xref: /titanic_41/usr/src/uts/common/fs/smbsrv/smb_session.c (revision 146832db19eb2048b216b5dd0ba4424c7d0dfd17)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #include <sys/atomic.h>
27 #include <sys/strsubr.h>
28 #include <sys/synch.h>
29 #include <sys/types.h>
30 #include <sys/socketvar.h>
31 #include <sys/sdt.h>
32 #include <smbsrv/netbios.h>
33 #include <smbsrv/smb_kproto.h>
34 #include <smbsrv/string.h>
35 #include <inet/tcp.h>
36 
37 static volatile uint64_t smb_kids;
38 
39 uint32_t smb_keep_alive = SSN_KEEP_ALIVE_TIMEOUT;
40 
41 static void smb_session_cancel(smb_session_t *);
42 static int smb_session_message(smb_session_t *);
43 static int smb_session_xprt_puthdr(smb_session_t *, smb_xprt_t *,
44     uint8_t *, size_t);
45 static smb_user_t *smb_session_lookup_user(smb_session_t *, char *, char *);
46 static void smb_request_init_command_mbuf(smb_request_t *sr);
47 void dump_smb_inaddr(smb_inaddr_t *ipaddr);
48 
49 void
50 smb_session_timers(smb_session_list_t *se)
51 {
52 	smb_session_t	*session;
53 
54 	rw_enter(&se->se_lock, RW_READER);
55 	session = list_head(&se->se_act.lst);
56 	while (session) {
57 		/*
58 		 * Walk through the table and decrement each keep_alive
59 		 * timer that has not timed out yet. (keepalive > 0)
60 		 */
61 		ASSERT(session->s_magic == SMB_SESSION_MAGIC);
62 		if (session->keep_alive &&
63 		    (session->keep_alive != (uint32_t)-1))
64 			session->keep_alive--;
65 		session = list_next(&se->se_act.lst, session);
66 	}
67 	rw_exit(&se->se_lock);
68 }
69 
70 void
71 smb_session_correct_keep_alive_values(
72     smb_session_list_t	*se,
73     uint32_t		new_keep_alive)
74 {
75 	smb_session_t		*sn;
76 
77 	if (new_keep_alive == smb_keep_alive)
78 		return;
79 	/*
80 	 * keep alive == 0 means do not drop connection if it's idle
81 	 */
82 	smb_keep_alive = (new_keep_alive) ? new_keep_alive : -1;
83 
84 	/*
85 	 * Walk through the table and set each session to the new keep_alive
86 	 * value if they have not already timed out.  Block clock interrupts.
87 	 */
88 	rw_enter(&se->se_lock, RW_READER);
89 	sn = list_head(&se->se_rdy.lst);
90 	while (sn) {
91 		ASSERT(sn->s_magic == SMB_SESSION_MAGIC);
92 		sn->keep_alive = new_keep_alive;
93 		sn = list_next(&se->se_rdy.lst, sn);
94 	}
95 	sn = list_head(&se->se_act.lst);
96 	while (sn) {
97 		ASSERT(sn->s_magic == SMB_SESSION_MAGIC);
98 		if (sn->keep_alive)
99 			sn->keep_alive = new_keep_alive;
100 		sn = list_next(&se->se_act.lst, sn);
101 	}
102 	rw_exit(&se->se_lock);
103 }
104 
105 /*
106  * smb_reconnection_check
107  *
108  * This function is called when a client indicates its current connection
109  * should be the only one it has with the server, as indicated by VC=0 in
110  * a SessionSetupX request. We go through the session list and destroy any
111  * stale connections for that client.
112  *
113  * Clients don't associate IP addresses and servers. So a client may make
114  * independent connections (i.e. with VC=0) to a server with multiple
115  * IP addresses. So, when checking for a reconnection, we need to include
116  * the local IP address, to which the client is connecting, when checking
117  * for stale sessions.
118  *
119  * Also check the server's NetBIOS name to support simultaneous access by
120  * multiple clients behind a NAT server.  This will only work for SMB over
121  * NetBIOS on TCP port 139, it will not work SMB over TCP port 445 because
122  * there is no NetBIOS name.  See also Knowledge Base article Q301673.
123  */
124 void
125 smb_session_reconnection_check(smb_session_list_t *se, smb_session_t *sess)
126 {
127 	smb_session_t	*sn;
128 
129 	rw_enter(&se->se_lock, RW_READER);
130 	sn = list_head(&se->se_act.lst);
131 	while (sn) {
132 		ASSERT(sn->s_magic == SMB_SESSION_MAGIC);
133 		if ((sn != sess) &&
134 		    smb_inet_equal(&sn->ipaddr, &sess->ipaddr) &&
135 		    smb_inet_equal(&sn->local_ipaddr, &sess->local_ipaddr) &&
136 		    (strcasecmp(sn->workstation, sess->workstation) == 0) &&
137 		    (sn->opentime <= sess->opentime) &&
138 		    (sn->s_kid < sess->s_kid)) {
139 			tsignal(sn->s_thread, SIGUSR1);
140 		}
141 		sn = list_next(&se->se_act.lst, sn);
142 	}
143 	rw_exit(&se->se_lock);
144 }
145 
146 /*
147  * Send a session message - supports SMB-over-NBT and SMB-over-TCP.
148  *
149  * The mbuf chain is copied into a contiguous buffer so that the whole
150  * message is submitted to smb_sosend as a single request.  This should
151  * help Ethereal/Wireshark delineate the packets correctly even though
152  * TCP_NODELAY has been set on the socket.
153  *
154  * If an mbuf chain is provided, it will be freed and set to NULL here.
