1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
24 */
25
26 /*
27 * SMB requests.
28 *
29 * Request
30 * Header
31 * Magic 0xFF 'S' 'M' 'B'
32 * smb_com a byte, the "first" command
33 * Error a 4-byte union, ignored in a request
34 * smb_flg a one byte set of eight flags
35 * smb_flg2 a two byte set of 16 flags
36 * . twelve reserved bytes, have a role
37 * in connectionless transports (IPX, UDP?)
38 * smb_tid a 16-bit tree ID, a mount point sorta,
39 * 0xFFFF is this command does not have
40 * or require a tree context
41 * smb_pid a 16-bit process ID
42 * smb_uid a 16-bit user ID, specific to this "session"
43 * and mapped to a system (bona-fide) UID
44 * smb_mid a 16-bit multiplex ID, used to differentiate
45 * multiple simultaneous requests from the same
46 * process (pid) (ref RPC "xid")
47 *
48 * Chained (AndX) commands (0 or more)
49 * smb_wct a byte, number of 16-bit words containing
50 * command parameters, min 2 for chained command
51 * andx_com a byte, the "next" command, 0xFF for none
52 * . an unused byte
53 * andx_off a 16-bit offset, byte displacement from &Magic
54 * to the smb_wct field of the "next" command,
55 * ignore if andx_com is 0xFF, s/b 0 if no next
56 * smb_vwv[] 0 or more 16-bit (sorta) parameters for
57 * "this" command (i.e. smb_com if this is the
58 * first parameters, or the andx_com of the just
59 * previous block.
60 * smb_bcc a 16-bit count of smb_data[] bytes
61 * smb_data[] 0 or more bytes, format specific to commands
62 * padding[] Optional padding
63 *
64 * Last command
65 * smb_wct a byte, number of 16-bit words containing
66 * command parameters, min 0 for chained command
67 * smb_vwv[] 0 or more 16-bit (sorta) parameters for
68 * "this" command (i.e. smb_com if this is the
69 * first parameters, or the andx_com of the just
70 * previous block.
71 * smb_bcc a 16-bit count of smb_data[] bytes
72 * smb_data[] 0 or more bytes, format specific to commands
73 *
74 * Reply
75 * Header
76 * Magic 0xFF 'S' 'M' 'B'
77 * smb_com a byte, the "first" command, corresponds
78 * to request
79 * Error a 4-byte union, coding depends on dialect in use
80 * for "DOS" errors
81 * a byte for error class
82 * an unused byte
83 * a 16-bit word for error code
84 * for "NT" errors
85 * a 32-bit error code which
86 * is a packed class and specifier
87 * for "OS/2" errors
88 * I don't know
89 * The error information is specific to the
90 * last command in the reply chain.
91 * smb_flg a one byte set of eight flags, 0x80 bit set
92 * indicating this message is a reply
93 * smb_flg2 a two byte set of 16 flags
94 * . twelve reserved bytes, have a role
95 * in connectionless transports (IPX, UDP?)
96 * smb_tid a 16-bit tree ID, a mount point sorta,
97 * should be the same as the request
98 * smb_pid a 16-bit process ID, MUST BE the same as request
99 * smb_uid a 16-bit user ID, specific to this "session"
100 * and mapped to a system (bona-fide) UID,
101 * should be the same as request
102 * smb_mid a 16-bit multiplex ID, used to differentiate
103 * multiple simultaneous requests from the same
104 * process (pid) (ref RPC "xid"), MUST BE the
105 * same as request
106 * padding[] Optional padding
107 *
108 * Chained (AndX) commands (0 or more)
109 * smb_wct a byte, number of 16-bit words containing
110 * command parameters, min 2 for chained command,
111 * andx_com a byte, the "next" command, 0xFF for none,
112 * corresponds to request, if this is the chained
113 * command that had an error set to 0xFF
114 * . an unused byte
115 * andx_off a 16-bit offset, byte displacement from &Magic
116 * to the smb_wct field of the "next" command,
117 * ignore if andx_com is 0xFF, s/b 0 if no next
118 * smb_vwv[] 0 or more 16-bit (sorta) parameters for
119 * "this" command (i.e. smb_com if this is the
120 * first parameters, or the andx_com of the just
121 * previous block. Empty if an error.
122 * smb_bcc a 16-bit count of smb_data[] bytes
123 * smb_data[] 0 or more bytes, format specific to commands
124 * empty if an error.
125 *
126 * Last command
127 * smb_wct a byte, number of 16-bit words containing
128 * command parameters, min 0 for chained command
129 * smb_vwv[] 0 or more 16-bit (sorta) parameters for
130 * "this" command (i.e. smb_com if this is the
131 * first parameters, or the andx_com of the just
132 * previous block, empty if an error.
133 * smb_bcc a 16-bit count of smb_data[] bytes
134 * smb_data[] 0 or more bytes, format specific to commands,
135 * empty if an error.
136 */
137
138 #include <smbsrv/smb_kproto.h>
139 #include <smbsrv/smb_kstat.h>
140 #include <sys/sdt.h>
141 #include <sys/spl.h>
142
143 static int smb_legacy_dispatch_stats_update(kstat_t *, int);
144 static int is_andx_com(unsigned char);
145 static int smbsr_check_result(struct smb_request *, int, int);
146
147 static kstat_t *smb_legacy_dispatch_ksp = NULL;
148 static kmutex_t smb_legacy_dispatch_ksmtx;
149
150 static smb_disp_entry_t smb_disp_table[SMB_COM_NUM] = {
151 { "SmbCreateDirectory", SMB_SDT_OPS(create_directory), /* 0x00 000 */
152 0x00, PC_NETWORK_PROGRAM_1_0 },
153 { "SmbDeleteDirectory", SMB_SDT_OPS(delete_directory), /* 0x01 001 */
154 0x01, PC_NETWORK_PROGRAM_1_0 },
155 { "SmbOpen", SMB_SDT_OPS(open), /* 0x02 002 */
156 0x02, PC_NETWORK_PROGRAM_1_0 },
157 { "SmbCreate", SMB_SDT_OPS(create), /* 0x03 003 */
158 0x03, PC_NETWORK_PROGRAM_1_0 },
159 { "SmbClose", SMB_SDT_OPS(close), /* 0x04 004 */
160 0x04, PC_NETWORK_PROGRAM_1_0 },
161 { "SmbFlush", SMB_SDT_OPS(flush), /* 0x05 005 */
162 0x05, PC_NETWORK_PROGRAM_1_0 },
163 { "SmbDelete", SMB_SDT_OPS(delete), /* 0x06 006 */
164 0x06, PC_NETWORK_PROGRAM_1_0 },
165 { "SmbRename", SMB_SDT_OPS(rename), /* 0x07 007 */
166 0x07, PC_NETWORK_PROGRAM_1_0 },
167 { "SmbQueryInformation", SMB_SDT_OPS(query_information), /* 0x08 008 */
168 0x08, PC_NETWORK_PROGRAM_1_0 },
169 { "SmbSetInformation", SMB_SDT_OPS(set_information), /* 0x09 009 */
170 0x09, PC_NETWORK_PROGRAM_1_0 },
171 { "SmbRead", SMB_SDT_OPS(read), /* 0x0A 010 */
172 0x0A, PC_NETWORK_PROGRAM_1_0 },
173 { "SmbWrite", SMB_SDT_OPS(write), /* 0x0B 011 */
