Print this page
12513 SMB 3.1.1 support for server
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/uts/common/fs/smbsrv/smb_session.c
+++ new/usr/src/uts/common/fs/smbsrv/smb_session.c
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
|
↓ open down ↓ |
13 lines elided |
↑ open up ↑ |
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21 /*
22 22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23 23 * Copyright 2019 Nexenta Systems, Inc. All rights reserved.
24 + * Copyright 2020 RackTop Systems, Inc.
24 25 */
25 26
26 27 #include <sys/atomic.h>
27 28 #include <sys/synch.h>
28 29 #include <sys/types.h>
29 30 #include <sys/sdt.h>
30 31 #include <sys/random.h>
31 32 #include <smbsrv/netbios.h>
32 33 #include <smbsrv/smb2_kproto.h>
33 34 #include <smbsrv/string.h>
34 35 #include <netinet/tcp.h>
35 36
36 37 /* How many iovec we'll handle as a local array (no allocation) */
37 38 #define SMB_LOCAL_IOV_MAX 16
38 39
39 40 #define SMB_NEW_KID() atomic_inc_64_nv(&smb_kids)
40 41
41 42 static volatile uint64_t smb_kids;
42 43
43 44 /*
44 45 * We track the keepalive in minutes, but this constant
45 46 * specifies it in seconds, so convert to minutes.
46 47 */
47 48 uint32_t smb_keep_alive = SMB_PI_KEEP_ALIVE_MIN / 60;
48 49
49 50 /*
50 51 * This is the maximum time we'll allow a "session" to exist with no
51 52 * authenticated smb_user_t objects on it. This allows a client to
52 53 * logoff their "one and only" user session and then logon as some
53 54 * different user. (There are some tests that do that.) The same
54 55 * timeout mechanism also reduces the impact of clients that might
55 56 * open TCP connections but never authenticate.
56 57 */
57 58 int smb_session_auth_tmo = 30; /* sec. */
58 59
59 60 /*
60 61 * There are many smbtorture test cases that send
61 62 * racing requests, and where the tests fail if we
62 63 * don't execute them in exactly the order sent.
63 64 * These are test bugs. The protocol makes no
64 65 * guarantees about execution order of requests
65 66 * that are concurrently active.
66 67 *
67 68 * Nonetheless, smbtorture has many useful tests,
68 69 * so we have this work-around we can enable to
69 70 * basically force sequential execution. When
70 71 * enabled, insert a delay after each request is
71 72 * issued a taskq job. Enable this with mdb by
72 73 * setting smb_reader_delay to 10. Don't make it
73 74 * more than 500 or so or the server will appear
74 75 * to be so slow that tests may time out.
75 76 */
76 77 int smb_reader_delay = 0; /* mSec. */
77 78
78 79 static int smbsr_newrq_initial(smb_request_t *);
79 80
80 81 static void smb_session_cancel(smb_session_t *);
81 82 static int smb_session_reader(smb_session_t *);
82 83 static int smb_session_xprt_puthdr(smb_session_t *,
83 84 uint8_t msg_type, uint32_t msg_len,
84 85 uint8_t *dst, size_t dstlen);
85 86 static void smb_session_disconnect_trees(smb_session_t *);
86 87 static void smb_request_init_command_mbuf(smb_request_t *sr);
87 88 static void smb_session_genkey(smb_session_t *);
88 89
89 90 /*
90 91 * This (legacy) code is in support of an "idle timeout" feature,
91 92 * which is apparently incomplete. To complete it, we should:
92 93 * when the keep_alive timer expires, check whether the client
93 94 * has any open files, and if not then kill their session.
94 95 * Right now the timers are there, but nothing happens when
95 96 * a timer expires.
96 97 *
97 98 * Todo: complete logic to kill idle sessions.
98 99 *
99 100 * Only called when sv_cfg.skc_keepalive != 0
100 101 */
101 102 void
102 103 smb_session_timers(smb_server_t *sv)
103 104 {
104 105 smb_session_t *session;
105 106 smb_llist_t *ll;
106 107
107 108 ll = &sv->sv_session_list;
108 109 smb_llist_enter(ll, RW_READER);
109 110 session = smb_llist_head(ll);
110 111 while (session != NULL) {
111 112 /*
112 113 * Walk through the table and decrement each keep_alive
113 114 * timer that has not timed out yet. (keepalive > 0)
114 115 */
115 116 SMB_SESSION_VALID(session);
116 117 if (session->keep_alive &&
117 118 (session->keep_alive != (uint32_t)-1))
118 119 session->keep_alive--;
119 120
120 121 session = smb_llist_next(ll, session);
121 122 }
122 123 smb_llist_exit(ll);
123 124 }
124 125
125 126 /*
126 127 * Send a session message - supports SMB-over-NBT and SMB-over-TCP.
127 128 * If an mbuf chain is provided (optional), it will be freed and
128 129 * set to NULL -- unconditionally! (error or not)
129 130 *
130 131 * Builds a I/O vector (uio/iov) to do the send from mbufs, plus one
131 132 * segment for the 4-byte NBT header.
132 133 */
133 134 int
134 135 smb_session_send(smb_session_t *session, uint8_t nbt_type, mbuf_chain_t *mbc)
135 136 {
136 137 uio_t uio;
137 138 iovec_t local_iov[SMB_LOCAL_IOV_MAX];
138 139 iovec_t *alloc_iov = NULL;
139 140 int alloc_sz = 0;
140 141 mbuf_t *m;
141 142 uint8_t nbt_hdr[NETBIOS_HDR_SZ];
142 143 uint32_t nbt_len;
143 144 int i, nseg;
144 145 int rc;
145 146
146 147 switch (session->s_state) {
147 148 case SMB_SESSION_STATE_DISCONNECTED:
148 149 case SMB_SESSION_STATE_TERMINATED:
149 150 rc = ENOTCONN;
150 151 goto out;
151 152 default:
152 153 break;
153 154 }
154 155
155 156 /*
156 157 * Setup the IOV. First, count the number of IOV segments
157 158 * (plus one for the NBT header) and decide whether we
158 159 * need to allocate an iovec or can use local_iov;
159 160 */
160 161 bzero(&uio, sizeof (uio));
161 162 nseg = 1;
162 163 m = (mbc != NULL) ? mbc->chain : NULL;
163 164 while (m != NULL) {
164 165 nseg++;
165 166 m = m->m_next;
166 167 }
167 168 if (nseg <= SMB_LOCAL_IOV_MAX) {
168 169 uio.uio_iov = local_iov;
169 170 } else {
170 171 alloc_sz = nseg * sizeof (iovec_t);
171 172 alloc_iov = kmem_alloc(alloc_sz, KM_SLEEP);
172 173 uio.uio_iov = alloc_iov;
173 174 }
174 175 uio.uio_iovcnt = nseg;
175 176 uio.uio_segflg = UIO_SYSSPACE;
176 177 uio.uio_extflg = UIO_COPY_DEFAULT;
177 178
178 179 /*
179 180 * Build the iov list, meanwhile computing the length of
180 181 * the SMB payload (to put in the NBT header).
