1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org> 4 * Copyright (C) 2018 Samsung Electronics Co., Ltd. 5 */ 6 7 #include "glob.h" 8 #include "oplock.h" 9 #include "misc.h" 10 #include <linux/sched/signal.h> 11 #include <linux/workqueue.h> 12 #include <linux/sysfs.h> 13 #include <linux/module.h> 14 #include <linux/moduleparam.h> 15 16 #include "server.h" 17 #include "smb_common.h" 18 #include "../common/smb2status.h" 19 #include "connection.h" 20 #include "transport_ipc.h" 21 #include "mgmt/user_session.h" 22 #include "crypto_ctx.h" 23 #include "auth.h" 24 #include "stats.h" 25 #include "compress.h" 26 27 int ksmbd_debug_types; 28 29 struct ksmbd_server_config server_conf; 30 31 enum SERVER_CTRL_TYPE { 32 SERVER_CTRL_TYPE_INIT, 33 SERVER_CTRL_TYPE_RESET, 34 }; 35 36 struct server_ctrl_struct { 37 int type; 38 struct work_struct ctrl_work; 39 }; 40 41 static DEFINE_MUTEX(ctrl_lock); 42 43 static int ___server_conf_set(int idx, char *val) 44 { 45 if (idx >= ARRAY_SIZE(server_conf.conf)) 46 return -EINVAL; 47 48 if (!val || val[0] == 0x00) 49 return -EINVAL; 50 51 kfree(server_conf.conf[idx]); 52 server_conf.conf[idx] = kstrdup(val, KSMBD_DEFAULT_GFP); 53 if (!server_conf.conf[idx]) 54 return -ENOMEM; 55 return 0; 56 } 57 58 int ksmbd_set_netbios_name(char *v) 59 { 60 return ___server_conf_set(SERVER_CONF_NETBIOS_NAME, v); 61 } 62 63 int ksmbd_set_server_string(char *v) 64 { 65 return ___server_conf_set(SERVER_CONF_SERVER_STRING, v); 66 } 67 68 int ksmbd_set_work_group(char *v) 69 { 70 return ___server_conf_set(SERVER_CONF_WORK_GROUP, v); 71 } 72 73 char *ksmbd_netbios_name(void) 74 { 75 return server_conf.conf[SERVER_CONF_NETBIOS_NAME]; 76 } 77 78 char *ksmbd_server_string(void) 79 { 80 return server_conf.conf[SERVER_CONF_SERVER_STRING]; 81 } 82 83 char *ksmbd_work_group(void) 84 { 85 return server_conf.conf[SERVER_CONF_WORK_GROUP]; 86 } 87 88 /** 89 * check_conn_state() - check state of server thread connection 90 * @work: smb work containing server thread information 91 * 92 * Return: 0 on valid connection, otherwise 1 to reconnect 93 */ 94 static inline int check_conn_state(struct ksmbd_work *work) 95 { 96 struct smb_hdr *rsp_hdr; 97 98 if (ksmbd_conn_exiting(work->conn) || 99 ksmbd_conn_need_reconnect(work->conn)) { 100 rsp_hdr = smb_get_msg(work->response_buf); 101 rsp_hdr->Status.CifsError = STATUS_CONNECTION_DISCONNECTED; 102 return 1; 103 } 104 return 0; 105 } 106 107 #define SERVER_HANDLER_CONTINUE 0 108 #define SERVER_HANDLER_ABORT 1 109 110 static int __process_request(struct ksmbd_work *work, struct ksmbd_conn *conn, 111 u16 *cmd) 112 { 113 struct smb_version_cmds *cmds; 114 u16 command; 115 bool signed_req; 116 int ret; 117 118 if (check_conn_state(work)) 119 return SERVER_HANDLER_CONTINUE; 120 121 if (ksmbd_verify_smb_message(work)) { 122 conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER); 123 return SERVER_HANDLER_ABORT; 124 } 125 126 command = conn->ops->get_cmd_val(work); 127 *cmd = command; 128 129 