1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 2000-2001 Boris Popov 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 __FBSDID("$FreeBSD$"); 31 32 #include <sys/param.h> 33 #include <sys/condvar.h> 34 #include <sys/kernel.h> 35 #include <sys/lock.h> 36 #include <sys/malloc.h> 37 #include <sys/mbuf.h> 38 #include <sys/poll.h> 39 #include <sys/proc.h> 40 #include <sys/protosw.h> 41 #include <sys/signalvar.h> 42 #include <sys/socket.h> 43 #include <sys/socketvar.h> 44 #include <sys/sx.h> 45 #include <sys/sysctl.h> 46 #include <sys/systm.h> 47 #include <sys/uio.h> 48 49 #include <net/if.h> 50 #include <net/route.h> 51 #include <net/vnet.h> 52 53 #include <netinet/in.h> 54 #include <netinet/tcp.h> 55 56 #include <sys/mchain.h> 57 58 #include <netsmb/netbios.h> 59 60 #include <netsmb/smb.h> 61 #include <netsmb/smb_conn.h> 62 #include <netsmb/smb_tran.h> 63 #include <netsmb/smb_trantcp.h> 64 #include <netsmb/smb_subr.h> 65 66 #define M_NBDATA M_PCB 67 68 static int smb_tcpsndbuf = NB_SNDQ - 1; 69 static int smb_tcprcvbuf = NB_RCVQ - 1; 70 71 SYSCTL_DECL(_net_smb); 72 SYSCTL_INT(_net_smb, OID_AUTO, tcpsndbuf, CTLFLAG_RW, &smb_tcpsndbuf, 0, ""); 73 SYSCTL_INT(_net_smb, OID_AUTO, tcprcvbuf, CTLFLAG_RW, &smb_tcprcvbuf, 0, ""); 74 75 #define nb_sosend(so,m,flags,td) sosend(so, NULL, 0, m, 0, flags, td) 76 77 static int nbssn_recv(struct nbpcb *nbp, struct mbuf **mpp, int *lenp, 78 u_int8_t *rpcodep, struct thread *td); 79 static int smb_nbst_disconnect(struct smb_vc *vcp, struct thread *td); 80 81 static int 82 nb_setsockopt_int(struct socket *so, int level, int name, int val) 83 { 84 struct sockopt sopt; 85 int error; 86 87 bzero(&sopt, sizeof(sopt)); 88 sopt.sopt_level = level; 89 sopt.sopt_name = name; 90 sopt.sopt_val = &val; 91 sopt.sopt_valsize = sizeof(val); 92 CURVNET_SET(so->so_vnet); 93 error = sosetopt(so, &sopt); 94 CURVNET_RESTORE(); 95 return error; 96 } 97 98 static int 99 nb_intr(struct nbpcb *nbp, struct proc *p) 100 { 101 return 0; 102 } 103 104 static int 105 nb_upcall(struct socket *so, void *arg, int waitflag) 106 { 107 struct nbpcb *nbp = arg; 108 109 if (arg == NULL || nbp->nbp_selectid == NULL) 110 return (SU_OK); 111 wakeup(nbp->nbp_selectid); 112 return (SU_OK); 113 } 114 115 static int 116 nb_sethdr(struct mbuf *m, u_int8_t type, u_int32_t len) 117 { 118 u_int32_t *p = mtod(m, u_int32_t *); 119 120 *p = htonl((len & 0x1FFFF) | (type << 24)); 121 return 0; 122 } 123 124 static int 125 nb_put_name(struct mbchain *mbp, struct sockaddr_nb *snb) 126 { 127 int error; 128 u_char seglen, *cp; 129 130 cp = snb->snb_name; 131 if (*cp == 0) 132 return EINVAL; 133 NBDEBUG("[%s]\n", cp); 134 for (;;) { 135 seglen = (*cp) + 1; 136 error = mb_put_mem(mbp, cp, seglen, MB_MSYSTEM); 