174 0x0B, PC_NETWORK_PROGRAM_1_0 },
175 { "SmbLockByteRange", SMB_SDT_OPS(lock_byte_range), /* 0x0C 012 */
176 0x0C, PC_NETWORK_PROGRAM_1_0 },
177 { "SmbUnlockByteRange", SMB_SDT_OPS(unlock_byte_range), /* 0x0D 013 */
178 0x0D, PC_NETWORK_PROGRAM_1_0 },
179 { "SmbCreateTemporary", SMB_SDT_OPS(create_temporary), /* 0x0E 014 */
180 0x0E, PC_NETWORK_PROGRAM_1_0 },
181 { "SmbCreateNew", SMB_SDT_OPS(create_new), /* 0x0F 015 */
182 0x0F, PC_NETWORK_PROGRAM_1_0 },
183 { "SmbCheckDirectory", SMB_SDT_OPS(check_directory), /* 0x10 016 */
184 0x10, PC_NETWORK_PROGRAM_1_0 },
185 { "SmbProcessExit", SMB_SDT_OPS(process_exit), /* 0x11 017 */
186 0x11, PC_NETWORK_PROGRAM_1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID,
187 0, 0, { 0 } },
188 { "SmbSeek", SMB_SDT_OPS(seek), /* 0x12 018 */
189 0x12, PC_NETWORK_PROGRAM_1_0 },
190 { "SmbLockAndRead", SMB_SDT_OPS(lock_and_read), /* 0x13 019 */
191 0x13, LANMAN1_0 },
192 { "SmbWriteAndUnlock", SMB_SDT_OPS(write_and_unlock), /* 0x14 020 */
193 0x14, LANMAN1_0 },
194 { "Invalid", SMB_SDT_OPS(invalid), 0x15, 0 }, /* 0x15 021 */
195 { "Invalid", SMB_SDT_OPS(invalid), 0x16, 0 }, /* 0x16 022 */
196 { "Invalid", SMB_SDT_OPS(invalid), 0x17, 0 }, /* 0x17 023 */
197 { "Invalid", SMB_SDT_OPS(invalid), 0x18, 0 }, /* 0x18 024 */
198 { "Invalid", SMB_SDT_OPS(invalid), 0x19, 0 }, /* 0x19 025 */
199 { "SmbReadRaw", SMB_SDT_OPS(read_raw), /* 0x1A 026 */
200 0x1A, LANMAN1_0 },
201 { "Invalid", SMB_SDT_OPS(invalid), 0x1B, 0 }, /* 0x1B 027 */
202 { "Invalid", SMB_SDT_OPS(invalid), 0x1C, 0 }, /* 0x1C 028 */
203 { "SmbWriteRaw", SMB_SDT_OPS(write_raw), /* 0x1D 029 */
204 0x1D, LANMAN1_0 },
205 { "Invalid", SMB_SDT_OPS(invalid), 0x1E, 0 }, /* 0x1E 030 */
206 { "Invalid", SMB_SDT_OPS(invalid), 0x1F, 0 }, /* 0x1F 031 */
207 { "Invalid", SMB_SDT_OPS(invalid), 0x20, 0 }, /* 0x20 032 */
208 { "Invalid", SMB_SDT_OPS(invalid), 0x21, 0 }, /* 0x21 033 */
209 { "SmbSetInformation2", SMB_SDT_OPS(set_information2), /* 0x22 034 */
210 0x22, LANMAN1_0 },
211 { "SmbQueryInformation2",
212 SMB_SDT_OPS(query_information2), /* 0x23 035 */
213 0x23, LANMAN1_0 },
214 { "SmbLockingX", SMB_SDT_OPS(locking_andx), /* 0x24 036 */
215 0x24, LANMAN1_0 },
216 { "SmbTransaction", SMB_SDT_OPS(transaction), /* 0x25 037 */
217 0x25, LANMAN1_0 },
218 { "SmbTransactionSecondary",
219 SMB_SDT_OPS(transaction_secondary), /* 0x26 038 */
220 0x26, LANMAN1_0 },
221 { "SmbIoctl", SMB_SDT_OPS(ioctl), /* 0x27 039 */
222 0x27, LANMAN1_0 },
223 { "Invalid", SMB_SDT_OPS(invalid), 0x28, 0 }, /* 0x28 040 */
224 { "Invalid", SMB_SDT_OPS(invalid), 0x29, 0 }, /* 0x29 041 */
225 { "Invalid", SMB_SDT_OPS(invalid), 0x2A, 0 }, /* 0x2A 042 */
226 { "SmbEcho", SMB_SDT_OPS(echo), /* 0x2B 043 */
227 0x2B, LANMAN1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
228 { "SmbWriteAndClose", SMB_SDT_OPS(write_and_close), /* 0x2C 044 */
229 0x2C, LANMAN1_0 },
230 { "SmbOpenX", SMB_SDT_OPS(open_andx), /* 0x2D 045 */
231 0x2D, LANMAN1_0 },
232 { "SmbReadX", SMB_SDT_OPS(read_andx), /* 0x2E 046 */
233 0x2E, LANMAN1_0 },
234 { "SmbWriteX", SMB_SDT_OPS(write_andx), /* 0x2F 047 */
235 0x2F, LANMAN1_0 },
236 { "Invalid", SMB_SDT_OPS(invalid), 0x30, 0 }, /* 0x30 048 */
237 { "SmbCloseAndTreeDisconnect",
238 SMB_SDT_OPS(close_and_tree_disconnect), /* 0x31 049 */
239 0x31, LANMAN1_0 },
240 { "SmbTransaction2", SMB_SDT_OPS(transaction2), /* 0x32 050 */
241 0x32, LM1_2X002 },
242 { "SmbTransaction2Secondary",
243 SMB_SDT_OPS(transaction2_secondary), /* 0x33 051 */
244 0x33, LM1_2X002 },
245 { "SmbFindClose2", SMB_SDT_OPS(find_close2), /* 0x34 052 */
246 0x34, LM1_2X002 },
247 { "Invalid", SMB_SDT_OPS(invalid), 0x35, 0 }, /* 0x35 053 */
248 { "Invalid", SMB_SDT_OPS(invalid), 0x36, 0 }, /* 0x36 054 */
249 { "Invalid", SMB_SDT_OPS(invalid), 0x37, 0 }, /* 0x37 055 */
250 { "Invalid", SMB_SDT_OPS(invalid), 0x38, 0 }, /* 0x38 056 */
251 { "Invalid", SMB_SDT_OPS(invalid), 0x39, 0 }, /* 0x39 057 */
252 { "Invalid", SMB_SDT_OPS(invalid), 0x3A, 0 }, /* 0x3A 058 */
253 { "Invalid", SMB_SDT_OPS(invalid), 0x3B, 0 }, /* 0x3B 059 */
254 { "Invalid", SMB_SDT_OPS(invalid), 0x3C, 0 }, /* 0x3C 060 */
255 { "Invalid", SMB_SDT_OPS(invalid), 0x3D, 0 }, /* 0x3D 061 */
256 { "Invalid", SMB_SDT_OPS(invalid), 0x3E, 0 }, /* 0x3E 062 */
257 { "Invalid", SMB_SDT_OPS(invalid), 0x3F, 0 }, /* 0x3F 063 */
258 { "Invalid", SMB_SDT_OPS(invalid), 0x40, 0 }, /* 0x40 064 */
259 { "Invalid", SMB_SDT_OPS(invalid), 0x47, 0 }, /* 0x47 065 */
260 { "Invalid", SMB_SDT_OPS(invalid), 0x48, 0 }, /* 0x48 066 */
261 { "Invalid", SMB_SDT_OPS(invalid), 0x49, 0 }, /* 0x49 067 */
262 { "Invalid", SMB_SDT_OPS(invalid), 0x44, 0 }, /* 0x44 068 */
263 { "Invalid", SMB_SDT_OPS(invalid), 0x45, 0 }, /* 0x45 069 */
264 { "Invalid", SMB_SDT_OPS(invalid), 0x46, 0 }, /* 0x46 070 */
265 { "Invalid", SMB_SDT_OPS(invalid), 0x47, 0 }, /* 0x47 071 */
266 { "Invalid", SMB_SDT_OPS(invalid), 0x48, 0 }, /* 0x48 072 */
267 { "Invalid", SMB_SDT_OPS(invalid), 0x49, 0 }, /* 0x49 073 */
268 { "Invalid", SMB_SDT_OPS(invalid), 0x4A, 0 }, /* 0x4A 074 */
269 { "Invalid", SMB_SDT_OPS(invalid), 0x4B, 0 }, /* 0x4B 075 */
270 { "Invalid", SMB_SDT_OPS(invalid), 0x4C, 0 }, /* 0x4C 076 */
271 { "Invalid", SMB_SDT_OPS(invalid), 0x4D, 0 }, /* 0x4D 077 */
272 { "Invalid", SMB_SDT_OPS(invalid), 0x4E, 0 }, /* 0x4E 078 */
273 { "Invalid", SMB_SDT_OPS(invalid), 0x4F, 0 }, /* 0x4F 079 */
274 { "Invalid", SMB_SDT_OPS(invalid), 0x50, 0 }, /* 0x50 080 */
275 { "Invalid", SMB_SDT_OPS(invalid), 0x51, 0 }, /* 0x51 081 */
276 { "Invalid", SMB_SDT_OPS(invalid), 0x52, 0 }, /* 0x52 082 */
277 { "Invalid", SMB_SDT_OPS(invalid), 0x53, 0 }, /* 0x53 083 */
278 { "Invalid", SMB_SDT_OPS(invalid), 0x54, 0 }, /* 0x54 084 */
279 { "Invalid", SMB_SDT_OPS(invalid), 0x55, 0 }, /* 0x55 085 */
280 { "Invalid", SMB_SDT_OPS(invalid), 0x56, 0 }, /* 0x56 086 */
281 { "Invalid", SMB_SDT_OPS(invalid), 0x57, 0 }, /* 0x57 087 */
282 { "Invalid", SMB_SDT_OPS(invalid), 0x58, 0 }, /* 0x58 088 */
283 { "Invalid", SMB_SDT_OPS(invalid), 0x59, 0 }, /* 0x59 089 */
284 { "Invalid", SMB_SDT_OPS(invalid), 0x5A, 0 }, /* 0x5A 090 */
