1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 24 */ 25 26 /* 27 * SMB requests. 28 * 29 * Request 30 * Header 31 * Magic 0xFF 'S' 'M' 'B' 32 * smb_com a byte, the "first" command 33 * Error a 4-byte union, ignored in a request 34 * smb_flg a one byte set of eight flags 35 * smb_flg2 a two byte set of 16 flags 36 * . twelve reserved bytes, have a role 37 * in connectionless transports (IPX, UDP?) 38 * smb_tid a 16-bit tree ID, a mount point sorta, 39 * 0xFFFF is this command does not have 40 * or require a tree context 41 * smb_pid a 16-bit process ID 42 * smb_uid a 16-bit user ID, specific to this "session" 43 * and mapped to a system (bona-fide) UID 44 * smb_mid a 16-bit multiplex ID, used to differentiate 45 * multiple simultaneous requests from the same 46 * process (pid) (ref RPC "xid") 47 * 48 * Chained (AndX) commands (0 or more) 49 * smb_wct a byte, number of 16-bit words containing 50 * command parameters, min 2 for chained command 51 * andx_com a byte, the "next" command, 0xFF for none 52 * . an unused byte 53 * andx_off a 16-bit offset, byte displacement from &Magic 54 * to the smb_wct field of the "next" command, 55 * ignore if andx_com is 0xFF, s/b 0 if no next 56 * smb_vwv[] 0 or more 16-bit (sorta) parameters for 57 * "this" command (i.e. smb_com if this is the 58 * first parameters, or the andx_com of the just 59 * previous block. 60 * smb_bcc a 16-bit count of smb_data[] bytes 61 * smb_data[] 0 or more bytes, format specific to commands 62 * padding[] Optional padding 63 * 64 * Last command 65 * smb_wct a byte, number of 16-bit words containing 66 * command parameters, min 0 for chained command 67 * smb_vwv[] 0 or more 16-bit (sorta) parameters for 68 * "this" command (i.e. smb_com if this is the 69 * first parameters, or the andx_com of the just 70 * previous block. 71 * smb_bcc a 16-bit count of smb_data[] bytes 72 * smb_data[] 0 or more bytes, format specific to commands 73 * 74 * Reply 75 * Header 76 * Magic 0xFF 'S' 'M' 'B' 77 * smb_com a byte, the "first" command, corresponds 78 * to request 79 * Error a 4-byte union, coding depends on dialect in use 80 * for "DOS" errors 81 * a byte for error class 82 * an unused byte 83 * a 16-bit word for error code 84 * for "NT" errors 85 * a 32-bit error code which 86 * is a packed class and specifier 87 * for "OS/2" errors 88 * I don't know 89 * The error information is specific to the 90 * last command in the reply chain. 91 * smb_flg a one byte set of eight flags, 0x80 bit set 92 * indicating this message is a reply 93 * smb_flg2 a two byte set of 16 flags 94 * . twelve reserved bytes, have a role 95 * in connectionless transports (IPX, UDP?) 96 * smb_tid a 16-bit tree ID, a mount point sorta, 97 * should be the same as the request 98 * smb_pid a 16-bit process ID, MUST BE the same as request 99 * smb_uid a 16-bit user ID, specific to this "session" 100 * and mapped to a system (bona-fide) UID, 101 * should be the same as request 102 * smb_mid a 16-bit multiplex ID, used to differentiate 103 * multiple simultaneous requests from the same 104 * process (pid) (ref RPC "xid"), MUST BE the 105 * same as request 106 * padding[] Optional padding 107 * 108 * Chained (AndX) commands (0 or more) 109 * smb_wct a byte, number of 16-bit words containing 110 * command parameters, min 2 for chained command, 111 * andx_com a byte, the "next" command, 0xFF for none, 112 * corresponds to request, if this is the chained 113 * command that had an error set to 0xFF 114 * . an unused byte 115 * andx_off a 16-bit offset, byte displacement from &Magic 116 * to the smb_wct field of the "next" command, 117 * ignore if andx_com is 0xFF, s/b 0 if no next 118 * smb_vwv[] 0 or more 16-bit (sorta) parameters for 119 * "this" command (i.e. smb_com if this is the 120 * first parameters, or the andx_com of the just 121 * previous block. Empty if an error. 122 * smb_bcc a 16-bit count of smb_data[] bytes 123 * smb_data[] 0 or more bytes, format specific to commands 124 * empty if an error. 125 * 126 * Last command 127 * smb_wct a byte, number of 16-bit words containing 128 * command parameters, min 0 for chained command 129 * smb_vwv[] 0 or more 16-bit (sorta) parameters for 130 * "this" command (i.e. smb_com if this is the 131 * first parameters, or the andx_com of the just 132 * previous block, empty if an error. 133 * smb_bcc a 16-bit count of smb_data[] bytes 134 * smb_data[] 0 or more bytes, format specific to commands, 135 * empty if an error. 136 */ 137 138 #include <smbsrv/smb_kproto.h> 139 #include <smbsrv/smb_kstat.h> 140 #include <sys/sdt.h> 141 #include <sys/spl.h> 142 143 static int smb_legacy_dispatch_stats_update(kstat_t *, int); 144 static int is_andx_com(unsigned char); 145 static int smbsr_check_result(struct smb_request *, int, int); 146 147 static kstat_t *smb_legacy_dispatch_ksp = NULL; 148 static kmutex_t smb_legacy_dispatch_ksmtx; 149 150 static smb_disp_entry_t smb_disp_table[SMB_COM_NUM] = { 151 { "SmbCreateDirectory", SMB_SDT_OPS(create_directory), /* 0x00 000 */ 152 0x00, PC_NETWORK_PROGRAM_1_0 }, 153 { "SmbDeleteDirectory", SMB_SDT_OPS(delete_directory), /* 0x01 001 */ 154 0x01, PC_NETWORK_PROGRAM_1_0 }, 155 { "SmbOpen", SMB_SDT_OPS(open), /* 0x02 002 */ 156 0x02, PC_NETWORK_PROGRAM_1_0 }, 157 { "SmbCreate", SMB_SDT_OPS(create), /* 0x03 003 */ 158 0x03, PC_NETWORK_PROGRAM_1_0 }, 159 { "SmbClose", SMB_SDT_OPS(close), /* 0x04 004 */ 160 0x04, PC_NETWORK_PROGRAM_1_0 }, 161 { "SmbFlush", SMB_SDT_OPS(flush), /* 0x05 005 */ 162 0x05, PC_NETWORK_PROGRAM_1_0 }, 163 { "SmbDelete", SMB_SDT_OPS(delete), /* 0x06 006 */ 164 0x06, PC_NETWORK_PROGRAM_1_0 }, 165 { "SmbRename", SMB_SDT_OPS(rename), /* 0x07 007 */ 166 0x07, PC_NETWORK_PROGRAM_1_0 }, 167 { "SmbQueryInformation", SMB_SDT_OPS(query_information), /* 0x08 008 */ 168 0x08, PC_NETWORK_PROGRAM_1_0 }, 169 { "SmbSetInformation", SMB_SDT_OPS(set_information), /* 0x09 009 */ 170 