1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 24 * Copyright 2020 Tintri by DDN, Inc. All rights reserved. 25 * Copyright 2022 RackTop Systems, Inc. 26 */ 27 28 /* 29 * This module provides the common open functionality to the various 30 * open and create SMB interface functions. 31 */ 32 33 #include <sys/types.h> 34 #include <sys/cmn_err.h> 35 #include <sys/fcntl.h> 36 #include <sys/nbmlock.h> 37 #include <smbsrv/string.h> 38 #include <smbsrv/smb2_kproto.h> 39 #include <smbsrv/smb_fsops.h> 40 #include <smbsrv/smbinfo.h> 41 42 extern uint32_t smb_is_executable(char *); 43 static void smb_delete_new_object(smb_request_t *); 44 static int smb_set_open_attributes(smb_request_t *, smb_ofile_t *); 45 46 /* 47 * smb_access_generic_to_file 48 * 49 * Search MSDN for IoCreateFile to see following mapping. 50 * 51 * GENERIC_READ STANDARD_RIGHTS_READ, FILE_READ_DATA, 52 * FILE_READ_ATTRIBUTES and FILE_READ_EA 53 * 54 * GENERIC_WRITE STANDARD_RIGHTS_WRITE, FILE_WRITE_DATA, 55 * FILE_WRITE_ATTRIBUTES, FILE_WRITE_EA, and FILE_APPEND_DATA 56 * 57 * GENERIC_EXECUTE STANDARD_RIGHTS_EXECUTE, SYNCHRONIZE, and FILE_EXECUTE. 58 */ 59 static uint32_t 60 smb_access_generic_to_file(uint32_t desired_access) 61 { 62 uint32_t access = 0; 63 64 if (desired_access & GENERIC_ALL) 65 return (FILE_ALL_ACCESS & ~SYNCHRONIZE); 66 67 if (desired_access & GENERIC_EXECUTE) { 68 desired_access &= ~GENERIC_EXECUTE; 69 access |= (STANDARD_RIGHTS_EXECUTE | 70 SYNCHRONIZE | FILE_EXECUTE); 71 } 72 73 if (desired_access & GENERIC_WRITE) { 74 desired_access &= ~GENERIC_WRITE; 75 access |= (FILE_GENERIC_WRITE & ~SYNCHRONIZE); 76 } 77 78 if (desired_access & GENERIC_READ) { 79 desired_access &= ~GENERIC_READ; 80 access |= FILE_GENERIC_READ; 81 } 82 83 return (access | desired_access); 84 } 85 86 /* 87 * smb_omode_to_amask 88 * 89 * This function converts open modes used by Open and Open AndX 90 * commands to desired access bits used by NT Create AndX command. 91 */ 92 uint32_t 93 smb_omode_to_amask(uint32_t desired_access) 94 { 95 switch (desired_access & SMB_DA_ACCESS_MASK) { 96 case SMB_DA_ACCESS_READ: 97 return (FILE_GENERIC_READ); 98 99 case SMB_DA_ACCESS_WRITE: 100 return (FILE_GENERIC_WRITE); 101 102 case SMB_DA_ACCESS_READ_WRITE: 103 return (FILE_GENERIC_READ | FILE_GENERIC_WRITE); 104 105 case SMB_DA_ACCESS_EXECUTE: 106 return (FILE_GENERIC_READ | FILE_GENERIC_EXECUTE); 107 108 default: 109 return (FILE_GENERIC_ALL); 110 } 111 } 112 113 /* 114 * smb_denymode_to_sharemode 115 * 116 * This function converts deny modes used by Open and Open AndX 117 * commands to share access bits used by NT Create AndX command. 118 */ 119 uint32_t 120 smb_denymode_to_sharemode(uint32_t desired_access, char *fname) 121 { 122 switch (desired_access & SMB_DA_SHARE_MASK) { 123 case SMB_DA_SHARE_COMPATIBILITY: 124 if (smb_is_executable(fname)) 125 return (FILE_SHARE_READ | FILE_SHARE_WRITE); 126 127 return (FILE_SHARE_ALL); 128 129 case SMB_DA_SHARE_EXCLUSIVE: 130 return (FILE_SHARE_NONE); 131 132 case SMB_DA_SHARE_DENY_WRITE: 133 return (FILE_SHARE_READ); 134 135 case SMB_DA_SHARE_DENY_READ: 136 return (FILE_SHARE_WRITE); 137 138 case SMB_DA_SHARE_DENY_NONE: 139 default: 140 return (FILE_SHARE_READ | FILE_SHARE_WRITE); 141 } 142 } 143 144 /* 145 * smb_ofun_to_crdisposition 146 * 147 * This function converts open function values used by Open and Open AndX 148 * commands to create disposition values used by NT Create AndX command. 149 */ 150 uint32_t 151 smb_ofun_to_crdisposition(uint16_t ofun) 152 { 153 static int ofun_cr_map[3][2] = 154 { 155 { -1, FILE_CREATE }, 156 { FILE_OPEN, FILE_OPEN_IF }, 157 { FILE_OVERWRITE, FILE_OVERWRITE_IF } 158 }; 159 160 int row = ofun & SMB_OFUN_OPEN_MASK; 161 int col = (ofun & SMB_OFUN_CREATE_MASK) >> 4; 162 163 if (row == 3) 164 return (FILE_MAXIMUM_DISPOSITION + 1); 165 166 return (ofun_cr_map[row][col]); 167 } 168 169 /* 170 * smb_common_open 171 * 172 * Notes on write-through behaviour. It looks like pre-LM0.12 versions 173 * of the protocol specify the write-through mode when a file is opened, 174 * (SmbOpen, SmbOpenAndX) so the write calls (SmbWrite, SmbWriteAndClose, 175 * SmbWriteAndUnlock) don't need to contain a write-through flag. 176 * 177 * With LM0.12, the open calls (SmbCreateAndX, SmbNtTransactCreate) 178 * don't indicate which write-through mode to use. Instead the write 179 * calls (SmbWriteAndX, SmbWriteRaw) specify the mode on a per call 180 * basis. 181 * 182 * We don't care which open call was used to get us here, we just need 183 * to ensure that the write-through mode flag is copied from the open 184 * parameters to the node. We test the omode write-through flag in all 185 * write functions. 