Ksmbd-review

From SambaWiki
Revision as of 05:59, 9 October 2021 by Namjae Jeon (talk | contribs) (update checks for allowing too many requests (crediting) section)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Ksmbd checks

There are various checks that are especially important for SMB3 servers. They fall into multiple categories:

  • packet processing checks to make sure buffers do not overflow, allowing access to data outside the SMB request
  • path processing checks to make sure access to files outside the share is not permitted, these include checks for ".." or "../.." to make sure they do not go outside the share, and checks for symlinks in paths and checks to ensure paths do not allow a processed path e.g. with "\" or "/" to go outside the share. These primarily impact three operations (open, query directory and rename) as unlike SMB1 most SMB2/SMB3 operations are handle based, not path based.
  • denial of service and resource checks (e.g. ensure that no single client can exhaust the server by opening millions of files, or use so many credits that they submit thousands of simultaneous requests starving other clients)

In addition, it is important that servers only implement reasonably secure dialects and authentication mechanisms by default. For example SMB2.1 or later supports protection against "man in the middle" attacks, and this is the minimum version supported by default with ksmbd (SMB2.0 and SMB1/CIFS is not supported). In addition, NTLMv1 authentication should be disabled (NTLMv2 can be allowed, although 8 character and longer passwords may be a good minimum to require by default). Kerberos authentication should also be supported. In the longer run, especially to support Macs (which allow at least two additional peer-to-peer authentication mechanisms which look promising) we can consider adding additional mechanisms, but currently NTLMv2 (encapsulated in NTLMSSP during negotiation) is for "peer to peer" use cases, and Kerberos for domain joined cases, and those are broadly supported by most clients.

SMB3.1.1 supports very strong signing and encryption options (e.g. GCM256 encryption), and it may be helpful to ensure that users know about the advantages of using current SMB3.1.1 so they don't choose less secure options.

Optional security features

ksmbd implementation of optional security features in the protocol
Feature Status (submitted, reviewed) Function(s) including the check (and patch name if not included yet) Additional work if any
SMB3.1.1 (many useful security features in newest dialect SMB3.1.1) Already implemented
Encryption (strongest encryption) Already implemented (strongest encryption GCM256, and CCM and GCM128 also supported) See decode_encrypt_context in smb2pdu.c (and routines like generate_key in auth.c) It may be confusing for some users that encryption is turned off by default (must add "smb3 encryption = yes" to /etc/ksmbd/smb.conf to allow client to negotiate encryption). Should probably be enabled by default
Packet signing (helps guard against "man in the middle" attacks) Already implemented (CMAC), as is the new signing capability context which Windows clients now support See decode_sign_cap_ctxt function in smb2pdu.c GMAC signing is faster but only supported by newest Windows, will be useful to see how much faster GMAC is when negotiated instead of the default for most clients (CMAC).
Disable unsafe legacy dialects like SMB1 Already done. SMB2 and SMB1 ("CIFS") can not be negotiated, and only newer secure dialects are supported (like SMB2.1, SMB3 and SMB3.1.1 There are some unused function (relating to SMB1 and SMB2) that can be removed in the future.
Support for Kerberos Already implemented
Disable insecure auth mechanisms (e.g. NTLMv1) Patches submitted
Minimum password length configurable for local users Patches submitted __prompt_password_stdin function in adduser/user_admin.c 8 character minimum password length is default for some servers but not Samba and ksmbd. Samba and ksmbd should add a minimum password length check by default.
Support for per-file encryption (allowing setting the encryption flag for file in local fs)
ACL support Already implemented

