1/*-
2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3 *
4 * Copyright (c) 2000-2001 Boris Popov
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29#include <sys/cdefs.h>
30__FBSDID("$FreeBSD$");
31
32#include <sys/param.h>
33#include <sys/condvar.h>
34#include <sys/kernel.h>
35#include <sys/lock.h>
36#include <sys/malloc.h>
37#include <sys/mbuf.h>
38#include <sys/poll.h>
39#include <sys/proc.h>
40#include <sys/protosw.h>
41#include <sys/signalvar.h>
42#include <sys/socket.h>
43#include <sys/socketvar.h>
44#include <sys/sx.h>
45#include <sys/sysctl.h>
46#include <sys/systm.h>
47#include <sys/uio.h>
48
49#include <net/if.h>
50#include <net/route.h>
51#include <net/vnet.h>
52
53#include <netinet/in.h>
54#include <netinet/tcp.h>
55
56#include <sys/mchain.h>
57
58#include <netsmb/netbios.h>
59
60#include <netsmb/smb.h>
61#include <netsmb/smb_conn.h>
62#include <netsmb/smb_tran.h>
63#include <netsmb/smb_trantcp.h>
64#include <netsmb/smb_subr.h>
65
66#define M_NBDATA	M_PCB
67
68static int smb_tcpsndbuf = NB_SNDQ - 1;
69static int smb_tcprcvbuf = NB_RCVQ - 1;
70
71SYSCTL_DECL(_net_smb);
72SYSCTL_INT(_net_smb, OID_AUTO, tcpsndbuf, CTLFLAG_RW, &smb_tcpsndbuf, 0, "");
73SYSCTL_INT(_net_smb, OID_AUTO, tcprcvbuf, CTLFLAG_RW, &smb_tcprcvbuf, 0, "");
74
75#define nb_sosend(so,m,flags,td) sosend(so, NULL, 0, m, 0, flags, td)
76
77static int  nbssn_recv(struct nbpcb *nbp, struct mbuf **mpp, int *lenp,
78	u_int8_t *rpcodep, struct thread *td);
79static int  smb_nbst_disconnect(struct smb_vc *vcp, struct thread *td);
80
81static int
82nb_setsockopt_int(struct socket *so, int level, int name, int val)
83{
84	struct sockopt sopt;
85	int error;
86
87	bzero(&sopt, sizeof(sopt));
88	sopt.sopt_level = level;
89	sopt.sopt_name = name;
90	sopt.sopt_val = &val;
91	sopt.sopt_valsize = sizeof(val);
92	CURVNET_SET(so->so_vnet);
93	error = sosetopt(so, &sopt);
94	CURVNET_RESTORE();
95	return error;
96}
97
98static int
99nb_intr(struct nbpcb *nbp, struct proc *p)
100{
101	return 0;
102}
103
104static int
105nb_upcall(struct socket *so, void *arg, int waitflag)
106{
107	struct nbpcb *nbp = arg;
108
109	if (arg == NULL || nbp->nbp_selectid == NULL)
110		return (SU_OK);
111	wakeup(nbp->nbp_selectid);
112	return (SU_OK);
113}
114
115static int
116nb_sethdr(struct mbuf *m, u_int8_t type, u_int32_t len)
117{
118	u_int32_t *p = mtod(m, u_int32_t *);
119
120	*p = htonl((len & 0x1FFFF) | (type << 24));
121	return 0;
122}
123
124static int
125nb_put_name(struct mbchain *mbp, struct sockaddr_nb *snb)
126{
127	int error;
128	u_char seglen, *cp;
129
130	cp = snb->snb_name;
131	if (*cp == 0)
132		return EINVAL;
133	NBDEBUG("[%s]\n", cp);
134	for (;;) {
135		seglen = (*cp) + 1;
