1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #pragma ident "%Z%%M% %I% %E% SMI" 27 28 /* 29 * SMB: write_raw 30 * 5.27 WRITE_RAW: Write Raw Bytes 31 * 32 * The Write Block Raw protocol is used to maximize the performance of 33 * writing a large block of data from the client to the server. The Write 34 * Block Raw command's scope includes files, Named Pipes, and spooled 35 * output (can be used in place COM_WRITE_PRINT_FILE ). 36 * 37 * Client Request Description 38 * ========================== ========================================= 39 * 40 * UCHAR WordCount; Count of parameter words = 12 41 * USHORT Fid; File handle 42 * USHORT Count; Total bytes, including this buffer 43 * USHORT Reserved; 44 * ULONG Offset; Offset in file to begin write 45 * ULONG Timeout; 46 * USHORT WriteMode; Write mode: 47 * bit 0 - complete write to disk and send 48 * final result response 49 * bit 1 - return Remaining (pipe/dev) 50 * (see WriteAndX for #defines) 51 * ULONG Reserved2; 52 * USHORT DataLength; Number of data bytes this buffer 53 * USHORT DataOffset; Offset (from header start) to data 54 * USHORT ByteCount; Count of data bytes 55 * UCHAR Pad[]; Pad to SHORT or LONG 56 * UCHAR Data[]; Data (# = DataLength) 57 * 58 * First Server Response Description 59 * ============================== ===================================== 60 * 61 * UCHAR WordCount; Count of parameter words = 1 62 * USHORT Remaining; Bytes remaining to be read if pipe 63 * USHORT ByteCount; Count of data bytes = 0 64 * 65 * Final Server Response Description 66 * ================================== ================================= 67 * 68 * UCHAR Command (in SMB header) SMB_COM_WRITE_COMPLETE 69 * 70 * UCHAR WordCount; Count of parameter words = 1 71 * USHORT Count; Total number of bytes written 72 * USHORT ByteCount; Count of data bytes = 0 73 * 74 * The first response format will be that of the final server response in 75 * the case where the server gets an error while writing the data sent 76 * along with the request. Thus Count is the number of bytes which did get 77 * written any time an error is returned. If an error occurs after the 78 * first response has been sent allowing the client to send the remaining 79 * data, the final response should not be sent unless write through is set. 80 * Rather the server should return this "write behind" error on the next 81 * access to the Fid. 82 * 83 * The client must guarantee that there is (and will be) no other request 84 * on the connection for the duration of this request. The server will 85 * reserve enough resources to receive the data and respond with a response 86 * SMB as defined above. The client then sends the raw data in one send. 87 * Thus the server is able to receive up to 65,535 bytes of data directly 88 * into the server buffer. The amount of data transferred is expected to 89 * be larger than the negotiated buffer size for this protocol. 90 * 91 * The reason that no other requests can be active on the connection for 92 * the duration of the request is that if other receives are present on the 93 * connection, there is normally no way to guarantee that the data will be 94 * received into the correct server buffer, rather the data may fill one 95 * (or more) of the other buffers. Also if the client is sending other 96 * requests on the connection, a request may land in the buffer that the 97 * server has allocated for the this SMB's data. 98 * 99 * Whether or not SMB_COM_WRITE_RAW is supported is returned in the 100 * response to SMB_COM_NEGOTIATE. SMB_COM_WRITE_RAW is not supported for 101 * connectionless clients. 