xref: /titanic_52/usr/src/uts/common/fs/smbsrv/smb_fsops.c (revision a9da3307db733eb1739ba859952610bba3d894ab)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #pragma ident	"%Z%%M%	%I%	%E% SMI"
27 
28 #include <sys/sid.h>
29 #include <sys/nbmlock.h>
30 #include <smbsrv/smb_fsops.h>
31 #include <smbsrv/smb_kproto.h>
32 #include <smbsrv/ntstatus.h>
33 #include <smbsrv/ntaccess.h>
34 #include <smbsrv/smb_incl.h>
35 #include <acl/acl_common.h>
36 #include <sys/fcntl.h>
37 #include <sys/flock.h>
38 #include <fs/fs_subr.h>
39 
40 extern caller_context_t smb_ct;
41 
42 extern int smb_fem_oplock_install(smb_node_t *);
43 extern void smb_fem_oplock_uninstall(smb_node_t *);
44 
45 extern int smb_vop_other_opens(vnode_t *, int);
46 
47 static int smb_fsop_sdinherit(smb_request_t *sr, smb_node_t *dnode,
48     smb_fssd_t *fs_sd);
49 
50 /*
51  * The smb_fsop_* functions have knowledge of CIFS semantics.
52  *
53  * The smb_vop_* functions have minimal knowledge of CIFS semantics and
54  * serve as an interface to the VFS layer.
55  *
56  * Hence, smb_request_t and smb_node_t structures should not be passed
57  * from the smb_fsop_* layer to the smb_vop_* layer.
58  *
59  * In general, CIFS service code should only ever call smb_fsop_*
60  * functions directly, and never smb_vop_* functions directly.
61  *
62  * smb_fsop_* functions should call smb_vop_* functions where possible, instead
63  * of their smb_fsop_* counterparts.  However, there are times when
64  * this cannot be avoided.
65  */
66 
67 /*
68  * Note: Stream names cannot be mangled.
69  */
70 
71 /*
72  * smb_fsop_amask_to_omode
73  *
74  * Convert the access mask to the open mode (for use
75  * with the VOP_OPEN call).
76  *
77  * Note that opening a file for attribute only access
78  * will also translate into an FREAD or FWRITE open mode
79  * (i.e., it's not just for data).
80  *
81  * This is needed so that opens are tracked appropriately
82  * for oplock processing.
83  */
84 
85 int
86 smb_fsop_amask_to_omode(uint32_t access)
87 {
88 	int mode = 0;
89 
90 	if (access & (FILE_READ_DATA | FILE_EXECUTE |
91 	    FILE_READ_ATTRIBUTES | FILE_READ_EA))
92 		mode |= FREAD;
93 
94 	if (access & (FILE_WRITE_DATA | FILE_APPEND_DATA |
95 	    FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA))
96 		mode |= FWRITE;
97 
98 	if (access & FILE_APPEND_DATA)
99 		mode |= FAPPEND;
100 
101 	return (mode);
102 }
103 
104 int
105 smb_fsop_open(smb_node_t *node, int mode, cred_t *cred)
106 {
107 	/*
108 	 * Assuming that the same vnode is returned as we had before.
109 	 * (I.e., with certain types of files or file systems, a
110 	 * different vnode might be returned by VOP_OPEN)
111 	 */
112 	return (smb_vop_open(&node->vp, mode, cred));
113 }
114 
115 int
116 smb_fsop_close(smb_node_t *node, int mode, cred_t *cred)
117 {
118 	return (smb_vop_close(node->vp, mode, cred));
119 }
120 
121 int
122 smb_fsop_oplock_install(smb_node_t *node, int mode)
123 {
124 	int rc;
125 
126 	if (smb_vop_other_opens(node->vp, mode))
127 		return (EMFILE);
128 
129 	if ((rc = smb_fem_oplock_install(node)))
130 		return (rc);
131 
132 	if (smb_vop_other_opens(node->vp, mode)) {
133 		(void) smb_fem_oplock_uninstall(node);
134 		return (EMFILE);
135 	}
136 
137 	return (0);
138 }
139 
140 void
141 smb_fsop_oplock_uninstall(smb_node_t *node)
142 {
143 	smb_fem_oplock_uninstall(node);
144 }
145 
146 static int
147 smb_fsop_create_with_sd(
148 	smb_request_t *sr,
149 	cred_t *cr,
150 	smb_node_t *snode,
151 	char *name,
152 	smb_attr_t *attr,
153 	smb_node_t **ret_snode,
154 	smb_attr_t *ret_attr,
155 	smb_fssd_t *fs_sd)
156 {
157 	vsecattr_t *vsap;
158 	vsecattr_t vsecattr;
159 	acl_t *acl, *dacl, *sacl;
160 	smb_attr_t set_attr;
161 	vnode_t *vp;
162 	int aclbsize = 0;	/* size of acl list in bytes */
163 	int flags = 0;
164 	int is_dir;
165 	int rc;
166 	boolean_t no_xvattr = B_FALSE;
167 
168 	ASSERT(fs_sd);
169 
170 	if (SMB_TREE_CASE_INSENSITIVE(sr))
171 		flags = SMB_IGNORE_CASE;
172 
173 	ASSERT(cr);
174 
175 	is_dir = ((fs_sd->sd_flags & SMB_FSSD_FLAGS_DIR) != 0);
176 
177 	if (sr->tid_tree->t_flags & SMB_TREE_FLAG_ACLONCREATE) {
178 		if (fs_sd->sd_secinfo & SMB_ACL_SECINFO) {
179 			dacl = fs_sd->sd_zdacl;
180 			sacl = fs_sd->sd_zsacl;
181 			ASSERT(dacl || sacl);
182 			if (dacl && sacl) {
183 				acl = smb_fsacl_merge(dacl, sacl);
184 			} else if (dacl) {
185 				acl = dacl;
186 			} else {
187 				acl = sacl;
188 			}
189 
190 			rc = smb_fsacl_to_vsa(acl, &vsecattr, &aclbsize);
191 
192 			if (dacl && sacl)
193 				acl_free(acl);
194 
195 			if (rc)
196 				return (rc);
197 
198 			vsap = &vsecattr;
199 		}
200 		else
201 			vsap = NULL;
202 
203 		if (is_dir) {
204 			rc = smb_vop_mkdir(snode->vp, name, attr, &vp, flags,
205 			    cr, vsap);
206 		} else {
207 			rc = smb_vop_create(snode->vp, name, attr, &vp, flags,
208 			    cr, vsap);
209 		}
210 
211 		if (vsap != NULL)
212 			kmem_free(vsap->vsa_aclentp, aclbsize);
213 
214 		if (rc != 0)
215 			return (rc);
216 
217 		set_attr.sa_mask = 0;
218 
219 		/*
220 		 * Ideally we should be able to specify the owner and owning
221 		 * group at create time along with the ACL. Since we cannot
222 		 * do that right now, kcred is passed to smb_vop_setattr so it
223 		 * doesn't fail due to lack of permission.
224 		 */
225 		if (fs_sd->sd_secinfo & SMB_OWNER_SECINFO) {
226 			set_attr.sa_vattr.va_uid = fs_sd->sd_uid;
227 			set_attr.sa_mask |= SMB_AT_UID;
228 		}
229 
230 		if (fs_sd->sd_secinfo & SMB_GROUP_SECINFO) {
231 			set_attr.sa_vattr.va_gid = fs_sd->sd_gid;
232 			set_attr.sa_mask |= SMB_AT_GID;
233 		}
234 
235 		if (set_attr.sa_mask) {
236 			if (sr && sr->tid_tree)
237 				if (sr->tid_tree->t_flags & SMB_TREE_FLAG_UFS)
238 					no_xvattr = B_TRUE;
239 			rc = smb_vop_setattr(snode->vp, NULL, &set_attr,
240 			    0, kcred, no_xvattr);
241 		}
242 
243 	} else {
244 		/*
245 		 * For filesystems that don't support ACL-on-create, try
246 		 * to set the specified SD after create, which could actually
247 		 * fail because of conflicts between inherited security
248 		 * attributes upon creation and the specified SD.
249 		 *
250 		 * Passing kcred to smb_fsop_sdwrite() to overcome this issue.
251 		 */
252 
253 		if (is_dir) {
254 			rc = smb_vop_mkdir(snode->vp, name, attr, &vp, flags,
255 			    cr, NULL);
256 		} else {
257 			rc = smb_vop_create(snode->vp, name, attr, &vp, flags,
258 			    cr, NULL);
259 		}
260 
261 		if (rc != 0)
262 			return (rc);
263 
264 		if ((sr->tid_tree->t_flags & SMB_TREE_FLAG_NFS_MOUNTED) == 0)
265 			rc = smb_fsop_sdwrite(sr, kcred, snode, fs_sd, 1);
266 	}
267 
268 	if (rc == 0) {
269 		*ret_snode = smb_node_lookup(sr, &sr->arg.open, cr, vp, name,
270 		    snode, NULL, ret_attr);
271 
272 		if (*ret_snode == NULL) {
273 			VN_RELE(vp);
274 			rc = ENOMEM;
275 		}
276 	}
277 
278 	if (rc != 0) {
279 		if (is_dir) {
280 			(void) smb_vop_rmdir(snode->vp, name, flags, cr);
281 		} else {
282 			(void) smb_vop_remove(snode->vp, name, flags, cr);
283 		}
284 	}
285 
286 	return (rc);
287 }
288 
289 /*
290  * smb_fsop_create
291  *
292  * All SMB functions should use this wrapper to ensure that
293  * all the smb_vop_creates are performed with the appropriate credentials.
294  * Please document any direct calls to explain the reason
295  * for avoiding this wrapper.
296  *
297  * It is assumed that a reference exists on snode coming into this routine.
298  *
299  * *ret_snode is returned with a reference upon success.  No reference is
300  * taken if an error is returned.
301  */
302 
303 int
304 smb_fsop_create(
305     smb_request_t	*sr,
306     cred_t		*cr,
307     smb_node_t		*dir_snode,
308     char		*name,
309     smb_attr_t		*attr,
310     smb_node_t		**ret_snode,
311     smb_attr_t		*ret_attr)
312 {
313 	struct open_param *op = &sr->arg.open;
314 	boolean_t	no_xvattr = B_FALSE;
315 	smb_node_t	*fnode;
316 	smb_attr_t	file_attr;
317 	vnode_t		*xattrdirvp;
318 	vnode_t		*vp;
319 	char		*longname = NULL;
320 	char		*namep;
321 	char		*fname;
322 	char		*sname;
323 	int		is_stream;
324 	int		flags = 0;
325 	int		rc = 0;
326 	smb_fssd_t	fs_sd;
327 	uint32_t	secinfo;
328 	uint32_t	status;
329 
330 	ASSERT(cr);
331 	ASSERT(dir_snode);
332 	ASSERT(dir_snode->n_magic == SMB_NODE_MAGIC);
333 	ASSERT(dir_snode->n_state != SMB_NODE_STATE_DESTROYING);
334 
335 	ASSERT(ret_snode);
336 	*ret_snode = 0;
337 
338 	ASSERT(name);
339 	if (*name == 0)
340 		return (EINVAL);
341 
342 	if (SMB_TREE_ROOT_FS(sr, dir_snode) == 0)
343 		return (EACCES);
344 
345 	ASSERT(sr);
346 	ASSERT(sr->tid_tree);
347 	if (SMB_TREE_IS_READ_ONLY(sr))
348 		return (EROFS);
349 
350 	if (SMB_TREE_CASE_INSENSITIVE(sr))
351 		flags = SMB_IGNORE_CASE;
352 
353 	fname = kmem_alloc(MAXNAMELEN, KM_SLEEP);
354 	sname = kmem_alloc(MAXNAMELEN, KM_SLEEP);
355 
356 	is_stream = smb_stream_parse_name(name, fname, sname);
357 
358 	if (is_stream)
359 		namep = fname;
360 	else
361 		namep = name;
362 
363 	if (smb_maybe_mangled_name(namep)) {
364 		longname = kmem_alloc(MAXNAMELEN, KM_SLEEP);
365 
366 		rc = smb_unmangle_name(sr, cr, dir_snode, namep, longname,
367 		    MAXNAMELEN, NULL, NULL, 1);
368 
369 		if ((is_stream == 0) && (rc == 0))
370 			rc = EEXIST;
371 
372 		if ((is_stream && rc) ||
373 		    ((is_stream == 0) && (rc != ENOENT))) {
374 			kmem_free(longname, MAXNAMELEN);
375 			kmem_free(fname, MAXNAMELEN);
376 			kmem_free(sname, MAXNAMELEN);
377 			return (rc);
378 		}
379 
380 		if (is_stream)
381 			namep = longname;
382 		else
383 			kmem_free(longname, MAXNAMELEN);
384 	}
385 
386 	if (is_stream) {
387 		/*
388 		 * Look up the unnamed stream.