136		error = mb_put_mem(mbp, cp, seglen, MB_MSYSTEM);
137		if (error)
138			return error;
139		if (seglen == 1)
140			break;
141		cp += seglen;
142	}
143	return 0;
144}
145
146static int
147nb_connect_in(struct nbpcb *nbp, struct sockaddr_in *to, struct thread *td)
148{
149	struct socket *so;
150	int error, s;
151
152	error = socreate(AF_INET, &so, SOCK_STREAM, IPPROTO_TCP,
153	    td->td_ucred, td);
154	if (error)
155		return error;
156	nbp->nbp_tso = so;
157	SOCKBUF_LOCK(&so->so_rcv);
158	soupcall_set(so, SO_RCV, nb_upcall, nbp);
159	SOCKBUF_UNLOCK(&so->so_rcv);
160	so->so_rcv.sb_timeo = (5 * SBT_1S);
161	so->so_snd.sb_timeo = (5 * SBT_1S);
162	error = soreserve(so, nbp->nbp_sndbuf, nbp->nbp_rcvbuf);
163	if (error)
164		goto bad;
165	nb_setsockopt_int(so, SOL_SOCKET, SO_KEEPALIVE, 1);
166	nb_setsockopt_int(so, IPPROTO_TCP, TCP_NODELAY, 1);
167	SOCKBUF_LOCK(&so->so_rcv);
168	so->so_rcv.sb_flags &= ~SB_NOINTR;
169	SOCKBUF_UNLOCK(&so->so_rcv);
170	SOCKBUF_LOCK(&so->so_snd);
171	so->so_snd.sb_flags &= ~SB_NOINTR;
172	SOCKBUF_UNLOCK(&so->so_snd);
173	error = soconnect(so, (struct sockaddr*)to, td);
174	if (error)
175		goto bad;
176	s = splnet();
177	while ((so->so_state & SS_ISCONNECTING) && so->so_error == 0) {
178		tsleep(&so->so_timeo, PSOCK, "nbcon", 2 * hz);
179		if ((so->so_state & SS_ISCONNECTING) && so->so_error == 0 &&
180			(error = nb_intr(nbp, td->td_proc)) != 0) {
181			so->so_state &= ~SS_ISCONNECTING;
182			splx(s);
183			goto bad;
184		}
185	}
186	if (so->so_error) {
187		error = so->so_error;
188		so->so_error = 0;
189		splx(s);
190		goto bad;
191	}
192	splx(s);
193	return 0;
194bad:
195	smb_nbst_disconnect(nbp->nbp_vc, td);
196	return error;
197}
198
199static int
200nbssn_rq_request(struct nbpcb *nbp, struct thread *td)
201{
202	struct mbchain *mbp;
203	struct mdchain *mdp;
204	struct mbuf *m0;
205	struct timeval tv;
206	struct sockaddr_in sin;
207	u_short port;
208	u_int8_t rpcode;
209	int error, rplen;
210
211	mbp = malloc(sizeof(struct mbchain), M_NBDATA, M_WAITOK);
212	mdp = malloc(sizeof(struct mbchain), M_NBDATA, M_WAITOK);
213	error = mb_init(mbp);
214	if (error) {
215		free(mbp, M_NBDATA);
216		free(mdp, M_NBDATA);
217		return error;
218	}
219	mb_put_uint32le(mbp, 0);
220	nb_put_name(mbp, nbp->nbp_paddr);
221	nb_put_name(mbp, nbp->nbp_laddr);
222	nb_sethdr(mbp->mb_top, NB_SSN_REQUEST, mb_fixhdr(mbp) - 4);
223	error = nb_sosend(nbp->nbp_tso, mbp->mb_top, 0, td);
224	if (!error) {
225		nbp->nbp_state = NBST_RQSENT;
226	}
227	mb_detach(mbp);
228	mb_done(mbp);
229	free(mbp, M_NBDATA);
230	if (error) {
231		free(mdp, M_NBDATA);
232		return error;
233	}
234	TIMESPEC_TO_TIMEVAL(&tv, &nbp->nbp_timo);
235	error = selsocket(nbp->nbp_tso, POLLIN, &tv, td);