102 * 103 * When write through is not specified ((WriteMode & 01) == 0) this SMB is 104 * assumed to be a form of write behind. The transport layer guarantees 105 * delivery of all secondary requests from the client. Thus no "got the 106 * data you sent" SMB is needed. If an error should occur at the server 107 * end, all bytes must be received and thrown away. If an error occurs 108 * while writing data to disk such as disk full, the next access of the 109 * file handle (another write, close, read, etc.) will return the fact that 110 * the error occurred. 111 * 112 * If write through is specified ((WriteMode & 01) != 0), the server will 113 * receive the data, write it to disk and then send a final response 114 * indicating the result of the write. The total number of bytes written 115 * is also returned in this response in the Count field. 116 * 117 * The flow for the SMB_COM_WRITE_RAW SMB is: 118 * 119 * client -----> SMB_COM_WRITE_RAW request (optional data) >-------> server 120 * client <------------------< OK send (more) data <---------------- server 121 * client ----------------------> raw data >----------------------> server 122 * client <---< data on disk or error (write through only) <------- server 123 * 124 * This protocol is set up such that the SMB_COM_WRITE_RAW request may also 125 * carry data. This is an optimization in that up to the server's buffer 126 * size (MaxCount from SMB_COM_NEGOTIATE response), minus the size of the 127 * SMB_COM_WRITE_RAW SMB request, may be sent along with the request. Thus 128 * if the server is busy and unable to support the raw write of the 129 * remaining data, the data sent along with the request has been delivered 130 * and need not be sent again. The server will write any data sent in the 131 * request (and wait for it to be on the disk or device if write through is 132 * set), prior to sending the response. 133 * 134 * The specific responses error class ERRSRV, error codes ERRusempx and 135 * ERRusestd, indicate that the server is temporarily out of the resources 136 * 137 * needed to support the raw write of the remaining data, but that any data 138 * sent along with the request has been successfully written. The client 139 * should then write the remaining data using a different type of SMB write 140 * request, or delay and retry using SMB_COM_WRITE_RAW. If a write error 141 * occurs writing the initial data, it will be returned and the write raw 142 * request is implicitly denied. 143 * 144 * The return field Remaining is returned for named pipes only. It is used 145 * to return the number of bytes currently available in the pipe. This 146 * information can then be used by the client to know when a subsequent 147 * (non blocking) read of the pipe may return some data. Of course when 148 * the read request is actually received by the server there may be more or 149 * less actual data in the pipe (more data has been written to the pipe / 150 * device or another reader drained it). If the information is currently 151 * not available or the request is NOT for a pipe or the server does not 152 * support this feature, a -1 value should be returned. 