1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2000-2001 Boris Popov 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 #include <sys/param.h> 31 #include <sys/condvar.h> 32 #include <sys/kernel.h> 33 #include <sys/lock.h> 34 #include <sys/malloc.h> 35 #include <sys/mbuf.h> 36 #include <sys/poll.h> 37 #include <sys/proc.h> 38 #include <sys/protosw.h> 39 #include <sys/signalvar.h> 40 #include <sys/socket.h> 41 #include <sys/socketvar.h> 42 #include <sys/sx.h> 43 #include <sys/sysctl.h> 44 #include <sys/systm.h> 45 #include <sys/uio.h> 46 47 #include <net/if.h> 48 #include <net/route.h> 49 #include <net/vnet.h> 50 51 #include <netinet/in.h> 52 #include <netinet/tcp.h> 53 54 #include <sys/mchain.h> 55 56 #include <netsmb/netbios.h> 57 58 #include <netsmb/smb.h> 59 #include <netsmb/smb_conn.h> 60 #include <netsmb/smb_tran.h> 61 #include <netsmb/smb_trantcp.h> 62 #include <netsmb/smb_subr.h> 63 64 #define M_NBDATA M_PCB 65 66 static int smb_tcpsndbuf = NB_SNDQ - 1; 67 static int smb_tcprcvbuf = NB_RCVQ - 1; 68 69 SYSCTL_DECL(_net_smb); 70 SYSCTL_INT(_net_smb, OID_AUTO, tcpsndbuf, CTLFLAG_RW, &smb_tcpsndbuf, 0, ""); 71 SYSCTL_INT(_net_smb, OID_AUTO, tcprcvbuf, CTLFLAG_RW, &smb_tcprcvbuf, 0, ""); 72 73 #define nb_sosend(so,m,flags,td) sosend(so, NULL, 0, m, 0, flags, td) 74 75 static int nbssn_recv(struct nbpcb *nbp, struct mbuf **mpp, int *lenp, 76 u_int8_t *rpcodep, struct thread *td); 77 static int smb_nbst_disconnect(struct smb_vc *vcp, struct thread *td); 78 79 static int 80 nb_setsockopt_int(struct socket *so, int level, int name, int val) 81 { 82 struct sockopt sopt; 83 int error; 84 85 bzero(&sopt, sizeof(sopt)); 86 sopt.sopt_level = level; 87 sopt.sopt_name = name; 88 sopt.sopt_val = &val; 89 sopt.sopt_valsize = sizeof(val); 90 CURVNET_SET(so->so_vnet); 91 error = sosetopt(so, &sopt); 92 CURVNET_RESTORE(); 93 return error; 94 } 95 96 static int 97 nb_intr(struct nbpcb *nbp, struct proc *p) 98 { 99 return 0; 100 } 101 102 static int 103 nb_upcall(struct socket *so, void *arg, int waitflag) 104 { 105 struct nbpcb *nbp = arg; 106 107 if (arg == NULL || nbp->nbp_selectid == NULL) 108 return (SU_OK); 109 wakeup(nbp->nbp_selectid); 110 return (SU_OK); 111 } 112 113 static int 114 nb_sethdr(struct mbuf *m, u_int8_t type, u_int32_t len) 115 { 116 u_int32_t *p = mtod(m, u_int32_t *); 117 118 *p = htonl((len & 0x1FFFF) | (type << 24)); 119 return 0; 120 } 121 122 static int 123 nb_put_name(struct mbchain *mbp, struct sockaddr_nb *snb) 124 { 125 int error; 126 u_char seglen, *cp; 127 128 cp = snb->snb_name; 129 if (*cp == 0) 130 return EINVAL; 131 NBDEBUG("[%s]\n", cp); 132 for (;;) { 133 seglen = (*cp) + 1; 134 error = mb_put_mem(mbp, cp, seglen, MB_MSYSTEM); 135 