389 		 *
390 		 * Mangle processing in smb_fsop_lookup() for the unnamed
391 		 * stream won't be needed (as it was done above), but
392 		 * it may be needed on any link target (which
393 		 * smb_fsop_lookup() will provide).
394 		 */
395 		rc = smb_fsop_lookup(sr, cr, flags | SMB_FOLLOW_LINKS,
396 		    sr->tid_tree->t_snode, dir_snode, namep, &fnode, &file_attr,
397 		    0, 0);
398 
399 		if (longname) {
400 			kmem_free(longname, MAXNAMELEN);
401 			namep = NULL;
402 		}
403 
404 		if (rc != 0) {
405 			kmem_free(fname, MAXNAMELEN);
406 			kmem_free(sname, MAXNAMELEN);
407 			return (rc);
408 		}
409 
410 		rc = smb_vop_stream_create(fnode->vp, sname, attr, &vp,
411 		    &xattrdirvp, flags, cr);
412 
413 		if (rc != 0) {
414 			smb_node_release(fnode);
415 			kmem_free(fname, MAXNAMELEN);
416 			kmem_free(sname, MAXNAMELEN);
417 			return (rc);
418 		}
419 
420 		if (sr && sr->tid_tree)
421 			if (sr->tid_tree->t_flags & SMB_TREE_FLAG_UFS)
422 				no_xvattr = B_TRUE;
423 
424 		attr->sa_vattr.va_uid = file_attr.sa_vattr.va_uid;
425 		attr->sa_vattr.va_gid = file_attr.sa_vattr.va_gid;
426 		attr->sa_mask = SMB_AT_UID | SMB_AT_GID;
427 
428 		/*
429 		 * The second parameter of smb_vop_setattr() is set to
430 		 * NULL, even though an unnamed stream exists.  This is
431 		 * because we want to set the UID and GID on the named
432 		 * stream in this case for consistency with the (unnamed
433 		 * stream) file (see comments for smb_vop_setattr()).
434 		 */
435 
436 		rc = smb_vop_setattr(vp, NULL, attr, 0, kcred, no_xvattr);
437 
438 		if (rc != 0) {
439 			smb_node_release(fnode);
440 			kmem_free(fname, MAXNAMELEN);
441 			kmem_free(sname, MAXNAMELEN);
442 			return (rc);
443 		}
444 
445 		*ret_snode = smb_stream_node_lookup(sr, cr, fnode, xattrdirvp,
446 		    vp, sname, ret_attr);
447 
448 		smb_node_release(fnode);
449 
450 		if (*ret_snode == NULL) {
451 			VN_RELE(xattrdirvp);
452 			VN_RELE(vp);
453 			kmem_free(fname, MAXNAMELEN);
454 			kmem_free(sname, MAXNAMELEN);
455 			return (ENOMEM);
456 		}
457 	} else {
458 		if (op->sd) {
459 			/*
460 			 * SD sent by client in Windows format. Needs to be
461 			 * converted to FS format. No inheritance.
462 			 */
463 			secinfo = smb_sd_get_secinfo(op->sd);
464 			smb_fssd_init(&fs_sd, secinfo, 0);
465 
466 			status = smb_sd_tofs(op->sd, &fs_sd);
467 			if (status == NT_STATUS_SUCCESS) {
468 				rc = smb_fsop_create_with_sd(sr, cr, dir_snode,
469 				    name, attr, ret_snode, ret_attr, &fs_sd);
470 			}
471 			else
472 				rc = EINVAL;
473 			smb_fssd_term(&fs_sd);
474 		} else if (sr->tid_tree->t_acltype == ACE_T) {
475 			/*
476 			 * No incoming SD and filesystem is ZFS
477 			 * Server applies Windows inheritance rules,
478 			 * see smb_fsop_sdinherit() comments as to why.
479 			 */
480 			smb_fssd_init(&fs_sd, SMB_ACL_SECINFO, 0);
481 			rc = smb_fsop_sdinherit(sr, dir_snode, &fs_sd);
482 			if (rc == 0) {
483 				rc = smb_fsop_create_with_sd(sr, cr, dir_snode,
484 				    name, attr, ret_snode, ret_attr, &fs_sd);
485 			}
486 
487 			smb_fssd_term(&fs_sd);
488 		} else {
489 			/*
490 			 * No incoming SD and filesystem is not ZFS
491 			 * let the filesystem handles the inheritance.
492 			 */
493 			rc = smb_vop_create(dir_snode->vp, name, attr, &vp,
494 			    flags, cr, NULL);
495 
496 			if (rc == 0) {
497 				*ret_snode = smb_node_lookup(sr, op, cr, vp,
498 				    name, dir_snode, NULL, ret_attr);
499 
500 				if (*ret_snode == NULL) {
501 					VN_RELE(vp);
502 					rc = ENOMEM;
503 				}
504 			}
505 
506 		}
507 	}
508 
509 	kmem_free(fname, MAXNAMELEN);
510 	kmem_free(sname, MAXNAMELEN);
511 	return (rc);
512 }
513 
514 /*
515  * smb_fsop_mkdir
516  *
517  * All SMB functions should use this wrapper to ensure that
518  * the the calls are performed with the appropriate credentials.
519  * Please document any direct call to explain the reason
520  * for avoiding this wrapper.
521  *
522  * It is assumed that a reference exists on snode coming into this routine.
523  *
524  * *ret_snode is returned with a reference upon success.  No reference is
525  * taken if an error is returned.
526  */
527 int
528 smb_fsop_mkdir(
529     smb_request_t *sr,
530     cred_t *cr,
531     smb_node_t *dir_snode,
532     char *name,
533     smb_attr_t *attr,
534     smb_node_t **ret_snode,
535     smb_attr_t *ret_attr)
536 {
537 	struct open_param *op = &sr->arg.open;
538 	char *longname;
539 	vnode_t *vp;
540 	int flags = 0;
541 	smb_fssd_t fs_sd;
542 	uint32_t secinfo;
543 	uint32_t status;
544 	int rc;
545 	ASSERT(cr);
546 	ASSERT(dir_snode);
547 	ASSERT(dir_snode->n_magic == SMB_NODE_MAGIC);
548 	ASSERT(dir_snode->n_state != SMB_NODE_STATE_DESTROYING);
549 
550 	ASSERT(ret_snode);
551 	*ret_snode = 0;
552 
553 	ASSERT(name);
554 	if (*name == 0)
555 		return (EINVAL);
556 
557 	if (SMB_TREE_ROOT_FS(sr, dir_snode) == 0)
558 		return (EACCES);
559 
560 	ASSERT(sr);
561 	ASSERT(sr->tid_tree);
562 	if (SMB_TREE_IS_READ_ONLY(sr))
563 		return (EROFS);
564 
565 	if (smb_maybe_mangled_name(name)) {
566 		longname = kmem_alloc(MAXNAMELEN, KM_SLEEP);
567 		rc = smb_unmangle_name(sr, cr, dir_snode, name, longname,
568 		    MAXNAMELEN, NULL, NULL, 1);
569 
570 		kmem_free(longname, MAXNAMELEN);
571 
572 		/*
573 		 * If the name passed in by the client has an unmangled
574 		 * equivalent that is found in the specified directory,
575 		 * then the mkdir cannot succeed.  Return EEXIST.
576 		 *
577 		 * Only if ENOENT is returned will a mkdir be attempted.
578 		 */
579 
580 		if (rc == 0)
581 			rc = EEXIST;
582 
583 		if (rc != ENOENT)
584 			return (rc);
585 	}
586 
587 	if (SMB_TREE_CASE_INSENSITIVE(sr))
588 		flags = SMB_IGNORE_CASE;
589 
590 	if (op->sd) {
591 		/*
592 		 * SD sent by client in Windows format. Needs to be
593 		 * converted to FS format. No inheritance.
594 		 */
595 		secinfo = smb_sd_get_secinfo(op->sd);
596 		smb_fssd_init(&fs_sd, secinfo, SMB_FSSD_FLAGS_DIR);
597 
598 		status = smb_sd_tofs(op->sd, &fs_sd);
599 		if (status == NT_STATUS_SUCCESS) {
600 			rc = smb_fsop_create_with_sd(sr, cr, dir_snode,
601 			    name, attr, ret_snode, ret_attr, &fs_sd);
602 		}
603 		else
604 			rc = EINVAL;
605 		smb_fssd_term(&fs_sd);
606 	} else if (sr->tid_tree->t_acltype == ACE_T) {
607 		/*
608 		 * No incoming SD and filesystem is ZFS
609 		 * Server applies Windows inheritance rules,
610 		 * see smb_fsop_sdinherit() comments as to why.
611 		 */
612 		smb_fssd_init(&fs_sd, SMB_ACL_SECINFO, SMB_FSSD_FLAGS_DIR);
613 		rc = smb_fsop_sdinherit(sr, dir_snode, &fs_sd);
614 		if (rc == 0) {
615 			rc = smb_fsop_create_with_sd(sr, cr, dir_snode,
616 			    name, attr, ret_snode, ret_attr, &fs_sd);
617 		}
618 
619 		smb_fssd_term(&fs_sd);
620 
621 	} else {
622 		rc = smb_vop_mkdir(dir_snode->vp, name, attr, &vp, flags, cr,
623 		    NULL);
624 
625 		if (rc == 0) {
626 			*ret_snode = smb_node_lookup(sr, op, cr, vp, name,
627 			    dir_snode, NULL, ret_attr);
628 
629 			if (*ret_snode == NULL) {
630 				VN_RELE(vp);
631 				rc = ENOMEM;
632 			}
633 		}
634 	}
635 
636 	return (rc);
637 }
638 
639 /*
640  * smb_fsop_remove
641  *
642  * All SMB functions should use this wrapper to ensure that
643  * the the calls are performed with the appropriate credentials.
644  * Please document any direct call to explain the reason
645  * for avoiding this wrapper.
646  *
647  * It is assumed that a reference exists on snode coming into this routine.
648  *
649  * od: This means that the name passed in is an on-disk name.
650  * A null smb_request might be passed to this function.
651  */
652 
653 int
654 smb_fsop_remove(
655     smb_request_t	*sr,
656     cred_t		*cr,
657     smb_node_t		*dir_snode,
658     char		*name,
659     int			od)
660 {
661 	smb_node_t	*fnode;
662 	smb_attr_t	file_attr;
663 	char		*longname;
664 	char		*fname;
665 	char		*sname;
666 	int		flags = 0;
667 	int		rc;
668 
669 	ASSERT(cr);
670 	/*
671 	 * The state of the node could be SMB_NODE_STATE_DESTROYING if this
672 	 * function is called during the deletion of the node (because of
673 	 * DELETE_ON_CLOSE).
674 	 */
675 	ASSERT(dir_snode);
676 	ASSERT(dir_snode->n_magic == SMB_NODE_MAGIC);
677 
678 	if (SMB_TREE_ROOT_FS(sr, dir_snode) == 0)
679 		return (EACCES);
680 
681 	if (SMB_TREE_IS_READ_ONLY(sr))
682 		return (EROFS);
683 
684 	fname = kmem_alloc(MAXNAMELEN, KM_SLEEP);
685 	sname = kmem_alloc(MAXNAMELEN, KM_SLEEP);
686 
687 	/*
688 	 * If the passed-in name is an on-disk name,
689 	 * then we need to do a case-sensitive remove.
690 	 * This is important if the on-disk name
691 	 * corresponds to a mangled name passed in by
692 	 * the client.  We want to make sure to remove
693 	 * the exact file specified by the client,
694 	 * instead of letting the underlying file system
695 	 * do a remove on the "first match."
696 	 */
697 
698 	if ((od == 0) && SMB_TREE_CASE_INSENSITIVE(sr))
699 		flags = SMB_IGNORE_CASE;
700 
701 	if (dir_snode->flags & NODE_XATTR_DIR) {
702 		rc = smb_vop_stream_remove(dir_snode->dir_snode->vp,
703 		    name, flags, cr);
704 	} else if (smb_stream_parse_name(name, fname, sname)) {
705 		/*
706 		 * It is assumed that "name" corresponds to the path
707 		 * passed in by the client, and no need of suppressing
708 		 * case-insensitive lookups is needed.
