Difference between revisions of "Ksmbd-review"

From SambaWiki
m
m
Line 33: Line 33:
 
|-
 
|-
 
| Disable unsafe legacy dialects like SMB1
 
| Disable unsafe legacy dialects like SMB1
| SMB2 and SMB1 ("CIFS") support already removed. Newer secure dialects are supported
+
| Already done. SMB2 and SMB1 ("CIFS") can not be negotiated, and only newer secure dialects are supported (like SMB2.1, SMB3 and SMB3.1.1
|
+
|
 
| There are some unused function (relating to SMB1 and SMB2) that can be removed in the future.
 
| There are some unused function (relating to SMB1 and SMB2) that can be removed in the future.
 
|-
 
|-

Revision as of 02:53, 22 September 2021

There are various checks that are especially important for SMB3 servers. They fall into multiple categories:

  • packet processing checks to make sure buffers do not overflow, allowing access to data outside the SMB request
  • path processing checks to make sure access to files outside the share is not permitted, these include checks for ".." or "../.." to make sure they do not go outside the share, and checks for symlinks in paths and checks to ensure paths do not allow a processed path e.g. with "\" or "/" to go outside the share. These primarily impact three operations (open, query directory and rename) as unlike SMB1 most SMB2/SMB3 operations are handle based, not path based.
  • denial of service and resource checks (e.g. ensure that no single client can exhaust the server by opening millions of files, or use so many credits that they submit thousands of simultaneous requests starving other clients)

In addition, it is important that servers only implement reasonably secure dialects and authentication mechanisms by default. For example SMB2.1 or later supports protection against "man in the middle" attacks, and this is the minimum version supported by default with ksmbd (SMB2.0 and SMB1/CIFS is not supported). In addition, NTLMv1 authentication should be disabled (NTLMv2 can be allowed, although 8 character and longer passwords may be a good minimum to require by default). Kerberos authentication should also be supported. In the longer run, especially to support Macs (which allow at least two additional peer-to-peer authentication mechanisms which look promising) we can consider adding additional mechanisms, but currently NTLMv2 (encapsulated in NTLMSSP during negotiation) is for "peer to peer" use cases, and Kerberos for domain joined cases, and those are broadly supported by most clients.

SMB3.1.1 supports very strong signing and encryption options (e.g. GCM256 encryption), and it may be helpful to ensure that users know about the advantages of using current SMB3.1.1 so they don't choose less secure options.

