blob: f9250c4f734ebf54cd22ecc37f730072af72d43b [file] [log] [blame]
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
* Copyright 2020 Tintri by DDN, Inc. All rights reserved.
* Copyright 2022 RackTop Systems, Inc.
*/
#include <sys/atomic.h>
#include <sys/synch.h>
#include <sys/types.h>
#include <sys/sdt.h>
#include <sys/random.h>
#include <smbsrv/netbios.h>
#include <smbsrv/smb2_kproto.h>
#include <smbsrv/string.h>
#include <netinet/tcp.h>
/* How many iovec we'll handle as a local array (no allocation) */
#define SMB_LOCAL_IOV_MAX 16
#define SMB_NEW_KID() atomic_inc_64_nv(&smb_kids)
static volatile uint64_t smb_kids;
/*
* We track the keepalive in minutes, but this constant
* specifies it in seconds, so convert to minutes.
*/
uint32_t smb_keep_alive = SMB_PI_KEEP_ALIVE_MIN / 60;
/*
* This is the maximum time we'll allow a "session" to exist with no
* authenticated smb_user_t objects on it. This allows a client to
* logoff their "one and only" user session and then logon as some
* different user. (There are some tests that do that.) The same
* timeout mechanism also reduces the impact of clients that might
* open TCP connections but never authenticate.
*/
int smb_session_auth_tmo = 30; /* sec. */
/*
* There are many smbtorture test cases that send
* racing requests, and where the tests fail if we
* don't execute them in exactly the order sent.
* These are test bugs. The protocol makes no
* guarantees about execution order of requests
* that are concurrently active.
*
* Nonetheless, smbtorture has many useful tests,
* so we have this work-around we can enable to
* basically force sequential execution. When
* enabled, insert a delay after each request is
* issued a taskq job. Enable this with mdb by
* setting smb_reader_delay to 10. Don't make it
* more than 500 or so or the server will appear
* to be so slow that tests may time out.
*/
int smb_reader_delay = 0; /* mSec. */
static int smbsr_newrq_initial(smb_request_t *);
static void smb_session_cancel(smb_session_t *);
static int smb_session_reader(smb_session_t *);
static int smb_session_xprt_puthdr(smb_session_t *,
uint8_t msg_type, uint32_t msg_len,
uint8_t *dst, size_t dstlen);
static void smb_session_disconnect_trees(smb_session_t *);
static void smb_request_init_command_mbuf(smb_request_t *sr);
static void smb_session_genkey(smb_session_t *);
/*
* This (legacy) code is in support of an "idle timeout" feature,
* which is apparently incomplete. To complete it, we should:
* when the keep_alive timer expires, check whether the client
* has any open files, and if not then kill their session.
* Right now the timers are there, but nothing happens when
* a timer expires.
*
* Todo: complete logic to kill idle sessions.
*
* Only called when sv_cfg.skc_keepalive != 0
*/
void
smb_session_timers(smb_server_t *sv)
{
smb_session_t *session;
smb_llist_t *ll;
ll = &sv->sv_session_list;
smb_llist_enter(ll, RW_READER);
session = smb_llist_head(ll);
while (session != NULL) {
/*
* Walk through the table and decrement each keep_alive
* timer that has not timed out yet. (keepalive > 0)
*/
SMB_SESSION_VALID(session);
if (session->keep_alive &&
(session->keep_alive != (uint32_t)-1))
session->keep_alive--;
session = smb_llist_next(ll, session);
}
smb_llist_exit(ll);
}
/*
* Send a session message - supports SMB-over-NBT and SMB-over-TCP.
* If an mbuf chain is provided (optional), it will be freed and
* set to NULL -- unconditionally! (error or not)
*
* Builds a I/O vector (uio/iov) to do the send from mbufs, plus one
* segment for the 4-byte NBT header.
*/
int
smb_session_send(smb_session_t *session, uint8_t nbt_type, mbuf_chain_t *mbc)
{
uio_t uio;
iovec_t local_iov[SMB_LOCAL_IOV_MAX];
iovec_t *alloc_iov = NULL;
int alloc_sz = 0;
mbuf_t *m;
uint8_t nbt_hdr[NETBIOS_HDR_SZ];
uint32_t nbt_len;
int i, nseg;
int rc;
switch (session->s_state) {
case SMB_SESSION_STATE_DISCONNECTED:
case SMB_SESSION_STATE_TERMINATED:
rc = ENOTCONN;
goto out;
default:
break;
}
/*
* Setup the IOV. First, count the number of IOV segments
* (plus one for the NBT header) and decide whether we
* need to allocate an iovec or can use local_iov;
*/
bzero(&uio, sizeof (uio));
nseg = 1;
m = (mbc != NULL) ? mbc->chain : NULL;
while (m != NULL) {
nseg++;
m = m->m_next;
}
if (nseg <= SMB_LOCAL_IOV_MAX) {
uio.uio_iov = local_iov;
} else {
alloc_sz = nseg * sizeof (iovec_t);
alloc_iov = kmem_alloc(alloc_sz, KM_SLEEP);
uio.uio_iov = alloc_iov;
}
uio.uio_iovcnt = nseg;
uio.uio_segflg = UIO_SYSSPACE;
uio.uio_extflg = UIO_COPY_DEFAULT;
/*
* Build the iov list, meanwhile computing the length of
* the SMB payload (to put in the NBT header).
