1// SPDX-License-Identifier: GPL-2.0-or-later 2/* 3 * Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org> 4 * Copyright (C) 2018 Samsung Electronics Co., Ltd. 5 */ 6 7#include "glob.h" 8#include "oplock.h" 9#include "misc.h" 10#include <linux/sched/signal.h> 11#include <linux/workqueue.h> 12#include <linux/sysfs.h> 13#include <linux/module.h> 14#include <linux/moduleparam.h> 15 16#include "server.h" 17#include "smb_common.h" 18#include "smbstatus.h" 19#include "connection.h" 20#include "transport_ipc.h" 21#include "mgmt/user_session.h" 22#include "crypto_ctx.h" 23#include "auth.h" 24 25int ksmbd_debug_types; 26 27struct ksmbd_server_config server_conf; 28 29enum SERVER_CTRL_TYPE { 30 SERVER_CTRL_TYPE_INIT, 31 SERVER_CTRL_TYPE_RESET, 32}; 33 34struct server_ctrl_struct { 35 int type; 36 struct work_struct ctrl_work; 37}; 38 39static DEFINE_MUTEX(ctrl_lock); 40 41static int ___server_conf_set(int idx, char *val) 42{ 43 if (idx >= ARRAY_SIZE(server_conf.conf)) 44 return -EINVAL; 45 46 if (!val || val[0] == 0x00) 47 return -EINVAL; 48 49 kfree(server_conf.conf[idx]); 50 server_conf.conf[idx] = kstrdup(val, GFP_KERNEL); 51 if (!server_conf.conf[idx]) 52 return -ENOMEM; 53 return 0; 54} 55 56int ksmbd_set_netbios_name(char *v) 57{ 58 return ___server_conf_set(SERVER_CONF_NETBIOS_NAME, v); 59} 60 61int ksmbd_set_server_string(char *v) 62{ 63 return ___server_conf_set(SERVER_CONF_SERVER_STRING, v); 64} 65 66int ksmbd_set_work_group(char *v) 67{ 68 return ___server_conf_set(SERVER_CONF_WORK_GROUP, v); 69} 70 71char *ksmbd_netbios_name(void) 72{ 73 return server_conf.conf[SERVER_CONF_NETBIOS_NAME]; 74} 75 76char *ksmbd_server_string(void) 77{ 78 return server_conf.conf[SERVER_CONF_SERVER_STRING]; 79} 80 81char *ksmbd_work_group(void) 82{ 83 return server_conf.conf[SERVER_CONF_WORK_GROUP]; 84} 85 86/** 87 * check_conn_state() - check state of server thread connection 88 * @work: smb work containing server thread information 89 * 90 * Return: 0 on valid connection, otherwise 1 to reconnect 91 */ 92static inline int check_conn_state(struct ksmbd_work *work) 93{ 94 struct smb_hdr *rsp_hdr; 95 96 if (ksmbd_conn_exiting(work->conn) || 97 ksmbd_conn_need_reconnect(work->conn)) { 98 rsp_hdr = work->response_buf; 99 rsp_hdr->Status.CifsError = STATUS_CONNECTION_DISCONNECTED; 100 return 1; 101 } 102 return 0; 103} 104 105#define SERVER_HANDLER_CONTINUE 0 106#define SERVER_HANDLER_ABORT 1 107 108static int __process_request(struct ksmbd_work *work, struct ksmbd_conn *conn, 109 u16 *cmd) 110{ 111 struct smb_version_cmds *cmds; 112 u16 command; 113 int ret; 114 115 if (check_conn_state(work)) 116 return SERVER_HANDLER_CONTINUE; 117 118 if (ksmbd_verify_smb_message(work)) { 119 conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER); 120 return SERVER_HANDLER_ABORT; 121 } 122 123 command = conn->ops->get_cmd_val(work); 124 *cmd = command; 125 126andx_again: 127 if (command >= conn->max_cmds) { 128 conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER); 129 return SERVER_HANDLER_CONTINUE; 130 } 131 132 cmds = &conn->cmds[command]; 133 if (!cmds->proc) { 134 ksmbd_debug(SMB, "*** not implemented yet cmd = %x\n", command); 135 conn->ops->set_rsp_status(work, STATUS_NOT_IMPLEMENTED); 136 return