1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2000-2001 Boris Popov 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include <sys/param.h> 30 #include <sys/condvar.h> 31 #include <sys/kernel.h> 32 #include <sys/lock.h> 33 #include <sys/malloc.h> 34 #include <sys/mbuf.h> 35 #include <sys/poll.h> 36 #include <sys/proc.h> 37 #include <sys/protosw.h> 38 #include <sys/signalvar.h> 39 #include <sys/socket.h> 40 #include <sys/socketvar.h> 41 #include <sys/sx.h> 42 #include <sys/sysctl.h> 43 #include <sys/systm.h> 44 #include <sys/uio.h> 45 46 #include <net/if.h> 47 #include <net/route.h> 48 #include <net/vnet.h> 49 50 #include <netinet/in.h> 51 #include <netinet/tcp.h> 52 53 #include <sys/mchain.h> 54 55 #include <netsmb/netbios.h> 56 57 #include <netsmb/smb.h> 58 #include <netsmb/smb_conn.h> 59 #include <netsmb/smb_tran.h> 60 #include <netsmb/smb_trantcp.h> 61 #include <netsmb/smb_subr.h> 62 63 #define M_NBDATA M_PCB 64 65 static int smb_tcpsndbuf = NB_SNDQ - 1; 66 static int smb_tcprcvbuf = NB_RCVQ - 1; 67 68 SYSCTL_DECL(_net_smb); 69 SYSCTL_INT(_net_smb, OID_AUTO, tcpsndbuf, CTLFLAG_RW, &smb_tcpsndbuf, 0, ""); 70 SYSCTL_INT(_net_smb, OID_AUTO, tcprcvbuf, CTLFLAG_RW, &smb_tcprcvbuf, 0, ""); 71 72 #define nb_sosend(so,m,flags,td) sosend(so, NULL, 0, m, 0, flags, td) 73 74 static int nbssn_recv(struct nbpcb *nbp, struct mbuf **mpp, int *lenp, 75 u_int8_t *rpcodep, struct thread *td); 76 static int smb_nbst_disconnect(struct smb_vc *vcp, struct thread *td); 77 78 static int 79 nb_setsockopt_int(struct socket *so, int level, int name, int val) 80 { 81 struct sockopt sopt; 82 int error; 83 84 bzero(&sopt, sizeof(sopt)); 85 sopt.sopt_level = level; 86 sopt.sopt_name = name; 87 sopt.sopt_val = &val; 88 sopt.sopt_valsize = sizeof(val); 89 CURVNET_SET(so->so_vnet); 90 error = sosetopt(so, &sopt); 91 CURVNET_RESTORE(); 92 return error; 93 } 94 95 static int 96 nb_intr(struct nbpcb *nbp, struct proc *p) 97 { 98 return 0; 99 } 100 101 static int 102 nb_upcall(struct socket *so, void *arg, int waitflag) 103 { 104 struct nbpcb *nbp = arg; 105 106 if (arg == NULL || nbp->nbp_selectid == NULL) 107 return (SU_OK); 108 wakeup(nbp->nbp_selectid); 109 return (SU_OK); 110 } 111 112 static int 113 nb_sethdr(struct mbuf *m, u_int8_t type, u_int32_t len) 114 { 115 u_int32_t *p = mtod(m, u_int32_t *); 116 117 *p = htonl((len & 0x1FFFF) | (type << 24)); 118 return 0; 119 } 120 121 static int 122 nb_put_name(struct mbchain *mbp, struct sockaddr_nb *snb) 123 { 124 int error; 125 u_char seglen, *cp; 126 127 cp = snb->snb_name; 128 if (*cp == 0) 129 return EINVAL; 130 NBDEBUG("[%s]\n", cp); 131 for (;;) { 132 seglen = (*cp) + 1; 133 error = mb_put_mem(mbp, cp, seglen, MB_MSYSTEM); 134 if (error) 135 return error; 136 if (seglen == 1) 137 break; 138 cp += seglen; 139 } 140 return 0; 141 } 142 143 static int 144 nb_connect_in(struct nbpcb *nbp, struct sockaddr_in *to, struct thread *td) 145 { 146 struct socket *so; 147 int error, s; 148 149 error = socreate(AF_INET, &so, SOCK_STREAM, IPPROTO_TCP, 150 td->td_ucred, td); 151 if (error) 152 return error; 153 nbp->nbp_tso = so; 154 SOCKBUF_LOCK(&so->so_rcv); 155 soupcall_set(so, SO_RCV, nb_upcall, nbp); 156 SOCKBUF_UNLOCK(&so->so_rcv); 157 so->so_rcv.sb_timeo = (5 * SBT_1S); 158 so->so_snd.sb_timeo = (5 * SBT_1S); 159 error = soreserve(so, nbp->nbp_sndbuf, nbp->nbp_rcvbuf); 160 if (error) 161 goto bad; 162 nb_setsockopt_int(so, SOL_SOCKET, SO_KEEPALIVE, 1); 163 nb_setsockopt_int(so, IPPROTO_TCP, TCP_NODELAY, 1); 164 error = soconnect(so, (struct sockaddr*)to, td); 165 if (error) 166 goto bad; 167 s = splnet(); 168 while ((so->so_state & SS_ISCONNECTING) && so->so_error == 0) { 169 tsleep(&so->so_timeo, PSOCK, "nbcon", 2 * hz); 170 if ((so->so_state & SS_ISCONNECTING) && so->so_error == 0 && 171 (error = nb_intr(nbp, td->td_proc)) != 0) { 172 so->so_state &= ~SS_ISCONNECTING; 173 splx(s); 174 goto bad; 175 } 176 } 177 if (so->so_error) { 178 error = so->so_error; 179 so->so_error = 0; 180 splx(s); 181 goto bad; 182 } 183 splx(s); 184 return 0; 185 bad: 186 smb_nbst_disconnect(nbp->nbp_vc, td); 187 return error; 188 } 189 190 static int 191 nbssn_rq_request(struct nbpcb *nbp, struct thread *td) 192 { 193 struct mbchain *mbp; 194 struct mdchain *mdp; 195 struct mbuf *m0; 196 struct timeval tv; 197 struct sockaddr_in sin; 198 u_short port; 199 u_int8_t rpcode; 200 int error, rplen; 201 202 mbp = malloc(sizeof(struct mbchain), M_NBDATA, M_WAITOK); 203 mdp = malloc(sizeof(struct mbchain), M_NBDATA, M_WAITOK); 204 error = mb_init(mbp); 205 if (error) { 206 free(mbp, M_NBDATA); 207 free(mdp, M_NBDATA); 208 return error; 209 } 210 mb_put_uint32le(mbp, 0); 211 nb_put_name(mbp, nbp->nbp_paddr); 212 nb_put_name(mbp, nbp->nbp_laddr); 213 nb_sethdr(mbp->mb_top, NB_SSN_REQUEST, mb_fixhdr(mbp) - 4); 214 error = nb_sosend(nbp->nbp_tso, mbp->mb_top, 0, td); 215 if (!error) { 216 nbp->nbp_state = NBST_RQSENT; 217 } 218 mb_detach(mbp); 219 mb_done(mbp); 220 free(mbp, M_NBDATA); 221 if (error) { 222 free(mdp, M_NBDATA); 223 return error; 224 } 225 TIMESPEC_TO_TIMEVAL(&tv, &nbp->nbp_timo); 226 error = selsocket(nbp->nbp_tso, POLLIN, &tv, td); 227 if (error == EWOULDBLOCK) { /* Timeout */ 228 NBDEBUG("initial request timeout\n"); 229 free(mdp, M_NBDATA); 230 return ETIMEDOUT; 231 } 232 if (error) { /* restart or interrupt */ 233 free(mdp, M_NBDATA); 234 return