lustre/ptlrpc/sec_config.c

   1 /*
   2  * GPL HEADER START
   3  *
   4  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 only,
   8  * as published by the Free Software Foundation.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13  * General Public License version 2 for more details (a copy is included
  14  * in the LICENSE file that accompanied this code).
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * version 2 along with this program; If not, see
  18  * http://www.gnu.org/licenses/gpl-2.0.html
  19  *
  20  * GPL HEADER END
  21  */
  22 /*
  23  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Use is subject to license terms.
  25  *
  26  * Copyright (c) 2011, 2017, Intel Corporation.
  27  */
  28 /*
  29  * This file is part of Lustre, http://www.lustre.org/
  30  */
  31
  32 #define DEBUG_SUBSYSTEM S_SEC
  33
  34 #include <libcfs/libcfs.h>
  35 #include <linux/crypto.h>
  36 #include <linux/key.h>
  37
  38 #include <obd.h>
  39 #include <obd_class.h>
  40 #include <obd_support.h>
  41 #include <lustre_net.h>
  42 #include <lustre_import.h>
  43 #include <lustre_log.h>
  44 #include <lustre_disk.h>
  45 #include <lustre_dlm.h>
  46 #include <uapi/linux/lustre/lustre_param.h>
  47 #include <lustre_sec.h>
  48
  49 #include "ptlrpc_internal.h"
  50
  51 const char *sptlrpc_part2name(enum lustre_sec_part part)
  52 {
  53         switch (part) {
  54         case LUSTRE_SP_CLI:
  55                 return "cli";
  56         case LUSTRE_SP_MDT:
  57                 return "mdt";
  58         case LUSTRE_SP_OST:
  59                 return "ost";
  60         case LUSTRE_SP_MGC:
  61                 return "mgc";
  62         case LUSTRE_SP_MGS:
  63                 return "mgs";
  64         case LUSTRE_SP_ANY:
  65                 return "any";
  66         default:
  67                 return "err";
  68         }
  69 }
  70 EXPORT_SYMBOL(sptlrpc_part2name);
  71
  72 enum lustre_sec_part sptlrpc_target_sec_part(struct obd_device *obd)
  73 {
  74         const char *type = obd->obd_type->typ_name;
  75
  76         if (!strcmp(type, LUSTRE_MDT_NAME))
  77                 return LUSTRE_SP_MDT;
  78         if (!strcmp(type, LUSTRE_OST_NAME))
  79                 return LUSTRE_SP_OST;
  80         if (!strcmp(type, LUSTRE_MGS_NAME))
  81                 return LUSTRE_SP_MGS;
  82
  83         CERROR("unknown target %p(%s)\n", obd, type);
  84         return LUSTRE_SP_ANY;
  85 }
  86
  87 /* user supplied flavor string parsing */
  88
  89 /* format: <base_flavor>[-<bulk_type:alg_spec>] */
  90 int sptlrpc_parse_flavor(const char *str, struct sptlrpc_flavor *flvr)
  91 {
  92         char            buf[32];
  93         char           *bulk, *alg;
  94
  95         memset(flvr, 0, sizeof(*flvr));
  96
  97         if (str == NULL || str[0] == '\0') {
  98                 flvr->sf_rpc = SPTLRPC_FLVR_INVALID;
  99                 return 0;
 100         }
 101
 102         strlcpy(buf, str, sizeof(buf));
 103
 104         bulk = strchr(buf, '-');
 105         if (bulk)
 106                 *bulk++ = '\0';
 107
 108         flvr->sf_rpc = sptlrpc_name2flavor_base(buf);
 109         if (flvr->sf_rpc == SPTLRPC_FLVR_INVALID)
 110                 goto err_out;
 111
 112         /* currently only base flavor "plain" can have bulk specification.  */
 113         if (flvr->sf_rpc == SPTLRPC_FLVR_PLAIN) {
 114                 flvr->u_bulk.hash.hash_alg = BULK_HASH_ALG_ADLER32;
 115                 if (bulk) {
 116                         /* format: plain-hash:<hash_alg> */
 117                         alg = strchr(bulk, ':');
 118                         if (alg == NULL)
 119                                 goto err_out;
 120                         *alg++ = '\0';
 121
 122                         if (strcmp(bulk, "hash"))
 123                                 goto err_out;
 124
 125                         flvr->u_bulk.hash.hash_alg = sptlrpc_get_hash_alg(alg);
 126                         if (flvr->u_bulk.hash.hash_alg >= BULK_HASH_ALG_MAX)