SERVER_HANDLER_CONTINUE; 137 } 138 139 if (work->sess && conn->ops->is_sign_req(work, command)) { 140 ret = conn->ops->check_sign_req(work); 141 if (!ret) { 142 conn->ops->set_rsp_status(work, STATUS_ACCESS_DENIED); 143 return SERVER_HANDLER_CONTINUE; 144 } 145 } 146 147 ret = cmds->proc(work); 148 149 if (ret < 0) 150 ksmbd_debug(CONN, "Failed to process %u [%d]\n", command, ret); 151 /* AndX commands - chained request can return positive values */ 152 else if (ret > 0) { 153 command = ret; 154 *cmd = command; 155 goto andx_again; 156 } 157 158 if (work->send_no_response) 159 return SERVER_HANDLER_ABORT; 160 return SERVER_HANDLER_CONTINUE; 161} 162 163static void __handle_ksmbd_work(struct ksmbd_work *work, 164 struct ksmbd_conn *conn) 165{ 166 u16 command = 0; 167 int rc; 168 bool is_chained = false; 169 170 if (conn->ops->allocate_rsp_buf(work)) 171 return; 172 173 if (conn->ops->is_transform_hdr && 174 conn->ops->is_transform_hdr(work->request_buf)) { 175 rc = conn->ops->decrypt_req(work); 176 if (rc < 0) { 177 conn->ops->set_rsp_status(work, STATUS_DATA_ERROR); 178 goto send; 179 } 180 181 work->encrypted = true; 182 } 183 184 rc = conn->ops->init_rsp_hdr(work); 185 if (rc) { 186 /* either uid or tid is not correct */ 187 conn->ops->set_rsp_status(work, STATUS_INVALID_HANDLE); 188 goto send; 189 } 190 191 do { 192 if (conn->ops->check_user_session) { 193 rc = conn->ops->check_user_session(work); 194 if (rc < 0) { 195 if (rc == -EINVAL) 196 conn->ops->set_rsp_status(work, 197 STATUS_INVALID_PARAMETER); 198 else 199 conn->ops->set_rsp_status(work, 200 STATUS_USER_SESSION_DELETED); 201 goto send; 202 } else if (rc > 0) { 203 rc = conn->ops->get_ksmbd_tcon(work); 204 if (rc < 0) { 205 if (rc == -EINVAL) 206 conn->ops->set_rsp_status(work, 207 STATUS_INVALID_PARAMETER); 208 else 209 conn->ops->set_rsp_status(work, 210 STATUS_NETWORK_NAME_DELETED); 211 goto send; 212 } 213 } 214 } 215 216 rc = __process_request(work, conn, &command); 217 if (rc == SERVER_HANDLER_ABORT) 218 break; 219 220 /* 221 * Call smb2_set_rsp_credits() function to set number of credits 222 * granted in hdr of smb2 response. 223 */ 224 if (conn->ops->set_rsp_credits) { 225 spin_lock(&conn->credits_lock); 226 rc = conn->ops->set_rsp_credits(work); 227 spin_unlock(&conn->credits_lock); 228 if (rc < 0) { 229 conn->ops->set_rsp_status(work, 230 STATUS_INVALID_PARAMETER); 231 goto send; 232 } 233 } 234 235 is_chained = is_chained_smb2_message(work); 236 237 if (work->sess && 238 (work->sess->sign || smb3_11_final_sess_setup_resp(work) || 239 conn->ops->is_sign_req(work, command))) 240 conn->ops->set_sign_rsp(work); 241 } while (is_chained == true); 242 243send: 244 if (work->tcon) 245 ksmbd_tree_connect_put(work->tcon); 246 smb3_preauth_hash_rsp(work); 247 if (work->sess && work->sess->enc && work->encrypted && 248 conn->ops->encrypt_resp) { 249 rc = conn->ops->encrypt_resp(work); 250 if (rc < 0) 251 conn->ops->set_rsp_status(work, STATUS_DATA_ERROR); 252 } 253 254 ksmbd_conn_write(work); 255} 256 257/** 258 * handle_ksmbd_work() - process pending smb work requests 259 * @wk: smb work containing request command buffer 260 * 261 * called by kworker threads to processing remaining smb work requests 262 */ 263static