error; 235 } 236 error = nbssn_recv(nbp, &m0, &rplen, &rpcode, td); 237 if (error) { 238 NBDEBUG("recv() error %d\n", error); 239 free(mdp, M_NBDATA); 240 return error; 241 } 242 /* 243 * Process NETBIOS reply 244 */ 245 if (m0) 246 md_initm(mdp, m0); 247 error = 0; 248 do { 249 if (rpcode == NB_SSN_POSRESP) { 250 nbp->nbp_state = NBST_SESSION; 251 nbp->nbp_flags |= NBF_CONNECTED; 252 break; 253 } 254 if (rpcode != NB_SSN_RTGRESP) { 255 error = ECONNABORTED; 256 break; 257 } 258 if (rplen != 6) { 259 error = ECONNABORTED; 260 break; 261 } 262 md_get_mem(mdp, (caddr_t)&sin.sin_addr, 4, MB_MSYSTEM); 263 md_get_uint16(mdp, &port); 264 sin.sin_port = port; 265 nbp->nbp_state = NBST_RETARGET; 266 smb_nbst_disconnect(nbp->nbp_vc, td); 267 error = nb_connect_in(nbp, &sin, td); 268 if (!error) 269 error = nbssn_rq_request(nbp, td); 270 if (error) { 271 smb_nbst_disconnect(nbp->nbp_vc, td); 272 break; 273 } 274 } while(0); 275 if (m0) 276 md_done(mdp); 277 free(mdp, M_NBDATA); 278 return error; 279 } 280 281 static int 282 nbssn_recvhdr(struct nbpcb *nbp, int *lenp, 283 u_int8_t *rpcodep, int flags, struct thread *td) 284 { 285 struct socket *so = nbp->nbp_tso; 286 struct uio auio; 287 struct iovec aio; 288 u_int32_t len; 289 int error; 290 291 aio.iov_base = (caddr_t)&len; 292 aio.iov_len = sizeof(len); 293 auio.uio_iov = &aio; 294 auio.uio_iovcnt = 1; 295 auio.uio_segflg = UIO_SYSSPACE; 296 auio.uio_rw = UIO_READ; 297 auio.uio_offset = 0; 298 auio.uio_resid = sizeof(len); 299 auio.uio_td = td; 300 CURVNET_SET(so->so_vnet); 301 error = soreceive(so, (struct sockaddr **)NULL, &auio, 302 (struct mbuf **)NULL, (struct mbuf **)NULL, &flags); 303 CURVNET_RESTORE(); 304 if (error) 305 return error; 306 if (auio.uio_resid > 0) { 307 SMBSDEBUG("short reply\n"); 308 return EPIPE; 309 } 310 len = ntohl(len); 311 *rpcodep = (len >> 24) & 0xFF; 312 len &= 0x1ffff; 313 if (len > SMB_MAXPKTLEN) { 314 SMBERROR("packet too long (%d)\n", len); 315 return EFBIG; 316 } 317 *lenp = len; 318 return 0; 319 } 320 321 static int 322 nbssn_recv(struct nbpcb *nbp, struct mbuf **mpp, int *lenp, 323 u_int8_t *rpcodep, struct thread *td) 324 { 325 struct socket *so = nbp->nbp_tso; 326 struct uio auio; 327 struct mbuf *m, *tm, *im; 328 u_int8_t rpcode; 329 int len, resid; 330 int error, rcvflg; 331 332 if (so == NULL) 333 return ENOTCONN; 334 335 if (mpp) 336 *mpp = NULL; 337 m = NULL; 338 for(;;) { 339 /* 340 * Poll for a response header. 341 * If we don't have one waiting, return. 