709 		 */
710 
711 		ASSERT(od == 0);
712 
713 		/*
714 		 * Look up the unnamed stream (i.e. fname).
715 		 * Unmangle processing will be done on fname
716 		 * as well as any link target.
717 		 */
718 
719 		rc = smb_fsop_lookup(sr, cr, flags | SMB_FOLLOW_LINKS,
720 		    sr->tid_tree->t_snode, dir_snode, fname, &fnode, &file_attr,
721 		    0, 0);
722 
723 		if (rc != 0) {
724 			kmem_free(fname, MAXNAMELEN);
725 			kmem_free(sname, MAXNAMELEN);
726 			return (rc);
727 		}
728 
729 		/*
730 		 * XXX
731 		 * Need to find out what permission is required by NTFS
732 		 * to remove a stream.
733 		 */
734 		rc = smb_vop_stream_remove(fnode->vp, sname, flags, cr);
735 
736 		smb_node_release(fnode);
737 	} else {
738 		rc = smb_vop_remove(dir_snode->vp, name, flags, cr);
739 
740 		if (rc == ENOENT) {
741 			if (smb_maybe_mangled_name(name) == 0) {
742 				kmem_free(fname, MAXNAMELEN);
743 				kmem_free(sname, MAXNAMELEN);
744 				return (rc);
745 			}
746 			longname = kmem_alloc(MAXNAMELEN, KM_SLEEP);
747 
748 			rc = smb_unmangle_name(sr, cr, dir_snode, name,
749 			    longname, MAXNAMELEN, NULL, NULL, 1);
750 
751 			if (rc == 0) {
752 				/*
753 				 * We passed "1" as the "od" parameter
754 				 * to smb_unmangle_name(), such that longname
755 				 * is the real (case-sensitive) on-disk name.
756 				 * We make sure we do a remove on this exact
757 				 * name, as the name was mangled and denotes
758 				 * a unique file.
759 				 */
760 				flags &= ~SMB_IGNORE_CASE;
761 				rc = smb_vop_remove(dir_snode->vp, longname,
762 				    flags, cr);
763 			}
764 
765 			kmem_free(longname, MAXNAMELEN);
766 		}
767 	}
768 
769 	kmem_free(fname, MAXNAMELEN);
770 	kmem_free(sname, MAXNAMELEN);
771 	return (rc);
772 }
773 
774 /*
775  * smb_fsop_remove_streams
776  *
777  * This function removes a file's streams without removing the
778  * file itself.
779  *
780  * It is assumed that snode is not a link.
781  */
782 int
783 smb_fsop_remove_streams(smb_request_t *sr, cred_t *cr, smb_node_t *fnode)
784 {
785 	struct fs_stream_info stream_info;
786 	uint32_t cookie = 0;
787 	int flags = 0;
788 	int rc;
789 
790 	ASSERT(cr);
791 	ASSERT(fnode);
792 	ASSERT(fnode->n_magic == SMB_NODE_MAGIC);
793 	ASSERT(fnode->n_state != SMB_NODE_STATE_DESTROYING);
794 
795 	if (SMB_TREE_ROOT_FS(sr, fnode) == 0)
796 		return (EACCES);
797 
798 	if (SMB_TREE_IS_READ_ONLY(sr))
799 		return (EROFS);
800 
801 	if (SMB_TREE_CASE_INSENSITIVE(sr))
802 		flags = SMB_IGNORE_CASE;
803 
804 	for (;;) {
805 		rc = smb_vop_stream_readdir(fnode->vp, &cookie, &stream_info,
806 		    NULL, NULL, flags, cr);
807 
808 		if ((rc != 0) || (cookie == SMB_EOF))
809 			break;
810 
811 		(void) smb_vop_stream_remove(fnode->vp, stream_info.name, flags,
812 		    cr);
813 	}
814 	return (rc);
815 }
816 
817 /*
818  * smb_fsop_rmdir
819  *
820  * All SMB functions should use this wrapper to ensure that
821  * the the calls are performed with the appropriate credentials.
822  * Please document any direct call to explain the reason
823  * for avoiding this wrapper.
824  *
825  * It is assumed that a reference exists on snode coming into this routine.
826  *
827  * od: This means that the name passed in is an on-disk name.
828  */
829 
830 int
831 smb_fsop_rmdir(
832     smb_request_t	*sr,
833     cred_t		*cr,
834     smb_node_t		*dir_snode,
835     char		*name,
836     int			od)
837 {
838 	int		rc;
839 	int		flags = 0;
840 	char		*longname;
841 
842 	ASSERT(cr);
843 	/*
844 	 * The state of the node could be SMB_NODE_STATE_DESTROYING if this
845 	 * function is called during the deletion of the node (because of
846 	 * DELETE_ON_CLOSE).
847 	 */
848 	ASSERT(dir_snode);
849 	ASSERT(dir_snode->n_magic == SMB_NODE_MAGIC);
850 
851 	if (SMB_TREE_ROOT_FS(sr, dir_snode) == 0)
852 		return (EACCES);
853 
854 	if (SMB_TREE_IS_READ_ONLY(sr))
855 		return (EROFS);
856 
857 	/*
858 	 * If the passed-in name is an on-disk name,
859 	 * then we need to do a case-sensitive rmdir.
860 	 * This is important if the on-disk name
861 	 * corresponds to a mangled name passed in by
862 	 * the client.  We want to make sure to remove
863 	 * the exact directory specified by the client,
864 	 * instead of letting the underlying file system
865 	 * do a rmdir on the "first match."
866 	 */
867 
868 	if ((od == 0) && SMB_TREE_CASE_INSENSITIVE(sr))
869 		flags = SMB_IGNORE_CASE;
870 
871 	rc = smb_vop_rmdir(dir_snode->vp, name, flags, cr);
872 
873 	if (rc == ENOENT) {
874 		if (smb_maybe_mangled_name(name) == 0)
875 			return (rc);
876 
877 		longname = kmem_alloc(MAXNAMELEN, KM_SLEEP);
878 
879 		rc = smb_unmangle_name(sr, cr, dir_snode,
880 		    name, longname, MAXNAMELEN, NULL,
881 		    NULL, 1);
882 
883 		if (rc == 0) {
884 			/*
885 			 * We passed "1" as the "od" parameter
886 			 * to smb_unmangle_name(), such that longname
887 			 * is the real (case-sensitive) on-disk name.
888 			 * We make sure we do a rmdir on this exact
889 			 * name, as the name was mangled and denotes
890 			 * a unique directory.
891 			 */
892 			flags &= ~SMB_IGNORE_CASE;
893 			rc = smb_vop_rmdir(dir_snode->vp, longname, flags, cr);
894 		}
895 
896 		kmem_free(longname, MAXNAMELEN);
897 	}
898 
899 	return (rc);
900 }
901 
902 /*
903  * smb_fsop_getattr
904  *
905  * All SMB functions should use this wrapper to ensure that
906  * the the calls are performed with the appropriate credentials.
907  * Please document any direct call to explain the reason
908  * for avoiding this wrapper.
909  *
910  * It is assumed that a reference exists on snode coming into this routine.
911  */
912 int
913 smb_fsop_getattr(smb_request_t *sr, cred_t *cr, smb_node_t *snode,
914     smb_attr_t *attr)
915 {
916 	smb_node_t *unnamed_node;
917 	vnode_t *unnamed_vp = NULL;
918 	uint32_t status;
919 	uint32_t access = 0;
920 	int flags = 0;
921 	int rc;
922 
923 	ASSERT(cr);
924 	ASSERT(snode);
925 	ASSERT(snode->n_magic == SMB_NODE_MAGIC);
926 	ASSERT(snode->n_state != SMB_NODE_STATE_DESTROYING);
927 
928 	if (SMB_TREE_ROOT_FS(sr, snode) == 0)
929 		return (EACCES);
930 
931 	if (sr->fid_ofile) {
932 		/* if uid and/or gid is requested */
933 		if (attr->sa_mask & (SMB_AT_UID|SMB_AT_GID))
934 			access |= READ_CONTROL;
935 
936 		/* if anything else is also requested */
937 		if (attr->sa_mask & ~(SMB_AT_UID|SMB_AT_GID))
938 			access |= FILE_READ_ATTRIBUTES;
939 
940 		status = smb_ofile_access(sr->fid_ofile, cr, access);
941 		if (status != NT_STATUS_SUCCESS)
942 			return (EACCES);
943 
944 		if (sr->tid_tree->t_flags & SMB_TREE_FLAG_ACEMASKONACCESS)
945 			flags = ATTR_NOACLCHECK;
946 	}
947 
948 	unnamed_node = SMB_IS_STREAM(snode);
949 
950 	if (unnamed_node) {
951 		ASSERT(unnamed_node->n_magic == SMB_NODE_MAGIC);
952 		ASSERT(unnamed_node->n_state != SMB_NODE_STATE_DESTROYING);
953 		unnamed_vp = unnamed_node->vp;
954 	}
955 
956 	rc = smb_vop_getattr(snode->vp, unnamed_vp, attr, flags, cr);
957 	if (rc == 0)
958 		snode->attr = *attr;
959 
960 	return (rc);
961 }
962 
963 /*
964  * smb_fsop_readdir
965  *
966  * All SMB functions should use this smb_fsop_readdir wrapper to ensure that
967  * the smb_vop_readdir is performed with the appropriate credentials.
968  * Please document any direct call to smb_vop_readdir to explain the reason
969  * for avoiding this wrapper.
970  *
971  * It is assumed that a reference exists on snode coming into this routine.
972  */
973 int
974 smb_fsop_readdir(
975     smb_request_t *sr,
976     cred_t *cr,
977     smb_node_t *dir_snode,
978     uint32_t *cookie,
979     char *name,
980     int *namelen,
981     ino64_t *fileid,
982     struct fs_stream_info *stream_info,
983     smb_node_t **ret_snode,
984     smb_attr_t *ret_attr)
985 {
986 	smb_node_t	*ret_snodep;
987 	smb_node_t	*fnode;
988 	smb_attr_t	tmp_attr;
989 	vnode_t		*xattrdirvp;
990 	vnode_t		*fvp;
991 	vnode_t		*vp = NULL;
992 	char		*od_name;
993 	int		rc;
994 	int		flags = 0;
995 
996 	ASSERT(cr);
997 	ASSERT(dir_snode);
998 	ASSERT(dir_snode->n_magic == SMB_NODE_MAGIC);
999 	ASSERT(dir_snode->n_state != SMB_NODE_STATE_DESTROYING);
1000 
1001 	if (SMB_TREE_ROOT_FS(sr, dir_snode) == 0)
1002 		return (EACCES);
1003 
1004 	if (*cookie == SMB_EOF) {
1005 		*namelen = 0;
1006 		return (0);
1007 	}
1008 
1009 	if (SMB_TREE_CASE_INSENSITIVE(sr))
1010 		flags = SMB_IGNORE_CASE;
1011 
1012 	od_name = kmem_alloc(MAXNAMELEN, KM_SLEEP);
1013 
1014 	if (stream_info) {
1015 		rc = smb_vop_lookup(dir_snode->vp, name, &fvp, od_name,
1016 		    SMB_FOLLOW_LINKS, sr->tid_tree->t_snode->vp, cr);
1017 
1018 		if (rc != 0) {
1019 			kmem_free(od_name, MAXNAMELEN);
1020 			return (rc);
1021 		}
1022 
1023 		fnode = smb_node_lookup(sr, NULL, cr, fvp, od_name, dir_snode,
1024 		    NULL, ret_attr);
1025 
1026 		kmem_free(od_name, MAXNAMELEN);
1027 
1028 		if (fnode == NULL) {
1029 			VN_RELE(fvp);
1030 			return (ENOMEM);
1031 		}
1032 
1033 		/*
1034 		 * XXX
1035 		 * Need to find out what permission(s) NTFS requires for getting
1036 		 * a file's streams list.
1037 		 *
1038 		 * Might have to use kcred.
