1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
4 */
5
6#include <linux/list.h>
7#include <linux/slab.h>
8#include <linux/rwsem.h>
9#include <linux/xarray.h>
10
11#include "ksmbd_ida.h"
12#include "user_session.h"
13#include "user_config.h"
14#include "tree_connect.h"
15#include "../transport_ipc.h"
16#include "../connection.h"
17#include "../vfs_cache.h"
18
19static DEFINE_IDA(session_ida);
20
21#define SESSION_HASH_BITS		3
22static DEFINE_HASHTABLE(sessions_table, SESSION_HASH_BITS);
23static DECLARE_RWSEM(sessions_table_lock);
24
25struct ksmbd_session_rpc {
26	int			id;
27	unsigned int		method;
28};
29
30static void free_channel_list(struct ksmbd_session *sess)
31{
32	struct channel *chann;
33	unsigned long index;
34
35	xa_for_each(&sess->ksmbd_chann_list, index, chann) {
36		xa_erase(&sess->ksmbd_chann_list, index);
37		kfree(chann);
38	}
39
40	xa_destroy(&sess->ksmbd_chann_list);
41}
42
43static void __session_rpc_close(struct ksmbd_session *sess,
44				struct ksmbd_session_rpc *entry)
45{
46	struct ksmbd_rpc_command *resp;
47
48	resp = ksmbd_rpc_close(sess, entry->id);
49	if (!resp)
50		pr_err("Unable to close RPC pipe %d\n", entry->id);
51
52	kvfree(resp);
53	ksmbd_rpc_id_free(entry->id);
54	kfree(entry);
55}
56
57static void ksmbd_session_rpc_clear_list(struct ksmbd_session *sess)
58{
59	struct ksmbd_session_rpc *entry;
60	long index;
61
62	xa_for_each(&sess->rpc_handle_list, index, entry) {
63		xa_erase(&sess->rpc_handle_list, index);
64		__session_rpc_close(sess, entry);
65	}
66
67	xa_destroy(&sess->rpc_handle_list);
68}
69
70static int __rpc_method(char *rpc_name)
71{
72	if (!strcmp(rpc_name, "\\srvsvc") || !strcmp(rpc_name, "srvsvc"))
73		return KSMBD_RPC_SRVSVC_METHOD_INVOKE;
74
75	if (!strcmp(rpc_name, "\\wkssvc") || !strcmp(rpc_name, "wkssvc"))
76		return KSMBD_RPC_WKSSVC_METHOD_INVOKE;
77
78	if (!strcmp(rpc_name, "LANMAN") || !strcmp(rpc_name, "lanman"))
79		return KSMBD_RPC_RAP_METHOD;
80
81	if (!strcmp(rpc_name, "\\samr") || !strcmp(rpc_name, "samr"))
82		return KSMBD_RPC_SAMR_METHOD_INVOKE;
83
84	if (!strcmp(rpc_name, "\\lsarpc") || !strcmp(rpc_name, "lsarpc"))
85		return KSMBD_RPC_LSARPC_METHOD_INVOKE;
86
87	pr_err("Unsupported RPC: %s\n", rpc_name);
88	return 0;
89}
90
91int ksmbd_session_rpc_open(struct ksmbd_session *sess, char *rpc_name)
92{
93	struct ksmbd_session_rpc *entry;
94	struct ksmbd_rpc_command *resp;
95	int method;
96
97	method = __rpc_method(rpc_name);
98	if (!method)
99		return -EINVAL;
100
101	entry = kzalloc(sizeof(struct ksmbd_session_rpc), GFP_KERNEL);
102	if (!entry)
103		return -ENOMEM;
104
105	entry->method = method;
106	entry->id = ksmbd_ipc_id_alloc();
107	if (entry->id < 0)
108		goto free_entry;
109	xa_store(&sess->rpc_handle_list, entry->id, entry, GFP_KERNEL);
110
111	resp = ksmbd_rpc_open(sess, entry->id);
112	if (!resp)
113		goto free_id;
114
115	kvfree(resp);
116	return entry->id;
117free_id:
118	xa_erase(&sess->rpc_handle_list, entry->id);
119	ksmbd_rpc_id_free(entry->id);
120free_entry:
121	kfree(entry);
122	return -EINVAL;
123}
124
125void ksmbd_session_rpc_close(struct ksmbd_session *sess, int id)
126{
127	struct ksmbd_session_rpc *entry;
128
129	entry = xa_erase(&sess->rpc_handle_list, id);
130	if (entry)
131		__session_rpc_close(sess, entry);
132}
133
134int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id)
135{
136	struct ksmbd_session_rpc *entry;
137
138	entry = xa_load(&sess->rpc_handle_list, id);
139	return entry ? entry->method : 0;
140}
141
142void ksmbd_session_destroy(struct ksmbd_session *sess)
143{
144	if (!sess)
145		return;
146
147	if (sess->user)