 127                                 goto err_out;
 128                 }
 129
 130                 if (flvr->u_bulk.hash.hash_alg == BULK_HASH_ALG_NULL)
 131                         flvr_set_bulk_svc(&flvr->sf_rpc, SPTLRPC_BULK_SVC_NULL);
 132                 else
 133                         flvr_set_bulk_svc(&flvr->sf_rpc, SPTLRPC_BULK_SVC_INTG);
 134         } else {
 135                 if (bulk)
 136                         goto err_out;
 137         }
 138
 139         flvr->sf_flags = 0;
 140         return 0;
 141
 142 err_out:
 143         CERROR("invalid flavor string: %s\n", str);
 144         return -EINVAL;
 145 }
 146 EXPORT_SYMBOL(sptlrpc_parse_flavor);
 147
 148 /* configure rules */
 149
 150 static void get_default_flavor(struct sptlrpc_flavor *sf)
 151 {
 152         memset(sf, 0, sizeof(*sf));
 153
 154         sf->sf_rpc = SPTLRPC_FLVR_NULL;
 155         sf->sf_flags = 0;
 156 }
 157
 158 static void sptlrpc_rule_init(struct sptlrpc_rule *rule)
 159 {
 160         rule->sr_netid = LNET_NET_ANY;
 161         rule->sr_from = LUSTRE_SP_ANY;
 162         rule->sr_to = LUSTRE_SP_ANY;
 163         rule->sr_padding = 0;
 164
 165         get_default_flavor(&rule->sr_flvr);
 166 }
 167
 168 /* format: network[.direction]=flavor */
 169 int sptlrpc_parse_rule(char *param, struct sptlrpc_rule *rule)
 170 {
 171         char *flavor, *dir;
 172         int rc;
 173
 174         sptlrpc_rule_init(rule);
 175
 176         flavor = strchr(param, '=');
 177         if (flavor == NULL) {
 178                 CERROR("invalid param, no '='\n");
 179                 RETURN(-EINVAL);
 180         }
 181         *flavor++ = '\0';
 182
 183         dir = strchr(param, '.');
 184         if (dir)
 185                 *dir++ = '\0';
 186
 187         /* 1.1 network */
 188         if (strcmp(param, "default")) {
 189                 rule->sr_netid = libcfs_str2net(param);
 190                 if (rule->sr_netid == LNET_NET_ANY) {
 191                         CERROR("invalid network name: %s\n", param);
 192                         RETURN(-EINVAL);
 193                 }
 194         }
 195
 196         /* 1.2 direction */
 197         if (dir) {
 198                 if (!strcmp(dir, "mdt2ost")) {
 199                         rule->sr_from = LUSTRE_SP_MDT;
 200                         rule->sr_to = LUSTRE_SP_OST;
 201                 } else if (!strcmp(dir, "mdt2mdt")) {
 202                         rule->sr_from = LUSTRE_SP_MDT;
 203                         rule->sr_to = LUSTRE_SP_MDT;
 204                 } else if (!strcmp(dir, "cli2ost")) {
 205                         rule->sr_from = LUSTRE_SP_CLI;
 206                         rule->sr_to = LUSTRE_SP_OST;
 207                 } else if (!strcmp(dir, "cli2mdt")) {
 208                         rule->sr_from = LUSTRE_SP_CLI;
 209                         rule->sr_to = LUSTRE_SP_MDT;
 210                 } else {
 211                         CERROR("invalid rule dir segment: %s\n", dir);
 212                         RETURN(-EINVAL);
 213                 }
 214         }
 215
 216         /* 2.1 flavor */
 217         rc = sptlrpc_parse_flavor(flavor, &rule->sr_flvr);
 218         if (rc)
 219                 RETURN(-EINVAL);
 220
 221         RETURN(0);
 222 }
 223 EXPORT_SYMBOL(sptlrpc_parse_rule);
 224
 225 void sptlrpc_rule_set_free(struct sptlrpc_rule_set *rset)
 226 {
 227         LASSERT(rset->srs_nslot ||
 228                 (rset->srs_nrule == 0 && rset->srs_rules == NULL));
 229
 230         if (rset->srs_nslot) {
 231                 OBD_FREE_PTR_ARRAY(rset->srs_rules, rset->srs_nslot);
 232                 sptlrpc_rule_set_init(rset);
 233         }
 234 }
 235 EXPORT_SYMBOL(sptlrpc_rule_set_free);
 236
 237 /* return 0 if the rule set could accomodate one more rule.  */
 238 int sptlrpc_rule_set_expand(struct sptlrpc_rule_set *rset)
 239 {
 240         struct sptlrpc_rule *rules;
 241         int nslot;
 242
 243         might_sleep();
 244
 245         if (rset->srs_nrule < rset->srs_nslot)
 246                 return 0;
