1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
4 * Copyright (C) 2018 Samsung Electronics Co., Ltd.
10 #include "smb_common.h"
11 #include "smbstatus.h"
12 #include "mgmt/user_session.h"
13 #include "connection.h"
15 static int check_smb2_hdr(struct smb2_hdr
*hdr
)
18 * Make sure that this really is an SMB, that it is a response.
20 if (hdr
->Flags
& SMB2_FLAGS_SERVER_TO_REDIR
)
26 * The following table defines the expected "StructureSize" of SMB2 requests
27 * in order by SMB2 command. This is similar to "wct" in SMB/CIFS requests.
29 * Note that commands are defined in smb2pdu.h in le16 but the array below is
30 * indexed by command in host byte order
32 static const __le16 smb2_req_struct_sizes
[NUMBER_OF_SMB2_COMMANDS
] = {
33 /* SMB2_NEGOTIATE */ cpu_to_le16(36),
34 /* SMB2_SESSION_SETUP */ cpu_to_le16(25),
35 /* SMB2_LOGOFF */ cpu_to_le16(4),
36 /* SMB2_TREE_CONNECT */ cpu_to_le16(9),
37 /* SMB2_TREE_DISCONNECT */ cpu_to_le16(4),
38 /* SMB2_CREATE */ cpu_to_le16(57),
39 /* SMB2_CLOSE */ cpu_to_le16(24),
40 /* SMB2_FLUSH */ cpu_to_le16(24),
41 /* SMB2_READ */ cpu_to_le16(49),
42 /* SMB2_WRITE */ cpu_to_le16(49),
43 /* SMB2_LOCK */ cpu_to_le16(48),
44 /* SMB2_IOCTL */ cpu_to_le16(57),
45 /* SMB2_CANCEL */ cpu_to_le16(4),
46 /* SMB2_ECHO */ cpu_to_le16(4),
47 /* SMB2_QUERY_DIRECTORY */ cpu_to_le16(33),
48 /* SMB2_CHANGE_NOTIFY */ cpu_to_le16(32),
49 /* SMB2_QUERY_INFO */ cpu_to_le16(41),
50 /* SMB2_SET_INFO */ cpu_to_le16(33),
51 /* use 44 for lease break */
52 /* SMB2_OPLOCK_BREAK */ cpu_to_le16(36)
56 * The size of the variable area depends on the offset and length fields
57 * located in different fields for various SMB2 requests. SMB2 requests
58 * with no variable length info, show an offset of zero for the offset field.
60 static const bool has_smb2_data_area
[NUMBER_OF_SMB2_COMMANDS
] = {
61 /* SMB2_NEGOTIATE */ true,
62 /* SMB2_SESSION_SETUP */ true,
63 /* SMB2_LOGOFF */ false,
64 /* SMB2_TREE_CONNECT */ true,
65 /* SMB2_TREE_DISCONNECT */ false,
66 /* SMB2_CREATE */ true,
67 /* SMB2_CLOSE */ false,
68 /* SMB2_FLUSH */ false,
70 /* SMB2_WRITE */ true,
72 /* SMB2_IOCTL */ true,
73 /* SMB2_CANCEL */ false, /* BB CHECK this not listed in documentation */
74 /* SMB2_ECHO */ false,
75 /* SMB2_QUERY_DIRECTORY */ true,
76 /* SMB2_CHANGE_NOTIFY */ false,
77 /* SMB2_QUERY_INFO */ true,
78 /* SMB2_SET_INFO */ true,
79 /* SMB2_OPLOCK_BREAK */ false
83 * Set length of the data area and the offset to arguments.
84 * if they are invalid, return error.
