fs/ksmbd/smb2misc.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
   4  *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
   5  */
   6
   7 #include "glob.h"
   8 #include "nterr.h"
   9 #include "smb2pdu.h"
  10 #include "smb_common.h"
  11 #include "smbstatus.h"
  12 #include "mgmt/user_session.h"
  13 #include "connection.h"
  14
  15 static int check_smb2_hdr(struct smb2_hdr *hdr)
  16 {
  17         /*
  18          * Make sure that this really is an SMB, that it is a response.
  19          */
  20         if (hdr->Flags & SMB2_FLAGS_SERVER_TO_REDIR)
  21                 return 1;
  22         return 0;
  23 }
  24
  25 /*
  26  *  The following table defines the expected "StructureSize" of SMB2 requests
  27  *  in order by SMB2 command.  This is similar to "wct" in SMB/CIFS requests.
  28  *
  29  *  Note that commands are defined in smb2pdu.h in le16 but the array below is
  30  *  indexed by command in host byte order
  31  */
  32 static const __le16 smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = {
  33         /* SMB2_NEGOTIATE */ cpu_to_le16(36),
  34         /* SMB2_SESSION_SETUP */ cpu_to_le16(25),
  35         /* SMB2_LOGOFF */ cpu_to_le16(4),
  36         /* SMB2_TREE_CONNECT */ cpu_to_le16(9),
  37         /* SMB2_TREE_DISCONNECT */ cpu_to_le16(4),
  38         /* SMB2_CREATE */ cpu_to_le16(57),
  39         /* SMB2_CLOSE */ cpu_to_le16(24),
  40         /* SMB2_FLUSH */ cpu_to_le16(24),
  41         /* SMB2_READ */ cpu_to_le16(49),
  42         /* SMB2_WRITE */ cpu_to_le16(49),
  43         /* SMB2_LOCK */ cpu_to_le16(48),
  44         /* SMB2_IOCTL */ cpu_to_le16(57),
  45         /* SMB2_CANCEL */ cpu_to_le16(4),
  46         /* SMB2_ECHO */ cpu_to_le16(4),
  47         /* SMB2_QUERY_DIRECTORY */ cpu_to_le16(33),
  48         /* SMB2_CHANGE_NOTIFY */ cpu_to_le16(32),
  49         /* SMB2_QUERY_INFO */ cpu_to_le16(41),
  50         /* SMB2_SET_INFO */ cpu_to_le16(33),
  51         /* use 44 for lease break */
  52         /* SMB2_OPLOCK_BREAK */ cpu_to_le16(36)
  53 };
  54
  55 /*
  56  * The size of the variable area depends on the offset and length fields
  57  * located in different fields for various SMB2 requests. SMB2 requests
  58  * with no variable length info, show an offset of zero for the offset field.
  59  */
  60 static const bool has_smb2_data_area[NUMBER_OF_SMB2_COMMANDS] = {
  61         /* SMB2_NEGOTIATE */ true,
  62         /* SMB2_SESSION_SETUP */ true,
  63         /* SMB2_LOGOFF */ false,
  64         /* SMB2_TREE_CONNECT */ true,
  65         /* SMB2_TREE_DISCONNECT */ false,
  66         /* SMB2_CREATE */ true,
  67         /* SMB2_CLOSE */ false,
  68         /* SMB2_FLUSH */ false,
  69         /* SMB2_READ */ true,
  70         /* SMB2_WRITE */ true,
  71         /* SMB2_LOCK */ true,
  72         /* SMB2_IOCTL */ true,
  73         /* SMB2_CANCEL */ false, /* BB CHECK this not listed in documentation */
  74         /* SMB2_ECHO */ false,
  75         /* SMB2_QUERY_DIRECTORY */ true,
  76         /* SMB2_CHANGE_NOTIFY */ false,
  77         /* SMB2_QUERY_INFO */ true,
  78         /* SMB2_SET_INFO */ true,
  79         /* SMB2_OPLOCK_BREAK */ false
  80 };
  81
  82 /*
  83  * Returns the pointer to the beginning of the data area. Length of the data
  84  * area and the offset to it (from the beginning of the smb are also returned.