186 * 187 * This function returns NT status codes. 188 * 189 * The following rules apply when processing a file open request: 190 * 191 * - Oplocks must be broken prior to share checking as the break may 192 * cause other clients to close the file, which would affect sharing 193 * checks. 194 * 195 * - Share checks must take place prior to access checks for correct 196 * Windows semantics and to prevent unnecessary NFS delegation recalls. 197 * 198 * - Oplocks must be acquired after open to ensure the correct 199 * synchronization with NFS delegation and FEM installation. 200 * 201 * DOS readonly bit rules 202 * 203 * 1. The creator of a readonly file can write to/modify the size of the file 204 * using the original create fid, even though the file will appear as readonly 205 * to all other fids and via a CIFS getattr call. 206 * 207 * 2. A setinfo operation (using either an open fid or a path) to set/unset 208 * readonly will be successful regardless of whether a creator of a readonly 209 * file has an open fid. 210 * 211 * 3. The DOS readonly bit affects only data and some metadata. 212 * The following metadata can be changed regardless of the readonly bit: 213 * - security descriptors 214 * - DOS attributes 215 * - timestamps 216 * 217 * In the current implementation, the file size cannot be changed (except for 218 * the exceptions in #1 and #2, above). 219 * 220 * 221 * DOS attribute rules 222 * 223 * These rules are specific to creating / opening files and directories. 224 * How the attribute value (specifically ZERO or FILE_ATTRIBUTE_NORMAL) 225 * should be interpreted may differ in other requests. 226 * 227 * - An attribute value equal to ZERO or FILE_ATTRIBUTE_NORMAL means that the 228 * file's attributes should be cleared. 229 * - If FILE_ATTRIBUTE_NORMAL is specified with any other attributes, 230 * FILE_ATTRIBUTE_NORMAL is ignored. 231 * 232 * 1. Creating a new file 233 * - The request attributes + FILE_ATTRIBUTE_ARCHIVE are applied to the file. 234 * 235 * 2. Creating a new directory 236 * - The request attributes + FILE_ATTRIBUTE_DIRECTORY are applied to the file. 237 * - FILE_ATTRIBUTE_ARCHIVE does not get set. 238 * 239 * 3. Overwriting an existing file 240 * - the request attributes are used as search attributes. If the existing 241 * file does not meet the search criteria access is denied. 242 * - otherwise, applies attributes + FILE_ATTRIBUTE_ARCHIVE. 243 * 244 * 4. Opening an existing file or directory 245 * The request attributes are ignored. 246 */ 247 uint32_t 248 smb_common_open(smb_request_t *sr) 249 { 250 smb_server_t *sv = sr->sr_server; 251 smb_tree_t *tree = sr->tid_tree; 252 smb_node_t *fnode = NULL; 253 smb_node_t *dnode = NULL; 254 smb_node_t *cur_node = NULL; 255 smb_node_t *tmp_node = NULL; 256 smb_arg_open_t *op = &sr->sr_open; 257 smb_pathname_t *pn = &op->fqi.fq_path; 258 smb_ofile_t *of = NULL; 259 smb_attr_t new_attr; 260 hrtime_t shrlock_t0; 261 int max_requested = 0; 262 uint32_t max_allowed; 263 uint32_t status = NT_STATUS_SUCCESS; 264 int is_dir; 265 int rc; 266 boolean_t is_stream = B_FALSE; 267 int lookup_flags = SMB_FOLLOW_LINKS; 268 uint32_t uniq_fid = 0; 269 uint16_t tree_fid = 0; 270 boolean_t created = B_FALSE; 271 boolean_t last_comp_found = B_FALSE; 272 boolean_t stream_found = B_FALSE; 273 boolean_t opening_incr = B_FALSE; 274 boolean_t dnode_held = B_FALSE; 275 boolean_t dnode_wlock = B_FALSE; 276 boolean_t fnode_held = B_FALSE; 277 boolean_t fnode_wlock = B_FALSE; 278 boolean_t fnode_shrlk = B_FALSE; 279 boolean_t did_open = B_FALSE; 280 boolean_t did_break_handle = B_FALSE; 281 boolean_t did_cleanup_orphans = B_FALSE; 282 char *sname = NULL; 283 284 /* Get out now if we've been cancelled. */ 285 mutex_enter(&sr->sr_mutex); 286 if (sr->sr_state != SMB_REQ_STATE_ACTIVE) { 287 mutex_exit(&sr->sr_mutex); 288 return (NT_STATUS_CANCELLED); 289 } 290 mutex_exit(&sr->sr_mutex); 291 292 is_dir = (op->create_options & FILE_DIRECTORY_FILE) ? 