1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org> 4 * Copyright (C) 2018 Samsung Electronics Co., Ltd. 5 */ 6 7 #include "glob.h" 8 #include "oplock.h" 9 #include "misc.h" 10 #include <linux/sched/signal.h> 11 #include <linux/workqueue.h> 12 #include <linux/sysfs.h> 13 #include <linux/module.h> 14 #include <linux/moduleparam.h> 15 16 #include "server.h" 17 #include "smb_common.h" 18 #include "smb2pdu.h" 19 #include "../common/smb2status.h" 20 #include "connection.h" 21 #include "transport_ipc.h" 22 #include "mgmt/user_session.h" 23 #include "crypto_ctx.h" 24 #include "auth.h" 25 #include "stats.h" 26 #include "compress.h" 27 28 int ksmbd_debug_types; 29 30 struct ksmbd_server_config server_conf; 31 32 enum SERVER_CTRL_TYPE { 33 SERVER_CTRL_TYPE_INIT, 34 SERVER_CTRL_TYPE_RESET, 35 }; 36 37 struct server_ctrl_struct { 38 int type; 39 struct work_struct ctrl_work; 40 }; 41 42 static DEFINE_MUTEX(ctrl_lock); 43 44 static int ___server_conf_set(int idx, char *val) 45 { 46 if (idx >= ARRAY_SIZE(server_conf.conf)) 47 return -EINVAL; 48 49 if (!val || val[0] == 0x00) 50 return -EINVAL; 51 52 kfree(server_conf.conf[idx]); 53 server_conf.conf[idx] = kstrdup(val, KSMBD_DEFAULT_GFP); 54 if (!server_conf.conf[idx]) 55 return -ENOMEM; 56 return 0; 57 } 58 59 int ksmbd_set_netbios_name(char *v) 60 { 61 return ___server_conf_set(SERVER_CONF_NETBIOS_NAME, v); 62 } 63 64 int ksmbd_set_server_string(char *v) 65 { 66 return ___server_conf_set(SERVER_CONF_SERVER_STRING, v); 67 } 68 69 int ksmbd_set_work_group(char *v) 70 { 71 return ___server_conf_set(SERVER_CONF_WORK_GROUP, v); 72 } 73 74 char *ksmbd_netbios_name(void) 75 { 76 return server_conf.conf[SERVER_CONF_NETBIOS_NAME]; 77 } 78 79 char *ksmbd_server_string(void) 80 { 81 return server_conf.conf[SERVER_CONF_SERVER_STRING]; 82 } 83 84 char *ksmbd_work_group(void) 85 { 86 return server_conf.conf[SERVER_CONF_WORK_GROUP]; 87 } 88 89 /** 90 * check_conn_state() - check state of server thread connection 91 * @work: smb work containing server thread information 92 * 93 * Return: 0 on valid connection, otherwise 1 to reconnect 94 */ 95 static inline int check_conn_state(struct ksmbd_work *work) 96 { 97 struct smb_hdr *rsp_hdr; 98 99 if (ksmbd_conn_exiting(work->conn) || 100 ksmbd_conn_need_reconnect(work->conn)) { 101 rsp_hdr = smb_get_msg(work->response_buf); 102 rsp_hdr->Status.CifsError = STATUS_CONNECTION_DISCONNECTED; 103 return 1; 104 } 105 return 0; 106 } 107 108 #define SERVER_HANDLER_CONTINUE 0 109 #define SERVER_HANDLER_ABORT 1 110 111 static int __process_request(struct ksmbd_work *work, struct ksmbd_conn *conn, 112 u16 *cmd) 113 { 114 struct smb_version_cmds *cmds; 115 u16 command; 116 bool signed_req; 117 int ret; 118 119 if (check_conn_state(work)) 120 return SERVER_HANDLER_CONTINUE; 121 122 if (ksmbd_verify_smb_message(work)) { 123 conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER); 124 return SERVER_HANDLER_ABORT; 125 } 126 127 command = conn->ops->get_cmd_val(work); 128 *cmd = command; 129 130 andx_again: 131 if (command >= conn->max_cmds) { 132 conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER); 133 return SERVER_HANDLER_ABORT; 134 } 135 136 cmds = &conn->cmds[command]; 137 if (!cmds->proc) { 138 ksmbd_debug(SMB, "*** not implemented yet cmd = %x\n", command); 139 conn->ops->set_rsp_status(work, STATUS_NOT_IMPLEMENTED); 140 return SERVER_HANDLER_ABORT; 141 } 142 143 signed_req = conn->ops->is_sign_req && conn->ops->is_sign_req(work, command); 144 if (work->sess && work->sess->sign && !work->encrypted && 145 !signed_req) { 146 conn->ops->set_rsp_status(work, STATUS_ACCESS_DENIED); 147 return SERVER_HANDLER_ABORT; 148 } 149 150 if (work->sess && signed_req) { 151 ret = conn->ops->check_sign_req(work); 152 if (!ret) { 153 conn->ops->set_rsp_status(work, STATUS_ACCESS_DENIED); 154 return SERVER_HANDLER_ABORT; 155 } 156 } 157 158 ret = cmds->proc(work); 159 if (conn->ops->inc_reqs) { 160 struct smb2_hdr *rsp = ksmbd_resp_buf_curr(work); 161 162 conn->ops->inc_reqs(command, rsp->Status); 163 } 164 165 if (ret < 0) 166 ksmbd_debug(CONN, "Failed to process %u [%d]\n", command, ret); 167 /* AndX commands - chained request can return positive values */ 168 else if (ret > 0) { 169 command = ret; 170 *cmd = command; 171 goto andx_again; 172 } 173 174 if (work->send_no_response) 175 return SERVER_HANDLER_ABORT; 176 return SERVER_HANDLER_CONTINUE; 177 } 178 179 static void __handle_ksmbd_work(struct ksmbd_work *work, 180 struct ksmbd_conn *conn) 181 { 182 u16 command = 0; 183 int rc; 184 bool is_chained = false; 185 186 if (conn->ops->is_transform_hdr && 187 conn->ops->is_transform_hdr(work->request_buf)) { 188 rc = conn->ops->decrypt_req(work); 189 if (rc < 0) 190 return; 191 work->encrypted = true; 192 } 193 194 if (conn->ops->allocate_rsp_buf(work)) 195 return; 196 197 rc = conn->ops->init_rsp_hdr(work); 198 if (rc) { 199 /* either uid or tid is not correct */ 200 conn->ops->set_rsp_status(work, STATUS_INVALID_HANDLE); 201 goto send; 202 } 203 204 do { 205 if (conn->ops->check_user_session) { 206 rc = conn->ops->check_user_session(work); 207 if (rc < 0) { 208 if (rc == -EINVAL) 209 conn->ops->set_rsp_status(work, 210 STATUS_INVALID_PARAMETER); 211 else if (rc == -EKEYEXPIRED) 212 conn->ops->set_rsp_status(work, 213 STATUS_NETWORK_SESSION_EXPIRED); 214 else 215 conn->ops->set_rsp_status(work, 216 STATUS_USER_SESSION_DELETED); 217 if (conn->ops->is_sign_req(work, conn->ops->get_cmd_val(work))) { 218 struct smb2_hdr *rsp_hdr; 219 220 rsp_hdr = ksmbd_resp_buf_curr(work); 221 if (rc == -EKEYEXPIRED && work->sess && 222 conn->ops->set_sign_rsp) 223 conn->ops->set_sign_rsp(work); 224 else 225 rsp_hdr->Flags |= SMB2_FLAGS_SIGNED; 226 } 227 goto send; 228 } else if (rc > 0) { 229 rc = conn->ops->get_ksmbd_tcon(work); 230 if (rc < 0) { 231 if (rc == -EINVAL) 232 conn->ops->set_rsp_status(work, 233 STATUS_INVALID_PARAMETER); 234 else 235 conn->ops->set_rsp_status(work, 236 STATUS_NETWORK_NAME_DELETED); 237 goto send; 238 } 239 } 240 } 241 242 rc = __process_request(work, conn, &command); 243 if (rc == SERVER_HANDLER_ABORT) { 244 smb2_complete_request_open(work); 245 break; 246 } 247 248 /* 249 * Call smb2_set_rsp_credits() function to set number of credits 250 * granted in hdr of smb2 response. 