if (error) 136 return error; 137 if (seglen == 1) 138 break; 139 cp += seglen; 140 } 141 return 0; 142 } 143 144 static int 145 nb_connect_in(struct nbpcb *nbp, struct sockaddr_in *to, struct thread *td) 146 { 147 struct socket *so; 148 int error, s; 149 150 error = socreate(AF_INET, &so, SOCK_STREAM, IPPROTO_TCP, 151 td->td_ucred, td); 152 if (error) 153 return error; 154 nbp->nbp_tso = so; 155 SOCKBUF_LOCK(&so->so_rcv); 156 soupcall_set(so, SO_RCV, nb_upcall, nbp); 157 SOCKBUF_UNLOCK(&so->so_rcv); 158 so->so_rcv.sb_timeo = (5 * SBT_1S); 159 so->so_snd.sb_timeo = (5 * SBT_1S); 160 error = soreserve(so, nbp->nbp_sndbuf, nbp->nbp_rcvbuf); 161 if (error) 162 goto bad; 163 nb_setsockopt_int(so, SOL_SOCKET, SO_KEEPALIVE, 1); 164 nb_setsockopt_int(so, IPPROTO_TCP, TCP_NODELAY, 1); 165 SOCKBUF_LOCK(&so->so_rcv); 166 so->so_rcv.sb_flags &= ~SB_NOINTR; 167 SOCKBUF_UNLOCK(&so->so_rcv); 168 SOCKBUF_LOCK(&so->so_snd); 169 so->so_snd.sb_flags &= ~SB_NOINTR; 170 SOCKBUF_UNLOCK(&so->so_snd); 171 error = soconnect(so, (struct sockaddr*)to, td); 172 if (error) 173 goto bad; 174 s = splnet(); 175 while ((so->so_state & SS_ISCONNECTING) && so->so_error == 0) { 176 tsleep(&so->so_timeo, PSOCK, "nbcon", 2 * hz); 177 if ((so->so_state & SS_ISCONNECTING) && so->so_error == 0 && 178 (error = nb_intr(nbp, td->td_proc)) != 0) { 179 so->so_state &= ~SS_ISCONNECTING; 180 splx(s); 181 goto bad; 182 } 183 } 184 if (so->so_error) { 185 error = so->so_error; 186 so->so_error = 0; 187 splx(s); 188 goto bad; 189 } 190 splx(s); 191 return 0; 192 bad: 193 smb_nbst_disconnect(nbp->nbp_vc, td); 194 return error; 195 } 196 197 static int 198 nbssn_rq_request(struct nbpcb *nbp, struct thread *td) 199 { 200 struct mbchain *mbp; 201 struct mdchain *mdp; 202 struct mbuf *m0; 203 struct timeval tv; 204 struct sockaddr_in sin; 205 u_short port; 206 u_int8_t rpcode; 207 int error, rplen; 208 209 mbp = malloc(sizeof(struct mbchain), M_NBDATA, M_WAITOK); 210 mdp = malloc(sizeof(struct mbchain), M_NBDATA, M_WAITOK); 211 error = mb_init(mbp); 212 if (error) { 213 free(mbp, M_NBDATA); 214 free(mdp, M_NBDATA); 215 return error; 216 } 217 mb_put_uint32le(mbp, 0); 218 nb_put_name(mbp, nbp->nbp_paddr); 219 nb_put_name(mbp, nbp->nbp_laddr); 220 nb_sethdr(mbp->mb_top, NB_SSN_REQUEST, mb_fixhdr(mbp) - 4); 221 error = nb_sosend(nbp->nbp_tso, mbp->mb_top, 0, td); 222 if (!error) { 223 nbp->nbp_state = NBST_RQSENT; 224 } 225 mb_detach(mbp); 226 mb_done(mbp); 227 free(mbp, M_NBDATA); 228 if (error) { 229 free(mdp, M_NBDATA); 230 return error; 231 } 232 TIMESPEC_TO_TIMEVAL(&tv, &nbp->nbp_timo); 233 error = selsocket(nbp->nbp_tso, POLLIN, &tv, td); 234 if (error == EWOULDBLOCK) { /* Timeout */ 235 NBDEBUG("initial request