155  */
156 int
157 smb_session_send(smb_session_t *session, uint8_t type, mbuf_chain_t *mbc)
158 {
159 	smb_txreq_t	*txr;
160 	smb_xprt_t	hdr;
161 	int		rc;
162 
163 	switch (session->s_state) {
164 	case SMB_SESSION_STATE_DISCONNECTED:
165 	case SMB_SESSION_STATE_TERMINATED:
166 		if ((mbc != NULL) && (mbc->chain != NULL)) {
167 			m_freem(mbc->chain);
168 			mbc->chain = NULL;
169 			mbc->flags = 0;
170 		}
171 		return (ENOTCONN);
172 	default:
173 		break;
174 	}
175 
176 	txr = smb_net_txr_alloc();
177 
178 	if ((mbc != NULL) && (mbc->chain != NULL)) {
179 		rc = mbc_moveout(mbc, (caddr_t)&txr->tr_buf[NETBIOS_HDR_SZ],
180 		    sizeof (txr->tr_buf) - NETBIOS_HDR_SZ, &txr->tr_len);
181 		if (rc != 0) {
182 			smb_net_txr_free(txr);
183 			return (rc);
184 		}
185 	}
186 
187 	hdr.xh_type = type;
188 	hdr.xh_length = (uint32_t)txr->tr_len;
189 
190 	rc = smb_session_xprt_puthdr(session, &hdr, txr->tr_buf,
191 	    NETBIOS_HDR_SZ);
192 
193 	if (rc != 0) {
194 		smb_net_txr_free(txr);
195 		return (rc);
196 	}
197 	txr->tr_len += NETBIOS_HDR_SZ;
198 	return (smb_net_txr_send(session->sock, &session->s_txlst, txr));
199 }
200 
201 /*
202  * Read, process and respond to a NetBIOS session request.
203  *
204  * A NetBIOS session must be established for SMB-over-NetBIOS.  Validate
205  * the calling and called name format and save the client NetBIOS name,
206  * which is used when a NetBIOS session is established to check for and
207  * cleanup leftover state from a previous session.
208  *
209  * Session requests are not valid for SMB-over-TCP, which is unfortunate
210  * because without the client name leftover state cannot be cleaned up
211  * if the client is behind a NAT server.
212  */
213 static int
214 smb_session_request(struct smb_session *session)
215 {
216 	int			rc;
217 	char			*calling_name;
218 	char			*called_name;
219 	char 			client_name[NETBIOS_NAME_SZ];
220 	struct mbuf_chain 	mbc;
221 	char 			*names = NULL;
222 	smb_wchar_t		*wbuf = NULL;
223 	smb_xprt_t		hdr;
224 	char *p;
225 	int rc1, rc2;
226 
227 	session->keep_alive = smb_keep_alive;
228 
229 	if ((rc = smb_session_xprt_gethdr(session, &hdr)) != 0)
230 		return (rc);
231 
232 	DTRACE_PROBE2(receive__session__req__xprthdr, struct session *, session,
233 	    smb_xprt_t *, &hdr);
234 
235 	if ((hdr.xh_type != SESSION_REQUEST) ||
236 	    (hdr.xh_length != NETBIOS_SESSION_REQUEST_DATA_LENGTH)) {
237 		DTRACE_PROBE1(receive__session__req__failed,
238 		    struct session *, session);
239 		return (EINVAL);
240 	}
241 
242 	names = kmem_alloc(hdr.xh_length, KM_SLEEP);
243 
244 	if ((rc = smb_sorecv(session->sock, names, hdr.xh_length)) != 0) {
245 		kmem_free(names, hdr.xh_length);
246 		DTRACE_PROBE1(receive__session__req__failed,
247 		    struct session *, session);
248 		return (rc);
249 	}
250 
251 	DTRACE_PROBE3(receive__session__req__data, struct session *, session,
252 	    char *, names, uint32_t, hdr.xh_length);
253 
254 	called_name = &names[0];
255 	calling_name = &names[NETBIOS_ENCODED_NAME_SZ + 2];
256 
257 	rc1 = netbios_name_isvalid(called_name, 0);
258 	rc2 = netbios_name_isvalid(calling_name, client_name);
259 
260 	if (rc1 == 0 || rc2 == 0) {
261 
262 		DTRACE_PROBE3(receive__invalid__session__req,
263 		    struct session *, session, char *, names,
264 		    uint32_t, hdr.xh_length);
265 
266 		kmem_free(names, hdr.xh_length);
267 		MBC_INIT(&mbc, MAX_DATAGRAM_LENGTH);
268 		(void) smb_mbc_encodef(&mbc, "b",
269 		    DATAGRAM_INVALID_SOURCE_NAME_FORMAT);
270 		(void) smb_session_send(session, NEGATIVE_SESSION_RESPONSE,
271 		    &mbc);
272 		return (EINVAL);
273 	}
274 
275 	DTRACE_PROBE3(receive__session__req__calling__decoded,
276 	    struct session *, session,
277 	    char *, calling_name, char *, client_name);
278 
279 	/*
280 	 * The client NetBIOS name is in oem codepage format.
281 	 * We need to convert it to unicode and store it in
282 	 * multi-byte format.  We also need to strip off any
283 	 * spaces added as part of the NetBIOS name encoding.
284 	 */
285 	wbuf = kmem_alloc((SMB_PI_MAX_HOST * sizeof (smb_wchar_t)), KM_SLEEP);
286 	(void) oemtoucs(wbuf, client_name, SMB_PI_MAX_HOST, OEM_CPG_850);
287 	(void) smb_wcstombs(session->workstation, wbuf, SMB_PI_MAX_HOST);
288 	kmem_free(wbuf, (SMB_PI_MAX_HOST * sizeof (smb_wchar_t)));
289 
290 	if ((p = strchr(session->workstation, ' ')) != 0)
291 		*p = '\0';
292 
293 	kmem_free(names, hdr.xh_length);
294 	return (smb_session_send(session, POSITIVE_SESSION_RESPONSE, NULL));
295 }
296 
297 /*
298  * Read 4-byte header from the session socket and build an in-memory
299  * session transport header.  See smb_xprt_t definition for header
300  * format information.
301  *
302  * Direct hosted NetBIOS-less SMB (SMB-over-TCP) uses port 445.  The
303  * first byte of the four-byte header must be 0 and the next three
304  * bytes contain the length of the remaining data.
