1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2016 Nexenta Systems, Inc. All rights reserved.
25 */
26
27 /*
28 * SMB requests.
29 *
30 * Request
31 * Header
32 * Magic 0xFF 'S' 'M' 'B'
33 * smb_com a byte, the "first" command
34 * Error a 4-byte union, ignored in a request
35 * smb_flg a one byte set of eight flags
36 * smb_flg2 a two byte set of 16 flags
37 * . twelve reserved bytes, have a role
38 * in connectionless transports (IPX, UDP?)
39 * smb_tid a 16-bit tree ID, a mount point sorta,
40 * 0xFFFF is this command does not have
41 * or require a tree context
42 * smb_pid a 16-bit process ID
43 * smb_uid a 16-bit user ID, specific to this "session"
44 * and mapped to a system (bona-fide) UID
45 * smb_mid a 16-bit multiplex ID, used to differentiate
46 * multiple simultaneous requests from the same
47 * process (pid) (ref RPC "xid")
48 *
49 * Chained (AndX) commands (0 or more)
50 * smb_wct a byte, number of 16-bit words containing
51 * command parameters, min 2 for chained command
52 * andx_com a byte, the "next" command, 0xFF for none
53 * . an unused byte
54 * andx_off a 16-bit offset, byte displacement from &Magic
55 * to the smb_wct field of the "next" command,
56 * ignore if andx_com is 0xFF, s/b 0 if no next
57 * smb_vwv[] 0 or more 16-bit (sorta) parameters for
58 * "this" command (i.e. smb_com if this is the
59 * first parameters, or the andx_com of the just
60 * previous block.
61 * smb_bcc a 16-bit count of smb_data[] bytes
62 * smb_data[] 0 or more bytes, format specific to commands
63 * padding[] Optional padding
64 *
65 * Last command
66 * smb_wct a byte, number of 16-bit words containing
67 * command parameters, min 0 for chained command
68 * smb_vwv[] 0 or more 16-bit (sorta) parameters for
69 * "this" command (i.e. smb_com if this is the
70 * first parameters, or the andx_com of the just
71 * previous block.
72 * smb_bcc a 16-bit count of smb_data[] bytes
73 * smb_data[] 0 or more bytes, format specific to commands
74 *
75 * Reply
76 * Header
77 * Magic 0xFF 'S' 'M' 'B'
78 * smb_com a byte, the "first" command, corresponds
79 * to request
80 * Error a 4-byte union, coding depends on dialect in use
81 * for "DOS" errors
82 * a byte for error class
83 * an unused byte
84 * a 16-bit word for error code
85 * for "NT" errors
86 * a 32-bit error code which
87 * is a packed class and specifier
88 * for "OS/2" errors
89 * I don't know
90 * The error information is specific to the
91 * last command in the reply chain.
92 * smb_flg a one byte set of eight flags, 0x80 bit set
93 * indicating this message is a reply
94 * smb_flg2 a two byte set of 16 flags
95 * . twelve reserved bytes, have a role
96 * in connectionless transports (IPX, UDP?)
97 * smb_tid a 16-bit tree ID, a mount point sorta,
98 * should be the same as the request
99 * smb_pid a 16-bit process ID, MUST BE the same as request
100 * smb_uid a 16-bit user ID, specific to this "session"
101 * and mapped to a system (bona-fide) UID,
102 * should be the same as request
103 * smb_mid a 16-bit multiplex ID, used to differentiate
104 * multiple simultaneous requests from the same
105 * process (pid) (ref RPC "xid"), MUST BE the
106 * same as request
107 * padding[] Optional padding
108 *
109 * Chained (AndX) commands (0 or more)
110 * smb_wct a byte, number of 16-bit words containing
111 * command parameters, min 2 for chained command,
112 * andx_com a byte, the "next" command, 0xFF for none,
113 * corresponds to request, if this is the chained
114 * command that had an error set to 0xFF
115 * . an unused byte
116 * andx_off a 16-bit offset, byte displacement from &Magic
117 * to the smb_wct field of the "next" command,
118 * ignore if andx_com is 0xFF, s/b 0 if no next
119 * smb_vwv[] 0 or more 16-bit (sorta) parameters for
120 * "this" command (i.e. smb_com if this is the
121 * first parameters, or the andx_com of the just
122 * previous block. Empty if an error.
123 * smb_bcc a 16-bit count of smb_data[] bytes
124 * smb_data[] 0 or more bytes, format specific to commands
125 * empty if an error.
126 *
127 * Last command
128 * smb_wct a byte, number of 16-bit words containing
129 * command parameters, min 0 for chained command
130 * smb_vwv[] 0 or more 16-bit (sorta) parameters for
131 * "this" command (i.e. smb_com if this is the
132 * first parameters, or the andx_com of the just
133 * previous block, empty if an error.
134 * smb_bcc a 16-bit count of smb_data[] bytes
135 * smb_data[] 0 or more bytes, format specific to commands,
136 * empty if an error.
137 */
138
139 #include <smbsrv/smb_kproto.h>
140 #include <smbsrv/smb_kstat.h>
141 #include <sys/sdt.h>
142 #include <sys/spl.h>
143
144 static int is_andx_com(unsigned char);
145 static int smbsr_check_result(struct smb_request *, int, int);
146 static void smb1_tq_work(void *);
147
148 static const smb_disp_entry_t const
149 smb_disp_table[SMB_COM_NUM] = {
150 { "SmbCreateDirectory", SMB_SDT_OPS(create_directory), /* 0x00 000 */
151 0x00, PC_NETWORK_PROGRAM_1_0 },
152 { "SmbDeleteDirectory", SMB_SDT_OPS(delete_directory), /* 0x01 001 */
153 0x01, PC_NETWORK_PROGRAM_1_0 },
154 { "SmbOpen", SMB_SDT_OPS(open), /* 0x02 002 */
155 0x02, PC_NETWORK_PROGRAM_1_0 },
156 { "SmbCreate", SMB_SDT_OPS(create), /* 0x03 003 */
157 0x03, PC_NETWORK_PROGRAM_1_0 },
158 { "SmbClose", SMB_SDT_OPS(close), /* 0x04 004 */
159 0x04, PC_NETWORK_PROGRAM_1_0 },
160 { "SmbFlush", SMB_SDT_OPS(flush), /* 0x05 005 */
161 0x05, PC_NETWORK_PROGRAM_1_0 },
162 { "SmbDelete", SMB_SDT_OPS(delete), /* 0x06 006 */
163 0x06, PC_NETWORK_PROGRAM_1_0 },
164 { "SmbRename", SMB_SDT_OPS(rename), /* 0x07 007 */
165 0x07, PC_NETWORK_PROGRAM_1_0 },
166 { "SmbQueryInformation", SMB_SDT_OPS(query_information), /* 0x08 008 */
167 0x08, PC_NETWORK_PROGRAM_1_0 },