1 : 0; 293 294 /* 295 * If the object being created or opened is a directory 296 * the Disposition parameter must be one of FILE_CREATE, 297 * FILE_OPEN, or FILE_OPEN_IF 298 */ 299 if (is_dir) { 300 if ((op->create_disposition != FILE_CREATE) && 301 (op->create_disposition != FILE_OPEN_IF) && 302 (op->create_disposition != FILE_OPEN)) { 303 return (NT_STATUS_INVALID_PARAMETER); 304 } 305 } 306 307 if (op->desired_access & MAXIMUM_ALLOWED) { 308 max_requested = 1; 309 op->desired_access &= ~MAXIMUM_ALLOWED; 310 } 311 op->desired_access = smb_access_generic_to_file(op->desired_access); 312 313 if (sr->session->s_cfg.skc_max_opens != 0 && 314 sr->session->s_file_cnt >= sr->session->s_cfg.skc_max_opens) { 315 ASSERT(sr->uid_user); 316 cmn_err(CE_NOTE, "smbsrv[%s\\%s]: TOO_MANY_OPENED_FILES", 317 sr->uid_user->u_domain, sr->uid_user->u_name); 318 return (NT_STATUS_TOO_MANY_OPENED_FILES); 319 } 320 321 if (smb_idpool_alloc(&tree->t_fid_pool, &tree_fid)) 322 return (NT_STATUS_TOO_MANY_OPENED_FILES); 323 324 /* This must be NULL at this point */ 325 sr->fid_ofile = NULL; 326 327 op->devstate = 0; 328 329 switch (sr->tid_tree->t_res_type & STYPE_MASK) { 330 case STYPE_DISKTREE: 331 case STYPE_PRINTQ: 332 break; 333 334 case STYPE_IPC: 335 /* 336 * Security descriptors for pipes are not implemented, 337 * so just setup a reasonable access mask. 338 */ 339 op->desired_access = (READ_CONTROL | SYNCHRONIZE | 340 FILE_READ_DATA | FILE_READ_ATTRIBUTES | 341 FILE_WRITE_DATA | FILE_APPEND_DATA); 342 343 /* 344 * Limit the number of open pipe instances. 345 */ 346 if ((rc = smb_threshold_enter(&sv->sv_opipe_ct)) != 0) { 347 status = RPC_NT_SERVER_TOO_BUSY; 348 goto errout; 349 } 350 351 /* 352 * Most of IPC open is handled in smb_opipe_open() 353 */ 354 op->create_options = 0; 355 of = smb_ofile_alloc(sr, op, NULL, SMB_FTYPE_MESG_PIPE, 356 tree_fid); 357 tree_fid = 0; // given to the ofile 358 status = smb_opipe_open(sr, of); 359 smb_threshold_exit(&sv->sv_opipe_ct); 360 if (status != NT_STATUS_SUCCESS) 361 goto errout; 362 return (NT_STATUS_SUCCESS); 363 364 default: 365 status = NT_STATUS_BAD_DEVICE_TYPE; 366 goto errout; 367 } 368 369 smb_pathname_init(sr, pn, pn->pn_path); 370 if (!smb_pathname_validate(sr, pn)) { 371 status = sr->smb_error.status; 372 goto errout; 373 } 374 375 if (strlen(pn->pn_path) >= SMB_MAXPATHLEN) { 376 status = NT_STATUS_OBJECT_PATH_INVALID; 377 goto errout; 378 } 379 380 if (is_dir) { 381 if (!smb_validate_dirname(sr, pn)) { 382 status = sr->smb_error.status; 383 goto errout; 384 } 385 } else { 386 if (!smb_validate_object_name(sr, pn)) { 387 status = sr->smb_error.status; 388 goto errout; 389 } 390 } 391 392 cur_node = op->fqi.fq_dnode ? 393 op->fqi.fq_dnode : sr->tid_tree->t_snode; 394 395 rc = smb_pathname_reduce(sr, sr->user_cr, pn->pn_path, 396 sr->tid_tree->t_snode, cur_node, &op->fqi.fq_dnode, 397 op->fqi.fq_last_comp); 398 if (rc != 0) { 399 status = smb_errno2status(rc); 400 goto errout; 401 } 402 dnode = op->fqi.fq_dnode; 403 dnode_held = B_TRUE; 404 405 /* 406 * Lock the parent dir node in case another create 407 * request to the same parent directory comes in. 408 * Drop this once either lookup succeeds, or we've 409 * created the object in this directory. 410 */ 411 smb_node_wrlock(dnode); 412 dnode_wlock = B_TRUE; 413 414 /* 415 * If the access mask has only DELETE set (ignore 416 * FILE_READ_ATTRIBUTES), then assume that this 417 * is a request to delete the link (if a link) 418 * and do not follow links. Otherwise, follow 419 * the link to the target. 420 */ 421 if ((op->desired_access & ~FILE_READ_ATTRIBUTES) == DELETE) 422 lookup_flags &= ~SMB_FOLLOW_LINKS; 423 424 /* 425 * Lookup *just* the file portion of the name. 426 * Returns stream name in sname, which this allocates 427 */ 428 rc = smb_fsop_lookup_file(sr, zone_kcred(), lookup_flags, 429 sr->tid_tree->t_snode, op->fqi.fq_dnode, op->fqi.fq_last_comp, 430 &sname, &op->fqi.fq_fnode); 431 432 if (rc == 0) { 433 last_comp_found = B_TRUE; 434 fnode = op->fqi.fq_fnode; 435 fnode_held = B_TRUE; 436 437 /* 438 * Need the DOS attributes below, where we 439 * check the search attributes (sattr). 440 * Also UID, for owner check below. 441 */ 442 op->fqi.fq_fattr.sa_mask = SMB_AT_DOSATTR | SMB_AT_UID; 443 rc = smb_node_getattr(sr, op->fqi.fq_fnode, zone_kcred(), 444 NULL, &op->fqi.fq_fattr); 445 if (rc != 0) { 446 status = NT_STATUS_INTERNAL_ERROR; 447 goto errout; 448 } 449 } else if (rc == ENOENT) { 450 last_comp_found = B_FALSE; 451 op->fqi.fq_fnode = NULL; 452 rc = 0; 453 } else { 454 status = smb_errno2status(rc); 455 goto errout; 456 } 457 458 if (last_comp_found) { 459 460 fnode = op->fqi.fq_fnode; 461 dnode = op->fqi.fq_dnode; 462 463 if (!smb_node_is_file(fnode) && 464 !smb_node_is_dir(fnode) && 465 !smb_node_is_symlink(fnode)) { 466 status = NT_STATUS_ACCESS_DENIED; 467 goto errout; 468 } 469 470 /* 471 * Reject this request if either: 472 * - the target IS a directory and the client requires that 473 * it must NOT be (required by Lotus Notes) 474 * - the target is NOT a directory and client requires that 475 * it MUST be. 476 * Streams are never directories. 