  85  */
  86 static char *smb2_get_data_area_len(int *off, int *len, struct smb2_hdr *hdr)
  87 {
  88         *off = 0;
  89         *len = 0;
  90
  91         /* error reqeusts do not have data area */
  92         if (hdr->Status && hdr->Status != STATUS_MORE_PROCESSING_REQUIRED &&
  93             (((struct smb2_err_rsp *)hdr)->StructureSize) == SMB2_ERROR_STRUCTURE_SIZE2_LE)
  94                 return NULL;
  95
  96         /*
  97          * Following commands have data areas so we have to get the location
  98          * of the data buffer offset and data buffer length for the particular
  99          * command.
 100          */
 101         switch (hdr->Command) {
 102         case SMB2_SESSION_SETUP:
 103                 *off = le16_to_cpu(((struct smb2_sess_setup_req *)hdr)->SecurityBufferOffset);
 104                 *len = le16_to_cpu(((struct smb2_sess_setup_req *)hdr)->SecurityBufferLength);
 105                 break;
 106         case SMB2_TREE_CONNECT:
 107                 *off = le16_to_cpu(((struct smb2_tree_connect_req *)hdr)->PathOffset);
 108                 *len = le16_to_cpu(((struct smb2_tree_connect_req *)hdr)->PathLength);
 109                 break;
 110         case SMB2_CREATE:
 111         {
 112                 if (((struct smb2_create_req *)hdr)->CreateContextsLength) {
 113                         *off = le32_to_cpu(((struct smb2_create_req *)
 114                                 hdr)->CreateContextsOffset);
 115                         *len = le32_to_cpu(((struct smb2_create_req *)
 116                                 hdr)->CreateContextsLength);
 117                         break;
 118                 }
 119
 120                 *off = le16_to_cpu(((struct smb2_create_req *)hdr)->NameOffset);
 121                 *len = le16_to_cpu(((struct smb2_create_req *)hdr)->NameLength);
 122                 break;
 123         }
 124         case SMB2_QUERY_INFO:
 125                 *off = le16_to_cpu(((struct smb2_query_info_req *)hdr)->InputBufferOffset);
 126                 *len = le32_to_cpu(((struct smb2_query_info_req *)hdr)->InputBufferLength);
 127                 break;
 128         case SMB2_SET_INFO:
 129                 *off = le16_to_cpu(((struct smb2_set_info_req *)hdr)->BufferOffset);
 130                 *len = le32_to_cpu(((struct smb2_set_info_req *)hdr)->BufferLength);
 131                 break;
 132         case SMB2_READ:
 133                 *off = le16_to_cpu(((struct smb2_read_req *)hdr)->ReadChannelInfoOffset);
 134                 *len = le16_to_cpu(((struct smb2_read_req *)hdr)->ReadChannelInfoLength);
 135                 break;
 136         case SMB2_WRITE:
 137                 if (((struct smb2_write_req *)hdr)->DataOffset) {
 138                         *off = le16_to_cpu(((struct smb2_write_req *)hdr)->DataOffset);
 139                         *len = le32_to_cpu(((struct smb2_write_req *)hdr)->Length);
 140                         break;
 141                 }
 142
 143                 *off = le16_to_cpu(((struct smb2_write_req *)hdr)->WriteChannelInfoOffset);
 144                 *len = le16_to_cpu(((struct smb2_write_req *)hdr)->WriteChannelInfoLength);
 145                 break;
 146         case SMB2_QUERY_DIRECTORY:
 147                 *off = le16_to_cpu(((struct smb2_query_directory_req *)hdr)->FileNameOffset);
 148                 *len = le16_to_cpu(((struct smb2_query_directory_req *)hdr)->FileNameLength);
 149                 break;
 150         case SMB2_LOCK:
 151         {
 152                 int lock_count;
 153
 154                 /*
 155                  * smb2_lock request size is 48 included single
 156                  * smb2_lock_element structure size.