andx_again: 130 if (command >= conn->max_cmds) { 131 conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER); 132 return SERVER_HANDLER_ABORT; 133 } 134 135 cmds = &conn->cmds[command]; 136 if (!cmds->proc) { 137 ksmbd_debug(SMB, "*** not implemented yet cmd = %x\n", command); 138 conn->ops->set_rsp_status(work, STATUS_NOT_IMPLEMENTED); 139 return SERVER_HANDLER_ABORT; 140 } 141 142 signed_req = conn->ops->is_sign_req && conn->ops->is_sign_req(work, command); 143 if (work->sess && work->sess->sign && !work->encrypted && 144 !signed_req) { 145 conn->ops->set_rsp_status(work, STATUS_ACCESS_DENIED); 146 return SERVER_HANDLER_ABORT; 147 } 148 149 if (work->sess && signed_req) { 150 ret = conn->ops->check_sign_req(work); 151 if (!ret) { 152 conn->ops->set_rsp_status(work, STATUS_ACCESS_DENIED); 153 return SERVER_HANDLER_ABORT; 154 } 155 } 156 157 ret = cmds->proc(work); 158 if (conn->ops->inc_reqs) 159 conn->ops->inc_reqs(command); 160 161 if (ret < 0) 162 ksmbd_debug(CONN, "Failed to process %u [%d]\n", command, ret); 163 /* AndX commands - chained request can return positive values */ 164 else if (ret > 0) { 165 command = ret; 166 *cmd = command; 167 goto andx_again; 168 } 169 170 if (work->send_no_response) 171 return SERVER_HANDLER_ABORT; 172 return SERVER_HANDLER_CONTINUE; 173 } 174 175 static void __handle_ksmbd_work(struct ksmbd_work *work, 176 struct ksmbd_conn *conn) 177 { 178 u16 command = 0; 179 int rc; 180 bool is_chained = false; 181 182 if (conn->ops->is_transform_hdr && 183 conn->ops->is_transform_hdr(work->request_buf)) { 184 rc = conn->ops->decrypt_req(work); 185 if (rc < 0) 186 return; 187 work->encrypted = true; 188 } 189 190 if (conn->ops->allocate_rsp_buf(work)) 191 return; 192 193 rc = conn->ops->init_rsp_hdr(work); 194 if (rc) { 195 /* either uid or tid is not correct */ 196 conn->ops->set_rsp_status(work, STATUS_INVALID_HANDLE); 197 goto send; 198 } 199 200 do { 201 if (conn->ops->check_user_session) { 202 rc = conn->ops->check_user_session(work); 203 if (rc < 0) { 204 if (rc == -EINVAL) 205 conn->ops->set_rsp_status(work, 206 STATUS_INVALID_PARAMETER); 207 else 208 conn->ops->set_rsp_status(work, 209 STATUS_USER_SESSION_DELETED); 210 if (conn->ops->is_sign_req(work, conn->ops->get_cmd_val(work))) { 211 struct smb2_hdr *rsp_hdr; 212 213 rsp_hdr = ksmbd_resp_buf_curr(work); 214 rsp_hdr->Flags |= SMB2_FLAGS_SIGNED; 215 } 216 goto send; 217 } else if (rc > 0) { 218 rc = conn->ops->get_ksmbd_tcon(work); 219 if (rc < 0) { 220 if (rc == -EINVAL) 221 conn->ops->set_rsp_status(work, 222 STATUS_INVALID_PARAMETER); 223 else 224 conn->ops->set_rsp_status(work, 225 STATUS_NETWORK_NAME_DELETED); 226 goto send; 227 } 228 } 229 } 230 231 rc = __process_request(work, conn, &command); 232 if (rc == SERVER_HANDLER_ABORT) 233 break; 234 235 /* 236 * Call smb2_set_rsp_credits() function to set number of credits 237 * granted in hdr of smb2 response. 