477 */ 478 if (smb_node_is_dir(fnode) && sname == NULL) { 479 if (op->create_options & FILE_NON_DIRECTORY_FILE) { 480 status = NT_STATUS_FILE_IS_A_DIRECTORY; 481 goto errout; 482 } 483 } else { 484 if ((op->create_options & FILE_DIRECTORY_FILE) || 485 (op->nt_flags & NT_CREATE_FLAG_OPEN_TARGET_DIR)) { 486 status = NT_STATUS_NOT_A_DIRECTORY; 487 goto errout; 488 } 489 } 490 491 /* If we're given a stream name, look it up now */ 492 if (sname != NULL) { 493 tmp_node = fnode; 494 rc = smb_fsop_lookup_stream(sr, zone_kcred(), 495 lookup_flags, sr->tid_tree->t_snode, fnode, sname, 496 &fnode); 497 } else { 498 rc = 0; 499 } 500 501 if (rc == 0) { /* Stream Exists (including unnamed stream) */ 502 stream_found = B_TRUE; 503 smb_node_unlock(dnode); 504 dnode_wlock = B_FALSE; 505 506 if (tmp_node != NULL) 507 smb_node_release(tmp_node); 508 509 /* 510 * No more open should be accepted when 511 * "Delete on close" flag is set. 512 */ 513 if (fnode->flags & NODE_FLAGS_DELETE_ON_CLOSE) { 514 status = NT_STATUS_DELETE_PENDING; 515 goto errout; 516 } 517 518 /* 519 * Specified file already exists 520 * so the operation should fail. 521 */ 522 if (op->create_disposition == FILE_CREATE) { 523 status = NT_STATUS_OBJECT_NAME_COLLISION; 524 goto errout; 525 } 526 527 if ((op->create_disposition == FILE_SUPERSEDE) || 528 (op->create_disposition == FILE_OVERWRITE_IF) || 529 (op->create_disposition == FILE_OVERWRITE)) { 530 531 if (sname == NULL) { 532 if (!smb_sattr_check( 533 op->fqi.fq_fattr.sa_dosattr, 534 op->dattr)) { 535 status = 536 NT_STATUS_ACCESS_DENIED; 537 goto errout; 538 } 539 op->desired_access |= 540 FILE_WRITE_ATTRIBUTES; 541 } 542 543 if (smb_node_is_dir(fnode)) { 544 status = NT_STATUS_ACCESS_DENIED; 545 goto errout; 546 } 547 } 548 549 /* MS-FSA 2.1.5.1.2 */ 550 if (op->create_disposition == FILE_SUPERSEDE) 551 op->desired_access |= DELETE; 552 if ((op->create_disposition == FILE_OVERWRITE_IF) || 553 (op->create_disposition == FILE_OVERWRITE)) 554 op->desired_access |= FILE_WRITE_DATA; 555 } else if (rc == ENOENT) { /* File Exists, but Stream doesn't */ 556 if (op->create_disposition == FILE_OPEN || 557 op->create_disposition == FILE_OVERWRITE) { 558 status = NT_STATUS_OBJECT_NAME_NOT_FOUND; 559 goto errout; 560 } 561 562 op->desired_access |= FILE_WRITE_DATA; 563 } else { /* Error looking up stream */ 564 status = smb_errno2status(rc); 565 fnode = tmp_node; 566 goto errout; 567 } 568 569 /* 570 * Windows seems to check read-only access before file 571 * sharing check. 572 * 573 * Check to see if the file is currently readonly (regardless 574 * of whether this open will make it readonly). 575 * Readonly is ignored on directories. 576 */ 577 if (SMB_PATHFILE_IS_READONLY(sr, fnode) && 578 !smb_node_is_dir(fnode)) { 579 if (op->desired_access & 580 (FILE_WRITE_DATA | FILE_APPEND_DATA)) { 581 status = NT_STATUS_ACCESS_DENIED; 582 goto errout; 583 } 584 if (op->create_options & FILE_DELETE_ON_CLOSE) { 585 status = NT_STATUS_CANNOT_DELETE; 586 goto errout; 587 } 588 } 589 590 /* Dataset roots can't be deleted, so don't set DOC */ 591 if ((op->create_options & FILE_DELETE_ON_CLOSE) != 0 && 592 (fnode->flags & NODE_FLAGS_VFSROOT) != 0) { 593 status = NT_STATUS_CANNOT_DELETE; 594 goto errout; 595 } 596 597 status = smb_fsop_access(sr, sr->user_cr, fnode, 598 op->desired_access); 599 600 if (status != NT_STATUS_SUCCESS) 601 goto errout; 602 603 if (max_requested) { 604 smb_fsop_eaccess(sr, sr->user_cr, fnode, &max_allowed); 605 op->desired_access |= max_allowed; 606 } 607 608 /* 609 * File owner should always get read control + read attr. 610 */ 611 if (crgetuid(sr->user_cr) == op->fqi.fq_fattr.sa_vattr.va_uid) 612 op->desired_access |= 613 (READ_CONTROL | FILE_READ_ATTRIBUTES); 614 615 /* 616 * According to MS "dochelp" mail in Mar 2015, any handle 617 * on which read or write access is granted implicitly 618 * gets "read attributes", even if it was not requested. 619 */ 620 if ((op->desired_access & FILE_DATA_ALL) != 0) 621 op->desired_access |= FILE_READ_ATTRIBUTES; 622 623 /* If the stream didn't exist, create it now */ 624 if (!stream_found) { 625 smb_node_t *tmp_node = fnode; 626 627 bzero(&new_attr, sizeof (new_attr)); 628 new_attr.sa_vattr.va_type = VREG; 629 new_attr.sa_vattr.va_mode = S_IRUSR; 630 new_attr.sa_mask |= SMB_AT_TYPE | SMB_AT_MODE; 631 632 rc = smb_fsop_create_stream(sr, sr->user_cr, dnode, 633 fnode, sname, lookup_flags, &new_attr, &fnode); 634 smb_node_release(tmp_node); 635 636 if (rc != 0) { 637 status = smb_errno2status(rc); 638 fnode_held = B_FALSE; 639 goto errout; 640 } 641 op->action_taken = SMB_OACT_CREATED; 642 created = B_TRUE; 643 644 smb_node_unlock(dnode); 645 dnode_wlock = B_FALSE; 646 } 647 648 /* 649 * Oplock break is done prior to sharing checks as the break 650 * may cause other clients to close the file which would 651 * affect the sharing checks, and may delete the file due to 652 * DELETE_ON_CLOSE. This may block, so set the file opening 653 * count before oplock stuff. 