236	if (error == EWOULDBLOCK) {	/* Timeout */
237		NBDEBUG("initial request timeout\n");
238		free(mdp, M_NBDATA);
239		return ETIMEDOUT;
240	}
241	if (error) {			/* restart or interrupt */
242		free(mdp, M_NBDATA);
243		return error;
244	}
245	error = nbssn_recv(nbp, &m0, &rplen, &rpcode, td);
246	if (error) {
247		NBDEBUG("recv() error %d\n", error);
248		free(mdp, M_NBDATA);
249		return error;
250	}
251	/*
252	 * Process NETBIOS reply
253	 */
254	if (m0)
255		md_initm(mdp, m0);
256	error = 0;
257	do {
258		if (rpcode == NB_SSN_POSRESP) {
259			nbp->nbp_state = NBST_SESSION;
260			nbp->nbp_flags |= NBF_CONNECTED;
261			break;
262		}
263		if (rpcode != NB_SSN_RTGRESP) {
264			error = ECONNABORTED;
265			break;
266		}
267		if (rplen != 6) {
268			error = ECONNABORTED;
269			break;
270		}
271		md_get_mem(mdp, (caddr_t)&sin.sin_addr, 4, MB_MSYSTEM);
272		md_get_uint16(mdp, &port);
273		sin.sin_port = port;
274		nbp->nbp_state = NBST_RETARGET;
275		smb_nbst_disconnect(nbp->nbp_vc, td);
276		error = nb_connect_in(nbp, &sin, td);
277		if (!error)
278			error = nbssn_rq_request(nbp, td);
279		if (error) {
280			smb_nbst_disconnect(nbp->nbp_vc, td);
281			break;
282		}
283	} while(0);
284	if (m0)
285		md_done(mdp);
286	free(mdp, M_NBDATA);
287	return error;
288}
289
290static int
291nbssn_recvhdr(struct nbpcb *nbp, int *lenp,
292	u_int8_t *rpcodep, int flags, struct thread *td)
293{
294	struct socket *so = nbp->nbp_tso;
295	struct uio auio;
296	struct iovec aio;
297	u_int32_t len;
298	int error;
299
300	aio.iov_base = (caddr_t)&len;
301	aio.iov_len = sizeof(len);
302	auio.uio_iov = &aio;
303	auio.uio_iovcnt = 1;
304	auio.uio_segflg = UIO_SYSSPACE;
305	auio.uio_rw = UIO_READ;
306	auio.uio_offset = 0;
307	auio.uio_resid = sizeof(len);
308	auio.uio_td = td;
309	CURVNET_SET(so->so_vnet);
310	error = soreceive(so, (struct sockaddr **)NULL, &auio,
311	    (struct mbuf **)NULL, (struct mbuf **)NULL, &flags);
312	CURVNET_RESTORE();
313	if (error)
314		return error;
315	if (auio.uio_resid > 0) {
316		SMBSDEBUG("short reply\n");
317		return EPIPE;
318	}
319	len = ntohl(len);
320	*rpcodep = (len >> 24) & 0xFF;
321	len &= 0x1ffff;
322	if (len > SMB_MAXPKTLEN) {
323		SMBERROR("packet too long (%d)\n", len);
324		return EFBIG;
325	}
326	*lenp = len;
327	return 0;
328}
329
330static int
331nbssn_recv(struct nbpcb *nbp, struct mbuf **mpp, int *lenp,
332	u_int8_t *rpcodep, struct thread *td)
333{
334	struct socket *so = nbp->nbp_tso;
335	struct uio auio;
336	struct mbuf *m, *tm, *im;
337	u_int8_t rpcode;
338	int len, resid;
339	int error, rcvflg;
340
341	if (so == NULL)
342		return ENOTCONN;
343
344	if (mpp)
345		*mpp = NULL;
346	m = NULL;
347	for(;;) {
348		/*
349		 * Poll for a response header.