305  */
306 int
307 smb_session_xprt_gethdr(smb_session_t *session, smb_xprt_t *ret_hdr)
308 {
309 	int		rc;
310 	unsigned char	buf[NETBIOS_HDR_SZ];
311 
312 	if ((rc = smb_sorecv(session->sock, buf, NETBIOS_HDR_SZ)) != 0)
313 		return (rc);
314 
315 	switch (session->s_local_port) {
316 	case IPPORT_NETBIOS_SSN:
317 		ret_hdr->xh_type = buf[0];
318 		ret_hdr->xh_length = (((uint32_t)buf[1] & 1) << 16) |
319 		    ((uint32_t)buf[2] << 8) |
320 		    ((uint32_t)buf[3]);
321 		break;
322 
323 	case IPPORT_SMB:
324 		ret_hdr->xh_type = buf[0];
325 
326 		if (ret_hdr->xh_type != 0) {
327 			cmn_err(CE_WARN, "invalid type (%u)", ret_hdr->xh_type);
328 			dump_smb_inaddr(&session->ipaddr);
329 			return (EPROTO);
330 		}
331 
332 		ret_hdr->xh_length = ((uint32_t)buf[1] << 16) |
333 		    ((uint32_t)buf[2] << 8) |
334 		    ((uint32_t)buf[3]);
335 		break;
336 
337 	default:
338 		cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
339 		dump_smb_inaddr(&session->ipaddr);
340 		return (EPROTO);
341 	}
342 
343 	return (0);
344 }
345 
346 /*
347  * Encode a transport session packet header into a 4-byte buffer.
348  * See smb_xprt_t definition for header format information.
349  */
350 static int
351 smb_session_xprt_puthdr(smb_session_t *session, smb_xprt_t *hdr,
352     uint8_t *buf, size_t buflen)
353 {
354 	if (session == NULL || hdr == NULL ||
355 	    buf == NULL || buflen < NETBIOS_HDR_SZ) {
356 		return (-1);
357 	}
358 
359 	switch (session->s_local_port) {
360 	case IPPORT_NETBIOS_SSN:
361 		buf[0] = hdr->xh_type;
362 		buf[1] = ((hdr->xh_length >> 16) & 1);
363 		buf[2] = (hdr->xh_length >> 8) & 0xff;
364 		buf[3] = hdr->xh_length & 0xff;
365 		break;
366 
367 	case IPPORT_SMB:
368 		buf[0] = hdr->xh_type;
369 		buf[1] = (hdr->xh_length >> 16) & 0xff;
370 		buf[2] = (hdr->xh_length >> 8) & 0xff;
371 		buf[3] = hdr->xh_length & 0xff;
372 		break;
373 
374 	default:
375 		cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
376 		dump_smb_inaddr(&session->ipaddr);
377 		return (-1);
378 	}
379 
380 	return (0);
381 }
382 
383 static void
384 smb_request_init_command_mbuf(smb_request_t *sr)
385 {
386 	MGET(sr->command.chain, 0, MT_DATA);
387 
388 	/*
389 	 * Setup mbuf, mimic MCLGET but use the complete packet buffer.
390 	 */
391 	sr->command.chain->m_ext.ext_buf = sr->sr_request_buf;
392 	sr->command.chain->m_data = sr->command.chain->m_ext.ext_buf;
393 	sr->command.chain->m_len = sr->sr_req_length;
394 	sr->command.chain->m_flags |= M_EXT;
395 	sr->command.chain->m_ext.ext_size = sr->sr_req_length;
396 	sr->command.chain->m_ext.ext_ref = &mclrefnoop;
397 
398 	/*
399 	 * Initialize the rest of the mbuf_chain fields
400 	 */
401 	sr->command.flags = 0;
402 	sr->command.shadow_of = 0;
403 	sr->command.max_bytes = sr->sr_req_length;
404 	sr->command.chain_offset = 0;
405 }
406 
407 /*
408  * smb_request_cancel
409  *
410  * Handle a cancel for a request properly depending on the current request
411  * state.
412  */
413 void
414 smb_request_cancel(smb_request_t *sr)
415 {
416 	mutex_enter(&sr->sr_mutex);
417 	switch (sr->sr_state) {
418 
419 	case SMB_REQ_STATE_SUBMITTED:
420 	case SMB_REQ_STATE_ACTIVE:
421 	case SMB_REQ_STATE_CLEANED_UP:
422 		sr->sr_state = SMB_REQ_STATE_CANCELED;
423 		break;
424 
425 	case SMB_REQ_STATE_WAITING_LOCK:
426 		/*
427 		 * This request is waiting on a lock.  Wakeup everything
428 		 * waiting on the lock so that the relevant thread regains
429 		 * control and notices that is has been canceled.  The
430 		 * other lock request threads waiting on this lock will go
431 		 * back to sleep when they discover they are still blocked.
432 		 */
433 		sr->sr_state = SMB_REQ_STATE_CANCELED;
434 
435 		ASSERT(sr->sr_awaiting != NULL);
436 		mutex_enter(&sr->sr_awaiting->l_mutex);
437 		cv_broadcast(&sr->sr_awaiting->l_cv);
438 		mutex_exit(&sr->sr_awaiting->l_mutex);
439 		break;
440 
441 	case SMB_REQ_STATE_WAITING_EVENT:
442 	case SMB_REQ_STATE_EVENT_OCCURRED:
443 		/*
444 		 * Cancellations for these states are handled by the
445 		 * notify-change code
446 		 */
447 		break;
448 
449 	case SMB_REQ_STATE_COMPLETED:
450 	case SMB_REQ_STATE_CANCELED:
451 		/*
452 		 * No action required for these states since the request
453 		 * is completing.
454 		 */
455 		break;
456 	/*
457 	 * Cases included:
458 	 *	SMB_REQ_STATE_FREE:
459 	 *	SMB_REQ_STATE_INITIALIZING:
460 	 */
461 	default:
462 		SMB_PANIC();
463 	}
464 	mutex_exit(&sr->sr_mutex);
465 }
466 
467 /*
468  * This is the entry point for processing SMB messages over NetBIOS or
469  * SMB-over-TCP.
470  *
471  * NetBIOS connections require a session request to establish a session
472  * on which to send session messages.
473  *
474  * Session requests are not valid on SMB-over-TCP.  We don't need to do
475  * anything here as session requests will be treated as an error when
476  * handling session messages.