148		ksmbd_free_user(sess->user);
149
150	ksmbd_tree_conn_session_logoff(sess);
151	ksmbd_destroy_file_table(&sess->file_table);
152	ksmbd_session_rpc_clear_list(sess);
153	free_channel_list(sess);
154	kfree(sess->Preauth_HashValue);
155	ksmbd_release_id(&session_ida, sess->id);
156	kfree(sess);
157}
158
159struct ksmbd_session *__session_lookup(unsigned long long id)
160{
161	struct ksmbd_session *sess;
162
163	hash_for_each_possible(sessions_table, sess, hlist, id) {
164		if (id == sess->id) {
165			sess->last_active = jiffies;
166			return sess;
167		}
168	}
169	return NULL;
170}
171
172static void ksmbd_expire_session(struct ksmbd_conn *conn)
173{
174	unsigned long id;
175	struct ksmbd_session *sess;
176
177	down_write(&conn->session_lock);
178	xa_for_each(&conn->sessions, id, sess) {
179		if (sess->state != SMB2_SESSION_VALID ||
180		    time_after(jiffies,
181			       sess->last_active + SMB2_SESSION_TIMEOUT)) {
182			xa_erase(&conn->sessions, sess->id);
183			hash_del(&sess->hlist);
184			ksmbd_session_destroy(sess);
185			continue;
186		}
187	}
188	up_write(&conn->session_lock);
189}
190
191int ksmbd_session_register(struct ksmbd_conn *conn,
192			   struct ksmbd_session *sess)
193{
194	sess->dialect = conn->dialect;
195	memcpy(sess->ClientGUID, conn->ClientGUID, SMB2_CLIENT_GUID_SIZE);
196	ksmbd_expire_session(conn);
197	return xa_err(xa_store(&conn->sessions, sess->id, sess, GFP_KERNEL));
198}
199
200static int ksmbd_chann_del(struct ksmbd_conn *conn, struct ksmbd_session *sess)
201{
202	struct channel *chann;
203
204	chann = xa_erase(&sess->ksmbd_chann_list, (long)conn);
205	if (!chann)
206		return -ENOENT;
207
208	kfree(chann);
209	return 0;
210}
211
212void ksmbd_sessions_deregister(struct ksmbd_conn *conn)
213{
214	struct ksmbd_session *sess;
215	unsigned long id;
216
217	down_write(&sessions_table_lock);
218	if (conn->binding) {
219		int bkt;
220		struct hlist_node *tmp;
221
222		hash_for_each_safe(sessions_table, bkt, tmp, sess, hlist) {
223			if (!ksmbd_chann_del(conn, sess) &&
224			    xa_empty(&sess->ksmbd_chann_list)) {
225				hash_del(&sess->hlist);
226				ksmbd_session_destroy(sess);
227			}
228		}
229	}
230	up_write(&sessions_table_lock);
231
232	down_write(&conn->session_lock);
233	xa_for_each(&conn->sessions, id, sess) {
234		unsigned long chann_id;
235		struct channel *chann;
236
237		xa_for_each(&sess->ksmbd_chann_list, chann_id, chann) {
238			if (chann->conn != conn)
239				ksmbd_conn_set_exiting(chann->conn);
240		}
241
242		ksmbd_chann_del(conn, sess);
243		if (xa_empty(&sess->ksmbd_chann_list)) {
244			xa_erase(&conn->sessions, sess->id);
245			hash_del(&sess->hlist);
246			ksmbd_session_destroy(sess);
247		}
248	}
249	up_write(&conn->session_lock);
250}
251
252struct ksmbd_session *ksmbd_session_lookup(struct ksmbd_conn *conn,
253					   unsigned long long id)
254{
255	struct ksmbd_session *sess;
256
257	down_read(&conn->session_lock);
258	sess = xa_load(&conn->sessions, id);
259	if (sess)
260		sess->last_active = jiffies;
261	up_read(&conn->session_lock);
262	return sess;
263}
264
265struct ksmbd_session *ksmbd_session_lookup_slowpath(unsigned long long id)
266{
267	struct ksmbd_session *sess;
268
269	down_read(&sessions_table_lock);
270	sess = __session_lookup(id);
271	if (sess)
272		sess->last_active = jiffies;
273	up_read(&sessions_table_lock);
274
275	return sess;
276}
277
278struct ksmbd_session *ksmbd_session_lookup_all(struct ksmbd_conn *conn,
279					       unsigned long long id)
280{
281	struct ksmbd_session *sess;
282
283	sess = ksmbd_session_lookup(conn, id);
284	if (!sess && conn->binding)