*/
uio.uio_iov[0].iov_base = (void *)nbt_hdr;
uio.uio_iov[0].iov_len = sizeof (nbt_hdr);
i = 1;
nbt_len = 0;
m = (mbc != NULL) ? mbc->chain : NULL;
while (m != NULL) {
uio.uio_iov[i].iov_base = m->m_data;
uio.uio_iov[i++].iov_len = m->m_len;
nbt_len += m->m_len;
m = m->m_next;
}
ASSERT3S(i, ==, nseg);
/*
* Set the NBT header, set uio_resid
*/
uio.uio_resid = nbt_len + NETBIOS_HDR_SZ;
rc = smb_session_xprt_puthdr(session, nbt_type, nbt_len,
nbt_hdr, NETBIOS_HDR_SZ);
if (rc != 0)
goto out;
smb_server_add_txb(session->s_server, (int64_t)uio.uio_resid);
rc = smb_net_send_uio(session, &uio);
out:
if (alloc_iov != NULL)
kmem_free(alloc_iov, alloc_sz);
if ((mbc != NULL) && (mbc->chain != NULL)) {
m_freem(mbc->chain);
mbc->chain = NULL;
mbc->flags = 0;
}
return (rc);
}
/*
* Read, process and respond to a NetBIOS session request.
*
* A NetBIOS session must be established for SMB-over-NetBIOS. Validate
* the calling and called name format and save the client NetBIOS name,
* which is used when a NetBIOS session is established to check for and
* cleanup leftover state from a previous session.
*
* Session requests are not valid for SMB-over-TCP, which is unfortunate
* because without the client name leftover state cannot be cleaned up
* if the client is behind a NAT server.
*/
static int
smb_netbios_session_request(struct smb_session *session)
{
int rc;
char *calling_name;
char *called_name;
char client_name[NETBIOS_NAME_SZ];
struct mbuf_chain mbc;
char *names = NULL;
smb_wchar_t *wbuf = NULL;
smb_xprt_t hdr;
char *p;
int rc1, rc2;
session->keep_alive = smb_keep_alive;
if ((rc = smb_session_xprt_gethdr(session, &hdr)) != 0)
return (rc);
DTRACE_PROBE2(receive__session__req__xprthdr, struct session *, session,
smb_xprt_t *, &hdr);
if ((hdr.xh_type != SESSION_REQUEST) ||
(hdr.xh_length != NETBIOS_SESSION_REQUEST_DATA_LENGTH)) {
DTRACE_PROBE1(receive__session__req__failed,
struct session *, session);
return (EINVAL);
}
names = kmem_alloc(hdr.xh_length, KM_SLEEP);
if ((rc = smb_sorecv(session->sock, names, hdr.xh_length)) != 0) {
kmem_free(names, hdr.xh_length);
DTRACE_PROBE1(receive__session__req__failed,
struct session *, session);
return (rc);
}
DTRACE_PROBE3(receive__session__req__data, struct session *, session,
char *, names, uint32_t, hdr.xh_length);
called_name = &names[0];
calling_name = &names[NETBIOS_ENCODED_NAME_SZ + 2];
rc1 = netbios_name_isvalid(called_name, 0);
rc2 = netbios_name_isvalid(calling_name, client_name);
if (rc1 == 0 || rc2 == 0) {
DTRACE_PROBE3(receive__invalid__session__req,
struct session *, session, char *, names,
uint32_t, hdr.xh_length);
kmem_free(names, hdr.xh_length);
MBC_INIT(&mbc, MAX_DATAGRAM_LENGTH);
(void) smb_mbc_encodef(&mbc, "b",
DATAGRAM_INVALID_SOURCE_NAME_FORMAT);
(void) smb_session_send(session, NEGATIVE_SESSION_RESPONSE,
&mbc);
return (EINVAL);
}
DTRACE_PROBE3(receive__session__req__calling__decoded,
struct session *, session,
char *, calling_name, char *, client_name);
/*
* The client NetBIOS name is in oem codepage format.
* We need to convert it to unicode and store it in
* multi-byte format. We also need to strip off any
* spaces added as part of the NetBIOS name encoding.
*/
wbuf = kmem_alloc((SMB_PI_MAX_HOST * sizeof (smb_wchar_t)), KM_SLEEP);
(void) oemtoucs(wbuf, client_name, SMB_PI_MAX_HOST, OEM_CPG_850);
(void) smb_wcstombs(session->workstation, wbuf, SMB_PI_MAX_HOST);
kmem_free(wbuf, (SMB_PI_MAX_HOST * sizeof (smb_wchar_t)));
if ((p = strchr(session->workstation, ' ')) != 0)
*p = '\0';
kmem_free(names, hdr.xh_length);
return (smb_session_send(session, POSITIVE_SESSION_RESPONSE, NULL));
}
/*
* Read 4-byte header from the session socket and build an in-memory
* session transport header. See smb_xprt_t definition for header
* format information.
*
* Direct hosted NetBIOS-less SMB (SMB-over-TCP) uses port 445. The
* first byte of the four-byte header must be 0 and the next three
* bytes contain the length of the remaining data.
*/
int
smb_session_xprt_gethdr(smb_session_t *session, smb_xprt_t *ret_hdr)
{
int rc;
unsigned char buf[NETBIOS_HDR_SZ];
if ((rc = smb_sorecv(session->sock, buf, NETBIOS_HDR_SZ)) != 0)
return (rc);
switch (session->s_local_port) {
case IPPORT_NETBIOS_SSN:
ret_hdr->xh_type = buf[0];
ret_hdr->xh_length = (((uint32_t)buf[1] & 1) << 16) |
((uint32_t)buf[2] << 8) |
((uint32_t)buf[3]);
break;
case IPPORT_SMB:
ret_hdr->xh_type = buf[0];
if (ret_hdr->xh_type != 0) {
cmn_err(CE_WARN, "invalid NBT type (%u) from %s",
ret_hdr->xh_type, session->ip_addr_str);
return (EPROTO);
}
ret_hdr->xh_length = ((uint32_t)buf[1] << 16) |
((uint32_t)buf[2] << 8) |
((uint32_t)buf[3]);
break;
default:
cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
return (EPROTO);
}
return (0);
}
/*
* Encode a transport session packet header into a 4-byte buffer.