350		 * If we don't have one waiting, return.
351		 */
352		len = 0;
353		rpcode = 0;
354		error = nbssn_recvhdr(nbp, &len, &rpcode, MSG_DONTWAIT, td);
355		if ((so->so_state & (SS_ISDISCONNECTING | SS_ISDISCONNECTED)) ||
356		    (so->so_rcv.sb_state & SBS_CANTRCVMORE)) {
357			nbp->nbp_state = NBST_CLOSED;
358			NBDEBUG("session closed by peer\n");
359			return ECONNRESET;
360		}
361		if (error)
362			return error;
363		if (len == 0 && nbp->nbp_state != NBST_SESSION)
364			break;
365		/* no data, try again */
366		if (rpcode == NB_SSN_KEEPALIVE)
367			continue;
368
369		/*
370		 * Loop, blocking, for data following the response header.
371		 *
372		 * Note that we can't simply block here with MSG_WAITALL for the
373		 * entire response size, as it may be larger than the TCP
374		 * slow-start window that the sender employs.  This will result
375		 * in the sender stalling until the delayed ACK is sent, then
376		 * resuming slow-start, resulting in very poor performance.
377		 *
378		 * Instead, we never request more than NB_SORECEIVE_CHUNK
379		 * bytes at a time, resulting in an ack being pushed by
380		 * the TCP code at the completion of each call.
381		 */
382		resid = len;
383		while (resid > 0) {
384			tm = NULL;
385			rcvflg = MSG_WAITALL;
386			bzero(&auio, sizeof(auio));
387			auio.uio_resid = min(resid, NB_SORECEIVE_CHUNK);
388			auio.uio_td = td;
389			resid -= auio.uio_resid;
390			/*
391			 * Spin until we have collected everything in
392			 * this chunk.
393			 */
394			do {
395				rcvflg = MSG_WAITALL;
396				CURVNET_SET(so->so_vnet);
397				error = soreceive(so, (struct sockaddr **)NULL,
398				    &auio, &tm, (struct mbuf **)NULL, &rcvflg);
399				CURVNET_RESTORE();
400			} while (error == EWOULDBLOCK || error == EINTR ||
401				 error == ERESTART);
402			if (error)
403				goto out;
404			/* short return guarantees unhappiness */
405			if (auio.uio_resid > 0) {
406				SMBERROR("packet is shorter than expected\n");
407				error = EPIPE;
408				goto out;
409			}
410			/* append received chunk to previous chunk(s) */
411			if (m == NULL) {
412				m = tm;
413			} else {
414				/*
415				 * Just glue the new chain on the end.
416				 * Consumer will pullup as required.
417				 */
418				for (im = m; im->m_next != NULL; im = im->m_next)
419					;
420				im->m_next = tm;
421			}
422		}
423		/* got a session/message packet? */
424		if (nbp->nbp_state == NBST_SESSION &&
425		    rpcode == NB_SSN_MESSAGE)
426			break;
427		/* drop packet and try for another */
428		NBDEBUG("non-session packet %x\n", rpcode);
429		if (m) {
430			m_freem(m);
431			m = NULL;
432		}
433	}
434
435out:
436	if (error) {
437		if (m)
438			m_freem(m);
439		return error;
440	}
441	if (mpp)
442		*mpp = m;
443	else
444		m_freem(m);
445	*lenp = len;
446	*rpcodep = rpcode;
447	return 0;
448}
449
450/*