654 * 655 * Need the "proposed" ofile (and its TargetOplockKey) for 656 * correct oplock break semantics. 657 */ 658 of = smb_ofile_alloc(sr, op, fnode, SMB_FTYPE_DISK, 659 tree_fid); 660 tree_fid = 0; // given to the ofile 661 uniq_fid = of->f_uniqid; 662 663 smb_node_inc_opening_count(fnode); 664 opening_incr = B_TRUE; 665 666 if (!stream_found) { 667 /* 668 * Stake our Share Access claim. 669 */ 670 smb_node_wrlock(fnode); 671 fnode_wlock = B_TRUE; 672 673 status = smb_fsop_shrlock(sr->user_cr, fnode, uniq_fid, 674 op->desired_access, op->share_access); 675 if (status != 0) 676 goto errout; 677 678 fnode_shrlk = B_TRUE; 679 smb_node_unlock(fnode); 680 fnode_wlock = B_FALSE; 681 goto stream_created; 682 } 683 684 /* 685 * XXX Supposed to do share access checks next. 686 * [MS-FSA] describes that as part of access check: 687 * 2.1.5.1.2.1 Alg... Check Access to an Existing File 688 * 689 * If CreateDisposition is FILE_OPEN or FILE_OPEN_IF: 690 * If Open.Stream.Oplock is not empty and 691 * Open.Stream.Oplock.State contains BATCH_OPLOCK, 692 * the object store MUST check for an oplock 693 * break according to the algorithm in section 2.1.4.12, 694 * with input values as follows: 695 * Open equal to this operation's Open 696 * Oplock equal to Open.Stream.Oplock 697 * Operation equal to "OPEN" 698 * OpParams containing two members: 699 * DesiredAccess, CreateDisposition 700 * 701 * It's not clear how Windows would ask the FS layer if 702 * the file has a BATCH oplock. We'll use a call to the 703 * common oplock code, which calls smb_oplock_break_OPEN 704 * only if the oplock state contains BATCH_OPLOCK. 705 * See: smb_oplock_break_BATCH() 706 * 707 * Also note: There's a nearly identical section in the 708 * spec. at the start of the "else" part of the above 709 * "if (disposition is overwrite, overwrite_if)" so this 710 * section (oplock break, the share mode check, and the 711 * next oplock_break_HANDLE) are all factored out to be 712 * in all cases above that if/else from the spec. 713 */ 714 status = smb_oplock_break_BATCH(fnode, of, 715 op->desired_access, op->create_disposition); 716 if (status == NT_STATUS_OPLOCK_BREAK_IN_PROGRESS) { 717 if (sr->session->dialect >= SMB_VERS_2_BASE) 718 (void) smb2sr_go_async(sr); 719 status = smb_oplock_wait_break(sr, fnode, 0); 720 } 721 if (status != NT_STATUS_SUCCESS) 722 goto errout; 723 724 /* 725 * Check for sharing violations, and if any, 726 * do oplock break of handle caching. 727 * 728 * Need node_wrlock during shrlock checks, 729 * and not locked during oplock breaks etc. 730 */ 731 shrlock_t0 = gethrtime(); 732 shrlock_again: 733 smb_node_wrlock(fnode); 734 fnode_wlock = B_TRUE; 735 status = smb_fsop_shrlock(sr->user_cr, fnode, uniq_fid, 736 op->desired_access, op->share_access); 737 smb_node_unlock(fnode); 738 fnode_wlock = B_FALSE; 739 740 /* 741 * [MS-FSA] "OPEN_BREAK_H" 742 * If the (proposed) new open would violate sharing rules, 743 * indicate an oplock break with OPEN_BREAK_H (to break 744 * handle level caching rights) then try again. 745 */ 746 if (status == NT_STATUS_SHARING_VIOLATION && 747 did_break_handle == B_FALSE) { 748 did_break_handle = B_TRUE; 749 750 status = smb_oplock_break_HANDLE(fnode, of); 751 if (status == NT_STATUS_OPLOCK_BREAK_IN_PROGRESS) { 752 if (sr->session->dialect >= SMB_VERS_2_BASE) 753 (void) smb2sr_go_async(sr); 754 status = smb_oplock_wait_break(sr, fnode, 0); 755 } else { 756 /* 757 * Even when the oplock layer does NOT 758 * give us the special status indicating 759 * we should wait, it may have scheduled 760 * taskq jobs that may close handles. 761 * Give those a chance to run before we 762 * check again for sharing violations. 763 */ 764 delay(MSEC_TO_TICK(10)); 765 } 766 if (status != NT_STATUS_SUCCESS) 767 goto errout; 768 769 goto shrlock_again; 770 } 771 772 /* 773 * If we still have orphaned durable handles on this file, 774 * let's assume the client has lost interest in those and 775 * close them so they don't cause sharing violations. 776 * See longer comment at smb2_dh_close_my_orphans(). 777 */ 778 if (status == NT_STATUS_SHARING_VIOLATION && 779 sr->session->dialect >= SMB_VERS_2_BASE && 780 did_cleanup_orphans == B_FALSE) { 781 782 did_cleanup_orphans = B_TRUE; 783 smb2_dh_close_my_orphans(sr, of); 784 785 goto shrlock_again; 786 } 787 788 /* 789 * SMB1 expects a 1 sec. delay before returning a 790 * sharing violation error. If breaking oplocks 791 * above took less than a sec, wait some more. 792 * See: smbtorture base.defer_open 793 */ 794 if (status == NT_STATUS_SHARING_VIOLATION && 795 sr->session->dialect < SMB_VERS_2_BASE) { 796 hrtime_t t1 = shrlock_t0 + NANOSEC; 797 hrtime_t now = gethrtime(); 798 if (now < t1) { 799 delay(NSEC_TO_TICK_ROUNDUP(t1 - now)); 800 } 801 } 802 803 if (status != NT_STATUS_SUCCESS) 804 goto errout; 805 fnode_shrlk = B_TRUE; 806 807 /* 808 * The [MS-FSA] spec. describes this oplock break as 809 * part of the sharing access checks. See: 810 * 2.1.5.1.2.2 Algorithm to Check Sharing Access... 