*/
static int
smb_session_xprt_puthdr(smb_session_t *session,
uint8_t msg_type, uint32_t msg_length,
uint8_t *buf, size_t buflen)
{
if (buf == NULL || buflen < NETBIOS_HDR_SZ) {
return (-1);
}
switch (session->s_local_port) {
case IPPORT_NETBIOS_SSN:
/* Per RFC 1001, 1002: msg. len < 128KB */
if (msg_length >= (1 << 17))
return (-1);
buf[0] = msg_type;
buf[1] = ((msg_length >> 16) & 1);
buf[2] = (msg_length >> 8) & 0xff;
buf[3] = msg_length & 0xff;
break;
case IPPORT_SMB:
/*
* SMB over TCP is like NetBIOS but the one byte
* message type is always zero, and the length
* part is three bytes. It could actually use
* longer messages, but this is conservative.
*/
if (msg_length >= (1 << 24))
return (-1);
buf[0] = msg_type;
buf[1] = (msg_length >> 16) & 0xff;
buf[2] = (msg_length >> 8) & 0xff;
buf[3] = msg_length & 0xff;
break;
default:
cmn_err(CE_WARN, "invalid port %u", session->s_local_port);
return (-1);
}
return (0);
}
static void
smb_request_init_command_mbuf(smb_request_t *sr)
{
/*
* Setup mbuf using the buffer we allocated.
*/
MBC_ATTACH_BUF(&sr->command, sr->sr_request_buf, sr->sr_req_length);
sr->command.flags = 0;
sr->command.shadow_of = NULL;
}
/*
* smb_request_cancel
*
* Handle a cancel for a request properly depending on the current request
* state.
*/
void
smb_request_cancel(smb_request_t *sr)
{
void (*cancel_method)(smb_request_t *) = NULL;
mutex_enter(&sr->sr_mutex);
switch (sr->sr_state) {
case SMB_REQ_STATE_INITIALIZING:
case SMB_REQ_STATE_SUBMITTED:
case SMB_REQ_STATE_ACTIVE:
case SMB_REQ_STATE_CLEANED_UP:
sr->sr_state = SMB_REQ_STATE_CANCELLED;
break;
case SMB_REQ_STATE_WAITING_AUTH:
case SMB_REQ_STATE_WAITING_FCN1:
case SMB_REQ_STATE_WAITING_LOCK:
case SMB_REQ_STATE_WAITING_PIPE:
case SMB_REQ_STATE_WAITING_OLBRK:
/*
* These are states that have a cancel_method.
* Make the state change now, to ensure that
* we call cancel_method exactly once. Do the
* method call below, after we drop sr_mutex.
* When the cancelled request thread resumes,
* it should re-take sr_mutex and set sr_state
* to CANCELLED, then return STATUS_CANCELLED.
*/
sr->sr_state = SMB_REQ_STATE_CANCEL_PENDING;
cancel_method = sr->cancel_method;
VERIFY(cancel_method != NULL);
break;
case SMB_REQ_STATE_WAITING_FCN2:
case SMB_REQ_STATE_COMPLETED:
case SMB_REQ_STATE_CANCEL_PENDING:
case SMB_REQ_STATE_CANCELLED:
/*
* No action required for these states since the request
* is completing.
*/
break;
case SMB_REQ_STATE_FREE:
default:
SMB_PANIC();
}
mutex_exit(&sr->sr_mutex);
if (cancel_method != NULL) {
cancel_method(sr);
}
}
/*
* smb_session_receiver
*
* Receives request from the network and dispatches them to a worker.
*
* When we receive a disconnect here, it _could_ be due to the server
* having initiated disconnect, in which case the session state will be
* SMB_SESSION_STATE_TERMINATED and we want to keep that state so later
* tear-down logic will know which side initiated.
*/
void
smb_session_receiver(smb_session_t *session)
{
int rc = 0;
timeout_id_t tmo = NULL;
SMB_SESSION_VALID(session);
session->s_thread = curthread;
if (session->s_local_port == IPPORT_NETBIOS_SSN) {
rc = smb_netbios_session_request(session);
if (rc != 0) {
smb_rwx_rwenter(&session->s_lock, RW_WRITER);
if (session->s_state != SMB_SESSION_STATE_TERMINATED)
session->s_state =
SMB_SESSION_STATE_DISCONNECTED;
smb_rwx_rwexit(&session->s_lock);
return;
}
}
smb_rwx_rwenter(&session->s_lock, RW_WRITER);
session->s_state = SMB_SESSION_STATE_ESTABLISHED;
session->s_auth_tmo = timeout((tmo_func_t)smb_session_disconnect,
session, SEC_TO_TICK(smb_session_auth_tmo));
smb_rwx_rwexit(&session->s_lock);
(void) smb_session_reader(session);
smb_rwx_rwenter(&session->s_lock, RW_WRITER);
if (session->s_state != SMB_SESSION_STATE_TERMINATED)
session->s_state = SMB_SESSION_STATE_DISCONNECTED;
tmo = session->s_auth_tmo;
session->s_auth_tmo = NULL;
smb_rwx_rwexit(&session->s_lock);
/* Timeout callback takes s_lock. See untimeout(9f) */
if (tmo != NULL)
(void) untimeout(tmo);
smb_soshutdown(session->sock);
DTRACE_PROBE2(session__drop, struct session *, session, int, rc);
smb_session_cancel(session);
/*
* At this point everything related to the session should have been
* cleaned up and we expect that nothing will attempt to use the
* socket.