Packet processing checks

Packet processing checks in ksmbd
Type of check Status (submitted, reviewed) Function(s) including the check (and patch name if not included yet) Additional work if any
SMB3 header validation Already implemented See ksmbd_smb2_check_message function in smb2misc.c and ksmbd_verify_smb_message
StructureSize field check for all 19 SMB3 commands Already implemented See smb2_get_data_area_len function and smb2_req_struct_sizes in smb2misc.c
Checks for validity of compounded SMB3 requests Patches submitted (partially reviewed) See init_chained_smb2_rsp in smb2pdu.c
check for overflow of SET_INFO command patches submitted, partially reviewed "ksmbd: add request buffer validation in smb2_set_info"
check for overflow of FSCTL command patch submitted, partially reviewed "ksmbd: add validation in smb2_ioctl", smb2pdu.c
Generic check for packet overflow Already implmented See ksmb2_check_message and smb2_calc_size functions
Packet Signing Check (for packet corruption and man-in-the-middle attacks) Already implemented check_sign_req function in smb2pdu.c
Check for open context overflow patch submitted, partially reviewed See "ksmbd: add buffer validation for SMB2_CREATE_CONTEXT", oplock.c smb2pdu.c
Check for overflow of ACL patch submitted, partially reviewed See "ksmbd: add buffer validation for SMB2_CREATE_CONTEXT", smbacl.c (parse_dacl and parse_sec_desc functions)
Check for negotiate context overflow Already implemented See deassemble_neg_contexts function (in smb2pdu.c) and also decode_encrypt_context and decode_sign_cap_ctxt Some contexts (such as compression context) are ignored (set to none) and may need additional checks in future when implemented

Path processing checks

Path processing checks in ksmbd
Type of check Status (submitted, reviewed) Function(s) including the check (and patch name if not included yet) Additional work if any
checks for .. escaping the share Already implemented (and verified). See "ksmbd: prevent out of share access" merged (see ksmbd_conv_path_to_unix function in misc.c and its use in smb2pdu.c)
checks for symlinks in path components Already implemented and verified "ksmbd: use LOOKUP_NO_SYMLINKS flags for default lookup" and "ksmbd: use LOOKUP_BENEATH to prevent the out of share." See smb2_open, and ksmbd_vfs_create, ksmbd_vfs_mkdir, ksmb_vfs_link and ksmbd_remove_file and ksmbd_vfs_fp_rename
checks for resolved path never being / or \ (outside the share) Already implmented (also see additional restrictions made possible by ksmbd_share_veto_filename function in mgmt/share_config.c, and ksmbd_validate_filename in misc.c)
Rate limiting session setup access denied failures to limit dictionary attacks

Denial of Service checks

Denial of Service checks
Type of check Status (submitted, reviewed) Function(s) including the check (and patch name if not included yet) Additional work if any
checks for opening too many files Already implemented, can run smb2.maxfid smbtorture test to verify it. smb2_open in smb2pdu.c -> ksmbd_open_fd in vfs_cache.c -> _open_id -> fd_limit_depleted.
checks for allowing too many requests (crediting) patch submitted See smb2_set_rsp_credits and conn->max_credits field, and conn->total_credits in smb2_validate_credit_charge to investigate this

PDU processing functions

Also helpful will be a careful re-review of each of the PDU processing functions, ideally two reviews for each of the below. See below.