 157                  */
 158                 lock_count = le16_to_cpu(((struct smb2_lock_req *)hdr)->LockCount) - 1;
 159                 if (lock_count > 0) {
 160                         *off = __SMB2_HEADER_STRUCTURE_SIZE + 48;
 161                         *len = sizeof(struct smb2_lock_element) * lock_count;
 162                 }
 163                 break;
 164         }
 165         case SMB2_IOCTL:
 166                 *off = le32_to_cpu(((struct smb2_ioctl_req *)hdr)->InputOffset);
 167                 *len = le32_to_cpu(((struct smb2_ioctl_req *)hdr)->InputCount);
 168
 169                 break;
 170         default:
 171                 ksmbd_debug(SMB, "no length check for command\n");
 172                 break;
 173         }
 174
 175         /*
 176          * Invalid length or offset probably means data area is invalid, but
 177          * we have little choice but to ignore the data area in this case.
 178          */
 179         if (*off > 4096) {
 180                 ksmbd_debug(SMB, "offset %d too large, data area ignored\n",
 181                             *off);
 182                 *len = 0;
 183                 *off = 0;
 184         } else if (*off < 0) {
 185                 ksmbd_debug(SMB,
 186                             "negative offset %d to data invalid ignore data area\n",
 187                             *off);
 188                 *off = 0;
 189                 *len = 0;
 190         } else if (*len < 0) {
 191                 ksmbd_debug(SMB,
 192                             "negative data length %d invalid, data area ignored\n",
 193                             *len);
 194                 *len = 0;
 195         } else if (*len > 128 * 1024) {
 196                 ksmbd_debug(SMB, "data area larger than 128K: %d\n", *len);
 197                 *len = 0;
 198         }
 199
 200         /* return pointer to beginning of data area, ie offset from SMB start */
 201         if ((*off != 0) && (*len != 0))
 202                 return (char *)hdr + *off;
 203         else
 204                 return NULL;
 205 }
 206
 207 /*
 208  * Calculate the size of the SMB message based on the fixed header
 209  * portion, the number of word parameters and the data portion of the message.
 210  */
 211 static unsigned int smb2_calc_size(void *buf)
 212 {
 213         struct smb2_pdu *pdu = (struct smb2_pdu *)buf;
 214         struct smb2_hdr *hdr = &pdu->hdr;
 215         int offset; /* the offset from the beginning of SMB to data area */
 216         int data_length; /* the length of the variable length data area */
 217         /* Structure Size has already been checked to make sure it is 64 */
 218         int len = le16_to_cpu(hdr->StructureSize);
 219
 220         /*
 221          * StructureSize2, ie length of fixed parameter area has already
 222          * been checked to make sure it is the correct length.
 223          */
 224         len += le16_to_cpu(pdu->StructureSize2);
 225
 226         if (has_smb2_data_area[le16_to_cpu(hdr->Command)] == false)
 227                 goto calc_size_exit;
 228
 229         smb2_get_data_area_len(&offset, &data_length, hdr);
 230         ksmbd_debug(SMB, "SMB2 data length %d offset %d\n", data_length,
 231                     offset);
 232
 233         if (data_length > 0) {
 234                 /*
 235                  * Check to make sure that data area begins after fixed area,
 236                  * Note that last byte of the fixed area is part of data area
 237                  * for some commands, typically those with odd StructureSize,
 238                  * so we must add one to the calculation.