*/
}
/*
* smb_session_disconnect
*
* Server-initiated disconnect (i.e. server shutdown)
*/
void
smb_session_disconnect(smb_session_t *session)
{
SMB_SESSION_VALID(session);
smb_rwx_rwenter(&session->s_lock, RW_WRITER);
switch (session->s_state) {
case SMB_SESSION_STATE_INITIALIZED:
case SMB_SESSION_STATE_CONNECTED:
case SMB_SESSION_STATE_ESTABLISHED:
case SMB_SESSION_STATE_NEGOTIATED:
smb_soshutdown(session->sock);
session->s_state = SMB_SESSION_STATE_TERMINATED;
break;
case SMB_SESSION_STATE_DISCONNECTED:
case SMB_SESSION_STATE_TERMINATED:
break;
}
smb_rwx_rwexit(&session->s_lock);
}
/*
* Read and process SMB requests.
*
* Returns:
* 0 Success
* 1 Unable to read transport header
* 2 Invalid transport header type
* 3 Invalid SMB length (too small)
* 4 Unable to read SMB header
* 5 Invalid SMB header (bad magic number)
* 6 Unable to read SMB data
*/
static int
smb_session_reader(smb_session_t *session)
{
smb_server_t *sv;
smb_request_t *sr = NULL;
smb_xprt_t hdr;
uint8_t *req_buf;
uint32_t resid;
int rc;
sv = session->s_server;
for (;;) {
rc = smb_session_xprt_gethdr(session, &hdr);
if (rc)
return (rc);
DTRACE_PROBE2(session__receive__xprthdr, session_t *, session,
smb_xprt_t *, &hdr);
if (hdr.xh_type != SESSION_MESSAGE) {
/*
* Anything other than SESSION_MESSAGE or
* SESSION_KEEP_ALIVE is an error. A SESSION_REQUEST
* may indicate a new session request but we need to
* close this session and we can treat it as an error
* here.
*/
if (hdr.xh_type == SESSION_KEEP_ALIVE) {
session->keep_alive = smb_keep_alive;
continue;
}
return (EPROTO);
}
if (hdr.xh_length == 0) {
/* zero length is another form of keep alive */
session->keep_alive = smb_keep_alive;
continue;
}
if (hdr.xh_length < SMB_HEADER_LEN)
return (EPROTO);
if (hdr.xh_length > session->cmd_max_bytes)
return (EPROTO);
session->keep_alive = smb_keep_alive;
/*
* Allocate a request context, read the whole message.
* If the request alloc fails, we've disconnected
* and won't be able to send the reply anyway, so bail now.
*/
if ((sr = smb_request_alloc(session, hdr.xh_length)) == NULL)
break;
req_buf = (uint8_t *)sr->sr_request_buf;
resid = hdr.xh_length;
rc = smb_sorecv(session->sock, req_buf, resid);
if (rc) {
smb_request_free(sr);
break;
}
/* accounting: received bytes */
smb_server_add_rxb(sv,
(int64_t)(hdr.xh_length + NETBIOS_HDR_SZ));
/*
* Initialize command MBC to represent the received data.
*/
smb_request_init_command_mbuf(sr);
DTRACE_PROBE1(session__receive__smb, smb_request_t *, sr);
rc = session->newrq_func(sr);
sr = NULL; /* enqueued or freed */
if (rc != 0)
break;
/* See notes where this is defined (above). */
if (smb_reader_delay) {
delay(MSEC_TO_TICK(smb_reader_delay));
}
}
return (rc);
}
/*
* This is the initial handler for new smb requests, called from
* from smb_session_reader when we have not yet seen any requests.
* The first SMB request must be "negotiate", which determines
* which protocol and dialect we'll be using. That's the ONLY
* request type handled here, because with all later requests,
* we know the protocol and handle those with either the SMB1 or
* SMB2 handlers: smb1sr_post() or smb2sr_post().
* Those do NOT allow SMB negotiate, because that's only allowed
* as the first request on new session.
*
* This and other "post a request" handlers must either enqueue
* the new request for the session taskq, or smb_request_free it
* (in case we've decided to drop this connection). In this
* (special) new request handler, we always free the request.
*
* Return value is 0 for success, and anything else will
* terminate the reader thread (drop the connection).
*/
static int
smbsr_newrq_initial(smb_request_t *sr)
{
uint32_t magic;
int rc = EPROTO;
mutex_enter(&sr->sr_mutex);
sr->sr_state = SMB_REQ_STATE_ACTIVE;
mutex_exit(&sr->sr_mutex);
magic = SMB_READ_PROTOCOL(sr->sr_request_buf);
if (magic == SMB_PROTOCOL_MAGIC)
rc = smb1_newrq_negotiate(sr);
if (magic == SMB2_PROTOCOL_MAGIC)
rc = smb2_newrq_negotiate(sr);
mutex_enter(&sr->sr_mutex);
sr->sr_state = SMB_REQ_STATE_COMPLETED;
mutex_exit(&sr->sr_mutex);
smb_request_free(sr);
return (rc);
}
/*
* Port will be IPPORT_NETBIOS_SSN or IPPORT_SMB.