1039 		 */
1040 		rc = smb_vop_stream_readdir(fvp, cookie, stream_info, &vp,
1041 		    &xattrdirvp, flags, cr);
1042 
1043 		if ((rc != 0) || (*cookie == SMB_EOF)) {
1044 			smb_node_release(fnode);
1045 			return (rc);
1046 		}
1047 
1048 		ret_snodep = smb_stream_node_lookup(sr, cr, fnode, xattrdirvp,
1049 		    vp, stream_info->name, &tmp_attr);
1050 
1051 		smb_node_release(fnode);
1052 
1053 		if (ret_snodep == NULL) {
1054 			VN_RELE(xattrdirvp);
1055 			VN_RELE(vp);
1056 			return (ENOMEM);
1057 		}
1058 
1059 		stream_info->size = tmp_attr.sa_vattr.va_size;
1060 
1061 		if (ret_attr)
1062 			*ret_attr = tmp_attr;
1063 
1064 		if (ret_snode)
1065 			*ret_snode = ret_snodep;
1066 		else
1067 			smb_node_release(ret_snodep);
1068 
1069 	} else {
1070 		rc = smb_vop_readdir(dir_snode->vp, cookie, name, namelen,
1071 		    fileid, &vp, od_name, flags, cr);
1072 
1073 		if (rc != 0) {
1074 			kmem_free(od_name, MAXNAMELEN);
1075 			return (rc);
1076 		}
1077 
1078 		if (*namelen) {
1079 			ASSERT(vp);
1080 			if (ret_attr || ret_snode) {
1081 				ret_snodep = smb_node_lookup(sr, NULL, cr, vp,
1082 				    od_name, dir_snode, NULL, &tmp_attr);
1083 
1084 				if (ret_snodep == NULL) {
1085 					kmem_free(od_name, MAXNAMELEN);
1086 					VN_RELE(vp);
1087 					return (ENOMEM);
1088 				}
1089 
1090 				if (ret_attr)
1091 					*ret_attr = tmp_attr;
1092 
1093 				if (ret_snode)
1094 					*ret_snode = ret_snodep;
1095 				else
1096 					smb_node_release(ret_snodep);
1097 			}
1098 		}
1099 
1100 		kmem_free(od_name, MAXNAMELEN);
1101 	}
1102 
1103 	return (rc);
1104 }
1105 
1106 /*
1107  * smb_fsop_getdents
1108  *
1109  * All SMB functions should use this smb_vop_getdents wrapper to ensure that
1110  * the smb_vop_getdents is performed with the appropriate credentials.
1111  * Please document any direct call to smb_vop_getdents to explain the reason
1112  * for avoiding this wrapper.
1113  *
1114  * It is assumed that a reference exists on snode coming into this routine.
1115  */
1116 /*ARGSUSED*/
1117 int
1118 smb_fsop_getdents(
1119     struct smb_request *sr,
1120     cred_t *cr,
1121     smb_node_t *dir_snode,
1122     uint32_t *cookie,
1123     uint64_t *verifierp,
1124     int32_t	*maxcnt,
1125     char *args,
1126     char *pattern)
1127 {
1128 	int flags = 0;
1129 
1130 	ASSERT(cr);
1131 	ASSERT(dir_snode);
1132 	ASSERT(dir_snode->n_magic == SMB_NODE_MAGIC);
1133 	ASSERT(dir_snode->n_state != SMB_NODE_STATE_DESTROYING);
1134 
1135 	if (SMB_TREE_ROOT_FS(sr, dir_snode) == 0)
1136 		return (EACCES);
1137 
1138 	if (SMB_TREE_CASE_INSENSITIVE(sr))
1139 		flags = SMB_IGNORE_CASE;
1140 
1141 	return (smb_vop_getdents(dir_snode, cookie, 0, maxcnt, args, pattern,
1142 	    flags, sr, cr));
1143 }
1144 
1145 /*
1146  * smb_fsop_rename
1147  *
1148  * All SMB functions should use this smb_vop_rename wrapper to ensure that
1149  * the smb_vop_rename is performed with the appropriate credentials.
1150  * Please document any direct call to smb_vop_rename to explain the reason
1151  * for avoiding this wrapper.
1152  *
1153  * It is assumed that references exist on from_dir_snode and to_dir_snode coming
1154  * into this routine.
1155  */
1156 int
1157 smb_fsop_rename(
1158     smb_request_t *sr,
1159     cred_t *cr,
1160     smb_node_t *from_dir_snode,
1161     char *from_name,
1162     smb_node_t *to_dir_snode,
1163     char *to_name)
1164 {
1165 	smb_node_t *from_snode;
1166 	smb_attr_t tmp_attr;
1167 	vnode_t *from_vp;
1168 	int flags = 0;
1169 	int rc;
1170 
1171 	ASSERT(cr);
1172 	ASSERT(from_dir_snode);
1173 	ASSERT(from_dir_snode->n_magic == SMB_NODE_MAGIC);
1174 	ASSERT(from_dir_snode->n_state != SMB_NODE_STATE_DESTROYING);
1175 
1176 	ASSERT(to_dir_snode);
1177 	ASSERT(to_dir_snode->n_magic == SMB_NODE_MAGIC);
1178 	ASSERT(to_dir_snode->n_state != SMB_NODE_STATE_DESTROYING);
1179 
1180 	if (SMB_TREE_ROOT_FS(sr, from_dir_snode) == 0)
1181 		return (EACCES);
1182 
1183 	if (SMB_TREE_ROOT_FS(sr, to_dir_snode) == 0)
1184 		return (EACCES);
1185 
1186 	ASSERT(sr);
1187 	ASSERT(sr->tid_tree);
1188 	if (SMB_TREE_IS_READ_ONLY(sr))
1189 		return (EROFS);
1190 
1191 	/*
1192 	 * Note: There is no need to check SMB_TREE_CASE_INSENSITIVE(sr)
1193 	 * here.
1194 	 *
1195 	 * A case-sensitive rename is always done in this routine
1196 	 * because we are using the on-disk name from an earlier lookup.
1197 	 * If a mangled name was passed in by the caller (denoting a
1198 	 * deterministic lookup), then the exact file must be renamed
1199 	 * (i.e. SMB_IGNORE_CASE must not be passed to VOP_RENAME, or
1200 	 * else the underlying file system might return a "first-match"
1201 	 * on this on-disk name, possibly resulting in the wrong file).
1202 	 */
1203 
1204 	/*
1205 	 * XXX: Lock required through smb_node_release() below?
1206 	 */
1207 
1208 	rc = smb_vop_lookup(from_dir_snode->vp, from_name, &from_vp, NULL, 0,
1209 	    NULL, cr);
1210 
1211 	if (rc != 0)
1212 		return (rc);
1213 
1214 	rc = smb_vop_rename(from_dir_snode->vp, from_name, to_dir_snode->vp,
1215 	    to_name, flags, cr);
1216 
1217 	if (rc == 0) {
1218 		from_snode = smb_node_lookup(sr, NULL, cr, from_vp, from_name,
1219 		    from_dir_snode, NULL, &tmp_attr);
1220 
1221 		if (from_snode == NULL) {
1222 			VN_RELE(from_vp);
1223 			return (ENOMEM);
1224 		}
1225 
1226 		(void) smb_node_rename(from_dir_snode, from_snode, to_dir_snode,
1227 		    to_name);
1228 
1229 		smb_node_release(from_snode);
1230 	} else {
1231 		VN_RELE(from_vp);
1232 	}
1233 
1234 	/* XXX: unlock */
1235 
1236 	return (rc);
1237 }
1238 
1239 /*
1240  * smb_fsop_setattr
1241  *
1242  * All SMB functions should use this wrapper to ensure that
1243  * the the calls are performed with the appropriate credentials.
1244  * Please document any direct call to explain the reason
1245  * for avoiding this wrapper.
1246  *
1247  * It is assumed that a reference exists on snode coming into this routine.
1248  * A null smb_request might be passed to this function.
1249  */
1250 int
1251 smb_fsop_setattr(
1252     smb_request_t	*sr,
1253     cred_t		*cr,
1254     smb_node_t		*snode,
1255     smb_attr_t		*set_attr,
1256     smb_attr_t		*ret_attr)
1257 {
1258 	smb_node_t *unnamed_node;
1259 	vnode_t *unnamed_vp = NULL;
1260 	uint32_t status;
1261 	uint32_t access = 0;
1262 	int rc = 0;
1263 	int flags = 0;
1264 	boolean_t no_xvattr = B_FALSE;
1265 
1266 	ASSERT(cr);
1267 	ASSERT(snode);
1268 	ASSERT(snode->n_magic == SMB_NODE_MAGIC);
1269 	ASSERT(snode->n_state != SMB_NODE_STATE_DESTROYING);
1270 
1271 	if (SMB_TREE_ROOT_FS(sr, snode) == 0)
1272 		return (EACCES);
1273 
1274 	if (SMB_TREE_IS_READ_ONLY(sr))
1275 		return (EROFS);
1276 
1277 	/* sr could be NULL in some cases */
1278 	if (sr && sr->fid_ofile) {
1279 		/* if uid and/or gid is requested */
1280 		if (set_attr->sa_mask & (SMB_AT_UID|SMB_AT_GID))
1281 			access |= WRITE_OWNER;
1282 
1283 		/* if anything else is also requested */
1284 		if (set_attr->sa_mask & ~(SMB_AT_UID|SMB_AT_GID))
1285 			access |= FILE_WRITE_ATTRIBUTES;
1286 
1287 		status = smb_ofile_access(sr->fid_ofile, cr, access);
1288 		if (status != NT_STATUS_SUCCESS)
1289 			return (EACCES);
1290 
1291 		if (sr->tid_tree->t_flags & SMB_TREE_FLAG_ACEMASKONACCESS)
1292 			flags = ATTR_NOACLCHECK;
1293 	}
1294 
1295 	unnamed_node = SMB_IS_STREAM(snode);
1296 
1297 	if (unnamed_node) {
1298 		ASSERT(unnamed_node->n_magic == SMB_NODE_MAGIC);
1299 		ASSERT(unnamed_node->n_state != SMB_NODE_STATE_DESTROYING);
1300 		unnamed_vp = unnamed_node->vp;
1301 	}
1302 	if (sr && sr->tid_tree)
1303 		if (sr->tid_tree->t_flags & SMB_TREE_FLAG_UFS)
1304 			no_xvattr = B_TRUE;
1305 
1306 	rc = smb_vop_setattr(snode->vp, unnamed_vp, set_attr, flags, cr,
1307 	    no_xvattr);
1308 
1309 	if ((rc == 0) && ret_attr) {
1310 		/*
1311 		 * Use kcred to update the node attr because this
1312 		 * call is not being made on behalf of the user.
1313 		 */
1314 		ret_attr->sa_mask = SMB_AT_ALL;
1315 		rc = smb_vop_getattr(snode->vp, unnamed_vp, ret_attr, 0, kcred);
1316 		if (rc == 0)
1317 			snode->attr = *ret_attr;
1318 	}
1319 
1320 	return (rc);
1321 }
1322 
1323 /*
1324  * smb_fsop_read
1325  *
1326  * All SMB functions should use this wrapper to ensure that
1327  * the the calls are performed with the appropriate credentials.
1328  * Please document any direct call to explain the reason
1329  * for avoiding this wrapper.
1330  *
1331  * It is assumed that a reference exists on snode coming into this routine.
1332  */
1333 int
1334 smb_fsop_read(
1335     struct smb_request *sr,
1336     cred_t *cr,
1337     smb_node_t *snode,
1338     uio_t *uio,
1339     smb_attr_t *ret_attr)
1340 {
1341 	smb_node_t *unnamed_node;
1342 	vnode_t *unnamed_vp = NULL;
1343 	int svmand;
1344 	int rc;
1345 
1346 	ASSERT(cr);
1347 	ASSERT(snode);
1348 	ASSERT(snode->n_magic == SMB_NODE_MAGIC);
1349 	ASSERT(snode->n_state != SMB_NODE_STATE_DESTROYING);
1350 
1351 	ASSERT(sr);
1352 	ASSERT(sr->fid_ofile);
1353 
1354 	rc = smb_ofile_access(sr->fid_ofile, cr, FILE_READ_DATA);
1355 	if (rc != NT_STATUS_SUCCESS) {
1356 		rc = smb_ofile_access(sr->fid_ofile, cr, FILE_EXECUTE);
1357 		if (rc != NT_STATUS_SUCCESS)
1358 			return (EACCES);
1359 	}
1360 
1361 	unnamed_node = SMB_IS_STREAM(snode);
1362 	if (unnamed_node) {
1363 		ASSERT(unnamed_node->n_magic == SMB_NODE_MAGIC);
1364 		ASSERT(unnamed_node->n_state != SMB_NODE_STATE_DESTROYING);
1365 		unnamed_vp = unnamed_node->vp;
1366 		/*
1367 		 * Streams permission are checked against the unnamed stream,
1368 		 * but in FS level they have their own permissions. To avoid
1369 		 * rejection by FS due to lack of permission on the actual
1370 		 * extended attr kcred is passed for streams.