285 { "Invalid", SMB_SDT_OPS(invalid), 0x5B, 0 }, /* 0x5B 091 */
286 { "Invalid", SMB_SDT_OPS(invalid), 0x5C, 0 }, /* 0x5C 092 */
287 { "Invalid", SMB_SDT_OPS(invalid), 0x5D, 0 }, /* 0x5D 093 */
288 { "Invalid", SMB_SDT_OPS(invalid), 0x5E, 0 }, /* 0x5E 094 */
289 { "Invalid", SMB_SDT_OPS(invalid), 0x5F, 0 }, /* 0x5F 095 */
290 { "Invalid", SMB_SDT_OPS(invalid), 0x60, 0 }, /* 0x60 096 */
291 { "Invalid", SMB_SDT_OPS(invalid), 0x61, 0 }, /* 0x61 097 */
292 { "Invalid", SMB_SDT_OPS(invalid), 0x62, 0 }, /* 0x62 098 */
293 { "Invalid", SMB_SDT_OPS(invalid), 0x63, 0 }, /* 0x63 099 */
294 { "Invalid", SMB_SDT_OPS(invalid), 0x64, 0 }, /* 0x64 100 */
295 { "Invalid", SMB_SDT_OPS(invalid), 0x65, 0 }, /* 0x65 101 */
296 { "Invalid", SMB_SDT_OPS(invalid), 0x66, 0 }, /* 0x66 102 */
297 { "Invalid", SMB_SDT_OPS(invalid), 0x67, 0 }, /* 0x67 103 */
298 { "Invalid", SMB_SDT_OPS(invalid), 0x68, 0 }, /* 0x68 104 */
299 { "Invalid", SMB_SDT_OPS(invalid), 0x69, 0 }, /* 0x69 105 */
300 { "Invalid", SMB_SDT_OPS(invalid), 0x6A, 0 }, /* 0x6A 106 */
301 { "Invalid", SMB_SDT_OPS(invalid), 0x6B, 0 }, /* 0x6B 107 */
302 { "Invalid", SMB_SDT_OPS(invalid), 0x6C, 0 }, /* 0x6C 108 */
303 { "Invalid", SMB_SDT_OPS(invalid), 0x6D, 0 }, /* 0x6D 109 */
304 { "Invalid", SMB_SDT_OPS(invalid), 0x6E, 0 }, /* 0x6E 110 */
305 { "Invalid", SMB_SDT_OPS(invalid), 0x6F, 0 }, /* 0x6F 111 */
306 { "SmbTreeConnect", SMB_SDT_OPS(tree_connect), /* 0x70 112 */
307 0x70, PC_NETWORK_PROGRAM_1_0, SDDF_SUPPRESS_TID },
308 { "SmbTreeDisconnect", SMB_SDT_OPS(tree_disconnect), /* 0x71 113 */
309 0x71, PC_NETWORK_PROGRAM_1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID,
310 NULL },
311 { "SmbNegotiate", SMB_SDT_OPS(negotiate), /* 0x72 114 */
312 0x72, PC_NETWORK_PROGRAM_1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID,
313 NULL },
314 { "SmbSessionSetupX", SMB_SDT_OPS(session_setup_andx), /* 0x73 115 */
315 0x73, LANMAN1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
316 { "SmbLogoffX", SMB_SDT_OPS(logoff_andx), /* 0x74 116 */
317 0x74, LM1_2X002, SDDF_SUPPRESS_TID },
318 { "SmbTreeConnectX", SMB_SDT_OPS(tree_connect_andx), /* 0x75 117 */
319 0x75, LANMAN1_0, SDDF_SUPPRESS_TID },
320 { "Invalid", SMB_SDT_OPS(invalid), 0x76, 0, 0 }, /* 0x76 118 */
321 { "Invalid", SMB_SDT_OPS(invalid), 0x77, 0, 0 }, /* 0x77 119 */
322 { "Invalid", SMB_SDT_OPS(invalid), 0x78, 0, 0 }, /* 0x78 120 */
323 { "Invalid", SMB_SDT_OPS(invalid), 0x79, 0, 0 }, /* 0x79 121 */
324 { "Invalid", SMB_SDT_OPS(invalid), 0x7A, 0, 0 }, /* 0x7A 122 */
325 { "Invalid", SMB_SDT_OPS(invalid), 0x7B, 0, 0 }, /* 0x7B 123 */
326 { "Invalid", SMB_SDT_OPS(invalid), 0x7C, 0, 0 }, /* 0x7C 124 */
327 { "Invalid", SMB_SDT_OPS(invalid), 0x7D, 0, 0 }, /* 0x7D 125 */
328 { "Invalid", SMB_SDT_OPS(invalid), 0x7E, 0, 0 }, /* 0x7E 126 */
329 { "Invalid", SMB_SDT_OPS(invalid), 0x7F, 0, 0 }, /* 0x7F 127 */
330 { "SmbQueryInformationDisk",
331 SMB_SDT_OPS(query_information_disk), /* 0x80 128 */
332 0x80, PC_NETWORK_PROGRAM_1_0, 0 },
333 { "SmbSearch", SMB_SDT_OPS(search), /* 0x81 129 */
334 0x81, PC_NETWORK_PROGRAM_1_0, 0 },
335 { "SmbFind", SMB_SDT_OPS(find), /* 0x82 130 */
336 0x82, LANMAN1_0, 0 },
337 { "SmbFindUnique", SMB_SDT_OPS(find_unique), /* 0x83 131 */
338 0x83, LANMAN1_0, 0 },
339 { "SmbFindClose", SMB_SDT_OPS(find_close), /* 0x84 132 */
340 0x84, LANMAN1_0, 0 },
341 { "Invalid", SMB_SDT_OPS(invalid), 0x85, 0, 0 }, /* 0x85 133 */
342 { "Invalid", SMB_SDT_OPS(invalid), 0x86, 0, 0 }, /* 0x86 134 */
343 { "Invalid", SMB_SDT_OPS(invalid), 0x87, 0, 0 }, /* 0x87 135 */
344 { "Invalid", SMB_SDT_OPS(invalid), 0x88, 0, 0 }, /* 0x88 136 */
345 { "Invalid", SMB_SDT_OPS(invalid), 0x89, 0, 0 }, /* 0x89 137 */
346 { "Invalid", SMB_SDT_OPS(invalid), 0x8A, 0, 0 }, /* 0x8A 138 */
347 { "Invalid", SMB_SDT_OPS(invalid), 0x8B, 0, 0 }, /* 0x8B 139 */
348 { "Invalid", SMB_SDT_OPS(invalid), 0x8C, 0, 0 }, /* 0x8C 140 */
349 { "Invalid", SMB_SDT_OPS(invalid), 0x8D, 0, 0 }, /* 0x8D 141 */
350 { "Invalid", SMB_SDT_OPS(invalid), 0x8E, 0, 0 }, /* 0x8E 142 */
351 { "Invalid", SMB_SDT_OPS(invalid), 0x8F, 0, 0 }, /* 0x8F 143 */
352 { "Invalid", SMB_SDT_OPS(invalid), 0x90, 0, 0 }, /* 0x90 144 */
353 { "Invalid", SMB_SDT_OPS(invalid), 0x91, 0, 0 }, /* 0x91 145 */
354 { "Invalid", SMB_SDT_OPS(invalid), 0x92, 0, 0 }, /* 0x92 146 */
355 { "Invalid", SMB_SDT_OPS(invalid), 0x93, 0, 0 }, /* 0x93 147 */
356 { "Invalid", SMB_SDT_OPS(invalid), 0x94, 0, 0 }, /* 0x94 148 */
357 { "Invalid", SMB_SDT_OPS(invalid), 0x95, 0, 0 }, /* 0x95 149 */
358 { "Invalid", SMB_SDT_OPS(invalid), 0x96, 0, 0 }, /* 0x96 150 */
359 { "Invalid", SMB_SDT_OPS(invalid), 0x97, 0, 0 }, /* 0x97 151 */
360 { "Invalid", SMB_SDT_OPS(invalid), 0x98, 0, 0 }, /* 0x98 152 */
361 { "Invalid", SMB_SDT_OPS(invalid), 0x99, 0, 0 }, /* 0x99 153 */
362 { "Invalid", SMB_SDT_OPS(invalid), 0x9A, 0, 0 }, /* 0x9A 154 */
363 { "Invalid", SMB_SDT_OPS(invalid), 0x9B, 0, 0 }, /* 0x9B 155 */
364 { "Invalid", SMB_SDT_OPS(invalid), 0x9C, 0, 0 }, /* 0x9C 156 */
365 { "Invalid", SMB_SDT_OPS(invalid), 0x9D, 0, 0 }, /* 0x9D 157 */
366 { "Invalid", SMB_SDT_OPS(invalid), 0x9E, 0, 0 }, /* 0x9E 158 */
367 { "Invalid", SMB_SDT_OPS(invalid), 0x9F, 0, 0 }, /* 0x9F 159 */
368 { "SmbNtTransact", SMB_SDT_OPS(nt_transact), /* 0xA0 160 */
369 0xA0, NT_LM_0_12, 0 },
370 { "SmbNtTransactSecondary",
371 SMB_SDT_OPS(nt_transact_secondary), /* 0xA1 161 */
372 0xA1, NT_LM_0_12, 0 },
373 { "SmbNtCreateX", SMB_SDT_OPS(nt_create_andx), /* 0xA2 162 */
374 0xA2, NT_LM_0_12, 0 },
375 { "Invalid", SMB_SDT_OPS(invalid), 0xA3, 0, 0 }, /* 0xA3 163 */
376 { "SmbNtCancel", SMB_SDT_OPS(nt_cancel), /* 0xA4 164 */
377 0xA4, NT_LM_0_12, 0 },
378 { "SmbNtRename", SMB_SDT_OPS(nt_rename), /* 0xA5 165 */
379 0xA5, NT_LM_0_12, 0 },
380 { "Invalid", SMB_SDT_OPS(invalid), 0xA6, 0, 0 }, /* 0xA6 166 */
381 { "Invalid", SMB_SDT_OPS(invalid), 0xA7, 0, 0 }, /* 0xA7 167 */
382 { "Invalid", SMB_SDT_OPS(invalid), 0xA8, 0, 0 }, /* 0xA8 168 */
383 { "Invalid", SMB_SDT_OPS(invalid), 0xA9, 0, 0 }, /* 0xA9 169 */
384 { "Invalid", SMB_SDT_OPS(invalid), 0xAA, 0, 0 }, /* 0xAA 170 */
385 { "Invalid", SMB_SDT_OPS(invalid), 0xAB, 0, 0 }, /* 0xAB 171 */