  1. smb2 header (Reviewer: )
    • structure : smb2_hdr
    • validation function : ksmbd_smb2_check_message()
  2. smb2 negotiate (Reviewer: )
    • structure : smb2_negotiate_req
    • validation functioin : smb2_handle_negotiate()
  3. negotiate context (Reviewer: )
    • structure : smb2_neg_context, smb2_preauth_neg_context, smb2_encryption_neg_context, smb2_compression_ctx, smb2_posix_neg_context
    • validation function : deassemble_neg_contexts()
  4. smb2 session setup (Reviewer: )
    • structure : smb2_sess_setup_req
    • validation function : smb2_sess_setup()
  5. smb2 session logoff (Reviewer: )
    • struture : smb2_logoff_req
    • validation functioin : smb2_session_logoff()
  6. smb2 tree connect (Reviewer: )
    • structure : smb2_tree_connect_req
    • validation function : smb2_tree_connect()
  7. smb2 tree disconnect (Reviewer: )
    • structure : smb2_tree_disconnect_req
    • validation function : smb2_tree_disconnect()
  8. smb2 create (Reviewer: )
    1. smb2 create
      • structure : smb2_create_req
      • validation function : smb2_open()
    2. create context
      • structure : create_context, create_mxac_req, create_alloc_size_req,create_posix, lease_context, lease_context_v2
      • validation function : smb2_find_context_vals(), smb2_open()
  9. smb2 close (Reviewer: )
      • structure : smb2_close_req
      • validation function : smb2_close()
  10. smb2 flush (Reviewer: )
      • structure : smb2_flush_req
      • validation function : smb2_flush()
  11. smb2 read (Reviewer: )
      • structure : smb2_read_req
      • validation function : smb2_read()
  12. smb2 write (Reviewer: )
      • structure : smb2_write_req
      • validation function : smb2_write()
  13. smb2 ioctl (Reviewer: )
    1. FSCTL_VALIDATE_NEGOTIATE_INFO
      • strcture : validate_negotiate_info_req
      • validation function : smb2_ioctl(), fsctl_validate_negotiate_info()
    2. FSCTL_QUERY_NETWORK_INTERFACE_INFO
      • structure : network_interface_info_ioctl_rsp
      • validation functioin : fsctl_query_iface_info_ioctl()
    3. FSCTL_COPYCHUNK
      • structure : copychunk_ioctl_req
      • validation function : smb2_ioctl(), fsctl_copychunk()
    4. FSCTL_SET_SPARSE
      • structure : file_sparse
      • validation function : smb2_ioctl()
    5. FSCTL_SET_ZERO_DATA
      • structure : file_zero_data_information
      • validation function : smb2_ioctl()
    6. FSCTL_REQUEST_RESUME_KEY
      • structure : resume_key_ioctl_rsp
      • validation function : smb2_ioctl()
    7. FSCTL_QUERY_ALLOCATED_RANGES
      • structure : file_allocated_range_buffer
      • validation function : smb2_ioctl()
    8. FSCTL_GET_REPARSE_POINT
    9. FSCTL_DUPLICATE_EXTENTS_TO_FILE
      • structure : duplicate_extents_to_file
      • validation function : smb2_ioctl()
    10. FSCTL_PIPE_TRANSCEIVE
      • validation function : fsctl_pipe_transceive()
    11. FSCTL_CREATE_OR_GET_OBJECT_ID
      • structure : file_object_buf_type1_ioctl_rsp
      • validation function : smb2_ioctl()
  14. smb2 change notify (Reviewer: )
    • structure : smb2_notify_req
    • validation function : smb2_notify()
  15. smb2 lock (Reviewer: )
    • structure : smb2_lock_req
    • validation functioin : smb2_lock()
  16. smb2 echo (Reviewer: Ronnie Sahlberg, Steve French, tested by: Steve French )
    • structure : smb2_echo_req
    • validation function : smb2_echo()
  17. smb2 query directory (Reviewer: )
    • smb2_query_directory_req
    • validation function : smb2_query_dir()
  18. smb2 query info (Reviewer: )
    1. SMB2_O_INFO_FILE
      1. FILE_ACCESS_INFORMATION
        • structure : smb2_file_access_info
        • validation function : get_file_access_info()
      2. FILE_BASIC_INFORMATION
        • structure : smb2_file_all_info
        • validation function : get_file_basic_info()
      3. FILE_STANDARD_INFORMATION
        • structure : smb2_file_standard_info
        • validation function : get_file_standard_info()
      4. FILE_ALIGNMENT_INFORMATION
        • structure : smb2_file_alignment_info
        • validation function : get_file_alignment_info()
      5. FILE_ALL_INFORMATION
        • structure : smb2_file_all_info
        • validation function : get_file_all_info()
      6. FILE_ALTERNATE_NAME_INFORMATION
        • structure : smb2_file_alt_name_info
        • validation function : get_file_alternate_info()
      7. FILE_STREAM_INFORMATION
        • structure : smb2_file_stream_info
        • validation function : get_file_stream_info()
      8. FILE_INTERNAL_INFORMATION
        • structure : smb2_file_internal_info
        • validation function : get_file_internal_info()
      9. FILE_NETWORK_OPEN_INFORMATION
        • structure : smb2_file_ntwrk_info
        • validation function : get_file_network_open_info()
      10. FILE_EA_INFORMATION
        • structure : smb2_file_ea_info
        • validation function : get_file_ea_info()
      11. FILE_FULL_EA_INFORMATION
        • structure : smb2_ea_info
        • validation function : smb2_get_ea()
      12. FILE_POSITION_INFORMATION
        • structure : smb2_file_pos_info
        • validation function : get_file_position_info()
      13. FILE_MODE_INFORMATION
        • structure : smb2_file_mode_info
        • validation function : get_file_mode_info()
      14. FILE_POSITION_INFORMATION
        • structure : smb2_file_pos_info
        • validation function : get_file_position_info()
      15. FILE_MODE_INFORMATION
        • structure : smb2_file_mode_info
        • validation function : get_file_mode_info()
      16. FILE_COMPRESSION_INFORMATION
        • structure : smb2_file_comp_info
        • validation function : get_file_compression_info()
      17. FILE_ATTRIBUTE_TAG_INFORMATION
        • structure : smb2_file_attr_tag_info
        • validation function : get_file_attribute_tag_info()
      18. SMB_FIND_FILE_POSIX_INFO
        • structure : smb311_posix_qinfo
        • validation function : find_file_posix_info()
    2. SMB2_O_INFO_FILESYSTEM
      1. FS_DEVICE_INFORMATION
        • structure : filesystem_device_info
        • validation function : smb2_get_info_filesystem()
      2. FS_ATTRIBUTE_INFORMATION
        • structure : filesystem_attribute_info
        • validation function : smb2_get_info_filesystem()
      3. FS_VOLUME_INFORMATION
        • structure : filesystem_vol_info
        • validation function : smb2_get_info_filesystem()
      4. FS_SIZE_INFORMATION
        • structure : filesystem_info
        • validation function : smb2_get_info_filesystem()
      5. FS_FULL_SIZE_INFORMATION
        • structure : smb2_fs_full_size_info
        • validation function : smb2_get_info_filesystem()
      6. FS_OBJECT_ID_INFORMATION
        • structure : object_id_info
        • validation function : smb2_get_info_filesystem()
      7. FS_SECTOR_SIZE_INFORMATION
        • structure : smb3_fs_ss_info
        • validation function : smb2_get_info_filesystem()
      8. FS_CONTROL_INFORMATION
        • structure : smb2_fs_control_info
        • validation function : smb2_get_info_filesystem()
      9. FS_POSIX_INFORMATION
        • structure : filesystem_posix_info
        • validation function : smb2_get_info_filesystem()
    3. SMB2_O_INFO_SECURITY
      • structure : smb_ntsd, smb_acl, smb_ace, smb_sid
      • validation function : build_sec_desc()
  19. smb2 set info (Reviewer: )
    1. SMB2_O_INFO_FILE
      1. FILE_BASIC_INFORMATION
        • structure : smb2_file_basic_info
        • validation functioin : smb2_set_info_file()
      2. FILE_ALLOCATION_INFORMATION
        • structure : smb2_file_alloc_info
        • validation functioin : smb2_set_info_file()
      3. FILE_END_OF_FILE_INFORMATION
        • structure : smb2_file_eof_info
        • validation functioin : smb2_set_info_file()
      4. FILE_RENAME_INFORMATION
        • structure : smb2_file_rename_info
        • validation functioin : smb2_set_info_file(), set_rename_info()
      5. FILE_LINK_INFORMATION
        • structure : smb2_file_link_info
        • validation functioin : smb2_create_link()
      6. FILE_DISPOSITION_INFORMATION
        • structure : smb2_file_disposition_info
        • validation functioin : smb2_set_info_file()
      7. FILE_FULL_EA_INFORMATION
      8. structure : smb2_ea_info
      9. validation functioin : smb2_set_info_file(), smb2_set_ea
      10. FILE_POSITION_INFORMATION
        • structure : smb2_file_pos_info
        • validation functioin : smb2_set_info_file()
      11. FILE_MODE_INFORMATION
        • structure : smb2_file_mode_info
        • validation functioin : smb2_set_info_file()
    2. SMB2_O_INFO_SECURITY
      • structure : smb_ntsd, smb_acl, smb_ace, smb_sid
      • validation function : parse_sec_desc()
  20. smb2 oplock break ack (Reviewer: )
    • structure : smb2_oplock_break
    • validation function : smb20_oplock_break_ack()
  21. smb2 lease break ack (Reviewer: )
    • structure : smb2_lease_ack
    • validation function : smb21_lease_break_ack()