811 * At the end of the share mode tests described there, 812 * if it has not returned "sharing violation", it 813 * specifies a call to the alg. in sec. 2.1.4.12, 814 * that boils down to: smb_oplock_break_OPEN() 815 */ 816 status = smb_oplock_break_OPEN(fnode, of, 817 op->desired_access, 818 op->create_disposition); 819 if (status == NT_STATUS_OPLOCK_BREAK_IN_PROGRESS) { 820 if (sr->session->dialect >= SMB_VERS_2_BASE) 821 (void) smb2sr_go_async(sr); 822 status = smb_oplock_wait_break(sr, fnode, 0); 823 } 824 if (status != NT_STATUS_SUCCESS) 825 goto errout; 826 827 if ((fnode->flags & NODE_FLAGS_DELETE_COMMITTED) != 0) { 828 /* 829 * Breaking the oplock caused the file to be deleted, 830 * so let's bail and pretend the file wasn't found. 831 * Have to duplicate much of the logic found a the 832 * "errout" label here. 833 * 834 * This code path is exercised by smbtorture 835 * smb2.durable-open.delete_on_close1 836 */ 837 DTRACE_PROBE1(node_deleted, smb_node_t *, fnode); 838 tree_fid = of->f_fid; 839 of->f_fid = 0; 840 smb_ofile_free(of); 841 of = NULL; 842 last_comp_found = B_FALSE; 843 844 /* 845 * Get all the holds and locks into the state 846 * they would have if lookup had failed. 847 */ 848 fnode_shrlk = B_FALSE; 849 smb_fsop_unshrlock(sr->user_cr, fnode, uniq_fid); 850 851 opening_incr = B_FALSE; 852 smb_node_dec_opening_count(fnode); 853 854 fnode_held = B_FALSE; 855 smb_node_release(fnode); 856 857 dnode_wlock = B_TRUE; 858 smb_node_wrlock(dnode); 859 860 goto create; 861 } 862 863 /* 864 * Go ahead with modifications as necessary. 865 */ 866 switch (op->create_disposition) { 867 case FILE_SUPERSEDE: 868 case FILE_OVERWRITE_IF: 869 case FILE_OVERWRITE: 870 bzero(&new_attr, sizeof (new_attr)); 871 if (sname == NULL) { 872 op->dattr |= FILE_ATTRIBUTE_ARCHIVE; 873 /* 874 * Don't apply readonly until 875 * smb_set_open_attributes 876 */ 877 if (op->dattr & FILE_ATTRIBUTE_READONLY) { 878 op->dattr &= ~FILE_ATTRIBUTE_READONLY; 879 op->created_readonly = B_TRUE; 880 } 881 new_attr.sa_dosattr = op->dattr; 882 } else { 883 new_attr.sa_dosattr = FILE_ATTRIBUTE_ARCHIVE; 884 } 885 886 /* 887 * Truncate the file data here. 888 * We set alloc_size = op->dsize later, 889 * after we have an ofile. See: 890 * smb_set_open_attributes 891 */ 892 new_attr.sa_vattr.va_size = 0; 893 new_attr.sa_mask = SMB_AT_DOSATTR | SMB_AT_SIZE; 894 rc = smb_fsop_setattr(sr, sr->user_cr, fnode, 895 &new_attr); 896 if (rc != 0) { 897 status = smb_errno2status(rc); 898 goto errout; 899 } 900 901 /* 902 * If file is being replaced, remove existing streams 903 */ 904 if (SMB_IS_STREAM(fnode) == 0) { 905 status = smb_fsop_remove_streams(sr, 906 sr->user_cr, fnode); 907 if (status != 0) 908 goto errout; 909 } 910 911 op->action_taken = SMB_OACT_TRUNCATED; 912 break; 913 914 default: 915 /* 916 * FILE_OPEN or FILE_OPEN_IF. 917 */ 918 /* 919 * Ignore any user-specified alloc_size for 920 * existing files, to avoid truncation in 921 * smb_set_open_attributes 922 */ 923 op->dsize = 0L; 924 op->action_taken = SMB_OACT_OPENED; 925 break; 926 } 927 } else { 928 create: 929 /* Last component was not found. */ 930 dnode = op->fqi.fq_dnode; 931 932 if (is_dir == 0) 933 is_stream = smb_is_stream_name(pn->pn_path); 934 935 if ((op->create_disposition == FILE_OPEN) || 936 (op->create_disposition == FILE_OVERWRITE)) { 937 status = NT_STATUS_OBJECT_NAME_NOT_FOUND; 938 goto errout; 939 } 940 941 if (is_dir != 0 && 942 (op->dattr & FILE_ATTRIBUTE_TEMPORARY) != 0) { 943 status = NT_STATUS_INVALID_PARAMETER; 944 goto errout; 945 } 946 947 if ((op->dattr & FILE_ATTRIBUTE_READONLY) != 0 && 948 (op->create_options & FILE_DELETE_ON_CLOSE) != 0) { 949 status = NT_STATUS_CANNOT_DELETE; 950 goto errout; 951 } 952 953 if ((op->desired_access & ACCESS_SYSTEM_SECURITY) != 0 && 954 !smb_user_has_security_priv(sr->uid_user, sr->user_cr)) { 955 status = NT_STATUS_ACCESS_DENIED; 956 goto errout; 957 } 958 959 if (pn->pn_fname && smb_is_invalid_filename(pn->pn_fname)) { 960 status = NT_STATUS_OBJECT_NAME_INVALID; 961 goto errout; 962 } 963 964 /* 965 * Don't create in directories marked "Delete on close". 