386 { "Invalid", SMB_SDT_OPS(invalid), 0xAC, 0, 0 }, /* 0xAC 172 */
387 { "Invalid", SMB_SDT_OPS(invalid), 0xAD, 0, 0 }, /* 0xAD 173 */
388 { "Invalid", SMB_SDT_OPS(invalid), 0xAE, 0, 0 }, /* 0xAE 174 */
389 { "Invalid", SMB_SDT_OPS(invalid), 0xAF, 0, 0 }, /* 0xAF 175 */
390 { "Invalid", SMB_SDT_OPS(invalid), 0xB0, 0, 0 }, /* 0xB0 176 */
391 { "Invalid", SMB_SDT_OPS(invalid), 0xB1, 0, 0 }, /* 0xB1 177 */
392 { "Invalid", SMB_SDT_OPS(invalid), 0xB2, 0, 0 }, /* 0xB2 178 */
393 { "Invalid", SMB_SDT_OPS(invalid), 0xB3, 0, 0 }, /* 0xB3 179 */
394 { "Invalid", SMB_SDT_OPS(invalid), 0xB4, 0, 0 }, /* 0xB4 180 */
395 { "Invalid", SMB_SDT_OPS(invalid), 0xB5, 0, 0 }, /* 0xB5 181 */
396 { "Invalid", SMB_SDT_OPS(invalid), 0xB6, 0, 0 }, /* 0xB6 182 */
397 { "Invalid", SMB_SDT_OPS(invalid), 0xB7, 0, 0 }, /* 0xB7 183 */
398 { "Invalid", SMB_SDT_OPS(invalid), 0xB8, 0, 0 }, /* 0xB8 184 */
399 { "Invalid", SMB_SDT_OPS(invalid), 0xB9, 0, 0 }, /* 0xB9 185 */
400 { "Invalid", SMB_SDT_OPS(invalid), 0xBA, 0, 0 }, /* 0xBA 186 */
401 { "Invalid", SMB_SDT_OPS(invalid), 0xBB, 0, 0 }, /* 0xBB 187 */
402 { "Invalid", SMB_SDT_OPS(invalid), 0xBC, 0, 0 }, /* 0xBC 188 */
403 { "Invalid", SMB_SDT_OPS(invalid), 0xBD, 0, 0 }, /* 0xBD 189 */
404 { "Invalid", SMB_SDT_OPS(invalid), 0xBE, 0, 0 }, /* 0xBE 190 */
405 { "Invalid", SMB_SDT_OPS(invalid), 0xBF, 0, 0 }, /* 0xBF 191 */
406 { "SmbOpenPrintFile", SMB_SDT_OPS(open_print_file), /* 0xC0 192 */
407 0xC0, PC_NETWORK_PROGRAM_1_0, 0 },
408 { "SmbWritePrintFile", SMB_SDT_OPS(write_print_file), /* 0xC1 193 */
409 0xC1, PC_NETWORK_PROGRAM_1_0, 0 },
410 { "SmbClosePrintFile", SMB_SDT_OPS(close_print_file), /* 0xC2 194 */
411 0xC2, PC_NETWORK_PROGRAM_1_0, 0 },
412 { "SmbGetPrintQueue", SMB_SDT_OPS(get_print_queue), /* 0xC3 195 */
413 0xC3, PC_NETWORK_PROGRAM_1_0, 0 },
414 { "Invalid", SMB_SDT_OPS(invalid), 0xC4, 0, 0 }, /* 0xC4 196 */
415 { "Invalid", SMB_SDT_OPS(invalid), 0xC5, 0, 0 }, /* 0xC5 197 */
416 { "Invalid", SMB_SDT_OPS(invalid), 0xC6, 0, 0 }, /* 0xC6 198 */
417 { "Invalid", SMB_SDT_OPS(invalid), 0xC7, 0, 0 }, /* 0xC7 199 */
418 { "Invalid", SMB_SDT_OPS(invalid), 0xC8, 0, 0 }, /* 0xC8 200 */
419 { "Invalid", SMB_SDT_OPS(invalid), 0xC9, 0, 0 }, /* 0xC9 201 */
420 { "Invalid", SMB_SDT_OPS(invalid), 0xCA, 0, 0 }, /* 0xCA 202 */
421 { "Invalid", SMB_SDT_OPS(invalid), 0xCB, 0, 0 }, /* 0xCB 203 */
422 { "Invalid", SMB_SDT_OPS(invalid), 0xCC, 0, 0 }, /* 0xCC 204 */
423 { "Invalid", SMB_SDT_OPS(invalid), 0xCD, 0, 0 }, /* 0xCD 205 */
424 { "Invalid", SMB_SDT_OPS(invalid), 0xCE, 0, 0 }, /* 0xCE 206 */
425 { "Invalid", SMB_SDT_OPS(invalid), 0xCF, 0, 0 }, /* 0xCF 207 */
426 { "Invalid", SMB_SDT_OPS(invalid), 0xD0, 0, 0 }, /* 0xD0 208 */
427 { "Invalid", SMB_SDT_OPS(invalid), 0xD1, 0, 0 }, /* 0xD1 209 */
428 { "Invalid", SMB_SDT_OPS(invalid), 0xD2, 0, 0 }, /* 0xD2 210 */
429 { "Invalid", SMB_SDT_OPS(invalid), 0xD3, 0, 0 }, /* 0xD3 211 */
430 { "Invalid", SMB_SDT_OPS(invalid), 0xD4, 0, 0 }, /* 0xD4 212 */
431 { "Invalid", SMB_SDT_OPS(invalid), 0xD5, 0, 0 }, /* 0xD5 213 */
432 { "Invalid", SMB_SDT_OPS(invalid), 0xD6, 0, 0 }, /* 0xD6 214 */
433 { "Invalid", SMB_SDT_OPS(invalid), 0xD7, 0, 0 }, /* 0xD7 215 */
434 { "Invalid", SMB_SDT_OPS(invalid), 0xD8, 0, 0 }, /* 0xD8 216 */
435 { "Invalid", SMB_SDT_OPS(invalid), 0xD9, 0, 0 }, /* 0xD9 217 */
436 { "Invalid", SMB_SDT_OPS(invalid), 0xDA, 0, 0 }, /* 0xDA 218 */
437 { "Invalid", SMB_SDT_OPS(invalid), 0xDB, 0, 0 }, /* 0xDB 219 */
438 { "Invalid", SMB_SDT_OPS(invalid), 0xDC, 0, 0 }, /* 0xDC 220 */
439 { "Invalid", SMB_SDT_OPS(invalid), 0xDD, 0, 0 }, /* 0xDD 221 */
440 { "Invalid", SMB_SDT_OPS(invalid), 0xDE, 0, 0 }, /* 0xDE 222 */
441 { "Invalid", SMB_SDT_OPS(invalid), 0xDF, 0, 0 }, /* 0xDF 223 */
442 { "Invalid", SMB_SDT_OPS(invalid), 0xE0, 0, 0 }, /* 0xE0 224 */
443 { "Invalid", SMB_SDT_OPS(invalid), 0xE1, 0, 0 }, /* 0xE1 225 */
444 { "Invalid", SMB_SDT_OPS(invalid), 0xE2, 0, 0 }, /* 0xE2 226 */
445 { "Invalid", SMB_SDT_OPS(invalid), 0xE3, 0, 0 }, /* 0xE3 227 */
446 { "Invalid", SMB_SDT_OPS(invalid), 0xE4, 0, 0 }, /* 0xE4 228 */
447 { "Invalid", SMB_SDT_OPS(invalid), 0xE5, 0, 0 }, /* 0xE5 229 */
448 { "Invalid", SMB_SDT_OPS(invalid), 0xE6, 0, 0 }, /* 0xE6 230 */
449 { "Invalid", SMB_SDT_OPS(invalid), 0xE7, 0, 0 }, /* 0xE7 231 */
450 { "Invalid", SMB_SDT_OPS(invalid), 0xE8, 0, 0 }, /* 0xE8 232 */
451 { "Invalid", SMB_SDT_OPS(invalid), 0xE9, 0, 0 }, /* 0xE9 233 */
452 { "Invalid", SMB_SDT_OPS(invalid), 0xEA, 0, 0 }, /* 0xEA 234 */
453 { "Invalid", SMB_SDT_OPS(invalid), 0xEB, 0, 0 }, /* 0xEB 235 */
454 { "Invalid", SMB_SDT_OPS(invalid), 0xEC, 0, 0 }, /* 0xEC 236 */
455 { "Invalid", SMB_SDT_OPS(invalid), 0xED, 0, 0 }, /* 0xED 237 */
456 { "Invalid", SMB_SDT_OPS(invalid), 0xEE, 0, 0 }, /* 0xEE 238 */
457 { "Invalid", SMB_SDT_OPS(invalid), 0xEF, 0, 0 }, /* 0xEF 239 */
458 { "Invalid", SMB_SDT_OPS(invalid), 0xF0, 0, 0 }, /* 0xF0 240 */
459 { "Invalid", SMB_SDT_OPS(invalid), 0xF1, 0, 0 }, /* 0xF1 241 */
460 { "Invalid", SMB_SDT_OPS(invalid), 0xF2, 0, 0 }, /* 0xF2 242 */
461 { "Invalid", SMB_SDT_OPS(invalid), 0xF3, 0, 0 }, /* 0xF3 243 */
462 { "Invalid", SMB_SDT_OPS(invalid), 0xF4, 0, 0 }, /* 0xF4 244 */
463 { "Invalid", SMB_SDT_OPS(invalid), 0xF5, 0, 0 }, /* 0xF5 245 */
464 { "Invalid", SMB_SDT_OPS(invalid), 0xF6, 0, 0 }, /* 0xF6 246 */
465 { "Invalid", SMB_SDT_OPS(invalid), 0xF7, 0, 0 }, /* 0xF7 247 */
466 { "Invalid", SMB_SDT_OPS(invalid), 0xF8, 0, 0 }, /* 0xF8 248 */
467 { "Invalid", SMB_SDT_OPS(invalid), 0xF9, 0, 0 }, /* 0xF9 249 */
468 { "Invalid", SMB_SDT_OPS(invalid), 0xFA, 0, 0 }, /* 0xFA 250 */
469 { "Invalid", SMB_SDT_OPS(invalid), 0xFB, 0, 0 }, /* 0xFB 251 */
470 { "Invalid", SMB_SDT_OPS(invalid), 0xFC, 0, 0 }, /* 0xFC 252 */
471 { "Invalid", SMB_SDT_OPS(invalid), 0xFD, 0, 0 }, /* 0xFD 253 */
472 { "Invalid", SMB_SDT_OPS(invalid), 0xFE, 0, 0 }, /* 0xFE 254 */
473 { "Invalid", SMB_SDT_OPS(invalid), 0xFF, 0, 0 } /* 0xFF 255 */
474 };
475
476 /*
477 * smbsr_cleanup
478 *
479 * If any user/tree/file is used by given request then
480 * the reference count for that resource has been incremented.