137 if (error) 138 return error; 139 if (seglen == 1) 140 break; 141 cp += seglen; 142 } 143 return 0; 144 } 145 146 static int 147 nb_connect_in(struct nbpcb *nbp, struct sockaddr_in *to, struct thread *td) 148 { 149 struct socket *so; 150 int error, s; 151 152 error = socreate(AF_INET, &so, SOCK_STREAM, IPPROTO_TCP, 153 td->td_ucred, td); 154 if (error) 155 return error; 156 nbp->nbp_tso = so; 157 SOCKBUF_LOCK(&so->so_rcv); 158 soupcall_set(so, SO_RCV, nb_upcall, nbp); 159 SOCKBUF_UNLOCK(&so->so_rcv); 160 so->so_rcv.sb_timeo = (5 * SBT_1S); 161 so->so_snd.sb_timeo = (5 * SBT_1S); 162 error = soreserve(so, nbp->nbp_sndbuf, nbp->nbp_rcvbuf); 163 if (error) 164 goto bad; 165 nb_setsockopt_int(so, SOL_SOCKET, SO_KEEPALIVE, 1); 166 nb_setsockopt_int(so, IPPROTO_TCP, TCP_NODELAY, 1); 167 SOCKBUF_LOCK(&so->so_rcv); 168 so->so_rcv.sb_flags &= ~SB_NOINTR; 169 SOCKBUF_UNLOCK(&so->so_rcv); 170 SOCKBUF_LOCK(&so->so_snd); 171 so->so_snd.sb_flags &= ~SB_NOINTR; 172 SOCKBUF_UNLOCK(&so->so_snd); 173 error = soconnect(so, (struct sockaddr*)to, td); 174 if (error) 175 goto bad; 176 s = splnet(); 177 while ((so->so_state & SS_ISCONNECTING) && so->so_error == 0) { 178 tsleep(&so->so_timeo, PSOCK, "nbcon", 2 * hz); 179 if ((so->so_state & SS_ISCONNECTING) && so->so_error == 0 && 180 (error = nb_intr(nbp, td->td_proc)) != 0) { 181 so->so_state &= ~SS_ISCONNECTING; 182 splx(s); 183 goto bad; 184 } 185 } 186 if (so->so_error) { 187 error = so->so_error; 188 so->so_error = 0; 189 splx(s); 190 goto bad; 191 } 192 splx(s); 193 return 0; 194 bad: 195 smb_nbst_disconnect(nbp->nbp_vc, td); 196 return error; 197 } 198 199 static int 200 nbssn_rq_request(struct nbpcb *nbp, struct thread *td) 201 { 202 struct mbchain *mbp; 203 struct mdchain *mdp; 204 struct mbuf *m0; 205 struct timeval tv; 206 struct sockaddr_in sin; 207 u_short port; 208 u_int8_t rpcode; 209 int error, rplen; 210 211 mbp = malloc(sizeof(struct mbchain), M_NBDATA, M_WAITOK); 212 mdp = malloc(sizeof(struct mbchain), M_NBDATA, M_WAITOK); 213 error = mb_init(mbp); 214 if (error) { 215 free(mbp, M_NBDATA); 216 free(mdp, M_NBDATA); 217 return error; 218 } 219 mb_put_uint32le(mbp, 0); 220 nb_put_name(mbp, nbp->nbp_paddr); 221 nb_put_name(mbp, nbp->nbp_laddr); 222 nb_sethdr(mbp->mb_top, NB_SSN_REQUEST, mb_fixhdr(mbp) - 4); 223 error = nb_sosend(nbp->nbp_tso, mbp->mb_top, 0, td); 224 if (!error) { 225 nbp->nbp_state = NBST_RQSENT; 226 } 227 mb_detach(mbp); 228 mb_done(mbp); 229 free(mbp, M_NBDATA); 230 if (error) { 231 free(mdp, M_NBDATA); 232 return error; 233 } 234 TIMESPEC_TO_TIMEVAL(&tv, &nbp->nbp_timo); 235 error = selsocket(nbp->nbp_tso, POLLIN, &tv, td); 236 if (error == EWOULDBLOCK) { /* Timeout */ 237 NBDEBUG("initial