181 182 */
182 183 uio.uio_iov[0].iov_base = (void *)nbt_hdr;
183 184 uio.uio_iov[0].iov_len = sizeof (nbt_hdr);
184 185 i = 1;
185 186 nbt_len = 0;
186 187 m = (mbc != NULL) ? mbc->chain : NULL;
187 188 while (m != NULL) {
188 189 uio.uio_iov[i].iov_base = m->m_data;
189 190 uio.uio_iov[i++].iov_len = m->m_len;
190 191 nbt_len += m->m_len;
191 192 m = m->m_next;
192 193 }
193 194 ASSERT3S(i, ==, nseg);
194 195
195 196 /*
196 197 * Set the NBT header, set uio_resid
197 198 */
198 199 uio.uio_resid = nbt_len + NETBIOS_HDR_SZ;
199 200 rc = smb_session_xprt_puthdr(session, nbt_type, nbt_len,
200 201 nbt_hdr, NETBIOS_HDR_SZ);
201 202 if (rc != 0)
202 203 goto out;
203 204
204 205 smb_server_add_txb(session->s_server, (int64_t)uio.uio_resid);
205 206 rc = smb_net_send_uio(session, &uio);
206 207
207 208 out:
208 209 if (alloc_iov != NULL)
209 210 kmem_free(alloc_iov, alloc_sz);
210 211 if ((mbc != NULL) && (mbc->chain != NULL)) {
211 212 m_freem(mbc->chain);
212 213 mbc->chain = NULL;
213 214 mbc->flags = 0;
214 215 }
215 216 return (rc);
216 217 }
217 218
218 219 /*
219 220 * Read, process and respond to a NetBIOS session request.
220 221 *
221 222 * A NetBIOS session must be established for SMB-over-NetBIOS. Validate
222 223 * the calling and called name format and save the client NetBIOS name,
223 224 * which is used when a NetBIOS session is established to check for and
224 225 * cleanup leftover state from a previous session.
225 226 *
226 227 * Session requests are not valid for SMB-over-TCP, which is unfortunate
227 228 * because without the client name leftover state cannot be cleaned up
228 229 * if the client is behind a NAT server.
229 230 */
230 231 static int
231 232 smb_netbios_session_request(struct smb_session *session)
232 233 {
233 234 int rc;
234 235 char *calling_name;
235 236 char *called_name;
236 237 char client_name[NETBIOS_NAME_SZ];
237 238 struct mbuf_chain mbc;
238 239 char *names = NULL;
239 240 smb_wchar_t *wbuf = NULL;
240 241 smb_xprt_t hdr;
241 242 char *p;
242 243 int rc1, rc2;
243 244
244 245 session->keep_alive = smb_keep_alive;
245 246
246 247 if ((rc = smb_session_xprt_gethdr(session, &hdr)) != 0)
247 248 return (rc);
248 249
249 250 DTRACE_PROBE2(receive__session__req__xprthdr, struct session *, session,
250 251 smb_xprt_t *, &hdr);
251 252
252 253 if ((hdr.xh_type != SESSION_REQUEST) ||
253 254 (hdr.xh_length != NETBIOS_SESSION_REQUEST_DATA_LENGTH)) {
254 255 DTRACE_PROBE1(receive__session__req__failed,
255 256 struct session *, session);
256 257 return (EINVAL);
257 258 }
258 259
259 260 names = kmem_alloc(hdr.xh_length, KM_SLEEP);
260 261
261 262 if ((rc = smb_sorecv(session->sock, names, hdr.xh_length)) != 0) {
262 263 kmem_free(names, hdr.xh_length);
263 264 DTRACE_PROBE1(receive__session__req__failed,
264 265 struct session *, session);
265 266 return (rc);
266 267 }
267 268
268 269 DTRACE_PROBE3(receive__session__req__data, struct session *, session,
269 270 char *, names, uint32_t, hdr.xh_length);
270 271
271 272 called_name = &names[0];
272 273 calling_name = &names[NETBIOS_ENCODED_NAME_SZ + 2];
273 274
274 275 rc1 = netbios_name_isvalid(called_name, 0);
275 276 rc2 = netbios_name_isvalid(calling_name, client_name);
276 277
277 278 if (rc1 == 0 || rc2 == 0) {
278 279
279 280 DTRACE_PROBE3(receive__invalid__session__req,
280 281 struct session *, session, char *, names,
281 282 uint32_t, hdr.xh_length);
282 283
283 284 kmem_free(names, hdr.xh_length);
284 285 MBC_INIT(&mbc, MAX_DATAGRAM_LENGTH);
285 286 (void) smb_mbc_encodef(&mbc, "b",
286 287 DATAGRAM_INVALID_SOURCE_NAME_FORMAT);
287 288 (void) smb_session_send(session, NEGATIVE_SESSION_RESPONSE,
288 289 &mbc);
289 290 return (EINVAL);
290 291 }
291 292
292 293 DTRACE_PROBE3(receive__session__req__calling__decoded,
293 294 struct session *, session,
294 295 char *, calling_name, char *, client_name);
295 296
296 297 /*
297 298 * The client NetBIOS name is in oem codepage format.
298 299 * We need to convert it to unicode and store it in
299 300 * multi-byte format. We also need to strip off any
300 301 * spaces added as part of the NetBIOS name encoding.
301 302 */
302 303 wbuf = kmem_alloc((SMB_PI_MAX_HOST * sizeof (smb_wchar_t)), KM_SLEEP);
303 304 (void) oemtoucs(wbuf, client_name, SMB_PI_MAX_HOST, OEM_CPG_850);
304 305 (void) smb_wcstombs(session->workstation, wbuf, SMB_PI_MAX_HOST);
305 306 kmem_free(wbuf, (SMB_PI_MAX_HOST * sizeof (smb_wchar_t)));
306 307
307 308 if ((p = strchr(session->workstation, ' ')) != 0)
308 309 *p = '\0';
309 310
310 311 kmem_free(names, hdr.xh_length);
311 312 return (smb_session_send(session, POSITIVE_SESSION_RESPONSE, NULL));
312 313 }
313 314
314 315 /*
315 316 * Read 4-byte header from the session socket and build an in-memory
316 317 * session transport header. See smb_xprt_t definition for header
317 318 * format information.
318 319 *
319 320 * Direct hosted NetBIOS-less SMB (SMB-over-TCP) uses port 445. The
320 321 * first byte of the four-byte header must be 0 and the next three
321 322 * bytes contain the length of the remaining data.
322 323 */
323 324 int
324 325 smb_session_xprt_gethdr(smb_session_t *session, smb_xprt_t *ret_hdr)
325 326 {
326 327 int rc;
327 328 unsigned char buf[NETBIOS_HDR_SZ];
328 329
329 330 if ((rc = smb_sorecv(session->sock, buf, NETBIOS_HDR_SZ)) != 0)
330 331 return (rc);
331 332
332 333 switch (session->s_local_port) {
333 334 case IPPORT_NETBIOS_SSN:
334 335 ret_hdr->xh_type = buf[0];
335 336 ret_hdr->xh_length = (((uint32_t)buf[1] & 1) << 16) |
336 337 ((uint32_t)buf[2] << 8) |
337 338 ((uint32_t)buf[3]);
338 339 break;
339 340
340 341 case IPPORT_SMB:
341 342 ret_hdr->xh_type = buf[0];
342 343
343 344 if (ret_hdr->xh_type != 0) {
344 345 cmn_err(CE_WARN, "invalid NBT type (%u) from %s",
345 346 ret_hdr->xh_type, session->ip_addr_str);
346 347 return (EPROTO);
347 348 }
348 349
349 350 ret_hdr->xh_length = ((uint32_t)buf[1] << 16) |
350 351 ((uint32_t)buf[2] << 8) |
351 352 ((uint32_t)buf[3]);
352 353 break;
353 354
354 355 default:
355 356 cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
356 357 return (EPROTO);
357 358 }
358 359
359 360 return (0);
360 361 }
361 362
362 363 /*
363 364 * Encode a transport session packet header into a 4-byte buffer.