153 * 154 * If the negotiated dialect is NT LM 0.12 or later, and the response to 155 * the SMB_COM_NEGOTIATE SMB has CAP_LARGE_FILES set in the Capabilities 156 * field, an additional request format is allowed which accommodates very 157 * large files having 64 bit offsets: 158 * 159 * Client Request Description 160 * ================================== ================================= 161 * UCHAR WordCount; Count of parameter words = 14 162 * USHORT Fid; File handle 163 * USHORT Count; Total bytes, including this 164 * buffer 165 * USHORT Reserved; 166 * ULONG Offset; Offset in file to begin write 167 * ULONG Timeout; 168 * USHORT WriteMode; Write mode: 169 * bit 0 - complete write to disk 170 * and send final result response 171 * bit 1 - return Remaining 172 * (pipe/dev) 173 * ULONG Reserved2; 174 * USHORT DataLength; Number of data bytes this buffer 175 * USHORT DataOffset; Offset (from header start) to 176 * data 177 * ULONG OffsetHigh; Upper 32 bits of offset 178 * USHORT ByteCount; Count of data bytes 179 * UCHAR Pad[]; Pad to SHORT or LONG 180 * UCHAR Data[]; Data (# = DataLength) 181 * 182 * In this case the final offset in the file is formed by combining 183 * OffsetHigh and Offset, the resulting offset must not be negative. 184 */ 185 186 #include <sys/sdt.h> 187 #include <smbsrv/smb_incl.h> 188 #include <smbsrv/smb_fsops.h> 189 #include <smbsrv/mbuf.h> 190 #include <smbsrv/netbios.h> 191 192 extern uint32_t smb_keep_alive; 193 194 static int smb_write_raw_helper(struct smb_request *sr, struct uio *uiop, 195 unsigned int stability, offset_t *offp, uint32_t *lcountp); 196 197 static int smb_transfer_write_raw_data(smb_request_t *sr, 198 uint16_t addl_xfer_count); 199 200 #define WR_MODE_WR_THRU 1 201 202 int 203 smb_com_write_raw(struct smb_request *sr) 204 { 205 int rc = 0; 206 int session_send_rc = 0; 207 unsigned short addl_xfer_count; 208 unsigned short count; 209 unsigned short write_mode, data_offset, data_length; 210 offset_t off; 211 uint32_t off_low, off_high, timeout; 212 uint32_t lcount = 0; 213 uint32_t addl_lcount = 0; 214 struct uio uio; 215 iovec_t iovec; 216 unsigned int stability; 217 struct mbuf_chain reply; 218 smb_node_t *fnode; 219 smb_error_t err; 220 221 if (sr->session->s_state != SMB_SESSION_STATE_WRITE_RAW_ACTIVE) { 222 return (SDRC_DROP_VC); 223 } 224 225 if (sr->smb_wct == 12) { 226 off_high = 0; 227 rc = smbsr_decode_vwv(sr, "ww2.llw4.ww", &sr->smb_fid, &count, 228 &off_low, &timeout, &write_mode, &data_length, 229 &data_offset); 230 data_offset -= 59; 231 } else { 232 rc = smbsr_decode_vwv(sr, "ww2.llw4.wwl", &sr->smb_fid, &count, 233 &off_low, &timeout, &write_mode, &data_length, 234 &data_offset, &off_high); 235 data_offset -= 63; 236 } 237 238 if (rc != 0) { 239 smbsr_decode_error(sr); 240 /* NOTREACHED */ 241 } 242 243 off = ((offset_t)off_high << 32) | off_low; 244 addl_xfer_count = count - data_length; 245 246 sr->fid_ofile = smb_ofile_lookup_by_fid(sr->tid_tree, sr->smb_fid); 247 if (sr->fid_ofile == NULL) { 248 smbsr_error(sr, NT_STATUS_INVALID_HANDLE, ERRDOS, ERRbadfid); 249 /* NOTREACHED */ 250 } 251 252 fnode = sr->fid_ofile->f_node; 253 stability = ((write_mode & WR_MODE_WR_THRU) || 254 (fnode->flags & NODE_FLAGS_WRITE_THROUGH)) ? 255 FSSTAB_FILE_SYNC : FSSTAB_UNSTABLE; 256 257 if (STYPE_ISDSK(sr->tid_tree->t_res_type)) { 258 /* 259 * See comments in smb_write.c 260 */ 261 if (fnode->attr.sa_vattr.va_type != VDIR) { 262 rc = smb_lock_range_access(sr, fnode, off, 263 count, B_TRUE); 264 if (rc != NT_STATUS_SUCCESS) { 265 smbsr_error(sr, rc, ERRSRV, ERRaccess); 266 /* NOTREACHED */ 267 } 268 } 269 } 270 271 /* 272 * Make sure any raw write data that is supposed to be 273 * contained in this SMB is actually present. 