xref: /titanic_44/usr/src/uts/common/fs/smbsrv/smb_session.c (revision 0db3240d392634cfff2f95fb6da34b56b8dc574f)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #include <sys/atomic.h>
27 #include <sys/strsubr.h>
28 #include <sys/synch.h>
29 #include <sys/types.h>
30 #include <sys/socketvar.h>
31 #include <sys/sdt.h>
32 #include <smbsrv/netbios.h>
33 #include <smbsrv/smb_kproto.h>
34 #include <smbsrv/string.h>
35 #include <inet/tcp.h>
36 
37 static volatile uint64_t smb_kids;
38 
39 uint32_t smb_keep_alive = SSN_KEEP_ALIVE_TIMEOUT;
40 
41 static void smb_session_cancel(smb_session_t *);
42 static int smb_session_message(smb_session_t *);
43 static int smb_session_xprt_puthdr(smb_session_t *, smb_xprt_t *,
44     uint8_t *, size_t);
45 static smb_user_t *smb_session_lookup_user(smb_session_t *, char *, char *);
46 static void smb_session_logoff(smb_session_t *);
47 static void smb_request_init_command_mbuf(smb_request_t *sr);
48 void dump_smb_inaddr(smb_inaddr_t *ipaddr);
49 
50 void
51 smb_session_timers(smb_session_list_t *se)
52 {
53 	smb_session_t	*session;
54 
55 	rw_enter(&se->se_lock, RW_READER);
56 	session = list_head(&se->se_act.lst);
57 	while (session) {
58 		/*
59 		 * Walk through the table and decrement each keep_alive
60 		 * timer that has not timed out yet. (keepalive > 0)
61 		 */
62 		ASSERT(session->s_magic == SMB_SESSION_MAGIC);
63 		if (session->keep_alive &&
64 		    (session->keep_alive != (uint32_t)-1))
65 			session->keep_alive--;
66 		session = list_next(&se->se_act.lst, session);
67 	}
68 	rw_exit(&se->se_lock);
69 }
70 
71 void
72 smb_session_correct_keep_alive_values(
73     smb_session_list_t	*se,
74     uint32_t		new_keep_alive)
75 {
76 	smb_session_t		*sn;
77 
78 	if (new_keep_alive == smb_keep_alive)
79 		return;
80 	/*
81 	 * keep alive == 0 means do not drop connection if it's idle
82 	 */
83 	smb_keep_alive = (new_keep_alive) ? new_keep_alive : -1;
84 
85 	/*
86 	 * Walk through the table and set each session to the new keep_alive
87 	 * value if they have not already timed out.  Block clock interrupts.
88 	 */
89 	rw_enter(&se->se_lock, RW_READER);
90 	sn = list_head(&se->se_rdy.lst);
91 	while (sn) {
92 		ASSERT(sn->s_magic == SMB_SESSION_MAGIC);
93 		sn->keep_alive = new_keep_alive;
94 		sn = list_next(&se->se_rdy.lst, sn);
95 	}
96 	sn = list_head(&se->se_act.lst);
97 	while (sn) {
98 		ASSERT(sn->s_magic == SMB_SESSION_MAGIC);
99 		if (sn->keep_alive)
100 			sn->keep_alive = new_keep_alive;
101 		sn = list_next(&se->se_act.lst, sn);
102 	}
103 	rw_exit(&se->se_lock);
104 }
105 
106 /*
107  * smb_reconnection_check
108  *
109  * This function is called when a client indicates its current connection
110  * should be the only one it has with the server, as indicated by VC=0 in
111  * a SessionSetupX request. We go through the session list and destroy any
112  * stale connections for that client.
113  *
114  * Clients don't associate IP addresses and servers. So a client may make
115  * independent connections (i.e. with VC=0) to a server with multiple
116  * IP addresses. So, when checking for a reconnection, we need to include
117  * the local IP address, to which the client is connecting, when checking
118  * for stale sessions.
119  *
120  * Also check the server's NetBIOS name to support simultaneous access by
121  * multiple clients behind a NAT server.  This will only work for SMB over
122  * NetBIOS on TCP port 139, it will not work SMB over TCP port 445 because
123  * there is no NetBIOS name.  See also Knowledge Base article Q301673.
124  */
125 void
126 smb_session_reconnection_check(smb_session_list_t *se, smb_session_t *sess)
127 {
128 	smb_session_t	*sn;
129 
130 	rw_enter(&se->se_lock, RW_READER);
131 	sn = list_head(&se->se_act.lst);
132 	while (sn) {
133 		ASSERT(sn->s_magic == SMB_SESSION_MAGIC);
134 		if ((sn != sess) &&
135 		    smb_inet_equal(&sn->ipaddr, &sess->ipaddr) &&
136 		    smb_inet_equal(&sn->local_ipaddr, &sess->local_ipaddr) &&
137 		    (strcasecmp(sn->workstation, sess->workstation) == 0) &&
138 		    (sn->opentime <= sess->opentime) &&
139 		    (sn->s_kid < sess->s_kid)) {
140 			tsignal(sn->s_thread, SIGUSR1);
141 		}
142 		sn = list_next(&se->se_act.lst, sn);
143 	}
144 	rw_exit(&se->se_lock);
145 }
146 
147 /*
148  * Send a session message - supports SMB-over-NBT and SMB-over-TCP.
149  *
150  * The mbuf chain is copied into a contiguous buffer so that the whole
151  * message is submitted to smb_sosend as a single request.  This should
152  * help Ethereal/Wireshark delineate the packets correctly even though
153  * TCP_NODELAY has been set on the socket.
154  *
155  * If an mbuf chain is provided, it will be freed and set to NULL here.