238 */ 239 if (conn->ops->set_rsp_credits) { 240 spin_lock(&conn->credits_lock); 241 rc = conn->ops->set_rsp_credits(work); 242 spin_unlock(&conn->credits_lock); 243 if (rc < 0) { 244 conn->ops->set_rsp_status(work, 245 STATUS_INVALID_PARAMETER); 246 goto send; 247 } 248 } 249 250 is_chained = is_chained_smb2_message(work); 251 252 if (work->sess && 253 (work->sess->sign || smb3_11_final_sess_setup_resp(work) || 254 conn->ops->is_sign_req(work, command))) { 255 if (command == SMB2_SESSION_SETUP_HE && 256 work->sess->dialect >= SMB30_PROT_ID && 257 conn->dialect < SMB30_PROT_ID) 258 smb3_set_sign_rsp(work); 259 else 260 conn->ops->set_sign_rsp(work); 261 } 262 } while (is_chained == true); 263 264 send: 265 /* 266 * Release any credit charge still outstanding for this request. On 267 * the normal path smb2_set_rsp_credits() already returned it, but the 268 * abort, error and send-no-response paths skip that call, so the 269 * charge would otherwise leak and eventually exhaust the connection's 270 * outstanding credit window. 271 */ 272 if (work->credit_charge) { 273 spin_lock(&conn->credits_lock); 274 conn->outstanding_credits -= work->credit_charge; 275 work->credit_charge = 0; 276 spin_unlock(&conn->credits_lock); 277 } 278 279 if (work->tcon) 280 ksmbd_tree_connect_put(work->tcon); 281 smb3_preauth_hash_rsp(work); 282 /* 283 * Preauthentication hashes cover the original SMB2 response. Apply the 284 * transport compression wrapper only after updating the hash. 285 */ 286 if (work->compress_response) { 287 rc = ksmbd_compress_response(work); 288 if (rc < 0) 289 ksmbd_debug(CONN, "Failed to compress response: %d\n", rc); 290 } 291 if (work->sess && work->sess->enc && work->encrypted && 292 conn->ops->encrypt_resp) { 293 rc = conn->ops->encrypt_resp(work); 294 if (rc < 0) 295 conn->ops->set_rsp_status(work, STATUS_DATA_ERROR); 296 } 297 if (work->sess) 298 ksmbd_user_session_put(work->sess); 299 300 ksmbd_conn_write(work); 301 } 302 303 /** 304 * handle_ksmbd_work() - process pending smb work requests 305 * @wk: smb work containing request command buffer 306 * 307 * called by kworker threads to processing remaining smb work requests 308 */ 309 static void handle_ksmbd_work(struct work_struct *wk) 310 { 311 struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work); 312 struct ksmbd_conn *conn = work->conn; 313 314 atomic64_inc(&conn->stats.request_served); 315 316 __handle_ksmbd_work(work, conn); 317 318 ksmbd_conn_try_dequeue_request(work); 319 ksmbd_free_work_struct(work); 320 ksmbd_conn_r_count_dec(conn); 321 } 322 323 /** 324 * queue_ksmbd_work() - queue a smb request to worker thread queue 325 * for processing smb command and sending response 326 * @conn: connection instance 327 * 328 * read remaining data from socket create and submit work. 329 */ 330 static int queue_ksmbd_work(struct ksmbd_conn *conn) 331 { 332 struct ksmbd_work *work; 333 int err; 334 335 err = ksmbd_init_smb_server(conn); 336 if (err) 337 return 0; 338 339 work = ksmbd_alloc_work_struct(); 340 if (!work) { 341 pr_err("allocation for work