168 { "SmbSetInformation", SMB_SDT_OPS(set_information), /* 0x09 009 */
169 0x09, PC_NETWORK_PROGRAM_1_0 },
170 { "SmbRead", SMB_SDT_OPS(read), /* 0x0A 010 */
171 0x0A, PC_NETWORK_PROGRAM_1_0, SDDF_READOP },
172 { "SmbWrite", SMB_SDT_OPS(write), /* 0x0B 011 */
173 0x0B, PC_NETWORK_PROGRAM_1_0, SDDF_WRITEOP },
174 { "SmbLockByteRange", SMB_SDT_OPS(lock_byte_range), /* 0x0C 012 */
175 0x0C, PC_NETWORK_PROGRAM_1_0 },
176 { "SmbUnlockByteRange", SMB_SDT_OPS(unlock_byte_range), /* 0x0D 013 */
177 0x0D, PC_NETWORK_PROGRAM_1_0 },
178 { "SmbCreateTemporary", SMB_SDT_OPS(create_temporary), /* 0x0E 014 */
179 0x0E, PC_NETWORK_PROGRAM_1_0 },
180 { "SmbCreateNew", SMB_SDT_OPS(create_new), /* 0x0F 015 */
181 0x0F, PC_NETWORK_PROGRAM_1_0 },
182 { "SmbCheckDirectory", SMB_SDT_OPS(check_directory), /* 0x10 016 */
183 0x10, PC_NETWORK_PROGRAM_1_0 },
184 { "SmbProcessExit", SMB_SDT_OPS(process_exit), /* 0x11 017 */
185 0x11, PC_NETWORK_PROGRAM_1_0,
186 SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
187 { "SmbSeek", SMB_SDT_OPS(seek), /* 0x12 018 */
188 0x12, PC_NETWORK_PROGRAM_1_0 },
189 { "SmbLockAndRead", SMB_SDT_OPS(lock_and_read), /* 0x13 019 */
190 0x13, LANMAN1_0, SDDF_READOP},
191 { "SmbWriteAndUnlock", SMB_SDT_OPS(write_and_unlock), /* 0x14 020 */
192 0x14, LANMAN1_0, SDDF_WRITEOP },
193 { "Invalid", SMB_SDT_OPS(invalid), 0x15, 0 }, /* 0x15 021 */
194 { "Invalid", SMB_SDT_OPS(invalid), 0x16, 0 }, /* 0x16 022 */
195 { "Invalid", SMB_SDT_OPS(invalid), 0x17, 0 }, /* 0x17 023 */
196 { "Invalid", SMB_SDT_OPS(invalid), 0x18, 0 }, /* 0x18 024 */
197 { "Invalid", SMB_SDT_OPS(invalid), 0x19, 0 }, /* 0x19 025 */
198 { "SmbReadRaw", SMB_SDT_OPS(read_raw), /* 0x1A 026 */
199 0x1A, LANMAN1_0 },
200 { "Invalid", SMB_SDT_OPS(invalid), 0x1B, 0 }, /* 0x1B 027 */
201 { "Invalid", SMB_SDT_OPS(invalid), 0x1C, 0 }, /* 0x1C 028 */
202 { "SmbWriteRaw", SMB_SDT_OPS(write_raw), /* 0x1D 029 */
203 0x1D, LANMAN1_0 },
204 { "Invalid", SMB_SDT_OPS(invalid), 0x1E, 0 }, /* 0x1E 030 */
205 { "Invalid", SMB_SDT_OPS(invalid), 0x1F, 0 }, /* 0x1F 031 */
206 { "Invalid", SMB_SDT_OPS(invalid), 0x20, 0 }, /* 0x20 032 */
207 { "Invalid", SMB_SDT_OPS(invalid), 0x21, 0 }, /* 0x21 033 */
208 { "SmbSetInformation2", SMB_SDT_OPS(set_information2), /* 0x22 034 */
209 0x22, LANMAN1_0 },
210 { "SmbQueryInformation2",
211 SMB_SDT_OPS(query_information2), /* 0x23 035 */
212 0x23, LANMAN1_0 },
213 { "SmbLockingX", SMB_SDT_OPS(locking_andx), /* 0x24 036 */
214 0x24, LANMAN1_0 },
215 { "SmbTransaction", SMB_SDT_OPS(transaction), /* 0x25 037 */
216 0x25, LANMAN1_0 },
217 { "SmbTransactionSecondary",
218 SMB_SDT_OPS(transaction_secondary), /* 0x26 038 */
219 0x26, LANMAN1_0 },
220 { "SmbIoctl", SMB_SDT_OPS(ioctl), /* 0x27 039 */
221 0x27, LANMAN1_0 },
222 { "Invalid", SMB_SDT_OPS(invalid), 0x28, 0 }, /* 0x28 040 */
223 { "Invalid", SMB_SDT_OPS(invalid), 0x29, 0 }, /* 0x29 041 */
224 { "Invalid", SMB_SDT_OPS(invalid), 0x2A, 0 }, /* 0x2A 042 */
225 { "SmbEcho", SMB_SDT_OPS(echo), /* 0x2B 043 */
226 0x2B, LANMAN1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
227 { "SmbWriteAndClose", SMB_SDT_OPS(write_and_close), /* 0x2C 044 */
228 0x2C, LANMAN1_0, SDDF_WRITEOP },
229 { "SmbOpenX", SMB_SDT_OPS(open_andx), /* 0x2D 045 */
230 0x2D, LANMAN1_0 },
231 { "SmbReadX", SMB_SDT_OPS(read_andx), /* 0x2E 046 */
232 0x2E, LANMAN1_0, SDDF_READOP },
233 { "SmbWriteX", SMB_SDT_OPS(write_andx), /* 0x2F 047 */
234 0x2F, LANMAN1_0, SDDF_WRITEOP },
235 { "Invalid", SMB_SDT_OPS(invalid), 0x30, 0 }, /* 0x30 048 */
236 { "SmbCloseAndTreeDisconnect",
237 SMB_SDT_OPS(close_and_tree_disconnect), /* 0x31 049 */
238 0x31, LANMAN1_0 },
239 { "SmbTransaction2", SMB_SDT_OPS(transaction2), /* 0x32 050 */
240 0x32, LM1_2X002 },
241 { "SmbTransaction2Secondary",
242 SMB_SDT_OPS(transaction2_secondary), /* 0x33 051 */
243 0x33, LM1_2X002 },
244 { "SmbFindClose2", SMB_SDT_OPS(find_close2), /* 0x34 052 */
245 0x34, LM1_2X002 },
246 { "Invalid", SMB_SDT_OPS(invalid), 0x35, 0 }, /* 0x35 053 */
247 { "Invalid", SMB_SDT_OPS(invalid), 0x36, 0 }, /* 0x36 054 */
248 { "Invalid", SMB_SDT_OPS(invalid), 0x37, 0 }, /* 0x37 055 */
249 { "Invalid", SMB_SDT_OPS(invalid), 0x38, 0 }, /* 0x38 056 */
250 { "Invalid", SMB_SDT_OPS(invalid), 0x39, 0 }, /* 0x39 057 */
251 { "Invalid", SMB_SDT_OPS(invalid), 0x3A, 0 }, /* 0x3A 058 */
252 { "Invalid", SMB_SDT_OPS(invalid), 0x3B, 0 }, /* 0x3B 059 */
253 { "Invalid", SMB_SDT_OPS(invalid), 0x3C, 0 }, /* 0x3C 060 */
254 { "Invalid", SMB_SDT_OPS(invalid), 0x3D, 0 }, /* 0x3D 061 */
255 { "Invalid", SMB_SDT_OPS(invalid), 0x3E, 0 }, /* 0x3E 062 */
256 { "Invalid", SMB_SDT_OPS(invalid), 0x3F, 0 }, /* 0x3F 063 */
257 { "Invalid", SMB_SDT_OPS(invalid), 0x40, 0 }, /* 0x40 064 */
258 { "Invalid", SMB_SDT_OPS(invalid), 0x47, 0 }, /* 0x47 065 */
259 { "Invalid", SMB_SDT_OPS(invalid), 0x48, 0 }, /* 0x48 066 */
260 { "Invalid", SMB_SDT_OPS(invalid), 0x49, 0 }, /* 0x49 067 */
261 { "Invalid", SMB_SDT_OPS(invalid), 0x44, 0 }, /* 0x44 068 */
262 { "Invalid", SMB_SDT_OPS(invalid), 0x45, 0 }, /* 0x45 069 */
263 { "Invalid", SMB_SDT_OPS(invalid), 0x46, 0 }, /* 0x46 070 */
264 { "Invalid", SMB_SDT_OPS(invalid), 0x47, 0 }, /* 0x47 071 */
265 { "Invalid", SMB_SDT_OPS(invalid), 0x48, 0 }, /* 0x48 072 */
266 { "Invalid", SMB_SDT_OPS(invalid), 0x49, 0 }, /* 0x49 073 */
267 { "Invalid", SMB_SDT_OPS(invalid), 0x4A, 0 }, /* 0x4A 074 */
268 { "Invalid", SMB_SDT_OPS(invalid), 0x4B, 0 }, /* 0x4B 075 */
269 { "Invalid", SMB_SDT_OPS(invalid), 0x4C, 0 }, /* 0x4C 076 */
270 { "Invalid", SMB_SDT_OPS(invalid), 0x4D, 0 }, /* 0x4D 077 */
271 { "Invalid", SMB_SDT_OPS(invalid), 0x4E, 0 }, /* 0x4E 078 */
272 { "Invalid", SMB_SDT_OPS(invalid), 0x4F, 0 }, /* 0x4F 079 */
273 { "Invalid", SMB_SDT_OPS(invalid), 0x50, 0 }, /* 0x50 080 */
274 { "Invalid", SMB_SDT_OPS(invalid), 0x51, 0 }, /* 0x51 081 */