251 */ 252 if (conn->ops->set_rsp_credits) { 253 spin_lock(&conn->credits_lock); 254 rc = conn->ops->set_rsp_credits(work); 255 spin_unlock(&conn->credits_lock); 256 if (rc < 0) { 257 conn->ops->set_rsp_status(work, 258 STATUS_INVALID_PARAMETER); 259 smb2_complete_request_open(work); 260 goto send; 261 } 262 } 263 264 smb2_complete_request_open(work); 265 266 is_chained = is_chained_smb2_message(work); 267 268 if (work->sess && 269 (work->sess->sign || smb3_11_final_sess_setup_resp(work) || 270 conn->ops->is_sign_req(work, command))) { 271 if (command == SMB2_SESSION_SETUP_HE && 272 work->sess->dialect >= SMB30_PROT_ID && 273 conn->dialect < SMB30_PROT_ID) 274 smb3_set_sign_rsp(work); 275 else 276 conn->ops->set_sign_rsp(work); 277 } 278 } while (is_chained == true); 279 280 send: 281 smb2_complete_request_open(work); 282 /* 283 * Release any credit charge still outstanding for this request. On 284 * the normal path smb2_set_rsp_credits() already returned it, but the 285 * abort, error and send-no-response paths skip that call, so the 286 * charge would otherwise leak and eventually exhaust the connection's 287 * outstanding credit window. 288 */ 289 if (work->credit_charge) { 290 spin_lock(&conn->credits_lock); 291 conn->outstanding_credits -= work->credit_charge; 292 work->credit_charge = 0; 293 spin_unlock(&conn->credits_lock); 294 } 295 296 if (work->tcon) 297 ksmbd_tree_connect_put(work->tcon); 298 smb3_preauth_hash_rsp(work); 299 /* 300 * Preauthentication hashes cover the original SMB2 response. Apply the 301 * transport compression wrapper only after updating the hash. 302 */ 303 if (work->compress_response) { 304 rc = ksmbd_compress_response(work); 305 if (rc < 0) 306 ksmbd_debug(CONN, "Failed to compress response: %d\n", rc); 307 } 308 if (work->sess && work->sess->enc && work->encrypted && 309 conn->ops->encrypt_resp) { 310 rc = conn->ops->encrypt_resp(work); 311 if (rc < 0) 312 conn->ops->set_rsp_status(work, STATUS_DATA_ERROR); 313 } 314 if (work->sess) 315 ksmbd_user_session_put(work->sess); 316 317 ksmbd_conn_write(work); 318 } 319 320 /** 321 * handle_ksmbd_work() - process pending smb work requests 322 * @wk: smb work containing request command buffer 323 * 324 * called by kworker threads to processing remaining smb work requests 325 */ 326 static void handle_ksmbd_work(struct work_struct *wk) 327 { 328 struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work); 329 struct ksmbd_conn *conn = work->conn; 330 331 atomic64_inc(&conn->stats.request_served); 332 333 __handle_ksmbd_work(work, conn); 334 335 ksmbd_conn_try_dequeue_request(work); 336 ksmbd_free_work_struct(work); 337 ksmbd_conn_r_count_dec(conn); 338 } 339 340 /** 341 * queue_ksmbd_work() - queue a smb request to worker thread queue 342 * for processing smb command and sending response 343 * @conn: connection instance 344 * 345 * read remaining data from socket create and submit work. 346 */ 347 static int queue_ksmbd_work(struct