86 static int smb2_get_data_area_len(unsigned int *off
, unsigned int *len
,
94 /* error reqeusts do not have data area */
95 if (hdr
->Status
&& hdr
->Status
!= STATUS_MORE_PROCESSING_REQUIRED
&&
96 (((struct smb2_err_rsp
*)hdr
)->StructureSize
) == SMB2_ERROR_STRUCTURE_SIZE2_LE
)
100 * Following commands have data areas so we have to get the location
101 * of the data buffer offset and data buffer length for the particular
104 switch (hdr
->Command
) {
105 case SMB2_SESSION_SETUP
:
106 *off
= le16_to_cpu(((struct smb2_sess_setup_req
*)hdr
)->SecurityBufferOffset
);
107 *len
= le16_to_cpu(((struct smb2_sess_setup_req
*)hdr
)->SecurityBufferLength
);
109 case SMB2_TREE_CONNECT
:
110 *off
= le16_to_cpu(((struct smb2_tree_connect_req
*)hdr
)->PathOffset
);
111 *len
= le16_to_cpu(((struct smb2_tree_connect_req
*)hdr
)->PathLength
);
115 if (((struct smb2_create_req
*)hdr
)->CreateContextsLength
) {
116 *off
= le32_to_cpu(((struct smb2_create_req
*)
117 hdr
)->CreateContextsOffset
);
118 *len
= le32_to_cpu(((struct smb2_create_req
*)
119 hdr
)->CreateContextsLength
);
123 *off
= le16_to_cpu(((struct smb2_create_req
*)hdr
)->NameOffset
);
124 *len
= le16_to_cpu(((struct smb2_create_req
*)hdr
)->NameLength
);
127 case SMB2_QUERY_INFO
:
128 *off
= le16_to_cpu(((struct smb2_query_info_req
*)hdr
)->InputBufferOffset
);
129 *len
= le32_to_cpu(((struct smb2_query_info_req
*)hdr
)->InputBufferLength
);
132 *off
= le16_to_cpu(((struct smb2_set_info_req
*)hdr
)->BufferOffset
);
133 *len
= le32_to_cpu(((struct smb2_set_info_req
*)hdr
)->BufferLength
);
136 *off
= le16_to_cpu(((struct smb2_read_req
*)hdr
)->ReadChannelInfoOffset
);
137 *len
= le16_to_cpu(((struct smb2_read_req
*)hdr
)->ReadChannelInfoLength
);
140 if (((struct smb2_write_req
*)hdr
)->DataOffset
) {
141 *off
= le16_to_cpu(((struct smb2_write_req
*)hdr
)->DataOffset
);
142 *len
= le32_to_cpu(((struct smb2_write_req
*)hdr
)->Length
);
146 *off
= le16_to_cpu(((struct smb2_write_req
*)hdr
)->WriteChannelInfoOffset
);
147 *len
= le16_to_cpu(((struct smb2_write_req
*)hdr
)->WriteChannelInfoLength
);
149 case SMB2_QUERY_DIRECTORY
:
150 *off
= le16_to_cpu(((struct smb2_query_directory_req
*)hdr
)->FileNameOffset
);
151 *len
= le16_to_cpu(((struct smb2_query_directory_req
*)hdr
)->FileNameLength
);
158 * smb2_lock request size is 48 included single
159 * smb2_lock_element structure size.
161 lock_count
= le16_to_cpu(((struct smb2_lock_req
*)hdr
)->LockCount
) - 1;
162 if (lock_count
> 0) {
163 *off
= __SMB2_HEADER_STRUCTURE_SIZE
+ 48;
164 *len
= sizeof(struct smb2_lock_element
) * lock_count
;
169 *off
= le32_to_cpu(((struct smb2_ioctl_req
*)hdr
)->InputOffset
);
170 *len
= le32_to_cpu(((struct smb2_ioctl_req
*)hdr
)->InputCount
);
173 ksmbd_debug(SMB
, "no length check for command\n");
178 ksmbd_debug(SMB
, "offset %d too large\n", *off
);
180 } else if ((u64
)*off
+ *len
> MAX_STREAM_PROT_LEN
) {
181 ksmbd_debug(SMB
, "Request is larger than maximum stream protocol length(%u): %llu\n",
182 MAX_STREAM_PROT_LEN
, (u64
)*off
+ *len
);
190 * Calculate the size of the SMB message based on the fixed header
191 * portion, the number of word parameters and the data portion of the message.