156  */
157 int
158 smb_session_send(smb_session_t *session, uint8_t type, mbuf_chain_t *mbc)
159 {
160 	smb_txreq_t	*txr;
161 	smb_xprt_t	hdr;
162 	int		rc;
163 
164 	switch (session->s_state) {
165 	case SMB_SESSION_STATE_DISCONNECTED:
166 	case SMB_SESSION_STATE_TERMINATED:
167 		if ((mbc != NULL) && (mbc->chain != NULL)) {
168 			m_freem(mbc->chain);
169 			mbc->chain = NULL;
170 			mbc->flags = 0;
171 		}
172 		return (ENOTCONN);
173 	default:
174 		break;
175 	}
176 
177 	txr = smb_net_txr_alloc();
178 
179 	if ((mbc != NULL) && (mbc->chain != NULL)) {
180 		rc = mbc_moveout(mbc, (caddr_t)&txr->tr_buf[NETBIOS_HDR_SZ],
181 		    sizeof (txr->tr_buf) - NETBIOS_HDR_SZ, &txr->tr_len);
182 		if (rc != 0) {
183 			smb_net_txr_free(txr);
184 			return (rc);
185 		}
186 	}
187 
188 	hdr.xh_type = type;
189 	hdr.xh_length = (uint32_t)txr->tr_len;
190 
191 	rc = smb_session_xprt_puthdr(session, &hdr, txr->tr_buf,
192 	    NETBIOS_HDR_SZ);
193 
194 	if (rc != 0) {
195 		smb_net_txr_free(txr);
196 		return (rc);
197 	}
198 	txr->tr_len += NETBIOS_HDR_SZ;
199 	return (smb_net_txr_send(session->sock, &session->s_txlst, txr));
200 }
201 
202 /*
203  * Read, process and respond to a NetBIOS session request.
204  *
205  * A NetBIOS session must be established for SMB-over-NetBIOS.  Validate
206  * the calling and called name format and save the client NetBIOS name,
207  * which is used when a NetBIOS session is established to check for and
208  * cleanup leftover state from a previous session.
209  *
210  * Session requests are not valid for SMB-over-TCP, which is unfortunate
211  * because without the client name leftover state cannot be cleaned up
212  * if the client is behind a NAT server.
213  */
214 static int
215 smb_session_request(struct smb_session *session)
216 {
217 	int			rc;
218 	char			*calling_name;
219 	char			*called_name;
220 	char 			client_name[NETBIOS_NAME_SZ];
221 	struct mbuf_chain 	mbc;
222 	char 			*names = NULL;
223 	smb_wchar_t		*wbuf = NULL;
224 	smb_xprt_t		hdr;
225 	char *p;
226 	int rc1, rc2;
227 
228 	session->keep_alive = smb_keep_alive;
229 
230 	if ((rc = smb_session_xprt_gethdr(session, &hdr)) != 0)
231 		return (rc);
232 
233 	DTRACE_PROBE2(receive__session__req__xprthdr, struct session *, session,
234 	    smb_xprt_t *, &hdr);
235 
236 	if ((hdr.xh_type != SESSION_REQUEST) ||
237 	    (hdr.xh_length != NETBIOS_SESSION_REQUEST_DATA_LENGTH)) {
238 		DTRACE_PROBE1(receive__session__req__failed,
239 		    struct session *, session);
240 		return (EINVAL);
241 	}
242 
243 	names = kmem_alloc(hdr.xh_length, KM_SLEEP);
244 
245 	if ((rc = smb_sorecv(session->sock, names, hdr.xh_length)) != 0) {
246 		kmem_free(names, hdr.xh_length);
247 		DTRACE_PROBE1(receive__session__req__failed,
248 		    struct session *, session);
249 		return (rc);
250 	}
251 
252 	DTRACE_PROBE3(receive__session__req__data, struct session *, session,
253 	    char *, names, uint32_t, hdr.xh_length);
254 
255 	called_name = &names[0];
256 	calling_name = &names[NETBIOS_ENCODED_NAME_SZ + 2];
257 
258 	rc1 = netbios_name_isvalid(called_name, 0);
259 	rc2 = netbios_name_isvalid(calling_name, client_name);
260 
261 	if (rc1 == 0 || rc2 == 0) {
262 
263 		DTRACE_PROBE3(receive__invalid__session__req,
264 		    struct session *, session, char *, names,
265 		    uint32_t, hdr.xh_length);
266 
267 		kmem_free(names, hdr.xh_length);
268 		MBC_INIT(&mbc, MAX_DATAGRAM_LENGTH);
269 		(void) smb_mbc_encodef(&mbc, "b",
270 		    DATAGRAM_INVALID_SOURCE_NAME_FORMAT);
271 		(void) smb_session_send(session, NEGATIVE_SESSION_RESPONSE,
272 		    &mbc);
273 		return (EINVAL);
274 	}
275 
276 	DTRACE_PROBE3(receive__session__req__calling__decoded,
277 	    struct session *, session,
278 	    char *, calling_name, char *, client_name);
279 
280 	/*
281 	 * The client NetBIOS name is in oem codepage format.
282 	 * We need to convert it to unicode and store it in
283 	 * multi-byte format.  We also need to strip off any
284 	 * spaces added as part of the NetBIOS name encoding.
285 	 */
286 	wbuf = kmem_alloc((SMB_PI_MAX_HOST * sizeof (smb_wchar_t)), KM_SLEEP);
287 	(void) oemtoucs(wbuf, client_name, SMB_PI_MAX_HOST, OEM_CPG_850);
288 	(void) smb_wcstombs(session->workstation, wbuf, SMB_PI_MAX_HOST);
289 	kmem_free(wbuf, (SMB_PI_MAX_HOST * sizeof (smb_wchar_t)));
290 
291 	if ((p = strchr(session->workstation, ' ')) != 0)
292 		*p = '\0';
293 
294 	kmem_free(names, hdr.xh_length);
295 	return (smb_session_send(session, POSITIVE_SESSION_RESPONSE, NULL));
296 }
297 
298 /*
299  * Read 4-byte header from the session socket and build an in-memory
300  * session transport header.  See smb_xprt_t definition for header
301  * format information.
302  *
303  * Direct hosted NetBIOS-less SMB (SMB-over-TCP) uses port 445.  The
304  * first byte of the four-byte header must be 0 and the next three
305  * bytes contain the length of the remaining data.