451 * SMB transport interface
452 */
453static int
454smb_nbst_create(struct smb_vc *vcp, struct thread *td)
455{
456	struct nbpcb *nbp;
457
458	nbp = malloc(sizeof *nbp, M_NBDATA, M_WAITOK);
459	bzero(nbp, sizeof *nbp);
460	nbp->nbp_timo.tv_sec = 15;	/* XXX: sysctl ? */
461	nbp->nbp_state = NBST_CLOSED;
462	nbp->nbp_vc = vcp;
463	nbp->nbp_sndbuf = smb_tcpsndbuf;
464	nbp->nbp_rcvbuf = smb_tcprcvbuf;
465	vcp->vc_tdata = nbp;
466	return 0;
467}
468
469static int
470smb_nbst_done(struct smb_vc *vcp, struct thread *td)
471{
472	struct nbpcb *nbp = vcp->vc_tdata;
473
474	if (nbp == NULL)
475		return ENOTCONN;
476	smb_nbst_disconnect(vcp, td);
477	if (nbp->nbp_laddr)
478		free(nbp->nbp_laddr, M_SONAME);
479	if (nbp->nbp_paddr)
480		free(nbp->nbp_paddr, M_SONAME);
481	free(nbp, M_NBDATA);
482	return 0;
483}
484
485static int
486smb_nbst_bind(struct smb_vc *vcp, struct sockaddr *sap, struct thread *td)
487{
488	struct nbpcb *nbp = vcp->vc_tdata;
489	struct sockaddr_nb *snb;
490	int error, slen;
491
492	NBDEBUG("\n");
493	error = EINVAL;
494	do {
495		if (nbp->nbp_flags & NBF_LOCADDR)
496			break;
497		/*
498		 * It is possible to create NETBIOS name in the kernel,
499		 * but nothing prevents us to do it in the user space.
500		 */
501		if (sap == NULL)
502			break;
503		slen = sap->sa_len;
504		if (slen < NB_MINSALEN)
505			break;
506		snb = (struct sockaddr_nb*)sodupsockaddr(sap, M_WAITOK);
507		if (snb == NULL) {
508			error = ENOMEM;
509			break;
510		}
511		nbp->nbp_laddr = snb;
512		nbp->nbp_flags |= NBF_LOCADDR;
513		error = 0;
514	} while(0);
515	return error;
516}
517
518static int
519smb_nbst_connect(struct smb_vc *vcp, struct sockaddr *sap, struct thread *td)
520{
521	struct nbpcb *nbp = vcp->vc_tdata;
522	struct sockaddr_in sin;
523	struct sockaddr_nb *snb;
524	struct timespec ts1, ts2;
525	int error, slen;
526
527	NBDEBUG("\n");
528	if (nbp->nbp_tso != NULL)
529		return EISCONN;
530	if (nbp->nbp_laddr == NULL)
531		return EINVAL;
532	slen = sap->sa_len;
533	if (slen < NB_MINSALEN)
534		return EINVAL;
535	if (nbp->nbp_paddr) {
536		free(nbp->nbp_paddr, M_SONAME);
537		nbp->nbp_paddr = NULL;
538	}
539	snb = (struct sockaddr_nb*)sodupsockaddr(sap, M_WAITOK);
540	if (snb == NULL)
541		return ENOMEM;
542	nbp->nbp_paddr = snb;
543	sin = snb->snb_addrin;
544	getnanotime(&ts1);
545	error = nb_connect_in(nbp, &sin, td);
546	if (error)
547		return error;
548	getnanotime(&ts2);
549	timespecsub(&ts2, &ts1, &ts2);
550	if (ts2.tv_sec == 0) {
551		ts2.tv_sec = 1;
552		ts2.tv_nsec = 0;
553	}
554	timespecadd(&ts2, &ts2, &nbp->nbp_timo);
555	timespecadd(&nbp->nbp_timo, &ts2, &nbp->nbp_timo);
556	timespecadd(&nbp->nbp_timo, &ts2, &nbp->nbp_timo);	/*  * 4 */
557	error = nbssn_rq_request(nbp, td);
558	if (error)
559		smb_nbst_disconnect(vcp, td);
560	return error;
561}
562
563static int