193 static int smb2_calc_size(void *buf
, unsigned int *len
)
195 struct smb2_pdu
*pdu
= (struct smb2_pdu
*)buf
;
196 struct smb2_hdr
*hdr
= &pdu
->hdr
;
197 unsigned int offset
; /* the offset from the beginning of SMB to data area */
198 unsigned int data_length
; /* the length of the variable length data area */
201 /* Structure Size has already been checked to make sure it is 64 */
202 *len
= le16_to_cpu(hdr
->StructureSize
);
205 * StructureSize2, ie length of fixed parameter area has already
206 * been checked to make sure it is the correct length.
208 *len
+= le16_to_cpu(pdu
->StructureSize2
);
210 * StructureSize2 of smb2_lock pdu is set to 48, indicating
211 * the size of smb2 lock request with single smb2_lock_element
212 * regardless of number of locks. Subtract single
213 * smb2_lock_element for correct buffer size check.
215 if (hdr
->Command
== SMB2_LOCK
)
216 *len
-= sizeof(struct smb2_lock_element
);
218 if (has_smb2_data_area
[le16_to_cpu(hdr
->Command
)] == false)
221 ret
= smb2_get_data_area_len(&offset
, &data_length
, hdr
);
224 ksmbd_debug(SMB
, "SMB2 data length %u offset %u\n", data_length
,
227 if (data_length
> 0) {
229 * Check to make sure that data area begins after fixed area,
230 * Note that last byte of the fixed area is part of data area
231 * for some commands, typically those with odd StructureSize,
232 * so we must add one to the calculation.
234 if (offset
+ 1 < *len
) {
236 "data area offset %d overlaps SMB2 header %u\n",
241 *len
= offset
+ data_length
;
245 ksmbd_debug(SMB
, "SMB2 len %u\n", *len
);
249 static inline int smb2_query_info_req_len(struct smb2_query_info_req
*h
)
251 return le32_to_cpu(h
->InputBufferLength
) +
252 le32_to_cpu(h
->OutputBufferLength
);
255 static inline int smb2_set_info_req_len(struct smb2_set_info_req
*h
)
257 return le32_to_cpu(h
->BufferLength
);
260 static inline int smb2_read_req_len(struct smb2_read_req
*h
)
262 return le32_to_cpu(h
->Length
);
265 static inline int smb2_write_req_len(struct smb2_write_req
*h
)
267 return le32_to_cpu(h
->Length
);
270 static inline int smb2_query_dir_req_len(struct smb2_query_directory_req
*h
)
272 return le32_to_cpu(h
->OutputBufferLength
);
275 static inline int smb2_ioctl_req_len(struct smb2_ioctl_req
*h
)
277 return le32_to_cpu(h
->InputCount
) +
278 le32_to_cpu(h
->OutputCount
);
281 static inline int smb2_ioctl_resp_len(struct smb2_ioctl_req
*h
)
283 return le32_to_cpu(h
->MaxInputResponse
) +
284 le32_to_cpu(h
->MaxOutputResponse
);
287 static int smb2_validate_credit_charge(struct smb2_hdr
*hdr
)
289 int req_len
= 0, expect_resp_len
= 0, calc_credit_num
, max_len
;
290 int credit_charge
= le16_to_cpu(hdr
->CreditCharge
);
293 switch (hdr
->Command
) {
294 case SMB2_QUERY_INFO
:
295 req_len
= smb2_query_info_req_len(__hdr
);
298 req_len
= smb2_set_info_req_len(__hdr
);
301 req_len
= smb2_read_req_len(__hdr
);
304 req_len
= smb2_write_req_len(__hdr
);
306 case SMB2_QUERY_DIRECTORY
:
307 req_len
= smb2_query_dir_req_len(__hdr
);
310 req_len