481 * This function decrements the reference count and close
482 * the resource if it's needed.
483 */
484
485 void
smbsr_cleanup(smb_request_t * sr)486 smbsr_cleanup(smb_request_t *sr)
487 {
488 ASSERT((sr->sr_state != SMB_REQ_STATE_CLEANED_UP) &&
489 (sr->sr_state != SMB_REQ_STATE_COMPLETED));
490
491 if (sr->r_xa) {
492 if (sr->r_xa->xa_flags & SMB_XA_FLAG_COMPLETE)
493 smb_xa_close(sr->r_xa);
494 smb_xa_rele(sr->session, sr->r_xa);
495 sr->r_xa = NULL;
496 }
497
498 /*
499 * Mark this request so we know that we've already cleaned it up.
500 * A request should only get cleaned up once so multiple calls to
501 * smbsr_cleanup for the same request indicate a bug.
502 */
503 mutex_enter(&sr->sr_mutex);
504 if (sr->sr_state != SMB_REQ_STATE_CANCELED)
505 sr->sr_state = SMB_REQ_STATE_CLEANED_UP;
506 mutex_exit(&sr->sr_mutex);
507 }
508 /*
509 * smb_dispatch_request
510 *
511 * Returns:
512 *
513 * B_TRUE The caller must free the smb request passed in.
514 * B_FALSE The caller must not access the smb request passed in. It has
515 * been kept in an internal queue and may have already been freed.
516 */
517 boolean_t
smb_dispatch_request(struct smb_request * sr)518 smb_dispatch_request(struct smb_request *sr)
519 {
520 smb_sdrc_t sdrc;
521 smb_disp_entry_t *sdd;
522 boolean_t disconnect = B_FALSE;
523 smb_session_t *session;
524 uint32_t capabilities;
525 uint32_t byte_count;
526
527 session = sr->session;
528 capabilities = session->capabilities;
529
530 ASSERT(sr->tid_tree == 0);
531 ASSERT(sr->uid_user == 0);
532 ASSERT(sr->fid_ofile == 0);
533 sr->smb_fid = (uint16_t)-1;
534
535 /* temporary until we identify a user */
536 sr->user_cr = kcred;
537 sr->orig_request_hdr = sr->command.chain_offset;
538
539 /* If this connection is shutting down just kill request */
540 if (smb_mbc_decodef(&sr->command, SMB_HEADER_ED_FMT,
541 &sr->smb_com,
542 &sr->smb_rcls,
543 &sr->smb_reh,
544 &sr->smb_err,
545 &sr->smb_flg,
546 &sr->smb_flg2,
547 &sr->smb_pid_high,
548 sr->smb_sig,
549 &sr->smb_tid,
550 &sr->smb_pid,
551 &sr->smb_uid,
552 &sr->smb_mid) != 0) {
553 disconnect = B_TRUE;
554 goto drop_connection;
555 }
556
557 /*
558 * The reply "header" is filled in now even though it will,
559 * most likely, be rewritten under reply_ready below. We
560 * could reserve the space but this is convenient in case
561 * the dialect dispatcher has to send a special reply (like
562 * TRANSACT).
563 *
564 * Ensure that the 32-bit error code flag is turned off.
565 * Clients seem to set it in transact requests and they may
566 * get confused if we return success or a 16-bit SMB code.
567 */
568 sr->smb_rcls = 0;
569 sr->smb_reh = 0;
570 sr->smb_err = 0;
571 sr->smb_flg2 &= ~SMB_FLAGS2_NT_STATUS;
572
573 (void) smb_mbc_encodef(&sr->reply, SMB_HEADER_ED_FMT,
574 sr->smb_com,
575 sr->smb_rcls,
576 sr->smb_reh,
577 sr->smb_err,
578 sr->smb_flg,
579 sr->smb_flg2,
580 sr->smb_pid_high,
581 sr->smb_sig,
582 sr->smb_tid,
583 sr->smb_pid,
584 sr->smb_uid,
585 sr->smb_mid);
586 sr->first_smb_com = sr->smb_com;
587
588 /*
589 * Verify SMB signature if signing is enabled, dialect is NT LM 0.12,
590 * signing was negotiated and authentication has occurred.
591 */
592 if (session->signing.flags & SMB_SIGNING_ENABLED) {
593 if (smb_sign_check_request(sr) != 0) {
594 smbsr_error(sr, NT_STATUS_ACCESS_DENIED,
595 ERRDOS, ERROR_ACCESS_DENIED);
596 disconnect = B_TRUE;
597 goto report_error;
598 }
599 }
600
601 andx_more:
602 sdd = &smb_disp_table[sr->smb_com];
603 ASSERT(sdd->sdt_function);
604
605 if (smb_mbc_decodef(&sr->command, "b", &sr->smb_wct) != 0) {
606 disconnect = B_TRUE;
607 goto report_error;
608 }
609
610 (void) MBC_SHADOW_CHAIN(&sr->smb_vwv, &sr->command,
611 sr->command.chain_offset, sr->smb_wct * 2);
612
613 if (smb_mbc_decodef(&sr->command, "#.w", sr->smb_wct*2, &sr->smb_bcc)) {
614 disconnect = B_TRUE;
615 goto report_error;
616 }
617
618 atomic_add_64(&sdd->sdt_rxb,
619 (int64_t)(sr->smb_wct * 2 + sr->smb_bcc + 1));
620 sr->sr_txb = sr->reply.chain_offset;
621
622 /*
623 * Ignore smb_bcc if CAP_LARGE_READX/CAP_LARGE_WRITEX
624 * and this is SmbReadX/SmbWriteX since this enables
625 * large reads/write and bcc is only 16-bits.
