xref: /linux/fs/smb/server/server.c (revision 6af91e3d2cfc8bb579b1aa2d22cd91f8c34acdf6)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
4  *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
5  */
6 
7 #include "glob.h"
8 #include "oplock.h"
9 #include "misc.h"
10 #include <linux/sched/signal.h>
11 #include <linux/workqueue.h>
12 #include <linux/sysfs.h>
13 #include <linux/module.h>
14 #include <linux/moduleparam.h>
15 
16 #include "server.h"
17 #include "smb_common.h"
18 #include "smbstatus.h"
19 #include "connection.h"
20 #include "transport_ipc.h"
21 #include "mgmt/user_session.h"
22 #include "crypto_ctx.h"
23 #include "auth.h"
24 
25 int ksmbd_debug_types;
26 
27 struct ksmbd_server_config server_conf;
28 
29 enum SERVER_CTRL_TYPE {
30 	SERVER_CTRL_TYPE_INIT,
31 	SERVER_CTRL_TYPE_RESET,
32 };
33 
34 struct server_ctrl_struct {
35 	int			type;
36 	struct work_struct	ctrl_work;
37 };
38 
39 static DEFINE_MUTEX(ctrl_lock);
40 
41 static int ___server_conf_set(int idx, char *val)
42 {
43 	if (idx >= ARRAY_SIZE(server_conf.conf))
44 		return -EINVAL;
45 
46 	if (!val || val[0] == 0x00)
47 		return -EINVAL;
48 
49 	kfree(server_conf.conf[idx]);
50 	server_conf.conf[idx] = kstrdup(val, GFP_KERNEL);
51 	if (!server_conf.conf[idx])
52 		return -ENOMEM;
53 	return 0;
54 }
55 
56 int ksmbd_set_netbios_name(char *v)
57 {
58 	return ___server_conf_set(SERVER_CONF_NETBIOS_NAME, v);
59 }
60 
61 int ksmbd_set_server_string(char *v)
62 {
63 	return ___server_conf_set(SERVER_CONF_SERVER_STRING, v);
64 }
65 
66 int ksmbd_set_work_group(char *v)
67 {
68 	return ___server_conf_set(SERVER_CONF_WORK_GROUP, v);
69 }
70 
71 char *ksmbd_netbios_name(void)
72 {
73 	return server_conf.conf[SERVER_CONF_NETBIOS_NAME];
74 }
75 
76 char *ksmbd_server_string(void)
77 {
78 	return server_conf.conf[SERVER_CONF_SERVER_STRING];
79 }
80 
81 char *ksmbd_work_group(void)
82 {
83 	return server_conf.conf[SERVER_CONF_WORK_GROUP];
84 }
85 
86 /**
87  * check_conn_state() - check state of server thread connection
88  * @work:     smb work containing server thread information
89  *
90  * Return:	0 on valid connection, otherwise 1 to reconnect
91  */
92 static inline int check_conn_state(struct ksmbd_work *work)
93 {
94 	struct smb_hdr *rsp_hdr;
95 
96 	if (ksmbd_conn_exiting(work->conn) ||
97 	    ksmbd_conn_need_reconnect(work->conn)) {
98 		rsp_hdr = work->response_buf;
99 		rsp_hdr->Status.CifsError = STATUS_CONNECTION_DISCONNECTED;
100 		return 1;
101 	}
102 	return 0;
103 }
104 
105 #define SERVER_HANDLER_CONTINUE		0
106 #define SERVER_HANDLER_ABORT		1
107 
108 static int __process_request(struct ksmbd_work *work, struct ksmbd_conn *conn,
109 			     u16 *cmd)
110 {
111 	struct smb_version_cmds *cmds;
112 	u16 command;
113 	int ret;
114 
115 	if (check_conn_state(work))
116 		return SERVER_HANDLER_CONTINUE;
117 
118 	if (ksmbd_verify_smb_message(work)) {
119 		conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER);
120 		return SERVER_HANDLER_ABORT;
121 	}
122 
123 	command = conn->ops->get_cmd_val(work);
124 	*cmd = command;
125 
126 andx_again:
127 	if (command >= conn->max_cmds) {
128 		conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER);
129 		return SERVER_HANDLER_CONTINUE;
130 	}
131 
132 	cmds = &conn->cmds[command];
133 	if (!cmds->proc) {
134 		ksmbd_debug(SMB, "*** not implemented yet cmd = %x\n", command);
135 		conn->ops->set_rsp_status(work, STATUS_NOT_IMPLEMENTED);
136 		return SERVER_HANDLER_CONTINUE;
137 	}
138 
139 	if (work->sess && conn->ops->is_sign_req(work, command)) {
140 		ret = conn->ops->check_sign_req(work);
141 		if (!ret) {
142 			conn->ops->set_rsp_status(work, STATUS_ACCESS_DENIED);
143 			return SERVER_HANDLER_CONTINUE;