1371 		 */
1372 		cr = kcred;
1373 	}
1374 
1375 	smb_node_start_crit(snode, RW_READER);
1376 	rc = nbl_svmand(snode->vp, cr, &svmand);
1377 	if (rc) {
1378 		smb_node_end_crit(snode);
1379 		return (rc);
1380 	}
1381 
1382 	rc = nbl_lock_conflict(snode->vp, NBL_READ, uio->uio_loffset,
1383 	    uio->uio_iov->iov_len, svmand, &smb_ct);
1384 
1385 	if (rc) {
1386 		smb_node_end_crit(snode);
1387 		return (ERANGE);
1388 	}
1389 	rc = smb_vop_read(snode->vp, uio, cr);
1390 
1391 	if (rc == 0 && ret_attr) {
1392 		/*
1393 		 * Use kcred to update the node attr because this
1394 		 * call is not being made on behalf of the user.
1395 		 */
1396 		ret_attr->sa_mask = SMB_AT_ALL;
1397 		if (smb_vop_getattr(snode->vp, unnamed_vp, ret_attr, 0,
1398 		    kcred) == 0) {
1399 			snode->attr = *ret_attr;
1400 		}
1401 	}
1402 
1403 	smb_node_end_crit(snode);
1404 
1405 	return (rc);
1406 }
1407 
1408 /*
1409  * smb_fsop_write
1410  *
1411  * This is a wrapper function used for smb_write and smb_write_raw operations.
1412  *
1413  * It is assumed that a reference exists on snode coming into this routine.
1414  */
1415 int
1416 smb_fsop_write(
1417     smb_request_t *sr,
1418     cred_t *cr,
1419     smb_node_t *snode,
1420     uio_t *uio,
1421     uint32_t *lcount,
1422     smb_attr_t *ret_attr,
1423     uint32_t *flag)
1424 {
1425 	smb_node_t *unnamed_node;
1426 	vnode_t *unnamed_vp = NULL;
1427 	int svmand;
1428 	int rc;
1429 
1430 	ASSERT(cr);
1431 	ASSERT(snode);
1432 	ASSERT(snode->n_magic == SMB_NODE_MAGIC);
1433 	ASSERT(snode->n_state != SMB_NODE_STATE_DESTROYING);
1434 
1435 	ASSERT(sr);
1436 	ASSERT(sr->tid_tree);
1437 	ASSERT(sr->fid_ofile);
1438 
1439 	if (SMB_TREE_IS_READ_ONLY(sr))
1440 		return (EROFS);
1441 
1442 	rc = smb_ofile_access(sr->fid_ofile, cr, FILE_WRITE_DATA);
1443 	if (rc != NT_STATUS_SUCCESS) {
1444 		rc = smb_ofile_access(sr->fid_ofile, cr, FILE_APPEND_DATA);
1445 		if (rc != NT_STATUS_SUCCESS)
1446 			return (EACCES);
1447 	}
1448 
1449 	unnamed_node = SMB_IS_STREAM(snode);
1450 
1451 	if (unnamed_node) {
1452 		ASSERT(unnamed_node->n_magic == SMB_NODE_MAGIC);
1453 		ASSERT(unnamed_node->n_state != SMB_NODE_STATE_DESTROYING);
1454 		unnamed_vp = unnamed_node->vp;
1455 		/*
1456 		 * Streams permission are checked against the unnamed stream,
1457 		 * but in FS level they have their own permissions. To avoid
1458 		 * rejection by FS due to lack of permission on the actual
1459 		 * extended attr kcred is passed for streams.
1460 		 */
1461 		cr = kcred;
1462 	}
1463 
1464 	smb_node_start_crit(snode, RW_READER);
1465 	rc = nbl_svmand(snode->vp, cr, &svmand);
1466 	if (rc) {
1467 		smb_node_end_crit(snode);
1468 		return (rc);
1469 	}
1470 	rc = nbl_lock_conflict(snode->vp, NBL_WRITE, uio->uio_loffset,
1471 	    uio->uio_iov->iov_len, svmand, &smb_ct);
1472 
1473 	if (rc) {
1474 		smb_node_end_crit(snode);
1475 		return (ERANGE);
1476 	}
1477 	rc = smb_vop_write(snode->vp, uio, flag, lcount, cr);
1478 
1479 	if (rc == 0 && ret_attr) {
1480 		/*
1481 		 * Use kcred to update the node attr because this
1482 		 * call is not being made on behalf of the user.
1483 		 */
1484 		ret_attr->sa_mask = SMB_AT_ALL;
1485 		if (smb_vop_getattr(snode->vp, unnamed_vp, ret_attr, 0,
1486 		    kcred) == 0) {
1487 			snode->attr = *ret_attr;
1488 		}
1489 	}
1490 
1491 	smb_node_end_crit(snode);
1492 
1493 	return (rc);
1494 }
1495 
1496 /*
1497  * smb_fsop_statfs
1498  *
1499  * This is a wrapper function used for stat operations.
1500  */
1501 int
1502 smb_fsop_statfs(
1503     cred_t *cr,
1504     smb_node_t *snode,
1505     struct statvfs64 *statp)
1506 {
1507 	ASSERT(cr);
1508 	ASSERT(snode);
1509 	ASSERT(snode->n_magic == SMB_NODE_MAGIC);
1510 	ASSERT(snode->n_state != SMB_NODE_STATE_DESTROYING);
1511 
1512 	return (smb_vop_statfs(snode->vp, statp, cr));
1513 }
1514 
1515 /*
1516  * smb_fsop_access
1517  */
1518 int
1519 smb_fsop_access(smb_request_t *sr, cred_t *cr, smb_node_t *snode,
1520     uint32_t faccess)
1521 {
1522 	int access = 0;
1523 	int error;
1524 	vnode_t *dir_vp;
1525 	boolean_t acl_check = B_TRUE;
1526 	smb_node_t *unnamed_node;
1527 
1528 	ASSERT(cr);
1529 	ASSERT(snode);
1530 	ASSERT(snode->n_magic == SMB_NODE_MAGIC);
1531 	ASSERT(snode->n_state != SMB_NODE_STATE_DESTROYING);
1532 
1533 	if (faccess == 0)
1534 		return (NT_STATUS_SUCCESS);
1535 
1536 	if (SMB_TREE_IS_READ_ONLY(sr)) {
1537 		if (faccess & (FILE_WRITE_DATA|FILE_APPEND_DATA|
1538 		    FILE_WRITE_EA|FILE_DELETE_CHILD|FILE_WRITE_ATTRIBUTES|
1539 		    DELETE|WRITE_DAC|WRITE_OWNER)) {
1540 			return (NT_STATUS_ACCESS_DENIED);
1541 		}
1542 	}
1543 
1544 	unnamed_node = SMB_IS_STREAM(snode);
1545 	if (unnamed_node) {
1546 		ASSERT(unnamed_node->n_magic == SMB_NODE_MAGIC);
1547 		ASSERT(unnamed_node->n_state != SMB_NODE_STATE_DESTROYING);
1548 		/*
1549 		 * Streams authorization should be performed against the
1550 		 * unnamed stream.
1551 		 */
1552 		snode = unnamed_node;
1553 	}
1554 
1555 	if (faccess & ACCESS_SYSTEM_SECURITY) {
1556 		/*
1557 		 * This permission is required for reading/writing SACL and
1558 		 * it's not part of DACL. It's only granted via proper
1559 		 * privileges.
1560 		 */
1561 		if ((sr->uid_user->u_privileges &
1562 		    (SMB_USER_PRIV_BACKUP |
1563 		    SMB_USER_PRIV_RESTORE |
1564 		    SMB_USER_PRIV_SECURITY)) == 0)
1565 			return (NT_STATUS_PRIVILEGE_NOT_HELD);
1566 
1567 		faccess &= ~ACCESS_SYSTEM_SECURITY;
1568 	}
1569 
1570 	/* Links don't have ACL */
1571 	if (((sr->tid_tree->t_flags & SMB_TREE_FLAG_ACEMASKONACCESS) == 0) ||
1572 	    (snode->attr.sa_vattr.va_type == VLNK))
1573 		acl_check = B_FALSE;
1574 
1575 	if (acl_check) {
1576 		dir_vp = (snode->dir_snode) ? snode->dir_snode->vp : NULL;
1577 		error = smb_vop_access(snode->vp, faccess, V_ACE_MASK, dir_vp,
1578 		    cr);
1579 	} else {
1580 		/*
1581 		 * FS doesn't understand 32-bit mask, need to map
1582 		 */
1583 		if (faccess & (FILE_WRITE_DATA | FILE_APPEND_DATA))
1584 			access |= VWRITE;
1585 
1586 		if (faccess & FILE_READ_DATA)
1587 			access |= VREAD;
1588 
1589 		if (faccess & FILE_EXECUTE)
1590 			access |= VEXEC;
1591 
1592 		error = smb_vop_access(snode->vp, access, 0, NULL, cr);
1593 	}
1594 
1595 	return ((error) ? NT_STATUS_ACCESS_DENIED : NT_STATUS_SUCCESS);
1596 }
1597 
1598 /*
1599  * smb_fsop_lookup_name()
1600  *
1601  * Sanity checks on dir_snode done in smb_fsop_lookup().
1602  *
1603  * Note: This function is called only from the open path.
1604  * It will check if the file is a stream.
1605  * It will also return an error if the looked-up file is in
1606  * a child mount.
1607  */
1608 
1609 int
1610 smb_fsop_lookup_name(
1611     smb_request_t *sr,
1612     cred_t	*cr,
1613     int		flags,
1614     smb_node_t	*root_node,
1615     smb_node_t	*dir_snode,
1616     char	*name,
1617     smb_node_t	**ret_snode,
1618     smb_attr_t	*ret_attr)
1619 {
1620 	smb_node_t	*fnode;
1621 	smb_attr_t	file_attr;
1622 	vnode_t		*xattrdirvp;
1623 	vnode_t		*vp;
1624 	char		*od_name;
1625 	char		*fname;
1626 	char		*sname;
1627 	int		rc;
1628 
1629 	ASSERT(cr);
1630 	ASSERT(dir_snode);
1631 	ASSERT(dir_snode->n_magic == SMB_NODE_MAGIC);
1632 	ASSERT(dir_snode->n_state != SMB_NODE_STATE_DESTROYING);
1633 
1634 	/*
1635 	 * The following check is required for streams processing, below
1636 	 */
1637 
1638 	if (SMB_TREE_CASE_INSENSITIVE(sr))
1639 		flags |= SMB_IGNORE_CASE;
1640 
1641 	fname = kmem_alloc(MAXNAMELEN, KM_SLEEP);
1642 	sname = kmem_alloc(MAXNAMELEN, KM_SLEEP);
1643 
1644 	if (smb_stream_parse_name(name, fname, sname)) {
1645 		/*
1646 		 * Look up the unnamed stream (i.e. fname).
1647 		 * Unmangle processing will be done on fname
1648 		 * as well as any link target.
1649 		 */
1650 		rc = smb_fsop_lookup(sr, cr, flags, root_node, dir_snode, fname,
1651 		    &fnode, &file_attr, NULL, NULL);
1652 
1653 		if (rc != 0) {
1654 			kmem_free(fname, MAXNAMELEN);
1655 			kmem_free(sname, MAXNAMELEN);
1656 			return (rc);
1657 		}
1658 
1659 		od_name = kmem_alloc(MAXNAMELEN, KM_SLEEP);
1660 
1661 		/*
1662 		 * od_name is the on-disk name of the stream, except
1663 		 * without the prepended stream prefix (SMB_STREAM_PREFIX)
1664 		 */
1665 
1666 		/*
1667 		 * XXX
1668 		 * What permissions NTFS requires for stream lookup if any?