275 { "Invalid", SMB_SDT_OPS(invalid), 0x52, 0 }, /* 0x52 082 */
276 { "Invalid", SMB_SDT_OPS(invalid), 0x53, 0 }, /* 0x53 083 */
277 { "Invalid", SMB_SDT_OPS(invalid), 0x54, 0 }, /* 0x54 084 */
278 { "Invalid", SMB_SDT_OPS(invalid), 0x55, 0 }, /* 0x55 085 */
279 { "Invalid", SMB_SDT_OPS(invalid), 0x56, 0 }, /* 0x56 086 */
280 { "Invalid", SMB_SDT_OPS(invalid), 0x57, 0 }, /* 0x57 087 */
281 { "Invalid", SMB_SDT_OPS(invalid), 0x58, 0 }, /* 0x58 088 */
282 { "Invalid", SMB_SDT_OPS(invalid), 0x59, 0 }, /* 0x59 089 */
283 { "Invalid", SMB_SDT_OPS(invalid), 0x5A, 0 }, /* 0x5A 090 */
284 { "Invalid", SMB_SDT_OPS(invalid), 0x5B, 0 }, /* 0x5B 091 */
285 { "Invalid", SMB_SDT_OPS(invalid), 0x5C, 0 }, /* 0x5C 092 */
286 { "Invalid", SMB_SDT_OPS(invalid), 0x5D, 0 }, /* 0x5D 093 */
287 { "Invalid", SMB_SDT_OPS(invalid), 0x5E, 0 }, /* 0x5E 094 */
288 { "Invalid", SMB_SDT_OPS(invalid), 0x5F, 0 }, /* 0x5F 095 */
289 { "Invalid", SMB_SDT_OPS(invalid), 0x60, 0 }, /* 0x60 096 */
290 { "Invalid", SMB_SDT_OPS(invalid), 0x61, 0 }, /* 0x61 097 */
291 { "Invalid", SMB_SDT_OPS(invalid), 0x62, 0 }, /* 0x62 098 */
292 { "Invalid", SMB_SDT_OPS(invalid), 0x63, 0 }, /* 0x63 099 */
293 { "Invalid", SMB_SDT_OPS(invalid), 0x64, 0 }, /* 0x64 100 */
294 { "Invalid", SMB_SDT_OPS(invalid), 0x65, 0 }, /* 0x65 101 */
295 { "Invalid", SMB_SDT_OPS(invalid), 0x66, 0 }, /* 0x66 102 */
296 { "Invalid", SMB_SDT_OPS(invalid), 0x67, 0 }, /* 0x67 103 */
297 { "Invalid", SMB_SDT_OPS(invalid), 0x68, 0 }, /* 0x68 104 */
298 { "Invalid", SMB_SDT_OPS(invalid), 0x69, 0 }, /* 0x69 105 */
299 { "Invalid", SMB_SDT_OPS(invalid), 0x6A, 0 }, /* 0x6A 106 */
300 { "Invalid", SMB_SDT_OPS(invalid), 0x6B, 0 }, /* 0x6B 107 */
301 { "Invalid", SMB_SDT_OPS(invalid), 0x6C, 0 }, /* 0x6C 108 */
302 { "Invalid", SMB_SDT_OPS(invalid), 0x6D, 0 }, /* 0x6D 109 */
303 { "Invalid", SMB_SDT_OPS(invalid), 0x6E, 0 }, /* 0x6E 110 */
304 { "Invalid", SMB_SDT_OPS(invalid), 0x6F, 0 }, /* 0x6F 111 */
305 { "SmbTreeConnect", SMB_SDT_OPS(tree_connect), /* 0x70 112 */
306 0x70, PC_NETWORK_PROGRAM_1_0, SDDF_SUPPRESS_TID },
307 { "SmbTreeDisconnect", SMB_SDT_OPS(tree_disconnect), /* 0x71 113 */
308 0x71, PC_NETWORK_PROGRAM_1_0,
309 SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
310 /*
311 * NB: Negotiate gets special handling via
312 * smb_initial_request_handler. After that,
313 * another Negotiate is an invalid request.
314 */
315 { "SmbNegotiate", SMB_SDT_OPS(invalid), /* 0x72 114 */
316 0x72, PC_NETWORK_PROGRAM_1_0,
317 SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
318 { "SmbSessionSetupX", SMB_SDT_OPS(session_setup_andx), /* 0x73 115 */
319 0x73, LANMAN1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
320 { "SmbLogoffX", SMB_SDT_OPS(logoff_andx), /* 0x74 116 */
321 0x74, LM1_2X002, SDDF_SUPPRESS_TID },
322 { "SmbTreeConnectX", SMB_SDT_OPS(tree_connect_andx), /* 0x75 117 */
323 0x75, LANMAN1_0, SDDF_SUPPRESS_TID },
324 { "Invalid", SMB_SDT_OPS(invalid), 0x76, 0, 0 }, /* 0x76 118 */
325 { "Invalid", SMB_SDT_OPS(invalid), 0x77, 0, 0 }, /* 0x77 119 */
326 { "Invalid", SMB_SDT_OPS(invalid), 0x78, 0, 0 }, /* 0x78 120 */
327 { "Invalid", SMB_SDT_OPS(invalid), 0x79, 0, 0 }, /* 0x79 121 */
328 { "Invalid", SMB_SDT_OPS(invalid), 0x7A, 0, 0 }, /* 0x7A 122 */
329 { "Invalid", SMB_SDT_OPS(invalid), 0x7B, 0, 0 }, /* 0x7B 123 */
330 { "Invalid", SMB_SDT_OPS(invalid), 0x7C, 0, 0 }, /* 0x7C 124 */
331 { "Invalid", SMB_SDT_OPS(invalid), 0x7D, 0, 0 }, /* 0x7D 125 */
332 { "Invalid", SMB_SDT_OPS(invalid), 0x7E, 0, 0 }, /* 0x7E 126 */
333 { "Invalid", SMB_SDT_OPS(invalid), 0x7F, 0, 0 }, /* 0x7F 127 */
334 { "SmbQueryInformationDisk",
335 SMB_SDT_OPS(query_information_disk), /* 0x80 128 */
336 0x80, PC_NETWORK_PROGRAM_1_0, 0 },
337 { "SmbSearch", SMB_SDT_OPS(search), /* 0x81 129 */
338 0x81, PC_NETWORK_PROGRAM_1_0, 0 },
339 { "SmbFind", SMB_SDT_OPS(find), /* 0x82 130 */
340 0x82, LANMAN1_0, 0 },
341 { "SmbFindUnique", SMB_SDT_OPS(find_unique), /* 0x83 131 */
342 0x83, LANMAN1_0, 0 },
343 { "SmbFindClose", SMB_SDT_OPS(find_close), /* 0x84 132 */
344 0x84, LANMAN1_0, 0 },
345 { "Invalid", SMB_SDT_OPS(invalid), 0x85, 0, 0 }, /* 0x85 133 */
346 { "Invalid", SMB_SDT_OPS(invalid), 0x86, 0, 0 }, /* 0x86 134 */
347 { "Invalid", SMB_SDT_OPS(invalid), 0x87, 0, 0 }, /* 0x87 135 */
348 { "Invalid", SMB_SDT_OPS(invalid), 0x88, 0, 0 }, /* 0x88 136 */
349 { "Invalid", SMB_SDT_OPS(invalid), 0x89, 0, 0 }, /* 0x89 137 */
350 { "Invalid", SMB_SDT_OPS(invalid), 0x8A, 0, 0 }, /* 0x8A 138 */
351 { "Invalid", SMB_SDT_OPS(invalid), 0x8B, 0, 0 }, /* 0x8B 139 */
352 { "Invalid", SMB_SDT_OPS(invalid), 0x8C, 0, 0 }, /* 0x8C 140 */
353 { "Invalid", SMB_SDT_OPS(invalid), 0x8D, 0, 0 }, /* 0x8D 141 */
354 { "Invalid", SMB_SDT_OPS(invalid), 0x8E, 0, 0 }, /* 0x8E 142 */
355 { "Invalid", SMB_SDT_OPS(invalid), 0x8F, 0, 0 }, /* 0x8F 143 */
356 { "Invalid", SMB_SDT_OPS(invalid), 0x90, 0, 0 }, /* 0x90 144 */
357 { "Invalid", SMB_SDT_OPS(invalid), 0x91, 0, 0 }, /* 0x91 145 */
358 { "Invalid", SMB_SDT_OPS(invalid), 0x92, 0, 0 }, /* 0x92 146 */
359 { "Invalid", SMB_SDT_OPS(invalid), 0x93, 0, 0 }, /* 0x93 147 */
360 { "Invalid", SMB_SDT_OPS(invalid), 0x94, 0, 0 }, /* 0x94 148 */
361 { "Invalid", SMB_SDT_OPS(invalid), 0x95, 0, 0 }, /* 0x95 149 */
362 { "Invalid", SMB_SDT_OPS(invalid), 0x96, 0, 0 }, /* 0x96 150 */
363 { "Invalid", SMB_SDT_OPS(invalid), 0x97, 0, 0 }, /* 0x97 151 */
364 { "Invalid", SMB_SDT_OPS(invalid), 0x98, 0, 0 }, /* 0x98 152 */
365 { "Invalid", SMB_SDT_OPS(invalid), 0x99, 0, 0 }, /* 0x99 153 */
366 { "Invalid", SMB_SDT_OPS(invalid), 0x9A, 0, 0 }, /* 0x9A 154 */
367 { "Invalid", SMB_SDT_OPS(invalid), 0x9B, 0, 0 }, /* 0x9B 155 */
368 { "Invalid", SMB_SDT_OPS(invalid), 0x9C, 0, 0 }, /* 0x9C 156 */
369 { "Invalid", SMB_SDT_OPS(invalid), 0x9D, 0, 0 }, /* 0x9D 157 */