364 365 */
365 366 static int
366 367 smb_session_xprt_puthdr(smb_session_t *session,
367 368 uint8_t msg_type, uint32_t msg_length,
368 369 uint8_t *buf, size_t buflen)
369 370 {
370 371 if (buf == NULL || buflen < NETBIOS_HDR_SZ) {
371 372 return (-1);
372 373 }
373 374
374 375 switch (session->s_local_port) {
375 376 case IPPORT_NETBIOS_SSN:
376 377 /* Per RFC 1001, 1002: msg. len < 128KB */
377 378 if (msg_length >= (1 << 17))
378 379 return (-1);
379 380 buf[0] = msg_type;
380 381 buf[1] = ((msg_length >> 16) & 1);
381 382 buf[2] = (msg_length >> 8) & 0xff;
382 383 buf[3] = msg_length & 0xff;
383 384 break;
384 385
385 386 case IPPORT_SMB:
386 387 /*
387 388 * SMB over TCP is like NetBIOS but the one byte
388 389 * message type is always zero, and the length
389 390 * part is three bytes. It could actually use
390 391 * longer messages, but this is conservative.
391 392 */
392 393 if (msg_length >= (1 << 24))
393 394 return (-1);
394 395 buf[0] = msg_type;
395 396 buf[1] = (msg_length >> 16) & 0xff;
396 397 buf[2] = (msg_length >> 8) & 0xff;
397 398 buf[3] = msg_length & 0xff;
398 399 break;
399 400
400 401 default:
401 402 cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
402 403 return (-1);
403 404 }
404 405
405 406 return (0);
406 407 }
407 408
408 409 static void
409 410 smb_request_init_command_mbuf(smb_request_t *sr)
410 411 {
411 412
412 413 /*
413 414 * Setup mbuf using the buffer we allocated.
414 415 */
415 416 MBC_ATTACH_BUF(&sr->command, sr->sr_request_buf, sr->sr_req_length);
416 417
417 418 sr->command.flags = 0;
418 419 sr->command.shadow_of = NULL;
419 420 }
420 421
421 422 /*
422 423 * smb_request_cancel
423 424 *
424 425 * Handle a cancel for a request properly depending on the current request
425 426 * state.
426 427 */
427 428 void
428 429 smb_request_cancel(smb_request_t *sr)
429 430 {
430 431 void (*cancel_method)(smb_request_t *) = NULL;
431 432
432 433 mutex_enter(&sr->sr_mutex);
433 434 switch (sr->sr_state) {
434 435
435 436 case SMB_REQ_STATE_INITIALIZING:
436 437 case SMB_REQ_STATE_SUBMITTED:
437 438 case SMB_REQ_STATE_ACTIVE:
438 439 case SMB_REQ_STATE_CLEANED_UP:
439 440 sr->sr_state = SMB_REQ_STATE_CANCELLED;
440 441 break;
441 442
442 443 case SMB_REQ_STATE_WAITING_AUTH:
443 444 case SMB_REQ_STATE_WAITING_FCN1:
444 445 case SMB_REQ_STATE_WAITING_LOCK:
445 446 case SMB_REQ_STATE_WAITING_PIPE:
446 447 /*
447 448 * These are states that have a cancel_method.
448 449 * Make the state change now, to ensure that
449 450 * we call cancel_method exactly once. Do the
450 451 * method call below, after we drop sr_mutex.
451 452 * When the cancelled request thread resumes,
452 453 * it should re-take sr_mutex and set sr_state
453 454 * to CANCELLED, then return STATUS_CANCELLED.
454 455 */
455 456 sr->sr_state = SMB_REQ_STATE_CANCEL_PENDING;
456 457 cancel_method = sr->cancel_method;
457 458 VERIFY(cancel_method != NULL);
458 459 break;
459 460
460 461 case SMB_REQ_STATE_WAITING_FCN2:
461 462 case SMB_REQ_STATE_COMPLETED:
462 463 case SMB_REQ_STATE_CANCEL_PENDING:
463 464 case SMB_REQ_STATE_CANCELLED:
464 465 /*
465 466 * No action required for these states since the request
466 467 * is completing.
467 468 */
468 469 break;
469 470
470 471 case SMB_REQ_STATE_FREE:
471 472 default:
472 473 SMB_PANIC();
473 474 }
474 475 mutex_exit(&sr->sr_mutex);
475 476
476 477 if (cancel_method != NULL) {
477 478 cancel_method(sr);
478 479 }
479 480 }
480 481
481 482 /*
482 483 * smb_session_receiver
483 484 *
484 485 * Receives request from the network and dispatches them to a worker.
485 486 *
486 487 * When we receive a disconnect here, it _could_ be due to the server
487 488 * having initiated disconnect, in which case the session state will be
488 489 * SMB_SESSION_STATE_TERMINATED and we want to keep that state so later
489 490 * tear-down logic will know which side initiated.
490 491 */
491 492 void
492 493 smb_session_receiver(smb_session_t *session)
493 494 {
494 495 int rc = 0;
495 496 timeout_id_t tmo = NULL;
496 497
497 498 SMB_SESSION_VALID(session);
498 499
499 500 session->s_thread = curthread;
500 501
501 502 if (session->s_local_port == IPPORT_NETBIOS_SSN) {
502 503 rc = smb_netbios_session_request(session);
503 504 if (rc != 0) {
504 505 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
505 506 if (session->s_state != SMB_SESSION_STATE_TERMINATED)
506 507 session->s_state =
507 508 SMB_SESSION_STATE_DISCONNECTED;
508 509 smb_rwx_rwexit(&session->s_lock);
509 510 return;
510 511 }
511 512 }
512 513
513 514 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
514 515 session->s_state = SMB_SESSION_STATE_ESTABLISHED;
515 516 session->s_auth_tmo = timeout((tmo_func_t)smb_session_disconnect,
516 517 session, SEC_TO_TICK(smb_session_auth_tmo));
517 518 smb_rwx_rwexit(&session->s_lock);
518 519
519 520 (void) smb_session_reader(session);
520 521
521 522 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
522 523 if (session->s_state != SMB_SESSION_STATE_TERMINATED)
523 524 session->s_state = SMB_SESSION_STATE_DISCONNECTED;
524 525 tmo = session->s_auth_tmo;
525 526 session->s_auth_tmo = NULL;
526 527 smb_rwx_rwexit(&session->s_lock);
527 528
528 529 /* Timeout callback takes s_lock. See untimeout(9f) */
529 530 if (tmo != NULL)
530 531 (void) untimeout(tmo);
531 532
532 533 smb_soshutdown(session->sock);
533 534
534 535 DTRACE_PROBE2(session__drop, struct session *, session, int, rc);
535 536
536 537 smb_session_cancel(session);
537 538 /*
538 539 * At this point everything related to the session should have been
539 540 * cleaned up and we expect that nothing will attempt to use the
540 541 * socket.
541 542 */
542 543 }
543 544
544 545 /*
545 546 * smb_session_disconnect
546 547 *
547 548 * Server-initiated disconnect (i.e. server shutdown)
548 549 */
549 550 void
550 551 smb_session_disconnect(smb_session_t *session)
551 552 {
552 553 SMB_SESSION_VALID(session);
553 554
554 555 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
555 556 switch (session->s_state) {
556 557 case SMB_SESSION_STATE_INITIALIZED:
557 558 case SMB_SESSION_STATE_CONNECTED:
558 559 case SMB_SESSION_STATE_ESTABLISHED:
559 560 case SMB_SESSION_STATE_NEGOTIATED:
560 561 smb_soshutdown(session->sock);
561 562 session->s_state = SMB_SESSION_STATE_TERMINATED;
562 563 break;
563 564 case SMB_SESSION_STATE_DISCONNECTED:
564 565 case SMB_SESSION_STATE_TERMINATED:
565 566 break;
566 567 }
567 568 smb_rwx_rwexit(&session->s_lock);
568 569 }
569 570
570 571 /*
571 572 * Read and process SMB requests.