966 */ 967 if (dnode->flags & NODE_FLAGS_DELETE_ON_CLOSE) { 968 status = NT_STATUS_DELETE_PENDING; 969 goto errout; 970 } 971 972 /* 973 * Create always sets the DOS attributes, type, and mode 974 * in the if/else below (different for file vs directory). 975 * Don't set the readonly bit until smb_set_open_attributes 976 * or that would prevent this open. Note that op->dattr 977 * needs to be what smb_set_open_attributes will use, 978 * except for the readonly bit. 979 */ 980 bzero(&new_attr, sizeof (new_attr)); 981 new_attr.sa_mask = SMB_AT_DOSATTR | SMB_AT_TYPE | SMB_AT_MODE; 982 if (op->dattr & FILE_ATTRIBUTE_READONLY) { 983 op->dattr &= ~FILE_ATTRIBUTE_READONLY; 984 op->created_readonly = B_TRUE; 985 } 986 987 /* 988 * SMB create can specify the create time. 989 */ 990 if ((op->crtime.tv_sec != 0) && 991 (op->crtime.tv_sec != UINT_MAX)) { 992 new_attr.sa_mask |= SMB_AT_CRTIME; 993 new_attr.sa_crtime = op->crtime; 994 } 995 996 if (is_dir == 0) { 997 op->dattr |= FILE_ATTRIBUTE_ARCHIVE; 998 new_attr.sa_dosattr = op->dattr; 999 new_attr.sa_vattr.va_type = VREG; 1000 if (is_stream) 1001 new_attr.sa_vattr.va_mode = S_IRUSR | S_IWUSR; 1002 else 1003 new_attr.sa_vattr.va_mode = 1004 S_IRUSR | S_IRGRP | S_IROTH | 1005 S_IWUSR | S_IWGRP | S_IWOTH; 1006 1007 /* 1008 * We set alloc_size = op->dsize later, 1009 * (in smb_set_open_attributes) after we 1010 * have an ofile on which to save that. 1011 * 1012 * Legacy Open&X sets size to alloc_size 1013 * when creating a new file. 1014 */ 1015 if (sr->smb_com == SMB_COM_OPEN_ANDX) { 1016 new_attr.sa_vattr.va_size = op->dsize; 1017 new_attr.sa_mask |= SMB_AT_SIZE; 1018 } 1019 1020 rc = smb_fsop_create(sr, sr->user_cr, dnode, 1021 op->fqi.fq_last_comp, &new_attr, &op->fqi.fq_fnode); 1022 } else { 1023 op->dattr |= FILE_ATTRIBUTE_DIRECTORY; 1024 new_attr.sa_dosattr = op->dattr; 1025 new_attr.sa_vattr.va_type = VDIR; 1026 new_attr.sa_vattr.va_mode = 0777; 1027 1028 rc = smb_fsop_mkdir(sr, sr->user_cr, dnode, 1029 op->fqi.fq_last_comp, &new_attr, &op->fqi.fq_fnode); 1030 } 1031 if (rc != 0) { 1032 status = smb_errno2status(rc); 1033 goto errout; 1034 } 1035 1036 /* Create done. */ 1037 smb_node_unlock(dnode); 1038 dnode_wlock = B_FALSE; 1039 1040 created = B_TRUE; 1041 op->action_taken = SMB_OACT_CREATED; 1042 1043 /* Note: hold from create */ 1044 fnode = op->fqi.fq_fnode; 1045 fnode_held = B_TRUE; 1046 1047 if (max_requested) { 1048 smb_fsop_eaccess(sr, sr->user_cr, fnode, &max_allowed); 1049 op->desired_access |= max_allowed; 1050 } 1051 /* 1052 * We created this object (we own it) so grant 1053 * read_control + read_attributes on this handle, 1054 * even if that was not requested. This avoids 1055 * unexpected access failures later. 1056 */ 1057 op->desired_access |= (READ_CONTROL | FILE_READ_ATTRIBUTES); 1058 1059 /* Allocate the ofile and fill in most of it. */ 1060 of = smb_ofile_alloc(sr, op, fnode, SMB_FTYPE_DISK, 1061 tree_fid); 1062 tree_fid = 0; // given to the ofile 1063 uniq_fid = of->f_uniqid; 1064 1065 smb_node_inc_opening_count(fnode); 1066 opening_incr = B_TRUE; 1067 1068 /* 1069 * Share access checks... 1070 */ 1071 smb_node_wrlock(fnode); 1072 fnode_wlock = B_TRUE; 1073 1074 status = smb_fsop_shrlock(sr->user_cr, fnode, uniq_fid, 1075 op->desired_access, op->share_access); 1076 if (status != 0) 1077 goto errout; 1078 fnode_shrlk = B_TRUE; 1079 1080 /* 1081 * MS-FSA 2.1.5.1.1 1082 * If the Oplock member of the DirectoryStream in 1083 * Link.ParentFile.StreamList (ParentOplock) is 1084 * not empty ... oplock break on the parent... 1085 * (dnode is the parent directory) 1086 * 1087 * This compares of->ParentOplockKey with each 1088 * oplock of->TargetOplockKey and breaks... 1089 * so it's OK that we're passing an OF that's 1090 * NOT a member of dnode->n_ofile_list 1091 * 1092 * The break never blocks, so ignore the return. 1093 */ 1094 (void) smb_oplock_break_PARENT(dnode, of); 1095 } 1096 1097 stream_created: 1098 /* 1099 * We might have blocked in smb_oplock_break_OPEN long enough 1100 * so a tree disconnect might have happened. In that case, 1101 * we would be adding an ofile to a tree that's disconnecting, 1102 * which would interfere with tear-down. If so, error out. 1103 */ 1104 if (!smb_tree_is_connected(sr->tid_tree)) { 1105 status = NT_STATUS_INVALID_PARAMETER; 1106 goto errout; 1107 } 1108 1109 /* 1110 * Moved this up from smb_ofile_open() 1111 */ 1112 if ((rc = smb_fsop_open(fnode, of->f_mode, of->f_cr)) != 0) { 1113 status = smb_errno2status(rc); 1114 goto errout; 1115 } 1116 1117 /* 1118 * Complete this open (add to ofile lists) 1119 */ 1120 smb_ofile_open(sr, op, of); 1121 did_open = B_TRUE; 1122 1123 /* 1124 * This MUST be done after ofile creation, so that explicitly 1125 * set timestamps can be remembered on the ofile, and setting 1126 * the readonly flag won't affect access via this open. 1127 */ 1128 if ((rc = smb_set_open_attributes(sr, of)) != 0) { 1129 status = smb_errno2status(rc); 1130 goto errout; 1131 } 1132 1133 /* 1134 * We've already done access checks above, 1135 * and want this call to succeed even when 1136 * !