void handle_ksmbd_work(struct work_struct *wk) 264{ 265 struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work); 266 struct ksmbd_conn *conn = work->conn; 267 268 atomic64_inc(&conn->stats.request_served); 269 270 __handle_ksmbd_work(work, conn); 271 272 ksmbd_conn_try_dequeue_request(work); 273 ksmbd_free_work_struct(work); 274 /* 275 * Checking waitqueue to dropping pending requests on 276 * disconnection. waitqueue_active is safe because it 277 * uses atomic operation for condition. 278 */ 279 if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q)) 280 wake_up(&conn->r_count_q); 281} 282 283/** 284 * queue_ksmbd_work() - queue a smb request to worker thread queue 285 * for proccessing smb command and sending response 286 * @conn: connection instance 287 * 288 * read remaining data from socket create and submit work. 289 */ 290static int queue_ksmbd_work(struct ksmbd_conn *conn) 291{ 292 struct ksmbd_work *work; 293 int err; 294 295 work = ksmbd_alloc_work_struct(); 296 if (!work) { 297 pr_err("allocation for work failed\n"); 298 return -ENOMEM; 299 } 300 301 work->conn = conn; 302 work->request_buf = conn->request_buf; 303 conn->request_buf = NULL; 304 305 err = ksmbd_init_smb_server(work); 306 if (err) { 307 ksmbd_free_work_struct(work); 308 return 0; 309 } 310 311 ksmbd_conn_enqueue_request(work); 312 atomic_inc(&conn->r_count); 313 /* update activity on connection */ 314 conn->last_active = jiffies; 315 INIT_WORK(&work->work, handle_ksmbd_work); 316 ksmbd_queue_work(work); 317 return 0; 318} 319 320static int ksmbd_server_process_request(struct ksmbd_conn *conn) 321{ 322 return queue_ksmbd_work(conn); 323} 324 325static int ksmbd_server_terminate_conn(struct ksmbd_conn *conn) 326{ 327 ksmbd_sessions_deregister(conn); 328 destroy_lease_table(conn); 329 return 0; 330} 331 332static void ksmbd_server_tcp_callbacks_init(void) 333{ 334 struct ksmbd_conn_ops ops; 335 336 ops.process_fn = ksmbd_server_process_request; 337 ops.terminate_fn = ksmbd_server_terminate_conn; 338 339 ksmbd_conn_init_server_callbacks(&ops); 340} 341 342static void server_conf_free(void) 343{ 344 int i; 345 346 for (i = 0; i < ARRAY_SIZE(server_conf.conf); i++) { 347 kfree(server_conf.conf[i]); 348 server_conf.conf[i] = NULL; 349 } 350} 351 352static int server_conf_init(void) 353{ 354 WRITE_ONCE(server_conf.state, SERVER_STATE_STARTING_UP); 355 server_conf.enforced_signing = 0; 356 server_conf.min_protocol = ksmbd_min_protocol(); 357 server_conf.max_protocol = ksmbd_max_protocol(); 358 server_conf.auth_mechs = KSMBD_AUTH_NTLMSSP; 359#ifdef CONFIG_SMB_SERVER_KERBEROS5 360 server_conf.auth_mechs |= KSMBD_AUTH_KRB5 | 361 KSMBD_AUTH_MSKRB5; 362#endif 363 return 0; 364} 365 366static void server_ctrl_handle_init(struct server_ctrl_struct *ctrl) 367{ 368 int ret; 369 370 ret = ksmbd_conn_transport_init(); 371 if (ret) { 372 server_queue_ctrl_reset_work(); 373 return; 374 } 375 376 WRITE_ONCE(server_conf.state, SERVER_STATE_RUNNING); 377} 378 379static void server_ctrl_handle_reset(struct server_ctrl_struct *ctrl) 380{ 381 ksmbd_ipc_soft_reset(); 382 ksmbd_conn_transport_destroy(); 383 server_conf_free(); 384 server_conf_init(); 385 WRITE_ONCE(server_conf.state, SERVER_STATE_STARTING_UP); 386} 387 