0x09, PC_NETWORK_PROGRAM_1_0 }, 171 { "SmbRead", SMB_SDT_OPS(read), /* 0x0A 010 */ 172 0x0A, PC_NETWORK_PROGRAM_1_0 }, 173 { "SmbWrite", SMB_SDT_OPS(write), /* 0x0B 011 */ 174 0x0B, PC_NETWORK_PROGRAM_1_0 }, 175 { "SmbLockByteRange", SMB_SDT_OPS(lock_byte_range), /* 0x0C 012 */ 176 0x0C, PC_NETWORK_PROGRAM_1_0 }, 177 { "SmbUnlockByteRange", SMB_SDT_OPS(unlock_byte_range), /* 0x0D 013 */ 178 0x0D, PC_NETWORK_PROGRAM_1_0 }, 179 { "SmbCreateTemporary", SMB_SDT_OPS(create_temporary), /* 0x0E 014 */ 180 0x0E, PC_NETWORK_PROGRAM_1_0 }, 181 { "SmbCreateNew", SMB_SDT_OPS(create_new), /* 0x0F 015 */ 182 0x0F, PC_NETWORK_PROGRAM_1_0 }, 183 { "SmbCheckDirectory", SMB_SDT_OPS(check_directory), /* 0x10 016 */ 184 0x10, PC_NETWORK_PROGRAM_1_0 }, 185 { "SmbProcessExit", SMB_SDT_OPS(process_exit), /* 0x11 017 */ 186 0x11, PC_NETWORK_PROGRAM_1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID, 187 0, 0, { 0 } }, 188 { "SmbSeek", SMB_SDT_OPS(seek), /* 0x12 018 */ 189 0x12, PC_NETWORK_PROGRAM_1_0 }, 190 { "SmbLockAndRead", SMB_SDT_OPS(lock_and_read), /* 0x13 019 */ 191 0x13, LANMAN1_0 }, 192 { "SmbWriteAndUnlock", SMB_SDT_OPS(write_and_unlock), /* 0x14 020 */ 193 0x14, LANMAN1_0 }, 194 { "Invalid", SMB_SDT_OPS(invalid), 0x15, 0 }, /* 0x15 021 */ 195 { "Invalid", SMB_SDT_OPS(invalid), 0x16, 0 }, /* 0x16 022 */ 196 { "Invalid", SMB_SDT_OPS(invalid), 0x17, 0 }, /* 0x17 023 */ 197 { "Invalid", SMB_SDT_OPS(invalid), 0x18, 0 }, /* 0x18 024 */ 198 { "Invalid", SMB_SDT_OPS(invalid), 0x19, 0 }, /* 0x19 025 */ 199 { "SmbReadRaw", SMB_SDT_OPS(read_raw), /* 0x1A 026 */ 200 0x1A, LANMAN1_0 }, 201 { "Invalid", SMB_SDT_OPS(invalid), 0x1B, 0 }, /* 0x1B 027 */ 202 { "Invalid", SMB_SDT_OPS(invalid), 0x1C, 0 }, /* 0x1C 028 */ 203 { "SmbWriteRaw", SMB_SDT_OPS(write_raw), /* 0x1D 029 */ 204 0x1D, LANMAN1_0 }, 205 { "Invalid", SMB_SDT_OPS(invalid), 0x1E, 0 }, /* 0x1E 030 */ 206 { "Invalid", SMB_SDT_OPS(invalid), 0x1F, 0 }, /* 0x1F 031 */ 207 { "Invalid", SMB_SDT_OPS(invalid), 0x20, 0 }, /* 0x20 032 */ 208 { "Invalid", SMB_SDT_OPS(invalid), 0x21, 0 }, /* 0x21 033 */ 209 { "SmbSetInformation2", SMB_SDT_OPS(set_information2), /* 0x22 034 */ 210 0x22, LANMAN1_0 }, 211 { "SmbQueryInformation2", 212 SMB_SDT_OPS(query_information2), /* 0x23 035 */ 213 0x23, LANMAN1_0 }, 214 { "SmbLockingX", SMB_SDT_OPS(locking_andx), /* 0x24 036 */ 215 0x24, LANMAN1_0 }, 216 { "SmbTransaction", SMB_SDT_OPS(transaction), /* 0x25 037 */ 217 0x25, LANMAN1_0 }, 218 { "SmbTransactionSecondary", 219 SMB_SDT_OPS(transaction_secondary), /* 0x26 038 */ 220 0x26, LANMAN1_0 }, 221 { "SmbIoctl", SMB_SDT_OPS(ioctl), /* 0x27 039 */ 222 0x27, LANMAN1_0 }, 223 { "Invalid", SMB_SDT_OPS(invalid), 0x28, 0 }, /* 0x28 040 */ 224 { "Invalid", SMB_SDT_OPS(invalid), 0x29, 0 }, /* 0x29 041 */ 225 { "Invalid", SMB_SDT_OPS(invalid), 0x2A, 0 }, /* 0x2A 042 */ 226 { "SmbEcho", SMB_SDT_OPS(echo), /* 0x2B 043 */ 227 0x2B, LANMAN1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID }, 228 { "SmbWriteAndClose", SMB_SDT_OPS(write_and_close), /* 0x2C 044 */ 229 0x2C, LANMAN1_0 }, 230 { "SmbOpenX", SMB_SDT_OPS(open_andx), /* 0x2D 045 */ 231 0x2D, LANMAN1_0 }, 232 { "SmbReadX", SMB_SDT_OPS(read_andx), /* 0x2E 046 */ 233 0x2E, LANMAN1_0 }, 234 { "SmbWriteX", SMB_SDT_OPS(write_andx), /* 0x2F 047 */ 235 0x2F, LANMAN1_0 }, 236 { "Invalid", SMB_SDT_OPS(invalid), 0x30, 0 }, /* 0x30 048 */ 237 { "SmbCloseAndTreeDisconnect", 238 SMB_SDT_OPS(close_and_tree_disconnect), /* 0x31 049 */ 239 0x31, LANMAN1_0 }, 240 { "SmbTransaction2", SMB_SDT_OPS(transaction2), /* 0x32 050 */ 241 0x32, LM1_2X002 }, 242 { "SmbTransaction2Secondary", 243 SMB_SDT_OPS(transaction2_secondary), /* 0x33 051 */ 244 0x33, LM1_2X002 }, 245 { "SmbFindClose2", SMB_SDT_OPS(find_close2), /* 0x34 052 */ 246 0x34, LM1_2X002 }, 247 { "Invalid", SMB_SDT_OPS(invalid), 0x35, 0 }, /* 0x35 053 */ 248 { "Invalid", SMB_SDT_OPS(invalid), 0x36, 0 }, /* 0x36 054 */ 249 { "Invalid", SMB_SDT_OPS(invalid), 0x37, 0 }, /* 0x37 055 */ 250 { "Invalid", SMB_SDT_OPS(invalid), 0x38, 0 }, /* 0x38 056 */ 251 { "Invalid", SMB_SDT_OPS(invalid), 0x39, 0 }, /* 0x39 057 */ 252 { "Invalid", SMB_SDT_OPS(invalid), 0x3A, 0 }, /* 0x3A 058 */ 253 { "Invalid", SMB_SDT_OPS(invalid), 0x3B, 0 }, /* 0x3B 059 */ 254 { "Invalid", SMB_SDT_OPS(invalid), 0x3C, 0 }, /* 0x3C 060 */ 255 { "Invalid", SMB_SDT_OPS(invalid), 0x3D, 0 }, /* 0x3D 061 */ 256 { "Invalid", SMB_SDT_OPS(invalid), 0x3E, 0 }, /* 0x3E 062 */ 257 { "Invalid", SMB_SDT_OPS(invalid), 0x3F, 0 }, /* 0x3F 063 */ 258 { "Invalid", SMB_SDT_OPS(invalid), 0x40, 0 }, /* 0x40 064 */ 259 { "Invalid", SMB_SDT_OPS(invalid), 0x47, 0 }, /* 0x47 065 */ 260 { "Invalid", SMB_SDT_OPS(invalid), 0x48, 0 }, /* 0x48 066 */ 261 { "Invalid", SMB_SDT_OPS(invalid), 0x49, 0 }, /* 0x49 067 */ 262 { "Invalid", SMB_SDT_OPS(invalid), 0x44, 0 }, /* 0x44 068 */ 263 { "Invalid", SMB_SDT_OPS(invalid), 0x45, 0 }, /* 0x45 069 */ 264 { "Invalid", SMB_SDT_OPS(invalid), 0x46, 0 }, /* 0x46 070 */ 265 { "Invalid", SMB_SDT_OPS(invalid), 0x47, 0 }, /* 0x47 071 */ 266 { "Invalid", SMB_SDT_OPS(invalid), 0x48, 0 }, /* 0x48 072 */ 267 { "Invalid", SMB_SDT_OPS(invalid), 0x49, 0 }, /* 0x49 073 */ 268 { "Invalid", SMB_SDT_OPS(invalid), 0x4A, 0 }, /* 0x4A 074 */ 269 { "Invalid", SMB_SDT_OPS(invalid), 0x4B, 0 }, /* 0x4B 075 */ 270 { "Invalid", SMB_SDT_OPS(invalid), 0x4C, 0 }, /* 0x4C 076 */ 271 { "Invalid", SMB_SDT_OPS(invalid), 0x4D, 0 }, /* 0x4D 077 */ 272 { "Invalid", SMB_SDT_OPS(invalid), 0x4E, 0 }, /* 0x4E 078 */ 273 { "Invalid", SMB_SDT_OPS(invalid), 0x4F, 0 }, /* 0x4F 079 */ 274 { "Invalid", SMB_SDT_OPS(invalid), 0x50, 0 }, /* 0x50 080 */ 275 { "Invalid", SMB_SDT_OPS(invalid), 0x51, 0 }, /* 0x51 081 */ 276 { "Invalid", SMB_SDT_OPS(invalid), 0x52, 0 }, /* 0x52 082 */ 277 { "Invalid", SMB_SDT_OPS(invalid), 0x53, 0 }, /* 0x53 083 */ 278 { "Invalid", SMB_SDT_OPS(invalid), 0x54, 0 }, /* 0x54 084 */ 279 { "Invalid", SMB_SDT_OPS(invalid), 0x55, 0 }, /* 