306  */
307 int
308 smb_session_xprt_gethdr(smb_session_t *session, smb_xprt_t *ret_hdr)
309 {
310 	int		rc;
311 	unsigned char	buf[NETBIOS_HDR_SZ];
312 
313 	if ((rc = smb_sorecv(session->sock, buf, NETBIOS_HDR_SZ)) != 0)
314 		return (rc);
315 
316 	switch (session->s_local_port) {
317 	case IPPORT_NETBIOS_SSN:
318 		ret_hdr->xh_type = buf[0];
319 		ret_hdr->xh_length = (((uint32_t)buf[1] & 1) << 16) |
320 		    ((uint32_t)buf[2] << 8) |
321 		    ((uint32_t)buf[3]);
322 		break;
323 
324 	case IPPORT_SMB:
325 		ret_hdr->xh_type = buf[0];
326 
327 		if (ret_hdr->xh_type != 0) {
328 			cmn_err(CE_WARN, "invalid type (%u)", ret_hdr->xh_type);
329 			dump_smb_inaddr(&session->ipaddr);
330 			return (EPROTO);
331 		}
332 
333 		ret_hdr->xh_length = ((uint32_t)buf[1] << 16) |
334 		    ((uint32_t)buf[2] << 8) |
335 		    ((uint32_t)buf[3]);
336 		break;
337 
338 	default:
339 		cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
340 		dump_smb_inaddr(&session->ipaddr);
341 		return (EPROTO);
342 	}
343 
344 	return (0);
345 }
346 
347 /*
348  * Encode a transport session packet header into a 4-byte buffer.
349  * See smb_xprt_t definition for header format information.
350  */
351 static int
352 smb_session_xprt_puthdr(smb_session_t *session, smb_xprt_t *hdr,
353     uint8_t *buf, size_t buflen)
354 {
355 	if (session == NULL || hdr == NULL ||
356 	    buf == NULL || buflen < NETBIOS_HDR_SZ) {
357 		return (-1);
358 	}
359 
360 	switch (session->s_local_port) {
361 	case IPPORT_NETBIOS_SSN:
362 		buf[0] = hdr->xh_type;
363 		buf[1] = ((hdr->xh_length >> 16) & 1);
364 		buf[2] = (hdr->xh_length >> 8) & 0xff;
365 		buf[3] = hdr->xh_length & 0xff;
366 		break;
367 
368 	case IPPORT_SMB:
369 		buf[0] = hdr->xh_type;
370 		buf[1] = (hdr->xh_length >> 16) & 0xff;
371 		buf[2] = (hdr->xh_length >> 8) & 0xff;
372 		buf[3] = hdr->xh_length & 0xff;
373 		break;
374 
375 	default:
376 		cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
377 		dump_smb_inaddr(&session->ipaddr);
378 		return (-1);
379 	}
380 
381 	return (0);
382 }
383 
384 static void
385 smb_request_init_command_mbuf(smb_request_t *sr)
386 {
387 	MGET(sr->command.chain, 0, MT_DATA);
388 
389 	/*
390 	 * Setup mbuf, mimic MCLGET but use the complete packet buffer.
391 	 */
392 	sr->command.chain->m_ext.ext_buf = sr->sr_request_buf;
393 	sr->command.chain->m_data = sr->command.chain->m_ext.ext_buf;
394 	sr->command.chain->m_len = sr->sr_req_length;
395 	sr->command.chain->m_flags |= M_EXT;
396 	sr->command.chain->m_ext.ext_size = sr->sr_req_length;
397 	sr->command.chain->m_ext.ext_ref = &mclrefnoop;
398 
399 	/*
400 	 * Initialize the rest of the mbuf_chain fields
401 	 */
402 	sr->command.flags = 0;
403 	sr->command.shadow_of = 0;
404 	sr->command.max_bytes = sr->sr_req_length;
405 	sr->command.chain_offset = 0;
406 }
407 
408 /*
409  * smb_request_cancel
410  *
411  * Handle a cancel for a request properly depending on the current request
412  * state.
413  */
414 void
415 smb_request_cancel(smb_request_t *sr)
416 {
417 	mutex_enter(&sr->sr_mutex);
418 	switch (sr->sr_state) {
419 
420 	case SMB_REQ_STATE_SUBMITTED:
421 	case SMB_REQ_STATE_ACTIVE:
422 	case SMB_REQ_STATE_CLEANED_UP:
423 		sr->sr_state = SMB_REQ_STATE_CANCELED;
424 		break;
425 
426 	case SMB_REQ_STATE_WAITING_LOCK:
427 		/*
428 		 * This request is waiting on a lock.  Wakeup everything
429 		 * waiting on the lock so that the relevant thread regains
430 		 * control and notices that is has been canceled.  The
431 		 * other lock request threads waiting on this lock will go
432 		 * back to sleep when they discover they are still blocked.
433 		 */
434 		sr->sr_state = SMB_REQ_STATE_CANCELED;
435 
436 		ASSERT(sr->sr_awaiting != NULL);
437 		mutex_enter(&sr->sr_awaiting->l_mutex);
438 		cv_broadcast(&sr->sr_awaiting->l_cv);
439 		mutex_exit(&sr->sr_awaiting->l_mutex);
440 		break;
441 
442 	case SMB_REQ_STATE_WAITING_EVENT:
443 	case SMB_REQ_STATE_EVENT_OCCURRED:
444 		/*
445 		 * Cancellations for these states are handled by the
446 		 * notify-change code
447 		 */
448 		break;
449 
450 	case SMB_REQ_STATE_COMPLETED:
451 	case SMB_REQ_STATE_CANCELED:
452 		/*
453 		 * No action required for these states since the request
454 		 * is completing.
455 		 */
456 		break;
457 	/*
458 	 * Cases included:
459 	 *	SMB_REQ_STATE_FREE:
460 	 *	SMB_REQ_STATE_INITIALIZING:
461 	 */
462 	default:
463 		SMB_PANIC();
464 	}
465 	mutex_exit(&sr->sr_mutex);
466 }
467 
468 /*
469  * This is the entry point for processing SMB messages over NetBIOS or
470  * SMB-over-TCP.
471  *
472  * NetBIOS connections require a session request to establish a session
473  * on which to send session messages.
474  *
475  * Session requests are not valid on SMB-over-TCP.  We don't need to do
476  * anything here as session requests will be treated as an error when
477  * handling session messages.