274 */ 275 if (sr->smb_data.chain_offset + data_offset + data_length > 276 sr->smb_data.max_bytes) { 277 /* Error handling code will wake up the session daemon */ 278 smbsr_decode_error(sr); 279 /* NOTREACHED */ 280 } 281 282 /* 283 * Init uio (resid will get filled in later) 284 */ 285 uio.uio_iov = &iovec; 286 uio.uio_iovcnt = 1; 287 uio.uio_segflg = UIO_SYSSPACE; 288 uio.uio_loffset = off; 289 290 /* 291 * Send response if there is additional data to transfer. This 292 * will prompt the client to send the remaining data. 293 */ 294 if (addl_xfer_count != 0) { 295 MBC_INIT(&reply, MLEN); 296 (void) smb_encode_mbc(&reply, SMB_HEADER_ED_FMT "bww", 297 sr->first_smb_com, 298 sr->smb_rcls, 299 sr->smb_reh, 300 sr->smb_err, 301 sr->smb_flg | SMB_FLAGS_REPLY, 302 sr->smb_flg2, 303 sr->smb_pid_high, 304 sr->smb_sig, 305 sr->smb_tid, 306 sr->smb_pid, 307 sr->smb_uid, 308 sr->smb_mid, 1, -1, 0); 309 310 if (sr->session->signing.flags & SMB_SIGNING_ENABLED) 311 smb_sign_reply(sr, &reply); 312 313 session_send_rc = smb_session_send(sr->session, 0, &reply); 314 315 /* 316 * If the session response failed we're not going to 317 * return an error just yet -- we can still write the 318 * data we received along with the SMB even if the 319 * response failed. If it failed, we need to force the 320 * stability level to "write-through". 321 */ 322 stability = 323 (session_send_rc == 0) ? stability : FSSTAB_FILE_SYNC; 324 } 325 326 /* 327 * While the response is in flight (and the data begins to arrive) 328 * write out the first data segment. Start by setting up the 329 * iovec list for the first transfer. 330 */ 331 iovec.iov_base = sr->smb_data.chain->m_data + 332 sr->smb_data.chain_offset + data_offset; 333 iovec.iov_len = data_length; 334 uio.uio_resid = data_length; 335 336 /* 337 * smb_write_raw_helper will call smb_rpc_write or 338 * smb_fsop_write as appropriate, handle the NODE_FLAGS_SET_SIZE 339 * flag (if set) and update the other f_node fields. It's possible 340 * that data_length may be 0 for this transfer but we still want 341 * process it since it will update the file state (seek position, 342 * file size (possibly), etc). 343 */ 344 rc = smb_write_raw_helper(sr, &uio, stability, &off, &lcount); 345 346 /* 347 * If our initial session response failed then we're done. Return 348 * failure. The client will know we wrote some of the data because 349 * of the transfer count (count - lcount) in the response. 350 */ 351 if (session_send_rc != 0) { 352 sr->smb_rcls = ERRSRV; 353 sr->smb_err = ERRusestd; 354 goto write_raw_transfer_failed; 355 } 356 357 /* 358 * If we have more data to read then go get it 359 */ 360 if (addl_xfer_count) { 361 /* 362 * This is the only place where a worker thread should 363 * directly read from the session socket. If the data 364 * is read successfully then the buffer (sr->sr_raw_data_buf) 365 * will need to be freed after the data is written. 