626 */
627 if (((sr->smb_com == SMB_COM_READ_ANDX) &&
628 (capabilities & CAP_LARGE_READX)) ||
629 ((sr->smb_com == SMB_COM_WRITE_ANDX) &&
630 (capabilities & CAP_LARGE_WRITEX))) {
631 byte_count = sr->command.max_bytes - sr->command.chain_offset;
632 } else {
633 byte_count = (uint32_t)sr->smb_bcc;
634 }
635
636 (void) MBC_SHADOW_CHAIN(&sr->smb_data, &sr->command,
637 sr->command.chain_offset, byte_count);
638
639 sr->command.chain_offset += byte_count;
640 if (sr->command.chain_offset > sr->command.max_bytes) {
641 disconnect = B_TRUE;
642 goto report_error;
643 }
644
645 /* Store pointers for later */
646 sr->cur_reply_offset = sr->reply.chain_offset;
647
648 if (is_andx_com(sr->smb_com)) {
649 /* Peek ahead and don't disturb vwv */
650 if (smb_mbc_peek(&sr->smb_vwv, sr->smb_vwv.chain_offset, "b.w",
651 &sr->andx_com, &sr->andx_off) < 0) {
652 disconnect = B_TRUE;
653 goto report_error;
654 }
655 } else {
656 sr->andx_com = (unsigned char)-1;
657 }
658
659 mutex_enter(&sr->sr_mutex);
660 switch (sr->sr_state) {
661 case SMB_REQ_STATE_SUBMITTED:
662 case SMB_REQ_STATE_CLEANED_UP:
663 sr->sr_state = SMB_REQ_STATE_ACTIVE;
664 break;
665 case SMB_REQ_STATE_CANCELED:
666 break;
667 default:
668 ASSERT(0);
669 break;
670 }
671 mutex_exit(&sr->sr_mutex);
672
673 /*
674 * Setup UID and TID information (if required). Both functions
675 * will set the sr credentials. In domain mode, the user and
676 * tree credentials should be the same. In share mode, the
677 * tree credentials (defined in the share definition) should
678 * override the user credentials.
679 */
680 if (!(sdd->sdt_flags & SDDF_SUPPRESS_UID) && (sr->uid_user == NULL)) {
681 sr->uid_user = smb_session_lookup_uid(session, sr->smb_uid);
682 if (sr->uid_user == NULL) {
683 smbsr_error(sr, 0, ERRSRV, ERRbaduid);
684 smbsr_cleanup(sr);
685 goto report_error;
686 }
687
688 sr->user_cr = smb_user_getcred(sr->uid_user);
689
690 if (!(sdd->sdt_flags & SDDF_SUPPRESS_TID) &&
691 (sr->tid_tree == NULL)) {
692 sr->tid_tree = smb_user_lookup_tree(
693 sr->uid_user, sr->smb_tid);
694 if (sr->tid_tree == NULL) {
695 smbsr_error(sr, 0, ERRSRV, ERRinvnid);
696 smbsr_cleanup(sr);
697 goto report_error;
698 }
699 }
700 }
701
702 /*
703 * If the command is not a read raw request we can set the
704 * state of the session back to SMB_SESSION_STATE_NEGOTIATED
705 * (if the current state is SMB_SESSION_STATE_OPLOCK_BREAKING).
706 * Otherwise we let the read raw handler to deal with it.
707 */
708 smb_rwx_rwenter(&session->s_lock, RW_READER);
709 if ((session->s_state == SMB_SESSION_STATE_OPLOCK_BREAKING) &&
710 (sr->smb_com != SMB_COM_READ_RAW)) {
711 (void) smb_rwx_rwupgrade(&session->s_lock);
712 if (session->s_state == SMB_SESSION_STATE_OPLOCK_BREAKING)
713 session->s_state = SMB_SESSION_STATE_NEGOTIATED;
714 }
715 smb_rwx_rwexit(&session->s_lock);
716
717 sr->sr_time_start = gethrtime();
718 if ((sdrc = (*sdd->sdt_pre_op)(sr)) == SDRC_SUCCESS)
719 sdrc = (*sdd->sdt_function)(sr);
720
721 if (sdrc != SDRC_SR_KEPT) {
722 (*sdd->sdt_post_op)(sr);
723 smbsr_cleanup(sr);
724 }
725 smb_latency_add_sample(&sdd->sdt_lat, gethrtime() - sr->sr_time_start);
726
727 atomic_add_64(&sdd->sdt_txb,
728 (int64_t)(sr->reply.chain_offset - sr->sr_txb));
729
730 if (sdrc != SDRC_SUCCESS) {
731 /*
732 * Handle errors from raw write.
733 */
734 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
735 if (session->s_state == SMB_SESSION_STATE_WRITE_RAW_ACTIVE) {
736 /*
737 * Set state so that the netbios session
738 * daemon will start accepting data again.
739 */
740 session->s_write_raw_status = 0;
741 session->s_state = SMB_SESSION_STATE_NEGOTIATED;
742 }
743 smb_rwx_rwexit(&session->s_lock);
744 }
745
746 switch (sdrc) {
747 case SDRC_SUCCESS:
748 break;
749
750 case SDRC_DROP_VC:
751 disconnect = B_TRUE;
752 goto drop_connection;
753
754 case SDRC_NO_REPLY:
755 return (B_TRUE);
756
757 case SDRC_SR_KEPT:
758 return (B_FALSE);
759
760 case SDRC_ERROR:
761 goto report_error;
762
763 case SDRC_NOT_IMPLEMENTED:
764 default:
765 smbsr_error(sr, 0, ERRDOS, ERRbadfunc);
766 goto report_error;
767 }
768
769 /*
770 * If there's no AndX command, we're done.
771 */
772 if (sr->andx_com == 0xff)
773 goto reply_ready;
774
775 /*
776 * Otherwise, we have to back-patch the AndXCommand and AndXOffset
777 * and continue processing.
778 */
779 sr->andx_prev_wct = sr->cur_reply_offset;
780 (void) smb_mbc_poke(&sr->reply, sr->andx_prev_wct + 1, "b.w",
781 sr->andx_com, MBC_LENGTH(&sr->reply));
782
783 sr->command.chain_offset = sr->orig_request_hdr + sr->andx_off;
784 sr->smb_com = sr->andx_com;
785 goto andx_more;
786
787 report_error:
788 sr->reply.chain_offset = sr->cur_reply_offset;
789 (void) smb_mbc_encodef(&sr->reply, "bw", 0, 0);
790
791 sr->smb_wct = 0;
792 sr->smb_bcc = 0;
793
794 if (sr->smb_rcls == 0 && sr->smb_reh == 0 && sr->smb_err == 0)
795 smbsr_error(sr, 0, ERRSRV, ERRerror);
796
797 reply_ready:
798 smbsr_send_reply(sr);
799
800 drop_connection:
801 if (disconnect) {
802 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
803 switch (session->s_state) {
804 case SMB_SESSION_STATE_DISCONNECTED:
805 case SMB_SESSION_STATE_TERMINATED:
806 break;
807 default:
808 smb_soshutdown(session->sock);
809 session->s_state = SMB_SESSION_STATE_DISCONNECTED;
810 break;
811 }
812 smb_rwx_rwexit(&session->s_lock);
813 }
814
815 return (B_TRUE);
816 }
817
818 int
smbsr_encode_empty_result(struct smb_request * sr)819 smbsr_encode_empty_result(struct smb_request *sr)
820 {
821 return (smbsr_encode_result(sr, 0, 0, "bw", 0, 0));
822 }
823
824 int
smbsr_encode_result(struct smb_request * sr,int wct,int bcc,char * fmt,...)825 smbsr_encode_result(struct smb_request *sr, int wct, int bcc, char *fmt, ...)
826 {
827 va_list ap;
828
829 if (MBC_LENGTH(&sr->reply) != sr->cur_reply_offset)
830 return (-1);
831
832 va_start(ap, fmt);
833 (void) smb_mbc_vencodef(&sr->reply, fmt, ap);
834 va_end(ap);
835
836 sr->smb_wct = (unsigned char)wct;
837 sr->smb_bcc = (uint16_t)bcc;
838
839 if (smbsr_check_result(sr, wct, bcc) != 0)
840 return (-1);
841
842 return (0);
843 }
844
845 static int
smbsr_check_result(struct smb_request * sr,int wct,int bcc)846 smbsr_check_result(struct smb_request *sr, int wct, int bcc)
847 {
848 int offset = sr->cur_reply_offset;
849 int total_bytes;
850 unsigned char temp, temp1;
851 struct mbuf *m;
852
853 total_bytes = 0;
854 m = sr->reply.chain;
855 while (m != 0) {
856 total_bytes += m->m_len;
857 m = m->m_next;
858 }
859
860 if ((offset + 3) > total_bytes)
861 return (-1);
862
863 (void) smb_mbc_peek(&sr->reply, offset, "b", &temp);
864 if (temp != wct)
865 return (-1);
866
867 if ((offset + (wct * 2 + 1)) > total_bytes)
868 return (-1);
869
870 /* reply wct & vwv seem ok, consider data now */
871 offset += wct * 2 + 1;
872
873 if ((offset + 2) > total_bytes)
874 return (-1);
875
876 (void) smb_mbc_peek(&sr->reply, offset, "bb", &temp, &temp1);
877 if (bcc == VAR_BCC) {
878 if ((temp != 0xFF) || (temp1 != 0xFF)) {
879 return (-1);
880 } else {
881 bcc = (total_bytes - offset) - 2;
882 (void) smb_mbc_poke(&sr->reply, offset, "bb",
883 bcc, bcc >> 8);
884 }
885 } else {
886 if ((temp != (bcc&0xFF)) || (temp1 != ((bcc>>8)&0xFF)))
887 return (-1);
888 }
889
890 offset += bcc + 2;
891
892 if (offset != total_bytes)
893 return (-1);
894
895 sr->smb_wct = (unsigned char)wct;
896 sr->smb_bcc = (uint16_t)bcc;
897 return (0);
898 }
899
900 int
smbsr_decode_vwv(struct smb_request * sr,char * fmt,...)901 smbsr_decode_vwv(struct smb_request *sr, char *fmt, ...)