478  */
479 int
480 smb_session_daemon(smb_session_list_t *se)
481 {
482 	int		rc = 0;
483 	smb_session_t	*session;
484 
485 	session = smb_session_list_activate_head(se);
486 	if (session == NULL)
487 		return (EINVAL);
488 
489 	if (session->s_local_port == IPPORT_NETBIOS_SSN) {
490 		rc = smb_session_request(session);
491 		if (rc) {
492 			smb_rwx_rwenter(&session->s_lock, RW_WRITER);
493 			session->s_state = SMB_SESSION_STATE_DISCONNECTED;
494 			smb_rwx_rwexit(&session->s_lock);
495 			smb_session_list_terminate(se, session);
496 			return (rc);
497 		}
498 	}
499 
500 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
501 	session->s_state = SMB_SESSION_STATE_ESTABLISHED;
502 	smb_rwx_rwexit(&session->s_lock);
503 
504 	rc = smb_session_message(session);
505 
506 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
507 	session->s_state = SMB_SESSION_STATE_DISCONNECTED;
508 	smb_rwx_rwexit(&session->s_lock);
509 
510 	smb_soshutdown(session->sock);
511 
512 	DTRACE_PROBE2(session__drop, struct session *, session, int, rc);
513 
514 	smb_session_cancel(session);
515 
516 	/*
517 	 * At this point everything related to the session should have been
518 	 * cleaned up and we expect that nothing will attempt to use the
519 	 * socket.
520 	 */
521 	smb_session_list_terminate(se, session);
522 
523 	return (rc);
524 }
525 
526 /*
527  * Read and process SMB requests.
528  *
529  * Returns:
530  *	0	Success
531  *	1	Unable to read transport header
532  *	2	Invalid transport header type
533  *	3	Invalid SMB length (too small)
534  *	4	Unable to read SMB header
535  *	5	Invalid SMB header (bad magic number)
536  *	6	Unable to read SMB data
537  *	2x	Write raw failed
538  */
539 static int
540 smb_session_message(smb_session_t *session)
541 {
542 	smb_request_t	*sr = NULL;
543 	smb_xprt_t	hdr;
544 	uint8_t		*req_buf;
545 	uint32_t	resid;
546 	int		rc;
547 
548 	for (;;) {
549 
550 		rc = smb_session_xprt_gethdr(session, &hdr);
551 		if (rc)
552 			return (rc);
553 
554 		DTRACE_PROBE2(session__receive__xprthdr, session_t *, session,
555 		    smb_xprt_t *, &hdr);
556 
557 		if (hdr.xh_type != SESSION_MESSAGE) {
558 			/*
559 			 * Anything other than SESSION_MESSAGE or
560 			 * SESSION_KEEP_ALIVE is an error.  A SESSION_REQUEST
561 			 * may indicate a new session request but we need to
562 			 * close this session and we can treat it as an error
563 			 * here.
564 			 */
565 			if (hdr.xh_type == SESSION_KEEP_ALIVE) {
566 				session->keep_alive = smb_keep_alive;
567 				continue;
568 			}
569 			return (EPROTO);
570 		}
571 
572 		if (hdr.xh_length < SMB_HEADER_LEN)
573 			return (EPROTO);
574 
575 		session->keep_alive = smb_keep_alive;
576 
577 		/*
578 		 * Allocate a request context, read the SMB header and validate
579 		 * it. The sr includes a buffer large enough to hold the SMB
580 		 * request payload.  If the header looks valid, read any
581 		 * remaining data.
582 		 */
583 		sr = smb_request_alloc(session, hdr.xh_length);
584 
585 		req_buf = (uint8_t *)sr->sr_request_buf;
586 		resid = hdr.xh_length;
587 
588 		rc = smb_sorecv(session->sock, req_buf, SMB_HEADER_LEN);
589 		if (rc) {
590 			smb_request_free(sr);
591 			return (rc);
592 		}
593 
594 		if (SMB_PROTOCOL_MAGIC_INVALID(sr)) {
595 			smb_request_free(sr);
596 			return (EPROTO);
597 		}
598 
599 		if (resid > SMB_HEADER_LEN) {
600 			req_buf += SMB_HEADER_LEN;
601 			resid -= SMB_HEADER_LEN;
602 
603 			rc = smb_sorecv(session->sock, req_buf, resid);
604 			if (rc) {
605 				smb_request_free(sr);
606 				return (rc);
607 			}
608 		}
609 
610 		/*
611 		 * Initialize command MBC to represent the received data.
612 		 */
613 		smb_request_init_command_mbuf(sr);
614 
615 		DTRACE_PROBE1(session__receive__smb, smb_request_t *, sr);
616 
617 		/*
618 		 * If this is a raw write, hand off the request.  The handler
619 		 * will retrieve the remaining raw data and process the request.
620 		 */
621 		if (SMB_IS_WRITERAW(sr)) {
622 			rc = smb_handle_write_raw(session, sr);
623 			if (rc == 0)
624 				continue;
625 			return (rc);
626 		}
627 
628 		sr->sr_state = SMB_REQ_STATE_SUBMITTED;
629 		(void) taskq_dispatch(session->s_server->sv_thread_pool,
630 		    smb_session_worker, sr, TQ_SLEEP);
631 	}
632 }
633 
634 /*
635  * Port will be IPPORT_NETBIOS_SSN or IPPORT_SMB.