477  */
478 int
479 smb_session_daemon(smb_session_list_t *se)
480 {
481 	int		rc = 0;
482 	smb_session_t	*session;
483 
484 	session = smb_session_list_activate_head(se);
485 	if (session == NULL)
486 		return (EINVAL);
487 
488 	if (session->s_local_port == IPPORT_NETBIOS_SSN) {
489 		rc = smb_session_request(session);
490 		if (rc) {
491 			smb_rwx_rwenter(&session->s_lock, RW_WRITER);
492 			session->s_state = SMB_SESSION_STATE_DISCONNECTED;
493 			smb_rwx_rwexit(&session->s_lock);
494 			smb_session_list_terminate(se, session);
495 			return (rc);
496 		}
497 	}
498 
499 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
500 	session->s_state = SMB_SESSION_STATE_ESTABLISHED;
501 	smb_rwx_rwexit(&session->s_lock);
502 
503 	rc = smb_session_message(session);
504 
505 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
506 	session->s_state = SMB_SESSION_STATE_DISCONNECTED;
507 	smb_rwx_rwexit(&session->s_lock);
508 
509 	smb_soshutdown(session->sock);
510 
511 	DTRACE_PROBE2(session__drop, struct session *, session, int, rc);
512 
513 	smb_session_cancel(session);
514 
515 	/*
516 	 * At this point everything related to the session should have been
517 	 * cleaned up and we expect that nothing will attempt to use the
518 	 * socket.
519 	 */
520 	smb_session_list_terminate(se, session);
521 
522 	return (rc);
523 }
524 
525 /*
526  * Read and process SMB requests.
527  *
528  * Returns:
529  *	0	Success
530  *	1	Unable to read transport header
531  *	2	Invalid transport header type
532  *	3	Invalid SMB length (too small)
533  *	4	Unable to read SMB header
534  *	5	Invalid SMB header (bad magic number)
535  *	6	Unable to read SMB data
536  *	2x	Write raw failed
537  */
538 static int
539 smb_session_message(smb_session_t *session)
540 {
541 	smb_request_t	*sr = NULL;
542 	smb_xprt_t	hdr;
543 	uint8_t		*req_buf;
544 	uint32_t	resid;
545 	int		rc;
546 
547 	for (;;) {
548 
549 		rc = smb_session_xprt_gethdr(session, &hdr);
550 		if (rc)
551 			return (rc);
552 
553 		DTRACE_PROBE2(session__receive__xprthdr, session_t *, session,
554 		    smb_xprt_t *, &hdr);
555 
556 		if (hdr.xh_type != SESSION_MESSAGE) {
557 			/*
558 			 * Anything other than SESSION_MESSAGE or
559 			 * SESSION_KEEP_ALIVE is an error.  A SESSION_REQUEST
560 			 * may indicate a new session request but we need to
561 			 * close this session and we can treat it as an error
562 			 * here.
563 			 */
564 			if (hdr.xh_type == SESSION_KEEP_ALIVE) {
565 				session->keep_alive = smb_keep_alive;
566 				continue;
567 			}
568 			return (EPROTO);
569 		}
570 
571 		if (hdr.xh_length < SMB_HEADER_LEN)
572 			return (EPROTO);
573 
574 		session->keep_alive = smb_keep_alive;
575 
576 		/*
577 		 * Allocate a request context, read the SMB header and validate
578 		 * it. The sr includes a buffer large enough to hold the SMB
579 		 * request payload.  If the header looks valid, read any
580 		 * remaining data.
581 		 */
582 		sr = smb_request_alloc(session, hdr.xh_length);
583 
584 		req_buf = (uint8_t *)sr->sr_request_buf;
585 		resid = hdr.xh_length;
586 
587 		rc = smb_sorecv(session->sock, req_buf, SMB_HEADER_LEN);
588 		if (rc) {
589 			smb_request_free(sr);
590 			return (rc);
591 		}
592 
593 		if (SMB_PROTOCOL_MAGIC_INVALID(sr)) {
594 			smb_request_free(sr);
595 			return (EPROTO);
596 		}
597 
598 		if (resid > SMB_HEADER_LEN) {
599 			req_buf += SMB_HEADER_LEN;
600 			resid -= SMB_HEADER_LEN;
601 
602 			rc = smb_sorecv(session->sock, req_buf, resid);
603 			if (rc) {
604 				smb_request_free(sr);
605 				return (rc);
606 			}
607 		}
608 
609 		/*
610 		 * Initialize command MBC to represent the received data.
611 		 */
612 		smb_request_init_command_mbuf(sr);
613 
614 		DTRACE_PROBE1(session__receive__smb, smb_request_t *, sr);
615 
616 		/*
617 		 * If this is a raw write, hand off the request.  The handler
618 		 * will retrieve the remaining raw data and process the request.
619 		 */
620 		if (SMB_IS_WRITERAW(sr)) {
621 			rc = smb_handle_write_raw(session, sr);
622 			/* XXX smb_request_free(sr); ??? */
623 			return (rc);
624 		}
625 
626 		sr->sr_state = SMB_REQ_STATE_SUBMITTED;
627 		(void) taskq_dispatch(session->s_server->sv_thread_pool,
628 		    smb_session_worker, sr, TQ_SLEEP);
629 	}
630 }
631 
632 /*
633  * Port will be IPPORT_NETBIOS_SSN or IPPORT_SMB.