failed\n"); 342 return -ENOMEM; 343 } 344 345 work->conn = conn; 346 work->request_buf = conn->request_buf; 347 conn->request_buf = NULL; 348 349 ksmbd_conn_enqueue_request(work); 350 ksmbd_conn_r_count_inc(conn); 351 /* update activity on connection */ 352 conn->last_active = jiffies; 353 INIT_WORK(&work->work, handle_ksmbd_work); 354 ksmbd_queue_work(work); 355 return 0; 356 } 357 358 static int ksmbd_server_process_request(struct ksmbd_conn *conn) 359 { 360 return queue_ksmbd_work(conn); 361 } 362 363 static int ksmbd_server_terminate_conn(struct ksmbd_conn *conn) 364 { 365 ksmbd_sessions_deregister(conn); 366 destroy_lease_table(conn); 367 return 0; 368 } 369 370 static void ksmbd_server_tcp_callbacks_init(void) 371 { 372 struct ksmbd_conn_ops ops; 373 374 ops.process_fn = ksmbd_server_process_request; 375 ops.terminate_fn = ksmbd_server_terminate_conn; 376 377 ksmbd_conn_init_server_callbacks(&ops); 378 } 379 380 static void server_conf_free(void) 381 { 382 int i; 383 384 for (i = 0; i < ARRAY_SIZE(server_conf.conf); i++) { 385 kfree(server_conf.conf[i]); 386 server_conf.conf[i] = NULL; 387 } 388 } 389 390 static int server_conf_init(void) 391 { 392 WRITE_ONCE(server_conf.state, SERVER_STATE_STARTING_UP); 393 server_conf.enforced_signing = 0; 394 server_conf.min_protocol = ksmbd_min_protocol(); 395 server_conf.max_protocol = ksmbd_max_protocol(); 396 server_conf.auth_mechs = KSMBD_AUTH_NTLMSSP; 397 #ifdef CONFIG_SMB_SERVER_KERBEROS5 398 server_conf.auth_mechs |= KSMBD_AUTH_KRB5 | 399 KSMBD_AUTH_MSKRB5; 400 #endif 401 server_conf.max_inflight_req = SMB2_MAX_CREDITS; 402 return 0; 403 } 404 405 static void server_ctrl_handle_init(struct server_ctrl_struct *ctrl) 406 { 407 int ret; 408 409 ksmbd_proc_reset(); 410 ret = ksmbd_conn_transport_init(); 411 if (ret) { 412 server_queue_ctrl_reset_work(); 413 return; 414 } 415 416 pr_info("running\n"); 417 WRITE_ONCE(server_conf.state, SERVER_STATE_RUNNING); 418 } 419 420 static void server_ctrl_handle_reset(struct server_ctrl_struct *ctrl) 421 { 422 ksmbd_ipc_soft_reset(); 423 ksmbd_conn_transport_destroy(); 424 ksmbd_stop_durable_scavenger(); 425 server_conf_free(); 426 server_conf_init(); 427 WRITE_ONCE(server_conf.state, SERVER_STATE_STARTING_UP); 428 } 429 430 static void server_ctrl_handle_work(struct work_struct *work) 431 { 432 struct server_ctrl_struct *ctrl; 433 434 ctrl = container_of(work, struct server_ctrl_struct, ctrl_work); 435 436 mutex_lock(&ctrl_lock); 437 switch (ctrl->type) { 438 case SERVER_CTRL_TYPE_INIT: 439 server_ctrl_handle_init(ctrl); 440 break; 441 case SERVER_CTRL_TYPE_RESET: 442 server_ctrl_handle_reset(ctrl); 443 break; 444 default: 445 pr_err("Unknown server work type: %d\n", ctrl->type); 446 } 447 mutex_unlock(&ctrl_lock); 448 kfree(ctrl); 449 module_put(THIS_MODULE); 450 } 451 452 static int __queue_ctrl_work(int type) 453 { 454 struct server_ctrl_struct *ctrl; 455 456 ctrl = kmalloc_obj(struct server_ctrl_struct, KSMBD_DEFAULT_GFP); 457 if (!ctrl) 458 