144 		}
145 	}
146 
147 	ret = cmds->proc(work);
148 
149 	if (ret < 0)
150 		ksmbd_debug(CONN, "Failed to process %u [%d]\n", command, ret);
151 	/* AndX commands - chained request can return positive values */
152 	else if (ret > 0) {
153 		command = ret;
154 		*cmd = command;
155 		goto andx_again;
156 	}
157 
158 	if (work->send_no_response)
159 		return SERVER_HANDLER_ABORT;
160 	return SERVER_HANDLER_CONTINUE;
161 }
162 
163 static void __handle_ksmbd_work(struct ksmbd_work *work,
164 				struct ksmbd_conn *conn)
165 {
166 	u16 command = 0;
167 	int rc;
168 	bool is_chained = false;
169 
170 	if (conn->ops->is_transform_hdr &&
171 	    conn->ops->is_transform_hdr(work->request_buf)) {
172 		rc = conn->ops->decrypt_req(work);
173 		if (rc < 0)
174 			return;
175 		work->encrypted = true;
176 	}
177 
178 	if (conn->ops->allocate_rsp_buf(work))
179 		return;
180 
181 	rc = conn->ops->init_rsp_hdr(work);
182 	if (rc) {
183 		/* either uid or tid is not correct */
184 		conn->ops->set_rsp_status(work, STATUS_INVALID_HANDLE);
185 		goto send;
186 	}
187 
188 	do {
189 		if (conn->ops->check_user_session) {
190 			rc = conn->ops->check_user_session(work);
191 			if (rc < 0) {
192 				if (rc == -EINVAL)
193 					conn->ops->set_rsp_status(work,
194 						STATUS_INVALID_PARAMETER);
195 				else
196 					conn->ops->set_rsp_status(work,
197 						STATUS_USER_SESSION_DELETED);
198 				goto send;
199 			} else if (rc > 0) {
200 				rc = conn->ops->get_ksmbd_tcon(work);
201 				if (rc < 0) {
202 					if (rc == -EINVAL)
203 						conn->ops->set_rsp_status(work,
204 							STATUS_INVALID_PARAMETER);
205 					else
206 						conn->ops->set_rsp_status(work,
207 							STATUS_NETWORK_NAME_DELETED);
208 					goto send;
209 				}
210 			}
211 		}
212 
213 		rc = __process_request(work, conn, &command);
214 		if (rc == SERVER_HANDLER_ABORT)
215 			break;
216 
217 		/*
218 		 * Call smb2_set_rsp_credits() function to set number of credits
219 		 * granted in hdr of smb2 response.
220 		 */
221 		if (conn->ops->set_rsp_credits) {
222 			spin_lock(&conn->credits_lock);
223 			rc = conn->ops->set_rsp_credits(work);
224 			spin_unlock(&conn->credits_lock);
225 			if (rc < 0) {
226 				conn->ops->set_rsp_status(work,
227 					STATUS_INVALID_PARAMETER);
228 				goto send;
229 			}
230 		}
231 
232 		is_chained = is_chained_smb2_message(work);
233 
234 		if (work->sess &&
235 		    (work->sess->sign || smb3_11_final_sess_setup_resp(work) ||
236 		     conn->ops->is_sign_req(work, command)))
237 			conn->ops->set_sign_rsp(work);
238 	} while (is_chained == true);
239 
240 send:
241 	if (work->tcon)
242 		ksmbd_tree_connect_put(work->tcon);
243 	smb3_preauth_hash_rsp(work);
244 	if (work->sess && work->sess->enc && work->encrypted &&
245 	    conn->ops->encrypt_resp) {
246 		rc = conn->ops->encrypt_resp(work);
247 		if (rc < 0)
248 			conn->ops->set_rsp_status(work, STATUS_DATA_ERROR);
249 	}
250 
251 	ksmbd_conn_write(work);
252 }
253 
254 /**
255  * handle_ksmbd_work() - process pending smb work requests
256  * @wk:	smb work containing request command buffer
257  *
258  * called by kworker threads to processing remaining smb work requests
259  */
260 static void handle_ksmbd_work(struct work_struct *wk)
261 {
262 	struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work);
263 	struct ksmbd_conn *conn = work->conn;
264 
265 	atomic64_inc(&conn->stats.request_served);
266 
267 	__handle_ksmbd_work(work, conn);
268 
269 	ksmbd_conn_try_dequeue_request(work);
270 	ksmbd_free_work_struct(work);
271 	/*
272 	 * Checking waitqueue to dropping pending requests on
273 	 * disconnection. waitqueue_active is safe because it
274 	 * uses atomic operation for condition.