572 573 *
573 574 * Returns:
574 575 * 0 Success
575 576 * 1 Unable to read transport header
576 577 * 2 Invalid transport header type
577 578 * 3 Invalid SMB length (too small)
578 579 * 4 Unable to read SMB header
579 580 * 5 Invalid SMB header (bad magic number)
580 581 * 6 Unable to read SMB data
581 582 */
582 583 static int
583 584 smb_session_reader(smb_session_t *session)
584 585 {
585 586 smb_server_t *sv;
586 587 smb_request_t *sr = NULL;
587 588 smb_xprt_t hdr;
588 589 uint8_t *req_buf;
589 590 uint32_t resid;
590 591 int rc;
591 592
592 593 sv = session->s_server;
593 594
594 595 for (;;) {
595 596
596 597 rc = smb_session_xprt_gethdr(session, &hdr);
597 598 if (rc)
598 599 return (rc);
599 600
600 601 DTRACE_PROBE2(session__receive__xprthdr, session_t *, session,
601 602 smb_xprt_t *, &hdr);
602 603
603 604 if (hdr.xh_type != SESSION_MESSAGE) {
604 605 /*
605 606 * Anything other than SESSION_MESSAGE or
606 607 * SESSION_KEEP_ALIVE is an error. A SESSION_REQUEST
607 608 * may indicate a new session request but we need to
608 609 * close this session and we can treat it as an error
609 610 * here.
610 611 */
611 612 if (hdr.xh_type == SESSION_KEEP_ALIVE) {
612 613 session->keep_alive = smb_keep_alive;
613 614 continue;
614 615 }
615 616 return (EPROTO);
616 617 }
617 618
618 619 if (hdr.xh_length == 0) {
619 620 /* zero length is another form of keep alive */
620 621 session->keep_alive = smb_keep_alive;
621 622 continue;
622 623 }
623 624
624 625 if (hdr.xh_length < SMB_HEADER_LEN)
625 626 return (EPROTO);
626 627 if (hdr.xh_length > session->cmd_max_bytes)
627 628 return (EPROTO);
628 629
629 630 session->keep_alive = smb_keep_alive;
630 631
631 632 /*
632 633 * Allocate a request context, read the whole message.
633 634 * If the request alloc fails, we've disconnected
634 635 * and won't be able to send the reply anyway, so bail now.
635 636 */
636 637 if ((sr = smb_request_alloc(session, hdr.xh_length)) == NULL)
637 638 break;
638 639
639 640 req_buf = (uint8_t *)sr->sr_request_buf;
640 641 resid = hdr.xh_length;
641 642
642 643 rc = smb_sorecv(session->sock, req_buf, resid);
643 644 if (rc) {
644 645 smb_request_free(sr);
645 646 break;
646 647 }
647 648
648 649 /* accounting: received bytes */
649 650 smb_server_add_rxb(sv,
650 651 (int64_t)(hdr.xh_length + NETBIOS_HDR_SZ));
651 652
652 653 /*
653 654 * Initialize command MBC to represent the received data.
654 655 */
655 656 smb_request_init_command_mbuf(sr);
656 657
657 658 DTRACE_PROBE1(session__receive__smb, smb_request_t *, sr);
658 659
659 660 rc = session->newrq_func(sr);
660 661 sr = NULL; /* enqueued or freed */
661 662 if (rc != 0)
662 663 break;
663 664
664 665 /* See notes where this is defined (above). */
665 666 if (smb_reader_delay) {
666 667 delay(MSEC_TO_TICK(smb_reader_delay));
667 668 }
668 669 }
669 670 return (rc);
670 671 }
671 672
672 673 /*
673 674 * This is the initial handler for new smb requests, called from
674 675 * from smb_session_reader when we have not yet seen any requests.
675 676 * The first SMB request must be "negotiate", which determines
676 677 * which protocol and dialect we'll be using. That's the ONLY
677 678 * request type handled here, because with all later requests,
678 679 * we know the protocol and handle those with either the SMB1 or
679 680 * SMB2 handlers: smb1sr_post() or smb2sr_post().
680 681 * Those do NOT allow SMB negotiate, because that's only allowed
681 682 * as the first request on new session.
682 683 *
683 684 * This and other "post a request" handlers must either enqueue
684 685 * the new request for the session taskq, or smb_request_free it
685 686 * (in case we've decided to drop this connection). In this
686 687 * (special) new request handler, we always free the request.
687 688 *
688 689 * Return value is 0 for success, and anything else will
689 690 * terminate the reader thread (drop the connection).
690 691 */
691 692 static int
692 693 smbsr_newrq_initial(smb_request_t *sr)
693 694 {
694 695 uint32_t magic;
695 696 int rc = EPROTO;
696 697
697 698 mutex_enter(&sr->sr_mutex);
698 699 sr->sr_state = SMB_REQ_STATE_ACTIVE;
699 700 mutex_exit(&sr->sr_mutex);
700 701
701 702 magic = SMB_READ_PROTOCOL(sr->sr_request_buf);
702 703 if (magic == SMB_PROTOCOL_MAGIC)
703 704 rc = smb1_newrq_negotiate(sr);
704 705 if (magic == SMB2_PROTOCOL_MAGIC)
705 706 rc = smb2_newrq_negotiate(sr);
706 707
707 708 mutex_enter(&sr->sr_mutex);
708 709 sr->sr_state = SMB_REQ_STATE_COMPLETED;
709 710 mutex_exit(&sr->sr_mutex);
710 711
711 712 smb_request_free(sr);
712 713 return (rc);
713 714 }
714 715
715 716 /*
716 717 * Port will be IPPORT_NETBIOS_SSN or IPPORT_SMB.
717 718 */
718 719 smb_session_t *
719 720 smb_session_create(ksocket_t new_so, uint16_t port, smb_server_t *sv,
720 721 int family)
721 722 {
722 723 struct sockaddr_in sin;
723 724 socklen_t slen;
724 725 struct sockaddr_in6 sin6;
725 726 smb_session_t *session;
726 727 int64_t now;
727 728 uint16_t rport;
728 729
729 730 session = kmem_cache_alloc(smb_cache_session, KM_SLEEP);
730 731 bzero(session, sizeof (smb_session_t));
731 732
732 733 if (smb_idpool_constructor(&session->s_uid_pool)) {
733 734 kmem_cache_free(smb_cache_session, session);
734 735 return (NULL);
735 736 }
736 737 if (smb_idpool_constructor(&session->s_tid_pool)) {
737 738 smb_idpool_destructor(&session->s_uid_pool);
738 739 kmem_cache_free(smb_cache_session, session);
739 740 return (NULL);
740 741 }
741 742
742 743 now = ddi_get_lbolt64();
743 744
744 745 session->s_server = sv;
745 746 session->s_kid = SMB_NEW_KID();
746 747 session->s_state = SMB_SESSION_STATE_INITIALIZED;
747 748 session->native_os = NATIVE_OS_UNKNOWN;
748 749 session->opentime = now;
749 750 session->keep_alive = smb_keep_alive;
750 751 session->activity_timestamp = now;
751 752 smb_session_genkey(session);
752 753
753 754 mutex_init(&session->s_credits_mutex, NULL, MUTEX_DEFAULT, NULL);
754 755
755 756 smb_slist_constructor(&session->s_req_list, sizeof (smb_request_t),
756 757 offsetof(smb_request_t, sr_session_lnd));
757 758
758 759 smb_llist_constructor(&session->s_user_list, sizeof (smb_user_t),
759 760 offsetof(smb_user_t, u_lnd));
760 761
761 762 smb_llist_constructor(&session->s_tree_list, sizeof (smb_tree_t),
762 763 offsetof(smb_tree_t, t_lnd));
763 764
764 765 smb_llist_constructor(&session->s_xa_list, sizeof (smb_xa_t),
765 766 offsetof(smb_xa_t, xa_lnd));
766 767
767 768 smb_net_txl_constructor(&session->s_txlst);
768 769
769 770 smb_rwx_init(&session->s_lock);
770 771
771 772 session->s_srqueue = &sv->sv_srqueue;
772 773 smb_server_get_cfg(sv, &session->s_cfg);
773 774
774 775 if (new_so == NULL) {
775 776 /*
776 777 * This call is creating the special "server" session,
777 778 * used for kshare export, oplock breaks, CA import.
