1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
4 * Copyright (C) 2018 Samsung Electronics Co., Ltd.
5 */
6
7 #include "glob.h"
8 #include "oplock.h"
9 #include "misc.h"
10 #include <linux/sched/signal.h>
11 #include <linux/workqueue.h>
12 #include <linux/sysfs.h>
13 #include <linux/module.h>
14 #include <linux/moduleparam.h>
15
16 #include "server.h"
17 #include "smb_common.h"
18 #include "../common/smb2status.h"
19 #include "connection.h"
20 #include "transport_ipc.h"
21 #include "mgmt/user_session.h"
22 #include "crypto_ctx.h"
23 #include "auth.h"
24 #include "stats.h"
25
26 int ksmbd_debug_types;
27
28 struct ksmbd_server_config server_conf;
29
30 enum SERVER_CTRL_TYPE {
31 SERVER_CTRL_TYPE_INIT,
32 SERVER_CTRL_TYPE_RESET,
33 };
34
35 struct server_ctrl_struct {
36 int type;
37 struct work_struct ctrl_work;
38 };
39
40 static DEFINE_MUTEX(ctrl_lock);
41
___server_conf_set(int idx,char * val)42 static int ___server_conf_set(int idx, char *val)
43 {
44 if (idx >= ARRAY_SIZE(server_conf.conf))
45 return -EINVAL;
46
47 if (!val || val[0] == 0x00)
48 return -EINVAL;
49
50 kfree(server_conf.conf[idx]);
51 server_conf.conf[idx] = kstrdup(val, KSMBD_DEFAULT_GFP);
52 if (!server_conf.conf[idx])
53 return -ENOMEM;
54 return 0;
55 }
56
ksmbd_set_netbios_name(char * v)57 int ksmbd_set_netbios_name(char *v)
58 {
59 return ___server_conf_set(SERVER_CONF_NETBIOS_NAME, v);
60 }
61
ksmbd_set_server_string(char * v)62 int ksmbd_set_server_string(char *v)
63 {
64 return ___server_conf_set(SERVER_CONF_SERVER_STRING, v);
65 }
66
ksmbd_set_work_group(char * v)67 int ksmbd_set_work_group(char *v)
68 {
69 return ___server_conf_set(SERVER_CONF_WORK_GROUP, v);
70 }
71
ksmbd_netbios_name(void)72 char *ksmbd_netbios_name(void)
73 {
74 return server_conf.conf[SERVER_CONF_NETBIOS_NAME];
75 }
76
ksmbd_server_string(void)77 char *ksmbd_server_string(void)
78 {
79 return server_conf.conf[SERVER_CONF_SERVER_STRING];
80 }
81
ksmbd_work_group(void)82 char *ksmbd_work_group(void)
83 {
84 return server_conf.conf[SERVER_CONF_WORK_GROUP];
85 }
86
87 /**
88 * check_conn_state() - check state of server thread connection
89 * @work: smb work containing server thread information
90 *
91 * Return: 0 on valid connection, otherwise 1 to reconnect
92 */
check_conn_state(struct ksmbd_work * work)93 static inline int check_conn_state(struct ksmbd_work *work)
94 {
95 struct smb_hdr *rsp_hdr;
96
97 if (ksmbd_conn_exiting(work->conn) ||
98 ksmbd_conn_need_reconnect(work->conn)) {
99 rsp_hdr = smb_get_msg(work->response_buf);
100 rsp_hdr->Status.CifsError = STATUS_CONNECTION_DISCONNECTED;
101 return 1;
102 }
103 return 0;
104 }
105
106 #define SERVER_HANDLER_CONTINUE 0
107 #define SERVER_HANDLER_ABORT 1
108
__process_request(struct ksmbd_work * work,struct ksmbd_conn * conn,u16 * cmd)109 static int __process_request(struct ksmbd_work *work, struct ksmbd_conn *conn,
110 u16 *cmd)
111 {
112 struct smb_version_cmds *cmds;
113 u16 command;
114 int ret;
115
116 if (check_conn_state(work))
117 return SERVER_HANDLER_CONTINUE;
118
119 if (ksmbd_verify_smb_message(work)) {
120 conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER);
121 return SERVER_HANDLER_ABORT;
122 }
123
124 command = conn->ops->get_cmd_val(work);
125 *cmd = command;
126
127 andx_again:
128 if (command >= conn->max_cmds) {
129 conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER);
130 return SERVER_HANDLER_ABORT;
131 }
132
133 cmds = &conn->cmds[command];
134 if (!cmds->proc) {
135 ksmbd_debug(SMB, "*** not implemented yet cmd = %x\n", command);
136 conn->ops->set_rsp_status(work, STATUS_NOT_IMPLEMENTED);
137 return SERVER_HANDLER_ABORT;
138 }
139
140 if (work->sess && conn->ops->is_sign_req(work, command)) {
141 ret = conn->ops->check_sign_req(work);
142 if (!ret) {
143 conn->ops->set_rsp_status(work, STATUS_ACCESS_DENIED);