ksmbd_conn *conn) 348 { 349 struct ksmbd_work *work; 350 int err; 351 352 err = ksmbd_init_smb_server(conn); 353 if (err) 354 return 0; 355 356 work = ksmbd_alloc_work_struct(); 357 if (!work) { 358 pr_err("allocation for work failed\n"); 359 return -ENOMEM; 360 } 361 362 work->conn = conn; 363 work->request_buf = conn->request_buf; 364 conn->request_buf = NULL; 365 366 ksmbd_conn_enqueue_request(work); 367 ksmbd_conn_r_count_inc(conn); 368 /* update activity on connection */ 369 conn->last_active = jiffies; 370 INIT_WORK(&work->work, handle_ksmbd_work); 371 ksmbd_queue_work(work); 372 return 0; 373 } 374 375 static int ksmbd_server_process_request(struct ksmbd_conn *conn) 376 { 377 return queue_ksmbd_work(conn); 378 } 379 380 static int ksmbd_server_terminate_conn(struct ksmbd_conn *conn) 381 { 382 ksmbd_sessions_deregister(conn); 383 destroy_lease_table(conn); 384 return 0; 385 } 386 387 static void ksmbd_server_tcp_callbacks_init(void) 388 { 389 struct ksmbd_conn_ops ops; 390 391 ops.process_fn = ksmbd_server_process_request; 392 ops.terminate_fn = ksmbd_server_terminate_conn; 393 394 ksmbd_conn_init_server_callbacks(&ops); 395 } 396 397 static void server_conf_free(void) 398 { 399 int i; 400 401 for (i = 0; i < ARRAY_SIZE(server_conf.conf); i++) { 402 kfree(server_conf.conf[i]); 403 server_conf.conf[i] = NULL; 404 } 405 } 406 407 static int server_conf_init(void) 408 { 409 WRITE_ONCE(server_conf.state, SERVER_STATE_STARTING_UP); 410 server_conf.enforced_signing = 0; 411 server_conf.min_protocol = ksmbd_min_protocol(); 412 server_conf.max_protocol = ksmbd_max_protocol(); 413 server_conf.auth_mechs = KSMBD_AUTH_NTLMSSP; 414 #ifdef CONFIG_SMB_SERVER_KERBEROS5 415 server_conf.auth_mechs |= KSMBD_AUTH_KRB5 | 416 KSMBD_AUTH_MSKRB5; 417 #endif 418 server_conf.max_inflight_req = SMB2_MAX_CREDITS; 419 return 0; 420 } 421 422 static void server_ctrl_handle_init(struct server_ctrl_struct *ctrl) 423 { 424 int ret; 425 426 ksmbd_proc_reset(); 427 ret = ksmbd_conn_transport_init(); 428 if (ret) { 429 server_queue_ctrl_reset_work(); 430 return; 431 } 432 433 pr_info("running\n"); 434 WRITE_ONCE(server_conf.state, SERVER_STATE_RUNNING); 435 } 436 437 static void server_ctrl_handle_reset(struct server_ctrl_struct *ctrl) 438 { 439 ksmbd_ipc_soft_reset(); 440 ksmbd_conn_transport_destroy(); 441 ksmbd_stop_durable_scavenger(); 442 server_conf_free(); 443 server_conf_init(); 444 WRITE_ONCE(server_conf.state, SERVER_STATE_STARTING_UP); 445 } 446 447 static void server_ctrl_handle_work(struct work_struct *work) 448 { 449 struct server_ctrl_struct *ctrl; 450 451 ctrl = container_of(work, struct server_ctrl_struct, ctrl_work); 452 453 mutex_lock(&ctrl_lock); 454 switch (ctrl->type) { 455 case SERVER_CTRL_TYPE_INIT: 456 server_ctrl_handle_init(ctrl); 457 break; 458 case SERVER_CTRL_TYPE_RESET: 459 server_ctrl_handle_reset(ctrl); 460 break; 461 default: 462 pr_err("Unknown server work type: %d\n", ctrl->type); 463 } 464 mutex_unlock(&ctrl_lock); 465 kfree(ctrl); 466 module_put(THIS_MODULE); 467 } 468 469 static int __queue_ctrl_work(int