ksmbd implementation of optional security features in the protocol
Feature Status (submitted, reviewed) Function(s) including the check (and patch name if not included yet) Additional work if any
SMB3.1.1 (many useful security features in newest dialect SMB3.1.1) Already implemented
Encryption (strongest encryption) Already implemented (strongest encryption GCM256, and CCM and GCM128 also supported) Recent testing ran into some problems negotiating encryption.
Packet signing (helps guard against "man in the middle" attacks) Already implemented (CMAC) Should support for GMAC signing also be added? It is faster but only supported by newest Windows
Disable unsafe legacy dialects like SMB1 Already done. SMB2 and SMB1 ("CIFS") can not be negotiated, and only newer secure dialects are supported (like SMB2.1, SMB3 and SMB3.1.1 There are some unused function (relating to SMB1 and SMB2) that can be removed in the future.
Support for Kerberos Already implemented
Disable insecure auth mechanisms (e.g. NTLMv1)
Minimum password length configurable for local users 8 character minimum password length is default for some servers (Samba and ksmbd should add a minimum password length check by default)
Support for per-file encryption (allowing setting the encryption flag for file in local fs)
ACL support Already implemented
Packet processing checks in ksmbd
Type of check Status (submitted, reviewed) Function(s) including the check (and patch name if not included yet) Additional work if any
SMB3 header validation Already implemented See ksmbd_smb2_check_message function in smb2misc.c and ksmbd_verify_smb_message
StructureSize field check for all 19 SMB3 commands Already implemented See smb2_get_data_area_len function and smb2_req_struct_sizes in smb2misc.c SMB3.1.1
check for overflow of SET_INFO command patches submitted, partially reviewed "ksmbd: add request buffer validation in smb2_set_info"
check for overflow of FSCTL command patch submitted, partially reviewed "ksmbd: add validation in smb2_ioctl", smb2pdu.c
Generic check for packet overflow Already implmented See ksmb2_check_message and smb2_calc_size functions
Packet Signing Check (for packet corruption and man-in-the-middle attacks) Already implemented check_sign_req function in smb2pdu.c
Check for open context overflow patch submitted, partially reviewed See "ksmbd: add buffer validation for SMB2_CREATE_CONTEXT", oplock.c smb2pdu.c
Check for overflow of ACL patch submitted, partially reviewed See "ksmbd: add buffer validation for SMB2_CREATE_CONTEXT", smbacl.c (parse_dacl and parse_sec_desc functions)
Check for negotiate context overflow Already implemented See deassemble_neg_contexts function (in smb2pdu.c) and also decode_encrypt_context and decode_sign_cap_ctxt Some contexts (such as compression context) are ignored (set to none) and may need additional checks in future when implemented
Path processing checks in ksmbd
Type of check Status (submitted, reviewed) Function(s) including the check (and patch name if not included yet) Additional work if any
checks for .. escaping the share patch submitted, reviewed, tested multiple ways (libsmb2, smbclient) "ksmbd: prevent out of share access" (see ksmbd_conv_path_to_unix function in misc.c and its use in smb2pdu.c)
checks for symlinks in path components patch submitted, partially reviewed "ksmbd: use LOOKUP_NO_SYMLINKS flags for default lookup" See smb2_open, and ksmbd_vfs_create, ksmbd_vfs_mkdir, ksmb_vfs_link and ksmbd_remove_file and ksmbd_vfs_fp_rename
checks for resolved path never being / or \ (outside the share) (also see additional restrictions made possible by ksmbd_share_veto_filename function in mgmt/share_config.c, and ksmbd_validate_filename in misc.c)


Denial of Service checks
Type of check Status (submitted, reviewed) Function(s) including the check (and patch name if not included yet) Additional work if any
checks for opening too many files Would additional checks be helpful e.g. see smb2_open in smb2pdu.c and ksmbd_open_fd in vfs_cache.c?
checks for allowing too many requests (crediting) See smb2_set_rsp_credits and conn->max_credits field, and conn->total_credits in smb2_consume_credit_charge to investigate this

Also helpful will be a careful re-review of each of the PDU processing functions, ideally two reviews for each of the below. See below.