request timeout\n"); 238 free(mdp, M_NBDATA); 239 return ETIMEDOUT; 240 } 241 if (error) { /* restart or interrupt */ 242 free(mdp, M_NBDATA); 243 return error; 244 } 245 error = nbssn_recv(nbp, &m0, &rplen, &rpcode, td); 246 if (error) { 247 NBDEBUG("recv() error %d\n", error); 248 free(mdp, M_NBDATA); 249 return error; 250 } 251 /* 252 * Process NETBIOS reply 253 */ 254 if (m0) 255 md_initm(mdp, m0); 256 error = 0; 257 do { 258 if (rpcode == NB_SSN_POSRESP) { 259 nbp->nbp_state = NBST_SESSION; 260 nbp->nbp_flags |= NBF_CONNECTED; 261 break; 262 } 263 if (rpcode != NB_SSN_RTGRESP) { 264 error = ECONNABORTED; 265 break; 266 } 267 if (rplen != 6) { 268 error = ECONNABORTED; 269 break; 270 } 271 md_get_mem(mdp, (caddr_t)&sin.sin_addr, 4, MB_MSYSTEM); 272 md_get_uint16(mdp, &port); 273 sin.sin_port = port; 274 nbp->nbp_state = NBST_RETARGET; 275 smb_nbst_disconnect(nbp->nbp_vc, td); 276 error = nb_connect_in(nbp, &sin, td); 277 if (!error) 278 error = nbssn_rq_request(nbp, td); 279 if (error) { 280 smb_nbst_disconnect(nbp->nbp_vc, td); 281 break; 282 } 283 } while(0); 284 if (m0) 285 md_done(mdp); 286 free(mdp, M_NBDATA); 287 return error; 288 } 289 290 static int 291 nbssn_recvhdr(struct nbpcb *nbp, int *lenp, 292 u_int8_t *rpcodep, int flags, struct thread *td) 293 { 294 struct socket *so = nbp->nbp_tso; 295 struct uio auio; 296 struct iovec aio; 297 u_int32_t len; 298 int error; 299 300 aio.iov_base = (caddr_t)&len; 301 aio.iov_len = sizeof(len); 302 auio.uio_iov = &aio; 303 auio.uio_iovcnt = 1; 304 auio.uio_segflg = UIO_SYSSPACE; 305 auio.uio_rw = UIO_READ; 306 auio.uio_offset = 0; 307 auio.uio_resid = sizeof(len); 308 auio.uio_td = td; 309 CURVNET_SET(so->so_vnet); 310 error = soreceive(so, (struct sockaddr **)NULL, &auio, 311 (struct mbuf **)NULL, (struct mbuf **)NULL, &flags); 312 CURVNET_RESTORE(); 313 if (error) 314 return error; 315 if (auio.uio_resid > 0) { 316 SMBSDEBUG("short reply\n"); 317 return EPIPE; 318 } 319 len = ntohl(len); 320 *rpcodep = (len >> 24) & 0xFF; 321 len &= 0x1ffff; 322 if (len > SMB_MAXPKTLEN) { 323 SMBERROR("packet too long (%d)\n", len); 324 return EFBIG; 325 } 326 *lenp = len; 327 return 0; 328 } 329 330 static int 331 nbssn_recv(struct nbpcb *nbp, struct mbuf **mpp, int *lenp, 332 u_int8_t *rpcodep, struct thread *td) 333 { 334 struct socket *so = nbp->nbp_tso; 335 struct uio auio; 336 struct mbuf *m, *tm, *im; 337 u_int8_t rpcode; 338 int len, resid; 339 int error, rcvflg; 340 341 if (so == NULL) 342 return ENOTCONN; 343 344 if (mpp) 345 *mpp = NULL; 346 m = NULL; 347 for(;;) { 348 /* 349 * Poll for a response header. 350 * If we don't have one waiting, return. 