144 return SERVER_HANDLER_ABORT;
145 }
146 }
147
148 ret = cmds->proc(work);
149 if (conn->ops->inc_reqs)
150 conn->ops->inc_reqs(command);
151
152 if (ret < 0)
153 ksmbd_debug(CONN, "Failed to process %u [%d]\n", command, ret);
154 /* AndX commands - chained request can return positive values */
155 else if (ret > 0) {
156 command = ret;
157 *cmd = command;
158 goto andx_again;
159 }
160
161 if (work->send_no_response)
162 return SERVER_HANDLER_ABORT;
163 return SERVER_HANDLER_CONTINUE;
164 }
165
__handle_ksmbd_work(struct ksmbd_work * work,struct ksmbd_conn * conn)166 static void __handle_ksmbd_work(struct ksmbd_work *work,
167 struct ksmbd_conn *conn)
168 {
169 u16 command = 0;
170 int rc;
171 bool is_chained = false;
172
173 if (conn->ops->is_transform_hdr &&
174 conn->ops->is_transform_hdr(work->request_buf)) {
175 rc = conn->ops->decrypt_req(work);
176 if (rc < 0)
177 return;
178 work->encrypted = true;
179 }
180
181 if (conn->ops->allocate_rsp_buf(work))
182 return;
183
184 rc = conn->ops->init_rsp_hdr(work);
185 if (rc) {
186 /* either uid or tid is not correct */
187 conn->ops->set_rsp_status(work, STATUS_INVALID_HANDLE);
188 goto send;
189 }
190
191 do {
192 if (conn->ops->check_user_session) {
193 rc = conn->ops->check_user_session(work);
194 if (rc < 0) {
195 if (rc == -EINVAL)
196 conn->ops->set_rsp_status(work,
197 STATUS_INVALID_PARAMETER);
198 else
199 conn->ops->set_rsp_status(work,
200 STATUS_USER_SESSION_DELETED);
201 goto send;
202 } else if (rc > 0) {
203 rc = conn->ops->get_ksmbd_tcon(work);
204 if (rc < 0) {
205 if (rc == -EINVAL)
206 conn->ops->set_rsp_status(work,
207 STATUS_INVALID_PARAMETER);
208 else
209 conn->ops->set_rsp_status(work,
210 STATUS_NETWORK_NAME_DELETED);
211 goto send;
212 }
213 }
214 }
215
216 rc = __process_request(work, conn, &command);
217 if (rc == SERVER_HANDLER_ABORT)
218 break;
219
220 /*
221 * Call smb2_set_rsp_credits() function to set number of credits
222 * granted in hdr of smb2 response.
223 */
224 if (conn->ops->set_rsp_credits) {
225 spin_lock(&conn->credits_lock);
226 rc = conn->ops->set_rsp_credits(work);
227 spin_unlock(&conn->credits_lock);
228 if (rc < 0) {
229 conn->ops->set_rsp_status(work,
230 STATUS_INVALID_PARAMETER);
231 goto send;
232 }
233 }
234
235 is_chained = is_chained_smb2_message(work);
236
237 if (work->sess &&
238 (work->sess->sign || smb3_11_final_sess_setup_resp(work) ||
239 conn->ops->is_sign_req(work, command)))
240 conn->ops->set_sign_rsp(work);
241 } while (is_chained == true);
242
243 send:
244 if (work->tcon)
245 ksmbd_tree_connect_put(work->tcon);
246 smb3_preauth_hash_rsp(work);
247 if (work->sess && work->sess->enc && work->encrypted &&
248 conn->ops->encrypt_resp) {
249 rc = conn->ops->encrypt_resp(work);
250 if (rc < 0)
251 conn->ops->set_rsp_status(work, STATUS_DATA_ERROR);
252 }
253 if (work->sess)
254 ksmbd_user_session_put(work->sess);
255
256 ksmbd_conn_write(work);
257 }
258
259 /**
260 * handle_ksmbd_work() - process pending smb work requests
261 * @wk: smb work containing request command buffer
262 *
263 * called by kworker threads to processing remaining smb work requests
264 */
handle_ksmbd_work(struct work_struct * wk)265 static void handle_ksmbd_work(struct work_struct *wk)
266 {
267 struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work);
268 struct ksmbd_conn *conn = work->conn;
269
270 atomic64_inc(&conn->stats.request_served);
271
272 __handle_ksmbd_work(work, conn);
273
274 ksmbd_conn_try_dequeue_request(work);
275 ksmbd_free_work_struct(work);
276 ksmbd_conn_r_count_dec(conn);
277 }
278
279 /**
280 * queue_ksmbd_work() - queue a smb request to worker thread queue
281 * for processing smb command and sending response
282 * @conn: connection instance
283 *
284 * read remaining data from socket create and submit work.