0x55 085 */ 280 { "Invalid", SMB_SDT_OPS(invalid), 0x56, 0 }, /* 0x56 086 */ 281 { "Invalid", SMB_SDT_OPS(invalid), 0x57, 0 }, /* 0x57 087 */ 282 { "Invalid", SMB_SDT_OPS(invalid), 0x58, 0 }, /* 0x58 088 */ 283 { "Invalid", SMB_SDT_OPS(invalid), 0x59, 0 }, /* 0x59 089 */ 284 { "Invalid", SMB_SDT_OPS(invalid), 0x5A, 0 }, /* 0x5A 090 */ 285 { "Invalid", SMB_SDT_OPS(invalid), 0x5B, 0 }, /* 0x5B 091 */ 286 { "Invalid", SMB_SDT_OPS(invalid), 0x5C, 0 }, /* 0x5C 092 */ 287 { "Invalid", SMB_SDT_OPS(invalid), 0x5D, 0 }, /* 0x5D 093 */ 288 { "Invalid", SMB_SDT_OPS(invalid), 0x5E, 0 }, /* 0x5E 094 */ 289 { "Invalid", SMB_SDT_OPS(invalid), 0x5F, 0 }, /* 0x5F 095 */ 290 { "Invalid", SMB_SDT_OPS(invalid), 0x60, 0 }, /* 0x60 096 */ 291 { "Invalid", SMB_SDT_OPS(invalid), 0x61, 0 }, /* 0x61 097 */ 292 { "Invalid", SMB_SDT_OPS(invalid), 0x62, 0 }, /* 0x62 098 */ 293 { "Invalid", SMB_SDT_OPS(invalid), 0x63, 0 }, /* 0x63 099 */ 294 { "Invalid", SMB_SDT_OPS(invalid), 0x64, 0 }, /* 0x64 100 */ 295 { "Invalid", SMB_SDT_OPS(invalid), 0x65, 0 }, /* 0x65 101 */ 296 { "Invalid", SMB_SDT_OPS(invalid), 0x66, 0 }, /* 0x66 102 */ 297 { "Invalid", SMB_SDT_OPS(invalid), 0x67, 0 }, /* 0x67 103 */ 298 { "Invalid", SMB_SDT_OPS(invalid), 0x68, 0 }, /* 0x68 104 */ 299 { "Invalid", SMB_SDT_OPS(invalid), 0x69, 0 }, /* 0x69 105 */ 300 { "Invalid", SMB_SDT_OPS(invalid), 0x6A, 0 }, /* 0x6A 106 */ 301 { "Invalid", SMB_SDT_OPS(invalid), 0x6B, 0 }, /* 0x6B 107 */ 302 { "Invalid", SMB_SDT_OPS(invalid), 0x6C, 0 }, /* 0x6C 108 */ 303 { "Invalid", SMB_SDT_OPS(invalid), 0x6D, 0 }, /* 0x6D 109 */ 304 { "Invalid", SMB_SDT_OPS(invalid), 0x6E, 0 }, /* 0x6E 110 */ 305 { "Invalid", SMB_SDT_OPS(invalid), 0x6F, 0 }, /* 0x6F 111 */ 306 { "SmbTreeConnect", SMB_SDT_OPS(tree_connect), /* 0x70 112 */ 307 0x70, PC_NETWORK_PROGRAM_1_0, SDDF_SUPPRESS_TID }, 308 { "SmbTreeDisconnect", SMB_SDT_OPS(tree_disconnect), /* 0x71 113 */ 309 0x71, PC_NETWORK_PROGRAM_1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID, 310 NULL }, 311 { "SmbNegotiate", SMB_SDT_OPS(negotiate), /* 0x72 114 */ 312 0x72, PC_NETWORK_PROGRAM_1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID, 313 NULL }, 314 { "SmbSessionSetupX", SMB_SDT_OPS(session_setup_andx), /* 0x73 115 */ 315 0x73, LANMAN1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID }, 316 { "SmbLogoffX", SMB_SDT_OPS(logoff_andx), /* 0x74 116 */ 317 0x74, LM1_2X002, SDDF_SUPPRESS_TID }, 318 { "SmbTreeConnectX", SMB_SDT_OPS(tree_connect_andx), /* 0x75 117 */ 319 0x75, LANMAN1_0, SDDF_SUPPRESS_TID }, 320 { "Invalid", SMB_SDT_OPS(invalid), 0x76, 0, 0 }, /* 0x76 118 */ 321 { "Invalid", SMB_SDT_OPS(invalid), 0x77, 0, 0 }, /* 0x77 119 */ 322 { "Invalid", SMB_SDT_OPS(invalid), 0x78, 0, 0 }, /* 0x78 120 */ 323 { "Invalid", SMB_SDT_OPS(invalid), 0x79, 0, 0 }, /* 0x79 121 */ 324 { "Invalid", SMB_SDT_OPS(invalid), 0x7A, 0, 0 }, /* 0x7A 122 */ 325 { "Invalid", SMB_SDT_OPS(invalid), 0x7B, 0, 0 }, /* 0x7B 123 */ 326 { "Invalid", SMB_SDT_OPS(invalid), 0x7C, 0, 0 }, /* 0x7C 124 */ 327 { "Invalid", SMB_SDT_OPS(invalid), 0x7D, 0, 0 }, /* 0x7D 125 */ 328 { "Invalid", SMB_SDT_OPS(invalid), 0x7E, 0, 0 }, /* 0x7E 126 */ 329 { "Invalid", SMB_SDT_OPS(invalid), 0x7F, 0, 0 }, /* 0x7F 127 */ 330 { "SmbQueryInformationDisk", 331 SMB_SDT_OPS(query_information_disk), /* 0x80 128 */ 332 0x80, PC_NETWORK_PROGRAM_1_0, 0 }, 333 { "SmbSearch", SMB_SDT_OPS(search), /* 0x81 129 */ 334 0x81, PC_NETWORK_PROGRAM_1_0, 0 }, 335 { "SmbFind", SMB_SDT_OPS(find), /* 0x82 130 */ 336 0x82, LANMAN1_0, 0 }, 337 { "SmbFindUnique", SMB_SDT_OPS(find_unique), /* 0x83 131 */ 338 0x83, LANMAN1_0, 0 }, 339 { "SmbFindClose", SMB_SDT_OPS(find_close), /* 0x84 132 */ 340 0x84, LANMAN1_0, 0 }, 341 { "Invalid", SMB_SDT_OPS(invalid), 0x85, 0, 0 }, /* 0x85 133 */ 342 { "Invalid", SMB_SDT_OPS(invalid), 0x86, 0, 0 }, /* 0x86 134 */ 343 { "Invalid", SMB_SDT_OPS(invalid), 0x87, 0, 0 }, /* 0x87 135 */ 344 { "Invalid", SMB_SDT_OPS(invalid), 0x88, 0, 0 }, /* 0x88 136 */ 345 { "Invalid", SMB_SDT_OPS(invalid), 0x89, 0, 0 }, /* 0x89 137 */ 346 { "Invalid", SMB_SDT_OPS(invalid), 0x8A, 0, 0 }, /* 0x8A 138 */ 347 { "Invalid", SMB_SDT_OPS(invalid), 0x8B, 0, 0 }, /* 0x8B 139 */ 348 { "Invalid", SMB_SDT_OPS(invalid), 0x8C, 0, 0 }, /* 0x8C 140 */ 349 { "Invalid", SMB_SDT_OPS(invalid), 0x8D, 0, 0 }, /* 0x8D 141 */ 350 { "Invalid", SMB_SDT_OPS(invalid), 0x8E, 0, 0 }, /* 0x8E 142 */ 351 { "Invalid", SMB_SDT_OPS(invalid), 0x8F, 0, 0 }, /* 0x8F 143 */ 352 { "Invalid", SMB_SDT_OPS(invalid), 0x90, 0, 0 }, /* 0x90 144 */ 353 { "Invalid", SMB_SDT_OPS(invalid), 0x91, 0, 0 }, /* 0x91 145 */ 354 { "Invalid", SMB_SDT_OPS(invalid), 0x92, 0, 0 }, /* 0x92 146 */ 355 { "Invalid", SMB_SDT_OPS(invalid), 0x93, 0, 0 }, /* 0x93 147 */ 356 { "Invalid", SMB_SDT_OPS(invalid), 0x94, 0, 0 }, /* 0x94 148 */ 357 { "Invalid", SMB_SDT_OPS(invalid), 0x95, 0, 0 }, /* 0x95 149 */ 358 { "Invalid", SMB_SDT_OPS(invalid), 0x96, 0, 0 }, /* 0x96 150 */ 359 { "Invalid", SMB_SDT_OPS(invalid), 0x97, 0, 0 }, /* 0x97 151 */ 360 { "Invalid", SMB_SDT_OPS(invalid), 0x98, 0, 0 }, /* 0x98 152 */ 361 { "Invalid", SMB_SDT_OPS(invalid), 0x99, 0, 0 }, /* 0x99 153 */ 362 { "Invalid", SMB_SDT_OPS(invalid), 0x9A, 0, 0 }, /* 0x9A 154 */ 363 { "Invalid", SMB_SDT_OPS(invalid), 0x9B, 0, 0 }, /* 0x9B 155 */ 364 { "Invalid", SMB_SDT_OPS(invalid), 0x9C, 0, 0 }, /* 0x9C 156 */ 365 { "Invalid", SMB_SDT_OPS(invalid), 0x9D, 0, 0 }, /* 0x9D 157 */ 366 { "Invalid", SMB_SDT_OPS(invalid), 0x9E, 0, 0 }, /* 0x9E 158 */ 367 { "Invalid", SMB_SDT_OPS(invalid), 0x9F, 0, 0 }, /* 0x9F 159 */ 368 { "SmbNtTransact", SMB_SDT_OPS(nt_transact), /* 0xA0 160 */ 369 0xA0, NT_LM_0_12, 0 }, 370 { "SmbNtTransactSecondary", 371 SMB_SDT_OPS(nt_transact_secondary), /* 0xA1 161 */ 372 0xA1, NT_LM_0_12, 0 }, 373 { "SmbNtCreateX", SMB_SDT_OPS(nt_create_andx), /* 0xA2 162 */ 374 0xA2, NT_LM_0_12, 0 }, 375 { "Invalid", SMB_SDT_OPS(invalid), 0xA3, 0, 0 }, /* 0xA3 163 */ 376 { "SmbNtCancel", SMB_SDT_OPS(nt_cancel), /* 0xA4 164 */ 377 0xA4, NT_LM_0_12, 0 }, 378 { "SmbNtRename", SMB_SDT_OPS(nt_rename), /* 0xA5 165 */ 379 0xA5, NT_LM_0_12, 0 }, 380 { "Invalid", SMB_SDT_OPS(invalid), 0xA6, 0, 0 }, /* 0xA6 166 */ 381 { "Invalid", SMB_SDT_OPS(invalid), 0xA7, 0, 0 }, /* 0xA7 167 */ 382 { "Invalid", SMB_SDT_OPS(invalid), 0xA8, 0, 0 }, /* 0xA8 168 */ 383 { "Invalid", SMB_SDT_OPS(invalid), 0xA9, 0, 0 }, /* 0xA9 169 */ 384 { "Invalid", SMB_SDT_OPS(invalid), 0xAA, 0, 0 }, /* 0xAA 170 */ 385 { "Invalid", SMB_SDT_OPS(invalid), 0xAB, 0, 0 }, /* 0xAB 171 */ 386 { "Invalid", SMB_SDT_OPS(invalid), 0xAC, 0, 0 }, /* 0xAC 172 */ 387 { "Invalid", SMB_SDT_OPS(invalid), 0xAD, 0, 0 }, /* 0xAD 173 */ 388 { "Invalid", SMB_SDT_OPS(invalid), 0xAE, 0, 0 }, /* 0xAE 174 */ 389 { "Invalid", SMB_SDT_OPS(invalid), 0xAF, 0, 0 }, /* 0xAF 175 */ 390 { "Invalid", SMB_SDT_OPS(invalid), 0xB0, 0, 0 }, /* 0xB0 176 */ 391 { "Invalid", SMB_SDT_OPS(invalid), 0xB1, 0, 0 }, /* 0xB1 177 */ 392 { "Invalid", SMB_SDT_OPS(invalid), 0xB2, 0, 0 }, /* 0xB2 178 */ 393 { "Invalid", SMB_SDT_OPS(invalid), 0xB3, 0, 0 }, /* 0xB3 179 */ 394 { "Invalid", SMB_SDT_OPS(invalid), 0xB4, 0, 0 }, /* 0xB4 180 */ 395 { "Invalid", SMB_SDT_OPS(invalid), 0xB5, 0, 0 }, /* 0xB5 181 */ 396 { "Invalid", SMB_SDT_OPS(invalid), 0xB6, 0, 0 }, /* 0xB6 182 */ 397 { "Invalid", SMB_SDT_OPS(invalid), 0xB7, 0, 0 }, /* 0xB7 183 */ 398 { "Invalid", SMB_SDT_OPS(invalid), 0xB8, 0, 0 }, /* 0xB8 184 */ 399 { "Invalid", SMB_SDT_OPS(invalid), 0xB9, 0, 0 }, /* 0xB9 185 */ 400 { "Invalid", SMB_SDT_OPS(invalid), 0xBA, 0, 0 }, /* 0xBA 186 */ 401 { "Invalid", SMB_SDT_OPS(invalid), 0xBB, 0, 0 }, /* 0xBB 187 */ 402 { "Invalid", SMB_SDT_OPS(invalid), 0xBC, 0, 0 }, /* 0xBC 188 */ 403 { "Invalid", SMB_SDT_OPS(invalid), 0xBD, 0, 0 }, /* 0xBD 189 */ 404 { "Invalid", SMB_SDT_OPS(invalid), 0xBE, 0, 0 }, /* 0xBE 190 */ 405 { "Invalid", SMB_SDT_OPS(invalid), 0xBF, 0, 0 }, /* 0xBF 191 */ 406 { "SmbOpenPrintFile", SMB_SDT_OPS(open_print_file), /* 0xC0 192 */ 407 0xC0, PC_NETWORK_PROGRAM_1_0, 0 }, 408 { "SmbWritePrintFile", SMB_SDT_OPS(write_print_file), /* 0xC1 193 */ 409 0xC1, PC_NETWORK_PROGRAM_1_0, 0 }, 410 { "SmbClosePrintFile", SMB_SDT_OPS(close_print_file), /* 0xC2 194 */ 411 0xC2, PC_NETWORK_PROGRAM_1_0, 0 }, 412 { "SmbGetPrintQueue", SMB_SDT_OPS(get_print_queue), /* 0xC3 195 */ 413 0xC3, PC_NETWORK_PROGRAM_1_0, 0 }, 414 { "Invalid", SMB_SDT_OPS(invalid), 0xC4, 0, 0 }, /* 0xC4 196 */ 415 { "Invalid", SMB_SDT_OPS(invalid), 0xC5, 0, 0 }, /* 0xC5 197 */ 416 { "Invalid", SMB_SDT_OPS(invalid), 0xC6, 0, 0 }, /* 0xC6 198 */ 417 { "Invalid", SMB_SDT_OPS(invalid), 0xC7, 0, 0 }, /* 0xC7 199 */ 418 { "Invalid", SMB_SDT_OPS(invalid), 0xC8, 0, 0 }, /* 0xC8 200 */ 419 { "Invalid", SMB_SDT_OPS(invalid), 0xC9, 0, 0 }, /* 0xC9 201 */ 420 { "Invalid", SMB_SDT_OPS(invalid), 0xCA, 0, 0 }, /* 0xCA 202 */ 421 { "Invalid", SMB_SDT_OPS(invalid), 0xCB, 0, 0 }, /* 0xCB 203 */ 422 { "Invalid", SMB_SDT_OPS(invalid), 0xCC, 0, 0 }, /* 0xCC 204 */ 423 { "Invalid", SMB_SDT_OPS(invalid), 0xCD, 0, 0 }, /* 0xCD 205 */ 424 { "Invalid", SMB_SDT_OPS(invalid), 0xCE, 0, 0 }, /* 0xCE 206 */ 425 { "Invalid", SMB_SDT_OPS(invalid), 0xCF, 0, 0 }, /* 0xCF 207 */ 426 { "Invalid", SMB_SDT_OPS(invalid), 0xD0, 0, 0 }, /* 0xD0 208 */ 427 { "Invalid", SMB_SDT_OPS(invalid), 0xD1, 0, 0 }, /* 0xD1 209 */ 428 { "Invalid", SMB_SDT_OPS(invalid), 0xD2, 0, 0 }, /* 0xD2 210 */ 429 { "Invalid", SMB_SDT_OPS(invalid), 0xD3, 0, 0 }, /* 0xD3 211 */ 430 { "Invalid", SMB_SDT_OPS(invalid), 0xD4, 0, 0 }, /* 0xD4 212 */ 431 { "Invalid", SMB_SDT_OPS(invalid), 0xD5, 0, 0 }, /* 0xD5 213 */ 432 { "Invalid", SMB_SDT_OPS(invalid), 0xD6, 0, 0 }, /* 0xD6 214 */ 433 { "Invalid", SMB_SDT_OPS(invalid), 0xD7, 0, 0 }, /* 0xD7 215 */ 434 { "Invalid", SMB_SDT_OPS(invalid), 0xD8, 0, 0 }, /* 0xD8 216 */ 435 { "Invalid", SMB_SDT_OPS(invalid), 0xD9, 0, 0 }, /* 0xD9 217 */ 436 { "Invalid", SMB_SDT_OPS(invalid), 0xDA, 0, 0 }, /* 0xDA 218 */ 437 { "Invalid", SMB_SDT_OPS(invalid), 0xDB, 0, 0 }, /* 0xDB 219 */ 438 { "Invalid", SMB_SDT_OPS(invalid), 0xDC, 0, 0 }, /* 0xDC 220 */ 439 { "Invalid", SMB_SDT_OPS(invalid), 0xDD, 0, 0 }, /* 0xDD 221 */ 440 { "Invalid", SMB_SDT_OPS(invalid), 0xDE, 0, 0 }, /* 0xDE 222 */ 441 { "Invalid", SMB_SDT_OPS(invalid), 0xDF, 0, 0 }, /* 0xDF 223 */ 442 { "Invalid", SMB_SDT_OPS(invalid), 0xE0, 0, 0 }, /* 0xE0 224 */ 443 { "Invalid", SMB_SDT_OPS(invalid), 0xE1, 0, 0 }, /* 0xE1 225 */ 444 { "Invalid", SMB_SDT_OPS(invalid), 0xE2, 0, 0 }, /* 0xE2 226 */ 445 { "Invalid", SMB_SDT_OPS(invalid), 0xE3, 0, 0 }, /* 0xE3 227 */ 446 { "Invalid", SMB_SDT_OPS(invalid), 0xE4, 0, 0 }, /* 0xE4 228 */ 447 { "Invalid", SMB_SDT_OPS(invalid), 0xE5, 0, 0 }, /* 0xE5 229 */ 448 { "Invalid", SMB_SDT_OPS(invalid), 0xE6, 0, 0 }, /* 0xE6 230 */ 449 { "Invalid", SMB_SDT_OPS(invalid), 0xE7, 0, 0 }, /* 0xE7 231 */ 450 { "Invalid", SMB_SDT_OPS(invalid), 0xE8, 0, 0 }, /* 0xE8 232 */ 451 { "Invalid", SMB_SDT_OPS(invalid), 0xE9, 0, 0 }, /* 0xE9 233 */ 452 { "Invalid", SMB_SDT_OPS(invalid), 0xEA, 0, 0 }, /* 0xEA 234 */ 453 { "Invalid", SMB_SDT_OPS(invalid), 0xEB, 0, 0 }, /* 0xEB 235 */ 454 { "Invalid", SMB_SDT_OPS(invalid), 0xEC, 0, 0 }, /* 0xEC 236 */ 455 { "Invalid", SMB_SDT_OPS(invalid), 0xED, 0, 0 }, /* 0xED 237 */ 456 { "Invalid", SMB_SDT_OPS(invalid), 0xEE, 0, 0 }, /* 0xEE 238 */ 457 { "Invalid", SMB_SDT_OPS(invalid), 0xEF, 0, 0 }, /* 0xEF 239 */ 458 { "Invalid", SMB_SDT_OPS(invalid), 0xF0, 0, 0 }, /* 0xF0 240 */ 459 { "Invalid", SMB_SDT_OPS(invalid), 0xF1, 0, 0 }, /* 0xF1 241 */ 460 { "Invalid", SMB_SDT_OPS(invalid), 0xF2, 0, 0 }, /* 0xF2 242 */ 461 { "Invalid", SMB_SDT_OPS(invalid), 0xF3, 0, 0 }, /* 0xF3 243 */ 462 { "Invalid", SMB_SDT_OPS(invalid), 0xF4, 0, 0 }, /* 0xF4 244 */ 463 { "Invalid", SMB_SDT_OPS(invalid), 0xF5, 0, 0 }, /* 0xF5 245 */ 464 { "Invalid", SMB_SDT_OPS(invalid), 0xF6, 0, 0 }, /* 0xF6 246 */ 465 { "Invalid", SMB_SDT_OPS(invalid), 0xF7, 0, 0 }, /* 0xF7 247 */ 466 { "Invalid", SMB_SDT_OPS(invalid), 0xF8, 0, 0 }, /* 0xF8 248 */ 467 { "Invalid", SMB_SDT_OPS(invalid), 0xF9, 0, 0 }, /* 0xF9 249 */ 468 { "Invalid", SMB_SDT_OPS(invalid), 0xFA, 0, 0 }, /* 0xFA 250 */ 469 { "Invalid", SMB_SDT_OPS(invalid), 0xFB, 0, 0 }, /* 0xFB 251 */ 470 { "Invalid", SMB_SDT_OPS(invalid), 0xFC, 0, 0 }, /* 0xFC 252 */ 471 { "Invalid", SMB_SDT_OPS(invalid), 0xFD, 0, 0 }, /* 0xFD 253 */ 472 { "Invalid", SMB_SDT_OPS(invalid), 0xFE, 0, 0 }, /* 0xFE 254 */ 473 { "Invalid", SMB_SDT_OPS(invalid), 0xFF, 0, 0 } /* 0xFF 255 */ 474 }; 475 476 /* 477 * smbsr_cleanup 478 * 479 * If any user/tree/file is used by given request then 480 * the reference count for that resource has been incremented. 