778 779 * CA import creates temporary trees on this session
779 780 * and those should never get map/unmap up-calls, so
780 781 * force the map/unmap flags zero on this session.
781 782 * Set a "modern" dialect for CA import too, so
782 783 * pathname parse doesn't do OS/2 stuff, etc.
783 784 */
784 785 session->s_cfg.skc_execflags = 0;
785 786 session->dialect = session->s_cfg.skc_max_protocol;
786 787 } else {
787 788 if (family == AF_INET) {
788 789 slen = sizeof (sin);
789 790 (void) ksocket_getsockname(new_so,
790 791 (struct sockaddr *)&sin, &slen, CRED());
791 792 bcopy(&sin.sin_addr,
792 793 &session->local_ipaddr.au_addr.au_ipv4,
793 794 sizeof (in_addr_t));
794 795 slen = sizeof (sin);
795 796 (void) ksocket_getpeername(new_so,
796 797 (struct sockaddr *)&sin, &slen, CRED());
797 798 bcopy(&sin.sin_addr,
798 799 &session->ipaddr.au_addr.au_ipv4,
799 800 sizeof (in_addr_t));
800 801 rport = sin.sin_port;
801 802 } else {
802 803 slen = sizeof (sin6);
803 804 (void) ksocket_getsockname(new_so,
804 805 (struct sockaddr *)&sin6, &slen, CRED());
805 806 bcopy(&sin6.sin6_addr,
806 807 &session->local_ipaddr.au_addr.au_ipv6,
807 808 sizeof (in6_addr_t));
808 809 slen = sizeof (sin6);
809 810 (void) ksocket_getpeername(new_so,
810 811 (struct sockaddr *)&sin6, &slen, CRED());
811 812 bcopy(&sin6.sin6_addr,
812 813 &session->ipaddr.au_addr.au_ipv6,
813 814 sizeof (in6_addr_t));
814 815 rport = sin6.sin6_port;
815 816 }
816 817 session->ipaddr.a_family = family;
817 818 session->local_ipaddr.a_family = family;
818 819 session->s_local_port = port;
819 820 session->s_remote_port = ntohs(rport);
820 821 session->sock = new_so;
821 822 (void) smb_inet_ntop(&session->ipaddr,
822 823 session->ip_addr_str, INET6_ADDRSTRLEN);
823 824 if (port == IPPORT_NETBIOS_SSN)
824 825 smb_server_inc_nbt_sess(sv);
825 826 else
826 827 smb_server_inc_tcp_sess(sv);
827 828 }
828 829
829 830 /*
830 831 * The initial new request handler is special,
831 832 * and only accepts negotiation requests.
832 833 */
833 834 session->newrq_func = smbsr_newrq_initial;
834 835
835 836 /* These may increase in SMB2 negotiate. */
836 837 session->cmd_max_bytes = SMB_REQ_MAX_SIZE;
837 838 session->reply_max_bytes = SMB_REQ_MAX_SIZE;
838 839
839 840 session->s_magic = SMB_SESSION_MAGIC;
840 841 return (session);
841 842 }
842 843
843 844 void
844 845 smb_session_delete(smb_session_t *session)
845 846 {
846 847
847 848 ASSERT(session->s_magic == SMB_SESSION_MAGIC);
848 849
|
↓ open down ↓ |
815 lines elided |
↑ open up ↑ |
849 850 if (session->enc_mech != NULL)
850 851 smb3_encrypt_fini(session);
851 852
852 853 if (session->sign_fini != NULL)
853 854 session->sign_fini(session);
854 855
855 856 if (session->signing.mackey != NULL) {
856 857 kmem_free(session->signing.mackey,
857 858 session->signing.mackey_len);
858 859 }
860 +
861 + if (session->preauth_mech != NULL)
862 + smb31_preauth_fini(session);
859 863
860 864 session->s_magic = 0;
861 865
862 866 smb_rwx_destroy(&session->s_lock);
863 867 smb_net_txl_destructor(&session->s_txlst);
864 868
865 869 mutex_destroy(&session->s_credits_mutex);
866 870
867 871 smb_slist_destructor(&session->s_req_list);
868 872 smb_llist_destructor(&session->s_tree_list);
869 873 smb_llist_destructor(&session->s_user_list);
870 874 smb_llist_destructor(&session->s_xa_list);
871 875
872 876 ASSERT(session->s_tree_cnt == 0);
873 877 ASSERT(session->s_file_cnt == 0);
874 878 ASSERT(session->s_dir_cnt == 0);
875 879
876 880 smb_idpool_destructor(&session->s_tid_pool);
877 881 smb_idpool_destructor(&session->s_uid_pool);
878 882 if (session->sock != NULL) {
879 883 if (session->s_local_port == IPPORT_NETBIOS_SSN)
880 884 smb_server_dec_nbt_sess(session->s_server);
881 885 else
882 886 smb_server_dec_tcp_sess(session->s_server);
883 887 smb_sodestroy(session->sock);
884 888 }
885 889 kmem_cache_free(smb_cache_session, session);
886 890 }
887 891
888 892 static void
889 893 smb_session_cancel(smb_session_t *session)
890 894 {
891 895 smb_xa_t *xa, *nextxa;
892 896
893 897 /* All the request currently being treated must be canceled. */
894 898 smb_session_cancel_requests(session, NULL, NULL);
895 899
896 900 /*
897 901 * We wait for the completion of all the requests associated with
898 902 * this session.
899 903 */
900 904 smb_slist_wait_for_empty(&session->s_req_list);
901 905
902 906 /*
903 907 * Cleanup transact state objects
904 908 */
905 909 xa = smb_llist_head(&session->s_xa_list);
906 910 while (xa) {
907 911 nextxa = smb_llist_next(&session->s_xa_list, xa);
908 912 smb_xa_close(xa);
909 913 xa = nextxa;
910 914 }
911 915
912 916 /*
913 917 * At this point the reference count of the files and directories
914 918 * should be zero. It should be possible to destroy them without
915 919 * any problem, which should trigger the destruction of other objects.
916 920 */
917 921 smb_session_logoff(session);
918 922 }
919 923
920 924 /*
921 925 * Cancel requests. If a non-null tree is specified, only requests specific
922 926 * to that tree will be cancelled. If a non-null sr is specified, that sr
923 927 * will be not be cancelled - this would typically be the caller's sr.
924 928 */
925 929 void
926 930 smb_session_cancel_requests(
927 931 smb_session_t *session,
928 932 smb_tree_t *tree,
929 933 smb_request_t *exclude_sr)
930 934 {
931 935 smb_request_t *sr;
932 936
933 937 smb_slist_enter(&session->s_req_list);
934 938 sr = smb_slist_head(&session->s_req_list);
935 939
936 940 while (sr) {
937 941 ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
938 942 if ((sr != exclude_sr) &&
939 943 (tree == NULL || sr->tid_tree == tree))
940 944 smb_request_cancel(sr);
941 945
942 946 sr = smb_slist_next(&session->s_req_list, sr);
943 947 }
944 948
945 949 smb_slist_exit(&session->s_req_list);
946 950 }
947 951
948 952 /*
949 953 * Find a user on the specified session by SMB UID.