timeout\n"); 236 free(mdp, M_NBDATA); 237 return ETIMEDOUT; 238 } 239 if (error) { /* restart or interrupt */ 240 free(mdp, M_NBDATA); 241 return error; 242 } 243 error = nbssn_recv(nbp, &m0, &rplen, &rpcode, td); 244 if (error) { 245 NBDEBUG("recv() error %d\n", error); 246 free(mdp, M_NBDATA); 247 return error; 248 } 249 /* 250 * Process NETBIOS reply 251 */ 252 if (m0) 253 md_initm(mdp, m0); 254 error = 0; 255 do { 256 if (rpcode == NB_SSN_POSRESP) { 257 nbp->nbp_state = NBST_SESSION; 258 nbp->nbp_flags |= NBF_CONNECTED; 259 break; 260 } 261 if (rpcode != NB_SSN_RTGRESP) { 262 error = ECONNABORTED; 263 break; 264 } 265 if (rplen != 6) { 266 error = ECONNABORTED; 267 break; 268 } 269 md_get_mem(mdp, (caddr_t)&sin.sin_addr, 4, MB_MSYSTEM); 270 md_get_uint16(mdp, &port); 271 sin.sin_port = port; 272 nbp->nbp_state = NBST_RETARGET; 273 smb_nbst_disconnect(nbp->nbp_vc, td); 274 error = nb_connect_in(nbp, &sin, td); 275 if (!error) 276 error = nbssn_rq_request(nbp, td); 277 if (error) { 278 smb_nbst_disconnect(nbp->nbp_vc, td); 279 break; 280 } 281 } while(0); 282 if (m0) 283 md_done(mdp); 284 free(mdp, M_NBDATA); 285 return error; 286 } 287 288 static int 289 nbssn_recvhdr(struct nbpcb *nbp, int *lenp, 290 u_int8_t *rpcodep, int flags, struct thread *td) 291 { 292 struct socket *so = nbp->nbp_tso; 293 struct uio auio; 294 struct iovec aio; 295 u_int32_t len; 296 int error; 297 298 aio.iov_base = (caddr_t)&len; 299 aio.iov_len = sizeof(len); 300 auio.uio_iov = &aio; 301 auio.uio_iovcnt = 1; 302 auio.uio_segflg = UIO_SYSSPACE; 303 auio.uio_rw = UIO_READ; 304 auio.uio_offset = 0; 305 auio.uio_resid = sizeof(len); 306 auio.uio_td = td; 307 CURVNET_SET(so->so_vnet); 308 error = soreceive(so, (struct sockaddr **)NULL, &auio, 309 (struct mbuf **)NULL, (struct mbuf **)NULL, &flags); 310 CURVNET_RESTORE(); 311 if (error) 312 return error; 313 if (auio.uio_resid > 0) { 314 SMBSDEBUG("short reply\n"); 315 return EPIPE; 316 } 317 len = ntohl(len); 318 *rpcodep = (len >> 24) & 0xFF; 319 len &= 0x1ffff; 320 if (len > SMB_MAXPKTLEN) { 321 SMBERROR("packet too long (%d)\n", len); 322 return EFBIG; 323 } 324 *lenp = len; 325 return 0; 326 } 327 328 static int 329 nbssn_recv(struct nbpcb *nbp, struct mbuf **mpp, int *lenp, 330 u_int8_t *rpcodep, struct thread *td) 331 { 332 struct socket *so = nbp->nbp_tso; 333 struct uio auio; 334 struct mbuf *m, *tm, *im; 335 u_int8_t rpcode; 336 int len, resid; 337 int error, rcvflg; 338 339 if (so == NULL) 340 return ENOTCONN; 341 342 if (mpp) 343 *mpp = NULL; 344 m = NULL; 345 for(;;) { 346 /* 347 * Poll for a response header. 348 * If we don't have one waiting, return. 