481 * This function decrements the reference count and close 482 * the resource if it's needed. 483 */ 484 485 void 486 smbsr_cleanup(smb_request_t *sr) 487 { 488 ASSERT((sr->sr_state != SMB_REQ_STATE_CLEANED_UP) && 489 (sr->sr_state != SMB_REQ_STATE_COMPLETED)); 490 491 if (sr->r_xa) { 492 if (sr->r_xa->xa_flags & SMB_XA_FLAG_COMPLETE) 493 smb_xa_close(sr->r_xa); 494 smb_xa_rele(sr->session, sr->r_xa); 495 sr->r_xa = NULL; 496 } 497 498 /* 499 * Mark this request so we know that we've already cleaned it up. 500 * A request should only get cleaned up once so multiple calls to 501 * smbsr_cleanup for the same request indicate a bug. 502 */ 503 mutex_enter(&sr->sr_mutex); 504 if (sr->sr_state != SMB_REQ_STATE_CANCELED) 505 sr->sr_state = SMB_REQ_STATE_CLEANED_UP; 506 mutex_exit(&sr->sr_mutex); 507 } 508 /* 509 * smb_dispatch_request 510 * 511 * Returns: 512 * 513 * B_TRUE The caller must free the smb request passed in. 514 * B_FALSE The caller must not access the smb request passed in. It has 515 * been kept in an internal queue and may have already been freed. 516 */ 517 boolean_t 518 smb_dispatch_request(struct smb_request *sr) 519 { 520 smb_sdrc_t sdrc; 521 smb_disp_entry_t *sdd; 522 boolean_t disconnect = B_FALSE; 523 smb_session_t *session; 524 uint32_t capabilities; 525 uint32_t byte_count; 526 527 session = sr->session; 528 capabilities = session->capabilities; 529 530 ASSERT(sr->tid_tree == 0); 531 ASSERT(sr->uid_user == 0); 532 ASSERT(sr->fid_ofile == 0); 533 sr->smb_fid = (uint16_t)-1; 534 535 /* temporary until we identify a user */ 536 sr->user_cr = kcred; 537 sr->orig_request_hdr = sr->command.chain_offset; 538 539 /* If this connection is shutting down just kill request */ 540 if (smb_mbc_decodef(&sr->command, SMB_HEADER_ED_FMT, 541 &sr->smb_com, 542 &sr->smb_rcls, 543 &sr->smb_reh, 544 &sr->smb_err, 545 &sr->smb_flg, 546 &sr->smb_flg2, 547 &sr->smb_pid_high, 548 sr->smb_sig, 549 &sr->smb_tid, 550 &sr->smb_pid, 551 &sr->smb_uid, 552 &sr->smb_mid) != 0) { 553 disconnect = B_TRUE; 554 goto drop_connection; 555 } 556 557 /* 558 * The reply "header" is filled in now even though it will, 559 * most likely, be rewritten under reply_ready below. We 560 * could reserve the space but this is convenient in case 561 * the dialect dispatcher has to send a special reply (like 562 * TRANSACT). 563 * 564 * Ensure that the 32-bit error code flag is turned off. 565 * Clients seem to set it in transact requests and they may 566 * get confused if we return success or a 16-bit SMB code. 567 */ 568 sr->smb_rcls = 0; 569 sr->smb_reh = 0; 570 sr->smb_err = 0; 571 sr->smb_flg2 &= ~SMB_FLAGS2_NT_STATUS; 572 573 (void) smb_mbc_encodef(&sr->reply, SMB_HEADER_ED_FMT, 574 sr->smb_com, 575 sr->smb_rcls, 576 sr->smb_reh, 577 sr->smb_err, 578 sr->smb_flg, 579 sr->smb_flg2, 580 sr->smb_pid_high, 581 sr->smb_sig, 582 sr->smb_tid, 583 sr->smb_pid, 584 sr->smb_uid, 585 sr->smb_mid); 586 sr->first_smb_com = sr->smb_com; 587 588 /* 589 * Verify SMB signature if signing is enabled, dialect is NT LM 0.12, 590 * signing was negotiated and authentication has occurred. 591 */ 592 if (session->signing.flags & SMB_SIGNING_ENABLED) { 593 if (smb_sign_check_request(sr) != 0) { 594 smbsr_error(sr, NT_STATUS_ACCESS_DENIED, 595 ERRDOS, ERROR_ACCESS_DENIED); 596 disconnect = B_TRUE; 597 goto report_error; 598 } 599 } 600 601 andx_more: 602 sdd = &smb_disp_table[sr->smb_com]; 603 ASSERT(sdd->sdt_function); 604 605 if (smb_mbc_decodef(&sr->command, "b", &sr->smb_wct) != 0) { 606 disconnect = B_TRUE; 607 goto report_error; 608 } 609 610 (void) MBC_SHADOW_CHAIN(&sr->smb_vwv, &sr->command, 611 sr->command.chain_offset, sr->smb_wct * 2); 612 613 if (smb_mbc_decodef(&sr->command, "#.w", sr->smb_wct*2, &sr->smb_bcc)) { 614 disconnect = B_TRUE; 615 goto report_error; 616 } 617 618 atomic_add_64(&sdd->sdt_rxb, 619 (int64_t)(sr->smb_wct * 2 + sr->smb_bcc + 1)); 620 sr->sr_txb = sr->reply.chain_offset; 621 622 /* 623 * Ignore smb_bcc if CAP_LARGE_READX/CAP_LARGE_WRITEX 624 * and this is SmbReadX/SmbWriteX since this enables 625 * large reads/write and bcc is only 16-bits. 626 */ 627 if (((sr->smb_com == SMB_COM_READ_ANDX) && 628 (capabilities & CAP_LARGE_READX)) || 629 ((sr->smb_com == SMB_COM_WRITE_ANDX) && 630 (capabilities & CAP_LARGE_WRITEX))) { 631 byte_count = sr->command.max_bytes - sr->command.chain_offset; 632 } else { 633 byte_count = (uint32_t)sr->smb_bcc; 634 } 635 636 (void) MBC_SHADOW_CHAIN(&sr->smb_data, &sr->command, 637 sr->command.chain_offset, byte_count); 638 639 sr->command.chain_offset += byte_count; 640 if (sr->command.chain_offset > sr->command.max_bytes) { 641 disconnect = B_TRUE; 642 goto report_error; 643 } 644 645 /* Store pointers for later */ 646 sr->cur_reply_offset = sr->reply.chain_offset; 647 648 if (is_andx_com(sr->smb_com)) { 649 /* Peek ahead and don't disturb vwv */ 650 if (smb_mbc_peek(&sr->smb_vwv, sr->smb_vwv.chain_offset, "b.w", 651 &sr->andx_com, &sr->andx_off) < 0) { 652 disconnect = B_TRUE; 653 goto report_error; 654 } 655 } else { 656 sr->andx_com = (unsigned char)-1; 657 } 658 659 mutex_enter(&sr->sr_mutex); 660 switch (sr->sr_state) { 661 case SMB_REQ_STATE_SUBMITTED: 662 case SMB_REQ_STATE_CLEANED_UP: 663 sr->sr_state = SMB_REQ_STATE_ACTIVE; 664 break; 665 case SMB_REQ_STATE_CANCELED: 666 break; 667 default: 668 ASSERT(0); 669 break; 670 } 671 mutex_exit(&sr->sr_mutex); 672 673 /* 674 * Setup UID and TID information (if required). Both functions 675 * will set the sr credentials. In domain mode, the user and 676 * tree credentials should be the same. In share mode, the 677 * tree credentials (defined in the share definition) should 678 * override the user credentials. 