351 */ 352 len = 0; 353 rpcode = 0; 354 error = nbssn_recvhdr(nbp, &len, &rpcode, MSG_DONTWAIT, td); 355 if ((so->so_state & (SS_ISDISCONNECTING | SS_ISDISCONNECTED)) || 356 (so->so_rcv.sb_state & SBS_CANTRCVMORE)) { 357 nbp->nbp_state = NBST_CLOSED; 358 NBDEBUG("session closed by peer\n"); 359 return ECONNRESET; 360 } 361 if (error) 362 return error; 363 if (len == 0 && nbp->nbp_state != NBST_SESSION) 364 break; 365 /* no data, try again */ 366 if (rpcode == NB_SSN_KEEPALIVE) 367 continue; 368 369 /* 370 * Loop, blocking, for data following the response header. 371 * 372 * Note that we can't simply block here with MSG_WAITALL for the 373 * entire response size, as it may be larger than the TCP 374 * slow-start window that the sender employs. This will result 375 * in the sender stalling until the delayed ACK is sent, then 376 * resuming slow-start, resulting in very poor performance. 377 * 378 * Instead, we never request more than NB_SORECEIVE_CHUNK 379 * bytes at a time, resulting in an ack being pushed by 380 * the TCP code at the completion of each call. 381 */ 382 resid = len; 383 while (resid > 0) { 384 tm = NULL; 385 rcvflg = MSG_WAITALL; 386 bzero(&auio, sizeof(auio)); 387 auio.uio_resid = min(resid, NB_SORECEIVE_CHUNK); 388 auio.uio_td = td; 389 resid -= auio.uio_resid; 390 /* 391 * Spin until we have collected everything in 392 * this chunk. 393 */ 394 do { 395 rcvflg = MSG_WAITALL; 396 CURVNET_SET(so->so_vnet); 397 error = soreceive(so, (struct sockaddr **)NULL, 398 &auio, &tm, (struct mbuf **)NULL, &rcvflg); 399 CURVNET_RESTORE(); 400 } while (error == EWOULDBLOCK || error == EINTR || 401 error == ERESTART); 402 if (error) 403 goto out; 404 /* short return guarantees unhappiness */ 405 if (auio.uio_resid > 0) { 406 SMBERROR("packet is shorter than expected\n"); 407 error = EPIPE; 408 goto out; 409 } 410 /* append received chunk to previous chunk(s) */ 411 if (m == NULL) { 412 m = tm; 413 } else { 414 /* 415 * Just glue the new chain on the end. 416 * Consumer will pullup as required. 417 */ 418 for (im = m; im->m_next != NULL; im = im->m_next) 419 ; 420 im->m_next = tm; 421 } 422 } 423 /* got a session/message packet? */ 424 if (nbp->nbp_state == NBST_SESSION && 425 rpcode == NB_SSN_MESSAGE) 426 break; 427 /* drop packet and try for another */ 428 NBDEBUG("non-session packet %x\n", rpcode); 429 if (m) { 430 m_freem(m); 431 m = NULL; 432 } 433 } 434 435 out: 436 if (error) { 437 if (m) 438 m_freem(m); 439 return error; 440 } 441 if (mpp) 442 *mpp = m; 443 else 444 m_freem(m); 445 *lenp = len; 446 *rpcodep = rpcode; 447 return 0; 448 } 449 450 /* 451 * SMB transport interface 452 */ 453 static int 454 smb_nbst_create(struct smb_vc *vcp, struct thread *td) 455 { 456 struct nbpcb *nbp; 457 458 nbp = malloc(sizeof *nbp, M_NBDATA, M_WAITOK); 