902 {
903 int rc;
904 va_list ap;
905
906 va_start(ap, fmt);
907 rc = smb_mbc_vdecodef(&sr->smb_vwv, fmt, ap);
908 va_end(ap);
909
910 if (rc)
911 smbsr_error(sr, 0, ERRSRV, ERRerror);
912 return (rc);
913 }
914
915 int
smbsr_decode_data(struct smb_request * sr,char * fmt,...)916 smbsr_decode_data(struct smb_request *sr, char *fmt, ...)
917 {
918 int rc;
919 va_list ap;
920
921 va_start(ap, fmt);
922 rc = smb_mbc_vdecodef(&sr->smb_data, fmt, ap);
923 va_end(ap);
924
925 if (rc)
926 smbsr_error(sr, 0, ERRSRV, ERRerror);
927 return (rc);
928 }
929
930 boolean_t
smbsr_decode_data_avail(smb_request_t * sr)931 smbsr_decode_data_avail(smb_request_t *sr)
932 {
933 return (sr->smb_data.chain_offset < sr->smb_data.max_bytes);
934 }
935
936 void
smbsr_send_reply(smb_request_t * sr)937 smbsr_send_reply(smb_request_t *sr)
938 {
939 if (SMB_TREE_IS_CASEINSENSITIVE(sr))
940 sr->smb_flg |= SMB_FLAGS_CASE_INSENSITIVE;
941 else
942 sr->smb_flg &= ~SMB_FLAGS_CASE_INSENSITIVE;
943
944 (void) smb_mbc_poke(&sr->reply, 0, SMB_HEADER_ED_FMT,
945 sr->first_smb_com,
946 sr->smb_rcls,
947 sr->smb_reh,
948 sr->smb_err,
949 sr->smb_flg | SMB_FLAGS_REPLY,
950 sr->smb_flg2,
951 sr->smb_pid_high,
952 sr->smb_sig,
953 sr->smb_tid,
954 sr->smb_pid,
955 sr->smb_uid,
956 sr->smb_mid);
957
958 if (sr->session->signing.flags & SMB_SIGNING_ENABLED)
959 smb_sign_reply(sr, NULL);
960
961 smb_server_inc_req(sr->session->s_server);
962 if (smb_session_send(sr->session, 0, &sr->reply) == 0)
963 sr->reply.chain = 0;
964 }
965
966 /*
967 * Map errno values to SMB and NT status values.
968 * Note: ESRCH is a special case to handle a streams lookup failure.
969 */
970 static struct {
971 int errnum;
972 int errcls;
973 int errcode;
974 DWORD status32;
975 } smb_errno_map[] = {
976 { ENOSPC, ERRDOS, ERROR_DISK_FULL, NT_STATUS_DISK_FULL },
977 { EDQUOT, ERRDOS, ERROR_DISK_FULL, NT_STATUS_DISK_FULL },
978 { EPERM, ERRSRV, ERRaccess, NT_STATUS_ACCESS_DENIED },
979 { ENOTDIR, ERRDOS, ERRbadpath, NT_STATUS_OBJECT_PATH_NOT_FOUND },
980 { EISDIR, ERRDOS, ERRbadpath, NT_STATUS_FILE_IS_A_DIRECTORY },
981 { ENOENT, ERRDOS, ERRbadfile, NT_STATUS_NO_SUCH_FILE },
982 { ENOTEMPTY, ERRDOS, ERROR_DIR_NOT_EMPTY,
983 NT_STATUS_DIRECTORY_NOT_EMPTY },
984 { EILSEQ, ERRDOS, ERROR_INVALID_NAME,
985 NT_STATUS_OBJECT_NAME_INVALID },
986 { EACCES, ERRDOS, ERRnoaccess, NT_STATUS_ACCESS_DENIED },
987 { ENOMEM, ERRDOS, ERRnomem, NT_STATUS_NO_MEMORY },
988 { EIO, ERRHRD, ERRgeneral, NT_STATUS_IO_DEVICE_ERROR },
989 { EXDEV, ERRSRV, ERRdiffdevice, NT_STATUS_NOT_SAME_DEVICE },
990 { EREMOTE, ERRSRV, ERRbadpath, NT_STATUS_PATH_NOT_COVERED},
991 { EROFS, ERRHRD, ERRnowrite, NT_STATUS_ACCESS_DENIED },
992 { ESTALE, ERRDOS, ERRbadfid, NT_STATUS_INVALID_HANDLE },
993 { EBADF, ERRDOS, ERRbadfid, NT_STATUS_INVALID_HANDLE },
994 { EEXIST, ERRDOS, ERRfilexists, NT_STATUS_OBJECT_NAME_COLLISION },
995 { ENXIO, ERRSRV, ERRinvdevice, NT_STATUS_BAD_DEVICE_TYPE },
996 { ESRCH, ERRDOS, ERROR_FILE_NOT_FOUND,
997 NT_STATUS_OBJECT_NAME_NOT_FOUND },
998 /*
999 * It's not clear why smb_read_common effectively returns
1000 * ERRnoaccess if a range lock prevents access and smb_write_common
1001 * effectively returns ERRaccess. This table entry is used by
1002 * smb_read_common and preserves the behavior that was there before.
1003 */
1004 { ERANGE, ERRDOS, ERRnoaccess, NT_STATUS_FILE_LOCK_CONFLICT }
1005 };
1006
1007 void
smbsr_map_errno(int errnum,smb_error_t * err)1008 smbsr_map_errno(int errnum, smb_error_t *err)
1009 {
1010 int i;
1011
1012 for (i = 0; i < sizeof (smb_errno_map)/sizeof (smb_errno_map[0]); ++i) {
1013 if (smb_errno_map[i].errnum == errnum) {
1014 err->status = smb_errno_map[i].status32;
1015 err->errcls = smb_errno_map[i].errcls;
1016 err->errcode = smb_errno_map[i].errcode;
1017 return;
1018 }
1019 }
1020
1021 err->status = NT_STATUS_INTERNAL_ERROR;
1022 err->errcls = ERRDOS;
1023 err->errcode = ERROR_INTERNAL_ERROR;
1024 }
1025
1026 void
smbsr_errno(struct smb_request * sr,int errnum)1027 smbsr_errno(struct smb_request *sr, int errnum)
1028 {
1029 smbsr_map_errno(errnum, &sr->smb_error);
1030 smbsr_set_error(sr, &sr->smb_error);
1031 }
1032
1033 /*
1034 * Report a request processing status (error or warning).
1035 */
1036 void
smbsr_status(smb_request_t * sr,DWORD status,uint16_t errcls,uint16_t errcode)1037 smbsr_status(smb_request_t *sr, DWORD status, uint16_t errcls, uint16_t errcode)
1038 {
1039 sr->smb_error.status = status;
1040 sr->smb_error.errcls = errcls;
1041 sr->smb_error.errcode = errcode;
1042
1043 smbsr_set_error(sr, &sr->smb_error);
1044 }
1045
1046 /*
1047 * Setup a request processing error. This function can be used to
1048 * report 32-bit status codes or DOS errors. Set the status code
1049 * to 0 (NT_STATUS_SUCCESS) to explicitly report a DOS error,
1050 * regardless of the client capabilities.
1051 *
1052 * If status is non-zero and the client supports 32-bit status
1053 * codes, report the status. Otherwise, report the DOS error.
1054 */
1055 void
smbsr_set_error(smb_request_t * sr,smb_error_t * err)1056 smbsr_set_error(smb_request_t *sr, smb_error_t *err)
1057 {
1058 uint32_t status;
1059 uint32_t capabilities;
1060
1061 ASSERT(sr);
1062 ASSERT(err);
1063
1064 status = err->status;
1065 capabilities = sr->session->capabilities;
1066
1067 if ((err->errcls == 0) && (err->errcode == 0)) {
1068 capabilities |= CAP_STATUS32;
1069 if (status == 0)
1070 status = NT_STATUS_INTERNAL_ERROR;
1071 }
1072
1073 if ((capabilities & CAP_STATUS32) && (status != 0)) {
1074 sr->smb_rcls = status & 0xff;
1075 sr->smb_reh = (status >> 8) & 0xff;
1076 sr->smb_err = status >> 16;
1077 sr->smb_flg2 |= SMB_FLAGS2_NT_STATUS;
1078 } else {
1079 if ((err->errcls == 0) || (err->errcode == 0)) {
1080 sr->smb_rcls = ERRSRV;
1081 sr->smb_err = ERRerror;
1082 } else {
1083 sr->smb_rcls = (uint8_t)err->errcls;
1084 sr->smb_err = (uint16_t)err->errcode;
1085 }
1086 }
1087 }
1088
1089 smb_xa_t *
smbsr_lookup_xa(smb_request_t * sr)1090 smbsr_lookup_xa(smb_request_t *sr)
1091 {
1092 ASSERT(sr->r_xa == 0);
1093
1094 sr->r_xa = smb_xa_find(sr->session, sr->smb_pid, sr->smb_mid);
1095 return (sr->r_xa);
1096 }
1097
1098 void
smbsr_release_file(smb_request_t * sr)1099 smbsr_release_file(smb_request_t *sr)
1100 {
1101 smb_ofile_t *of = sr->fid_ofile;
1102
1103 sr->fid_ofile = NULL;
1104 (void) smb_ofile_release(of);
1105 }
1106
1107 void
smbsr_lookup_file(smb_request_t * sr)1108 smbsr_lookup_file(smb_request_t *sr)
1109 {
1110 if (sr->fid_ofile == NULL)
1111 sr->fid_ofile = smb_ofile_lookup_by_fid(sr->tid_tree,
1112 sr->smb_fid);
1113 }
1114
1115 static int
is_andx_com(unsigned char com)1116 is_andx_com(unsigned char com)
1117 {
1118 switch (com) {
1119 case SMB_COM_LOCKING_ANDX:
1120 case SMB_COM_OPEN_ANDX:
1121 case SMB_COM_READ_ANDX:
1122 case SMB_COM_WRITE_ANDX:
1123 case SMB_COM_SESSION_SETUP_ANDX:
1124 case SMB_COM_LOGOFF_ANDX:
1125 case SMB_COM_TREE_CONNECT_ANDX:
1126 case SMB_COM_NT_CREATE_ANDX:
1127 return (1);
1128 }
1129 return (0);
1130 }
1131
1132 /*
1133 * Invalid command stubs.