636  */
637 smb_session_t *
638 smb_session_create(ksocket_t new_so, uint16_t port, smb_server_t *sv,
639     int family)
640 {
641 	struct sockaddr_in	sin;
642 	socklen_t		slen;
643 	struct sockaddr_in6	sin6;
644 	smb_session_t		*session;
645 	int64_t			now;
646 
647 	session = kmem_cache_alloc(sv->si_cache_session, KM_SLEEP);
648 	bzero(session, sizeof (smb_session_t));
649 
650 	if (smb_idpool_constructor(&session->s_uid_pool)) {
651 		kmem_cache_free(sv->si_cache_session, session);
652 		return (NULL);
653 	}
654 
655 	now = ddi_get_lbolt64();
656 
657 	session->s_kid = SMB_NEW_KID();
658 	session->s_state = SMB_SESSION_STATE_INITIALIZED;
659 	session->native_os = NATIVE_OS_UNKNOWN;
660 	session->opentime = now;
661 	session->keep_alive = smb_keep_alive;
662 	session->activity_timestamp = now;
663 
664 	smb_slist_constructor(&session->s_req_list, sizeof (smb_request_t),
665 	    offsetof(smb_request_t, sr_session_lnd));
666 
667 	smb_llist_constructor(&session->s_user_list, sizeof (smb_user_t),
668 	    offsetof(smb_user_t, u_lnd));
669 
670 	smb_llist_constructor(&session->s_xa_list, sizeof (smb_xa_t),
671 	    offsetof(smb_xa_t, xa_lnd));
672 
673 	list_create(&session->s_oplock_brkreqs, sizeof (mbuf_chain_t),
674 	    offsetof(mbuf_chain_t, mbc_lnd));
675 
676 	smb_net_txl_constructor(&session->s_txlst);
677 
678 	smb_rwx_init(&session->s_lock);
679 
680 	if (new_so) {
681 		if (family == AF_INET) {
682 			slen = sizeof (sin);
683 			(void) ksocket_getsockname(new_so,
684 			    (struct sockaddr *)&sin, &slen, CRED());
685 			bcopy(&sin.sin_addr,
686 			    &session->local_ipaddr.au_addr.au_ipv4,
687 			    sizeof (in_addr_t));
688 			slen = sizeof (sin);
689 			(void) ksocket_getpeername(new_so,
690 			    (struct sockaddr *)&sin, &slen, CRED());
691 			bcopy(&sin.sin_addr,
692 			    &session->ipaddr.au_addr.au_ipv4,
693 			    sizeof (in_addr_t));
694 		} else {
695 			slen = sizeof (sin6);
696 			(void) ksocket_getsockname(new_so,
697 			    (struct sockaddr *)&sin6, &slen, CRED());
698 			bcopy(&sin6.sin6_addr,
699 			    &session->local_ipaddr.au_addr.au_ipv6,
700 			    sizeof (in6_addr_t));
701 			slen = sizeof (sin6);
702 			(void) ksocket_getpeername(new_so,
703 			    (struct sockaddr *)&sin6, &slen, CRED());
704 			bcopy(&sin6.sin6_addr,
705 			    &session->ipaddr.au_addr.au_ipv6,
706 			    sizeof (in6_addr_t));
707 		}
708 		session->ipaddr.a_family = family;
709 		session->local_ipaddr.a_family = family;
710 		session->s_local_port = port;
711 		session->sock = new_so;
712 	}
713 
714 	session->s_server = sv;
715 	smb_server_get_cfg(sv, &session->s_cfg);
716 	session->s_cache_request = sv->si_cache_request;
717 	session->s_cache = sv->si_cache_session;
718 	session->s_magic = SMB_SESSION_MAGIC;
719 	return (session);
720 }
721 
722 void
723 smb_session_delete(smb_session_t *session)
724 {
725 	mbuf_chain_t	*mbc;
726 
727 	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
728 
729 	session->s_magic = 0;
730 
731 	smb_rwx_destroy(&session->s_lock);
732 	smb_net_txl_destructor(&session->s_txlst);
733 
734 	while ((mbc = list_head(&session->s_oplock_brkreqs)) != NULL) {
735 		SMB_MBC_VALID(mbc);
736 		list_remove(&session->s_oplock_brkreqs, mbc);
737 		smb_mbc_free(mbc);
738 	}
739 	list_destroy(&session->s_oplock_brkreqs);
740 
741 	smb_slist_destructor(&session->s_req_list);
742 	smb_llist_destructor(&session->s_user_list);
743 	smb_llist_destructor(&session->s_xa_list);
744 
745 	ASSERT(session->s_tree_cnt == 0);
746 	ASSERT(session->s_file_cnt == 0);
747 	ASSERT(session->s_dir_cnt == 0);
748 
749 	smb_idpool_destructor(&session->s_uid_pool);
750 	kmem_cache_free(session->s_cache, session);
751 }
752 
753 static void
754 smb_session_cancel(smb_session_t *session)
755 {
756 	smb_xa_t	*xa, *nextxa;
757 
758 	/* All the request currently being treated must be canceled. */
759 	smb_session_cancel_requests(session, NULL, NULL);
760 
761 	/*
762 	 * We wait for the completion of all the requests associated with
763 	 * this session.
764 	 */
765 	smb_slist_wait_for_empty(&session->s_req_list);
766 
767 	/*
768 	 * At this point the reference count of the users, trees, files,
769 	 * directories should be zero. It should be possible to destroy them
770 	 * without any problem.
771 	 */
772 	xa = smb_llist_head(&session->s_xa_list);
773 	while (xa) {
774 		nextxa = smb_llist_next(&session->s_xa_list, xa);
775 		smb_xa_close(xa);
776 		xa = nextxa;
777 	}
778 
779 	smb_session_logoff(session);
780 }
781 
782 /*
783  * Cancel requests.  If a non-null tree is specified, only requests specific
784  * to that tree will be cancelled.  If a non-null sr is specified, that sr
785  * will be not be cancelled - this would typically be the caller's sr.
786  */
787 void
788 smb_session_cancel_requests(
789     smb_session_t	*session,
790     smb_tree_t		*tree,
791     smb_request_t	*exclude_sr)
792 {
793 	smb_request_t	*sr;
794 
795 	smb_process_session_notify_change_queue(session, tree);
796 
797 	smb_slist_enter(&session->s_req_list);
798 	sr = smb_slist_head(&session->s_req_list);
799 
800 	while (sr) {
801 		ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
802 		if ((sr != exclude_sr) &&
803 		    (tree == NULL || sr->tid_tree == tree))
804 			smb_request_cancel(sr);
805 
806 		sr = smb_slist_next(&session->s_req_list, sr);
807 	}
808 
809 	smb_slist_exit(&session->s_req_list);
810 }
811 
812 void
813 smb_session_worker(void	*arg)
814 {
815 	smb_request_t	*sr;
816 
817 	sr = (smb_request_t *)arg;
818 
819 	ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
820 
821 	sr->sr_worker = curthread;
822 	mutex_enter(&sr->sr_mutex);
823 	switch (sr->sr_state) {
824 	case SMB_REQ_STATE_SUBMITTED:
825 		mutex_exit(&sr->sr_mutex);