950 954 */
951 955 smb_user_t *
952 956 smb_session_lookup_uid(smb_session_t *session, uint16_t uid)
953 957 {
954 958 return (smb_session_lookup_uid_st(session, 0, uid,
955 959 SMB_USER_STATE_LOGGED_ON));
956 960 }
957 961
958 962 /*
959 963 * Find a user on the specified session by SMB2 SSNID.
960 964 */
961 965 smb_user_t *
962 966 smb_session_lookup_ssnid(smb_session_t *session, uint64_t ssnid)
963 967 {
964 968 return (smb_session_lookup_uid_st(session, ssnid, 0,
965 969 SMB_USER_STATE_LOGGED_ON));
966 970 }
967 971
968 972 smb_user_t *
969 973 smb_session_lookup_uid_st(smb_session_t *session, uint64_t ssnid,
970 974 uint16_t uid, smb_user_state_t st)
971 975 {
972 976 smb_user_t *user;
973 977 smb_llist_t *user_list;
974 978
975 979 SMB_SESSION_VALID(session);
976 980
977 981 user_list = &session->s_user_list;
978 982 smb_llist_enter(user_list, RW_READER);
979 983
980 984 for (user = smb_llist_head(user_list);
981 985 user != NULL;
982 986 user = smb_llist_next(user_list, user)) {
983 987
984 988 SMB_USER_VALID(user);
985 989 ASSERT(user->u_session == session);
986 990
987 991 if (user->u_ssnid != ssnid && user->u_uid != uid)
988 992 continue;
989 993
990 994 mutex_enter(&user->u_mutex);
991 995 if (user->u_state == st) {
992 996 // smb_user_hold_internal(user);
993 997 user->u_refcnt++;
994 998 mutex_exit(&user->u_mutex);
995 999 break;
996 1000 }
997 1001 mutex_exit(&user->u_mutex);
998 1002 }
999 1003
1000 1004 smb_llist_exit(user_list);
1001 1005 return (user);
1002 1006 }
1003 1007
1004 1008 /*
1005 1009 * Find a tree by tree-id.
1006 1010 */
1007 1011 smb_tree_t *
1008 1012 smb_session_lookup_tree(
1009 1013 smb_session_t *session,
1010 1014 uint16_t tid)
1011 1015 {
1012 1016 smb_tree_t *tree;
1013 1017
1014 1018 SMB_SESSION_VALID(session);
1015 1019
1016 1020 smb_llist_enter(&session->s_tree_list, RW_READER);
1017 1021 tree = smb_llist_head(&session->s_tree_list);
1018 1022
1019 1023 while (tree) {
1020 1024 ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
1021 1025 ASSERT(tree->t_session == session);
1022 1026
1023 1027 if (tree->t_tid == tid) {
1024 1028 if (smb_tree_hold(tree)) {
1025 1029 smb_llist_exit(&session->s_tree_list);
1026 1030 return (tree);
1027 1031 } else {
1028 1032 smb_llist_exit(&session->s_tree_list);
1029 1033 return (NULL);
1030 1034 }
1031 1035 }
1032 1036
1033 1037 tree = smb_llist_next(&session->s_tree_list, tree);
1034 1038 }
1035 1039
1036 1040 smb_llist_exit(&session->s_tree_list);
1037 1041 return (NULL);
1038 1042 }
1039 1043
1040 1044 /*
1041 1045 * Disconnect all trees that match the specified client process-id.
1042 1046 * Used by the SMB1 "process exit" request.
1043 1047 */
1044 1048 void
1045 1049 smb_session_close_pid(
1046 1050 smb_session_t *session,
1047 1051 uint32_t pid)
1048 1052 {
1049 1053 smb_llist_t *tree_list = &session->s_tree_list;
1050 1054 smb_tree_t *tree;
1051 1055
1052 1056 smb_llist_enter(tree_list, RW_READER);
1053 1057
1054 1058 tree = smb_llist_head(tree_list);
1055 1059 while (tree) {
1056 1060 if (smb_tree_hold(tree)) {
1057 1061 smb_tree_close_pid(tree, pid);
1058 1062 smb_tree_release(tree);
1059 1063 }
1060 1064 tree = smb_llist_next(tree_list, tree);
1061 1065 }
1062 1066
1063 1067 smb_llist_exit(tree_list);
1064 1068 }
1065 1069
1066 1070 static void
1067 1071 smb_session_tree_dtor(void *arg)
1068 1072 {
1069 1073 smb_tree_t *tree = arg;
1070 1074
1071 1075 smb_tree_disconnect(tree, B_TRUE);
1072 1076 /* release the ref acquired during the traversal loop */
1073 1077 smb_tree_release(tree);
1074 1078 }
1075 1079
1076 1080
1077 1081 /*
1078 1082 * Disconnect all trees that this user has connected.
1079 1083 */
1080 1084 void
1081 1085 smb_session_disconnect_owned_trees(
1082 1086 smb_session_t *session,
1083 1087 smb_user_t *owner)
1084 1088 {
1085 1089 smb_tree_t *tree;
1086 1090 smb_llist_t *tree_list = &session->s_tree_list;
1087 1091
1088 1092 SMB_SESSION_VALID(session);
1089 1093 SMB_USER_VALID(owner);
1090 1094
1091 1095 smb_llist_enter(tree_list, RW_READER);
1092 1096
1093 1097 tree = smb_llist_head(tree_list);
1094 1098 while (tree) {
1095 1099 if ((tree->t_owner == owner) &&
1096 1100 smb_tree_hold(tree)) {
1097 1101 /*
1098 1102 * smb_tree_hold() succeeded, hence we are in state
1099 1103 * SMB_TREE_STATE_CONNECTED; schedule this tree
1100 1104 * for disconnect after smb_llist_exit because
1101 1105 * the "unmap exec" up-call can block, and we'd
1102 1106 * rather not block with the tree list locked.
1103 1107 */
1104 1108 smb_llist_post(tree_list, tree, smb_session_tree_dtor);
1105 1109 }
1106 1110 tree = smb_llist_next(tree_list, tree);
1107 1111 }
1108 1112
1109 1113 /* drop the lock and flush the dtor queue */
1110 1114 smb_llist_exit(tree_list);
1111 1115 }
1112 1116
1113 1117 /*
1114 1118 * Disconnect all trees that this user has connected.
1115 1119 */
1116 1120 static void
1117 1121 smb_session_disconnect_trees(
1118 1122 smb_session_t *session)
1119 1123 {
1120 1124 smb_llist_t *tree_list = &session->s_tree_list;
1121 1125 smb_tree_t *tree;
1122 1126
1123 1127 smb_llist_enter(tree_list, RW_READER);
1124 1128
1125 1129 tree = smb_llist_head(tree_list);
1126 1130 while (tree) {
1127 1131 if (smb_tree_hold(tree)) {
1128 1132 smb_llist_post(tree_list, tree,
1129 1133 smb_session_tree_dtor);
1130 1134 }
1131 1135 tree = smb_llist_next(tree_list, tree);
1132 1136 }
1133 1137
1134 1138 /* drop the lock and flush the dtor queue */
1135 1139 smb_llist_exit(tree_list);
1136 1140 }
1137 1141
1138 1142 /*
1139 1143 * Variant of smb_session_tree_dtor that also
1140 1144 * cancels requests using this tree.
