING_OFF:
1260 			break;
1261 
1262 		default:
1263 			ASSERT(0);
1264 			break;
1265 		}
1266 
1267 		user = smb_llist_next(&session->s_user_list, user);
1268 	}
1269 
1270 	smb_llist_exit(&session->s_user_list);
1271 }
1272 
1273 /*
1274  * Copy the session workstation/client name to buf.  If the workstation
1275  * is an empty string (which it will be on TCP connections), use the
1276  * client IP address.
1277  */
1278 void
smb_session_getclient(smb_session_t * sn,char * buf,size_t buflen)1279 smb_session_getclient(smb_session_t *sn, char *buf, size_t buflen)
1280 {
1281 
1282 	*buf = '\0';
1283 
1284 	if (sn->workstation[0] != '\0') {
1285 		(void) strlcpy(buf, sn->workstation, buflen);
1286 		return;
1287 	}
1288 
1289 	(void) strlcpy(buf, sn->ip_addr_str, buflen);
1290 }
1291 
1292 /*
1293  * Check whether or not the specified client name is the client of this
1294  * session.  The name may be in UNC format (\\CLIENT).
1295  *
1296  * A workstation/client name is setup on NBT connections as part of the
1297  * NetBIOS session request but that isn't available on TCP connections.
1298  * If the session doesn't have a client name we typically return the
1299  * client IP address as the workstation name on MSRPC requests.  So we
1300  * check for the IP address here in addition to the workstation name.
1301  */
1302 boolean_t
smb_session_isclient(smb_session_t * sn,const char * client)1303 smb_session_isclient(smb_session_t *sn, const char *client)
1304 {
1305 
1306 	client += strspn(client, "\\");
1307 
1308 	if (smb_strcasecmp(client, sn->workstation, 0) == 0)
1309 		return (B_TRUE);
1310 
1311 	if (smb_strcasecmp(client, sn->ip_addr_str, 0) == 0)
1312 		return (B_TRUE);
1313 
1314 	return (B_FALSE);
1315 }
1316 
1317 /*
1318  * smb_request_alloc
1319  *
1320  * Allocate an smb_request_t structure from the kmem_cache.  Partially
1321  * initialize the found/new request.
1322  *
1323  * Returns pointer to a request
1324  */
1325 smb_request_t *
smb_request_alloc(smb_session_t * session,int req_length)1326 smb_request_alloc(smb_session_t *session, int req_length)
1327 {
1328 	smb_request_t	*sr;
1329 
1330 	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
1331 	ASSERT(req_length <= session->cmd_max_bytes);
1332 
1333 	sr = kmem_cache_alloc(smb_cache_request, KM_SLEEP);
1334 
1335 	/*
1336 	 * Future:  Use constructor to pre-initialize some fields.  For now
1337 	 * there are so many fields that it is easiest just to zero the
1338 	 * whole thing and start over.
1339 	 */
1340 	bzero(sr, sizeof (smb_request_t));
1341 
1342 	mutex_init(&sr->sr_mutex, NULL, MUTEX_DEFAULT, NULL);
1343 	cv_init(&sr->sr_ncr.nc_cv, NULL, CV_DEFAULT, NULL);
1344 	smb_srm_init(sr);
1345 	sr->session = session;
1346 	sr->sr_server = session->s_server;
1347 	sr->sr_gmtoff = session->s_server->si_gmtoff;
1348 	sr->sr_cfg = &session->s_cfg;
1349 	sr->command.max_bytes = req_length;
1350 	sr->reply.max_bytes = session->reply_max_bytes;
1351 	sr->sr_req_length = req_length;
1352 	if (req_length)
1353 		sr->sr_request_buf = kmem_alloc(req_length, KM_SLEEP);
1354 	sr->sr_magic = SMB_REQ_MAGIC;
1355 	sr->sr_state = SMB_REQ_STATE_INITIALIZING;
1356 	smb_slist_insert_tail(&session->s_req_list, sr);
1357 	return (sr);
1358 }
1359 
1360 /*
1361  * smb_request_free
1362  *
1363  * release the memories which have been allocated for a smb request.