349 */ 350 len = 0; 351 rpcode = 0; 352 error = nbssn_recvhdr(nbp, &len, &rpcode, MSG_DONTWAIT, td); 353 if ((so->so_state & (SS_ISDISCONNECTING | SS_ISDISCONNECTED)) || 354 (so->so_rcv.sb_state & SBS_CANTRCVMORE)) { 355 nbp->nbp_state = NBST_CLOSED; 356 NBDEBUG("session closed by peer\n"); 357 return ECONNRESET; 358 } 359 if (error) 360 return error; 361 if (len == 0 && nbp->nbp_state != NBST_SESSION) 362 break; 363 /* no data, try again */ 364 if (rpcode == NB_SSN_KEEPALIVE) 365 continue; 366 367 /* 368 * Loop, blocking, for data following the response header. 369 * 370 * Note that we can't simply block here with MSG_WAITALL for the 371 * entire response size, as it may be larger than the TCP 372 * slow-start window that the sender employs. This will result 373 * in the sender stalling until the delayed ACK is sent, then 374 * resuming slow-start, resulting in very poor performance. 375 * 376 * Instead, we never request more than NB_SORECEIVE_CHUNK 377 * bytes at a time, resulting in an ack being pushed by 378 * the TCP code at the completion of each call. 379 */ 380 resid = len; 381 while (resid > 0) { 382 tm = NULL; 383 rcvflg = MSG_WAITALL; 384 bzero(&auio, sizeof(auio)); 385 auio.uio_resid = min(resid, NB_SORECEIVE_CHUNK); 386 auio.uio_td = td; 387 resid -= auio.uio_resid; 388 /* 389 * Spin until we have collected everything in 390 * this chunk. 391 */ 392 do { 393 rcvflg = MSG_WAITALL; 394 CURVNET_SET(so->so_vnet); 395 error = soreceive(so, (struct sockaddr **)NULL, 396 &auio, &tm, (struct mbuf **)NULL, &rcvflg); 397 CURVNET_RESTORE(); 398 } while (error == EWOULDBLOCK || error == EINTR || 399 error == ERESTART); 400 if (error) 401 goto out; 402 /* short return guarantees unhappiness */ 403 if (auio.uio_resid > 0) { 404 SMBERROR("packet is shorter than expected\n"); 405 error = EPIPE; 406 goto out; 407 } 408 /* append received chunk to previous chunk(s) */ 409 if (m == NULL) { 410 m = tm; 411 } else { 412 /* 413 * Just glue the new chain on the end. 414 * Consumer will pullup as required. 415 */ 416 for (im = m; im->m_next != NULL; im = im->m_next) 417 ; 418 im->m_next = tm; 419 } 420 } 421 /* got a session/message packet? */ 422 if (nbp->nbp_state == NBST_SESSION && 423 rpcode == NB_SSN_MESSAGE) 424 break; 425 /* drop packet and try for another */ 426 NBDEBUG("non-session packet %x\n", rpcode); 427 if (m) { 428 m_freem(m); 429 m = NULL; 430 } 431 } 432 433 out: 434 if (error) { 435 if (m) 436 m_freem(m); 437 return error; 438 } 439 if (mpp) 440 *mpp = m; 441 else 442 m_freem(m); 443 *lenp = len; 444 *rpcodep = rpcode; 445 return 0; 446 } 447 448 /* 449 * SMB transport interface 450 */ 451 static int 452 smb_nbst_create(struct smb_vc *vcp, struct thread *td) 453 { 454 struct nbpcb *nbp; 455 456 nbp = malloc(sizeof *nbp, M_NBDATA, M_WAITOK); 