(desired_access & FILE_READ_ATTRIBUTES), 1137 * so pass kcred here. 1138 */ 1139 op->fqi.fq_fattr.sa_mask = SMB_AT_ALL; 1140 (void) smb_node_getattr(sr, fnode, zone_kcred(), of, 1141 &op->fqi.fq_fattr); 1142 1143 /* 1144 * Propagate the write-through mode from the open params 1145 * to the node: see the notes in the function header. 1146 * XXX: write_through should be a flag on the ofile. 1147 */ 1148 if (sr->sr_cfg->skc_sync_enable || 1149 (op->create_options & FILE_WRITE_THROUGH)) 1150 fnode->flags |= NODE_FLAGS_WRITE_THROUGH; 1151 1152 /* 1153 * Set up the fileid and dosattr in open_param for response 1154 */ 1155 op->fileid = op->fqi.fq_fattr.sa_vattr.va_nodeid; 1156 op->dattr = op->fqi.fq_fattr.sa_dosattr; 1157 1158 /* 1159 * Set up the file type in open_param for the response 1160 */ 1161 op->ftype = SMB_FTYPE_DISK; 1162 sr->smb_fid = of->f_fid; 1163 sr->fid_ofile = of; 1164 1165 if (smb_node_is_file(fnode)) { 1166 op->dsize = op->fqi.fq_fattr.sa_vattr.va_size; 1167 } else { 1168 /* directory or symlink */ 1169 op->dsize = 0; 1170 } 1171 1172 /* 1173 * Note: oplock_acquire happens in callers, because 1174 * how that happens is protocol-specific. 1175 */ 1176 1177 if (sname != NULL) 1178 kmem_free(sname, MAXNAMELEN); 1179 if (fnode_wlock) 1180 smb_node_unlock(fnode); 1181 if (opening_incr) 1182 smb_node_dec_opening_count(fnode); 1183 if (fnode_held) 1184 smb_node_release(fnode); 1185 if (dnode_wlock) 1186 smb_node_unlock(dnode); 1187 if (dnode_held) 1188 smb_node_release(dnode); 1189 1190 return (NT_STATUS_SUCCESS); 1191 1192 errout: 1193 if (did_open) { 1194 smb_ofile_close(of, 0); 1195 /* rele via sr->fid_ofile */ 1196 } else if (of != NULL) { 1197 /* No other refs possible */ 1198 smb_ofile_free(of); 1199 } 1200 1201 if (fnode_shrlk) 1202 smb_fsop_unshrlock(sr->user_cr, fnode, uniq_fid); 1203 1204 if (created) { 1205 /* Try to roll-back create. */ 1206 smb_delete_new_object(sr); 1207 } 1208 1209 if (sname != NULL) 1210 kmem_free(sname, MAXNAMELEN); 1211 if (fnode_wlock) 1212 smb_node_unlock(fnode); 1213 if (opening_incr) 1214 smb_node_dec_opening_count(fnode); 1215 if (fnode_held) 1216 smb_node_release(fnode); 1217 if (dnode_wlock) 1218 smb_node_unlock(dnode); 1219 if (dnode_held) 1220 smb_node_release(dnode); 1221 1222 if (tree_fid != 0) 1223 smb_idpool_free(&tree->t_fid_pool, tree_fid); 1224 1225 return (status); 1226 } 1227 1228 /* 1229 * smb_set_open_attributes 1230 * 1231 * Last write time: 1232 * - If the last_write time specified in the open params is not 0 or -1, 1233 * use it as file's mtime. This will be considered an explicitly set 1234 * timestamps, not reset by subsequent writes. 1235 * 1236 * DOS attributes 1237 * - If we created_readonly, we now store the real DOS attributes 1238 * (including the readonly bit) so subsequent opens will see it. 1239 * 1240 * Returns: errno 1241 */ 1242 static int 1243 smb_set_open_attributes(smb_request_t *sr, smb_ofile_t *of) 1244 { 1245 smb_attr_t attr; 1246 smb_arg_open_t *op = &sr->sr_open; 1247 smb_node_t *node = of->f_node; 1248 int rc = 0; 1249 1250 bzero(&attr, sizeof (smb_attr_t)); 1251 1252 if (op->created_readonly) { 1253 attr.sa_dosattr = op->dattr | FILE_ATTRIBUTE_READONLY; 1254 attr.sa_mask |= SMB_AT_DOSATTR; 1255 } 1256 1257 if (op->dsize != 0) { 1258 attr.sa_allocsz = op->dsize; 1259 attr.sa_mask |= SMB_AT_ALLOCSZ; 1260 } 1261 1262 if ((op->mtime.tv_sec != 0) && (op->mtime.tv_sec != UINT_MAX)) { 1263 attr.sa_vattr.va_mtime = op->mtime; 1264 attr.sa_mask |= SMB_AT_MTIME; 1265 } 1266 1267 if (attr.sa_mask != 0) 1268 rc = smb_node_setattr(sr, node, of->f_cr, of, &attr); 1269 1270 return (rc); 1271 } 1272 1273 /* 1274 * This function is used to delete a newly created object (file or 1275 * directory) if an error occurs after creation of the object. 1276 */ 1277 static void 1278 smb_delete_new_object(smb_request_t *sr) 1279 { 1280 smb_arg_open_t *op = &sr->sr_open; 1281 smb_fqi_t *fqi = &(op->fqi); 1282 uint32_t flags = 0; 1283 1284 if (SMB_TREE_IS_CASEINSENSITIVE(sr)) 1285 flags |= SMB_IGNORE_CASE; 1286 if (SMB_TREE_SUPPORTS_CATIA(sr)) 1287 flags |= SMB_CATIA; 1288 1289 if (op->create_options & FILE_DIRECTORY_FILE) 1290 (void) smb_fsop_rmdir(sr, sr->user_cr, fqi->fq_dnode, 1291 fqi->fq_last_comp, flags); 1292 else 1293 (void) smb_fsop_remove(sr, sr->user_cr, fqi->fq_dnode, 1294 fqi->fq_last_comp, flags); 1295 } 1296