370 { "Invalid", SMB_SDT_OPS(invalid), 0x9E, 0, 0 }, /* 0x9E 158 */
371 { "Invalid", SMB_SDT_OPS(invalid), 0x9F, 0, 0 }, /* 0x9F 159 */
372 { "SmbNtTransact", SMB_SDT_OPS(nt_transact), /* 0xA0 160 */
373 0xA0, NT_LM_0_12, 0 },
374 { "SmbNtTransactSecondary",
375 SMB_SDT_OPS(nt_transact_secondary), /* 0xA1 161 */
376 0xA1, NT_LM_0_12, 0 },
377 { "SmbNtCreateX", SMB_SDT_OPS(nt_create_andx), /* 0xA2 162 */
378 0xA2, NT_LM_0_12, 0 },
379 { "Invalid", SMB_SDT_OPS(invalid), 0xA3, 0, 0 }, /* 0xA3 163 */
380 { "SmbNtCancel", SMB_SDT_OPS(nt_cancel), /* 0xA4 164 */
381 0xA4, NT_LM_0_12, 0 },
382 { "SmbNtRename", SMB_SDT_OPS(nt_rename), /* 0xA5 165 */
383 0xA5, NT_LM_0_12, 0 },
384 { "Invalid", SMB_SDT_OPS(invalid), 0xA6, 0, 0 }, /* 0xA6 166 */
385 { "Invalid", SMB_SDT_OPS(invalid), 0xA7, 0, 0 }, /* 0xA7 167 */
386 { "Invalid", SMB_SDT_OPS(invalid), 0xA8, 0, 0 }, /* 0xA8 168 */
387 { "Invalid", SMB_SDT_OPS(invalid), 0xA9, 0, 0 }, /* 0xA9 169 */
388 { "Invalid", SMB_SDT_OPS(invalid), 0xAA, 0, 0 }, /* 0xAA 170 */
389 { "Invalid", SMB_SDT_OPS(invalid), 0xAB, 0, 0 }, /* 0xAB 171 */
390 { "Invalid", SMB_SDT_OPS(invalid), 0xAC, 0, 0 }, /* 0xAC 172 */
391 { "Invalid", SMB_SDT_OPS(invalid), 0xAD, 0, 0 }, /* 0xAD 173 */
392 { "Invalid", SMB_SDT_OPS(invalid), 0xAE, 0, 0 }, /* 0xAE 174 */
393 { "Invalid", SMB_SDT_OPS(invalid), 0xAF, 0, 0 }, /* 0xAF 175 */
394 { "Invalid", SMB_SDT_OPS(invalid), 0xB0, 0, 0 }, /* 0xB0 176 */
395 { "Invalid", SMB_SDT_OPS(invalid), 0xB1, 0, 0 }, /* 0xB1 177 */
396 { "Invalid", SMB_SDT_OPS(invalid), 0xB2, 0, 0 }, /* 0xB2 178 */
397 { "Invalid", SMB_SDT_OPS(invalid), 0xB3, 0, 0 }, /* 0xB3 179 */
398 { "Invalid", SMB_SDT_OPS(invalid), 0xB4, 0, 0 }, /* 0xB4 180 */
399 { "Invalid", SMB_SDT_OPS(invalid), 0xB5, 0, 0 }, /* 0xB5 181 */
400 { "Invalid", SMB_SDT_OPS(invalid), 0xB6, 0, 0 }, /* 0xB6 182 */
401 { "Invalid", SMB_SDT_OPS(invalid), 0xB7, 0, 0 }, /* 0xB7 183 */
402 { "Invalid", SMB_SDT_OPS(invalid), 0xB8, 0, 0 }, /* 0xB8 184 */
403 { "Invalid", SMB_SDT_OPS(invalid), 0xB9, 0, 0 }, /* 0xB9 185 */
404 { "Invalid", SMB_SDT_OPS(invalid), 0xBA, 0, 0 }, /* 0xBA 186 */
405 { "Invalid", SMB_SDT_OPS(invalid), 0xBB, 0, 0 }, /* 0xBB 187 */
406 { "Invalid", SMB_SDT_OPS(invalid), 0xBC, 0, 0 }, /* 0xBC 188 */
407 { "Invalid", SMB_SDT_OPS(invalid), 0xBD, 0, 0 }, /* 0xBD 189 */
408 { "Invalid", SMB_SDT_OPS(invalid), 0xBE, 0, 0 }, /* 0xBE 190 */
409 { "Invalid", SMB_SDT_OPS(invalid), 0xBF, 0, 0 }, /* 0xBF 191 */
410 { "SmbOpenPrintFile", SMB_SDT_OPS(open_print_file), /* 0xC0 192 */
411 0xC0, PC_NETWORK_PROGRAM_1_0, 0 },
412 { "SmbWritePrintFile", SMB_SDT_OPS(write_print_file), /* 0xC1 193 */
413 0xC1, PC_NETWORK_PROGRAM_1_0, SDDF_WRITEOP },
414 { "SmbClosePrintFile", SMB_SDT_OPS(close_print_file), /* 0xC2 194 */
415 0xC2, PC_NETWORK_PROGRAM_1_0, 0 },
416 { "SmbGetPrintQueue", SMB_SDT_OPS(get_print_queue), /* 0xC3 195 */
417 0xC3, PC_NETWORK_PROGRAM_1_0, 0 },
418 { "Invalid", SMB_SDT_OPS(invalid), 0xC4, 0, 0 }, /* 0xC4 196 */
419 { "Invalid", SMB_SDT_OPS(invalid), 0xC5, 0, 0 }, /* 0xC5 197 */
420 { "Invalid", SMB_SDT_OPS(invalid), 0xC6, 0, 0 }, /* 0xC6 198 */
421 { "Invalid", SMB_SDT_OPS(invalid), 0xC7, 0, 0 }, /* 0xC7 199 */
422 { "Invalid", SMB_SDT_OPS(invalid), 0xC8, 0, 0 }, /* 0xC8 200 */
423 { "Invalid", SMB_SDT_OPS(invalid), 0xC9, 0, 0 }, /* 0xC9 201 */
424 { "Invalid", SMB_SDT_OPS(invalid), 0xCA, 0, 0 }, /* 0xCA 202 */
425 { "Invalid", SMB_SDT_OPS(invalid), 0xCB, 0, 0 }, /* 0xCB 203 */
426 { "Invalid", SMB_SDT_OPS(invalid), 0xCC, 0, 0 }, /* 0xCC 204 */
427 { "Invalid", SMB_SDT_OPS(invalid), 0xCD, 0, 0 }, /* 0xCD 205 */
428 { "Invalid", SMB_SDT_OPS(invalid), 0xCE, 0, 0 }, /* 0xCE 206 */
429 { "Invalid", SMB_SDT_OPS(invalid), 0xCF, 0, 0 }, /* 0xCF 207 */
430 { "Invalid", SMB_SDT_OPS(invalid), 0xD0, 0, 0 }, /* 0xD0 208 */
431 { "Invalid", SMB_SDT_OPS(invalid), 0xD1, 0, 0 }, /* 0xD1 209 */
432 { "Invalid", SMB_SDT_OPS(invalid), 0xD2, 0, 0 }, /* 0xD2 210 */
433 { "Invalid", SMB_SDT_OPS(invalid), 0xD3, 0, 0 }, /* 0xD3 211 */
434 { "Invalid", SMB_SDT_OPS(invalid), 0xD4, 0, 0 }, /* 0xD4 212 */
435 { "Invalid", SMB_SDT_OPS(invalid), 0xD5, 0, 0 }, /* 0xD5 213 */
436 { "Invalid", SMB_SDT_OPS(invalid), 0xD6, 0, 0 }, /* 0xD6 214 */
437 { "Invalid", SMB_SDT_OPS(invalid), 0xD7, 0, 0 }, /* 0xD7 215 */
438 { "Invalid", SMB_SDT_OPS(invalid), 0xD8, 0, 0 }, /* 0xD8 216 */
439 { "Invalid", SMB_SDT_OPS(invalid), 0xD9, 0, 0 }, /* 0xD9 217 */
440 { "Invalid", SMB_SDT_OPS(invalid), 0xDA, 0, 0 }, /* 0xDA 218 */
441 { "Invalid", SMB_SDT_OPS(invalid), 0xDB, 0, 0 }, /* 0xDB 219 */
442 { "Invalid", SMB_SDT_OPS(invalid), 0xDC, 0, 0 }, /* 0xDC 220 */
443 { "Invalid", SMB_SDT_OPS(invalid), 0xDD, 0, 0 }, /* 0xDD 221 */
444 { "Invalid", SMB_SDT_OPS(invalid), 0xDE, 0, 0 }, /* 0xDE 222 */
445 { "Invalid", SMB_SDT_OPS(invalid), 0xDF, 0, 0 }, /* 0xDF 223 */
446 { "Invalid", SMB_SDT_OPS(invalid), 0xE0, 0, 0 }, /* 0xE0 224 */
447 { "Invalid", SMB_SDT_OPS(invalid), 0xE1, 0, 0 }, /* 0xE1 225 */
448 { "Invalid", SMB_SDT_OPS(invalid), 0xE2, 0, 0 }, /* 0xE2 226 */
449 { "Invalid", SMB_SDT_OPS(invalid), 0xE3, 0, 0 }, /* 0xE3 227 */
450 { "Invalid", SMB_SDT_OPS(invalid), 0xE4, 0, 0 }, /* 0xE4 228 */
451 { "Invalid", SMB_SDT_OPS(invalid), 0xE5, 0, 0 }, /* 0xE5 229 */
452 { "Invalid", SMB_SDT_OPS(invalid), 0xE6, 0, 0 }, /* 0xE6 230 */
453 { "Invalid", SMB_SDT_OPS(invalid), 0xE7, 0, 0 }, /* 0xE7 231 */
454 { "Invalid", SMB_SDT_OPS(invalid), 0xE8, 0, 0 }, /* 0xE8 232 */
455 { "Invalid", SMB_SDT_OPS(invalid), 0xE9, 0, 0 }, /* 0xE9 233 */
456 { "Invalid", SMB_SDT_OPS(invalid), 0xEA, 0, 0 }, /* 0xEA 234 */
457 { "Invalid", SMB_SDT_OPS(invalid), 0xEB, 0, 0 }, /* 0xEB 235 */
458 { "Invalid", SMB_SDT_OPS(invalid), 0xEC, 0, 0 }, /* 0xEC 236 */
459 { "Invalid", SMB_SDT_OPS(invalid), 0xED, 0, 0 }, /* 0xED 237 */
460 { "Invalid", SMB_SDT_OPS(invalid), 0xEE, 0, 0 }, /* 0xEE 238 */