366 */ 367 if (smb_transfer_write_raw_data(sr, addl_xfer_count) != 0) { 368 /* 369 * Raw data transfer failed 370 */ 371 goto write_raw_transfer_failed; 372 } 373 374 /* 375 * Fill in next iov entry 376 */ 377 iovec.iov_base = sr->sr_raw_data_buf; 378 iovec.iov_len = addl_xfer_count; 379 uio.uio_resid = addl_xfer_count; 380 } 381 382 /* 383 * Wake up session daemon since we now have all of our data and 384 * it's safe for the session daemon to resume processing SMB's. 385 */ 386 sr->session->s_write_raw_status = 0; 387 sr->session->s_state = SMB_SESSION_STATE_NEGOTIATED; 388 389 /* 390 * If we didn't write all the data from the first segment then 391 * there's not much point in continuing (we still wanted to 392 * read any additional data above since we don't necessarily 393 * want to drop the connection and we need to read through 394 * to the next SMB). 395 */ 396 if ((rc != 0) || (lcount != data_length)) { 397 goto notify_write_raw_complete; 398 } 399 400 /* 401 * Write any additional data 402 */ 403 if (addl_xfer_count) { 404 rc = smb_write_raw_helper(sr, &uio, stability, &off, 405 &addl_lcount); 406 } 407 408 /* 409 * If we were called in "Write-behind" mode ((write_mode & 1) == 0) 410 * and the transfer was successful then we don't need to send 411 * any further response. If we were called in "Write-Through" mode 412 * ((write_mode & 1) == 1) or if the transfer failed we need to 413 * send a completion notification. The "count" value will indicate 414 * whether the transfer was successful. 415 */ 416 if ((rc != 0) || (write_mode & WR_MODE_WR_THRU) || 417 (lcount + addl_lcount != count)) { 418 goto notify_write_raw_complete; 419 } 420 421 /* 422 * Free raw write buffer (allocated in smb_transfer_write_raw_data) 423 */ 424 kmem_free(sr->sr_raw_data_buf, sr->sr_raw_data_length); 425 426 (void) smb_session_send(sr->session, SESSION_KEEP_ALIVE, NULL); 427 return (SDRC_NO_REPLY); 428 429 write_raw_transfer_failed: 430 /* 431 * Raw data transfer failed, wake up session 432 * daemon 433 */ 434 sr->session->s_write_raw_status = 20; 435 sr->session->s_state = SMB_SESSION_STATE_NEGOTIATED; 436 437 notify_write_raw_complete: 438 /* 439 * If we had an error fill in the appropriate error code 440 */ 441 if (rc != 0) { 442 smbsr_map_errno(rc, &err); 443 smbsr_set_error(sr, &err); 444 } 445 446 /* 447 * Free raw write buffer if present (from smb_transfer_write_raw_data) 448 */ 449 if (sr->sr_raw_data_buf != NULL) { 450 kmem_free(sr->sr_raw_data_buf, sr->sr_raw_data_length); 451 } 452 /* Write complete notification */ 453 sr->first_smb_com = SMB_COM_WRITE_COMPLETE; 454 smbsr_encode_result(sr, 1, 0, "bww", 1, 455 count - (lcount + addl_lcount), 0); 456 return (SDRC_NORMAL_REPLY); 457 } 458 459 460 461 /* 462 * smb_write_raw_helper 463 * 464 * This function will call smb_rpc_write or smb_fsop_write as appropriate, 465 * handle the NODE_FLAGS_SET_SIZE flag (if set) and update the other f_node 466 * fields. It's possible that data_length may be 0 for this transfer but 467 * we still want process it since it will update the file state (seek 468 * position, file size (possibly), etc). 469 * 470 * Returns 0 for success, non-zero for failure 471 */ 472 static int 473 smb_write_raw_helper(struct smb_request *sr, struct uio *uiop, 474 unsigned int stability, offset_t *offp, uint32_t *lcountp) 475 { 476 smb_node_t *fnode; 477 int rc = 0; 478 479 if (STYPE_ISIPC(sr->tid_tree->t_res_type)) { 480 *lcountp = uiop->uio_resid; 481 482 if ((rc = smb_rpc_write(sr, uiop)) != 0) 483 *lcountp = 0; 484 } else { 485 fnode = sr->fid_ofile->f_node; 486 rc = smb_fsop_write(sr, sr->user_cr, fnode, 487 uiop, lcountp, &fnode->attr, &stability); 488 489 if (rc == 0) { 490 491 fnode->flags |= NODE_FLAGS_SYNCATIME; 492 