 239                  */
 240                 if (offset + 1 < len)
 241                         ksmbd_debug(SMB,
 242                                     "data area offset %d overlaps SMB2 header %d\n",
 243                                     offset + 1, len);
 244                 else
 245                         len = offset + data_length;
 246         }
 247 calc_size_exit:
 248         ksmbd_debug(SMB, "SMB2 len %d\n", len);
 249         return len;
 250 }
 251
 252 static inline int smb2_query_info_req_len(struct smb2_query_info_req *h)
 253 {
 254         return le32_to_cpu(h->InputBufferLength) +
 255                 le32_to_cpu(h->OutputBufferLength);
 256 }
 257
 258 static inline int smb2_set_info_req_len(struct smb2_set_info_req *h)
 259 {
 260         return le32_to_cpu(h->BufferLength);
 261 }
 262
 263 static inline int smb2_read_req_len(struct smb2_read_req *h)
 264 {
 265         return le32_to_cpu(h->Length);
 266 }
 267
 268 static inline int smb2_write_req_len(struct smb2_write_req *h)
 269 {
 270         return le32_to_cpu(h->Length);
 271 }
 272
 273 static inline int smb2_query_dir_req_len(struct smb2_query_directory_req *h)
 274 {
 275         return le32_to_cpu(h->OutputBufferLength);
 276 }
 277
 278 static inline int smb2_ioctl_req_len(struct smb2_ioctl_req *h)
 279 {
 280         return le32_to_cpu(h->InputCount) +
 281                 le32_to_cpu(h->OutputCount);
 282 }
 283
 284 static inline int smb2_ioctl_resp_len(struct smb2_ioctl_req *h)
 285 {
 286         return le32_to_cpu(h->MaxInputResponse) +
 287                 le32_to_cpu(h->MaxOutputResponse);
 288 }
 289
 290 static int smb2_validate_credit_charge(struct smb2_hdr *hdr)
 291 {
 292         int req_len = 0, expect_resp_len = 0, calc_credit_num, max_len;
 293         int credit_charge = le16_to_cpu(hdr->CreditCharge);
 294         void *__hdr = hdr;
 295
 296         switch (hdr->Command) {
 297         case SMB2_QUERY_INFO:
 298                 req_len = smb2_query_info_req_len(__hdr);
 299                 break;
 300         case SMB2_SET_INFO:
 301                 req_len = smb2_set_info_req_len(__hdr);
 302                 break;
 303         case SMB2_READ:
 304                 req_len = smb2_read_req_len(__hdr);
 305                 break;
 306         case SMB2_WRITE:
 307                 req_len = smb2_write_req_len(__hdr);
 308                 break;
 309         case SMB2_QUERY_DIRECTORY:
 310                 req_len = smb2_query_dir_req_len(__hdr);
 311                 break;
 312         case SMB2_IOCTL:
 313                 req_len = smb2_ioctl_req_len(__hdr);
 314                 expect_resp_len = smb2_ioctl_resp_len(__hdr);
 315                 break;
 316         default:
 317                 return 0;
 318         }
 319
 320         credit_charge = max(1, credit_charge);
 321         max_len = max(req_len, expect_resp_len);
 322         calc_credit_num = DIV_ROUND_UP(max_len, SMB2_MAX_BUFFER_SIZE);
 323
 324         if (credit_charge < calc_credit_num) {
 325                 pr_err("Insufficient credit charge, given: %d, needed: %d\n",
 326                        credit_charge, calc_credit_num);
 327                 return 1;
 328         }
 329
 330         return 0;
 331 }
 332
 333 int ksmbd_smb2_check_message(struct ksmbd_work *work)
 334 {
 335         struct smb2_pdu *pdu = work->request_buf;
 336         struct smb2_hdr *hdr = &pdu->hdr;
 337         int command;
 338         __u32 clc_len;  /* calculated length */
 339         __u32 len = get_rfc1002_len(pdu);
 340
 341         if (work->next_smb2_rcv_hdr_off) {
 342                 pdu = ksmbd_req_buf_next(work);
 343                 hdr = &pdu->hdr;
 344         }
 345
 346         if (le32_to_cpu(hdr->NextCommand) > 0) {
 347                 len = le32_to_cpu(hdr->NextCommand);
 348         } else if (work->next_smb2_rcv_hdr_off) {
 349                 len -= work->next_smb2_rcv_hdr_off;
 350                 len = round_up(len, 8);