461 { "Invalid", SMB_SDT_OPS(invalid), 0xEF, 0, 0 }, /* 0xEF 239 */
462 { "Invalid", SMB_SDT_OPS(invalid), 0xF0, 0, 0 }, /* 0xF0 240 */
463 { "Invalid", SMB_SDT_OPS(invalid), 0xF1, 0, 0 }, /* 0xF1 241 */
464 { "Invalid", SMB_SDT_OPS(invalid), 0xF2, 0, 0 }, /* 0xF2 242 */
465 { "Invalid", SMB_SDT_OPS(invalid), 0xF3, 0, 0 }, /* 0xF3 243 */
466 { "Invalid", SMB_SDT_OPS(invalid), 0xF4, 0, 0 }, /* 0xF4 244 */
467 { "Invalid", SMB_SDT_OPS(invalid), 0xF5, 0, 0 }, /* 0xF5 245 */
468 { "Invalid", SMB_SDT_OPS(invalid), 0xF6, 0, 0 }, /* 0xF6 246 */
469 { "Invalid", SMB_SDT_OPS(invalid), 0xF7, 0, 0 }, /* 0xF7 247 */
470 { "Invalid", SMB_SDT_OPS(invalid), 0xF8, 0, 0 }, /* 0xF8 248 */
471 { "Invalid", SMB_SDT_OPS(invalid), 0xF9, 0, 0 }, /* 0xF9 249 */
472 { "Invalid", SMB_SDT_OPS(invalid), 0xFA, 0, 0 }, /* 0xFA 250 */
473 { "Invalid", SMB_SDT_OPS(invalid), 0xFB, 0, 0 }, /* 0xFB 251 */
474 { "Invalid", SMB_SDT_OPS(invalid), 0xFC, 0, 0 }, /* 0xFC 252 */
475 { "Invalid", SMB_SDT_OPS(invalid), 0xFD, 0, 0 }, /* 0xFD 253 */
476 { "Invalid", SMB_SDT_OPS(invalid), 0xFE, 0, 0 }, /* 0xFE 254 */
477 { "Invalid", SMB_SDT_OPS(invalid), 0xFF, 0, 0 } /* 0xFF 255 */
478 };
479
480 /*
481 * smbsr_cleanup
482 *
483 * If any user/tree/file is used by given request then
484 * the reference count for that resource has been incremented.
485 * This function decrements the reference count and close
486 * the resource if it's needed.
487 */
488
489 void
490 smbsr_cleanup(smb_request_t *sr)
491 {
492 ASSERT((sr->sr_state != SMB_REQ_STATE_CLEANED_UP) &&
493 (sr->sr_state != SMB_REQ_STATE_COMPLETED));
494
495 if (sr->r_xa) {
496 if (sr->r_xa->xa_flags & SMB_XA_FLAG_COMPLETE)
497 smb_xa_close(sr->r_xa);
498 smb_xa_rele(sr->session, sr->r_xa);
499 sr->r_xa = NULL;
500 }
501
502 /*
503 * Mark this request so we know that we've already cleaned it up.
504 * A request should only get cleaned up once so multiple calls to
505 * smbsr_cleanup for the same request indicate a bug.
506 */
507 mutex_enter(&sr->sr_mutex);
508 if (sr->sr_state != SMB_REQ_STATE_CANCELLED)
509 sr->sr_state = SMB_REQ_STATE_CLEANED_UP;
510 mutex_exit(&sr->sr_mutex);
511 }
512
513 int smb_cancel_in_reader = 1;
514
515 /*
516 * This is the SMB1 handler for new smb requests, called from
517 * smb_session_reader after SMB negotiate is done. For most SMB
518 * requests, we just enqueue them for the smb_session_worker to
519 * execute via the task queue, so they can block for resources
520 * without stopping the reader thread. A few protocol messages
521 * are special cases and are handled directly here in the reader
522 * thread so they don't wait for taskq scheduling. Later, a few
523 * MORE things could be handled here, such as REPLY messages
524 * (oplock break reply) and things like "NT_cancel".
525 *
526 * This function must either enqueue the new request for
527 * execution via the task queue, or execute it directly
528 * and then free it. If this returns non-zero, the caller
529 * will drop the session.
530 */
531 int
532 smb1sr_newrq(smb_request_t *sr)
533 {
534 uint16_t pid_hi, pid_lo;
535 int rc, save_offset;
536
537 /*
538 * Decode the SMB header now (peek) so that
539 * SMB_COM_NT_CANCEL can find this SR.
540 */
541 save_offset = sr->command.chain_offset;
542 rc = smb_mbc_decodef(&sr->command, SMB_HEADER_ED_FMT,
543 &sr->smb_com,
544 &sr->smb_rcls,
545 &sr->smb_reh,
546 &sr->smb_err,
547 &sr->smb_flg,
548 &sr->smb_flg2,
549 &pid_hi,
550 sr->smb_sig,
551 &sr->smb_tid,
552 &pid_lo,
553 &sr->smb_uid,
554 &sr->smb_mid);
555 sr->command.chain_offset = save_offset;
556 if (rc != 0) {
557 /* Failed decoding the header. Drop 'em. */
558 smb_request_free(sr);
559 return (EPROTO);
560 }
561 sr->smb_pid = (pid_hi << 16) | pid_lo;
562
563 if (sr->smb_com == SMB_COM_NT_CANCEL) {
564 if (sr->session->signing.flags & SMB_SIGNING_ENABLED) {
565 sr->session->signing.seqnum++;
566 sr->sr_seqnum = sr->session->signing.seqnum + 1;
567 sr->reply_seqnum = 0;
568 }
569
570 /*
571 * Normally execute cancel requests immediately,
572 * (here in the reader thread) so they won't wait
573 * for other commands already in the task queue.
574 * Disable this via smb_cancel_in_reader=0 for
575 * testing or diagnostic efforts, in which case
576 * cancel runs via taskq_dispatch.
577 */
578 if (smb_cancel_in_reader != 0) {
579 rc = smb1sr_newrq_cancel(sr);
580 smb_request_free(sr);
581 return (rc);
582 }
583 } else {
584 /* not NT cancel */
585 if (sr->session->signing.flags & SMB_SIGNING_ENABLED) {
586 sr->session->signing.seqnum += 2;
587 sr->sr_seqnum = sr->session->signing.seqnum;
588 sr->reply_seqnum = sr->sr_seqnum + 1;
589 }
590 }
591
592 /*
593 * Submit the request to the task queue, which calls
594 * smb1_tq_work when the workload permits.
595 */
596 sr->sr_time_submitted = gethrtime();
597 sr->sr_state = SMB_REQ_STATE_SUBMITTED;
598 smb_srqueue_waitq_enter(sr->session->s_srqueue);
599 (void) taskq_dispatch(sr->sr_server->sv_worker_pool,
600 smb1_tq_work, sr, TQ_SLEEP);
601
602 return (0);
603 }
604
605 static void
606 smb1_tq_work(void *arg)
607 {
608 smb_request_t *sr;
609 smb_srqueue_t *srq;
610
611 sr = (smb_request_t *)arg;
612 SMB_REQ_VALID(sr);
613
614 srq = sr->session->s_srqueue;
615 smb_srqueue_waitq_to_runq(srq);
616 sr->sr_worker = curthread;
617 sr->sr_time_active = gethrtime();
618
619 /*
620 * Always dispatch to the work function, because cancelled
621 * requests need an error reply (NT_STATUS_CANCELLED).
622 */
623 mutex_enter(&sr->sr_mutex);
624 if (sr->sr_state == SMB_REQ_STATE_SUBMITTED)
625 sr->sr_state = SMB_REQ_STATE_ACTIVE;
626 mutex_exit(&sr->sr_mutex);
627
628 smb1sr_work(sr);
629
630 smb_srqueue_runq_exit(srq);
631 }
632
633 /*
634 * smb1sr_work
635 *
636 * In most cases, this should free the request before return.