826 		if (smb_dispatch_request(sr)) {
827 			mutex_enter(&sr->sr_mutex);
828 			sr->sr_state = SMB_REQ_STATE_COMPLETED;
829 			mutex_exit(&sr->sr_mutex);
830 			smb_request_free(sr);
831 		}
832 		break;
833 
834 	default:
835 		ASSERT(sr->sr_state == SMB_REQ_STATE_CANCELED);
836 		sr->sr_state = SMB_REQ_STATE_COMPLETED;
837 		mutex_exit(&sr->sr_mutex);
838 		smb_request_free(sr);
839 		break;
840 	}
841 }
842 
843 void
844 smb_session_list_constructor(smb_session_list_t *se)
845 {
846 	bzero(se, sizeof (*se));
847 	rw_init(&se->se_lock, NULL, RW_DEFAULT, NULL);
848 	list_create(&se->se_rdy.lst, sizeof (smb_session_t),
849 	    offsetof(smb_session_t, s_lnd));
850 	list_create(&se->se_act.lst, sizeof (smb_session_t),
851 	    offsetof(smb_session_t, s_lnd));
852 }
853 
854 void
855 smb_session_list_destructor(smb_session_list_t *se)
856 {
857 	list_destroy(&se->se_rdy.lst);
858 	list_destroy(&se->se_act.lst);
859 	rw_destroy(&se->se_lock);
860 }
861 
862 void
863 smb_session_list_append(smb_session_list_t *se, smb_session_t *session)
864 {
865 	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
866 	ASSERT(session->s_state == SMB_SESSION_STATE_INITIALIZED);
867 
868 	rw_enter(&se->se_lock, RW_WRITER);
869 	list_insert_tail(&se->se_rdy.lst, session);
870 	se->se_rdy.count++;
871 	se->se_wrop++;
872 	rw_exit(&se->se_lock);
873 }
874 
875 void
876 smb_session_list_delete_tail(smb_session_list_t *se)
877 {
878 	smb_session_t	*session;
879 
880 	rw_enter(&se->se_lock, RW_WRITER);
881 	session = list_tail(&se->se_rdy.lst);
882 	if (session) {
883 		ASSERT(session->s_magic == SMB_SESSION_MAGIC);
884 		ASSERT(session->s_state == SMB_SESSION_STATE_INITIALIZED);
885 		list_remove(&se->se_rdy.lst, session);
886 		ASSERT(se->se_rdy.count);
887 		se->se_rdy.count--;
888 		rw_exit(&se->se_lock);
889 		smb_session_delete(session);
890 		return;
891 	}
892 	rw_exit(&se->se_lock);
893 }
894 
895 smb_session_t *
896 smb_session_list_activate_head(smb_session_list_t *se)
897 {
898 	smb_session_t	*session;
899 
900 	rw_enter(&se->se_lock, RW_WRITER);
901 	session = list_head(&se->se_rdy.lst);
902 	if (session) {
903 		ASSERT(session->s_magic == SMB_SESSION_MAGIC);
904 		smb_rwx_rwenter(&session->s_lock, RW_WRITER);
905 		ASSERT(session->s_state == SMB_SESSION_STATE_INITIALIZED);
906 		session->s_thread = curthread;
907 		session->s_ktdid = session->s_thread->t_did;
908 		smb_rwx_rwexit(&session->s_lock);
909 		list_remove(&se->se_rdy.lst, session);
910 		se->se_rdy.count--;
911 		list_insert_tail(&se->se_act.lst, session);
912 		se->se_act.count++;
913 		se->se_wrop++;
914 	}
915 	rw_exit(&se->se_lock);
916 	return (session);
917 }
918 
919 void
920 smb_session_list_terminate(smb_session_list_t *se, smb_session_t *session)
921 {
922 	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
923 
924 	rw_enter(&se->se_lock, RW_WRITER);
925 
926 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
927 	ASSERT(session->s_state == SMB_SESSION_STATE_DISCONNECTED);
928 	session->s_state = SMB_SESSION_STATE_TERMINATED;
929 	smb_sodestroy(session->sock);
930 	session->sock = NULL;
931 	smb_rwx_rwexit(&session->s_lock);
932 
933 	list_remove(&se->se_act.lst, session);
934 	se->se_act.count--;
935 	se->se_wrop++;
936 
937 	ASSERT(session->s_thread == curthread);
938 
939 	rw_exit(&se->se_lock);
940 
941 	smb_session_delete(session);
942 }
943 
944 /*
945  * smb_session_list_signal
946  *
947  * This function signals all the session threads. The intent is to terminate
948  * them. The sessions still in the SMB_SESSION_STATE_INITIALIZED are delete
949  * immediately.
950  *
951  * This function must only be called by the threads listening and accepting
952  * connections. They must pass in their respective session list.
953  */
954 void
955 smb_session_list_signal(smb_session_list_t *se)
956 {
957 	smb_session_t	*session;
958 
959 	rw_enter(&se->se_lock, RW_WRITER);
960 	while (session = list_head(&se->se_rdy.lst)) {
961 
962 		ASSERT(session->s_magic == SMB_SESSION_MAGIC);
963 
964 		smb_rwx_rwenter(&session->s_lock, RW_WRITER);
965 		ASSERT(session->s_state == SMB_SESSION_STATE_INITIALIZED);
966 		session->s_state = SMB_SESSION_STATE_TERMINATED;
967 		smb_sodestroy(session->sock);
968 		session->sock = NULL;
969 		smb_rwx_rwexit(&session->s_lock);
970 
971 		list_remove(&se->se_rdy.lst, session);
972 		se->se_rdy.count--;
973 		se->se_wrop++;
974 
975 		rw_exit(&se->se_lock);
976 		smb_session_delete(session);
977 		rw_enter(&se->se_lock, RW_WRITER);
978 	}
979 	rw_downgrade(&se->se_lock);
980 
981 	session = list_head(&se->se_act.lst);
982 	while (session) {
983 
984 		ASSERT(session->s_magic == SMB_SESSION_MAGIC);
985 		tsignal(session->s_thread, SIGUSR1);
986 		session = list_next(&se->se_act.lst, session);
987 	}
988 	rw_exit(&se->se_lock);
989 }
990 
991 /*
992  * smb_session_lookup_user
993  */
994 static smb_user_t *
995 smb_session_lookup_user(smb_session_t *session, char *domain, char *name)
996 {
997 	smb_user_t	*user;
998 	smb_llist_t	*ulist;
999 
1000 	ulist = &session->s_user_list;
1001 	smb_llist_enter(ulist, RW_READER);
1002 	user = smb_llist_head(ulist);
1003 	while (user) {
1004 		ASSERT(user->u_magic == SMB_USER_MAGIC);
1005 		if (!smb_strcasecmp(user->u_name, name, 0) &&
1006 		    !smb_strcasecmp(user->u_domain, domain, 0)) {
1007 			if (smb_user_hold(user))
1008 				break;
1009 		}
1010 		user = smb_llist_next(ulist, user);
1011 	}
1012 	smb_llist_exit(ulist);
1013 
1014 	return (user);
1015 }
1016 
1017 /*
1018  * If a user attempts to log in subsequently from the specified session,
1019  * duplicates the existing SMB user instance such that all SMB user
1020  * instances that corresponds to the same user on the given session
1021  * reference the same user's cred.