285 */
queue_ksmbd_work(struct ksmbd_conn * conn)286 static int queue_ksmbd_work(struct ksmbd_conn *conn)
287 {
288 struct ksmbd_work *work;
289 int err;
290
291 err = ksmbd_init_smb_server(conn);
292 if (err)
293 return 0;
294
295 work = ksmbd_alloc_work_struct();
296 if (!work) {
297 pr_err("allocation for work failed\n");
298 return -ENOMEM;
299 }
300
301 work->conn = conn;
302 work->request_buf = conn->request_buf;
303 conn->request_buf = NULL;
304
305 ksmbd_conn_enqueue_request(work);
306 ksmbd_conn_r_count_inc(conn);
307 /* update activity on connection */
308 conn->last_active = jiffies;
309 INIT_WORK(&work->work, handle_ksmbd_work);
310 ksmbd_queue_work(work);
311 return 0;
312 }
313
ksmbd_server_process_request(struct ksmbd_conn * conn)314 static int ksmbd_server_process_request(struct ksmbd_conn *conn)
315 {
316 return queue_ksmbd_work(conn);
317 }
318
ksmbd_server_terminate_conn(struct ksmbd_conn * conn)319 static int ksmbd_server_terminate_conn(struct ksmbd_conn *conn)
320 {
321 ksmbd_sessions_deregister(conn);
322 destroy_lease_table(conn);
323 return 0;
324 }
325
ksmbd_server_tcp_callbacks_init(void)326 static void ksmbd_server_tcp_callbacks_init(void)
327 {
328 struct ksmbd_conn_ops ops;
329
330 ops.process_fn = ksmbd_server_process_request;
331 ops.terminate_fn = ksmbd_server_terminate_conn;
332
333 ksmbd_conn_init_server_callbacks(&ops);
334 }
335
server_conf_free(void)336 static void server_conf_free(void)
337 {
338 int i;
339
340 for (i = 0; i < ARRAY_SIZE(server_conf.conf); i++) {
341 kfree(server_conf.conf[i]);
342 server_conf.conf[i] = NULL;
343 }
344 }
345
server_conf_init(void)346 static int server_conf_init(void)
347 {
348 WRITE_ONCE(server_conf.state, SERVER_STATE_STARTING_UP);
349 server_conf.enforced_signing = 0;
350 server_conf.min_protocol = ksmbd_min_protocol();
351 server_conf.max_protocol = ksmbd_max_protocol();
352 server_conf.auth_mechs = KSMBD_AUTH_NTLMSSP;
353 #ifdef CONFIG_SMB_SERVER_KERBEROS5
354 server_conf.auth_mechs |= KSMBD_AUTH_KRB5 |
355 KSMBD_AUTH_MSKRB5;
356 #endif
357 server_conf.max_inflight_req = SMB2_MAX_CREDITS;
358 return 0;
359 }
360
server_ctrl_handle_init(struct server_ctrl_struct * ctrl)361 static void server_ctrl_handle_init(struct server_ctrl_struct *ctrl)
362 {
363 int ret;
364
365 ksmbd_proc_reset();
366 ret = ksmbd_conn_transport_init();
367 if (ret) {
368 server_queue_ctrl_reset_work();
369 return;
370 }
371
372 pr_info("running\n");
373 WRITE_ONCE(server_conf.state, SERVER_STATE_RUNNING);
374 }
375
server_ctrl_handle_reset(struct server_ctrl_struct * ctrl)376 static void server_ctrl_handle_reset(struct server_ctrl_struct *ctrl)
377 {
378 ksmbd_ipc_soft_reset();
379 ksmbd_conn_transport_destroy();
380 ksmbd_stop_durable_scavenger();
381 server_conf_free();
382 server_conf_init();
383 WRITE_ONCE(server_conf.state, SERVER_STATE_STARTING_UP);
384 }
385
server_ctrl_handle_work(struct work_struct * work)386 static void server_ctrl_handle_work(struct work_struct *work)
387 {
388 struct server_ctrl_struct *ctrl;
389
390 ctrl = container_of(work, struct server_ctrl_struct, ctrl_work);
391
392 mutex_lock(&ctrl_lock);
393 switch (ctrl->type) {
394 case SERVER_CTRL_TYPE_INIT:
395 server_ctrl_handle_init(ctrl);
396 break;
397 case SERVER_CTRL_TYPE_RESET:
398 server_ctrl_handle_reset(ctrl);