  1. smb2 header (Reviewer: )
    • structure : smb2_hdr
    • validation function : ksmbd_smb2_check_message()
  2. smb2 negotiate (Reviewer: )
    • structure : smb2_negotiate_req
    • validation functioin : smb2_handle_negotiate()
  3. negotiate context (Reviewer: )
    • structure : smb2_neg_context, smb2_preauth_neg_context, smb2_encryption_neg_context, smb2_compression_ctx, smb2_posix_neg_context
    • validation function : deassemble_neg_contexts()
  4. smb2 session setup (Reviewer: )
    • structure : smb2_sess_setup_req
    • validation function : smb2_sess_setup()
  5. smb2 session logoff (Reviewer: )
    • struture : smb2_logoff_req
    • validation functioin : smb2_session_logoff()
  6. smb2 tree connect (Reviewer: )
    • structure : smb2_tree_connect_req
    • validation function : smb2_tree_connect()
  7. smb2 tree disconnect (Reviewer: )
    • structure : smb2_tree_disconnect_req
    • validation function : smb2_tree_disconnect()
  8. smb2 create (Reviewer: )
    1. smb2 create
      • structure : smb2_create_req
      • validation function : smb2_open()
    2. create context
      • structure : create_context, create_mxac_req, create_alloc_size_req,create_posix, lease_context, lease_context_v2
      • validation function : smb2_find_context_vals(), smb2_open()
  9. smb2 close (Reviewer: )
      • structure : smb2_close_req
      • validation function : smb2_close()
  10. smb2 flush (Reviewer: )
      • structure : smb2_flush_req
      • validation function : smb2_flush()
  11. smb2 read (Reviewer: )
      • structure : smb2_read_req
      • validation function : smb2_read()
  12. smb2 write (Reviewer: )
      • structure : smb2_write_req
      • validation function : smb2_write()
  13. smb2 ioctl (Reviewer: )
    1. FSCTL_VALIDATE_NEGOTIATE_INFO
      • strcture : validate_negotiate_info_req
      • validation function : smb2_ioctl(), fsctl_validate_negotiate_info()
    2. FSCTL_QUERY_NETWORK_INTERFACE_INFO
      • structure : network_interface_info_ioctl_rsp
      • validation functioin : fsctl_query_iface_info_ioctl()
    3. FSCTL_COPYCHUNK
      • structure : copychunk_ioctl_req
      • validation function : smb2_ioctl(), fsctl_copychunk()
    4. FSCTL_SET_SPARSE
      • structure : file_sparse
      • validation function : smb2_ioctl()
    5. FSCTL_SET_ZERO_DATA
      • structure : file_zero_data_information
      • validation function : smb2_ioctl()
    6. FSCTL_REQUEST_RESUME_KEY
      • structure : resume_key_ioctl_rsp
      • validation function : smb2_ioctl()
    7. FSCTL_QUERY_ALLOCATED_RANGES
      • structure : file_allocated_range_buffer
      • validation function : smb2_ioctl()
    8. FSCTL_GET_REPARSE_POINT
    9. FSCTL_DUPLICATE_EXTENTS_TO_FILE
      • structure : duplicate_extents_to_file
      • validation function : smb2_ioctl()
    10. FSCTL_PIPE_TRANSCEIVE
      • validation function : fsctl_pipe_transceive()
    11. FSCTL_CREATE_OR_GET_OBJECT_ID
      • structure : file_object_buf_type1_ioctl_rsp
      • validation function : smb2_ioctl()
  14. smb2 change notify (Reviewer: )
    • structure : smb2_notify_req
    • validation function : smb2_notify()
  15. smb2 lock (Reviewer: )
    • structure : smb2_lock_req
    • validation functioin : smb2_lock()
  16. smb2 echo (Reviewer: Ronnie Sahlberg, Steve French, tested by: Steve French )
    • structure : smb2_echo_req
    • validation function : smb2_echo()
  17. smb2 query directory (Reviewer: )
    • smb2_query_directory_req
    • validation function : smb2_query_dir()
  18. smb2 query info (Reviewer: )
    1. SMB2_O_INFO_FILE
      1. FILE_ACCESS_INFORMATION
        • structure : smb2_file_access_info
        • validation function : get_file_access_info()
      2. FILE_BASIC_INFORMATION
        • structure : smb2_file_all_info
        • validation function : get_file_basic_info()
      3. FILE_STANDARD_INFORMATION
        • structure : smb2_file_standard_info
        • validation function : get_file_standard_info()
      4. FILE_ALIGNMENT_INFORMATION
        • structure : smb2_file_alignment_info
        • validation function : get_file_alignment_info()
      5. FILE_ALL_INFORMATION
        • structure : smb2_file_all_info
        • validation function : get_file_all_info()
      6. FILE_ALTERNATE_NAME_INFORMATION
        • structure : smb2_file_alt_name_info
        • validation function : get_file_alternate_info()
      7. FILE_STREAM_INFORMATION
        • structure : smb2_file_stream_info
        • validation function : get_file_stream_info()