 247
 248         nslot = rset->srs_nslot + 8;
 249
 250         /* better use realloc() if available */
 251         OBD_ALLOC_PTR_ARRAY(rules, nslot);
 252         if (rules == NULL)
 253                 return -ENOMEM;
 254
 255         if (rset->srs_nrule) {
 256                 LASSERT(rset->srs_nslot && rset->srs_rules);
 257                 memcpy(rules, rset->srs_rules,
 258                        rset->srs_nrule * sizeof(*rset->srs_rules));
 259
 260                 OBD_FREE_PTR_ARRAY(rset->srs_rules, rset->srs_nslot);
 261         }
 262
 263         rset->srs_rules = rules;
 264         rset->srs_nslot = nslot;
 265         return 0;
 266 }
 267
 268 static inline int rule_spec_dir(struct sptlrpc_rule *rule)
 269 {
 270         return (rule->sr_from != LUSTRE_SP_ANY ||
 271                 rule->sr_to != LUSTRE_SP_ANY);
 272 }
 273 static inline int rule_spec_net(struct sptlrpc_rule *rule)
 274 {
 275         return (rule->sr_netid != LNET_NET_ANY);
 276 }
 277 static inline int rule_match_dir(struct sptlrpc_rule *r1,
 278                                  struct sptlrpc_rule *r2)
 279 {
 280         return (r1->sr_from == r2->sr_from && r1->sr_to == r2->sr_to);
 281 }
 282 static inline int rule_match_net(struct sptlrpc_rule *r1,
 283                                  struct sptlrpc_rule *r2)
 284 {
 285         return (r1->sr_netid == r2->sr_netid);
 286 }
 287
 288 /*
 289  * merge @rule into @rset.
 290  * the @rset slots might be expanded.
 291  */
 292 int sptlrpc_rule_set_merge(struct sptlrpc_rule_set *rset,
 293                            struct sptlrpc_rule *rule)
 294 {
 295         struct sptlrpc_rule      *p = rset->srs_rules;
 296         int                       spec_dir, spec_net;
 297         int                       rc, n, match = 0;
 298
 299         might_sleep();
 300
 301         spec_net = rule_spec_net(rule);
 302         spec_dir = rule_spec_dir(rule);
 303
 304         for (n = 0; n < rset->srs_nrule; n++) {
 305                 p = &rset->srs_rules[n];
 306
 307                 /* test network match, if failed:
 308                  * - spec rule: skip rules which is also spec rule match, until
 309                  *   we hit a wild rule, which means no more chance
 310                  * - wild rule: skip until reach the one which is also wild
 311                  *   and matches
 312                  */
 313                 if (!rule_match_net(p, rule)) {
 314                         if (spec_net) {
 315                                 if (rule_spec_net(p))
 316                                         continue;
 317                                 else
 318                                         break;
 319                         } else {
 320                                 continue;
 321                         }
 322                 }
 323
 324                 /* test dir match, same logic as net matching */
 325                 if (!rule_match_dir(p, rule)) {
 326                         if (spec_dir) {
 327                                 if (rule_spec_dir(p))
 328                                         continue;
 329                                 else
 330                                         break;
 331                         } else {
 332                                 continue;
 333                         }
 334                 }
 335
 336                 /* find a match */
 337                 match = 1;
 338                 break;
 339         }
 340
 341         if (match) {
 342                 LASSERT(n >= 0 && n < rset->srs_nrule);
 343
 344                 if (rule->sr_flvr.sf_rpc == SPTLRPC_FLVR_INVALID) {
 345                         /* remove this rule */
 346                         if (n < rset->srs_nrule - 1)
 347                                 memmove(&rset->srs_rules[n],
 348                                         &rset->srs_rules[n + 1],
 349                                         (rset->srs_nrule - n - 1) *
 350                                         sizeof(*rule));