type) 470 { 471 struct server_ctrl_struct *ctrl; 472 473 ctrl = kmalloc_obj(struct server_ctrl_struct, KSMBD_DEFAULT_GFP); 474 if (!ctrl) 475 return -ENOMEM; 476 477 __module_get(THIS_MODULE); 478 ctrl->type = type; 479 INIT_WORK(&ctrl->ctrl_work, server_ctrl_handle_work); 480 queue_work(system_long_wq, &ctrl->ctrl_work); 481 return 0; 482 } 483 484 int server_queue_ctrl_init_work(void) 485 { 486 return __queue_ctrl_work(SERVER_CTRL_TYPE_INIT); 487 } 488 489 int server_queue_ctrl_reset_work(void) 490 { 491 return __queue_ctrl_work(SERVER_CTRL_TYPE_RESET); 492 } 493 494 static ssize_t stats_show(const struct class *class, const struct class_attribute *attr, 495 char *buf) 496 { 497 /* 498 * Inc this each time you change stats output format, 499 * so user space will know what to do. 500 */ 501 static int stats_version = 2; 502 static const char * const state[] = { 503 "startup", 504 "running", 505 "reset", 506 "shutdown" 507 }; 508 return sysfs_emit(buf, "%d %s %d %lu\n", stats_version, 509 state[server_conf.state], server_conf.tcp_port, 510 server_conf.ipc_last_active / HZ); 511 } 512 513 static ssize_t kill_server_store(const struct class *class, 514 const struct class_attribute *attr, const char *buf, 515 size_t len) 516 { 517 if (!sysfs_streq(buf, "hard")) 518 return len; 519 520 pr_info("kill command received\n"); 521 mutex_lock(&ctrl_lock); 522 WRITE_ONCE(server_conf.state, SERVER_STATE_RESETTING); 523 __module_get(THIS_MODULE); 524 server_ctrl_handle_reset(NULL); 525 module_put(THIS_MODULE); 526 mutex_unlock(&ctrl_lock); 527 return len; 528 } 529 530 static const char * const debug_type_strings[] = {"smb", "auth", "vfs", 531 "oplock", "ipc", "conn", 532 "rdma"}; 533 534 static ssize_t debug_show(const struct class *class, const struct class_attribute *attr, 535 char *buf) 536 { 537 ssize_t sz = 0; 538 int i, pos = 0; 539 540 for (i = 0; i < ARRAY_SIZE(debug_type_strings); i++) { 541 if ((ksmbd_debug_types >> i) & 1) { 542 pos = sysfs_emit_at(buf, sz, "[%s] ", debug_type_strings[i]); 543 } else { 544 pos = sysfs_emit_at(buf, sz, "%s ", debug_type_strings[i]); 545 } 546 sz += pos; 547 } 548 sz += sysfs_emit_at(buf, sz, "\n"); 549 return sz; 550 } 551 552 static ssize_t debug_store(const struct class *class, const struct class_attribute *attr, 553 const char *buf, size_t len) 554 { 555 int i; 556 557 for (i = 0; i < ARRAY_SIZE(debug_type_strings); i++) { 558 if (sysfs_streq(buf, "all")) { 559 if (ksmbd_debug_types == KSMBD_DEBUG_ALL) 560 ksmbd_debug_types = 0; 561 else 562 ksmbd_debug_types = KSMBD_DEBUG_ALL; 563 break; 564 } 565 566 if (sysfs_streq(buf, debug_type_strings[i])) { 567 if (ksmbd_debug_types & (1 << i)) 568 ksmbd_debug_types &= ~(1 << i); 569 else 570 ksmbd_debug_types |= (1 << i); 571 break; 572 } 573 } 574 575 return len; 576 } 577 578 static CLASS_ATTR_RO(stats); 579 static CLASS_ATTR_WO(kill_server); 580 static CLASS_ATTR_RW(debug); 581 582 static struct attribute *ksmbd_control_class_attrs[] = { 583 &class_attr_stats.attr, 584 &class_attr_kill_server.attr, 585 &class_attr_debug.attr, 586 NULL, 