1141 1145 */
1142 1146 static void
1143 1147 smb_session_tree_kill(void *arg)
1144 1148 {
1145 1149 smb_tree_t *tree = arg;
1146 1150
1147 1151 SMB_TREE_VALID(tree);
1148 1152
1149 1153 smb_tree_disconnect(tree, B_TRUE);
1150 1154 smb_session_cancel_requests(tree->t_session, tree, NULL);
1151 1155
1152 1156 /* release the ref acquired during the traversal loop */
1153 1157 smb_tree_release(tree);
1154 1158 }
1155 1159
1156 1160 /*
1157 1161 * Disconnect all trees that match the specified share name,
1158 1162 * and kill requests using those trees.
1159 1163 */
1160 1164 void
1161 1165 smb_session_disconnect_share(
1162 1166 smb_session_t *session,
1163 1167 const char *sharename)
1164 1168 {
1165 1169 smb_llist_t *ll;
1166 1170 smb_tree_t *tree;
1167 1171
1168 1172 SMB_SESSION_VALID(session);
1169 1173
1170 1174 ll = &session->s_tree_list;
1171 1175 smb_llist_enter(ll, RW_READER);
1172 1176
1173 1177 for (tree = smb_llist_head(ll);
1174 1178 tree != NULL;
1175 1179 tree = smb_llist_next(ll, tree)) {
1176 1180
1177 1181 SMB_TREE_VALID(tree);
1178 1182 ASSERT(tree->t_session == session);
1179 1183
1180 1184 if (smb_strcasecmp(tree->t_sharename, sharename, 0) != 0)
1181 1185 continue;
1182 1186
1183 1187 if (smb_tree_hold(tree)) {
1184 1188 smb_llist_post(ll, tree,
1185 1189 smb_session_tree_kill);
1186 1190 }
1187 1191 }
1188 1192
1189 1193 smb_llist_exit(ll);
1190 1194 }
1191 1195
1192 1196 /*
1193 1197 * Logoff all users associated with the specified session.
1194 1198 *
1195 1199 * This is called for both server-initiated disconnect
1196 1200 * (SMB_SESSION_STATE_TERMINATED) and client-initiated
1197 1201 * disconnect (SMB_SESSION_STATE_DISCONNECTED).
1198 1202 * If client-initiated, save durable handles.
1199 1203 */
1200 1204 void
1201 1205 smb_session_logoff(smb_session_t *session)
1202 1206 {
1203 1207 smb_llist_t *ulist;
1204 1208 smb_user_t *user;
1205 1209
1206 1210 SMB_SESSION_VALID(session);
1207 1211
1208 1212 top:
1209 1213 ulist = &session->s_user_list;
1210 1214 smb_llist_enter(ulist, RW_READER);
1211 1215
1212 1216 user = smb_llist_head(ulist);
1213 1217 while (user) {
1214 1218 SMB_USER_VALID(user);
1215 1219 ASSERT(user->u_session == session);
1216 1220
1217 1221 mutex_enter(&user->u_mutex);
1218 1222 switch (user->u_state) {
1219 1223 case SMB_USER_STATE_LOGGING_ON:
1220 1224 case SMB_USER_STATE_LOGGED_ON:
1221 1225 // smb_user_hold_internal(user);
1222 1226 user->u_refcnt++;
1223 1227 mutex_exit(&user->u_mutex);
1224 1228 smb_user_logoff(user);
1225 1229 smb_user_release(user);
1226 1230 break;
1227 1231
1228 1232 case SMB_USER_STATE_LOGGED_OFF:
1229 1233 case SMB_USER_STATE_LOGGING_OFF:
1230 1234 mutex_exit(&user->u_mutex);
1231 1235 break;
1232 1236
1233 1237 default:
1234 1238 mutex_exit(&user->u_mutex);
1235 1239 ASSERT(0);
1236 1240 break;
1237 1241 }
1238 1242
1239 1243 user = smb_llist_next(ulist, user);
1240 1244 }
1241 1245
1242 1246 /* Needed below (Was the list empty?) */
1243 1247 user = smb_llist_head(ulist);
1244 1248
1245 1249 smb_llist_exit(ulist);
1246 1250
1247 1251 /*
1248 1252 * It's possible for user objects to remain due to references
1249 1253 * obtained via smb_server_lookup_ssnid(), when an SMB2
1250 1254 * session setup is destroying a previous session.
1251 1255 *
1252 1256 * Wait for user objects to clear out (last refs. go away,
1253 1257 * then smb_user_delete takes them out of the list). When
1254 1258 * the last user object is removed, the session state is
1255 1259 * set to SHUTDOWN and s_lock is signaled.
1256 1260 *
1257 1261 * Not all places that call smb_user_release necessarily
1258 1262 * flush the delete queue, so after we wait for the list
1259 1263 * to empty out, go back to the top and recheck the list
1260 1264 * delete queue to make sure smb_user_delete happens.
1261 1265 */
1262 1266 if (user == NULL) {
1263 1267 /* User list is empty. */
1264 1268 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
1265 1269 session->s_state = SMB_SESSION_STATE_SHUTDOWN;
1266 1270 smb_rwx_rwexit(&session->s_lock);
1267 1271 } else {
1268 1272 smb_rwx_rwenter(&session->s_lock, RW_READER);
1269 1273 if (session->s_state != SMB_SESSION_STATE_SHUTDOWN) {
1270 1274 (void) smb_rwx_cvwait(&session->s_lock,
1271 1275 MSEC_TO_TICK(200));
1272 1276 smb_rwx_rwexit(&session->s_lock);
1273 1277 goto top;
1274 1278 }
1275 1279 smb_rwx_rwexit(&session->s_lock);
1276 1280 }
1277 1281 ASSERT(session->s_state == SMB_SESSION_STATE_SHUTDOWN);
1278 1282
1279 1283 /*
1280 1284 * User list should be empty now.
1281 1285 */
1282 1286 #ifdef DEBUG
1283 1287 if (ulist->ll_count != 0) {
1284 1288 cmn_err(CE_WARN, "user list not empty?");
1285 1289 debug_enter("s_user_list");
1286 1290 }
1287 1291 #endif
1288 1292
1289 1293 /*
1290 1294 * User logoff happens first so we'll set preserve_opens
1291 1295 * for client-initiated disconnect. When that's done
1292 1296 * there should be no trees left, but check anyway.
1293 1297 */
1294 1298 smb_session_disconnect_trees(session);
1295 1299 }
1296 1300
1297 1301 /*
1298 1302 * Copy the session workstation/client name to buf. If the workstation
1299 1303 * is an empty string (which it will be on TCP connections), use the
1300 1304 * client IP address.
1301 1305 */
1302 1306 void
1303 1307 smb_session_getclient(smb_session_t *sn, char *buf, size_t buflen)
1304 1308 {
1305 1309
1306 1310 *buf = '\0';
1307 1311
1308 1312 if (sn->workstation[0] != '\0') {
1309 1313 (void) strlcpy(buf, sn->workstation, buflen);
1310 1314 return;
1311 1315 }
1312 1316
1313 1317 (void) strlcpy(buf, sn->ip_addr_str, buflen);
1314 1318 }
1315 1319
1316 1320 /*
1317 1321 * Check whether or not the specified client name is the client of this
1318 1322 * session. The name may be in UNC format (\\CLIENT).
1319 1323 *
1320 1324 * A workstation/client name is setup on NBT connections as part of the
1321 1325 * NetBIOS session request but that isn't available on TCP connections.
1322 1326 * If the session doesn't have a client name we typically return the
1323 1327 * client IP address as the workstation name on MSRPC requests. So we
1324 1328 * check for the IP address here in addition to the workstation name.