493 if (fnode->flags & NODE_FLAGS_SET_SIZE) { 494 if ((*offp + *lcountp) >= fnode->n_size) { 495 fnode->flags &= ~NODE_FLAGS_SET_SIZE; 496 fnode->n_size = *offp + *lcountp; 497 } 498 } 499 } 500 } 501 502 *offp += *lcountp; 503 mutex_enter(&sr->fid_ofile->f_mutex); 504 sr->fid_ofile->f_seek_pos = *offp; 505 mutex_exit(&sr->fid_ofile->f_mutex); 506 507 return (rc); 508 } 509 510 511 /* 512 * smb_handle_write_raw 513 * 514 * Called from smb_session_daemon() when the SMB command is SMB_COM_WRITE_RAW. 515 * Dispatches the command to the worker thread and waits until the worker 516 * has completed processing the command. 517 * 518 * Returns 0 for success, non-zero for failure 519 */ 520 int 521 smb_handle_write_raw(smb_session_t *session, smb_request_t *sr) 522 { 523 int drop_reason = 0; 524 525 /* 526 * Set flag to indicate that we are waiting for raw data. The 527 * worker thread will actually retrieve the raw data directly 528 * from the socket. This should be the only case when a worker 529 * thread reads from the session socket. When the data is read 530 * the worker will clear the flag. 531 */ 532 smb_rwx_rwenter(&session->s_lock, RW_WRITER); 533 switch (session->s_state) { 534 case SMB_SESSION_STATE_NEGOTIATED: 535 case SMB_SESSION_STATE_OPLOCK_BREAKING: 536 session->s_state = SMB_SESSION_STATE_WRITE_RAW_ACTIVE; 537 smb_rwx_rwexit(&session->s_lock); 538 sr->sr_state = SMB_REQ_STATE_SUBMITTED; 539 (void) taskq_dispatch(smb_info.thread_pool, smb_session_worker, 540 sr, TQ_SLEEP); 541 smb_rwx_rwenter(&session->s_lock, RW_READER); 542 while (session->s_state == SMB_SESSION_STATE_WRITE_RAW_ACTIVE) { 543 (void) smb_rwx_rwwait(&session->s_lock, -1); 544 } 545 drop_reason = session->s_write_raw_status; 546 break; 547 default: 548 drop_reason = 21; 549 break; 550 } 551 smb_rwx_rwexit(&session->s_lock); 552 return (drop_reason); 553 } 554 555 /* 556 * smb_transfer_write_raw_data 557 * 558 * Handles the second transfer phase of SMB_COM_WRITE_RAW. smb_com_write_raw() 559 * will process the parameters and data from the SMB and send the initial 560 * SMB response. This function reads the remaining data from the socket 561 * as it arrives from the client. 562 * 563 * Clients may send KEEP_ALIVE messages (when using NBT) between the first 564 * and second parts of write raw requests. The only session transport 565 * types accepted here are SESSION_MESSAGE or SESSION_KEEP_ALIVE. 566 * 567 * Returns 0 for success, non-zero for failure 568 */ 569 int 570 smb_transfer_write_raw_data(smb_request_t *sr, uint16_t addl_xfer_count) 571 { 572 smb_session_t *session = sr->session; 573 smb_xprt_t hdr; 574 uint8_t *data_buf; 575 576 do { 577 if (smb_session_xprt_gethdr(session, &hdr) != 0) 578 return (-1); 579 580 if ((hdr.xh_type == SESSION_MESSAGE) || 581 (hdr.xh_type == SESSION_KEEP_ALIVE)) { 582 session->keep_alive = smb_keep_alive; 583 } else { 584 return (-1); 585 } 586 } while (hdr.xh_type == SESSION_KEEP_ALIVE); 587 588 if (hdr.xh_length < addl_xfer_count) { 589 /* 590 * Less data than we were expecting. 591 */ 592 return (-1); 593 } 594 595 data_buf = kmem_alloc(hdr.xh_length, KM_SLEEP); 596 597 if (smb_sorecv(session->sock, data_buf, hdr.xh_length) != 0) { 598 kmem_free(data_buf, hdr.xh_length); 599 sr->sr_raw_data_buf = NULL; 600 sr->sr_raw_data_length = 0; 601 return (-1); 602 } 603 604 sr->sr_raw_data_buf = data_buf; 605 sr->sr_raw_data_length = hdr.xh_length; 606 return (0); 607 } 608