 351         }
 352
 353         if (check_smb2_hdr(hdr))
 354                 return 1;
 355
 356         if (hdr->StructureSize != SMB2_HEADER_STRUCTURE_SIZE) {
 357                 ksmbd_debug(SMB, "Illegal structure size %u\n",
 358                             le16_to_cpu(hdr->StructureSize));
 359                 return 1;
 360         }
 361
 362         command = le16_to_cpu(hdr->Command);
 363         if (command >= NUMBER_OF_SMB2_COMMANDS) {
 364                 ksmbd_debug(SMB, "Illegal SMB2 command %d\n", command);
 365                 return 1;
 366         }
 367
 368         if (smb2_req_struct_sizes[command] != pdu->StructureSize2) {
 369                 if (command != SMB2_OPLOCK_BREAK_HE &&
 370                     (hdr->Status == 0 || pdu->StructureSize2 != SMB2_ERROR_STRUCTURE_SIZE2_LE)) {
 371                         /* error packets have 9 byte structure size */
 372                         ksmbd_debug(SMB,
 373                                     "Illegal request size %u for command %d\n",
 374                                     le16_to_cpu(pdu->StructureSize2), command);
 375                         return 1;
 376                 } else if (command == SMB2_OPLOCK_BREAK_HE &&
 377                            hdr->Status == 0 &&
 378                            le16_to_cpu(pdu->StructureSize2) != OP_BREAK_STRUCT_SIZE_20 &&
 379                            le16_to_cpu(pdu->StructureSize2) != OP_BREAK_STRUCT_SIZE_21) {
 380                         /* special case for SMB2.1 lease break message */
 381                         ksmbd_debug(SMB,
 382                                     "Illegal request size %d for oplock break\n",
 383                                     le16_to_cpu(pdu->StructureSize2));
 384                         return 1;
 385                 }
 386         }
 387
 388         if ((work->conn->vals->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU) &&
 389             smb2_validate_credit_charge(hdr)) {
 390                 work->conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER);
 391                 return 1;
 392         }
 393
 394         clc_len = smb2_calc_size(hdr);
 395         if (len != clc_len) {
 396                 /* server can return one byte more due to implied bcc[0] */
 397                 if (clc_len == len + 1)
 398                         return 0;
 399
 400                 /*
 401                  * Some windows servers (win2016) will pad also the final
 402                  * PDU in a compound to 8 bytes.
 403                  */
 404                 if (ALIGN(clc_len, 8) == len)
 405                         return 0;
 406
 407                 /*
 408                  * windows client also pad up to 8 bytes when compounding.
 409                  * If pad is longer than eight bytes, log the server behavior
 410                  * (once), since may indicate a problem but allow it and
 411                  * continue since the frame is parseable.
 412                  */
 413                 if (clc_len < len) {
 414                         ksmbd_debug(SMB,
 415                                     "cli req padded more than expected. Length %d not %d for cmd:%d mid:%llu\n",
 416                                     len, clc_len, command,
 417                                     le64_to_cpu(hdr->MessageId));
 418                         return 0;
 419                 }
 420
 421                 if (command == SMB2_LOCK_HE && len == 88)
 422                         return 0;
 423
 424                 ksmbd_debug(SMB,
 425                             "cli req too short, len %d not %d. cmd:%d mid:%llu\n",
 426                             len, clc_len, command,
 427                             le64_to_cpu(hdr->MessageId));
 428
 429                 return 1;
 430         }
 431
 432         return 0;
 433 }
 434
 435 int smb2_negotiate_request(struct ksmbd_work *work)
 436 {
 437         return ksmbd_smb_negotiate_common(work, SMB2_NEGOTIATE_HE);
 438 }