*/
smb_session_t *
smb_session_create(ksocket_t new_so, uint16_t port, smb_server_t *sv,
int family)
{
struct sockaddr_in sin;
socklen_t slen;
struct sockaddr_in6 sin6;
smb_session_t *session;
int64_t now;
uint16_t rport;
session = kmem_cache_alloc(smb_cache_session, KM_SLEEP);
bzero(session, sizeof (smb_session_t));
if (smb_idpool_constructor(&session->s_uid_pool)) {
kmem_cache_free(smb_cache_session, session);
return (NULL);
}
if (smb_idpool_constructor(&session->s_tid_pool)) {
smb_idpool_destructor(&session->s_uid_pool);
kmem_cache_free(smb_cache_session, session);
return (NULL);
}
now = ddi_get_lbolt64();
session->s_server = sv;
session->s_kid = SMB_NEW_KID();
session->s_state = SMB_SESSION_STATE_INITIALIZED;
session->native_os = NATIVE_OS_UNKNOWN;
session->opentime = now;
session->keep_alive = smb_keep_alive;
session->activity_timestamp = now;
smb_session_genkey(session);
mutex_init(&session->s_credits_mutex, NULL, MUTEX_DEFAULT, NULL);
smb_slist_constructor(&session->s_req_list, sizeof (smb_request_t),
offsetof(smb_request_t, sr_session_lnd));
smb_llist_constructor(&session->s_user_list, sizeof (smb_user_t),
offsetof(smb_user_t, u_lnd));
smb_llist_constructor(&session->s_tree_list, sizeof (smb_tree_t),
offsetof(smb_tree_t, t_lnd));
smb_llist_constructor(&session->s_xa_list, sizeof (smb_xa_t),
offsetof(smb_xa_t, xa_lnd));
smb_net_txl_constructor(&session->s_txlst);
smb_rwx_init(&session->s_lock);
session->s_srqueue = &sv->sv_srqueue;
smb_server_get_cfg(sv, &session->s_cfg);
if (new_so == NULL) {
/*
* This call is creating the special "server" session,
* used for kshare export, oplock breaks, CA import.
* CA import creates temporary trees on this session
* and those should never get map/unmap up-calls, so
* force the map/unmap flags zero on this session.
* Set a "modern" dialect for CA import too, so
* pathname parse doesn't do OS/2 stuff, etc.
*/
session->s_cfg.skc_execflags = 0;
session->dialect = session->s_cfg.skc_max_protocol;
} else {
if (family == AF_INET) {
slen = sizeof (sin);
(void) ksocket_getsockname(new_so,
(struct sockaddr *)&sin, &slen, CRED());
bcopy(&sin.sin_addr,
&session->local_ipaddr.au_addr.au_ipv4,
sizeof (in_addr_t));
slen = sizeof (sin);
(void) ksocket_getpeername(new_so,
(struct sockaddr *)&sin, &slen, CRED());
bcopy(&sin.sin_addr,
&session->ipaddr.au_addr.au_ipv4,
sizeof (in_addr_t));
rport = sin.sin_port;
} else {
slen = sizeof (sin6);
(void) ksocket_getsockname(new_so,
(struct sockaddr *)&sin6, &slen, CRED());
bcopy(&sin6.sin6_addr,
&session->local_ipaddr.au_addr.au_ipv6,
sizeof (in6_addr_t));
slen = sizeof (sin6);
(void) ksocket_getpeername(new_so,
(struct sockaddr *)&sin6, &slen, CRED());
bcopy(&sin6.sin6_addr,
&session->ipaddr.au_addr.au_ipv6,
sizeof (in6_addr_t));
rport = sin6.sin6_port;
}
session->ipaddr.a_family = family;
session->local_ipaddr.a_family = family;
session->s_local_port = port;
session->s_remote_port = ntohs(rport);
session->sock = new_so;
(void) smb_inet_ntop(&session->ipaddr,
session->ip_addr_str, INET6_ADDRSTRLEN);
if (port == IPPORT_NETBIOS_SSN)
smb_server_inc_nbt_sess(sv);
else
smb_server_inc_tcp_sess(sv);
}
/*
* The initial new request handler is special,
* and only accepts negotiation requests.
*/
session->newrq_func = smbsr_newrq_initial;
/* These may increase in SMB2 negotiate. */
session->cmd_max_bytes = SMB_REQ_MAX_SIZE;
session->reply_max_bytes = SMB_REQ_MAX_SIZE;
session->s_magic = SMB_SESSION_MAGIC;
return (session);
}
void
smb_session_delete(smb_session_t *session)
{
ASSERT(session->s_magic == SMB_SESSION_MAGIC);
if (session->enc_mech != NULL)
smb3_encrypt_fini(session);
if (session->sign_fini != NULL)
session->sign_fini(session);
if (session->signing.mackey != NULL) {
kmem_free(session->signing.mackey,
session->signing.mackey_len);
}
if (session->preauth_mech != NULL)
smb31_preauth_fini(session);
session->s_magic = 0;
smb_rwx_destroy(&session->s_lock);
smb_net_txl_destructor(&session->s_txlst);
mutex_destroy(&session->s_credits_mutex);
smb_slist_destructor(&session->s_req_list);
smb_llist_destructor(&session->s_tree_list);
smb_llist_destructor(&session->s_user_list);
smb_llist_destructor(&session->s_xa_list);
ASSERT(session->s_tree_cnt == 0);
ASSERT(session->s_file_cnt == 0);
ASSERT(session->s_dir_cnt == 0);
smb_idpool_destructor(&session->s_tid_pool);
smb_idpool_destructor(&session->s_uid_pool);
if (session->sock != NULL) {
if (session->s_local_port == IPPORT_NETBIOS_SSN)
smb_server_dec_nbt_sess(session->s_server);
else
smb_server_dec_tcp_sess(session->s_server);
smb_sodestroy(session->sock);
}
kmem_cache_free(smb_cache_session, session);
}
static void
smb_session_cancel(smb_session_t *session)
{
smb_xa_t *xa, *nextxa;
/* All the request currently being treated must be canceled. */
smb_session_cancel_requests(session, NULL, NULL);
/*
* We wait for the completion of all the requests associated with
* this session.