637 * Exceptions are when a dispatch function returns SDRC_SR_KEPT.
638 */
639 void
640 smb1sr_work(struct smb_request *sr)
641 {
642 smb_sdrc_t sdrc;
643 const smb_disp_entry_t *sdd;
644 smb_disp_stats_t *sds;
645 boolean_t disconnect = B_FALSE;
646 smb_session_t *session;
647 smb_server_t *server;
648 int32_t txbase;
649 uint32_t rxbytes;
650 uint32_t byte_count;
651 uint32_t max_bytes;
652 uint16_t pid_hi, pid_lo;
653
654 session = sr->session;
655 server = session->s_server;
656
657 ASSERT(sr->tid_tree == 0);
658 ASSERT(sr->uid_user == 0);
659 ASSERT(sr->fid_ofile == 0);
660 sr->smb_fid = (uint16_t)-1;
661
662 /* temporary until we identify a user */
663 sr->user_cr = zone_kcred();
664 sr->orig_request_hdr = sr->command.chain_offset;
665
666 /*
667 * Decode the SMB header.
668 */
669 if (smb_mbc_decodef(&sr->command, SMB_HEADER_ED_FMT,
670 &sr->smb_com,
671 &sr->smb_rcls,
672 &sr->smb_reh,
673 &sr->smb_err,
674 &sr->smb_flg,
675 &sr->smb_flg2,
676 &pid_hi,
677 sr->smb_sig,
678 &sr->smb_tid,
679 &pid_lo,
680 &sr->smb_uid,
681 &sr->smb_mid) != 0) {
682 disconnect = B_TRUE;
683 goto drop_connection;
684 }
685 sr->smb_pid = (pid_hi << 16) | pid_lo;
686
687 /*
688 * The reply "header" is filled in now even though it will,
689 * most likely, be rewritten under reply_ready below. We
690 * could reserve the space but this is convenient in case
691 * the dialect dispatcher has to send a special reply (like
692 * TRANSACT).
693 *
694 * Ensure that the 32-bit error code flag is turned off.
695 * Clients seem to set it in transact requests and they may
696 * get confused if we return success or a 16-bit SMB code.
697 */
698 sr->smb_rcls = 0;
699 sr->smb_reh = 0;
700 sr->smb_err = 0;
701 sr->smb_flg2 &= ~SMB_FLAGS2_NT_STATUS;
702
703 (void) smb_mbc_encodef(&sr->reply, SMB_HEADER_ED_FMT,
704 sr->smb_com,
705 sr->smb_rcls,
706 sr->smb_reh,
707 sr->smb_err,
708 sr->smb_flg,
709 sr->smb_flg2,
710 pid_hi,
711 sr->smb_sig,
712 sr->smb_tid,
713 pid_lo,
714 sr->smb_uid,
715 sr->smb_mid);
716 sr->first_smb_com = sr->smb_com;
717
718 if ((session->signing.flags & SMB_SIGNING_CHECK) != 0) {
719 if ((sr->smb_flg2 & SMB_FLAGS2_SMB_SECURITY_SIGNATURE) == 0 ||
720 smb_sign_check_request(sr) != 0) {
721 smbsr_error(sr, NT_STATUS_ACCESS_DENIED,
722 ERRDOS, ERROR_ACCESS_DENIED);
723 disconnect = B_TRUE;
724 goto report_error;
725 }
726 }
727
728 andx_more:
729 sdd = &smb_disp_table[sr->smb_com];
730 ASSERT(sdd->sdt_function);
731 sds = &server->sv_disp_stats1[sr->smb_com];
732
733 if (smb_mbc_decodef(&sr->command, "b", &sr->smb_wct) != 0) {
734 disconnect = B_TRUE;
735 goto report_error;
736 }
737
738 (void) MBC_SHADOW_CHAIN(&sr->smb_vwv, &sr->command,
739 sr->command.chain_offset, sr->smb_wct * 2);
740
741 if (smb_mbc_decodef(&sr->command, "#.w", sr->smb_wct*2, &sr->smb_bcc)) {
742 disconnect = B_TRUE;
743 goto report_error;
744 }
745
746 /*
747 * Ignore smb_bcc if CAP_LARGE_READX/CAP_LARGE_WRITEX
748 * and this is SmbReadX/SmbWriteX since this enables
749 * large reads/write and bcc is only 16-bits.
750 */
751 max_bytes = sr->command.max_bytes - sr->command.chain_offset;
752 if (sr->smb_com == SMB_COM_WRITE_ANDX) {
753 /* Allow > BCC */
754 byte_count = max_bytes;
755 } else if (max_bytes < (uint32_t)sr->smb_bcc) {
756 /* BCC is bogus. Will fail later. */
757 byte_count = max_bytes;
758 } else {
759 /* ordinary case */
760 byte_count = (uint32_t)sr->smb_bcc;
761 }
762
763 /* Save these for kstat updates below. */
764 rxbytes = byte_count + 1 + 2 * sr->smb_wct;
765 txbase = sr->reply.chain_offset;
766
767 (void) MBC_SHADOW_CHAIN(&sr->smb_data, &sr->command,
768 sr->command.chain_offset, byte_count);
769
770 sr->command.chain_offset += byte_count;
771 if (sr->command.chain_offset > sr->command.max_bytes) {
772 disconnect = B_TRUE;
773 goto report_error;
774 }
775
776 /* Store pointers for later */
777 sr->cur_reply_offset = sr->reply.chain_offset;
778
779 if (is_andx_com(sr->smb_com)) {
780 /* Peek ahead and don't disturb vwv */
781 if (smb_mbc_peek(&sr->smb_vwv, sr->smb_vwv.chain_offset, "b.w",
782 &sr->andx_com, &sr->andx_off) < 0) {
783 disconnect = B_TRUE;
784 goto report_error;
785 }
786 } else {
787 sr->andx_com = (unsigned char)-1;
788 }
789
790 mutex_enter(&sr->sr_mutex);
791 switch (sr->sr_state) {
792 case SMB_REQ_STATE_ACTIVE:
793 break;
794 case SMB_REQ_STATE_CLEANED_UP:
795 sr->sr_state = SMB_REQ_STATE_ACTIVE;
796 break;
797 case SMB_REQ_STATE_CANCELLED:
798 /*
799 * Keep cancelled. Handlers that might block will
800 * check the state and return NT_STATUS_CANCELLED.
801 */
802 break;
803 default:
804 ASSERT(0);
805 break;
806 }
807 mutex_exit(&sr->sr_mutex);
808
809 /*
810 * Setup UID and TID information (if required). Both functions
811 * will set the sr credentials. In domain mode, the user and
812 * tree credentials should be the same. In share mode, the
813 * tree credentials (defined in the share definition) should
814 * override the user credentials.
815 */
816 if (!(sdd->sdt_flags & SDDF_SUPPRESS_UID) && (sr->uid_user == NULL)) {
817 sr->uid_user = smb_session_lookup_uid(session, sr->smb_uid);
818 if (sr->uid_user == NULL) {
819 smbsr_error(sr, 0, ERRSRV, ERRbaduid);
820 smbsr_cleanup(sr);
821 goto report_error;
822 }
823
824 sr->user_cr = smb_user_getcred(sr->uid_user);
825 }
826 if (!(sdd->sdt_flags & SDDF_SUPPRESS_TID) && (sr->tid_tree == NULL)) {
827 sr->tid_tree = smb_session_lookup_tree(session, sr->smb_tid);
828 if (sr->tid_tree == NULL) {
829 smbsr_error(sr, 0, ERRSRV, ERRinvnid);
830 smbsr_cleanup(sr);
831 goto report_error;
832 }
833 }
834
835 sr->sr_time_start = gethrtime();
836 if ((sdrc = (*sdd->sdt_pre_op)(sr)) == SDRC_SUCCESS)
837 sdrc = (*sdd->sdt_function)(sr);
838 (*sdd->sdt_post_op)(sr);
839 if (sdrc != SDRC_SR_KEPT) {
840 smbsr_cleanup(sr);
841 }
842
843 /* Record latency and rx/tx bytes per: server, session, share. */
844 {
845 hrtime_t dt;
846 int64_t rxb, txb;
847 smb_disp_stats_t *client_sds; /* session */
848 smb_disp_stats_t *share_sds; /* kshare */
849 int cmd_type;
850
851 if (sdd->sdt_flags & SDDF_READOP) {
852 cmd_type = SMBSRV_CLSH_READ;
853 } else if (sdd->sdt_flags & SDDF_WRITEOP) {
854 cmd_type = SMBSRV_CLSH_WRITE;
855 } else {
856 cmd_type = SMBSRV_CLSH_OTHER;
857 }
858
859 dt = gethrtime() - sr->sr_time_start;
860 rxb = (int64_t)rxbytes;
861 txb = (int64_t)(sr->reply.chain_offset - txbase);
862
863 smb_latency_add_sample(&sds->sdt_lat, dt);
864 atomic_add_64(&sds->sdt_rxb, rxb);
865 atomic_add_64(&sds->sdt_txb, txb);
866
867 client_sds = &session->s_stats[cmd_type];
868 smb_latency_add_sample(&client_sds->sdt_lat, dt);
869 atomic_add_64(&client_sds->sdt_rxb, rxb);
870 atomic_add_64(&client_sds->sdt_txb, txb);
871
872 if ((sr->tid_tree != NULL) &&
873 (sr->tid_tree->t_kshare != NULL)) {
874 share_sds =
875 &sr->tid_tree->t_kshare->shr_stats[cmd_type];
876 smb_latency_add_sample(&share_sds->sdt_lat, dt);
877 atomic_add_64(&share_sds->sdt_rxb, rxb);
878 atomic_add_64(&share_sds->sdt_txb, txb);
879 }
880 }
881
882 switch (sdrc) {
883 case SDRC_SUCCESS:
884 break;
885
886 case SDRC_DROP_VC:
887 disconnect = B_TRUE;
888 goto drop_connection;
889
890 case SDRC_NO_REPLY:
891 /* will free sr */
892 goto out;
893
894 case SDRC_SR_KEPT:
895 /* Do NOT free sr */
896 sr = NULL;
897 goto out;
898
899 case SDRC_ERROR:
900 goto report_error;
901
902 case SDRC_NOT_IMPLEMENTED:
903 default:
904 smbsr_error(sr, 0, ERRDOS, ERRbadfunc);
905 goto report_error;
906 }
907
908 /*
909 * If there's no AndX command, we're done.