 351                         rset->srs_nrule--;
 352                 } else {
 353                         /* override the rule */
 354                         memcpy(&rset->srs_rules[n], rule, sizeof(*rule));
 355                 }
 356         } else {
 357                 LASSERT(n >= 0 && n <= rset->srs_nrule);
 358
 359                 if (rule->sr_flvr.sf_rpc != SPTLRPC_FLVR_INVALID) {
 360                         rc = sptlrpc_rule_set_expand(rset);
 361                         if (rc)
 362                                 return rc;
 363
 364                         if (n < rset->srs_nrule)
 365                                 memmove(&rset->srs_rules[n + 1],
 366                                         &rset->srs_rules[n],
 367                                         (rset->srs_nrule - n) * sizeof(*rule));
 368                         memcpy(&rset->srs_rules[n], rule, sizeof(*rule));
 369                         rset->srs_nrule++;
 370                 } else {
 371                         CDEBUG(D_CONFIG, "ignore the unmatched deletion\n");
 372                 }
 373         }
 374
 375         return 0;
 376 }
 377 EXPORT_SYMBOL(sptlrpc_rule_set_merge);
 378
 379 /**
 380  * given from/to/nid, determine a matching flavor in ruleset.
 381  * return 1 if a match found, otherwise return 0.
 382  */
 383 int sptlrpc_rule_set_choose(struct sptlrpc_rule_set *rset,
 384                             enum lustre_sec_part from,
 385                             enum lustre_sec_part to,
 386                             struct lnet_nid *nid,
 387                             struct sptlrpc_flavor *sf)
 388 {
 389         struct sptlrpc_rule *r;
 390         int n;
 391
 392         if (nid_is_lo0(nid))
 393                 /* do not enforce any sec flavor on loopback connection */
 394                 return 0;
 395
 396         for (n = 0; n < rset->srs_nrule; n++) {
 397                 r = &rset->srs_rules[n];
 398
 399                 if (!LNET_NID_IS_ANY(nid) &&
 400                     r->sr_netid != LNET_NET_ANY &&
 401                     __be16_to_cpu(nid->nid_num) != r->sr_netid)
 402                         continue;
 403
 404                 if (from != LUSTRE_SP_ANY && r->sr_from != LUSTRE_SP_ANY &&
 405                     from != r->sr_from)
 406                         continue;
 407
 408                 if (to != LUSTRE_SP_ANY && r->sr_to != LUSTRE_SP_ANY &&
 409                     to != r->sr_to)
 410                         continue;
 411
 412                 *sf = r->sr_flvr;
 413                 return 1;
 414         }
 415
 416         return 0;
 417 }
 418
 419 void sptlrpc_rule_set_dump(struct sptlrpc_rule_set *rset)
 420 {
 421         struct sptlrpc_rule *r;
 422         int     n;
 423
 424         for (n = 0; n < rset->srs_nrule; n++) {
 425                 r = &rset->srs_rules[n];
 426                 CDEBUG(D_SEC, "<%02d> from %x to %x, net %x, rpc %x\n", n,
 427                        r->sr_from, r->sr_to, r->sr_netid, r->sr_flvr.sf_rpc);
 428         }
 429 }
 430
 431 static int sptlrpc_rule_set_extract(struct sptlrpc_rule_set *gen,
 432                                     struct sptlrpc_rule_set *tgt,
 433                                     enum lustre_sec_part from,
 434                                     enum lustre_sec_part to,
 435                                     struct sptlrpc_rule_set *rset)
 436 {
 437         struct sptlrpc_rule_set *src[2] = { gen, tgt };
 438         struct sptlrpc_rule     *rule;
 439         int                      i, n, rc;
 440
 441         might_sleep();
 442
 443         /* merge general rules firstly, then target-specific rules */
 444         for (i = 0; i < 2; i++) {
 445                 if (src[i] == NULL)
 446                         continue;
 447
 448                 for (n = 0; n < src[i]->srs_nrule; n++) {
 449                         rule = &src[i]->srs_rules[n];
 450
 451                         if (from != LUSTRE_SP_ANY &&
 452                             rule->sr_from != LUSTRE_SP_ANY &&