634  */
635 smb_session_t *
636 smb_session_create(ksocket_t new_so, uint16_t port, smb_server_t *sv,
637     int family)
638 {
639 	struct sockaddr_in	sin;
640 	socklen_t		slen;
641 	struct sockaddr_in6	sin6;
642 	smb_session_t		*session;
643 	int64_t			now;
644 
645 	session = kmem_cache_alloc(sv->si_cache_session, KM_SLEEP);
646 	bzero(session, sizeof (smb_session_t));
647 
648 	if (smb_idpool_constructor(&session->s_uid_pool)) {
649 		kmem_cache_free(sv->si_cache_session, session);
650 		return (NULL);
651 	}
652 
653 	now = ddi_get_lbolt64();
654 
655 	session->s_kid = SMB_NEW_KID();
656 	session->s_state = SMB_SESSION_STATE_INITIALIZED;
657 	session->native_os = NATIVE_OS_UNKNOWN;
658 	session->opentime = now;
659 	session->keep_alive = smb_keep_alive;
660 	session->activity_timestamp = now;
661 
662 	smb_slist_constructor(&session->s_req_list, sizeof (smb_request_t),
663 	    offsetof(smb_request_t, sr_session_lnd));
664 
665 	smb_llist_constructor(&session->s_user_list, sizeof (smb_user_t),
666 	    offsetof(smb_user_t, u_lnd));
667 
668 	smb_llist_constructor(&session->s_xa_list, sizeof (smb_xa_t),
669 	    offsetof(smb_xa_t, xa_lnd));
670 
671 	list_create(&session->s_oplock_brkreqs, sizeof (mbuf_chain_t),
672 	    offsetof(mbuf_chain_t, mbc_lnd));
673 
674 	smb_net_txl_constructor(&session->s_txlst);
675 
676 	smb_rwx_init(&session->s_lock);
677 
678 	if (new_so) {
679 		if (family == AF_INET) {
680 			slen = sizeof (sin);
681 			(void) ksocket_getsockname(new_so,
682 			    (struct sockaddr *)&sin, &slen, CRED());
683 			bcopy(&sin.sin_addr,
684 			    &session->local_ipaddr.au_addr.au_ipv4,
685 			    sizeof (in_addr_t));
686 			slen = sizeof (sin);
687 			(void) ksocket_getpeername(new_so,
688 			    (struct sockaddr *)&sin, &slen, CRED());
689 			bcopy(&sin.sin_addr,
690 			    &session->ipaddr.au_addr.au_ipv4,
691 			    sizeof (in_addr_t));
692 		} else {
693 			slen = sizeof (sin6);
694 			(void) ksocket_getsockname(new_so,
695 			    (struct sockaddr *)&sin6, &slen, CRED());
696 			bcopy(&sin6.sin6_addr,
697 			    &session->local_ipaddr.au_addr.au_ipv6,
698 			    sizeof (in6_addr_t));
699 			slen = sizeof (sin6);
700 			(void) ksocket_getpeername(new_so,
701 			    (struct sockaddr *)&sin6, &slen, CRED());
702 			bcopy(&sin6.sin6_addr,
703 			    &session->ipaddr.au_addr.au_ipv6,
704 			    sizeof (in6_addr_t));
705 		}
706 		session->ipaddr.a_family = family;
707 		session->local_ipaddr.a_family = family;
708 		session->s_local_port = port;
709 		session->sock = new_so;
710 	}
711 
712 	session->s_server = sv;
713 	smb_server_get_cfg(sv, &session->s_cfg);
714 	session->s_cache_request = sv->si_cache_request;
715 	session->s_cache = sv->si_cache_session;
716 	session->s_magic = SMB_SESSION_MAGIC;
717 	return (session);
718 }
719 
720 void
721 smb_session_delete(smb_session_t *session)
722 {
723 	mbuf_chain_t	*mbc;
724 
725 	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
726 
727 	session->s_magic = 0;
728 
729 	smb_rwx_destroy(&session->s_lock);
730 	smb_net_txl_destructor(&session->s_txlst);
731 
732 	while ((mbc = list_head(&session->s_oplock_brkreqs)) != NULL) {
733 		SMB_MBC_VALID(mbc);
734 		list_remove(&session->s_oplock_brkreqs, mbc);
735 		smb_mbc_free(mbc);
736 	}
737 	list_destroy(&session->s_oplock_brkreqs);
738 
739 	smb_slist_destructor(&session->s_req_list);
740 	smb_llist_destructor(&session->s_user_list);
741 	smb_llist_destructor(&session->s_xa_list);
742 
743 	ASSERT(session->s_tree_cnt == 0);
744 	ASSERT(session->s_file_cnt == 0);
745 	ASSERT(session->s_dir_cnt == 0);
746 
747 	smb_idpool_destructor(&session->s_uid_pool);
748 	kmem_cache_free(session->s_cache, session);
749 }
750 
751 static void
752 smb_session_cancel(smb_session_t *session)
753 {
754 	smb_xa_t	*xa, *nextxa;
755 
756 	/* All the request currently being treated must be canceled. */
757 	smb_session_cancel_requests(session, NULL, NULL);
758 
759 	/*
760 	 * We wait for the completion of all the requests associated with
761 	 * this session.
762 	 */
763 	smb_slist_wait_for_empty(&session->s_req_list);
764 
765 	/*
766 	 * At this point the reference count of the users, trees, files,
767 	 * directories should be zero. It should be possible to destroy them
768 	 * without any problem.
769 	 */
770 	xa = smb_llist_head(&session->s_xa_list);
771 	while (xa) {
772 		nextxa = smb_llist_next(&session->s_xa_list, xa);
773 		smb_xa_close(xa);
774 		xa = nextxa;
775 	}
776 	smb_user_logoff_all(session);
777 }
778 
779 /*
780  * Cancel requests.  If a non-null tree is specified, only requests specific
781  * to that tree will be cancelled.  If a non-null sr is specified, that sr
782  * will be not be cancelled - this would typically be the caller's sr.