275 	 */
276 	if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q))
277 		wake_up(&conn->r_count_q);
278 }
279 
280 /**
281  * queue_ksmbd_work() - queue a smb request to worker thread queue
282  *		for proccessing smb command and sending response
283  * @conn:	connection instance
284  *
285  * read remaining data from socket create and submit work.
286  */
287 static int queue_ksmbd_work(struct ksmbd_conn *conn)
288 {
289 	struct ksmbd_work *work;
290 	int err;
291 
292 	work = ksmbd_alloc_work_struct();
293 	if (!work) {
294 		pr_err("allocation for work failed\n");
295 		return -ENOMEM;
296 	}
297 
298 	work->conn = conn;
299 	work->request_buf = conn->request_buf;
300 	conn->request_buf = NULL;
301 
302 	err = ksmbd_init_smb_server(work);
303 	if (err) {
304 		ksmbd_free_work_struct(work);
305 		return 0;
306 	}
307 
308 	ksmbd_conn_enqueue_request(work);
309 	atomic_inc(&conn->r_count);
310 	/* update activity on connection */
311 	conn->last_active = jiffies;
312 	INIT_WORK(&work->work, handle_ksmbd_work);
313 	ksmbd_queue_work(work);
314 	return 0;
315 }
316 
317 static int ksmbd_server_process_request(struct ksmbd_conn *conn)
318 {
319 	return queue_ksmbd_work(conn);
320 }
321 
322 static int ksmbd_server_terminate_conn(struct ksmbd_conn *conn)
323 {
324 	ksmbd_sessions_deregister(conn);
325 	destroy_lease_table(conn);
326 	return 0;
327 }
328 
329 static void ksmbd_server_tcp_callbacks_init(void)
330 {
331 	struct ksmbd_conn_ops ops;
332 
333 	ops.process_fn = ksmbd_server_process_request;
334 	ops.terminate_fn = ksmbd_server_terminate_conn;
335 
336 	ksmbd_conn_init_server_callbacks(&ops);
337 }
338 
339 static void server_conf_free(void)
340 {
341 	int i;
342 
343 	for (i = 0; i < ARRAY_SIZE(server_conf.conf); i++) {
344 		kfree(server_conf.conf[i]);
345 		server_conf.conf[i] = NULL;
346 	}
347 }
348 
349 static int server_conf_init(void)
350 {
351 	WRITE_ONCE(server_conf.state, SERVER_STATE_STARTING_UP);
352 	server_conf.enforced_signing = 0;
353 	server_conf.min_protocol = ksmbd_min_protocol();
354 	server_conf.max_protocol = ksmbd_max_protocol();
355 	server_conf.auth_mechs = KSMBD_AUTH_NTLMSSP;
356 #ifdef CONFIG_SMB_SERVER_KERBEROS5
357 	server_conf.auth_mechs |= KSMBD_AUTH_KRB5 |
358 				KSMBD_AUTH_MSKRB5;
359 #endif
360 	return 0;
361 }
362 
363 static void server_ctrl_handle_init(struct server_ctrl_struct *ctrl)
364 {
365 	int ret;
366 
367 	ret = ksmbd_conn_transport_init();
368 	if (ret) {
369 		server_queue_ctrl_reset_work();
370 		return;
371 	}
372 
373 	WRITE_ONCE(server_conf.state, SERVER_STATE_RUNNING);
374 }
375 
376 static void server_ctrl_handle_reset(struct server_ctrl_struct *ctrl)
377 {
378 	ksmbd_ipc_soft_reset();
379 	ksmbd_conn_transport_destroy();
380 	ksmbd_stop_durable_scavenger();
381 	server_conf_free();
382 	server_conf_init();
383 	WRITE_ONCE(server_conf.state, SERVER_STATE_STARTING_UP);
384 }
385 
386 static void server_ctrl_handle_work(struct work_struct *work)
387 {
388 	struct server_ctrl_struct *ctrl;
389 
390 	ctrl = container_of(work, struct server_ctrl_struct, ctrl_work);
391 
392 	mutex_lock(&ctrl_lock);
393 	switch (ctrl->type) {
394 	case SERVER_CTRL_TYPE_INIT:
395 		server_ctrl_handle_init(ctrl);
396 		break;