      8. FILE_INTERNAL_INFORMATION
        • structure : smb2_file_internal_info
        • validation function : get_file_internal_info()
      9. FILE_NETWORK_OPEN_INFORMATION
        • structure : smb2_file_ntwrk_info
        • validation function : get_file_network_open_info()
      10. FILE_EA_INFORMATION
        • structure : smb2_file_ea_info
        • validation function : get_file_ea_info()
      11. FILE_FULL_EA_INFORMATION
        • structure : smb2_ea_info
        • validation function : smb2_get_ea()
      12. FILE_POSITION_INFORMATION
        • structure : smb2_file_pos_info
        • validation function : get_file_position_info()
      13. FILE_MODE_INFORMATION
        • structure : smb2_file_mode_info
        • validation function : get_file_mode_info()
      14. FILE_POSITION_INFORMATION
        • structure : smb2_file_pos_info
        • validation function : get_file_position_info()
      15. FILE_MODE_INFORMATION
        • structure : smb2_file_mode_info
        • validation function : get_file_mode_info()
      16. FILE_COMPRESSION_INFORMATION
        • structure : smb2_file_comp_info
        • validation function : get_file_compression_info()
      17. FILE_ATTRIBUTE_TAG_INFORMATION
        • structure : smb2_file_attr_tag_info
        • validation function : get_file_attribute_tag_info()
      18. SMB_FIND_FILE_POSIX_INFO
        • structure : smb311_posix_qinfo
        • validation function : find_file_posix_info()
    2. SMB2_O_INFO_FILESYSTEM
      1. FS_DEVICE_INFORMATION
        • structure : filesystem_device_info
        • validation function : smb2_get_info_filesystem()
      2. FS_ATTRIBUTE_INFORMATION
        • structure : filesystem_attribute_info
        • validation function : smb2_get_info_filesystem()
      3. FS_VOLUME_INFORMATION
        • structure : filesystem_vol_info
        • validation function : smb2_get_info_filesystem()
      4. FS_SIZE_INFORMATION
        • structure : filesystem_info
        • validation function : smb2_get_info_filesystem()
      5. FS_FULL_SIZE_INFORMATION
        • structure : smb2_fs_full_size_info
        • validation function : smb2_get_info_filesystem()
      6. FS_OBJECT_ID_INFORMATION
        • structure : object_id_info
        • validation function : smb2_get_info_filesystem()
      7. FS_SECTOR_SIZE_INFORMATION
        • structure : smb3_fs_ss_info
        • validation function : smb2_get_info_filesystem()
      8. FS_CONTROL_INFORMATION
        • structure : smb2_fs_control_info
        • validation function : smb2_get_info_filesystem()
      9. FS_POSIX_INFORMATION
        • structure : filesystem_posix_info
        • validation function : smb2_get_info_filesystem()
    3. SMB2_O_INFO_SECURITY
      • structure : smb_ntsd, smb_acl, smb_ace, smb_sid
      • validation function : build_sec_desc()
  19. smb2 set info (Reviewer: )
    1. SMB2_O_INFO_FILE
      1. FILE_BASIC_INFORMATION
        • structure : smb2_file_basic_info
        • validation functioin : smb2_set_info_file()
      2. FILE_ALLOCATION_INFORMATION
        • structure : smb2_file_alloc_info
        • validation functioin : smb2_set_info_file()
      3. FILE_END_OF_FILE_INFORMATION
        • structure : smb2_file_eof_info
        • validation functioin : smb2_set_info_file()
      4. FILE_RENAME_INFORMATION
        • structure : smb2_file_rename_info
        • validation functioin : smb2_set_info_file(), set_rename_info()
      5. FILE_LINK_INFORMATION
        • structure : smb2_file_link_info
        • validation functioin : smb2_create_link()
      6. FILE_DISPOSITION_INFORMATION
        • structure : smb2_file_disposition_info
        • validation functioin : smb2_set_info_file()
      7. FILE_FULL_EA_INFORMATION
      8. structure : smb2_ea_info
      9. validation functioin : smb2_set_info_file(), smb2_set_ea
      10. FILE_POSITION_INFORMATION
        • structure : smb2_file_pos_info
        • validation functioin : smb2_set_info_file()
      11. FILE_MODE_INFORMATION
        • structure : smb2_file_mode_info
        • validation functioin : smb2_set_info_file()
    2. SMB2_O_INFO_SECURITY
      • structure : smb_ntsd, smb_acl, smb_ace, smb_sid
      • validation function : parse_sec_desc()
  20. smb2 oplock break ack (Reviewer: )
    • structure : smb2_oplock_break
    • validation function : smb20_oplock_break_ack()
  21. smb2 lease break ack (Reviewer: )
    • structure : smb2_lease_ack
    • validation function : smb21_lease_break_ack()