1134 *
1135 * SmbWriteComplete is sent to acknowledge completion of raw write requests.
1136 * We never send raw write commands to other servers so, if we receive
1137 * SmbWriteComplete, we treat it as an error.
1138 *
1139 * The Read/Write Block Multiplexed (mpx) protocol is used to maximize
1140 * performance when reading/writing a large block of data: it can be
1141 * used in parallel with other client/server operations. The mpx sub-
1142 * protocol is not supported because we support only connection oriented
1143 * transports and NT supports mpx only over connectionless transports.
1144 */
1145 smb_sdrc_t
smb_pre_invalid(smb_request_t * sr)1146 smb_pre_invalid(smb_request_t *sr)
1147 {
1148 DTRACE_SMB_1(op__Invalid__start, smb_request_t *, sr);
1149 return (SDRC_SUCCESS);
1150 }
1151
1152 void
smb_post_invalid(smb_request_t * sr)1153 smb_post_invalid(smb_request_t *sr)
1154 {
1155 DTRACE_SMB_1(op__Invalid__done, smb_request_t *, sr);
1156 }
1157
1158 smb_sdrc_t
smb_com_invalid(smb_request_t * sr)1159 smb_com_invalid(smb_request_t *sr)
1160 {
1161 smb_sdrc_t sdrc;
1162
1163 switch (sr->smb_com) {
1164 case SMB_COM_WRITE_COMPLETE:
1165 smbsr_error(sr, 0, ERRSRV, ERRerror);
1166 sdrc = SDRC_ERROR;
1167 break;
1168
1169 default:
1170 smbsr_error(sr, NT_STATUS_NOT_IMPLEMENTED,
1171 ERRDOS, ERROR_INVALID_FUNCTION);
1172 sdrc = SDRC_NOT_IMPLEMENTED;
1173 break;
1174 }
1175
1176 return (sdrc);
1177 }
1178
1179 /*
1180 * smb_dispatch_stats_init
1181 *
1182 * Initializes dispatch statistics.
1183 */
1184 void
smb_dispatch_stats_init(smb_kstat_req_t * ksr)1185 smb_dispatch_stats_init(smb_kstat_req_t *ksr)
1186 {
1187 kstat_named_t *ksn;
1188 int ks_ndata;
1189 int i;
1190
1191 for (i = 0; i < SMB_COM_NUM; i++, ksr++) {
1192 smb_latency_init(&smb_disp_table[i].sdt_lat);
1193 (void) strlcpy(ksr->kr_name, smb_disp_table[i].sdt_name,
1194 sizeof (ksr->kr_name));
1195 }
1196 /* Legacy Statistics */
1197 for (i = 0, ks_ndata = 0; i < SMB_COM_NUM; i++) {
1198 if (smb_disp_table[i].sdt_function != smb_com_invalid)
1199 ks_ndata++;
1200 }
1201
1202 smb_legacy_dispatch_ksp = kstat_create(SMBSRV_KSTAT_MODULE, 0,
1203 SMBSRV_KSTAT_NAME_CMDS, SMBSRV_KSTAT_CLASS,
1204 KSTAT_TYPE_NAMED, ks_ndata, 0);
1205
1206 if (smb_legacy_dispatch_ksp != NULL) {
1207 ksn = smb_legacy_dispatch_ksp->ks_data;
1208
1209 for (i = 0, ks_ndata = 0; i < SMB_COM_NUM; i++) {
1210 if (smb_disp_table[i].sdt_function != smb_com_invalid) {
1211 (void) strlcpy(ksn->name,
1212 smb_disp_table[i].sdt_name,
1213 sizeof (ksn->name));
1214 ksn->data_type = KSTAT_DATA_UINT64;
1215 ++ksn;
1216 }
1217 }
1218 mutex_init(&smb_legacy_dispatch_ksmtx, NULL,
1219 MUTEX_DEFAULT, NULL);
1220 smb_legacy_dispatch_ksp->ks_update =
1221 smb_legacy_dispatch_stats_update;
1222 smb_legacy_dispatch_ksp->ks_lock = &smb_legacy_dispatch_ksmtx;
1223 kstat_install(smb_legacy_dispatch_ksp);
1224 }
1225 }
1226
1227 /*
1228 * smb_dispatch_stats_fini
1229 *
1230 * Frees and destroyes the resources used for statistics.
1231 */
1232 void
smb_dispatch_stats_fini(void)1233 smb_dispatch_stats_fini(void)
1234 {
1235 int i;
1236
1237 if (smb_legacy_dispatch_ksp != NULL) {
1238 kstat_delete(smb_legacy_dispatch_ksp);
1239 mutex_destroy(&smb_legacy_dispatch_ksmtx);
1240 smb_legacy_dispatch_ksp = NULL;
1241 }
1242
1243 for (i = 0; i < SMB_COM_NUM; i++)
1244 smb_latency_destroy(&smb_disp_table[i].sdt_lat);
1245 }
1246
1247 void
smb_dispatch_stats_update(smb_kstat_req_t * ksr,int first,int nreq)1248 smb_dispatch_stats_update(smb_kstat_req_t *ksr, int first, int nreq)
1249 {
1250 int i;
1251 int last;
1252
1253 last = first + nreq - 1;
1254
1255 if ((first < SMB_COM_NUM) && (last < SMB_COM_NUM)) {
1256 for (i = first; i <= last; i++, ksr++) {
1257 ksr->kr_rxb = smb_disp_table[i].sdt_rxb;
1258 ksr->kr_txb = smb_disp_table[i].sdt_txb;
1259 mutex_enter(&smb_disp_table[i].sdt_lat.ly_mutex);
1260 ksr->kr_nreq = smb_disp_table[i].sdt_lat.ly_a_nreq;
1261 ksr->kr_sum = smb_disp_table[i].sdt_lat.ly_a_sum;
1262 ksr->kr_a_mean = smb_disp_table[i].sdt_lat.ly_a_mean;
1263 ksr->kr_a_stddev =
1264 smb_disp_table[i].sdt_lat.ly_a_stddev;
1265 ksr->kr_d_mean = smb_disp_table[i].sdt_lat.ly_d_mean;
1266 ksr->kr_d_stddev =
1267 smb_disp_table[i].sdt_lat.ly_d_stddev;
1268 smb_disp_table[i].sdt_lat.ly_d_mean = 0;
1269 smb_disp_table[i].sdt_lat.ly_d_nreq = 0;
1270 smb_disp_table[i].sdt_lat.ly_d_stddev = 0;
1271 smb_disp_table[i].sdt_lat.ly_d_sum = 0;
1272 mutex_exit(&smb_disp_table[i].sdt_lat.ly_mutex);
1273 }
1274 }
1275 }
1276
1277 /*
1278 * smb_legacy_dispatch_stats_update
1279 *
1280 * This callback function updates the smb_legacy_dispatch_kstat_data when kstat
1281 * command is invoked.
1282 */
1283 static int
smb_legacy_dispatch_stats_update(kstat_t * ksp,int rw)1284 smb_legacy_dispatch_stats_update(kstat_t *ksp, int rw)
1285 {
1286 kstat_named_t *ksn;
1287 int i;
1288
1289 ASSERT(MUTEX_HELD(ksp->ks_lock));
1290
1291 switch (rw) {
1292 case KSTAT_WRITE:
1293 return (EACCES);
1294
1295 case KSTAT_READ:
1296 ksn = ksp->ks_data;
1297 for (i = 0; i < SMB_COM_NUM; i++) {
1298 if (smb_disp_table[i].sdt_function != smb_com_invalid) {
1299 ksn->value.ui64 =
1300 smb_disp_table[i].sdt_lat.ly_a_nreq;
1301 ++ksn;
1302 }
1303 }
1304 return (0);
1305
1306 default:
1307 return (EIO);
1308 }
1309 }
1310