388static void server_ctrl_handle_work(struct work_struct *work) 389{ 390 struct server_ctrl_struct *ctrl; 391 392 ctrl = container_of(work, struct server_ctrl_struct, ctrl_work); 393 394 mutex_lock(&ctrl_lock); 395 switch (ctrl->type) { 396 case SERVER_CTRL_TYPE_INIT: 397 server_ctrl_handle_init(ctrl); 398 break; 399 case SERVER_CTRL_TYPE_RESET: 400 server_ctrl_handle_reset(ctrl); 401 break; 402 default: 403 pr_err("Unknown server work type: %d\n", ctrl->type); 404 } 405 mutex_unlock(&ctrl_lock); 406 kfree(ctrl); 407 module_put(THIS_MODULE); 408} 409 410static int __queue_ctrl_work(int type) 411{ 412 struct server_ctrl_struct *ctrl; 413 414 ctrl = kmalloc(sizeof(struct server_ctrl_struct), GFP_KERNEL); 415 if (!ctrl) 416 return -ENOMEM; 417 418 __module_get(THIS_MODULE); 419 ctrl->type = type; 420 INIT_WORK(&ctrl->ctrl_work, server_ctrl_handle_work); 421 queue_work(system_long_wq, &ctrl->ctrl_work); 422 return 0; 423} 424 425int server_queue_ctrl_init_work(void) 426{ 427 return __queue_ctrl_work(SERVER_CTRL_TYPE_INIT); 428} 429 430int server_queue_ctrl_reset_work(void) 431{ 432 return __queue_ctrl_work(SERVER_CTRL_TYPE_RESET); 433} 434 435static ssize_t stats_show(const struct class *class, const struct class_attribute *attr, 436 char *buf) 437{ 438 /* 439 * Inc this each time you change stats output format, 440 * so user space will know what to do. 441 */ 442 static int stats_version = 2; 443 static const char * const state[] = { 444 "startup", 445 "running", 446 "reset", 447 "shutdown" 448 }; 449 return sysfs_emit(buf, "%d %s %d %lu\n", stats_version, 450 state[server_conf.state], server_conf.tcp_port, 451 server_conf.ipc_last_active / HZ); 452} 453 454static ssize_t kill_server_store(const struct class *class, 455 const struct class_attribute *attr, const char *buf, 456 size_t len) 457{ 458 if (!sysfs_streq(buf, "hard")) 459 return len; 460 461 pr_info("kill command received\n"); 462 mutex_lock(&ctrl_lock); 463 WRITE_ONCE(server_conf.state, SERVER_STATE_RESETTING); 464 __module_get(THIS_MODULE); 465 server_ctrl_handle_reset(NULL); 466 module_put(THIS_MODULE); 467 mutex_unlock(&ctrl_lock); 468 return len; 469} 470 471static const char * const debug_type_strings[] = {"smb", "auth", "vfs", 472 "oplock", "ipc", "conn", 473 "rdma"}; 474 475static ssize_t debug_show(const struct class *class, const struct class_attribute *attr, 476 char *buf) 477{ 478 ssize_t sz = 0; 479 int i, pos = 0; 480 481 for (i = 0; i < ARRAY_SIZE(debug_type_strings); i++) { 482 if ((ksmbd_debug_types >> i) & 1) { 483 pos = sysfs_emit_at(buf, sz, "[%s] ", debug_type_strings[i]); 484 } else { 485 pos = sysfs_emit_at(buf, sz, "%s ", debug_type_strings[i]); 486 } 487 sz += pos; 488 } 489 sz += sysfs_emit_at(buf, sz, "\n"); 490 return sz; 491} 492 493static ssize_t debug_store(const struct class *class, const struct class_attribute *attr, 494 const char *buf, size_t len) 495{ 496 int i; 497 498 for (i = 0; i < ARRAY_SIZE(debug_type_strings); i++) { 499 if (sysfs_streq(buf, "all")) { 500 if (ksmbd_debug_types == KSMBD_DEBUG_ALL) 501 ksmbd_debug_types = 0; 502 else 503 ksmbd_debug_types = KSMBD_DEBUG_ALL; 504 break; 505 } 506 507 if (sysfs_streq(buf, debug_type_strings[i])) { 508 if (ksmbd_debug_types & (1 << i)) 