return -ENOMEM; 459 460 __module_get(THIS_MODULE); 461 ctrl->type = type; 462 INIT_WORK(&ctrl->ctrl_work, server_ctrl_handle_work); 463 queue_work(system_long_wq, &ctrl->ctrl_work); 464 return 0; 465 } 466 467 int server_queue_ctrl_init_work(void) 468 { 469 return __queue_ctrl_work(SERVER_CTRL_TYPE_INIT); 470 } 471 472 int server_queue_ctrl_reset_work(void) 473 { 474 return __queue_ctrl_work(SERVER_CTRL_TYPE_RESET); 475 } 476 477 static ssize_t stats_show(const struct class *class, const struct class_attribute *attr, 478 char *buf) 479 { 480 /* 481 * Inc this each time you change stats output format, 482 * so user space will know what to do. 483 */ 484 static int stats_version = 2; 485 static const char * const state[] = { 486 "startup", 487 "running", 488 "reset", 489 "shutdown" 490 }; 491 return sysfs_emit(buf, "%d %s %d %lu\n", stats_version, 492 state[server_conf.state], server_conf.tcp_port, 493 server_conf.ipc_last_active / HZ); 494 } 495 496 static ssize_t kill_server_store(const struct class *class, 497 const struct class_attribute *attr, const char *buf, 498 size_t len) 499 { 500 if (!sysfs_streq(buf, "hard")) 501 return len; 502 503 pr_info("kill command received\n"); 504 mutex_lock(&ctrl_lock); 505 WRITE_ONCE(server_conf.state, SERVER_STATE_RESETTING); 506 __module_get(THIS_MODULE); 507 server_ctrl_handle_reset(NULL); 508 module_put(THIS_MODULE); 509 mutex_unlock(&ctrl_lock); 510 return len; 511 } 512 513 static const char * const debug_type_strings[] = {"smb", "auth", "vfs", 514 "oplock", "ipc", "conn", 515 "rdma"}; 516 517 static ssize_t debug_show(const struct class *class, const struct class_attribute *attr, 518 char *buf) 519 { 520 ssize_t sz = 0; 521 int i, pos = 0; 522 523 for (i = 0; i < ARRAY_SIZE(debug_type_strings); i++) { 524 if ((ksmbd_debug_types >> i) & 1) { 525 pos = sysfs_emit_at(buf, sz, "[%s] ", debug_type_strings[i]); 526 } else { 527 pos = sysfs_emit_at(buf, sz, "%s ", debug_type_strings[i]); 528 } 529 sz += pos; 530 } 531 sz += sysfs_emit_at(buf, sz, "\n"); 532 return sz; 533 } 534 535 static ssize_t debug_store(const struct class *class, const struct class_attribute *attr, 536 const char *buf, size_t len) 537 { 538 int i; 539 540 for (i = 0; i < ARRAY_SIZE(debug_type_strings); i++) { 541 if (sysfs_streq(buf, "all")) { 542 if (ksmbd_debug_types == KSMBD_DEBUG_ALL) 543 ksmbd_debug_types = 0; 544 else 545 ksmbd_debug_types = KSMBD_DEBUG_ALL; 546 break; 547 } 548 549 if (sysfs_streq(buf, debug_type_strings[i])) { 550 if (ksmbd_debug_types & (1 << i)) 551 ksmbd_debug_types &= ~(1 << i); 552 else 553 ksmbd_debug_types |= (1 << i); 554 break; 555 } 556 } 557 558 return len; 559 } 560 561 static CLASS_ATTR_RO(stats); 562 static CLASS_ATTR_WO(kill_server); 563 static CLASS_ATTR_RW(debug); 564 565 static struct attribute *ksmbd_control_class_attrs[] = { 566 &class_attr_stats.attr, 567 &class_attr_kill_server.attr, 568 &class_attr_debug.attr, 569 NULL, 570 }; 571 ATTRIBUTE_GROUPS(ksmbd_control_class); 572 573 static