342 */ 343 len = 0; 344 rpcode = 0; 345 error = nbssn_recvhdr(nbp, &len, &rpcode, MSG_DONTWAIT, td); 346 if ((so->so_state & (SS_ISDISCONNECTING | SS_ISDISCONNECTED)) || 347 (so->so_rcv.sb_state & SBS_CANTRCVMORE)) { 348 nbp->nbp_state = NBST_CLOSED; 349 NBDEBUG("session closed by peer\n"); 350 return ECONNRESET; 351 } 352 if (error) 353 return error; 354 if (len == 0 && nbp->nbp_state != NBST_SESSION) 355 break; 356 /* no data, try again */ 357 if (rpcode == NB_SSN_KEEPALIVE) 358 continue; 359 360 /* 361 * Loop, blocking, for data following the response header. 362 * 363 * Note that we can't simply block here with MSG_WAITALL for the 364 * entire response size, as it may be larger than the TCP 365 * slow-start window that the sender employs. This will result 366 * in the sender stalling until the delayed ACK is sent, then 367 * resuming slow-start, resulting in very poor performance. 368 * 369 * Instead, we never request more than NB_SORECEIVE_CHUNK 370 * bytes at a time, resulting in an ack being pushed by 371 * the TCP code at the completion of each call. 372 */ 373 resid = len; 374 while (resid > 0) { 375 tm = NULL; 376 rcvflg = MSG_WAITALL; 377 bzero(&auio, sizeof(auio)); 378 auio.uio_resid = min(resid, NB_SORECEIVE_CHUNK); 379 auio.uio_td = td; 380 resid -= auio.uio_resid; 381 /* 382 * Spin until we have collected everything in 383 * this chunk. 384 */ 385 do { 386 rcvflg = MSG_WAITALL; 387 CURVNET_SET(so->so_vnet); 388 error = soreceive(so, (struct sockaddr **)NULL, 389 &auio, &tm, (struct mbuf **)NULL, &rcvflg); 390 CURVNET_RESTORE(); 391 } while (error == EWOULDBLOCK || error == EINTR || 392 error == ERESTART); 393 if (error) 394 goto out; 395 /* short return guarantees unhappiness */ 396 if (auio.uio_resid > 0) { 397 SMBERROR("packet is shorter than expected\n"); 398 error = EPIPE; 399 goto out; 400 } 401 /* append received chunk to previous chunk(s) */ 402 if (m == NULL) { 403 m = tm; 404 } else { 405 /* 406 * Just glue the new chain on the end. 407 * Consumer will pullup as required. 408 */ 409 for (im = m; im->m_next != NULL; im = im->m_next) 410 ; 411 im->m_next = tm; 412 } 413 } 414 /* got a session/message packet? */ 415 if (nbp->nbp_state == NBST_SESSION && 416 rpcode == NB_SSN_MESSAGE) 417 break; 418 /* drop packet and try for another */ 419 NBDEBUG("non-session packet %x\n", rpcode); 420 if (m) { 421 m_freem(m); 422 m = NULL; 423 } 424 } 425 426 out: 427 if (error) { 428 if (m) 429 m_freem(m); 430 return error; 431 } 432 if (mpp) 433 *mpp = m; 434 else 435 m_freem(m); 436 *lenp = len; 437 *rpcodep = rpcode; 438 return 0; 439 } 440 441 /* 442 * SMB transport interface 443 */ 444 static int 445 smb_nbst_create(struct smb_vc *vcp, struct thread *td) 446 { 447 struct nbpcb *nbp; 448 449 nbp = malloc(sizeof *nbp, M_NBDATA, M_WAITOK); 450 bzero(nbp, sizeof *nbp); 451 nbp->nbp_timo.tv_sec = 15; /* XXX: sysctl ? */ 452 nbp->nbp_state = NBST_CLOSED; 453 nbp->nbp_vc = vcp; 454 nbp->nbp_sndbuf = smb_tcpsndbuf; 455 nbp->nbp_rcvbuf = smb_tcprcvbuf; 456 vcp->vc_tdata = nbp; 457 return 0; 458 } 459 460 static int 461 smb_nbst_done(struct smb_vc *vcp, struct thread *td) 462 { 463 struct nbpcb *nbp = vcp->vc_tdata; 464 465 if (nbp == NULL) 466 return ENOTCONN; 467 smb_nbst_disconnect(vcp, td); 468 if (nbp->nbp_laddr) 469 free(nbp->nbp_laddr, M_SONAME); 470 if (nbp->nbp_paddr) 471 free(nbp->nbp_paddr, M_SONAME); 472 free(nbp, M_NBDATA); 473 return 0; 474 } 475 476 static int 477 smb_nbst_bind(struct smb_vc *vcp, struct sockaddr *sap, struct thread *td) 478 { 479 struct nbpcb *nbp = vcp->vc_tdata; 480 struct sockaddr_nb *snb; 481 int error, slen; 482 483 NBDEBUG("\n"); 484 error = EINVAL; 485 do { 486 if (nbp->nbp_flags & NBF_LOCADDR) 487 break; 488 /* 489 * It is possible to create NETBIOS name in the kernel, 490 * but nothing prevents us to do it in the user space. 491 */ 492 if (sap == NULL) 493 break; 494 slen = sap->sa_len; 495 if (slen < NB_MINSALEN) 496 break; 497 snb = (struct sockaddr_nb*)sodupsockaddr(sap, M_WAITOK); 498 if (snb == NULL) { 499 error = ENOMEM; 500 break; 501 } 502 nbp->nbp_laddr = snb; 503 nbp->nbp_flags |= NBF_LOCADDR; 504 error = 0; 505 } while(0); 506 return error; 507 } 508 509 static int 510 smb_nbst_connect(struct smb_vc *vcp, struct sockaddr *sap, struct thread *td) 511 { 512 struct nbpcb *nbp = vcp->vc_tdata; 513 struct sockaddr_in sin; 514 struct sockaddr_nb *snb; 515 struct timespec ts1, ts2; 516 int error, slen; 517 518 NBDEBUG("\n"); 519 if (nbp->nbp_tso != NULL) 520 return EISCONN; 521 if (nbp->nbp_laddr == NULL) 522 return EINVAL; 523 slen = sap->sa_len; 524 if (slen < NB_MINSALEN) 525 return EINVAL; 526 if (nbp->nbp_paddr) { 527 free(nbp->nbp_paddr, M_SONAME); 528 nbp->nbp_paddr = NULL; 529 } 530 snb = (struct sockaddr_nb*)sodupsockaddr(sap, M_WAITOK); 531 if (snb == NULL) 532 return ENOMEM; 533 nbp->nbp_paddr = snb; 534 sin = snb->snb_addrin; 535 getnanotime(&ts1); 536 error = nb_connect_in(nbp, &sin, td); 537 if (error) 538 return error; 539 getnanotime(&ts2); 540 timespecsub(&ts2, &ts1, &ts2); 541 if (ts2.tv_sec == 0) { 542 ts2.tv_sec = 1; 543 ts2.tv_nsec = 0; 544 } 545 timespecadd(&ts2, &ts2, &nbp->nbp_timo); 546 timespecadd(&nbp->nbp_timo, &ts2, &nbp->nbp_timo); 547 timespecadd(&nbp->nbp_timo, &ts2, &nbp->nbp_timo); /* * 4 */ 548 error = nbssn_rq_request(nbp, td); 549 if (error) 550 smb_nbst_disconnect(vcp, td); 551 return error; 552 } 553 554 static int 555 smb_nbst_disconnect(struct smb_vc *vcp, struct thread *td) 556 { 557 struct nbpcb *nbp = vcp->vc_tdata; 558 struct socket *so; 559 560 if (nbp == NULL || nbp->nbp_tso == NULL) 561 return ENOTCONN; 562 if ((so = nbp->nbp_tso) != NULL) { 563 nbp->nbp_flags &= ~NBF_CONNECTED; 564 nbp->nbp_tso = (struct socket *)NULL; 565 soshutdown(so, 2); 566 soclose(so); 567 } 568 if (nbp->nbp_state != NBST_RETARGET) { 569 nbp->nbp_state = NBST_CLOSED; 570 } 571 return 0; 572 } 573 574 static int 575 smb_nbst_send(struct smb_vc *vcp, struct mbuf *m0, struct thread *td) 576 { 577 struct nbpcb *nbp = vcp->vc_tdata; 578 int error; 579 580 if (nbp->nbp_state != NBST_SESSION) { 581 error = ENOTCONN; 582 goto abort; 583 } 584 M_PREPEND(m0, 4, M_WAITOK); 585 nb_sethdr(m0, NB_SSN_MESSAGE, m_fixhdr(m0) - 4); 586 error = nb_sosend(nbp->nbp_tso, m0, 0, td); 587 return error; 588 abort: 589 if (m0) 590 m_freem(m0); 591 return error; 592 } 593 594 static int 595 smb_nbst_recv(struct smb_vc *vcp, struct mbuf **mpp, struct thread *td) 596 { 597 struct nbpcb *nbp = vcp->vc_tdata; 598 u_int8_t rpcode; 599 int error, rplen; 600 601 nbp->nbp_flags |= NBF_RECVLOCK; 602 error = nbssn_recv(nbp, mpp, &rplen, &rpcode, td); 603 nbp->nbp_flags &= ~NBF_RECVLOCK; 604 return error; 605 } 606 607 static void 608 smb_nbst_timo(struct smb_vc *vcp) 609 { 610 return; 611 } 612 613 static void 614 smb_nbst_intr(struct smb_vc *vcp) 615 { 616 struct nbpcb *nbp = vcp->vc_tdata; 617 618 if (nbp == NULL || nbp->nbp_tso == NULL) 619 return; 620 sorwakeup(nbp->nbp_tso); 621 sowwakeup(nbp->nbp_tso); 622 } 623 624 static int 625 smb_nbst_getparam(struct smb_vc *vcp, int param, void *data) 626 { 627 struct nbpcb *nbp = vcp->vc_tdata; 628 629 switch (param) { 630 case SMBTP_SNDSZ: 631 *(int*)data = nbp->nbp_sndbuf; 632 break; 633 case SMBTP_RCVSZ: 634 *(int*)data = nbp->nbp_rcvbuf; 635 break; 636 case SMBTP_TIMEOUT: 637 *(struct timespec*)data = nbp->nbp_timo; 638 break; 639 default: 640 return EINVAL; 641 } 642 return 0; 643 } 644 645 static int 646 smb_nbst_setparam(struct smb_vc *vcp, int param, void *data) 647 { 648 struct nbpcb *nbp = vcp->vc_tdata; 649 650 switch (param) { 651 case SMBTP_SELECTID: 652 nbp->nbp_selectid = data; 653 break; 654 default: 655 return EINVAL; 656 } 657 return 0; 658 } 659 660 /* 661 * Check for fatal errors 662 */ 663 static int 664 smb_nbst_fatal(struct smb_vc *vcp, int error) 665 { 666 switch (error) { 667 case ENOTCONN: 668 case ENETRESET: 669 case ECONNABORTED: 670 return 1; 671 } 672 return 0; 673 } 674 675 struct smb_tran_desc smb_tran_nbtcp_desc = { 676 SMBT_NBTCP, 677 smb_nbst_create, smb_nbst_done, 678 smb_nbst_bind, smb_nbst_connect, smb_nbst_disconnect, 679 smb_nbst_send, smb_nbst_recv, 680 smb_nbst_timo, smb_nbst_intr, 681 smb_nbst_getparam, smb_nbst_setparam, 682 smb_nbst_fatal 683 }; 684