*/
smb_slist_wait_for_empty(&session->s_req_list);
/*
* Cleanup transact state objects
*/
xa = smb_llist_head(&session->s_xa_list);
while (xa) {
nextxa = smb_llist_next(&session->s_xa_list, xa);
smb_xa_close(xa);
xa = nextxa;
}
/*
* At this point the reference count of the files and directories
* should be zero. It should be possible to destroy them without
* any problem, which should trigger the destruction of other objects.
*/
smb_session_logoff(session);
}
/*
* Cancel requests. If a non-null tree is specified, only requests specific
* to that tree will be cancelled. If a non-null sr is specified, that sr
* will be not be cancelled - this would typically be the caller's sr.
*/
void
smb_session_cancel_requests(
smb_session_t *session,
smb_tree_t *tree,
smb_request_t *exclude_sr)
{
smb_request_t *sr;
smb_slist_enter(&session->s_req_list);
sr = smb_slist_head(&session->s_req_list);
while (sr) {
ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
if ((sr != exclude_sr) &&
(tree == NULL || sr->tid_tree == tree))
smb_request_cancel(sr);
sr = smb_slist_next(&session->s_req_list, sr);
}
smb_slist_exit(&session->s_req_list);
}
/*
* Find a user on the specified session by SMB UID.
*/
smb_user_t *
smb_session_lookup_uid(smb_session_t *session, uint16_t uid)
{
return (smb_session_lookup_uid_st(session, 0, uid,
SMB_USER_STATE_LOGGED_ON));
}
/*
* Find a user on the specified session by SMB2 SSNID.
*/
smb_user_t *
smb_session_lookup_ssnid(smb_session_t *session, uint64_t ssnid)
{
return (smb_session_lookup_uid_st(session, ssnid, 0,
SMB_USER_STATE_LOGGED_ON));
}
smb_user_t *
smb_session_lookup_uid_st(smb_session_t *session, uint64_t ssnid,
uint16_t uid, smb_user_state_t st)
{
smb_user_t *user;
smb_llist_t *user_list;
SMB_SESSION_VALID(session);
user_list = &session->s_user_list;
smb_llist_enter(user_list, RW_READER);
for (user = smb_llist_head(user_list);
user != NULL;
user = smb_llist_next(user_list, user)) {
SMB_USER_VALID(user);
ASSERT(user->u_session == session);
if (user->u_ssnid != ssnid && user->u_uid != uid)
continue;
mutex_enter(&user->u_mutex);
if (user->u_state == st) {
// smb_user_hold_internal(user);
user->u_refcnt++;
mutex_exit(&user->u_mutex);
break;
}
mutex_exit(&user->u_mutex);
}
smb_llist_exit(user_list);
return (user);
}
/*
* Find a tree by tree-id.
*/
smb_tree_t *
smb_session_lookup_tree(
smb_session_t *session,
uint16_t tid)
{
smb_tree_t *tree;
SMB_SESSION_VALID(session);
smb_llist_enter(&session->s_tree_list, RW_READER);
tree = smb_llist_head(&session->s_tree_list);
while (tree) {
ASSERT3U(tree->t_magic, ==, SMB_TREE_MAGIC);
ASSERT(tree->t_session == session);
if (tree->t_tid == tid) {
if (smb_tree_hold(tree)) {
smb_llist_exit(&session->s_tree_list);
return (tree);
} else {
smb_llist_exit(&session->s_tree_list);
return (NULL);
}
}
tree = smb_llist_next(&session->s_tree_list, tree);
}
smb_llist_exit(&session->s_tree_list);
return (NULL);
}
/*
* Disconnect all trees that match the specified client process-id.
* Used by the SMB1 "process exit" request.
*/
void
smb_session_close_pid(
smb_session_t *session,
uint32_t pid)
{
smb_llist_t *tree_list = &session->s_tree_list;
smb_tree_t *tree;
smb_llist_enter(tree_list, RW_READER);
tree = smb_llist_head(tree_list);
while (tree) {
if (smb_tree_hold(tree)) {
smb_tree_close_pid(tree, pid);
smb_tree_release(tree);
}
tree = smb_llist_next(tree_list, tree);
}
smb_llist_exit(tree_list);
}
static void
smb_session_tree_dtor(void *arg)
{
smb_tree_t *tree = arg;
smb_tree_disconnect(tree, B_TRUE);
/* release the ref acquired during the traversal loop */
smb_tree_release(tree);
}
/*
* Disconnect all trees that this user has connected.
*/
void
smb_session_disconnect_owned_trees(
smb_session_t *session,
smb_user_t *owner)
{
smb_tree_t *tree;
smb_llist_t *tree_list = &session->s_tree_list;
SMB_SESSION_VALID(session);
SMB_USER_VALID(owner);
smb_llist_enter(tree_list, RW_READER);
tree = smb_llist_head(tree_list);
while (tree) {
if ((tree->t_owner == owner) &&
smb_tree_hold(tree)) {
/*
* smb_tree_hold() succeeded, hence we are in state
* SMB_TREE_STATE_CONNECTED; schedule this tree
* for disconnect after smb_llist_exit because
* the "unmap exec" up-call can block, and we'd
* rather not block with the tree list locked.