457 bzero(nbp, sizeof *nbp); 458 nbp->nbp_timo.tv_sec = 15; /* XXX: sysctl ? */ 459 nbp->nbp_state = NBST_CLOSED; 460 nbp->nbp_vc = vcp; 461 nbp->nbp_sndbuf = smb_tcpsndbuf; 462 nbp->nbp_rcvbuf = smb_tcprcvbuf; 463 vcp->vc_tdata = nbp; 464 return 0; 465 } 466 467 static int 468 smb_nbst_done(struct smb_vc *vcp, struct thread *td) 469 { 470 struct nbpcb *nbp = vcp->vc_tdata; 471 472 if (nbp == NULL) 473 return ENOTCONN; 474 smb_nbst_disconnect(vcp, td); 475 if (nbp->nbp_laddr) 476 free(nbp->nbp_laddr, M_SONAME); 477 if (nbp->nbp_paddr) 478 free(nbp->nbp_paddr, M_SONAME); 479 free(nbp, M_NBDATA); 480 return 0; 481 } 482 483 static int 484 smb_nbst_bind(struct smb_vc *vcp, struct sockaddr *sap, struct thread *td) 485 { 486 struct nbpcb *nbp = vcp->vc_tdata; 487 struct sockaddr_nb *snb; 488 int error, slen; 489 490 NBDEBUG("\n"); 491 error = EINVAL; 492 do { 493 if (nbp->nbp_flags & NBF_LOCADDR) 494 break; 495 /* 496 * It is possible to create NETBIOS name in the kernel, 497 * but nothing prevents us to do it in the user space. 498 */ 499 if (sap == NULL) 500 break; 501 slen = sap->sa_len; 502 if (slen < NB_MINSALEN) 503 break; 504 snb = (struct sockaddr_nb*)sodupsockaddr(sap, M_WAITOK); 505 if (snb == NULL) { 506 error = ENOMEM; 507 break; 508 } 509 nbp->nbp_laddr = snb; 510 nbp->nbp_flags |= NBF_LOCADDR; 511 error = 0; 512 } while(0); 513 return error; 514 } 515 516 static int 517 smb_nbst_connect(struct smb_vc *vcp, struct sockaddr *sap, struct thread *td) 518 { 519 struct nbpcb *nbp = vcp->vc_tdata; 520 struct sockaddr_in sin; 521 struct sockaddr_nb *snb; 522 struct timespec ts1, ts2; 523 int error, slen; 524 525 NBDEBUG("\n"); 526 if (nbp->nbp_tso != NULL) 527 return EISCONN; 528 if (nbp->nbp_laddr == NULL) 529 return EINVAL; 530 slen = sap->sa_len; 531 if (slen < NB_MINSALEN) 532 return EINVAL; 533 if (nbp->nbp_paddr) { 534 free(nbp->nbp_paddr, M_SONAME); 535 nbp->nbp_paddr = NULL; 536 } 537 snb = (struct sockaddr_nb*)sodupsockaddr(sap, M_WAITOK); 538 if (snb == NULL) 539 return ENOMEM; 540 nbp->nbp_paddr = snb; 541 sin = snb->snb_addrin; 542 getnanotime(&ts1); 543 error = nb_connect_in(nbp, &sin, td); 544 if (error) 545 return error; 546 getnanotime(&ts2); 547 timespecsub(&ts2, &ts1, &ts2); 548 if (ts2.tv_sec == 0) { 549 ts2.tv_sec = 1; 550 ts2.tv_nsec = 0; 551 } 552 timespecadd(&ts2, &ts2, &nbp->nbp_timo); 553 timespecadd(&nbp->nbp_timo, &ts2, &nbp->nbp_timo); 554 timespecadd(&nbp->nbp_timo, &ts2, &nbp->nbp_timo); /* * 4 */ 555 error = nbssn_rq_request(nbp, td); 556 if (error) 557 smb_nbst_disconnect(vcp, td); 558 return error; 559 } 560 561 static int 562 smb_nbst_disconnect(struct smb_vc *vcp, struct thread *td) 563 { 564 struct nbpcb *nbp = vcp->vc_tdata; 565 