285		sess = ksmbd_session_lookup_slowpath(id);
286	if (sess && sess->state != SMB2_SESSION_VALID)
287		sess = NULL;
288	return sess;
289}
290
291struct preauth_session *ksmbd_preauth_session_alloc(struct ksmbd_conn *conn,
292						    u64 sess_id)
293{
294	struct preauth_session *sess;
295
296	sess = kmalloc(sizeof(struct preauth_session), GFP_KERNEL);
297	if (!sess)
298		return NULL;
299
300	sess->id = sess_id;
301	memcpy(sess->Preauth_HashValue, conn->preauth_info->Preauth_HashValue,
302	       PREAUTH_HASHVALUE_SIZE);
303	list_add(&sess->preauth_entry, &conn->preauth_sess_table);
304
305	return sess;
306}
307
308void destroy_previous_session(struct ksmbd_conn *conn,
309			      struct ksmbd_user *user, u64 id)
310{
311	struct ksmbd_session *prev_sess;
312	struct ksmbd_user *prev_user;
313
314	down_write(&sessions_table_lock);
315	down_write(&conn->session_lock);
316	prev_sess = __session_lookup(id);
317	if (!prev_sess || prev_sess->state == SMB2_SESSION_EXPIRED)
318		goto out;
319
320	prev_user = prev_sess->user;
321	if (!prev_user ||
322	    strcmp(user->name, prev_user->name) ||
323	    user->passkey_sz != prev_user->passkey_sz ||
324	    memcmp(user->passkey, prev_user->passkey, user->passkey_sz))
325		goto out;
326
327	ksmbd_destroy_file_table(&prev_sess->file_table);
328	prev_sess->state = SMB2_SESSION_EXPIRED;
329out:
330	up_write(&conn->session_lock);
331	up_write(&sessions_table_lock);
332}
333
334static bool ksmbd_preauth_session_id_match(struct preauth_session *sess,
335					   unsigned long long id)
336{
337	return sess->id == id;
338}
339
340struct preauth_session *ksmbd_preauth_session_lookup(struct ksmbd_conn *conn,
341						     unsigned long long id)
342{
343	struct preauth_session *sess = NULL;
344
345	list_for_each_entry(sess, &conn->preauth_sess_table, preauth_entry) {
346		if (ksmbd_preauth_session_id_match(sess, id))
347			return sess;
348	}
349	return NULL;
350}
351
352static int __init_smb2_session(struct ksmbd_session *sess)
353{
354	int id = ksmbd_acquire_smb2_uid(&session_ida);
355
356	if (id < 0)
357		return -EINVAL;
358	sess->id = id;
359	return 0;
360}
361
362static struct ksmbd_session *__session_create(int protocol)
363{
364	struct ksmbd_session *sess;
365	int ret;
366
367	if (protocol != CIFDS_SESSION_FLAG_SMB2)
368		return NULL;
369
370	sess = kzalloc(sizeof(struct ksmbd_session), GFP_KERNEL);
371	if (!sess)
372		return NULL;
373
374	if (ksmbd_init_file_table(&sess->file_table))
375		goto error;
376
377	sess->last_active = jiffies;
378	sess->state = SMB2_SESSION_IN_PROGRESS;
379	set_session_flag(sess, protocol);
380	xa_init(&sess->tree_conns);
381	xa_init(&sess->ksmbd_chann_list);
382	xa_init(&sess->rpc_handle_list);
383	sess->sequence_number = 1;
384	rwlock_init(&sess->tree_conns_lock);
385
386	ret = __init_smb2_session(sess);
387	if (ret)
388		goto error;
389
390	ida_init(&sess->tree_conn_ida);
391
392	down_write(&sessions_table_lock);
393	hash_add(sessions_table, &sess->hlist, sess->id);
394	up_write(&sessions_table_lock);
395
396	return sess;
397
398error:
399	ksmbd_session_destroy(sess);
400	return NULL;
401}
402
403struct ksmbd_session *ksmbd_smb2_session_create(void)
404{
405	return __session_create(CIFDS_SESSION_FLAG_SMB2);
406}
407
408int ksmbd_acquire_tree_conn_id(struct ksmbd_session *sess)
409{
410	int id = -EINVAL;
411
412	if (test_session_flag(sess, CIFDS_SESSION_FLAG_SMB2))
413		id = ksmbd_acquire_smb2_tid(&sess->tree_conn_ida);
414
415	return id;
416}
417
418void ksmbd_release_tree_conn_id(struct ksmbd_session *sess, int id)
419{
420	if (id >= 0)
421		ksmbd_release_id(&sess->tree_conn_ida, id);
422}
423