1669 		 */
1670 		rc = smb_vop_stream_lookup(fnode->vp, sname, &vp, od_name,
1671 		    &xattrdirvp, flags, root_node->vp, cr);
1672 
1673 		if (rc != 0) {
1674 			smb_node_release(fnode);
1675 			kmem_free(fname, MAXNAMELEN);
1676 			kmem_free(sname, MAXNAMELEN);
1677 			kmem_free(od_name, MAXNAMELEN);
1678 			return (rc);
1679 		}
1680 
1681 		*ret_snode = smb_stream_node_lookup(sr, cr, fnode, xattrdirvp,
1682 		    vp, od_name, ret_attr);
1683 
1684 		kmem_free(od_name, MAXNAMELEN);
1685 		smb_node_release(fnode);
1686 
1687 		if (*ret_snode == NULL) {
1688 			VN_RELE(xattrdirvp);
1689 			VN_RELE(vp);
1690 			kmem_free(fname, MAXNAMELEN);
1691 			kmem_free(sname, MAXNAMELEN);
1692 			return (ENOMEM);
1693 		}
1694 	} else {
1695 		rc = smb_fsop_lookup(sr, cr, flags, root_node, dir_snode, name,
1696 		    ret_snode, ret_attr, NULL, NULL);
1697 	}
1698 
1699 	if (rc == 0) {
1700 		ASSERT(ret_snode);
1701 		if (SMB_TREE_ROOT_FS(sr, *ret_snode) == 0) {
1702 			smb_node_release(*ret_snode);
1703 			*ret_snode = NULL;
1704 			rc = EACCES;
1705 		}
1706 	}
1707 
1708 	kmem_free(fname, MAXNAMELEN);
1709 	kmem_free(sname, MAXNAMELEN);
1710 
1711 	return (rc);
1712 }
1713 
1714 /*
1715  * smb_fsop_lookup
1716  *
1717  * All SMB functions should use this smb_vop_lookup wrapper to ensure that
1718  * the smb_vop_lookup is performed with the appropriate credentials and using
1719  * case insensitive compares. Please document any direct call to smb_vop_lookup
1720  * to explain the reason for avoiding this wrapper.
1721  *
1722  * It is assumed that a reference exists on dir_snode coming into this routine
1723  * (and that it is safe from deallocation).
1724  *
1725  * Same with the root_node.
1726  *
1727  * *ret_snode is returned with a reference upon success.  No reference is
1728  * taken if an error is returned.
1729  *
1730  * Note: The returned ret_snode may be in a child mount.  This is ok for
1731  * readdir and getdents.
1732  *
1733  * Other smb_fsop_* routines will call SMB_TREE_ROOT_FS() to prevent
1734  * operations on files not in the parent mount.
1735  */
1736 int
1737 smb_fsop_lookup(
1738     smb_request_t *sr,
1739     cred_t	*cr,
1740     int		flags,
1741     smb_node_t	*root_node,
1742     smb_node_t	*dir_snode,
1743     char	*name,
1744     smb_node_t	**ret_snode,
1745     smb_attr_t	*ret_attr,
1746     char	*ret_shortname, /* Must be at least MANGLE_NAMELEN chars */
1747     char	*ret_name83)    /* Must be at least MANGLE_NAMELEN chars */
1748 {
1749 	smb_node_t *lnk_target_node;
1750 	smb_node_t *lnk_dnode;
1751 	char *longname;
1752 	char *od_name;
1753 	vnode_t *vp;
1754 	int rc;
1755 
1756 	ASSERT(cr);
1757 	ASSERT(dir_snode);
1758 	ASSERT(dir_snode->n_magic == SMB_NODE_MAGIC);
1759 	ASSERT(dir_snode->n_state != SMB_NODE_STATE_DESTROYING);
1760 
1761 	if (name == NULL)
1762 		return (EINVAL);
1763 
1764 	if (SMB_TREE_ROOT_FS(sr, dir_snode) == 0)
1765 		return (EACCES);
1766 
1767 	if (SMB_TREE_CASE_INSENSITIVE(sr))
1768 		flags |= SMB_IGNORE_CASE;
1769 
1770 	od_name = kmem_alloc(MAXNAMELEN, KM_SLEEP);
1771 
1772 	rc = smb_vop_lookup(dir_snode->vp, name, &vp, od_name, flags,
1773 	    root_node ? root_node->vp : NULL, cr);
1774 
1775 	if (rc != 0) {
1776 		if (smb_maybe_mangled_name(name) == 0) {
1777 			kmem_free(od_name, MAXNAMELEN);
1778 			return (rc);
1779 		}
1780 
1781 		longname = kmem_alloc(MAXNAMELEN, KM_SLEEP);
1782 
1783 		rc = smb_unmangle_name(sr, cr, dir_snode, name, longname,
1784 		    MAXNAMELEN, ret_shortname, ret_name83, 1);
1785 
1786 		if (rc != 0) {
1787 			kmem_free(od_name, MAXNAMELEN);
1788 			kmem_free(longname, MAXNAMELEN);
1789 			return (rc);
1790 		}
1791 
1792 		/*
1793 		 * We passed "1" as the "od" parameter
1794 		 * to smb_unmangle_name(), such that longname
1795 		 * is the real (case-sensitive) on-disk name.
1796 		 * We make sure we do a lookup on this exact
1797 		 * name, as the name was mangled and denotes
1798 		 * a unique file.
1799 		 */
1800 
1801 		if (flags & SMB_IGNORE_CASE)
1802 			flags &= ~SMB_IGNORE_CASE;
1803 
1804 		rc = smb_vop_lookup(dir_snode->vp, longname, &vp, od_name,
1805 		    flags, root_node ? root_node->vp : NULL, cr);
1806 
1807 		kmem_free(longname, MAXNAMELEN);
1808 
1809 		if (rc != 0) {
1810 			kmem_free(od_name, MAXNAMELEN);
1811 			return (rc);
1812 		}
1813 	}
1814 
1815 	if ((flags & SMB_FOLLOW_LINKS) && (vp->v_type == VLNK)) {
1816 
1817 		rc = smb_pathname(sr, od_name, FOLLOW, root_node, dir_snode,
1818 		    &lnk_dnode, &lnk_target_node, cr);
1819 
1820 		if (rc != 0) {
1821 			/*
1822 			 * The link is assumed to be for the last component
1823 			 * of a path.  Hence any ENOTDIR error will be returned
1824 			 * as ENOENT.
1825 			 */
1826 			if (rc == ENOTDIR)
1827 				rc = ENOENT;
1828 
1829 			VN_RELE(vp);
1830 			kmem_free(od_name, MAXNAMELEN);
1831 			return (rc);
1832 		}
1833 
1834 		/*
1835 		 * Release the original VLNK vnode
1836 		 */
1837 
1838 		VN_RELE(vp);
1839 		vp = lnk_target_node->vp;
1840 
1841 		rc = smb_vop_traverse_check(&vp);
1842 
1843 		if (rc != 0) {
1844 			smb_node_release(lnk_dnode);
1845 			smb_node_release(lnk_target_node);
1846 			kmem_free(od_name, MAXNAMELEN);
1847 			return (rc);
1848 		}
1849 
1850 		/*
1851 		 * smb_vop_traverse_check() may have returned a different vnode
1852 		 */
1853 
1854 		if (lnk_target_node->vp == vp) {
1855 			*ret_snode = lnk_target_node;
1856 			*ret_attr = (*ret_snode)->attr;
1857 		} else {
1858 			*ret_snode = smb_node_lookup(sr, NULL, cr, vp,
1859 			    lnk_target_node->od_name, lnk_dnode, NULL,
1860 			    ret_attr);
1861 
1862 			if (*ret_snode == NULL) {
1863 				VN_RELE(vp);
1864 				rc = ENOMEM;
1865 			}
1866 			smb_node_release(lnk_target_node);
1867 		}
1868 
1869 		smb_node_release(lnk_dnode);
1870 
1871 	} else {
1872 
1873 		rc = smb_vop_traverse_check(&vp);
1874 		if (rc) {
1875 			VN_RELE(vp);
1876 			kmem_free(od_name, MAXNAMELEN);
1877 			return (rc);
1878 		}
1879 
1880 		*ret_snode = smb_node_lookup(sr, NULL, cr, vp, od_name,
1881 		    dir_snode, NULL, ret_attr);
1882 
1883 		if (*ret_snode == NULL) {
1884 			VN_RELE(vp);
1885 			rc = ENOMEM;
1886 		}
1887 	}
1888 
1889 	kmem_free(od_name, MAXNAMELEN);
1890 	return (rc);
1891 }
1892 
1893 /*
1894  * smb_fsop_stream_readdir()
1895  *
1896  * ret_snode and ret_attr are optional parameters (i.e. NULL may be passed in)
1897  *
1898  * This routine will return only NTFS streams.  If an NTFS stream is not
1899  * found at the offset specified, the directory will be read until an NTFS
1900  * stream is found or until EOF.
1901  *
1902  * Note: Sanity checks done in caller
1903  * (smb_fsop_readdir(), smb_fsop_remove_streams())
1904  */
1905 
1906 int
1907 smb_fsop_stream_readdir(smb_request_t *sr, cred_t *cr, smb_node_t *fnode,
1908     uint32_t *cookiep, struct fs_stream_info *stream_info,
1909     smb_node_t **ret_snode, smb_attr_t *ret_attr)
1910 {
1911 	smb_node_t *ret_snodep = NULL;
1912 	smb_attr_t tmp_attr;
1913 	vnode_t *xattrdirvp;
1914 	vnode_t *vp;
1915 	int rc = 0;
1916 	int flags = 0;
1917 
1918 	/*
1919 	 * XXX NTFS permission requirements if any?
1920 	 */
1921 	ASSERT(cr);
1922 	ASSERT(fnode);
1923 	ASSERT(fnode->n_magic == SMB_NODE_MAGIC);
1924 	ASSERT(fnode->n_state != SMB_NODE_STATE_DESTROYING);
1925 
1926 	if (SMB_TREE_CASE_INSENSITIVE(sr))
1927 		flags = SMB_IGNORE_CASE;
1928 
1929 	rc = smb_vop_stream_readdir(fnode->vp, cookiep, stream_info, &vp,
1930 	    &xattrdirvp, flags, cr);
1931 
1932 	if ((rc != 0) || *cookiep == SMB_EOF)
1933 		return (rc);
1934 
1935 	ret_snodep = smb_stream_node_lookup(sr, cr, fnode, xattrdirvp, vp,
1936 	    stream_info->name, &tmp_attr);
1937 
1938 	if (ret_snodep == NULL) {
1939 		VN_RELE(xattrdirvp);
1940 		VN_RELE(vp);
1941 		return (ENOMEM);
1942 	}
1943 
1944 	stream_info->size = tmp_attr.sa_vattr.va_size;
1945 
1946 	if (ret_attr)
1947 		*ret_attr = tmp_attr;
1948 
1949 	if (ret_snode)
1950 		*ret_snode = ret_snodep;
1951 	else
1952 		smb_node_release(ret_snodep);
1953 
1954 	return (rc);
1955 }
1956 
1957 int /*ARGSUSED*/
1958 smb_fsop_commit(smb_request_t *sr, cred_t *cr, smb_node_t *snode)
1959 {
1960 	ASSERT(cr);
1961 	ASSERT(snode);
1962 	ASSERT(snode->n_magic == SMB_NODE_MAGIC);
1963 	ASSERT(snode->n_state != SMB_NODE_STATE_DESTROYING);
1964 
1965 	ASSERT(sr);
1966 	ASSERT(sr->tid_tree);
1967 	if (SMB_TREE_IS_READ_ONLY(sr))
1968 		return (EROFS);
1969 
1970 	return (smb_vop_commit(snode->vp, cr));
1971 }
1972 
1973 /*
1974  * smb_fsop_aclread
1975  *
1976  * Retrieve filesystem ACL. Depends on requested ACLs in
1977  * fs_sd->sd_secinfo, it'll set DACL and SACL pointers in
1978  * fs_sd. Note that requesting a DACL/SACL doesn't mean that
1979  * the corresponding field in fs_sd should be non-NULL upon
1980  * return, since the target ACL might not contain that type of
1981  * entries.
1982  *
1983  * Returned ACL is always in ACE_T (aka ZFS) format.