587 }; 588 ATTRIBUTE_GROUPS(ksmbd_control_class); 589 590 static struct class ksmbd_control_class = { 591 .name = "ksmbd-control", 592 .class_groups = ksmbd_control_class_groups, 593 }; 594 595 static int ksmbd_server_shutdown(void) 596 { 597 WRITE_ONCE(server_conf.state, SERVER_STATE_SHUTTING_DOWN); 598 599 ksmbd_proc_cleanup(); 600 class_unregister(&ksmbd_control_class); 601 ksmbd_workqueue_destroy(); 602 ksmbd_ipc_release(); 603 ksmbd_conn_transport_destroy(); 604 ksmbd_crypto_destroy(); 605 ksmbd_free_global_file_table(); 606 destroy_lease_table(NULL); 607 ksmbd_work_pool_destroy(); 608 ksmbd_exit_file_cache(); 609 server_conf_free(); 610 return 0; 611 } 612 613 static int __init ksmbd_server_init(void) 614 { 615 int ret; 616 617 ret = class_register(&ksmbd_control_class); 618 if (ret) { 619 pr_err("Unable to register ksmbd-control class\n"); 620 return ret; 621 } 622 623 ksmbd_proc_init(); 624 create_proc_sessions(); 625 create_proc_shares(); 626 627 ksmbd_server_tcp_callbacks_init(); 628 629 ret = server_conf_init(); 630 if (ret) 631 goto err_unregister; 632 633 ret = ksmbd_work_pool_init(); 634 if (ret) 635 goto err_unregister; 636 637 ret = ksmbd_init_file_cache(); 638 if (ret) 639 goto err_destroy_work_pools; 640 641 ret = ksmbd_ipc_init(); 642 if (ret) 643 goto err_exit_file_cache; 644 645 ret = ksmbd_init_global_file_table(); 646 if (ret) 647 goto err_ipc_release; 648 649 ret = ksmbd_inode_hash_init(); 650 if (ret) 651 goto err_destroy_file_table; 652 653 ret = ksmbd_crypto_create(); 654 if (ret) 655 goto err_release_inode_hash; 656 657 ret = ksmbd_workqueue_init(); 658 if (ret) 659 goto err_crypto_destroy; 660 661 ret = ksmbd_conn_wq_init(); 662 if (ret) 663 goto err_workqueue_destroy; 664 665 return 0; 666 667 err_workqueue_destroy: 668 ksmbd_workqueue_destroy(); 669 err_crypto_destroy: 670 ksmbd_crypto_destroy(); 671 err_release_inode_hash: 672 ksmbd_release_inode_hash(); 673 err_destroy_file_table: 674 ksmbd_free_global_file_table(); 675 err_ipc_release: 676 ksmbd_ipc_release(); 677 err_exit_file_cache: 678 ksmbd_exit_file_cache(); 679 err_destroy_work_pools: 680 ksmbd_work_pool_destroy(); 681 err_unregister: 682 class_unregister(&ksmbd_control_class); 683 684 return ret; 685 } 686 687 /** 688 * ksmbd_server_exit() - shutdown forker thread and free memory at module exit 689 */ 690 static void __exit ksmbd_server_exit(void) 691 { 692 ksmbd_server_shutdown(); 693 rcu_barrier(); 694 /* 695 * ksmbd_conn_put() defers the final release onto ksmbd_conn_wq, 696 * so drain it after rcu_barrier() has fired any pending RCU 697 * callbacks that may have queued a release. 698 */ 699 ksmbd_conn_wq_destroy(); 700 ksmbd_release_inode_hash(); 701 } 702 703 MODULE_AUTHOR("Namjae Jeon <linkinjeon@kernel.org>"); 704 MODULE_DESCRIPTION("Linux kernel CIFS/SMB SERVER"); 705 MODULE_LICENSE("GPL"); 706 MODULE_SOFTDEP("pre: nls"); 707 MODULE_SOFTDEP("pre: aes"); 708 MODULE_SOFTDEP("pre: aead2"); 709 MODULE_SOFTDEP("pre: ccm"); 710 MODULE_SOFTDEP("pre: gcm"); 711 module_init(ksmbd_server_init) 712 module_exit(ksmbd_server_exit) 713