397 	case SERVER_CTRL_TYPE_RESET:
398 		server_ctrl_handle_reset(ctrl);
399 		break;
400 	default:
401 		pr_err("Unknown server work type: %d\n", ctrl->type);
402 	}
403 	mutex_unlock(&ctrl_lock);
404 	kfree(ctrl);
405 	module_put(THIS_MODULE);
406 }
407 
408 static int __queue_ctrl_work(int type)
409 {
410 	struct server_ctrl_struct *ctrl;
411 
412 	ctrl = kmalloc(sizeof(struct server_ctrl_struct), GFP_KERNEL);
413 	if (!ctrl)
414 		return -ENOMEM;
415 
416 	__module_get(THIS_MODULE);
417 	ctrl->type = type;
418 	INIT_WORK(&ctrl->ctrl_work, server_ctrl_handle_work);
419 	queue_work(system_long_wq, &ctrl->ctrl_work);
420 	return 0;
421 }
422 
423 int server_queue_ctrl_init_work(void)
424 {
425 	return __queue_ctrl_work(SERVER_CTRL_TYPE_INIT);
426 }
427 
428 int server_queue_ctrl_reset_work(void)
429 {
430 	return __queue_ctrl_work(SERVER_CTRL_TYPE_RESET);
431 }
432 
433 static ssize_t stats_show(const struct class *class, const struct class_attribute *attr,
434 			  char *buf)
435 {
436 	/*
437 	 * Inc this each time you change stats output format,
438 	 * so user space will know what to do.
439 	 */
440 	static int stats_version = 2;
441 	static const char * const state[] = {
442 		"startup",
443 		"running",
444 		"reset",
445 		"shutdown"
446 	};
447 	return sysfs_emit(buf, "%d %s %d %lu\n", stats_version,
448 			  state[server_conf.state], server_conf.tcp_port,
449 			  server_conf.ipc_last_active / HZ);
450 }
451 
452 static ssize_t kill_server_store(const struct class *class,
453 				 const struct class_attribute *attr, const char *buf,
454 				 size_t len)
455 {
456 	if (!sysfs_streq(buf, "hard"))
457 		return len;
458 
459 	pr_info("kill command received\n");
460 	mutex_lock(&ctrl_lock);
461 	WRITE_ONCE(server_conf.state, SERVER_STATE_RESETTING);
462 	__module_get(THIS_MODULE);
463 	server_ctrl_handle_reset(NULL);
464 	module_put(THIS_MODULE);
465 	mutex_unlock(&ctrl_lock);
466 	return len;
467 }
468 
469 static const char * const debug_type_strings[] = {"smb", "auth", "vfs",
470 						  "oplock", "ipc", "conn",
471 						  "rdma"};
472 
473 static ssize_t debug_show(const struct class *class, const struct class_attribute *attr,
474 			  char *buf)
475 {
476 	ssize_t sz = 0;
477 	int i, pos = 0;
478 
479 	for (i = 0; i < ARRAY_SIZE(debug_type_strings); i++) {
480 		if ((ksmbd_debug_types >> i) & 1) {
481 			pos = sysfs_emit_at(buf, sz, "[%s] ", debug_type_strings[i]);
482 		} else {
483 			pos = sysfs_emit_at(buf, sz, "%s ", debug_type_strings[i]);
484 		}
485 		sz += pos;
486 	}
487 	sz += sysfs_emit_at(buf, sz, "\n");
488 	return sz;
489 }
490 
491 static ssize_t debug_store(const struct class *class, const struct class_attribute *attr,
492 			   const char *buf, size_t len)
493 {
494 	int i;
495 
496 	for (i = 0; i < ARRAY_SIZE(debug_type_strings); i++) {
497 		if (sysfs_streq(buf, "all")) {
498 			if (ksmbd_debug_types == KSMBD_DEBUG_ALL)
499 				ksmbd_debug_types = 0;
500 			else
501 				ksmbd_debug_types = KSMBD_DEBUG_ALL;
502 			break;
503 		}
504 
505 		if (sysfs_streq(buf, debug_type_strings[i])) {
506 			if (ksmbd_debug_types & (1 << i))
507 				ksmbd_debug_types &= ~(1 << i);
508 			else
509 				ksmbd_debug_types |= (1 << i);
510 			break;
511 		}
512 	}
513 