1325 1329 */
1326 1330 boolean_t
1327 1331 smb_session_isclient(smb_session_t *sn, const char *client)
1328 1332 {
1329 1333
1330 1334 client += strspn(client, "\\");
1331 1335
1332 1336 if (smb_strcasecmp(client, sn->workstation, 0) == 0)
1333 1337 return (B_TRUE);
1334 1338
1335 1339 if (smb_strcasecmp(client, sn->ip_addr_str, 0) == 0)
1336 1340 return (B_TRUE);
1337 1341
1338 1342 return (B_FALSE);
1339 1343 }
1340 1344
1341 1345 /*
1342 1346 * smb_request_alloc
1343 1347 *
1344 1348 * Allocate an smb_request_t structure from the kmem_cache. Partially
1345 1349 * initialize the found/new request.
1346 1350 *
1347 1351 * Returns pointer to a request, or NULL if the session state is
1348 1352 * one in which new requests are no longer allowed.
1349 1353 */
1350 1354 smb_request_t *
1351 1355 smb_request_alloc(smb_session_t *session, int req_length)
1352 1356 {
1353 1357 smb_request_t *sr;
1354 1358
1355 1359 ASSERT(session->s_magic == SMB_SESSION_MAGIC);
1356 1360 ASSERT(req_length <= session->cmd_max_bytes);
1357 1361
1358 1362 sr = kmem_cache_alloc(smb_cache_request, KM_SLEEP);
1359 1363
1360 1364 /*
1361 1365 * Future: Use constructor to pre-initialize some fields. For now
1362 1366 * there are so many fields that it is easiest just to zero the
1363 1367 * whole thing and start over.
1364 1368 */
1365 1369 bzero(sr, sizeof (smb_request_t));
1366 1370
1367 1371 mutex_init(&sr->sr_mutex, NULL, MUTEX_DEFAULT, NULL);
1368 1372 smb_srm_init(sr);
1369 1373 sr->session = session;
1370 1374 sr->sr_server = session->s_server;
1371 1375 sr->sr_gmtoff = session->s_server->si_gmtoff;
1372 1376 sr->sr_cfg = &session->s_cfg;
1373 1377 sr->command.max_bytes = req_length;
1374 1378 sr->reply.max_bytes = session->reply_max_bytes;
1375 1379 sr->sr_req_length = req_length;
1376 1380 if (req_length)
1377 1381 sr->sr_request_buf = kmem_alloc(req_length, KM_SLEEP);
1378 1382 sr->sr_magic = SMB_REQ_MAGIC;
1379 1383 sr->sr_state = SMB_REQ_STATE_INITIALIZING;
1380 1384
1381 1385 /*
1382 1386 * Only allow new SMB requests in some states.
1383 1387 */
1384 1388 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
1385 1389 switch (session->s_state) {
1386 1390 case SMB_SESSION_STATE_CONNECTED:
1387 1391 case SMB_SESSION_STATE_INITIALIZED:
1388 1392 case SMB_SESSION_STATE_ESTABLISHED:
1389 1393 case SMB_SESSION_STATE_NEGOTIATED:
1390 1394 smb_slist_insert_tail(&session->s_req_list, sr);
1391 1395 break;
1392 1396
1393 1397 default:
1394 1398 ASSERT(0);
1395 1399 /* FALLTHROUGH */
1396 1400 case SMB_SESSION_STATE_DISCONNECTED:
1397 1401 case SMB_SESSION_STATE_SHUTDOWN:
1398 1402 case SMB_SESSION_STATE_TERMINATED:
1399 1403 /* Disallow new requests in these states. */
1400 1404 if (sr->sr_request_buf)
1401 1405 kmem_free(sr->sr_request_buf, sr->sr_req_length);
1402 1406 sr->session = NULL;
1403 1407 sr->sr_magic = 0;
1404 1408 mutex_destroy(&sr->sr_mutex);
1405 1409 kmem_cache_free(smb_cache_request, sr);
1406 1410 sr = NULL;
1407 1411 break;
1408 1412 }
1409 1413 smb_rwx_rwexit(&session->s_lock);
1410 1414
1411 1415 return (sr);
1412 1416 }
1413 1417
1414 1418 /*
1415 1419 * smb_request_free
1416 1420 *
1417 1421 * release the memories which have been allocated for a smb request.
1418 1422 */
1419 1423 void
1420 1424 smb_request_free(smb_request_t *sr)
1421 1425 {
1422 1426 ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
1423 1427 ASSERT(sr->session);
1424 1428 ASSERT(sr->r_xa == NULL);
1425 1429
1426 1430 if (sr->fid_ofile != NULL) {
1427 1431 smb_ofile_release(sr->fid_ofile);
1428 1432 }
1429 1433
1430 1434 if (sr->tid_tree != NULL)
1431 1435 smb_tree_release(sr->tid_tree);
1432 1436
1433 1437 if (sr->uid_user != NULL)
1434 1438 smb_user_release(sr->uid_user);
1435 1439
1436 1440 if (sr->tform_ssn != NULL)
1437 1441 smb_user_release(sr->tform_ssn);
1438 1442
1439 1443 /*
1440 1444 * The above may have left work on the delete queues
1441 1445 */
1442 1446 smb_llist_flush(&sr->session->s_tree_list);
1443 1447 smb_llist_flush(&sr->session->s_user_list);
1444 1448
1445 1449 smb_slist_remove(&sr->session->s_req_list, sr);
1446 1450
1447 1451 sr->session = NULL;
1448 1452
1449 1453 smb_srm_fini(sr);
1450 1454
1451 1455 if (sr->sr_request_buf)
1452 1456 kmem_free(sr->sr_request_buf, sr->sr_req_length);
1453 1457 if (sr->command.chain)
1454 1458 m_freem(sr->command.chain);
1455 1459 if (sr->reply.chain)
1456 1460 m_freem(sr->reply.chain);
1457 1461 if (sr->raw_data.chain)
1458 1462 m_freem(sr->raw_data.chain);
1459 1463
1460 1464 sr->sr_magic = 0;
1461 1465 mutex_destroy(&sr->sr_mutex);
1462 1466 kmem_cache_free(smb_cache_request, sr);
1463 1467 }
1464 1468
1465 1469 boolean_t
1466 1470 smb_session_oplocks_enable(smb_session_t *session)
1467 1471 {
1468 1472 SMB_SESSION_VALID(session);
1469 1473 if (session->s_cfg.skc_oplock_enable == 0)
1470 1474 return (B_FALSE);
1471 1475 else
1472 1476 return (B_TRUE);
1473 1477 }
1474 1478
1475 1479 boolean_t
1476 1480 smb_session_levelII_oplocks(smb_session_t *session)
1477 1481 {
1478 1482 SMB_SESSION_VALID(session);
1479 1483
1480 1484 /* Older clients only do Level II oplocks if negotiated. */
1481 1485 if ((session->capabilities & CAP_LEVEL_II_OPLOCKS) != 0)
1482 1486 return (B_TRUE);
1483 1487
1484 1488 return (B_FALSE);
1485 1489 }
1486 1490
1487 1491 static void
1488 1492 smb_session_genkey(smb_session_t *session)
1489 1493 {
1490 1494 uint8_t tmp_key[SMB_CHALLENGE_SZ];
1491 1495
1492 1496 (void) random_get_pseudo_bytes(tmp_key, SMB_CHALLENGE_SZ);
1493 1497 bcopy(tmp_key, &session->challenge_key, SMB_CHALLENGE_SZ);
1494 1498 session->challenge_len = SMB_CHALLENGE_SZ;
1495 1499
1496 1500 (void) random_get_pseudo_bytes(tmp_key, 4);
1497 1501 session->sesskey = tmp_key[0] | tmp_key[1] << 8 |
1498 1502 tmp_key[2] << 16 | tmp_key[3] << 24;
1499 1503 }
|
↓ open down ↓ |
631 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX