|
| 1 | +.. SPDX-License-Identifier: GPL-2.0 |
| 2 | +
|
| 3 | +========================= |
| 4 | +CIFSD - SMB3 Kernel Server |
| 5 | +========================= |
| 6 | + |
| 7 | +CIFSD is a linux kernel server which implements SMB3 protocol in kernel space |
| 8 | +for sharing files over network. |
| 9 | + |
| 10 | +CIFSD architecture |
| 11 | +================== |
| 12 | + |
| 13 | +The subset of performance related operations belong in kernelspace and |
| 14 | +the other subset which belong to operations which are not really related with |
| 15 | +performance in userspace. So, DCE/RPC management that has historically resulted |
| 16 | +into number of buffer overflow issues and dangerous security bugs and user |
| 17 | +account management are implemented in user space as ksmbd.mountd. |
| 18 | +File operations that are related with performance (open/read/write/close etc.) |
| 19 | +in kernel space (ksmbd). This also allows for easier integration with VFS |
| 20 | +interface for all file operations. |
| 21 | + |
| 22 | +ksmbd (kernel daemon) |
| 23 | +--------------------- |
| 24 | + |
| 25 | +When the server daemon is started, It starts up a forker thread |
| 26 | +(ksmbd/interface name) at initialization time and open a dedicated port 445 |
| 27 | +for listening to SMB requests. Whenever new clients make request, Forker |
| 28 | +thread will accept the client connection and fork a new thread for dedicated |
| 29 | +communication channel between the client and the server. It allows for parallel |
| 30 | +processing of SMB requests(commands) from clients as well as allowing for new |
| 31 | +clients to make new connections. Each instance is named ksmbd/1~n(port number) |
| 32 | +to indicate connected clients. Depending on the SMB request types, each new |
| 33 | +thread can decide to pass through the commands to the user space (ksmbd.mountd), |
| 34 | +currently DCE/RPC commands are identified to be handled through the user space. |
| 35 | +To further utilize the linux kernel, it has been chosen to process the commands |
| 36 | +as workitems and to be executed in the handlers of the ksmbd-io kworker threads. |
| 37 | +It allows for multiplexing of the handlers as the kernel take care of initiating |
| 38 | +extra worker threads if the load is increased and vice versa, if the load is |
| 39 | +decreased it destroys the extra worker threads. So, after connection is |
| 40 | +established with client. Dedicated ksmbd/1..n(port number) takes complete |
| 41 | +ownership of receiving/parsing of SMB commands. Each received command is worked |
| 42 | +in parallel i.e., There can be multiple clients commands which are worked in |
| 43 | +parallel. After receiving each command a separated kernel workitem is prepared |
| 44 | +for each command which is further queued to be handled by ksmbd-io kworkers. |
| 45 | +So, each SMB workitem is queued to the kworkers. This allows the benefit of load |
| 46 | +sharing to be managed optimally by the default kernel and optimizing client |
| 47 | +performance by handling client commands in parallel. |
| 48 | + |
| 49 | +ksmbd.mountd (user space daemon) |
| 50 | +-------------------------------- |
| 51 | + |
| 52 | +ksmbd.mountd is userspace process to, transfer user account and password that |
| 53 | +are registered using ksmbd.adduser(part of utils for user space). Further it |
| 54 | +allows sharing information parameters that parsed from smb.conf to ksmbd in |
| 55 | +kernel. For the execution part it has a daemon which is continuously running |
| 56 | +and connected to the kernel interface using netlink socket, it waits for the |
| 57 | +requests(dcerpc and share/user info). It handles RPC calls (at a minimum few |
| 58 | +dozen) that are most important for file server from NetShareEnum and |
| 59 | +NetServerGetInfo. Complete DCE/RPC response is prepared from the user space |
| 60 | +and passed over to the associated kernel thread for the client. |
| 61 | + |
| 62 | +Key Features |
| 63 | +============ |
| 64 | + |
| 65 | +The supported features are: |
| 66 | + * SMB3 protocols for basic file sharing |
| 67 | + * Auto negotiation |
| 68 | + * Compound requests |
| 69 | + * Oplock/Lease |
| 70 | + * Large MTU |
| 71 | + * NTLM/NTLMv2 |
| 72 | + * HMAC-SHA256 Signing |
| 73 | + * Secure negotiate |
| 74 | + * Signing Update |
| 75 | + * Pre-authentication integrity(SMB 3.1.1) |
| 76 | + * SMB3 encryption(CCM, GCM) |
| 77 | + * SMB direct(RDMA) |
| 78 | + * SMB3.1.1 POSIX extension support |
| 79 | + * ACLs |
| 80 | + * Kerberos |
| 81 | + |
| 82 | +The features that are planned or not supported: |
| 83 | + * SMB3 Multi-channel |
| 84 | + * Durable handle v1,v2 |
| 85 | + * Persistent handles |
| 86 | + * Directory lease |
| 87 | + * SMB2 notify |
| 88 | + |
| 89 | +How to run |
| 90 | +========== |
| 91 | + |
| 92 | +1. Download ksmbd-tools and compile them. |
| 93 | + - https://github.com/cifsd-team/ksmbd-tools |
| 94 | + |
| 95 | +2. Create user/password for SMB share. |
| 96 | + |
| 97 | + # mkdir /etc/ksmbd/ |
| 98 | + # ksmbd.adduser -a <Enter USERNAME for SMB share access> |
| 99 | + |
| 100 | +3. Create /etc/ksmbd/smb.conf file, add SMB share in smb.conf file |
| 101 | + - Refer smb.conf.example and Documentation/configuration.txt |
| 102 | + in ksmbd-tools |
| 103 | + |
| 104 | +4. Insert ksmbd.ko module |
| 105 | + |
| 106 | + # insmod ksmbd.ko |
| 107 | + |
| 108 | +5. Start ksmbd user space daemon |
| 109 | + # ksmbd.mountd |
| 110 | + |
| 111 | +6. Access share from Windows or Linux using CIFS |
| 112 | + |
| 113 | +Shutdown CIFSD |
| 114 | +============== |
| 115 | + |
| 116 | +1. kill user and kernel space daemon |
| 117 | + # sudo ksmbd.control -s |
| 118 | + |
| 119 | +How to turn debug print on |
| 120 | +========================== |
| 121 | + |
| 122 | +Each layer |
| 123 | +/sys/class/ksmbd-control/debug |
| 124 | + |
| 125 | +1. Enable all component prints |
| 126 | + # sudo ksmbd.control -d "all" |
| 127 | + |
| 128 | +2. Enable one of components(smb, auth, vfs, oplock, ipc, conn, rdma) |
| 129 | + # sudo ksmbd.control -d "smb" |
| 130 | + |
| 131 | +3. Show what prints are enable. |
| 132 | + # cat/sys/class/ksmbd-control/debug |
| 133 | + [smb] auth vfs oplock ipc conn [rdma] |
| 134 | + |
| 135 | +4. Disable prints: |
| 136 | + If you try the selected component once more, It is disabled without brackets. |
0 commit comments