509 ksmbd_debug_types &= ~(1 << i); 510 else 511 ksmbd_debug_types |= (1 << i); 512 break; 513 } 514 } 515 516 return len; 517} 518 519static CLASS_ATTR_RO(stats); 520static CLASS_ATTR_WO(kill_server); 521static CLASS_ATTR_RW(debug); 522 523static struct attribute *ksmbd_control_class_attrs[] = { 524 &class_attr_stats.attr, 525 &class_attr_kill_server.attr, 526 &class_attr_debug.attr, 527 NULL, 528}; 529ATTRIBUTE_GROUPS(ksmbd_control_class); 530 531static struct class ksmbd_control_class = { 532 .name = "ksmbd-control", 533 .class_groups = ksmbd_control_class_groups, 534}; 535 536static int ksmbd_server_shutdown(void) 537{ 538 WRITE_ONCE(server_conf.state, SERVER_STATE_SHUTTING_DOWN); 539 540 class_unregister(&ksmbd_control_class); 541 ksmbd_workqueue_destroy(); 542 ksmbd_ipc_release(); 543 ksmbd_conn_transport_destroy(); 544 ksmbd_crypto_destroy(); 545 ksmbd_free_global_file_table(); 546 destroy_lease_table(NULL); 547 ksmbd_work_pool_destroy(); 548 ksmbd_exit_file_cache(); 549 server_conf_free(); 550 return 0; 551} 552 553static int __init ksmbd_server_init(void) 554{ 555 int ret; 556 557 ret = class_register(&ksmbd_control_class); 558 if (ret) { 559 pr_err("Unable to register ksmbd-control class\n"); 560 return ret; 561 } 562 563 ksmbd_server_tcp_callbacks_init(); 564 565 ret = server_conf_init(); 566 if (ret) 567 goto err_unregister; 568 569 ret = ksmbd_work_pool_init(); 570 if (ret) 571 goto err_unregister; 572 573 ret = ksmbd_init_file_cache(); 574 if (ret) 575 goto err_destroy_work_pools; 576 577 ret = ksmbd_ipc_init(); 578 if (ret) 579 goto err_exit_file_cache; 580 581 ret = ksmbd_init_global_file_table(); 582 if (ret) 583 goto err_ipc_release; 584 585 ret = ksmbd_inode_hash_init(); 586 if (ret) 587 goto err_destroy_file_table; 588 589 ret = ksmbd_crypto_create(); 590 if (ret) 591 goto err_release_inode_hash; 592 593 ret = ksmbd_workqueue_init(); 594 if (ret) 595 goto err_crypto_destroy; 596 597 return 0; 598 599err_crypto_destroy: 600 ksmbd_crypto_destroy(); 601err_release_inode_hash: 602 ksmbd_release_inode_hash(); 603err_destroy_file_table: 604 ksmbd_free_global_file_table(); 605err_ipc_release: 606 ksmbd_ipc_release(); 607err_exit_file_cache: 608 ksmbd_exit_file_cache(); 609err_destroy_work_pools: 610 ksmbd_work_pool_destroy(); 611err_unregister: 612 class_unregister(&ksmbd_control_class); 613 614 return ret; 615} 616 617/** 618 * ksmbd_server_exit() - shutdown forker thread and free memory at module exit 619 */ 620static void __exit ksmbd_server_exit(void) 621{ 622 ksmbd_server_shutdown(); 623 rcu_barrier(); 624 ksmbd_release_inode_hash(); 625} 626 627MODULE_AUTHOR("Namjae Jeon <linkinjeon@kernel.org>"); 628MODULE_VERSION(KSMBD_VERSION); 629MODULE_DESCRIPTION("Linux kernel CIFS/SMB SERVER"); 630MODULE_LICENSE("GPL"); 631MODULE_SOFTDEP("pre: ecb"); 632MODULE_SOFTDEP("pre: hmac"); 633MODULE_SOFTDEP("pre: md5"); 634MODULE_SOFTDEP("pre: nls"); 635MODULE_SOFTDEP("pre: aes"); 636MODULE_SOFTDEP("pre: cmac"); 637MODULE_SOFTDEP("pre: sha256"); 638MODULE_SOFTDEP("pre: sha512"); 639MODULE_SOFTDEP("pre: aead2"); 640MODULE_SOFTDEP("pre: ccm"); 641MODULE_SOFTDEP("pre: gcm"); 642MODULE_SOFTDEP("pre: crc32"); 643module_init(ksmbd_server_init) 644module_exit(ksmbd_server_exit) 645