*/
smb_llist_post(tree_list, tree, smb_session_tree_dtor);
}
tree = smb_llist_next(tree_list, tree);
}
/* drop the lock and flush the dtor queue */
smb_llist_exit(tree_list);
}
/*
* Disconnect all trees that this user has connected.
*/
static void
smb_session_disconnect_trees(
smb_session_t *session)
{
smb_llist_t *tree_list = &session->s_tree_list;
smb_tree_t *tree;
smb_llist_enter(tree_list, RW_READER);
tree = smb_llist_head(tree_list);
while (tree) {
if (smb_tree_hold(tree)) {
smb_llist_post(tree_list, tree,
smb_session_tree_dtor);
}
tree = smb_llist_next(tree_list, tree);
}
/* drop the lock and flush the dtor queue */
smb_llist_exit(tree_list);
}
/*
* Variant of smb_session_tree_dtor that also
* cancels requests using this tree.
*/
static void
smb_session_tree_kill(void *arg)
{
smb_tree_t *tree = arg;
SMB_TREE_VALID(tree);
smb_tree_disconnect(tree, B_TRUE);
smb_session_cancel_requests(tree->t_session, tree, NULL);
/* release the ref acquired during the traversal loop */
smb_tree_release(tree);
}
/*
* Disconnect all trees that match the specified share name,
* and kill requests using those trees.
*/
void
smb_session_disconnect_share(
smb_session_t *session,
const char *sharename)
{
smb_llist_t *ll;
smb_tree_t *tree;
SMB_SESSION_VALID(session);
ll = &session->s_tree_list;
smb_llist_enter(ll, RW_READER);
for (tree = smb_llist_head(ll);
tree != NULL;
tree = smb_llist_next(ll, tree)) {
SMB_TREE_VALID(tree);
ASSERT(tree->t_session == session);
if (smb_strcasecmp(tree->t_sharename, sharename, 0) != 0)
continue;
if (smb_tree_hold(tree)) {
smb_llist_post(ll, tree,
smb_session_tree_kill);
}
}
smb_llist_exit(ll);
}
int smb_session_logoff_maxwait = 2 * MILLISEC; /* 2 sec. */
/*
* Logoff all users associated with the specified session.
*
* This is called for both server-initiated disconnect
* (SMB_SESSION_STATE_TERMINATED) and client-initiated
* disconnect (SMB_SESSION_STATE_DISCONNECTED).
* If client-initiated, save durable handles.
*/
void
smb_session_logoff(smb_session_t *session)
{
smb_llist_t *ulist;
smb_user_t *user;
int count;
int timeleft = smb_session_logoff_maxwait;
SMB_SESSION_VALID(session);
top:
ulist = &session->s_user_list;
smb_llist_enter(ulist, RW_READER);
user = smb_llist_head(ulist);
while (user) {
SMB_USER_VALID(user);
ASSERT(user->u_session == session);
mutex_enter(&user->u_mutex);
switch (user->u_state) {
case SMB_USER_STATE_LOGGING_ON:
case SMB_USER_STATE_LOGGED_ON:
// smb_user_hold_internal(user);
user->u_refcnt++;
mutex_exit(&user->u_mutex);
smb_user_logoff(user);
smb_user_release(user);
break;
case SMB_USER_STATE_LOGGED_OFF:
case SMB_USER_STATE_LOGGING_OFF:
mutex_exit(&user->u_mutex);
break;
default:
mutex_exit(&user->u_mutex);
ASSERT(0);
break;
}
user = smb_llist_next(ulist, user);
}
count = smb_llist_get_count(ulist);
/* drop the lock and flush the dtor queue */
smb_llist_exit(ulist);
/*
* Wait (briefly) for user objects to go away.
* They might linger, eg. if some ofile ref has been
* forgotten, which holds, a tree and a user.
* See smb_session_destroy.
*/
if (count == 0) {
/* User list is empty. */
smb_rwx_rwenter(&session->s_lock, RW_WRITER);
session->s_state = SMB_SESSION_STATE_SHUTDOWN;
smb_rwx_rwexit(&session->s_lock);
} else {
smb_rwx_rwenter(&session->s_lock, RW_READER);
if (session->s_state != SMB_SESSION_STATE_SHUTDOWN &&
timeleft > 0) {
/* May be signaled in smb_user_delete */
(void) smb_rwx_cvwait(&session->s_lock,
MSEC_TO_TICK(200));
timeleft -= 200;
smb_rwx_rwexit(&session->s_lock);
goto top;
}
smb_rwx_rwexit(&session->s_lock);
}
/*
* User list should be empty now.
* (Checked in smb_session_destroy)
*/
/*
* User logoff happens first so we'll set preserve_opens
* for client-initiated disconnect. When that's done
* there should be no trees left, but check anyway.
*/
smb_session_disconnect_trees(session);
}
/*
* Copy the session workstation/client name to buf. If the workstation
* is an empty string (which it will be on TCP connections), use the
* client IP address.
*/
void
smb_session_getclient(smb_session_t *sn, char *buf, size_t buflen)
{
*buf = '\0';
if (sn->workstation[0] != '\0') {
(void) strlcpy(buf, sn->workstation, buflen);
return;
}
(void) strlcpy(buf, sn->ip_addr_str, buflen);
}
/*
* Check whether or not the specified client name is the client of this
* session. The name may be in UNC format (\\CLIENT).
*
* A workstation/client name is setup on NBT connections as part of the
* NetBIOS session request but that isn't available on TCP connections.