514 	return len;
515 }
516 
517 static CLASS_ATTR_RO(stats);
518 static CLASS_ATTR_WO(kill_server);
519 static CLASS_ATTR_RW(debug);
520 
521 static struct attribute *ksmbd_control_class_attrs[] = {
522 	&class_attr_stats.attr,
523 	&class_attr_kill_server.attr,
524 	&class_attr_debug.attr,
525 	NULL,
526 };
527 ATTRIBUTE_GROUPS(ksmbd_control_class);
528 
529 static struct class ksmbd_control_class = {
530 	.name		= "ksmbd-control",
531 	.class_groups	= ksmbd_control_class_groups,
532 };
533 
534 static int ksmbd_server_shutdown(void)
535 {
536 	WRITE_ONCE(server_conf.state, SERVER_STATE_SHUTTING_DOWN);
537 
538 	class_unregister(&ksmbd_control_class);
539 	ksmbd_workqueue_destroy();
540 	ksmbd_ipc_release();
541 	ksmbd_conn_transport_destroy();
542 	ksmbd_crypto_destroy();
543 	ksmbd_free_global_file_table();
544 	destroy_lease_table(NULL);
545 	ksmbd_work_pool_destroy();
546 	ksmbd_exit_file_cache();
547 	server_conf_free();
548 	return 0;
549 }
550 
551 static int __init ksmbd_server_init(void)
552 {
553 	int ret;
554 
555 	ret = class_register(&ksmbd_control_class);
556 	if (ret) {
557 		pr_err("Unable to register ksmbd-control class\n");
558 		return ret;
559 	}
560 
561 	ksmbd_server_tcp_callbacks_init();
562 
563 	ret = server_conf_init();
564 	if (ret)
565 		goto err_unregister;
566 
567 	ret = ksmbd_work_pool_init();
568 	if (ret)
569 		goto err_unregister;
570 
571 	ret = ksmbd_init_file_cache();
572 	if (ret)
573 		goto err_destroy_work_pools;
574 
575 	ret = ksmbd_ipc_init();
576 	if (ret)
577 		goto err_exit_file_cache;
578 
579 	ret = ksmbd_init_global_file_table();
580 	if (ret)
581 		goto err_ipc_release;
582 
583 	ret = ksmbd_inode_hash_init();
584 	if (ret)
585 		goto err_destroy_file_table;
586 
587 	ret = ksmbd_crypto_create();
588 	if (ret)
589 		goto err_release_inode_hash;
590 
591 	ret = ksmbd_workqueue_init();
592 	if (ret)
593 		goto err_crypto_destroy;
594 
595 	return 0;
596 
597 err_crypto_destroy:
598 	ksmbd_crypto_destroy();
599 err_release_inode_hash:
600 	ksmbd_release_inode_hash();
601 err_destroy_file_table:
602 	ksmbd_free_global_file_table();
603 err_ipc_release:
604 	ksmbd_ipc_release();
605 err_exit_file_cache:
606 	ksmbd_exit_file_cache();
607 err_destroy_work_pools:
608 	ksmbd_work_pool_destroy();
609 err_unregister:
610 	class_unregister(&ksmbd_control_class);
611 
612 	return ret;
613 }
614 
615 /**
616  * ksmbd_server_exit() - shutdown forker thread and free memory at module exit
617  */
618 static void __exit ksmbd_server_exit(void)
619 {
620 	ksmbd_server_shutdown();
621 	rcu_barrier();
622 	ksmbd_release_inode_hash();
623 }
624 
625 MODULE_AUTHOR("Namjae Jeon <linkinjeon@kernel.org>");
626 MODULE_DESCRIPTION("Linux kernel CIFS/SMB SERVER");
627 MODULE_LICENSE("GPL");
628 MODULE_SOFTDEP("pre: ecb");
629 MODULE_SOFTDEP("pre: hmac");
630 MODULE_SOFTDEP("pre: md5");
631 MODULE_SOFTDEP("pre: nls");
632 MODULE_SOFTDEP("pre: aes");
633 MODULE_SOFTDEP("pre: cmac");
634 MODULE_SOFTDEP("pre: sha256");
635 MODULE_SOFTDEP("pre: sha512");
636 MODULE_SOFTDEP("pre: aead2");
637 MODULE_SOFTDEP("pre: ccm");
638 MODULE_SOFTDEP("pre: gcm");
639 MODULE_SOFTDEP("pre: crc32");
640 module_init(ksmbd_server_init)
641 module_exit(ksmbd_server_exit)
642