1984  * If successful the allocated memory for the ACL should be freed
1985  * using smb_fsacl_free() or smb_fssd_term()
1986  */
1987 int
1988 smb_fsop_aclread(smb_request_t *sr, cred_t *cr, smb_node_t *snode,
1989     smb_fssd_t *fs_sd)
1990 {
1991 	int error = 0;
1992 	int flags = 0;
1993 	int access = 0;
1994 	acl_t *acl;
1995 	smb_node_t *unnamed_node;
1996 
1997 	ASSERT(cr);
1998 
1999 	if (sr->fid_ofile) {
2000 		if (fs_sd->sd_secinfo & SMB_DACL_SECINFO)
2001 			access = READ_CONTROL;
2002 
2003 		if (fs_sd->sd_secinfo & SMB_SACL_SECINFO)
2004 			access |= ACCESS_SYSTEM_SECURITY;
2005 
2006 		error = smb_ofile_access(sr->fid_ofile, cr, access);
2007 		if (error != NT_STATUS_SUCCESS) {
2008 			return (EACCES);
2009 		}
2010 	}
2011 
2012 	unnamed_node = SMB_IS_STREAM(snode);
2013 	if (unnamed_node) {
2014 		ASSERT(unnamed_node->n_magic == SMB_NODE_MAGIC);
2015 		ASSERT(unnamed_node->n_state != SMB_NODE_STATE_DESTROYING);
2016 		/*
2017 		 * Streams don't have ACL, any read ACL attempt on a stream
2018 		 * should be performed on the unnamed stream.
2019 		 */
2020 		snode = unnamed_node;
2021 	}
2022 
2023 	if (sr->tid_tree->t_flags & SMB_TREE_FLAG_ACEMASKONACCESS)
2024 		flags = ATTR_NOACLCHECK;
2025 
2026 	error = smb_vop_acl_read(snode->vp, &acl, flags,
2027 	    sr->tid_tree->t_acltype, cr);
2028 	if (error != 0) {
2029 		return (error);
2030 	}
2031 
2032 	error = acl_translate(acl, _ACL_ACE_ENABLED,
2033 	    (snode->vp->v_type == VDIR), fs_sd->sd_uid, fs_sd->sd_gid);
2034 
2035 	if (error == 0) {
2036 		smb_fsacl_split(acl, &fs_sd->sd_zdacl, &fs_sd->sd_zsacl,
2037 		    fs_sd->sd_secinfo);
2038 	}
2039 
2040 	acl_free(acl);
2041 	return (error);
2042 }
2043 
2044 /*
2045  * smb_fsop_aclwrite
2046  *
2047  * Stores the filesystem ACL provided in fs_sd->sd_acl.
2048  */
2049 int
2050 smb_fsop_aclwrite(smb_request_t *sr, cred_t *cr, smb_node_t *snode,
2051     smb_fssd_t *fs_sd)
2052 {
2053 	int target_flavor;
2054 	int error = 0;
2055 	int flags = 0;
2056 	int access = 0;
2057 	acl_t *acl, *dacl, *sacl;
2058 	smb_node_t *unnamed_node;
2059 
2060 	ASSERT(cr);
2061 
2062 	ASSERT(sr);
2063 	ASSERT(sr->tid_tree);
2064 	if (SMB_TREE_IS_READ_ONLY(sr))
2065 		return (EROFS);
2066 
2067 	if (sr->fid_ofile) {
2068 		if (fs_sd->sd_secinfo & SMB_DACL_SECINFO)
2069 			access = WRITE_DAC;
2070 
2071 		if (fs_sd->sd_secinfo & SMB_SACL_SECINFO)
2072 			access |= ACCESS_SYSTEM_SECURITY;
2073 
2074 		error = smb_ofile_access(sr->fid_ofile, cr, access);
2075 		if (error != NT_STATUS_SUCCESS)
2076 			return (EACCES);
2077 	}
2078 
2079 	switch (sr->tid_tree->t_acltype) {
2080 	case ACLENT_T:
2081 		target_flavor = _ACL_ACLENT_ENABLED;
2082 		break;
2083 
2084 	case ACE_T:
2085 		target_flavor = _ACL_ACE_ENABLED;
2086 		break;
2087 	default:
2088 		return (EINVAL);
2089 	}
2090 
2091 	unnamed_node = SMB_IS_STREAM(snode);
2092 	if (unnamed_node) {
2093 		ASSERT(unnamed_node->n_magic == SMB_NODE_MAGIC);
2094 		ASSERT(unnamed_node->n_state != SMB_NODE_STATE_DESTROYING);
2095 		/*
2096 		 * Streams don't have ACL, any write ACL attempt on a stream
2097 		 * should be performed on the unnamed stream.
2098 		 */
2099 		snode = unnamed_node;
2100 	}
2101 
2102 	dacl = fs_sd->sd_zdacl;
2103 	sacl = fs_sd->sd_zsacl;
2104 
2105 	ASSERT(dacl || sacl);
2106 	if ((dacl == NULL) && (sacl == NULL))
2107 		return (EINVAL);
2108 
2109 	if (dacl && sacl)
2110 		acl = smb_fsacl_merge(dacl, sacl);
2111 	else if (dacl)
2112 		acl = dacl;
2113 	else
2114 		acl = sacl;
2115 
2116 	error = acl_translate(acl, target_flavor, (snode->vp->v_type == VDIR),
2117 	    fs_sd->sd_uid, fs_sd->sd_gid);
2118 	if (error == 0) {
2119 		if (sr->tid_tree->t_flags & SMB_TREE_FLAG_ACEMASKONACCESS)
2120 			flags = ATTR_NOACLCHECK;
2121 
2122 		error = smb_vop_acl_write(snode->vp, acl, flags, cr);
2123 	}
2124 
2125 	if (dacl && sacl)
2126 		acl_free(acl);
2127 
2128 	return (error);
2129 }
2130 
2131 acl_type_t
2132 smb_fsop_acltype(smb_node_t *snode)
2133 {
2134 	return (smb_vop_acl_type(snode->vp));
2135 }
2136 
2137 /*
2138  * smb_fsop_sdread
2139  *
2140  * Read the requested security descriptor items from filesystem.
2141  * The items are specified in fs_sd->sd_secinfo.
2142  */
2143 int
2144 smb_fsop_sdread(smb_request_t *sr, cred_t *cr, smb_node_t *snode,
2145     smb_fssd_t *fs_sd)
2146 {
2147 	int error = 0;
2148 	int getowner = 0;
2149 	cred_t *ga_cred;
2150 	smb_attr_t attr;
2151 
2152 	ASSERT(cr);
2153 	ASSERT(fs_sd);
2154 
2155 	/*
2156 	 * File's uid/gid is fetched in two cases:
2157 	 *
2158 	 * 1. it's explicitly requested
2159 	 *
2160 	 * 2. target ACL is ACE_T (ZFS ACL). They're needed for
2161 	 *    owner@/group@ entries. In this case kcred should be used
2162 	 *    because uid/gid are fetched on behalf of smb server.
2163 	 */
2164 	if (fs_sd->sd_secinfo & (SMB_OWNER_SECINFO | SMB_GROUP_SECINFO)) {
2165 		getowner = 1;
2166 		ga_cred = cr;
2167 	} else if (sr->tid_tree->t_acltype == ACE_T) {
2168 		getowner = 1;
2169 		ga_cred = kcred;
2170 	}
2171 
2172 	if (getowner) {
2173 		/*
2174 		 * Windows require READ_CONTROL to read owner/group SID since
2175 		 * they're part of Security Descriptor.
2176 		 * ZFS only requires read_attribute. Need to have a explicit
2177 		 * access check here.
2178 		 */
2179 		if (sr->fid_ofile == NULL) {
2180 			error = smb_fsop_access(sr, ga_cred, snode,
2181 			    READ_CONTROL);
2182 			if (error)
2183 				return (error);
2184 		}
2185 
2186 		attr.sa_mask = SMB_AT_UID | SMB_AT_GID;
2187 		error = smb_fsop_getattr(sr, ga_cred, snode, &attr);
2188 		if (error == 0) {
2189 			fs_sd->sd_uid = attr.sa_vattr.va_uid;
2190 			fs_sd->sd_gid = attr.sa_vattr.va_gid;
2191 		} else {
2192 			return (error);
2193 		}
2194 	}
2195 
2196 	if (fs_sd->sd_secinfo & SMB_ACL_SECINFO) {
2197 		error = smb_fsop_aclread(sr, cr, snode, fs_sd);
2198 	}
2199 
2200 	return (error);
2201 }
2202 
2203 /*
2204  * smb_fsop_sdmerge
2205  *
2206  * From SMB point of view DACL and SACL are two separate list
2207  * which can be manipulated independently without one affecting
2208  * the other, but entries for both DACL and SACL will end up
2209  * in the same ACL if target filesystem supports ACE_T ACLs.
2210  *
2211  * So, if either DACL or SACL is present in the client set request
2212  * the entries corresponding to the non-present ACL shouldn't
2213  * be touched in the FS ACL.
2214  *
2215  * fs_sd parameter contains DACL and SACL specified by SMB
2216  * client to be set on a file/directory. The client could
2217  * specify both or one of these ACLs (if none is specified
2218  * we don't get this far). When both DACL and SACL are given
2219  * by client the existing ACL should be overwritten. If only
2220  * one of them is specified the entries corresponding to the other
2221  * ACL should not be touched. For example, if only DACL
2222  * is specified in input fs_sd, the function reads audit entries
2223  * of the existing ACL of the file and point fs_sd->sd_zsdacl
2224  * pointer to the fetched SACL, this way when smb_fsop_sdwrite()
2225  * function is called the passed fs_sd would point to the specified
2226  * DACL by client and fetched SACL from filesystem, so the file
2227  * will end up with correct ACL.
2228  */
2229 static int
2230 smb_fsop_sdmerge(smb_request_t *sr, smb_node_t *snode, smb_fssd_t *fs_sd)
2231 {
2232 	smb_fssd_t cur_sd;
2233 	int error = 0;
2234 
2235 	if (sr->tid_tree->t_acltype != ACE_T)
2236 		/* Don't bother if target FS doesn't support ACE_T */
2237 		return (0);
2238 
2239 	if ((fs_sd->sd_secinfo & SMB_ACL_SECINFO) != SMB_ACL_SECINFO) {
2240 		if (fs_sd->sd_secinfo & SMB_DACL_SECINFO) {
2241 			/*
2242 			 * Don't overwrite existing audit entries
2243 			 */
2244 			smb_fssd_init(&cur_sd, SMB_SACL_SECINFO,
2245 			    fs_sd->sd_flags);
2246 
2247 			error = smb_fsop_sdread(sr, kcred, snode, &cur_sd);
2248 			if (error == 0) {
2249 				ASSERT(fs_sd->sd_zsacl == NULL);
2250 				fs_sd->sd_zsacl = cur_sd.sd_zsacl;
2251 				if (fs_sd->sd_zsacl && fs_sd->sd_zdacl)
2252 					fs_sd->sd_zsacl->acl_flags =
2253 					    fs_sd->sd_zdacl->acl_flags;
2254 			}
2255 		} else {
2256 			/*
2257 			 * Don't overwrite existing access entries
2258 			 */
2259 			smb_fssd_init(&cur_sd, SMB_DACL_SECINFO,
2260 			    fs_sd->sd_flags);
2261 
2262 			error = smb_fsop_sdread(sr, kcred, snode, &cur_sd);
2263 			if (error == 0) {
2264 				ASSERT(fs_sd->sd_zdacl == NULL);
2265 				fs_sd->sd_zdacl = cur_sd.sd_zdacl;
2266 				if (fs_sd->sd_zdacl && fs_sd->sd_zsacl)
2267 					fs_sd->sd_zdacl->acl_flags =
2268 					    fs_sd->sd_zsacl->acl_flags;
2269 			}
2270 		}
2271 
2272 		if (error)
2273 			smb_fssd_term(&cur_sd);
2274 	}
2275 
2276 	return (error);
2277 }
2278 
2279 /*
2280  * smb_fsop_sdwrite
2281  *
2282  * Stores the given uid, gid and acl in filesystem.
2283  * Provided items in fs_sd are specified by fs_sd->sd_secinfo.
2284  *
2285  * A SMB security descriptor could contain owner, primary group,
2286  * DACL and SACL. Setting an SD should be atomic but here it has to
2287  * be done via two separate FS operations: VOP_SETATTR and
2288  * VOP_SETSECATTR. Therefore, this function has to simulate the
2289  * atomicity as well as it can.