* If the session doesn't have a client name we typically return the
* client IP address as the workstation name on MSRPC requests. So we
* check for the IP address here in addition to the workstation name.
*/
boolean_t
smb_session_isclient(smb_session_t *sn, const char *client)
{
client += strspn(client, "\\");
if (smb_strcasecmp(client, sn->workstation, 0) == 0)
return (B_TRUE);
if (smb_strcasecmp(client, sn->ip_addr_str, 0) == 0)
return (B_TRUE);
return (B_FALSE);
}
/*
* smb_request_alloc
*
* Allocate an smb_request_t structure from the kmem_cache. Partially
* initialize the found/new request.
*
* Returns pointer to a request, or NULL if the session state is
* one in which new requests are no longer allowed.
*/
smb_request_t *
smb_request_alloc(smb_session_t *session, int req_length)
{
smb_request_t *sr;
ASSERT(session->s_magic == SMB_SESSION_MAGIC);
ASSERT(req_length <= session->cmd_max_bytes);
sr = kmem_cache_alloc(smb_cache_request, KM_SLEEP);
/*
* Future: Use constructor to pre-initialize some fields. For now
* there are so many fields that it is easiest just to zero the
* whole thing and start over.
*/
bzero(sr, sizeof (smb_request_t));
mutex_init(&sr->sr_mutex, NULL, MUTEX_DEFAULT, NULL);
smb_srm_init(sr);
sr->session = session;
sr->sr_server = session->s_server;
sr->sr_gmtoff = session->s_server->si_gmtoff;
sr->sr_cfg = &session->s_cfg;
sr->command.max_bytes = req_length;
sr->reply.max_bytes = session->reply_max_bytes;
sr->sr_req_length = req_length;
if (req_length)
sr->sr_request_buf = kmem_alloc(req_length, KM_SLEEP);
sr->sr_magic = SMB_REQ_MAGIC;
sr->sr_state = SMB_REQ_STATE_INITIALIZING;
/*
* Only allow new SMB requests in some states.
*/
smb_rwx_rwenter(&session->s_lock, RW_WRITER);
switch (session->s_state) {
case SMB_SESSION_STATE_CONNECTED:
case SMB_SESSION_STATE_INITIALIZED:
case SMB_SESSION_STATE_ESTABLISHED:
case SMB_SESSION_STATE_NEGOTIATED:
smb_slist_insert_tail(&session->s_req_list, sr);
break;
default:
ASSERT(0);
/* FALLTHROUGH */
case SMB_SESSION_STATE_DISCONNECTED:
case SMB_SESSION_STATE_SHUTDOWN:
case SMB_SESSION_STATE_TERMINATED:
/* Disallow new requests in these states. */
if (sr->sr_request_buf)
kmem_free(sr->sr_request_buf, sr->sr_req_length);
sr->session = NULL;
sr->sr_magic = 0;
mutex_destroy(&sr->sr_mutex);
kmem_cache_free(smb_cache_request, sr);
sr = NULL;
break;
}
smb_rwx_rwexit(&session->s_lock);
return (sr);
}
/*
* smb_request_free
*
* release the memories which have been allocated for a smb request.
*/
void
smb_request_free(smb_request_t *sr)
{
ASSERT(sr->sr_magic == SMB_REQ_MAGIC);
ASSERT(sr->session);
ASSERT(sr->r_xa == NULL);
if (sr->fid_ofile != NULL) {
smb_ofile_release(sr->fid_ofile);
}
if (sr->tid_tree != NULL)
smb_tree_release(sr->tid_tree);
if (sr->uid_user != NULL)
smb_user_release(sr->uid_user);
if (sr->tform_ssn != NULL)
smb_user_release(sr->tform_ssn);
/*
* The above may have left work on the delete queues
*/
smb_llist_flush(&sr->session->s_tree_list);
smb_llist_flush(&sr->session->s_user_list);
smb_slist_remove(&sr->session->s_req_list, sr);
sr->session = NULL;
smb_srm_fini(sr);
if (sr->sr_request_buf)
kmem_free(sr->sr_request_buf, sr->sr_req_length);
if (sr->command.chain)
m_freem(sr->command.chain);
if (sr->reply.chain)
m_freem(sr->reply.chain);
if (sr->raw_data.chain)
m_freem(sr->raw_data.chain);
sr->sr_magic = 0;
mutex_destroy(&sr->sr_mutex);
kmem_cache_free(smb_cache_request, sr);
}
boolean_t
smb_session_oplocks_enable(smb_session_t *session)
{
SMB_SESSION_VALID(session);
if (session->s_cfg.skc_oplock_enable == 0)
return (B_FALSE);
else
return (B_TRUE);
}
boolean_t
smb_session_levelII_oplocks(smb_session_t *session)
{
SMB_SESSION_VALID(session);
/* Older clients only do Level II oplocks if negotiated. */
if ((session->capabilities & CAP_LEVEL_II_OPLOCKS) != 0)
return (B_TRUE);
return (B_FALSE);
}
static void
smb_session_genkey(smb_session_t *session)
{
uint8_t tmp_key[SMB_CHALLENGE_SZ];
(void) random_get_pseudo_bytes(tmp_key, SMB_CHALLENGE_SZ);
bcopy(tmp_key, &session->challenge_key, SMB_CHALLENGE_SZ);
session->challenge_len = SMB_CHALLENGE_SZ;
(void) random_get_pseudo_bytes(tmp_key, 4);
session->sesskey = tmp_key[0] | tmp_key[1] << 8 |
tmp_key[2] << 16 | tmp_key[3] << 24;
}