679 */ 680 if (!(sdd->sdt_flags & SDDF_SUPPRESS_UID) && (sr->uid_user == NULL)) { 681 sr->uid_user = smb_session_lookup_uid(session, sr->smb_uid); 682 if (sr->uid_user == NULL) { 683 smbsr_error(sr, 0, ERRSRV, ERRbaduid); 684 smbsr_cleanup(sr); 685 goto report_error; 686 } 687 688 sr->user_cr = smb_user_getcred(sr->uid_user); 689 690 if (!(sdd->sdt_flags & SDDF_SUPPRESS_TID) && 691 (sr->tid_tree == NULL)) { 692 sr->tid_tree = smb_user_lookup_tree( 693 sr->uid_user, sr->smb_tid); 694 if (sr->tid_tree == NULL) { 695 smbsr_error(sr, 0, ERRSRV, ERRinvnid); 696 smbsr_cleanup(sr); 697 goto report_error; 698 } 699 } 700 } 701 702 /* 703 * If the command is not a read raw request we can set the 704 * state of the session back to SMB_SESSION_STATE_NEGOTIATED 705 * (if the current state is SMB_SESSION_STATE_OPLOCK_BREAKING). 706 * Otherwise we let the read raw handler to deal with it. 707 */ 708 smb_rwx_rwenter(&session->s_lock, RW_READER); 709 if ((session->s_state == SMB_SESSION_STATE_OPLOCK_BREAKING) && 710 (sr->smb_com != SMB_COM_READ_RAW)) { 711 (void) smb_rwx_rwupgrade(&session->s_lock); 712 if (session->s_state == SMB_SESSION_STATE_OPLOCK_BREAKING) 713 session->s_state = SMB_SESSION_STATE_NEGOTIATED; 714 } 715 smb_rwx_rwexit(&session->s_lock); 716 717 sr->sr_time_start = gethrtime(); 718 if ((sdrc = (*sdd->sdt_pre_op)(sr)) == SDRC_SUCCESS) 719 sdrc = (*sdd->sdt_function)(sr); 720 721 if (sdrc != SDRC_SR_KEPT) { 722 (*sdd->sdt_post_op)(sr); 723 smbsr_cleanup(sr); 724 } 725 smb_latency_add_sample(&sdd->sdt_lat, gethrtime() - sr->sr_time_start); 726 727 atomic_add_64(&sdd->sdt_txb, 728 (int64_t)(sr->reply.chain_offset - sr->sr_txb)); 729 730 if (sdrc != SDRC_SUCCESS) { 731 /* 732 * Handle errors from raw write. 733 */ 734 smb_rwx_rwenter(&session->s_lock, RW_WRITER); 735 if (session->s_state == SMB_SESSION_STATE_WRITE_RAW_ACTIVE) { 736 /* 737 * Set state so that the netbios session 738 * daemon will start accepting data again. 739 */ 740 session->s_write_raw_status = 0; 741 session->s_state = SMB_SESSION_STATE_NEGOTIATED; 742 } 743 smb_rwx_rwexit(&session->s_lock); 744 } 745 746 switch (sdrc) { 747 case SDRC_SUCCESS: 748 break; 749 750 case SDRC_DROP_VC: 751 disconnect = B_TRUE; 752 goto drop_connection; 753 754 case SDRC_NO_REPLY: 755 return (B_TRUE); 756 757 case SDRC_SR_KEPT: 758 return (B_FALSE); 759 760 case SDRC_ERROR: 761 goto report_error; 762 763 case SDRC_NOT_IMPLEMENTED: 764 default: 765 smbsr_error(sr, 0, ERRDOS, ERRbadfunc); 766 goto report_error; 767 } 768 769 /* 770 * If there's no AndX command, we're done. 771 */ 772 if (sr->andx_com == 0xff) 773 goto reply_ready; 774 775 /* 776 * Otherwise, we have to back-patch the AndXCommand and AndXOffset 777 * and continue processing. 778 */ 779 sr->andx_prev_wct = sr->cur_reply_offset; 780 (void) smb_mbc_poke(&sr->reply, sr->andx_prev_wct + 1, "b.w", 781 sr->andx_com, MBC_LENGTH(&sr->reply)); 782 783 sr->command.chain_offset = sr->orig_request_hdr + sr->andx_off; 784 sr->smb_com = sr->andx_com; 785 goto andx_more; 786 787 report_error: 788 sr->reply.chain_offset = sr->cur_reply_offset; 789 (void) smb_mbc_encodef(&sr->reply, "bw", 0, 0); 790 791 sr->smb_wct = 0; 792 sr->smb_bcc = 0; 793 794 if (sr->smb_rcls == 0 && sr->smb_reh == 0 && sr->smb_err == 0) 795 smbsr_error(sr, 0, ERRSRV, ERRerror); 796 797 reply_ready: 798 smbsr_send_reply(sr); 799 800 drop_connection: 801 if (disconnect) { 802 smb_rwx_rwenter(&session->s_lock, RW_WRITER); 803 switch (session->s_state) { 804 case SMB_SESSION_STATE_DISCONNECTED: 805 case SMB_SESSION_STATE_TERMINATED: 806 break; 807 default: 808 smb_soshutdown(session->sock); 809 session->s_state = SMB_SESSION_STATE_DISCONNECTED; 810 break; 811 } 812 smb_rwx_rwexit(&session->s_lock); 813 } 814 815 return (B_TRUE); 816 } 817 818 int 819 smbsr_encode_empty_result(struct smb_request *sr) 820 { 821 return (smbsr_encode_result(sr, 0, 0, "bw", 0, 0)); 822 } 823 824 int 825 smbsr_encode_result(struct smb_request *sr, int wct, int bcc, char *fmt, ...) 826 { 827 va_list ap; 828 829 if (MBC_LENGTH(&sr->reply) != sr->cur_reply_offset) 830 return (-1); 831 832 va_start(ap, fmt); 833 (void) smb_mbc_vencodef(&sr->reply, fmt, ap); 834 va_end(ap); 835 836 sr->smb_wct = (unsigned char)wct; 837 sr->smb_bcc = (uint16_t)bcc; 838 839 if (smbsr_check_result(sr, wct, bcc) != 0) 840 return (-1); 841 842 return (0); 843 } 844 845 static int 846 smbsr_check_result(struct smb_request *sr, int wct, int bcc) 847 { 848 int offset = sr->cur_reply_offset; 849 int total_bytes; 850 unsigned char temp, temp1; 851 struct mbuf *m; 852 853 total_bytes = 0; 854 m = sr->reply.chain; 855 while (m != 0) { 856 total_bytes += m->m_len; 857 m = m->m_next; 858 } 859 860 if ((offset + 3) > total_bytes) 861 return (-1); 862 863 (void) smb_mbc_peek(&sr->reply, offset, "b", &temp); 864 if (temp != wct) 865 return (-1); 866 867 if ((offset + (wct * 2 + 1)) > total_bytes) 868 return (-1); 869 870 /* reply wct & vwv seem ok, consider data now */ 871 offset += wct * 2 + 1; 872 873 if ((offset + 2) > total_bytes) 874 return (-1); 875 876 (void) smb_mbc_peek(&sr->reply, offset, "bb", &temp, &temp1); 877 if (bcc == VAR_BCC) { 878 if ((temp != 0xFF) || (temp1 != 0xFF)) { 879 return (-1); 880 } else { 881 bcc = (total_bytes - offset) - 2; 882 (void) smb_mbc_poke(&sr->reply, offset, "bb", 883 bcc, bcc >> 8); 884 } 885 } else { 886 if ((temp != (bcc&0xFF)) || (temp1 != ((bcc>>8)&0xFF))) 887 return (-1); 888 } 889 890 offset += bcc + 2; 891 892 if (offset != total_bytes) 893 return (-1); 894 895 sr->smb_wct = (unsigned char)wct; 896 sr->smb_bcc = (uint16_t)bcc; 897 return (0); 898 } 899 900 int 901 smbsr_decode_vwv(struct smb_request *sr, char *fmt, ...) 