399 break;
400 default:
401 pr_err("Unknown server work type: %d\n", ctrl->type);
402 }
403 mutex_unlock(&ctrl_lock);
404 kfree(ctrl);
405 module_put(THIS_MODULE);
406 }
407
__queue_ctrl_work(int type)408 static int __queue_ctrl_work(int type)
409 {
410 struct server_ctrl_struct *ctrl;
411
412 ctrl = kmalloc_obj(struct server_ctrl_struct, KSMBD_DEFAULT_GFP);
413 if (!ctrl)
414 return -ENOMEM;
415
416 __module_get(THIS_MODULE);
417 ctrl->type = type;
418 INIT_WORK(&ctrl->ctrl_work, server_ctrl_handle_work);
419 queue_work(system_long_wq, &ctrl->ctrl_work);
420 return 0;
421 }
422
server_queue_ctrl_init_work(void)423 int server_queue_ctrl_init_work(void)
424 {
425 return __queue_ctrl_work(SERVER_CTRL_TYPE_INIT);
426 }
427
server_queue_ctrl_reset_work(void)428 int server_queue_ctrl_reset_work(void)
429 {
430 return __queue_ctrl_work(SERVER_CTRL_TYPE_RESET);
431 }
432
stats_show(const struct class * class,const struct class_attribute * attr,char * buf)433 static ssize_t stats_show(const struct class *class, const struct class_attribute *attr,
434 char *buf)
435 {
436 /*
437 * Inc this each time you change stats output format,
438 * so user space will know what to do.
439 */
440 static int stats_version = 2;
441 static const char * const state[] = {
442 "startup",
443 "running",
444 "reset",
445 "shutdown"
446 };
447 return sysfs_emit(buf, "%d %s %d %lu\n", stats_version,
448 state[server_conf.state], server_conf.tcp_port,
449 server_conf.ipc_last_active / HZ);
450 }
451
kill_server_store(const struct class * class,const struct class_attribute * attr,const char * buf,size_t len)452 static ssize_t kill_server_store(const struct class *class,
453 const struct class_attribute *attr, const char *buf,
454 size_t len)
455 {
456 if (!sysfs_streq(buf, "hard"))
457 return len;
458
459 pr_info("kill command received\n");
460 mutex_lock(&ctrl_lock);
461 WRITE_ONCE(server_conf.state, SERVER_STATE_RESETTING);
462 __module_get(THIS_MODULE);
463 server_ctrl_handle_reset(NULL);
464 module_put(THIS_MODULE);
465 mutex_unlock(&ctrl_lock);
466 return len;
467 }
468
469 static const char * const debug_type_strings[] = {"smb", "auth", "vfs",
470 "oplock", "ipc", "conn",
471 "rdma"};
472
debug_show(const struct class * class,const struct class_attribute * attr,char * buf)473 static ssize_t debug_show(const struct class *class, const struct class_attribute *attr,
474 char *buf)
475 {
476 ssize_t sz = 0;
477 int i, pos = 0;
478
479 for (i = 0; i < ARRAY_SIZE(debug_type_strings); i++) {
480 if ((ksmbd_debug_types >> i) & 1) {
481 pos = sysfs_emit_at(buf, sz, "[%s] ", debug_type_strings[i]);
482 } else {
483 pos = sysfs_emit_at(buf, sz, "%s ", debug_type_strings[i]);
484 }
485 sz += pos;
486 }
487 sz += sysfs_emit_at(buf, sz, "\n");
488 return sz;
489 }
490
debug_store(const struct class * class,const struct class_attribute * attr,const char * buf,size_t len)491 static ssize_t debug_store(const struct class *class, const struct class_attribute *attr,
492 const char *buf, size_t len)
493 {
494 int i;
495
496 for (i = 0; i < ARRAY_SIZE(debug_type_strings); i++) {
497 if (sysfs_streq(buf, "all")) {
498 if (ksmbd_debug_types == KSMBD_DEBUG_ALL)
499 ksmbd_debug_types = 0;
500 else
501 ksmbd_debug_types = KSMBD_DEBUG_ALL;
502 break;
503 }
504