459 bzero(nbp, sizeof *nbp); 460 nbp->nbp_timo.tv_sec = 15; /* XXX: sysctl ? */ 461 nbp->nbp_state = NBST_CLOSED; 462 nbp->nbp_vc = vcp; 463 nbp->nbp_sndbuf = smb_tcpsndbuf; 464 nbp->nbp_rcvbuf = smb_tcprcvbuf; 465 vcp->vc_tdata = nbp; 466 return 0; 467 } 468 469 static int 470 smb_nbst_done(struct smb_vc *vcp, struct thread *td) 471 { 472 struct nbpcb *nbp = vcp->vc_tdata; 473 474 if (nbp == NULL) 475 return ENOTCONN; 476 smb_nbst_disconnect(vcp, td); 477 if (nbp->nbp_laddr) 478 free(nbp->nbp_laddr, M_SONAME); 479 if (nbp->nbp_paddr) 480 free(nbp->nbp_paddr, M_SONAME); 481 free(nbp, M_NBDATA); 482 return 0; 483 } 484 485 static int 486 smb_nbst_bind(struct smb_vc *vcp, struct sockaddr *sap, struct thread *td) 487 { 488 struct nbpcb *nbp = vcp->vc_tdata; 489 struct sockaddr_nb *snb; 490 int error, slen; 491 492 NBDEBUG("\n"); 493 error = EINVAL; 494 do { 495 if (nbp->nbp_flags & NBF_LOCADDR) 496 break; 497 /* 498 * It is possible to create NETBIOS name in the kernel, 499 * but nothing prevents us to do it in the user space. 500 */ 501 if (sap == NULL) 502 break; 503 slen = sap->sa_len; 504 if (slen < NB_MINSALEN) 505 break; 506 snb = (struct sockaddr_nb*)sodupsockaddr(sap, M_WAITOK); 507 if (snb == NULL) { 508 error = ENOMEM; 509 break; 510 } 511 nbp->nbp_laddr = snb; 512 nbp->nbp_flags |= NBF_LOCADDR; 513 error = 0; 514 } while(0); 515 return error; 516 } 517 518 static int 519 smb_nbst_connect(struct smb_vc *vcp, struct sockaddr *sap, struct thread *td) 520 { 521 struct nbpcb *nbp = vcp->vc_tdata; 522 struct sockaddr_in sin; 523 struct sockaddr_nb *snb; 524 struct timespec ts1, ts2; 525 int error, slen; 526 527 NBDEBUG("\n"); 528 if (nbp->nbp_tso != NULL) 529 return EISCONN; 530 if (nbp->nbp_laddr == NULL) 531 return EINVAL; 532 slen = sap->sa_len; 533 if (slen < NB_MINSALEN) 534 return EINVAL; 535 if (nbp->nbp_paddr) { 536 free(nbp->nbp_paddr, M_SONAME); 537 nbp->nbp_paddr = NULL; 538 } 539 snb = (struct sockaddr_nb*)sodupsockaddr(sap, M_WAITOK); 540 if (snb == NULL) 541 return ENOMEM; 542 nbp->nbp_paddr = snb; 543 sin = snb->snb_addrin; 544 getnanotime(&ts1); 545 error = nb_connect_in(nbp, &sin, td); 546 if (error) 547 return error; 548 getnanotime(&ts2); 549 timespecsub(&ts2, &ts1, &ts2); 550 if (ts2.tv_sec == 0) { 551 ts2.tv_sec = 1; 552 ts2.tv_nsec = 0; 553 } 554 timespecadd(&ts2, &ts2, &nbp->nbp_timo); 555 timespecadd(&nbp->nbp_timo, &ts2, &nbp->nbp_timo); 556 timespecadd(&nbp->nbp_timo, &ts2, &nbp->nbp_timo); /* * 4 */ 557 error = nbssn_rq_request(nbp, td); 558 if (error) 559 smb_nbst_disconnect(vcp, td); 560 return error; 561 } 562 563 static int 564 smb_nbst_disconnect(struct smb_vc *vcp, struct thread *td) 565 { 566 struct nbpcb *nbp = vcp->vc_tdata; 567 