902 { 903 int rc; 904 va_list ap; 905 906 va_start(ap, fmt); 907 rc = smb_mbc_vdecodef(&sr->smb_vwv, fmt, ap); 908 va_end(ap); 909 910 if (rc) 911 smbsr_error(sr, 0, ERRSRV, ERRerror); 912 return (rc); 913 } 914 915 int 916 smbsr_decode_data(struct smb_request *sr, char *fmt, ...) 917 { 918 int rc; 919 va_list ap; 920 921 va_start(ap, fmt); 922 rc = smb_mbc_vdecodef(&sr->smb_data, fmt, ap); 923 va_end(ap); 924 925 if (rc) 926 smbsr_error(sr, 0, ERRSRV, ERRerror); 927 return (rc); 928 } 929 930 boolean_t 931 smbsr_decode_data_avail(smb_request_t *sr) 932 { 933 return (sr->smb_data.chain_offset < sr->smb_data.max_bytes); 934 } 935 936 void 937 smbsr_send_reply(smb_request_t *sr) 938 { 939 if (SMB_TREE_IS_CASEINSENSITIVE(sr)) 940 sr->smb_flg |= SMB_FLAGS_CASE_INSENSITIVE; 941 else 942 sr->smb_flg &= ~SMB_FLAGS_CASE_INSENSITIVE; 943 944 (void) smb_mbc_poke(&sr->reply, 0, SMB_HEADER_ED_FMT, 945 sr->first_smb_com, 946 sr->smb_rcls, 947 sr->smb_reh, 948 sr->smb_err, 949 sr->smb_flg | SMB_FLAGS_REPLY, 950 sr->smb_flg2, 951 sr->smb_pid_high, 952 sr->smb_sig, 953 sr->smb_tid, 954 sr->smb_pid, 955 sr->smb_uid, 956 sr->smb_mid); 957 958 if (sr->session->signing.flags & SMB_SIGNING_ENABLED) 959 smb_sign_reply(sr, NULL); 960 961 smb_server_inc_req(sr->session->s_server); 962 if (smb_session_send(sr->session, 0, &sr->reply) == 0) 963 sr->reply.chain = 0; 964 } 965 966 /* 967 * Map errno values to SMB and NT status values. 968 * Note: ESRCH is a special case to handle a streams lookup failure. 969 */ 970 static struct { 971 int errnum; 972 int errcls; 973 int errcode; 974 DWORD status32; 975 } smb_errno_map[] = { 976 { ENOSPC, ERRDOS, ERROR_DISK_FULL, NT_STATUS_DISK_FULL }, 977 { EDQUOT, ERRDOS, ERROR_DISK_FULL, NT_STATUS_DISK_FULL }, 978 { EPERM, ERRSRV, ERRaccess, NT_STATUS_ACCESS_DENIED }, 979 { ENOTDIR, ERRDOS, ERRbadpath, NT_STATUS_OBJECT_PATH_NOT_FOUND }, 980 { EISDIR, ERRDOS, ERRbadpath, NT_STATUS_FILE_IS_A_DIRECTORY }, 981 { ENOENT, ERRDOS, ERRbadfile, NT_STATUS_NO_SUCH_FILE }, 982 { ENOTEMPTY, ERRDOS, ERROR_DIR_NOT_EMPTY, 983 NT_STATUS_DIRECTORY_NOT_EMPTY }, 984 { EILSEQ, ERRDOS, ERROR_INVALID_NAME, 985 NT_STATUS_OBJECT_NAME_INVALID }, 986 { EACCES, ERRDOS, ERRnoaccess, NT_STATUS_ACCESS_DENIED }, 987 { ENOMEM, ERRDOS, ERRnomem, NT_STATUS_NO_MEMORY }, 988 { EIO, ERRHRD, ERRgeneral, NT_STATUS_IO_DEVICE_ERROR }, 989 { EXDEV, ERRSRV, ERRdiffdevice, NT_STATUS_NOT_SAME_DEVICE }, 990 { EREMOTE, ERRSRV, ERRbadpath, NT_STATUS_PATH_NOT_COVERED}, 991 { EROFS, ERRHRD, ERRnowrite, NT_STATUS_ACCESS_DENIED }, 992 { ESTALE, ERRDOS, ERRbadfid, NT_STATUS_INVALID_HANDLE }, 993 { EBADF, ERRDOS, ERRbadfid, NT_STATUS_INVALID_HANDLE }, 994 { EEXIST, ERRDOS, ERRfilexists, NT_STATUS_OBJECT_NAME_COLLISION }, 995 { ENXIO, ERRSRV, ERRinvdevice, NT_STATUS_BAD_DEVICE_TYPE }, 996 { ESRCH, ERRDOS, ERROR_FILE_NOT_FOUND, 997 NT_STATUS_OBJECT_NAME_NOT_FOUND }, 998 /* 999 * It's not clear why smb_read_common effectively returns 1000 * ERRnoaccess if a range lock prevents access and smb_write_common 1001 * effectively returns ERRaccess. This table entry is used by 1002 * smb_read_common and preserves the behavior that was there before. 1003 */ 1004 { ERANGE, ERRDOS, ERRnoaccess, NT_STATUS_FILE_LOCK_CONFLICT } 1005 }; 1006 1007 void 1008 smbsr_map_errno(int errnum, smb_error_t *err) 1009 { 1010 int i; 1011 1012 for (i = 0; i < sizeof (smb_errno_map)/sizeof (smb_errno_map[0]); ++i) { 1013 if (smb_errno_map[i].errnum == errnum) { 1014 err->status = smb_errno_map[i].status32; 1015 err->errcls = smb_errno_map[i].errcls; 1016 err->errcode = smb_errno_map[i].errcode; 1017 return; 1018 } 1019 } 1020 1021 err->status = NT_STATUS_INTERNAL_ERROR; 1022 err->errcls = ERRDOS; 1023 err->errcode = ERROR_INTERNAL_ERROR; 1024 } 1025 1026 void 1027 smbsr_errno(struct smb_request *sr, int errnum) 1028 { 1029 smbsr_map_errno(errnum, &sr->smb_error); 1030 smbsr_set_error(sr, &sr->smb_error); 1031 } 1032 1033 /* 1034 * Report a request processing status (error or warning). 1035 */ 1036 void 1037 smbsr_status(smb_request_t *sr, DWORD status, uint16_t errcls, uint16_t errcode) 1038 { 1039 sr->smb_error.status = status; 1040 sr->smb_error.errcls = errcls; 1041 sr->smb_error.errcode = errcode; 1042 1043 smbsr_set_error(sr, &sr->smb_error); 1044 } 1045 1046 /* 1047 * Setup a request processing error. This function can be used to 1048 * report 32-bit status codes or DOS errors. Set the status code 1049 * to 0 (NT_STATUS_SUCCESS) to explicitly report a DOS error, 1050 * regardless of the client capabilities. 1051 * 1052 * If status is non-zero and the client supports 32-bit status 1053 * codes, report the status. Otherwise, report the DOS error. 1054 */ 1055 void 1056 smbsr_set_error(smb_request_t *sr, smb_error_t *err) 1057 { 1058 uint32_t status; 1059 uint32_t capabilities; 1060 1061 ASSERT(sr); 1062 ASSERT(err); 1063 1064 status = err->status; 1065 capabilities = sr->session->capabilities; 1066 1067 if ((err->errcls == 0) && (err->errcode == 0)) { 1068 capabilities |= CAP_STATUS32; 1069 if (status == 0) 1070 status = NT_STATUS_INTERNAL_ERROR; 1071 } 1072 1073 if ((capabilities & CAP_STATUS32) && (status != 0)) { 1074 sr->smb_rcls = status & 0xff; 1075 sr->smb_reh = (status >> 8) & 0xff; 1076 sr->smb_err = status >> 16; 1077 sr->smb_flg2 |= SMB_FLAGS2_NT_STATUS; 1078 } else { 1079 if ((err->errcls == 0) || (err->errcode == 0)) { 1080 sr->smb_rcls = ERRSRV; 1081 sr->smb_err = ERRerror; 1082 } else { 1083 sr->smb_rcls = (uint8_t)err->errcls; 1084 sr->smb_err = (uint16_t)err->errcode; 1085 } 1086 } 1087 } 1088 1089 smb_xa_t * 1090 smbsr_lookup_xa(smb_request_t *sr) 1091 { 1092 