1022  *
1023  * Returns NULL if the given user hasn't yet logged in from this
1024  * specified session.  Otherwise, returns a user instance that corresponds
1025  * to this subsequent login.
1026  */
1027 smb_user_t *
1028 smb_session_dup_user(smb_session_t *session, char *domain, char *account_name)
1029 {
1030 	smb_user_t *orig_user = NULL;
1031 	smb_user_t *user = NULL;
1032 
1033 	orig_user = smb_session_lookup_user(session, domain,
1034 	    account_name);
1035 
1036 	if (orig_user) {
1037 		user = smb_user_dup(orig_user);
1038 		smb_user_release(orig_user);
1039 	}
1040 
1041 	return (user);
1042 }
1043 
1044 /*
1045  * Find a user on the specified session by SMB UID.
1046  */
1047 smb_user_t *
1048 smb_session_lookup_uid(smb_session_t *session, uint16_t uid)
1049 {
1050 	smb_user_t	*user;
1051 	smb_llist_t	*user_list;
1052 
1053 	SMB_SESSION_VALID(session);
1054 
1055 	user_list = &session->s_user_list;
1056 	smb_llist_enter(user_list, RW_READER);
1057 
1058 	user = smb_llist_head(user_list);
1059 	while (user) {
1060 		SMB_USER_VALID(user);
1061 		ASSERT(user->u_session == session);
1062 
1063 		if (user->u_uid == uid) {
1064 			if (!smb_user_hold(user))
1065 				break;
1066 
1067 			smb_llist_exit(user_list);
1068 			return (user);
1069 		}
1070 
1071 		user = smb_llist_next(user_list, user);
1072 	}
1073 
1074 	smb_llist_exit(user_list);
1075 	return (NULL);
1076 }
1077 
1078 void
1079 smb_session_post_user(smb_session_t *session, smb_user_t *user)
1080 {
1081 	SMB_USER_VALID(user);
1082 	ASSERT(user->u_refcnt == 0);
1083 	ASSERT(user->u_state == SMB_USER_STATE_LOGGED_OFF);
1084 	ASSERT(user->u_session == session);
1085 
1086 	smb_llist_post(&session->s_user_list, user, smb_user_delete);
1087 }
1088 
1089 /*
1090  * Logoff all users associated with the specified session.
1091  */
1092 static void
1093 smb_session_logoff(smb_session_t *session)
1094 {
1095 	smb_user_t	*user;
1096 
1097 	SMB_SESSION_VALID(session);
1098 
1099 	smb_llist_enter(&session->s_user_list, RW_READER);
1100 
1101 	user = smb_llist_head(&session->s_user_list);
1102 	while (user) {
1103 		SMB_USER_VALID(user);
1104 		ASSERT(user->u_session == session);
1105 
1106 		if (smb_user_hold(user)) {
1107 			smb_user_logoff(user);
1108 			smb_user_release(user);
1109 		}
1110 
1111 		user = smb_llist_next(&session->s_user_list, user);
1112 	}
1113 
1114 	smb_llist_exit(&session->s_user_list);
1115 }
1116 
1117 /*
1118  * Disconnect any trees associated with the specified share.
1119  * Iterate through the users on this session and tell each user
1120  * to disconnect from the share.
1121  */
1122 void
1123 smb_session_disconnect_share(smb_session_t *session, const char *sharename)
1124 {
1125 	smb_user_t	*user;
1126 
1127 	SMB_SESSION_VALID(session);
1128 
1129 	smb_llist_enter(&session->s_user_list, RW_READER);
1130 
1131 	user = smb_llist_head(&session->s_user_list);
1132 	while (user) {
1133 		SMB_USER_VALID(user);
1134 		ASSERT(user->u_session == session);
1135 
1136 		if (smb_user_hold(user)) {
1137 			smb_user_disconnect_share(user, sharename);
1138 			smb_user_release(user);
1139 		}
1140 
1141 		user = smb_llist_next(&session->s_user_list, user);
1142 	}
1143 
1144 	smb_llist_exit(&session->s_user_list);
1145 }
1146 
1147 /*
1148  * Copy the session workstation/client name to buf.  If the workstation
1149  * is an empty string (which it will be on TCP connections), use the
1150  * client IP address.
1151  */
1152 void
1153 smb_session_getclient(smb_session_t *sn, char *buf, size_t buflen)
1154 {
1155 	char		ipbuf[INET6_ADDRSTRLEN];
1156 	smb_inaddr_t	*ipaddr;
1157 
1158 	ASSERT(sn);
1159 	ASSERT(buf);
1160 	ASSERT(buflen);
1161 
1162 	*buf = '\0';
1163 
1164 	if (sn->workstation[0] != '\0') {
1165 		(void) strlcpy(buf, sn->workstation, buflen);
1166 		return;
1167 	}
1168 
1169 	ipaddr = &sn->ipaddr;
1170 	if (smb_inet_ntop(ipaddr, ipbuf, SMB_IPSTRLEN(ipaddr->a_family)))
1171 		(void) strlcpy(buf, ipbuf, buflen);
1172 }
1173 
1174 /*
1175  * Check whether or not the specified client name is the client of this
1176  * session.  The name may be in UNC format (\\CLIENT).
1177  *
1178  * A workstation/client name is setup on NBT connections as part of the
1179  * NetBIOS session request but that isn't available on TCP connections.
1180  * If the session doesn't have a client name we typically return the
1181  * client IP address as the workstation name on MSRPC requests.  So we
1182  * check for the IP address here in addition to the workstation name.
1183  */
1184 boolean_t
1185 smb_session_isclient(smb_session_t *sn, const char *client)
1186 {
1187 	char		buf[INET6_ADDRSTRLEN];
1188 	smb_inaddr_t	*ipaddr;
1189 
1190 	client += strspn(client, "\\");
1191 
1192 	if (smb_strcasecmp(client, sn->workstation, 0) == 0)
1193 		return (B_TRUE);
1194 
1195 	ipaddr = &sn->ipaddr;
1196 	if (smb_inet_ntop(ipaddr, buf, SMB_IPSTRLEN(ipaddr->a_family)) == NULL)
1197 		return (B_FALSE);
1198 
1199 	if (smb_strcasecmp(client, buf, 0) == 0)
1200 		return (B_TRUE);
1201 
1202 	return (B_FALSE);
1203 }
1204 
1205 /*
1206  * smb_request_alloc
1207  *
1208  * Allocate an smb_request_t structure from the kmem_cache.  Partially
1209  * initialize the found/new request.