struct socket *so; 568 569 if (nbp == NULL || nbp->nbp_tso == NULL) 570 return ENOTCONN; 571 if ((so = nbp->nbp_tso) != NULL) { 572 nbp->nbp_flags &= ~NBF_CONNECTED; 573 nbp->nbp_tso = (struct socket *)NULL; 574 soshutdown(so, 2); 575 soclose(so); 576 } 577 if (nbp->nbp_state != NBST_RETARGET) { 578 nbp->nbp_state = NBST_CLOSED; 579 } 580 return 0; 581 } 582 583 static int 584 smb_nbst_send(struct smb_vc *vcp, struct mbuf *m0, struct thread *td) 585 { 586 struct nbpcb *nbp = vcp->vc_tdata; 587 int error; 588 589 if (nbp->nbp_state != NBST_SESSION) { 590 error = ENOTCONN; 591 goto abort; 592 } 593 M_PREPEND(m0, 4, M_WAITOK); 594 nb_sethdr(m0, NB_SSN_MESSAGE, m_fixhdr(m0) - 4); 595 error = nb_sosend(nbp->nbp_tso, m0, 0, td); 596 return error; 597 abort: 598 if (m0) 599 m_freem(m0); 600 return error; 601 } 602 603 604 static int 605 smb_nbst_recv(struct smb_vc *vcp, struct mbuf **mpp, struct thread *td) 606 { 607 struct nbpcb *nbp = vcp->vc_tdata; 608 u_int8_t rpcode; 609 int error, rplen; 610 611 nbp->nbp_flags |= NBF_RECVLOCK; 612 error = nbssn_recv(nbp, mpp, &rplen, &rpcode, td); 613 nbp->nbp_flags &= ~NBF_RECVLOCK; 614 return error; 615 } 616 617 static void 618 smb_nbst_timo(struct smb_vc *vcp) 619 { 620 return; 621 } 622 623 static void 624 smb_nbst_intr(struct smb_vc *vcp) 625 { 626 struct nbpcb *nbp = vcp->vc_tdata; 627 628 if (nbp == NULL || nbp->nbp_tso == NULL) 629 return; 630 sorwakeup(nbp->nbp_tso); 631 sowwakeup(nbp->nbp_tso); 632 } 633 634 static int 635 smb_nbst_getparam(struct smb_vc *vcp, int param, void *data) 636 { 637 struct nbpcb *nbp = vcp->vc_tdata; 638 639 switch (param) { 640 case SMBTP_SNDSZ: 641 *(int*)data = nbp->nbp_sndbuf; 642 break; 643 case SMBTP_RCVSZ: 644 *(int*)data = nbp->nbp_rcvbuf; 645 break; 646 case SMBTP_TIMEOUT: 647 *(struct timespec*)data = nbp->nbp_timo; 648 break; 649 default: 650 return EINVAL; 651 } 652 return 0; 653 } 654 655 static int 656 smb_nbst_setparam(struct smb_vc *vcp, int param, void *data) 657 { 658 struct nbpcb *nbp = vcp->vc_tdata; 659 660 switch (param) { 661 case SMBTP_SELECTID: 662 nbp->nbp_selectid = data; 663 break; 664 default: 665 return EINVAL; 666 } 667 return 0; 668 } 669 670 /* 671 * Check for fatal errors 672 */ 673 static int 674 smb_nbst_fatal(struct smb_vc *vcp, int error) 675 { 676 switch (error) { 677 case ENOTCONN: 678 case ENETRESET: 679 case ECONNABORTED: 680 return 1; 681 } 682 return 0; 683 } 684 685 686 struct smb_tran_desc smb_tran_nbtcp_desc = { 687 SMBT_NBTCP, 688 smb_nbst_create, smb_nbst_done, 689 smb_nbst_bind, smb_nbst_connect, smb_nbst_disconnect, 690 smb_nbst_send, smb_nbst_recv, 691 smb_nbst_timo, smb_nbst_intr, 692 smb_nbst_getparam, smb_nbst_setparam, 693 smb_nbst_fatal 694 }; 695 696