910 */
911 if (sr->andx_com == 0xff)
912 goto reply_ready;
913
914 /*
915 * Otherwise, we have to back-patch the AndXCommand and AndXOffset
916 * and continue processing.
917 */
918 sr->andx_prev_wct = sr->cur_reply_offset;
919 (void) smb_mbc_poke(&sr->reply, sr->andx_prev_wct + 1, "b.w",
920 sr->andx_com, MBC_LENGTH(&sr->reply));
921
922 sr->command.chain_offset = sr->orig_request_hdr + sr->andx_off;
923 sr->smb_com = sr->andx_com;
924 goto andx_more;
925
926 report_error:
927 sr->reply.chain_offset = sr->cur_reply_offset;
928 (void) smb_mbc_encodef(&sr->reply, "bw", 0, 0);
929
930 sr->smb_wct = 0;
931 sr->smb_bcc = 0;
932
933 if (sr->smb_rcls == 0 && sr->smb_reh == 0 && sr->smb_err == 0)
934 smbsr_error(sr, 0, ERRSRV, ERRerror);
935
936 reply_ready:
937 smbsr_send_reply(sr);
938
939 drop_connection:
940 if (disconnect) {
941 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
942 switch (session->s_state) {
943 case SMB_SESSION_STATE_DISCONNECTED:
944 case SMB_SESSION_STATE_TERMINATED:
945 break;
946 default:
947 smb_soshutdown(session->sock);
948 session->s_state = SMB_SESSION_STATE_DISCONNECTED;
949 break;
950 }
951 smb_rwx_rwexit(&session->s_lock);
952 }
953
954 out:
955 if (sr != NULL) {
956 mutex_enter(&sr->sr_mutex);
957 sr->sr_state = SMB_REQ_STATE_COMPLETED;
958 mutex_exit(&sr->sr_mutex);
959 smb_request_free(sr);
960 }
961 }
962
963 int
964 smbsr_encode_empty_result(struct smb_request *sr)
965 {
966 return (smbsr_encode_result(sr, 0, 0, "bw", 0, 0));
967 }
968
969 int
970 smbsr_encode_result(struct smb_request *sr, int wct, int bcc,
971 const char *fmt, ...)
972 {
973 va_list ap;
974
975 if (MBC_LENGTH(&sr->reply) != sr->cur_reply_offset)
976 return (-1);
977
978 va_start(ap, fmt);
979 (void) smb_mbc_vencodef(&sr->reply, fmt, ap);
980 va_end(ap);
981
982 sr->smb_wct = (unsigned char)wct;
983 sr->smb_bcc = (uint16_t)bcc;
984
985 if (smbsr_check_result(sr, wct, bcc) != 0)
986 return (-1);
987
988 return (0);
989 }
990
991 static int
992 smbsr_check_result(struct smb_request *sr, int wct, int bcc)
993 {
994 int offset = sr->cur_reply_offset;
995 int total_bytes;
996 unsigned char temp, temp1;
997 struct mbuf *m;
998
999 total_bytes = 0;
1000 m = sr->reply.chain;
1001 while (m != 0) {
1002 total_bytes += m->m_len;
1003 m = m->m_next;
1004 }
1005
1006 if ((offset + 3) > total_bytes)
1007 return (-1);
1008
1009 (void) smb_mbc_peek(&sr->reply, offset, "b", &temp);
1010 if (temp != wct)
1011 return (-1);
1012
1013 if ((offset + (wct * 2 + 1)) > total_bytes)
1014 return (-1);
1015
1016 /* reply wct & vwv seem ok, consider data now */
1017 offset += wct * 2 + 1;
1018
1019 if ((offset + 2) > total_bytes)
1020 return (-1);
1021
1022 (void) smb_mbc_peek(&sr->reply, offset, "bb", &temp, &temp1);
1023 if (bcc == VAR_BCC) {
1024 if ((temp != 0xFF) || (temp1 != 0xFF)) {
1025 return (-1);
1026 } else {
1027 bcc = (total_bytes - offset) - 2;
1028 (void) smb_mbc_poke(&sr->reply, offset, "bb",
1029 bcc, bcc >> 8);
1030 }
1031 } else {
1032 if ((temp != (bcc&0xFF)) || (temp1 != ((bcc>>8)&0xFF)))
1033 return (-1);
1034 }
1035
1036 offset += bcc + 2;
1037
1038 if (offset != total_bytes)
1039 return (-1);
1040
1041 sr->smb_wct = (unsigned char)wct;
1042 sr->smb_bcc = (uint16_t)bcc;
1043 return (0);
1044 }
1045
1046 int
1047 smbsr_decode_vwv(struct smb_request *sr, const char *fmt, ...)
1048 {
1049 int rc;
1050 va_list ap;
1051
1052 va_start(ap, fmt);
1053 rc = smb_mbc_vdecodef(&sr->smb_vwv, fmt, ap);
1054 va_end(ap);
1055
1056 if (rc)
1057 smbsr_error(sr, 0, ERRSRV, ERRerror);
1058 return (rc);
1059 }
1060
1061 int
1062 smbsr_decode_data(struct smb_request *sr, const char *fmt, ...)
1063 {
1064 int rc;
1065 va_list ap;
1066
1067 va_start(ap, fmt);
1068 rc = smb_mbc_vdecodef(&sr->smb_data, fmt, ap);
1069 va_end(ap);
1070
1071 if (rc)
1072 smbsr_error(sr, 0, ERRSRV, ERRerror);
1073 return (rc);
1074 }
1075
1076 boolean_t
1077 smbsr_decode_data_avail(smb_request_t *sr)
1078 {
1079 return (sr->smb_data.chain_offset < sr->smb_data.max_bytes);
1080 }
1081
1082 void
1083 smbsr_send_reply(smb_request_t *sr)
1084 {
1085 uint16_t pid_hi, pid_lo;
1086
1087 if (SMB_TREE_IS_CASEINSENSITIVE(sr))
1088 sr->smb_flg |= SMB_FLAGS_CASE_INSENSITIVE;
1089 else
1090 sr->smb_flg &= ~SMB_FLAGS_CASE_INSENSITIVE;
1091 pid_hi = sr->smb_pid >> 16;
1092 pid_lo = (uint16_t)sr->smb_pid;
1093
1094 (void) smb_mbc_poke(&sr->reply, 0, SMB_HEADER_ED_FMT,
1095 sr->first_smb_com,
1096 sr->smb_rcls,
1097 sr->smb_reh,
1098 sr->smb_err,
1099 sr->smb_flg | SMB_FLAGS_REPLY,
1100 sr->smb_flg2,
1101 pid_hi,
1102 sr->smb_sig,
1103 sr->smb_tid,
1104 pid_lo,
1105 sr->smb_uid,
1106 sr->smb_mid);
1107
1108 if (sr->session->signing.flags & SMB_SIGNING_ENABLED)
1109 smb_sign_reply(sr, NULL);
1110
1111 if (smb_session_send(sr->session, 0, &sr->reply) == 0)
1112 sr->reply.chain = 0;
1113 }
1114
1115 void
1116 smbsr_map_errno(int errnum, smb_error_t *err)
1117 {
1118 uint32_t status;
1119 uint16_t doserr;
1120
1121 status = smb_errno2status(errnum);
1122 doserr = smb_status2doserr(status);
1123
1124 err->status = status;
1125 err->errcls = ERRDOS;
1126 err->errcode = doserr;
1127 }
1128
1129 void
1130 smbsr_errno(struct smb_request *sr, int errnum)
1131 {
1132 smbsr_map_errno(errnum, &sr->smb_error);
1133 smbsr_set_error(sr, &sr->smb_error);
1134 }
1135
1136 /*
1137 * Report a request processing status (error or warning).
