search

namjaejeon / ksmbd

ksmbd kernel server(SMB/CIFS server)
https://github.com/cifsd-team/ksmbd
270 stars 62 forks source link

Total credits overflow: 1 for SMB 2.0.2 #392

Closed peclik closed 2 years ago

peclik commented 2 years ago

ksmbd 3.4.4

Problem: I have HP Color LaserJet MFP M281fdn. CONFIG_SMB_INSECURE_SERVERmust be enabled (negotiation starts with SMB1). When trying to scan from the printer to a network share, ksmbd reports

Total credits overflow: 1

Proposed solution: Add .max_credits = SMB2_MAX_CREDITS, into static struct smb_version_values smb20_server_values

Attached is a pcap after patch has been applied (192.168.20.108 is the printer, 192.168.20.5 is ksmbd) M281fdn-Samba-test.zip

namjaejeon commented 2 years ago

Thanks for your report and solution! can you send the patch to linux-cifsd-devel@lists.sourceforge.net ?

mmakassikis commented 2 years ago

peclik, can you test with master branch from namjaejeon/ksmbd ?

I think this change may not be necessary after https://github.com/namjaejeon/ksmbd/commit/53544224a37b4cf1156b0fccf774bb57922bbeed.

namjaejeon commented 2 years ago

@mmakassikis Thanks for your comment:)

@peclik Done. Thanks for your report!

peclik commented 2 years ago

@mmakassikis I have tester current master. Unfortunately 5354422 breaks compatibility with the printer. After revoking the commit, the printer is able to upload to a server with ksmbd again.

peclik commented 1 year ago

(In reply to other user question)

Today, the situation is even worse, I gave up. There are more problems - not only (init_smb3_11_server vs. init_smb2_0_server), but also strange forced listen on IPv6 when available and ignoring IPv4, see

 ret = sock_create(PF_INET6, SOCK_STREAM, IPPROTO_TCP, &ksmbd_socket)

in transport_tcp.c.

namjaejeon commented 1 year ago

@peclik Please explain more what is problem ?

peclik commented 1 year ago

@namjaejeon

  1. In code @ fe243b7, the problem with my printer HP Color LaserJet MFP M281fdn still exists. It cannot connect because it supports SMBv2 only. The workaround is to revert the https://github.com/namjaejeon/ksmbd/commit/53544224a37b4cf1156b0fccf774bb57922bbeed patch.

  2. This code https://github.com/namjaejeon/ksmbd/blob/ecf319086072fe673338df4586e2ba6c455eb713/transport_tcp.c#L457, if I understand it right, prefers IPv6 over IPv4. I.e. when IPv6 is configured on an interface ksmbd won't listen on its IPv4 address. That should be configurable at least.

(Edit: referenced a commit I was testing the ksmbd at.)

namjaejeon commented 1 year ago

In current code, the problem with my printer HP Color LaserJet MFP M281fdn still exists. It cannot connect because it supports SMBv2 only. The workaround is to revert the https://github.com/namjaejeon/ksmbd/commit/53544224a37b4cf1156b0fccf774bb57922bbeed patch.

I can not understand why this patch cause problem. Can you dump packets using wireshark or tcpdump ?

if I understand it right, prefers IPv6 over IPv4. I.e. when IPv6 is configured on an interface ksmbd won't listen on its IPv4 address. That should be configurable at least.

So what is problem for you ?

peclik commented 1 year ago

Regarding 2. Problem is, that on my server's interface I have both IPv4 and IPv6 configured. And I want to connect to SMB shares from IPv4 only clients. (Usually, daemons by default bind to all interfaces and IPv4 +IPv6 protocols, which can be limited in their configurations. But with ksmbd I cannot select neither IPv4 alone nor both IPv6 and IPv4.).

Regarding 1.

mmakassikis commented 1 year ago

The code you commented prevents ksmbd from creating a socket.

On Linux, a socket created with PF_INET6 will accept both IPv6 and IPv4 connections (unless IPV6_V6ONLY socket option has been set, but this is not the case with ksmbd).

If the client is IPv4 only, the fact that ksmbd can accept connections over IPv6 is completely transparent.

In the pcap you attached, the server responds with "Access Denied" error. Can you verify in ksmbd config that

What permissions are set on the "upload" directory ?

Can you connect to the share using the same credentials using a different client ?

Try running the mountd binary "-v" and then attempt to connect.

peclik commented 1 year ago

Without that patch (ret=1), netstat -l shows that port 445 is open on IPv6 address only, but I can test connection again.

The same share UPLOAD with the user 'x' and given passowrd works from Windows.

mmakassikis commented 1 year ago

Without that patch (ret=1), netstat -l shows that port 445 is open on IPv6 address only, but I can test connection again.

Yes, that is the expected behaviour. If you connect a client over IPv4 and run "netstat -paluten" again, you should see an ESTABLISHED connection, with an IPv4-mapped IPv6 address (e.g. if the client is connecting from 192.168.1.30, you will see ::ffff:192.168.1.30)

peclik commented 1 year ago

OK, thanks for explanation regarding IPv4.

Code @ https://github.com/namjaejeon/ksmbd/commit/fe243b7f7ced079fafd2ac887994a104bba360ee worked with the printer's client when I reverted https://github.com/namjaejeon/ksmbd/commit/53544224a37b4cf1156b0fccf774bb57922bbeed patch, the same share/user/password used. (On the other hand after that it didn't work with Windows client, of course). I did not test reverting the patch with the current code, as that would be meaningless, probably.