505 if (sysfs_streq(buf, debug_type_strings[i])) {
506 if (ksmbd_debug_types & (1 << i))
507 ksmbd_debug_types &= ~(1 << i);
508 else
509 ksmbd_debug_types |= (1 << i);
510 break;
511 }
512 }
513
514 return len;
515 }
516
517 static CLASS_ATTR_RO(stats);
518 static CLASS_ATTR_WO(kill_server);
519 static CLASS_ATTR_RW(debug);
520
521 static struct attribute *ksmbd_control_class_attrs[] = {
522 &class_attr_stats.attr,
523 &class_attr_kill_server.attr,
524 &class_attr_debug.attr,
525 NULL,
526 };
527 ATTRIBUTE_GROUPS(ksmbd_control_class);
528
529 static struct class ksmbd_control_class = {
530 .name = "ksmbd-control",
531 .class_groups = ksmbd_control_class_groups,
532 };
533
ksmbd_server_shutdown(void)534 static int ksmbd_server_shutdown(void)
535 {
536 WRITE_ONCE(server_conf.state, SERVER_STATE_SHUTTING_DOWN);
537
538 ksmbd_proc_cleanup();
539 class_unregister(&ksmbd_control_class);
540 ksmbd_workqueue_destroy();
541 ksmbd_ipc_release();
542 ksmbd_conn_transport_destroy();
543 ksmbd_crypto_destroy();
544 ksmbd_free_global_file_table();
545 destroy_lease_table(NULL);
546 ksmbd_work_pool_destroy();
547 ksmbd_exit_file_cache();
548 server_conf_free();
549 return 0;
550 }
551
ksmbd_server_init(void)552 static int __init ksmbd_server_init(void)
553 {
554 int ret;
555
556 ret = class_register(&ksmbd_control_class);
557 if (ret) {
558 pr_err("Unable to register ksmbd-control class\n");
559 return ret;
560 }
561
562 ksmbd_proc_init();
563 create_proc_sessions();
564
565 ksmbd_server_tcp_callbacks_init();
566
567 ret = server_conf_init();
568 if (ret)
569 goto err_unregister;
570
571 ret = ksmbd_work_pool_init();
572 if (ret)
573 goto err_unregister;
574
575 ret = ksmbd_init_file_cache();
576 if (ret)
577 goto err_destroy_work_pools;
578
579 ret = ksmbd_ipc_init();
580 if (ret)
581 goto err_exit_file_cache;
582
583 ret = ksmbd_init_global_file_table();
584 if (ret)
585 goto err_ipc_release;
586
587 ret = ksmbd_inode_hash_init();
588 if (ret)
589 goto err_destroy_file_table;
590
591 ret = ksmbd_crypto_create();
592 if (ret)
593 goto err_release_inode_hash;
594
595 ret = ksmbd_workqueue_init();
596 if (ret)
597 goto err_crypto_destroy;
598
599 return 0;
600
601 err_crypto_destroy:
602 ksmbd_crypto_destroy();
603 err_release_inode_hash:
604 ksmbd_release_inode_hash();
605 err_destroy_file_table:
606 ksmbd_free_global_file_table();
607 err_ipc_release:
608 ksmbd_ipc_release();
609 err_exit_file_cache:
610 ksmbd_exit_file_cache();
611 err_destroy_work_pools:
612 ksmbd_work_pool_destroy();
613 err_unregister:
614 class_unregister(&ksmbd_control_class);
615
616 return ret;
617 }
618
619 /**
620 * ksmbd_server_exit() - shutdown forker thread and free memory at module exit
621 */
ksmbd_server_exit(void)622 static void __exit ksmbd_server_exit(void)
623 {
624 ksmbd_server_shutdown();
625 rcu_barrier();
626 ksmbd_release_inode_hash();
627 }
628
629 MODULE_AUTHOR("Namjae Jeon <linkinjeon@kernel.org>");
630 MODULE_DESCRIPTION("Linux kernel CIFS/SMB SERVER");
631 MODULE_LICENSE("GPL");
632 MODULE_SOFTDEP("pre: ecb");
633 MODULE_SOFTDEP("pre: nls");
634 MODULE_SOFTDEP("pre: aes");
635 MODULE_SOFTDEP("pre: cmac");
636 MODULE_SOFTDEP("pre: aead2");
637 MODULE_SOFTDEP("pre: ccm");
638 MODULE_SOFTDEP("pre: gcm");
639 module_init(ksmbd_server_init)
640 module_exit(ksmbd_server_exit)
641