564smb_nbst_disconnect(struct smb_vc *vcp, struct thread *td)
565{
566	struct nbpcb *nbp = vcp->vc_tdata;
567	struct socket *so;
568
569	if (nbp == NULL || nbp->nbp_tso == NULL)
570		return ENOTCONN;
571	if ((so = nbp->nbp_tso) != NULL) {
572		nbp->nbp_flags &= ~NBF_CONNECTED;
573		nbp->nbp_tso = (struct socket *)NULL;
574		soshutdown(so, 2);
575		soclose(so);
576	}
577	if (nbp->nbp_state != NBST_RETARGET) {
578		nbp->nbp_state = NBST_CLOSED;
579	}
580	return 0;
581}
582
583static int
584smb_nbst_send(struct smb_vc *vcp, struct mbuf *m0, struct thread *td)
585{
586	struct nbpcb *nbp = vcp->vc_tdata;
587	int error;
588
589	if (nbp->nbp_state != NBST_SESSION) {
590		error = ENOTCONN;
591		goto abort;
592	}
593	M_PREPEND(m0, 4, M_WAITOK);
594	nb_sethdr(m0, NB_SSN_MESSAGE, m_fixhdr(m0) - 4);
595	error = nb_sosend(nbp->nbp_tso, m0, 0, td);
596	return error;
597abort:
598	if (m0)
599		m_freem(m0);
600	return error;
601}
602
603
604static int
605smb_nbst_recv(struct smb_vc *vcp, struct mbuf **mpp, struct thread *td)
606{
607	struct nbpcb *nbp = vcp->vc_tdata;
608	u_int8_t rpcode;
609	int error, rplen;
610
611	nbp->nbp_flags |= NBF_RECVLOCK;
612	error = nbssn_recv(nbp, mpp, &rplen, &rpcode, td);
613	nbp->nbp_flags &= ~NBF_RECVLOCK;
614	return error;
615}
616
617static void
618smb_nbst_timo(struct smb_vc *vcp)
619{
620	return;
621}
622
623static void
624smb_nbst_intr(struct smb_vc *vcp)
625{
626	struct nbpcb *nbp = vcp->vc_tdata;
627
628	if (nbp == NULL || nbp->nbp_tso == NULL)
629		return;
630	sorwakeup(nbp->nbp_tso);
631	sowwakeup(nbp->nbp_tso);
632}
633
634static int
635smb_nbst_getparam(struct smb_vc *vcp, int param, void *data)
636{
637	struct nbpcb *nbp = vcp->vc_tdata;
638
639	switch (param) {
640	    case SMBTP_SNDSZ:
641		*(int*)data = nbp->nbp_sndbuf;
642		break;
643	    case SMBTP_RCVSZ:
644		*(int*)data = nbp->nbp_rcvbuf;
645		break;
646	    case SMBTP_TIMEOUT:
647		*(struct timespec*)data = nbp->nbp_timo;
648		break;
649	    default:
650		return EINVAL;
651	}
652	return 0;
653}
654
655static int
656smb_nbst_setparam(struct smb_vc *vcp, int param, void *data)
657{
658	struct nbpcb *nbp = vcp->vc_tdata;
659
660	switch (param) {
661	    case SMBTP_SELECTID:
662		nbp->nbp_selectid = data;
663		break;
664	    default:
665		return EINVAL;
666	}
667	return 0;
668}
669
670/*
671 * Check for fatal errors
672 */
673static int
674smb_nbst_fatal(struct smb_vc *vcp, int error)
675{
676	switch (error) {
677	    case ENOTCONN:
678	    case ENETRESET:
679	    case ECONNABORTED:
680		return 1;
681	}
682	return 0;
683}
684
685
686struct smb_tran_desc smb_tran_nbtcp_desc = {
687	SMBT_NBTCP,
688	smb_nbst_create, smb_nbst_done,
689	smb_nbst_bind, smb_nbst_connect, smb_nbst_disconnect,
690	smb_nbst_send, smb_nbst_recv,
691	smb_nbst_timo, smb_nbst_intr,
692	smb_nbst_getparam, smb_nbst_setparam,
693	smb_nbst_fatal
694};
695
696