struct class ksmbd_control_class = { 574 .name = "ksmbd-control", 575 .class_groups = ksmbd_control_class_groups, 576 }; 577 578 static int ksmbd_server_shutdown(void) 579 { 580 WRITE_ONCE(server_conf.state, SERVER_STATE_SHUTTING_DOWN); 581 582 ksmbd_proc_cleanup(); 583 class_unregister(&ksmbd_control_class); 584 ksmbd_workqueue_destroy(); 585 ksmbd_ipc_release(); 586 ksmbd_conn_transport_destroy(); 587 ksmbd_crypto_destroy(); 588 ksmbd_free_global_file_table(); 589 destroy_lease_table(NULL); 590 ksmbd_work_pool_destroy(); 591 ksmbd_exit_file_cache(); 592 server_conf_free(); 593 return 0; 594 } 595 596 static int __init ksmbd_server_init(void) 597 { 598 int ret; 599 600 ret = class_register(&ksmbd_control_class); 601 if (ret) { 602 pr_err("Unable to register ksmbd-control class\n"); 603 return ret; 604 } 605 606 ksmbd_proc_init(); 607 create_proc_sessions(); 608 609 ksmbd_server_tcp_callbacks_init(); 610 611 ret = server_conf_init(); 612 if (ret) 613 goto err_unregister; 614 615 ret = ksmbd_work_pool_init(); 616 if (ret) 617 goto err_unregister; 618 619 ret = ksmbd_init_file_cache(); 620 if (ret) 621 goto err_destroy_work_pools; 622 623 ret = ksmbd_ipc_init(); 624 if (ret) 625 goto err_exit_file_cache; 626 627 ret = ksmbd_init_global_file_table(); 628 if (ret) 629 goto err_ipc_release; 630 631 ret = ksmbd_inode_hash_init(); 632 if (ret) 633 goto err_destroy_file_table; 634 635 ret = ksmbd_crypto_create(); 636 if (ret) 637 goto err_release_inode_hash; 638 639 ret = ksmbd_workqueue_init(); 640 if (ret) 641 goto err_crypto_destroy; 642 643 ret = ksmbd_conn_wq_init(); 644 if (ret) 645 goto err_workqueue_destroy; 646 647 return 0; 648 649 err_workqueue_destroy: 650 ksmbd_workqueue_destroy(); 651 err_crypto_destroy: 652 ksmbd_crypto_destroy(); 653 err_release_inode_hash: 654 ksmbd_release_inode_hash(); 655 err_destroy_file_table: 656 ksmbd_free_global_file_table(); 657 err_ipc_release: 658 ksmbd_ipc_release(); 659 err_exit_file_cache: 660 ksmbd_exit_file_cache(); 661 err_destroy_work_pools: 662 ksmbd_work_pool_destroy(); 663 err_unregister: 664 class_unregister(&ksmbd_control_class); 665 666 return ret; 667 } 668 669 /** 670 * ksmbd_server_exit() - shutdown forker thread and free memory at module exit 671 */ 672 static void __exit ksmbd_server_exit(void) 673 { 674 ksmbd_server_shutdown(); 675 rcu_barrier(); 676 /* 677 * ksmbd_conn_put() defers the final release onto ksmbd_conn_wq, 678 * so drain it after rcu_barrier() has fired any pending RCU 679 * callbacks that may have queued a release. 680 */ 681 ksmbd_conn_wq_destroy(); 682 ksmbd_release_inode_hash(); 683 } 684 685 MODULE_AUTHOR("Namjae Jeon <linkinjeon@kernel.org>"); 686 MODULE_DESCRIPTION("Linux kernel CIFS/SMB SERVER"); 687 MODULE_LICENSE("GPL"); 688 MODULE_SOFTDEP("pre: nls"); 689 MODULE_SOFTDEP("pre: aes"); 690 MODULE_SOFTDEP("pre: aead2"); 691 MODULE_SOFTDEP("pre: ccm"); 692 MODULE_SOFTDEP("pre: gcm"); 693 module_init(ksmbd_server_init) 694 module_exit(ksmbd_server_exit) 695