= smb2_ioctl_req_len(__hdr
);
311 expect_resp_len
= smb2_ioctl_resp_len(__hdr
);
317 credit_charge
= max(1, credit_charge
);
318 max_len
= max(req_len
, expect_resp_len
);
319 calc_credit_num
= DIV_ROUND_UP(max_len
, SMB2_MAX_BUFFER_SIZE
);
321 if (credit_charge
< calc_credit_num
) {
322 pr_err("Insufficient credit charge, given: %d, needed: %d\n",
323 credit_charge
, calc_credit_num
);
330 int ksmbd_smb2_check_message(struct ksmbd_work
*work
)
332 struct smb2_pdu
*pdu
= work
->request_buf
;
333 struct smb2_hdr
*hdr
= &pdu
->hdr
;
335 __u32 clc_len
; /* calculated length */
336 __u32 len
= get_rfc1002_len(pdu
);
338 if (work
->next_smb2_rcv_hdr_off
) {
339 pdu
= ksmbd_req_buf_next(work
);
343 if (le32_to_cpu(hdr
->NextCommand
) > 0) {
344 len
= le32_to_cpu(hdr
->NextCommand
);
345 } else if (work
->next_smb2_rcv_hdr_off
) {
346 len
-= work
->next_smb2_rcv_hdr_off
;
347 len
= round_up(len
, 8);
350 if (check_smb2_hdr(hdr
))
353 if (hdr
->StructureSize
!= SMB2_HEADER_STRUCTURE_SIZE
) {
354 ksmbd_debug(SMB
, "Illegal structure size %u\n",
355 le16_to_cpu(hdr
->StructureSize
));
359 command
= le16_to_cpu(hdr
->Command
);
360 if (command
>= NUMBER_OF_SMB2_COMMANDS
) {
361 ksmbd_debug(SMB
, "Illegal SMB2 command %d\n", command
);
365 if (smb2_req_struct_sizes
[command
] != pdu
->StructureSize2
) {
366 if (command
!= SMB2_OPLOCK_BREAK_HE
&&
367 (hdr
->Status
== 0 || pdu
->StructureSize2
!= SMB2_ERROR_STRUCTURE_SIZE2_LE
)) {
368 /* error packets have 9 byte structure size */
370 "Illegal request size %u for command %d\n",
371 le16_to_cpu(pdu
->StructureSize2
), command
);
373 } else if (command
== SMB2_OPLOCK_BREAK_HE
&&
375 le16_to_cpu(pdu
->StructureSize2
) != OP_BREAK_STRUCT_SIZE_20
&&
376 le16_to_cpu(pdu
->StructureSize2
) != OP_BREAK_STRUCT_SIZE_21
) {
377 /* special case for SMB2.1 lease break message */
379 "Illegal request size %d for oplock break\n",
380 le16_to_cpu(pdu
->StructureSize2
));
385 if ((work
->conn
->vals
->capabilities
& SMB2_GLOBAL_CAP_LARGE_MTU
) &&
386 smb2_validate_credit_charge(hdr
)) {
387 work
->conn
->ops
->set_rsp_status(work
, STATUS_INVALID_PARAMETER
);
391 if (smb2_calc_size(hdr
, &clc_len
))
394 if (len
!= clc_len
) {
395 /* client can return one byte more due to implied bcc[0] */
396 if (clc_len
== len
+ 1)
400 * Some windows servers (win2016) will pad also the final
401 * PDU in a compound to 8 bytes.
403 if (ALIGN(clc_len
, 8) == len
)
407 * windows client also pad up to 8 bytes when compounding.
408 * If pad is longer than eight bytes, log the server behavior
409 * (once), since may indicate a problem but allow it and
410 * continue since the frame is parseable.
414 "cli req padded more than expected. Length %d not %d for cmd:%d mid:%llu\n",
415 len
, clc_len
, command
,
416 le64_to_cpu(hdr
->MessageId
));
421 "cli req too short, len %d not %d. cmd:%d mid:%llu\n",
422 len
, clc_len
, command
,
423 le64_to_cpu(hdr
->MessageId
));
431 int smb2_negotiate_request(struct ksmbd_work
*work
)
433 return ksmbd_smb_negotiate_common(work
, SMB2_NEGOTIATE_HE
);