2290  */
2291 int
2292 smb_fsop_sdwrite(smb_request_t *sr, cred_t *cr, smb_node_t *snode,
2293     smb_fssd_t *fs_sd, int overwrite)
2294 {
2295 	int error = 0;
2296 	int access = 0;
2297 	smb_attr_t set_attr;
2298 	smb_attr_t orig_attr;
2299 
2300 	ASSERT(cr);
2301 	ASSERT(fs_sd);
2302 
2303 	ASSERT(sr);
2304 	ASSERT(sr->tid_tree);
2305 	if (SMB_TREE_IS_READ_ONLY(sr))
2306 		return (EROFS);
2307 
2308 	bzero(&set_attr, sizeof (smb_attr_t));
2309 
2310 	if (fs_sd->sd_secinfo & SMB_OWNER_SECINFO) {
2311 		set_attr.sa_vattr.va_uid = fs_sd->sd_uid;
2312 		set_attr.sa_mask |= SMB_AT_UID;
2313 	}
2314 
2315 	if (fs_sd->sd_secinfo & SMB_GROUP_SECINFO) {
2316 		set_attr.sa_vattr.va_gid = fs_sd->sd_gid;
2317 		set_attr.sa_mask |= SMB_AT_GID;
2318 	}
2319 
2320 	if (fs_sd->sd_secinfo & SMB_DACL_SECINFO)
2321 		access |= WRITE_DAC;
2322 
2323 	if (fs_sd->sd_secinfo & SMB_SACL_SECINFO)
2324 		access |= ACCESS_SYSTEM_SECURITY;
2325 
2326 	if (sr->fid_ofile)
2327 		error = smb_ofile_access(sr->fid_ofile, cr, access);
2328 	else
2329 		error = smb_fsop_access(sr, cr, snode, access);
2330 
2331 	if (error)
2332 		return (EACCES);
2333 
2334 	if (set_attr.sa_mask) {
2335 		/*
2336 		 * Get the current uid, gid so if smb_fsop_aclwrite fails
2337 		 * we can revert uid, gid changes.
2338 		 *
2339 		 * We use root cred here so the operation doesn't fail
2340 		 * due to lack of permission for the user to read the attrs
2341 		 */
2342 
2343 		orig_attr.sa_mask = SMB_AT_UID | SMB_AT_GID;
2344 		error = smb_fsop_getattr(sr, kcred, snode, &orig_attr);
2345 		if (error == 0)
2346 			error = smb_fsop_setattr(sr, cr, snode, &set_attr,
2347 			    NULL);
2348 
2349 		if (error)
2350 			return (error);
2351 	}
2352 
2353 	if (fs_sd->sd_secinfo & SMB_ACL_SECINFO) {
2354 		if (overwrite == 0) {
2355 			error = smb_fsop_sdmerge(sr, snode, fs_sd);
2356 			if (error)
2357 				return (error);
2358 		}
2359 
2360 		error = smb_fsop_aclwrite(sr, cr, snode, fs_sd);
2361 		if (error) {
2362 			/*
2363 			 * Revert uid/gid changes if required.
2364 			 */
2365 			if (set_attr.sa_mask) {
2366 				orig_attr.sa_mask = set_attr.sa_mask;
2367 				(void) smb_fsop_setattr(sr, kcred, snode,
2368 				    &orig_attr, NULL);
2369 			}
2370 		}
2371 	}
2372 
2373 	return (error);
2374 }
2375 
2376 /*
2377  * smb_fsop_sdinherit
2378  *
2379  * Inherit the security descriptor from the parent container.
2380  * This function is called after FS has created the file/folder
2381  * so if this doesn't do anything it means FS inheritance is
2382  * in place.
2383  *
2384  * Do inheritance for ZFS internally.
2385  *
2386  * If we want to let ZFS does the inheritance the
2387  * following setting should be true:
2388  *
2389  *  - aclinherit = passthrough
2390  *  - aclmode = passthrough
2391  *  - smbd umask = 0777
2392  *
2393  * This will result in right effective permissions but
2394  * ZFS will always add 6 ACEs for owner, owning group
2395  * and others to be POSIX compliant. This is not what
2396  * Windows clients/users expect, so we decided that CIFS
2397  * implements Windows rules and overwrite whatever ZFS
2398  * comes up with. This way we also don't have to care
2399  * about ZFS aclinherit and aclmode settings.
2400  */
2401 static int
2402 smb_fsop_sdinherit(smb_request_t *sr, smb_node_t *dnode, smb_fssd_t *fs_sd)
2403 {
2404 	int is_dir;
2405 	acl_t *dacl = NULL;
2406 	acl_t *sacl = NULL;
2407 	ksid_t *owner_sid;
2408 	int error;
2409 
2410 	ASSERT(fs_sd);
2411 
2412 	if (sr->tid_tree->t_acltype != ACE_T) {
2413 		/*
2414 		 * No forced inheritance for non-ZFS filesystems.
2415 		 */
2416 		fs_sd->sd_secinfo = 0;
2417 		return (0);
2418 	}
2419 
2420 
2421 	/* Fetch parent directory's ACL */
2422 	error = smb_fsop_sdread(sr, kcred, dnode, fs_sd);
2423 	if (error) {
2424 		return (error);
2425 	}
2426 
2427 	is_dir = (fs_sd->sd_flags & SMB_FSSD_FLAGS_DIR);
2428 	owner_sid = crgetsid(sr->user_cr, KSID_OWNER);
2429 	ASSERT(owner_sid);
2430 	dacl = smb_fsacl_inherit(fs_sd->sd_zdacl, is_dir, SMB_DACL_SECINFO,
2431 	    owner_sid->ks_id);
2432 	sacl = smb_fsacl_inherit(fs_sd->sd_zsacl, is_dir, SMB_SACL_SECINFO,
2433 	    (uid_t)-1);
2434 
2435 	if (sacl == NULL)
2436 		fs_sd->sd_secinfo &= ~SMB_SACL_SECINFO;
2437 
2438 	smb_fsacl_free(fs_sd->sd_zdacl);
2439 	smb_fsacl_free(fs_sd->sd_zsacl);
2440 
2441 	fs_sd->sd_zdacl = dacl;
2442 	fs_sd->sd_zsacl = sacl;
2443 
2444 	return (0);
2445 }
2446 
2447 /*
2448  * smb_fsop_eaccess
2449  *
2450  * Returns the effective permission of the given credential for the
2451  * specified object.
2452  *
2453  * This is just a workaround. We need VFS/FS support for this.
2454  */
2455 void
2456 smb_fsop_eaccess(smb_request_t *sr, cred_t *cr, smb_node_t *snode,
2457     uint32_t *eaccess)
2458 {
2459 	int access = 0;
2460 	vnode_t *dir_vp;
2461 	smb_node_t *unnamed_node;
2462 
2463 	ASSERT(cr);
2464 	ASSERT(snode);
2465 	ASSERT(snode->n_magic == SMB_NODE_MAGIC);
2466 	ASSERT(snode->n_state != SMB_NODE_STATE_DESTROYING);
2467 
2468 	unnamed_node = SMB_IS_STREAM(snode);
2469 	if (unnamed_node) {
2470 		ASSERT(unnamed_node->n_magic == SMB_NODE_MAGIC);
2471 		ASSERT(unnamed_node->n_state != SMB_NODE_STATE_DESTROYING);
2472 		/*
2473 		 * Streams authorization should be performed against the
2474 		 * unnamed stream.
2475 		 */
2476 		snode = unnamed_node;
2477 	}
2478 
2479 	if (sr->tid_tree->t_flags & SMB_TREE_FLAG_ACEMASKONACCESS) {
2480 		dir_vp = (snode->dir_snode) ? snode->dir_snode->vp : NULL;
2481 		smb_vop_eaccess(snode->vp, (int *)eaccess, V_ACE_MASK, dir_vp,
2482 		    cr);
2483 		return;
2484 	}
2485 
2486 	/*
2487 	 * FS doesn't understand 32-bit mask
2488 	 */
2489 	smb_vop_eaccess(snode->vp, &access, 0, NULL, cr);
2490 
2491 	*eaccess = READ_CONTROL | FILE_READ_EA | FILE_READ_ATTRIBUTES;
2492 
2493 	if (access & VREAD)
2494 		*eaccess |= FILE_READ_DATA;
2495 
2496 	if (access & VEXEC)
2497 		*eaccess |= FILE_EXECUTE;
2498 
2499 	if (access & VWRITE)
2500 		*eaccess |= FILE_WRITE_DATA | FILE_WRITE_ATTRIBUTES |
2501 		    FILE_WRITE_EA | FILE_APPEND_DATA | FILE_DELETE_CHILD;
2502 }
2503 
2504 /*
2505  * smb_fsop_shrlock
2506  *
2507  * For the current open request, check file sharing rules
2508  * against existing opens.
2509  *
2510  * Returns NT_STATUS_SHARING_VIOLATION if there is any
2511  * sharing conflict.  Returns NT_STATUS_SUCCESS otherwise.
2512  *
2513  * Full system-wide share reservation synchronization is available
2514  * when the nbmand (non-blocking mandatory) mount option is set
2515  * (i.e. nbl_need_crit() is true) and nbmand critical regions are used.
2516  * This provides synchronization with NFS and local processes.  The
2517  * critical regions are entered in VOP_SHRLOCK()/fs_shrlock() (called
2518  * from smb_open_subr()/smb_fsop_shrlock()/smb_vop_shrlock()) as well
2519  * as the CIFS rename and delete paths.
2520  *
2521  * The CIFS server will also enter the nbl critical region in the open,
2522  * rename, and delete paths when nbmand is not set.  There is limited
2523  * coordination with local and VFS share reservations in this case.
2524  * Note that when the nbmand mount option is not set, the VFS layer
2525  * only processes advisory reservations and the delete mode is not checked.
2526  *
2527  * Whether or not the nbmand mount option is set, intra-CIFS share
2528  * checking is done in the open, delete, and rename paths using a CIFS
2529  * critical region (node->n_share_lock).
2530  */
2531 
2532 uint32_t
2533 smb_fsop_shrlock(cred_t *cr, smb_node_t *node, uint32_t uniq_fid,
2534     uint32_t desired_access, uint32_t share_access)
2535 {
2536 	int rc;
2537 
2538 	if (node->attr.sa_vattr.va_type == VDIR)
2539 		return (NT_STATUS_SUCCESS);
2540 
2541 	/* Allow access if the request is just for meta data */
2542 	if ((desired_access & FILE_DATA_ALL) == 0)
2543 		return (NT_STATUS_SUCCESS);
2544 
2545 	rc = smb_node_open_check(node, cr, desired_access, share_access);
2546 	if (rc)
2547 		return (NT_STATUS_SHARING_VIOLATION);
2548 
2549 	rc = smb_vop_shrlock(node->vp, uniq_fid, desired_access, share_access,
2550 	    cr);
2551 	if (rc)
2552 		return (NT_STATUS_SHARING_VIOLATION);
2553 
2554 	return (NT_STATUS_SUCCESS);
2555 }
2556 
2557 void
2558 smb_fsop_unshrlock(cred_t *cr, smb_node_t *node, uint32_t uniq_fid)
2559 {
2560 	if (node->attr.sa_vattr.va_type == VDIR)
2561 		return;
2562 
2563 	(void) smb_vop_unshrlock(node->vp, uniq_fid, cr);
2564 }
2565 
2566 int
2567 smb_fsop_frlock(smb_node_t *node, smb_lock_t *lock, boolean_t unlock,
2568     cred_t *cr)
2569 {
2570 	flock64_t bf;
2571 	int flag = F_REMOTELOCK;
2572 
2573 	bzero(&bf, sizeof (bf));
2574 
2575 	if (unlock) {
2576 		bf.l_type = F_UNLCK;
2577 	} else if (lock->l_type == SMB_LOCK_TYPE_READONLY) {
2578 		bf.l_type = F_RDLCK;
2579 		flag |= FREAD;
2580 	} else if (lock->l_type == SMB_LOCK_TYPE_READWRITE) {
2581 		bf.l_type = F_WRLCK;
2582 		flag |= FWRITE;
2583 	}
2584 
2585 	bf.l_start = lock->l_start;
2586 	bf.l_len = lock->l_length;
2587 	bf.l_pid = IGN_PID;
2588 	bf.l_sysid = smb_ct.cc_sysid;
2589 
2590 	return (smb_vop_frlock(node->vp, cr, flag, &bf));
2591 }
2592