783  */
784 void
785 smb_session_cancel_requests(
786     smb_session_t	*session,
787     smb_tree_t		*tree,
788     smb_request_t	*exclude_sr)
789 {
790 	smb_request_t	*sr;
791 
792 	smb_process_session_notify_change_queue(session, tree);
793 
794 	smb_slist_enter(&session->s_req_list);
795 	sr = smb_slist_head(&session->s_req_list);
796 
797 	while (sr) {
798 		ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
799 		if ((sr != exclude_sr) &&
800 		    (tree == NULL || sr->tid_tree == tree))
801 			smb_request_cancel(sr);
802 
803 		sr = smb_slist_next(&session->s_req_list, sr);
804 	}
805 
806 	smb_slist_exit(&session->s_req_list);
807 }
808 
809 void
810 smb_session_worker(void	*arg)
811 {
812 	smb_request_t	*sr;
813 
814 	sr = (smb_request_t *)arg;
815 
816 	ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
817 
818 	sr->sr_worker = curthread;
819 	mutex_enter(&sr->sr_mutex);
820 	switch (sr->sr_state) {
821 	case SMB_REQ_STATE_SUBMITTED:
822 		mutex_exit(&sr->sr_mutex);
823 		if (smb_dispatch_request(sr)) {
824 			mutex_enter(&sr->sr_mutex);
825 			sr->sr_state = SMB_REQ_STATE_COMPLETED;
826 			mutex_exit(&sr->sr_mutex);
827 			smb_request_free(sr);
828 		}
829 		break;
830 
831 	default:
832 		ASSERT(sr->sr_state == SMB_REQ_STATE_CANCELED);
833 		sr->sr_state = SMB_REQ_STATE_COMPLETED;
834 		mutex_exit(&sr->sr_mutex);
835 		smb_request_free(sr);
836 		break;
837 	}
838 }
839 
840 /*
841  * smb_session_disconnect_share
842  *
843  * Disconnects the specified share. This function should be called after the
844  * share passed in has been made unavailable by the "share manager".
845  */
846 void
847 smb_session_disconnect_share(smb_session_list_t *se, char *sharename)
848 {
849 	smb_session_t	*session;
850 
851 	rw_enter(&se->se_lock, RW_READER);
852 	session = list_head(&se->se_act.lst);
853 	while (session) {
854 		ASSERT(session->s_magic == SMB_SESSION_MAGIC);
855 		smb_rwx_rwenter(&session->s_lock, RW_READER);
856 		switch (session->s_state) {
857 		case SMB_SESSION_STATE_NEGOTIATED:
858 		case SMB_SESSION_STATE_OPLOCK_BREAKING:
859 		case SMB_SESSION_STATE_WRITE_RAW_ACTIVE: {
860 			smb_user_t	*user;
861 			smb_user_t	*next;
862 
863 			user = smb_user_lookup_by_state(session, NULL);
864 			while (user) {
865 				smb_user_disconnect_share(user, sharename);
866 				next = smb_user_lookup_by_state(session, user);
867 				smb_user_release(user);
868 				user = next;
869 			}
870 			break;
871 
872 		}
873 		default:
874 			break;
875 		}
876 		smb_rwx_rwexit(&session->s_lock);
877 		session = list_next(&se->se_act.lst, session);
878 	}
879 	rw_exit(&se->se_lock);
880 }
881 
882 void
883 smb_session_list_constructor(smb_session_list_t *se)
884 {
885 	bzero(se, sizeof (*se));
886 	rw_init(&se->se_lock, NULL, RW_DEFAULT, NULL);
887 	list_create(&se->se_rdy.lst, sizeof (smb_session_t),
888 	    offsetof(smb_session_t, s_lnd));
889 	list_create(&se->se_act.lst, sizeof (smb_session_t),
890 	    offsetof(smb_session_t, s_lnd));
891 }
892 
893 void
894 smb_session_list_destructor(smb_session_list_t *se)
895 {
896 	list_destroy(&se->se_rdy.lst);
897 	list_destroy(&se->se_act.lst);
898 	rw_destroy(&se->se_lock);
899 }
900 
901 void
902 smb_session_list_append(smb_session_list_t *se, smb_session_t *session)
903 {
904 	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
905 	ASSERT(session->s_state == SMB_SESSION_STATE_INITIALIZED);
906 
907 	rw_enter(&se->se_lock, RW_WRITER);
908 	list_insert_tail(&se->se_rdy.lst, session);
909 	se->se_rdy.count++;
910 	se->se_wrop++;
911 	rw_exit(&se->se_lock);
912 }
913 
914 void
915 smb_session_list_delete_tail(smb_session_list_t *se)
916 {
917 	smb_session_t	*session;
918 
919 	rw_enter(&se->se_lock, RW_WRITER);
920 	session = list_tail(&se->se_rdy.lst);
921 	if (session) {
922 		ASSERT(session->s_magic == SMB_SESSION_MAGIC);
923 		ASSERT(session->s_state == SMB_SESSION_STATE_INITIALIZED);
924 		list_remove(&se->se_rdy.lst, session);
925 		ASSERT(se->se_rdy.count);
926 		se->se_rdy.count--;
927 		rw_exit(&se->se_lock);
928 		smb_session_delete(session);
929 		return;
930 	}
931 	rw_exit(&se->se_lock);
932 }
933 
934 smb_session_t *
935 smb_session_list_activate_head(smb_session_list_t *se)
936 {
937 	smb_session_t	*session;
938 
939 	rw_enter(&se->se_lock, RW_WRITER);
940 	session = list_head(&se->se_rdy.lst);
941 	if (session) {
942 		ASSERT(session->s_magic == SMB_SESSION_MAGIC);
943 		smb_rwx_rwenter(&session->s_lock, RW_WRITER);
944 		ASSERT(session->s_state == SMB_SESSION_STATE_INITIALIZED);
945 		session->s_thread = curthread;
946 		session->s_ktdid = session->s_thread->t_did;
947 		smb_rwx_rwexit(&session->s_lock);
948 		list_remove(&se->se_rdy.lst, session);
949 		se->se_rdy.count--;
950 		list_insert_tail(&se->se_act.lst, session);
951 		se->se_act.count++;
952 		se->se_wrop++;
953 	}
954 	rw_exit(&se->se_lock);
955 	return (session);
956 }
957 
958 void
959 smb_session_list_terminate(smb_session_list_t *se, smb_session_t *session)
960 {
961 	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
962 
963 	rw_enter(&se->se_lock, RW_WRITER);
964 
965 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
966 	ASSERT(session->s_state == SMB_SESSION_STATE_DISCONNECTED);
967 	session->s_state = SMB_SESSION_STATE_TERMINATED;
968 	smb_sodestroy(session->sock);
969 	session->sock = NULL;
970 	smb_rwx_rwexit(&session->s_lock);
971 
972 	list_remove(&se->se_act.lst, session);
973 	se->se_act.count--;
974 	se->se_wrop++;
975 
976 	ASSERT(session->s_thread == curthread);
977 
978 	rw_exit(&se->se_lock);
979 
980 	smb_session_delete(session);
981 }
982 
983 /*
984  * smb_session_list_signal
985  *
986  * This function signals all the session threads. The intent is to terminate
987  * them. The sessions still in the SMB_SESSION_STATE_INITIALIZED are delete
988  * immediately.