1364  */
1365 void
smb_request_free(smb_request_t * sr)1366 smb_request_free(smb_request_t *sr)
1367 {
1368 	ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
1369 	ASSERT(sr->session);
1370 	ASSERT(sr->r_xa == NULL);
1371 	ASSERT(sr->sr_ncr.nc_fname == NULL);
1372 
1373 	if (sr->fid_ofile != NULL) {
1374 		smb_ofile_request_complete(sr->fid_ofile);
1375 		smb_ofile_release(sr->fid_ofile);
1376 	}
1377 
1378 	if (sr->tid_tree != NULL)
1379 		smb_tree_release(sr->tid_tree);
1380 
1381 	if (sr->uid_user != NULL)
1382 		smb_user_release(sr->uid_user);
1383 
1384 	smb_slist_remove(&sr->session->s_req_list, sr);
1385 
1386 	sr->session = NULL;
1387 
1388 	smb_srm_fini(sr);
1389 
1390 	if (sr->sr_request_buf)
1391 		kmem_free(sr->sr_request_buf, sr->sr_req_length);
1392 	if (sr->command.chain)
1393 		m_freem(sr->command.chain);
1394 	if (sr->reply.chain)
1395 		m_freem(sr->reply.chain);
1396 	if (sr->raw_data.chain)
1397 		m_freem(sr->raw_data.chain);
1398 
1399 	sr->sr_magic = 0;
1400 	cv_destroy(&sr->sr_ncr.nc_cv);
1401 	mutex_destroy(&sr->sr_mutex);
1402 	kmem_cache_free(smb_cache_request, sr);
1403 }
1404 
1405 boolean_t
smb_session_oplocks_enable(smb_session_t * session)1406 smb_session_oplocks_enable(smb_session_t *session)
1407 {
1408 	SMB_SESSION_VALID(session);
1409 	if (session->s_cfg.skc_oplock_enable == 0)
1410 		return (B_FALSE);
1411 	else
1412 		return (B_TRUE);
1413 }
1414 
1415 boolean_t
smb_session_levelII_oplocks(smb_session_t * session)1416 smb_session_levelII_oplocks(smb_session_t *session)
1417 {
1418 	SMB_SESSION_VALID(session);
1419 
1420 	/* Clients using SMB2 and later always know about oplocks. */
1421 	if (session->dialect > NT_LM_0_12)
1422 		return (B_TRUE);
1423 
1424 	/* Older clients only do Level II oplocks if negotiated. */
1425 	if ((session->capabilities & CAP_LEVEL_II_OPLOCKS) != 0)
1426 		return (B_TRUE);
1427 
1428 	return (B_FALSE);
1429 }
1430 
1431 /*
1432  * smb_session_oplock_break
1433  *
1434  * Send an oplock break request to the client,
1435  * recalling some cache delegation.
1436  */
1437 void
smb_session_oplock_break(smb_request_t * sr,uint8_t brk)1438 smb_session_oplock_break(smb_request_t *sr, uint8_t brk)
1439 {
1440 	smb_session_t	*session = sr->session;
1441 	mbuf_chain_t	*mbc = &sr->reply;
1442 
1443 	SMB_SESSION_VALID(session);
1444 
1445 	/*
1446 	 * Build the break message in sr->reply and then send it.
1447 	 * The mbc is free'd later, in smb_request_free().
1448 	 */
1449 	mbc->max_bytes = MLEN;
1450 	if (session->dialect <= NT_LM_0_12) {
1451 		smb1_oplock_break_notification(sr, brk);
1452 	} else {
1453 		smb2_oplock_break_notification(sr, brk);
1454 	}
1455 
1456 	(void) smb_session_send(session, 0, mbc);
1457 }
1458 
1459 static void
smb_session_genkey(smb_session_t * session)1460 smb_session_genkey(smb_session_t *session)
1461 {
1462 	uint8_t		tmp_key[SMB_CHALLENGE_SZ];
1463 
1464 	(void) random_get_pseudo_bytes(tmp_key, SMB_CHALLENGE_SZ);
1465 	bcopy(tmp_key, &session->challenge_key, SMB_CHALLENGE_SZ);
1466 	session->challenge_len = SMB_CHALLENGE_SZ;
1467 
1468 	(void) random_get_pseudo_bytes(tmp_key, 4);
1469 	session->sesskey = tmp_key[0] | tmp_key[1] << 8 |
1470 	    tmp_key[2] << 16 | tmp_key[3] << 24;
1471 }
1472