struct socket *so; 566 567 if (nbp == NULL || nbp->nbp_tso == NULL) 568 return ENOTCONN; 569 if ((so = nbp->nbp_tso) != NULL) { 570 nbp->nbp_flags &= ~NBF_CONNECTED; 571 nbp->nbp_tso = (struct socket *)NULL; 572 soshutdown(so, 2); 573 soclose(so); 574 } 575 if (nbp->nbp_state != NBST_RETARGET) { 576 nbp->nbp_state = NBST_CLOSED; 577 } 578 return 0; 579 } 580 581 static int 582 smb_nbst_send(struct smb_vc *vcp, struct mbuf *m0, struct thread *td) 583 { 584 struct nbpcb *nbp = vcp->vc_tdata; 585 int error; 586 587 if (nbp->nbp_state != NBST_SESSION) { 588 error = ENOTCONN; 589 goto abort; 590 } 591 M_PREPEND(m0, 4, M_WAITOK); 592 nb_sethdr(m0, NB_SSN_MESSAGE, m_fixhdr(m0) - 4); 593 error = nb_sosend(nbp->nbp_tso, m0, 0, td); 594 return error; 595 abort: 596 if (m0) 597 m_freem(m0); 598 return error; 599 } 600 601 static int 602 smb_nbst_recv(struct smb_vc *vcp, struct mbuf **mpp, struct thread *td) 603 { 604 struct nbpcb *nbp = vcp->vc_tdata; 605 u_int8_t rpcode; 606 int error, rplen; 607 608 nbp->nbp_flags |= NBF_RECVLOCK; 609 error = nbssn_recv(nbp, mpp, &rplen, &rpcode, td); 610 nbp->nbp_flags &= ~NBF_RECVLOCK; 611 return error; 612 } 613 614 static void 615 smb_nbst_timo(struct smb_vc *vcp) 616 { 617 return; 618 } 619 620 static void 621 smb_nbst_intr(struct smb_vc *vcp) 622 { 623 struct nbpcb *nbp = vcp->vc_tdata; 624 625 if (nbp == NULL || nbp->nbp_tso == NULL) 626 return; 627 sorwakeup(nbp->nbp_tso); 628 sowwakeup(nbp->nbp_tso); 629 } 630 631 static int 632 smb_nbst_getparam(struct smb_vc *vcp, int param, void *data) 633 { 634 struct nbpcb *nbp = vcp->vc_tdata; 635 636 switch (param) { 637 case SMBTP_SNDSZ: 638 *(int*)data = nbp->nbp_sndbuf; 639 break; 640 case SMBTP_RCVSZ: 641 *(int*)data = nbp->nbp_rcvbuf; 642 break; 643 case SMBTP_TIMEOUT: 644 *(struct timespec*)data = nbp->nbp_timo; 645 break; 646 default: 647 return EINVAL; 648 } 649 return 0; 650 } 651 652 static int 653 smb_nbst_setparam(struct smb_vc *vcp, int param, void *data) 654 { 655 struct nbpcb *nbp = vcp->vc_tdata; 656 657 switch (param) { 658 case SMBTP_SELECTID: 659 nbp->nbp_selectid = data; 660 break; 661 default: 662 return EINVAL; 663 } 664 return 0; 665 } 666 667 /* 668 * Check for fatal errors 669 */ 670 static int 671 smb_nbst_fatal(struct smb_vc *vcp, int error) 672 { 673 switch (error) { 674 case ENOTCONN: 675 case ENETRESET: 676 case ECONNABORTED: 677 return 1; 678 } 679 return 0; 680 } 681 682 struct smb_tran_desc smb_tran_nbtcp_desc = { 683 SMBT_NBTCP, 684 smb_nbst_create, smb_nbst_done, 685 smb_nbst_bind, smb_nbst_connect, smb_nbst_disconnect, 686 smb_nbst_send, smb_nbst_recv, 687 smb_nbst_timo, smb_nbst_intr, 688 smb_nbst_getparam, smb_nbst_setparam, 689 smb_nbst_fatal 690 }; 691