989  *
990  * This function must only be called by the threads listening and accepting
991  * connections. They must pass in their respective session list.
992  */
993 void
994 smb_session_list_signal(smb_session_list_t *se)
995 {
996 	smb_session_t	*session;
997 
998 	rw_enter(&se->se_lock, RW_WRITER);
999 	while (session = list_head(&se->se_rdy.lst)) {
1000 
1001 		ASSERT(session->s_magic == SMB_SESSION_MAGIC);
1002 
1003 		smb_rwx_rwenter(&session->s_lock, RW_WRITER);
1004 		ASSERT(session->s_state == SMB_SESSION_STATE_INITIALIZED);
1005 		session->s_state = SMB_SESSION_STATE_TERMINATED;
1006 		smb_sodestroy(session->sock);
1007 		session->sock = NULL;
1008 		smb_rwx_rwexit(&session->s_lock);
1009 
1010 		list_remove(&se->se_rdy.lst, session);
1011 		se->se_rdy.count--;
1012 		se->se_wrop++;
1013 
1014 		rw_exit(&se->se_lock);
1015 		smb_session_delete(session);
1016 		rw_enter(&se->se_lock, RW_WRITER);
1017 	}
1018 	rw_downgrade(&se->se_lock);
1019 
1020 	session = list_head(&se->se_act.lst);
1021 	while (session) {
1022 
1023 		ASSERT(session->s_magic == SMB_SESSION_MAGIC);
1024 		tsignal(session->s_thread, SIGUSR1);
1025 		session = list_next(&se->se_act.lst, session);
1026 	}
1027 	rw_exit(&se->se_lock);
1028 }
1029 
1030 /*
1031  * smb_session_lookup_user
1032  */
1033 static smb_user_t *
1034 smb_session_lookup_user(smb_session_t *session, char *domain, char *name)
1035 {
1036 	smb_user_t	*user;
1037 	smb_llist_t	*ulist;
1038 
1039 	ulist = &session->s_user_list;
1040 	smb_llist_enter(ulist, RW_READER);
1041 	user = smb_llist_head(ulist);
1042 	while (user) {
1043 		ASSERT(user->u_magic == SMB_USER_MAGIC);
1044 		if (!smb_strcasecmp(user->u_name, name, 0) &&
1045 		    !smb_strcasecmp(user->u_domain, domain, 0)) {
1046 			if (smb_user_hold(user))
1047 				break;
1048 		}
1049 		user = smb_llist_next(ulist, user);
1050 	}
1051 	smb_llist_exit(ulist);
1052 
1053 	return (user);
1054 }
1055 
1056 /*
1057  * If a user attempts to log in subsequently from the specified session,
1058  * duplicates the existing SMB user instance such that all SMB user
1059  * instances that corresponds to the same user on the given session
1060  * reference the same user's cred.
1061  *
1062  * Returns NULL if the given user hasn't yet logged in from this
1063  * specified session.  Otherwise, returns a user instance that corresponds
1064  * to this subsequent login.
1065  */
1066 smb_user_t *
1067 smb_session_dup_user(smb_session_t *session, char *domain, char *account_name)
1068 {
1069 	smb_user_t *orig_user = NULL;
1070 	smb_user_t *user = NULL;
1071 
1072 	orig_user = smb_session_lookup_user(session, domain,
1073 	    account_name);
1074 
1075 	if (orig_user) {
1076 		user = smb_user_dup(orig_user);
1077 		smb_user_release(orig_user);
1078 	}
1079 
1080 	return (user);
1081 }
1082 
1083 /*
1084  * Copy the session workstation/client name to buf.  If the workstation
1085  * is an empty string (which it will be on TCP connections), use the
1086  * client IP address.
1087  */
1088 void
1089 smb_session_getclient(smb_session_t *sn, char *buf, size_t buflen)
1090 {
1091 	char		ipbuf[INET6_ADDRSTRLEN];
1092 	smb_inaddr_t	*ipaddr;
1093 
1094 	ASSERT(sn);
1095 	ASSERT(buf);
1096 	ASSERT(buflen);
1097 
1098 	*buf = '\0';
1099 
1100 	if (sn->workstation[0] != '\0') {
1101 		(void) strlcpy(buf, sn->workstation, buflen);
1102 		return;
1103 	}
1104 
1105 	ipaddr = &sn->ipaddr;
1106 	if (smb_inet_ntop(ipaddr, ipbuf, SMB_IPSTRLEN(ipaddr->a_family)))
1107 		(void) strlcpy(buf, ipbuf, buflen);
1108 }
1109 
1110 /*
1111  * Check whether or not the specified client name is the client of this
1112  * session.  The name may be in UNC format (\\CLIENT).
1113  *
1114  * A workstation/client name is setup on NBT connections as part of the
1115  * NetBIOS session request but that isn't available on TCP connections.
1116  * If the session doesn't have a client name we typically return the
1117  * client IP address as the workstation name on MSRPC requests.  So we
1118  * check for the IP address here in addition to the workstation name.
1119  */
1120 boolean_t
1121 smb_session_isclient(smb_session_t *sn, const char *client)
1122 {
1123 	char		buf[INET6_ADDRSTRLEN];
1124 	smb_inaddr_t	*ipaddr;
1125 
1126 	client += strspn(client, "\\");
1127 
1128 	if (smb_strcasecmp(client, sn->workstation, 0) == 0)
1129 		return (B_TRUE);
1130 
1131 	ipaddr = &sn->ipaddr;
1132 	if (smb_inet_ntop(ipaddr, buf, SMB_IPSTRLEN(ipaddr->a_family)) == NULL)
1133 		return (B_FALSE);
1134 
1135 	if (smb_strcasecmp(client, buf, 0) == 0)
1136 		return (B_TRUE);
1137 
1138 	return (B_FALSE);
1139 }
1140 
1141 /*
1142  * smb_request_alloc
1143  *
1144  * Allocate an smb_request_t structure from the kmem_cache.  Partially
1145  * initialize the found/new request.
1146  *
1147  * Returns pointer to a request
1148  */
1149 smb_request_t *
1150 smb_request_alloc(smb_session_t *session, int req_length)
1151 {
1152 	smb_request_t	*sr;
1153 
1154 	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
1155 
1156 	sr = kmem_cache_alloc(session->s_cache_request, KM_SLEEP);
1157 
1158 	/*
1159 	 * Future:  Use constructor to pre-initialize some fields.  For now
1160 	 * there are so many fields that it is easiest just to zero the
1161 	 * whole thing and start over.
1162 	 */
1163 	bzero(sr, sizeof (smb_request_t));
1164 
1165 	mutex_init(&sr->sr_mutex, NULL, MUTEX_DEFAULT, NULL);
1166 	smb_srm_init(sr);
1167 	sr->session = session;
1168 	sr->sr_server = session->s_server;
1169 	sr->sr_gmtoff = session->s_server->si_gmtoff;
1170 	sr->sr_cache = session->s_server->si_cache_request;
1171 	sr->sr_cfg = &session->s_cfg;
1172 	sr->command.max_bytes = req_length;
1173 	sr->reply.max_bytes = smb_maxbufsize;
1174 	sr->sr_req_length = req_length;
1175 	if (req_length)
1176 		sr->sr_request_buf = kmem_alloc(req_length, KM_SLEEP);
1177 	sr->sr_magic = SMB_REQ_MAGIC;
1178 	sr->sr_state = SMB_REQ_STATE_INITIALIZING;
1179 	smb_slist_insert_tail(&session->s_req_list, sr);
1180 	return (sr);
1181 }
1182 
1183 /*
1184  * smb_request_free
1185  *
1186  * release the memories which have been allocated for a smb request.
1187  */
1188 void
1189 smb_request_free(smb_request_t *sr)
1190 {
1191 	ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
1192 	ASSERT(sr->session);
1193 	ASSERT(sr->r_xa == NULL);
1194 
1195 	if (sr->fid_ofile != NULL)
1196 		smb_ofile_release(sr->fid_ofile);
1197 
1198 	if (sr->tid_tree != NULL)
1199 		smb_tree_release(sr->tid_tree);
1200 
1201 	if (sr->uid_user != NULL)
1202 		smb_user_release(sr->uid_user);
1203 
1204 	smb_slist_remove(&sr->session->s_req_list, sr);
1205 
1206 	sr->session = NULL;
1207 
1208 	smb_srm_fini(sr);
1209 
1210 	if (sr->sr_request_buf)
1211 		kmem_free(sr->sr_request_buf, sr->sr_req_length);
1212 	if (sr->command.chain)
1213 		m_freem(sr->command.chain);
1214 	if (sr->reply.chain)
1215 		m_freem(sr->reply.chain);
1216 	if (sr->raw_data.chain)
1217 		m_freem(sr->raw_data.chain);
1218 
1219 	sr->sr_magic = 0;
1220 	mutex_destroy(&sr->sr_mutex);
1221 	kmem_cache_free(sr->sr_cache, sr);
1222 }
1223 
1224 void
1225 dump_smb_inaddr(smb_inaddr_t *ipaddr)
1226 {
1227 	char ipstr[INET6_ADDRSTRLEN];
1228 
1229 	if (smb_inet_ntop(ipaddr, ipstr, SMB_IPSTRLEN(ipaddr->a_family)))
1230 		cmn_err(CE_WARN, "error ipstr=%s", ipstr);
1231 	else
1232 		cmn_err(CE_WARN, "error converting ip address");
1233 }
1234 
1235 boolean_t
1236 smb_session_oplocks_enable(smb_session_t *session)
1237 {
1238 	SMB_SESSION_VALID(session);
1239 	if (session->s_cfg.skc_oplock_enable == 0)
1240 		return (B_FALSE);
1241 	else
1242 		return (B_TRUE);
1243 }
1244 
1245 /*
1246  * smb_session_breaking_oplock
1247  *
1248  * This MUST be a cross-session call, i.e. the caller must be in a different
1249  * context than the one passed. The mutex of the SMB node requiring an oplock
1250  * break MUST be dropped before calling this function. This last requirement is
1251  * due to a potential deadlock that can occur when trying to enter the lock of
1252  * the session passed in.
1253  */
1254 void
1255 smb_session_oplock_break(smb_session_t *session, smb_ofile_t *of)
1256 {
1257 	mbuf_chain_t	*mbc;
1258 
1259 	SMB_SESSION_VALID(session);
1260 
1261 	mbc = smb_mbc_alloc(MLEN);
1262 
1263 	(void) smb_mbc_encodef(mbc, "Mb19.wwwwbb3.ww10.",
1264 	    SMB_COM_LOCKING_ANDX,
1265 	    SMB_TREE_GET_TID(SMB_OFILE_GET_TREE(of)),
1266 	    0xFFFF, 0, 0xFFFF, 8, 0xFF,
1267 	    SMB_OFILE_GET_FID(of),
1268 	    LOCKING_ANDX_OPLOCK_RELEASE);
1269 
1270 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
1271 	switch (session->s_state) {
1272 	case SMB_SESSION_STATE_NEGOTIATED:
1273 	case SMB_SESSION_STATE_OPLOCK_BREAKING:
1274 		session->s_state = SMB_SESSION_STATE_OPLOCK_BREAKING;
1275 		(void) smb_session_send(session, 0, mbc);
1276 		smb_mbc_free(mbc);
1277 		break;
1278 
1279 	case SMB_SESSION_STATE_READ_RAW_ACTIVE:
1280 		list_insert_tail(&session->s_oplock_brkreqs, mbc);
1281 		break;
1282 
1283 	case SMB_SESSION_STATE_DISCONNECTED:
1284 	case SMB_SESSION_STATE_TERMINATED:
1285 		smb_mbc_free(mbc);
1286 		break;
1287 
1288 	default:
1289 		SMB_PANIC();
1290 	}
1291 	smb_rwx_rwexit(&session->s_lock);
1292 }
1293