1138 */
1139 void
1140 smbsr_status(smb_request_t *sr, DWORD status, uint16_t errcls, uint16_t errcode)
1141 {
1142
1143 sr->smb_error.status = status;
1144
1145 /*
1146 * This function is SMB1 specific. While adding SMB2 support,
1147 * calls to this function have been removed from common code.
1148 * In case we missed any, check for SMB2 callers here, and
1149 * vector into a wrapper function that we can watch for...
1150 * (and track down with dtrace:)
1151 */
1152 if (sr->session->dialect >= SMB_VERS_2_BASE) {
1153 smbsr_status_smb2(sr, status);
1154 return;
1155 }
1156
1157 if (status != 0 && errcls == 0 && errcode == 0) {
1158 errcls = ERRDOS;
1159 errcode = smb_status2doserr(status);
1160 }
1161
1162 sr->smb_error.errcls = errcls;
1163 sr->smb_error.errcode = errcode;
1164
1165 smbsr_set_error(sr, &sr->smb_error);
1166 }
1167
1168 /*
1169 * Setup a request processing error. This function can be used to
1170 * report 32-bit status codes or DOS errors. Set the status code
1171 * to 0 (NT_STATUS_SUCCESS) to explicitly report a DOS error,
1172 * regardless of the client capabilities.
1173 *
1174 * If status is non-zero and the client supports 32-bit status
1175 * codes, report the status. Otherwise, report the DOS error.
1176 */
1177 void
1178 smbsr_set_error(smb_request_t *sr, smb_error_t *err)
1179 {
1180 uint32_t status;
1181 uint32_t capabilities;
1182
1183 ASSERT(sr);
1184 ASSERT(err);
1185
1186 status = err->status;
1187 capabilities = sr->session->capabilities;
1188
1189 if ((err->errcls == 0) && (err->errcode == 0)) {
1190 capabilities |= CAP_STATUS32;
1191 if (status == 0)
1192 status = NT_STATUS_INTERNAL_ERROR;
1193 }
1194
1195 if ((capabilities & CAP_STATUS32) && (status != 0)) {
1196 sr->smb_rcls = status & 0xff;
1197 sr->smb_reh = (status >> 8) & 0xff;
1198 sr->smb_err = status >> 16;
1199 sr->smb_flg2 |= SMB_FLAGS2_NT_STATUS;
1200 } else {
1201 if ((err->errcls == 0) || (err->errcode == 0)) {
1202 sr->smb_rcls = ERRSRV;
1203 sr->smb_err = ERRerror;
1204 } else {
1205 sr->smb_rcls = (uint8_t)err->errcls;
1206 sr->smb_err = (uint16_t)err->errcode;
1207 }
1208 }
1209 }
1210
1211 smb_xa_t *
1212 smbsr_lookup_xa(smb_request_t *sr)
1213 {
1214 ASSERT(sr->r_xa == 0);
1215
1216 sr->r_xa = smb_xa_find(sr->session, sr->smb_pid, sr->smb_mid);
1217 return (sr->r_xa);
1218 }
1219
1220 void
1221 smbsr_release_file(smb_request_t *sr)
1222 {
1223 smb_ofile_t *of = sr->fid_ofile;
1224
1225 sr->fid_ofile = NULL;
1226 (void) smb_ofile_release(of);
1227 }
1228
1229 void
1230 smbsr_lookup_file(smb_request_t *sr)
1231 {
1232 if (sr->fid_ofile == NULL)
1233 sr->fid_ofile = smb_ofile_lookup_by_fid(sr, sr->smb_fid);
1234 }
1235
1236 static int
1237 is_andx_com(unsigned char com)
1238 {
1239 switch (com) {
1240 case SMB_COM_LOCKING_ANDX:
1241 case SMB_COM_OPEN_ANDX:
1242 case SMB_COM_READ_ANDX:
1243 case SMB_COM_WRITE_ANDX:
1244 case SMB_COM_SESSION_SETUP_ANDX:
1245 case SMB_COM_LOGOFF_ANDX:
1246 case SMB_COM_TREE_CONNECT_ANDX:
1247 case SMB_COM_NT_CREATE_ANDX:
1248 return (1);
1249 }
1250 return (0);
1251 }
1252
1253 /*
1254 * Invalid command stubs.
1255 *
1256 * The Read/Write Block Multiplexed (mpx) protocol is used to maximize
1257 * performance when reading/writing a large block of data: it can be
1258 * used in parallel with other client/server operations. The mpx sub-
1259 * protocol is not supported because we support only connection oriented
1260 * transports and NT supports mpx only over connectionless transports.
1261 */
1262 smb_sdrc_t
1263 smb_pre_invalid(smb_request_t *sr)
1264 {
1265 DTRACE_SMB_1(op__Invalid__start, smb_request_t *, sr);
1266 return (SDRC_SUCCESS);
1267 }
1268
1269 void
1270 smb_post_invalid(smb_request_t *sr)
1271 {
1272 DTRACE_SMB_1(op__Invalid__done, smb_request_t *, sr);
1273 }
1274
1275 smb_sdrc_t
1276 smb_com_invalid(smb_request_t *sr)
1277 {
1278 smb_sdrc_t sdrc;
1279
1280 switch (sr->smb_com) {
1281 case SMB_COM_WRITE_COMPLETE:
1282 smbsr_error(sr, 0, ERRSRV, ERRerror);
1283 sdrc = SDRC_ERROR;
1284 break;
1285
1286 default:
1287 smbsr_error(sr, NT_STATUS_NOT_IMPLEMENTED,
1288 ERRDOS, ERROR_INVALID_FUNCTION);
1289 sdrc = SDRC_NOT_IMPLEMENTED;
1290 break;
1291 }
1292
1293 return (sdrc);
1294 }
1295
1296 /*
1297 * smb_dispatch_stats_init
1298 *
1299 * Initializes dispatch statistics.
1300 */
1301 void
1302 smb_dispatch_stats_init(smb_server_t *sv)
1303 {
1304 smb_disp_stats_t *sds = sv->sv_disp_stats1;
1305 smb_kstat_req_t *ksr;
1306 int i;
1307
1308 ksr = ((smbsrv_kstats_t *)sv->sv_ksp->ks_data)->ks_reqs1;
1309
1310 for (i = 0; i < SMB_COM_NUM; i++, ksr++) {
1311 smb_latency_init(&sds[i].sdt_lat);
1312 (void) strlcpy(ksr->kr_name, smb_disp_table[i].sdt_name,
1313 sizeof (ksr->kr_name));
1314 }
1315 }
1316
1317 /*
1318 * smb_dispatch_stats_fini
1319 *
1320 * Frees and destroyes the resources used for statistics.
1321 */
1322 void
1323 smb_dispatch_stats_fini(smb_server_t *sv)
1324 {
1325 smb_disp_stats_t *sds = sv->sv_disp_stats1;
1326 int i;
1327
1328 for (i = 0; i < SMB_COM_NUM; i++)
1329 smb_latency_destroy(&sds[i].sdt_lat);
1330 }
1331
1332 void
1333 smb_dispatch_stats_update(smb_server_t *sv,
1334 smb_kstat_req_t *ksr, int first, int nreq)
1335 {
1336 smb_disp_stats_t *sds = sv->sv_disp_stats1;
1337 int i;
1338 int last;
1339
1340 last = first + nreq - 1;
1341
1342 if ((first < SMB_COM_NUM) && (last < SMB_COM_NUM)) {
1343 for (i = first; i <= last; i++, ksr++) {
1344 ksr->kr_rxb = sds[i].sdt_rxb;
1345 ksr->kr_txb = sds[i].sdt_txb;
1346 mutex_enter(&sds[i].sdt_lat.ly_mutex);
1347 ksr->kr_nreq = sds[i].sdt_lat.ly_a_nreq;
1348 ksr->kr_sum = sds[i].sdt_lat.ly_a_sum;
1349 ksr->kr_a_mean = sds[i].sdt_lat.ly_a_mean;
1350 ksr->kr_a_stddev =
1351 sds[i].sdt_lat.ly_a_stddev;
1352 ksr->kr_d_mean = sds[i].sdt_lat.ly_d_mean;
1353 ksr->kr_d_stddev =
1354 sds[i].sdt_lat.ly_d_stddev;
1355 sds[i].sdt_lat.ly_d_mean = 0;
1356 sds[i].sdt_lat.ly_d_nreq = 0;
1357 sds[i].sdt_lat.ly_d_stddev = 0;
1358 sds[i].sdt_lat.ly_d_sum = 0;
1359 mutex_exit(&sds[i].sdt_lat.ly_mutex);
1360 }
1361 }
1362 }