1210  *
1211  * Returns pointer to a request
1212  */
1213 smb_request_t *
1214 smb_request_alloc(smb_session_t *session, int req_length)
1215 {
1216 	smb_request_t	*sr;
1217 
1218 	ASSERT(session->s_magic == SMB_SESSION_MAGIC);
1219 
1220 	sr = kmem_cache_alloc(session->s_cache_request, KM_SLEEP);
1221 
1222 	/*
1223 	 * Future:  Use constructor to pre-initialize some fields.  For now
1224 	 * there are so many fields that it is easiest just to zero the
1225 	 * whole thing and start over.
1226 	 */
1227 	bzero(sr, sizeof (smb_request_t));
1228 
1229 	mutex_init(&sr->sr_mutex, NULL, MUTEX_DEFAULT, NULL);
1230 	smb_srm_init(sr);
1231 	sr->session = session;
1232 	sr->sr_server = session->s_server;
1233 	sr->sr_gmtoff = session->s_server->si_gmtoff;
1234 	sr->sr_cache = session->s_server->si_cache_request;
1235 	sr->sr_cfg = &session->s_cfg;
1236 	sr->command.max_bytes = req_length;
1237 	sr->reply.max_bytes = smb_maxbufsize;
1238 	sr->sr_req_length = req_length;
1239 	if (req_length)
1240 		sr->sr_request_buf = kmem_alloc(req_length, KM_SLEEP);
1241 	sr->sr_magic = SMB_REQ_MAGIC;
1242 	sr->sr_state = SMB_REQ_STATE_INITIALIZING;
1243 	smb_slist_insert_tail(&session->s_req_list, sr);
1244 	return (sr);
1245 }
1246 
1247 /*
1248  * smb_request_free
1249  *
1250  * release the memories which have been allocated for a smb request.
1251  */
1252 void
1253 smb_request_free(smb_request_t *sr)
1254 {
1255 	ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
1256 	ASSERT(sr->session);
1257 	ASSERT(sr->r_xa == NULL);
1258 
1259 	if (sr->fid_ofile != NULL)
1260 		smb_ofile_release(sr->fid_ofile);
1261 
1262 	if (sr->tid_tree != NULL)
1263 		smb_tree_release(sr->tid_tree);
1264 
1265 	if (sr->uid_user != NULL)
1266 		smb_user_release(sr->uid_user);
1267 
1268 	smb_slist_remove(&sr->session->s_req_list, sr);
1269 
1270 	sr->session = NULL;
1271 
1272 	smb_srm_fini(sr);
1273 
1274 	if (sr->sr_request_buf)
1275 		kmem_free(sr->sr_request_buf, sr->sr_req_length);
1276 	if (sr->command.chain)
1277 		m_freem(sr->command.chain);
1278 	if (sr->reply.chain)
1279 		m_freem(sr->reply.chain);
1280 	if (sr->raw_data.chain)
1281 		m_freem(sr->raw_data.chain);
1282 
1283 	sr->sr_magic = 0;
1284 	mutex_destroy(&sr->sr_mutex);
1285 	kmem_cache_free(sr->sr_cache, sr);
1286 }
1287 
1288 void
1289 dump_smb_inaddr(smb_inaddr_t *ipaddr)
1290 {
1291 	char ipstr[INET6_ADDRSTRLEN];
1292 
1293 	if (smb_inet_ntop(ipaddr, ipstr, SMB_IPSTRLEN(ipaddr->a_family)))
1294 		cmn_err(CE_WARN, "error ipstr=%s", ipstr);
1295 	else
1296 		cmn_err(CE_WARN, "error converting ip address");
1297 }
1298 
1299 boolean_t
1300 smb_session_oplocks_enable(smb_session_t *session)
1301 {
1302 	SMB_SESSION_VALID(session);
1303 	if (session->s_cfg.skc_oplock_enable == 0)
1304 		return (B_FALSE);
1305 	else
1306 		return (B_TRUE);
1307 }
1308 
1309 /*
1310  * smb_session_breaking_oplock
1311  *
1312  * This MUST be a cross-session call, i.e. the caller must be in a different
1313  * context than the one passed. The mutex of the SMB node requiring an oplock
1314  * break MUST be dropped before calling this function. This last requirement is
1315  * due to a potential deadlock that can occur when trying to enter the lock of
1316  * the session passed in.
1317  */
1318 void
1319 smb_session_oplock_break(smb_session_t *session, smb_ofile_t *of)
1320 {
1321 	mbuf_chain_t	*mbc;
1322 
1323 	SMB_SESSION_VALID(session);
1324 
1325 	mbc = smb_mbc_alloc(MLEN);
1326 
1327 	(void) smb_mbc_encodef(mbc, "Mb19.wwwwbb3.ww10.",
1328 	    SMB_COM_LOCKING_ANDX,
1329 	    SMB_TREE_GET_TID(SMB_OFILE_GET_TREE(of)),
1330 	    0xFFFF, 0, 0xFFFF, 8, 0xFF,
1331 	    SMB_OFILE_GET_FID(of),
1332 	    LOCKING_ANDX_OPLOCK_RELEASE);
1333 
1334 	smb_rwx_rwenter(&session->s_lock, RW_WRITER);
1335 	switch (session->s_state) {
1336 	case SMB_SESSION_STATE_NEGOTIATED:
1337 	case SMB_SESSION_STATE_OPLOCK_BREAKING:
1338 		session->s_state = SMB_SESSION_STATE_OPLOCK_BREAKING;
1339 		(void) smb_session_send(session, 0, mbc);
1340 		smb_mbc_free(mbc);
1341 		break;
1342 
1343 	case SMB_SESSION_STATE_READ_RAW_ACTIVE:
1344 		list_insert_tail(&session->s_oplock_brkreqs, mbc);
1345 		break;
1346 
1347 	case SMB_SESSION_STATE_DISCONNECTED:
1348 	case SMB_SESSION_STATE_TERMINATED:
1349 		smb_mbc_free(mbc);
1350 		break;
1351 
1352 	default:
1353 		SMB_PANIC();
1354 	}
1355 	smb_rwx_rwexit(&session->s_lock);
1356 }
1357