ASSERT(sr->r_xa == 0); 1093 1094 sr->r_xa = smb_xa_find(sr->session, sr->smb_pid, sr->smb_mid); 1095 return (sr->r_xa); 1096 } 1097 1098 void 1099 smbsr_release_file(smb_request_t *sr) 1100 { 1101 smb_ofile_t *of = sr->fid_ofile; 1102 1103 sr->fid_ofile = NULL; 1104 (void) smb_ofile_release(of); 1105 } 1106 1107 void 1108 smbsr_lookup_file(smb_request_t *sr) 1109 { 1110 if (sr->fid_ofile == NULL) 1111 sr->fid_ofile = smb_ofile_lookup_by_fid(sr->tid_tree, 1112 sr->smb_fid); 1113 } 1114 1115 static int 1116 is_andx_com(unsigned char com) 1117 { 1118 switch (com) { 1119 case SMB_COM_LOCKING_ANDX: 1120 case SMB_COM_OPEN_ANDX: 1121 case SMB_COM_READ_ANDX: 1122 case SMB_COM_WRITE_ANDX: 1123 case SMB_COM_SESSION_SETUP_ANDX: 1124 case SMB_COM_LOGOFF_ANDX: 1125 case SMB_COM_TREE_CONNECT_ANDX: 1126 case SMB_COM_NT_CREATE_ANDX: 1127 return (1); 1128 } 1129 return (0); 1130 } 1131 1132 /* 1133 * Invalid command stubs. 1134 * 1135 * SmbWriteComplete is sent to acknowledge completion of raw write requests. 1136 * We never send raw write commands to other servers so, if we receive 1137 * SmbWriteComplete, we treat it as an error. 1138 * 1139 * The Read/Write Block Multiplexed (mpx) protocol is used to maximize 1140 * performance when reading/writing a large block of data: it can be 1141 * used in parallel with other client/server operations. The mpx sub- 1142 * protocol is not supported because we support only connection oriented 1143 * transports and NT supports mpx only over connectionless transports. 1144 */ 1145 smb_sdrc_t 1146 smb_pre_invalid(smb_request_t *sr) 1147 { 1148 DTRACE_SMB_1(op__Invalid__start, smb_request_t *, sr); 1149 return (SDRC_SUCCESS); 1150 } 1151 1152 void 1153 smb_post_invalid(smb_request_t *sr) 1154 { 1155 DTRACE_SMB_1(op__Invalid__done, smb_request_t *, sr); 1156 } 1157 1158 smb_sdrc_t 1159 smb_com_invalid(smb_request_t *sr) 1160 { 1161 smb_sdrc_t sdrc; 1162 1163 switch (sr->smb_com) { 1164 case SMB_COM_WRITE_COMPLETE: 1165 smbsr_error(sr, 0, ERRSRV, ERRerror); 1166 sdrc = SDRC_ERROR; 1167 break; 1168 1169 default: 1170 smbsr_error(sr, NT_STATUS_NOT_IMPLEMENTED, 1171 ERRDOS, ERROR_INVALID_FUNCTION); 1172 sdrc = SDRC_NOT_IMPLEMENTED; 1173 break; 1174 } 1175 1176 return (sdrc); 1177 } 1178 1179 /* 1180 * smb_dispatch_stats_init 1181 * 1182 * Initializes dispatch statistics. 1183 */ 1184 void 1185 smb_dispatch_stats_init(smb_kstat_req_t *ksr) 1186 { 1187 kstat_named_t *ksn; 1188 int ks_ndata; 1189 int i; 1190 1191 for (i = 0; i < SMB_COM_NUM; i++, ksr++) { 1192 smb_latency_init(&smb_disp_table[i].sdt_lat); 1193 (void) strlcpy(ksr->kr_name, smb_disp_table[i].sdt_name, 1194 sizeof (ksr->kr_name)); 1195 } 1196 /* Legacy Statistics */ 1197 for (i = 0, ks_ndata = 0; i < SMB_COM_NUM; i++) { 1198 if (smb_disp_table[i].sdt_function != smb_com_invalid) 1199 ks_ndata++; 1200 } 1201 1202 smb_legacy_dispatch_ksp = kstat_create(SMBSRV_KSTAT_MODULE, 0, 1203 SMBSRV_KSTAT_NAME_CMDS, SMBSRV_KSTAT_CLASS, 1204 KSTAT_TYPE_NAMED, ks_ndata, 0); 1205 1206 if (smb_legacy_dispatch_ksp != NULL) { 1207 ksn = smb_legacy_dispatch_ksp->ks_data; 1208 1209 for (i = 0, ks_ndata = 0; i < SMB_COM_NUM; i++) { 1210 if (smb_disp_table[i].sdt_function != smb_com_invalid) { 1211 (void) strlcpy(ksn->name, 1212 smb_disp_table[i].sdt_name, 1213 sizeof (ksn->name)); 1214 ksn->data_type = KSTAT_DATA_UINT64; 1215 ++ksn; 1216 } 1217 } 1218 mutex_init(&smb_legacy_dispatch_ksmtx, NULL, 1219 MUTEX_DEFAULT, NULL); 1220 smb_legacy_dispatch_ksp->ks_update = 1221 smb_legacy_dispatch_stats_update; 1222 smb_legacy_dispatch_ksp->ks_lock = &smb_legacy_dispatch_ksmtx; 1223 kstat_install(smb_legacy_dispatch_ksp); 1224 } 1225 } 1226 1227 /* 1228 * smb_dispatch_stats_fini 1229 * 1230 * Frees and destroyes the resources used for statistics. 1231 */ 1232 void 1233 smb_dispatch_stats_fini(void) 1234 { 1235 int i; 1236 1237 if (smb_legacy_dispatch_ksp != NULL) { 1238 kstat_delete(smb_legacy_dispatch_ksp); 1239 mutex_destroy(&smb_legacy_dispatch_ksmtx); 1240 smb_legacy_dispatch_ksp = NULL; 1241 } 1242 1243 for (i = 0; i < SMB_COM_NUM; i++) 1244 smb_latency_destroy(&smb_disp_table[i].sdt_lat); 1245 } 1246 1247 void 1248 smb_dispatch_stats_update(smb_kstat_req_t *ksr, int first, int nreq) 1249 { 1250 int i; 1251 int last; 1252 1253 last = first + nreq - 1; 1254 1255 if ((first < SMB_COM_NUM) && (last < SMB_COM_NUM)) { 1256 for (i = first; i <= last; i++, ksr++) { 1257 ksr->kr_rxb = smb_disp_table[i].sdt_rxb; 1258 ksr->kr_txb = smb_disp_table[i].sdt_txb; 1259 mutex_enter(&smb_disp_table[i].sdt_lat.ly_mutex); 1260 ksr->kr_nreq = smb_disp_table[i].sdt_lat.ly_a_nreq; 1261 ksr->kr_sum = smb_disp_table[i].sdt_lat.ly_a_sum; 1262 ksr->kr_a_mean = smb_disp_table[i].sdt_lat.ly_a_mean; 1263 ksr->kr_a_stddev = 1264 smb_disp_table[i].sdt_lat.ly_a_stddev; 1265 ksr->kr_d_mean = smb_disp_table[i].sdt_lat.ly_d_mean; 1266 ksr->kr_d_stddev = 1267 smb_disp_table[i].sdt_lat.ly_d_stddev; 1268 smb_disp_table[i].sdt_lat.ly_d_mean = 0; 1269 smb_disp_table[i].sdt_lat.ly_d_nreq = 0; 1270 smb_disp_table[i].sdt_lat.ly_d_stddev = 0; 1271 smb_disp_table[i].sdt_lat.ly_d_sum = 0; 1272 mutex_exit(&smb_disp_table[i].sdt_lat.ly_mutex); 1273 } 1274 } 1275 } 1276 1277 /* 1278 * smb_legacy_dispatch_stats_update 1279 * 1280 * This callback function updates the smb_legacy_dispatch_kstat_data when kstat 1281 * command is invoked. 1282 */ 1283 static int 1284 smb_legacy_dispatch_stats_update(kstat_t *ksp, int rw) 1285 { 1286 kstat_named_t *ksn; 1287 int i; 1288 1289 ASSERT(MUTEX_HELD(ksp->ks_lock)); 1290 1291 switch (rw) { 1292 case KSTAT_WRITE: 1293 return (EACCES); 1294 1295 case KSTAT_READ: 1296 ksn = ksp->ks_data; 1297 for (i = 0; i < SMB_COM_NUM; i++) { 1298 if (smb_disp_table[i].sdt_function != smb_com_invalid) { 1299 ksn->value.ui64 = 1300 smb_disp_table[i].sdt_lat.ly_a_nreq; 1301 ++ksn; 1302 } 1303 } 1304 return (0); 1305 1306 default: 1307 return (EIO); 1308 } 1309 } 1310