 453                             rule->sr_from != from)
 454                                 continue;
 455                         if (to != LUSTRE_SP_ANY &&
 456                             rule->sr_to != LUSTRE_SP_ANY &&
 457                             rule->sr_to != to)
 458                                 continue;
 459
 460                         rc = sptlrpc_rule_set_merge(rset, rule);
 461                         if (rc) {
 462                                 CERROR("can't merge: %d\n", rc);
 463                                 return rc;
 464                         }
 465                 }
 466         }
 467
 468         return 0;
 469 }
 470
 471 /* sptlrpc configuration support  */
 472
 473 struct sptlrpc_conf_tgt {
 474         struct list_head              sct_list;
 475         char                    sct_name[MAX_OBD_NAME];
 476         struct sptlrpc_rule_set sct_rset;
 477 };
 478
 479 struct sptlrpc_conf {
 480         struct list_head        sc_list;
 481         char                    sc_fsname[MTI_NAME_MAXLEN];
 482         unsigned int            sc_modified;    /* modified during updating */
 483         unsigned int            sc_updated:1,   /* updated copy from MGS */
 484                                 sc_local:1;     /* local copy from target */
 485         struct sptlrpc_rule_set sc_rset;        /* fs general rules */
 486         struct list_head        sc_tgts;        /* target-specific rules */
 487 };
 488
 489 static struct mutex sptlrpc_conf_lock;
 490 static LIST_HEAD(sptlrpc_confs);
 491
 492 static void sptlrpc_conf_free_rsets(struct sptlrpc_conf *conf)
 493 {
 494         struct sptlrpc_conf_tgt *conf_tgt, *conf_tgt_next;
 495
 496         sptlrpc_rule_set_free(&conf->sc_rset);
 497
 498         list_for_each_entry_safe(conf_tgt, conf_tgt_next,
 499                                  &conf->sc_tgts, sct_list) {
 500                 sptlrpc_rule_set_free(&conf_tgt->sct_rset);
 501                 list_del(&conf_tgt->sct_list);
 502                 OBD_FREE_PTR(conf_tgt);
 503         }
 504         LASSERT(list_empty(&conf->sc_tgts));
 505
 506         conf->sc_updated = 0;
 507         conf->sc_local = 0;
 508 }
 509
 510 static void sptlrpc_conf_free(struct sptlrpc_conf *conf)
 511 {
 512         CDEBUG(D_SEC, "free sptlrpc conf %s\n", conf->sc_fsname);
 513
 514         sptlrpc_conf_free_rsets(conf);
 515         list_del(&conf->sc_list);
 516         OBD_FREE_PTR(conf);
 517 }
 518
 519 static
 520 struct sptlrpc_conf_tgt *sptlrpc_conf_get_tgt(struct sptlrpc_conf *conf,
 521                                               const char *name,
 522                                               int create)
 523 {
 524         struct sptlrpc_conf_tgt *conf_tgt;
 525
 526         list_for_each_entry(conf_tgt, &conf->sc_tgts, sct_list) {
 527                 if (strcmp(conf_tgt->sct_name, name) == 0)
 528                         return conf_tgt;
 529         }
 530
 531         if (!create)
 532                 return NULL;
 533
 534         OBD_ALLOC_PTR(conf_tgt);
 535         if (conf_tgt) {
 536                 strlcpy(conf_tgt->sct_name, name, sizeof(conf_tgt->sct_name));
 537                 sptlrpc_rule_set_init(&conf_tgt->sct_rset);
 538                 list_add(&conf_tgt->sct_list, &conf->sc_tgts);
 539         }
 540
 541         return conf_tgt;
 542 }
 543
 544 static
 545 struct sptlrpc_conf *sptlrpc_conf_get(const char *fsname,
 546                                       int create)
 547 {
 548         struct sptlrpc_conf *conf;
 549
 550         list_for_each_entry(conf, &sptlrpc_confs, sc_list) {
 551                 if (strcmp(conf->sc_fsname, fsname) == 0)
 552                         return conf;
 553         }
 554
 555         if (!create)
 556                 return NULL;
 557
 558         OBD_ALLOC_PTR(conf);
 559         if (conf == NULL)
 560                 return NULL;
 561
 562         if (strlcpy(conf->sc_fsname, fsname, sizeof(conf->sc_fsname)) >=
 563             sizeof(conf->sc_fsname)) {
 564                 OBD_FREE_PTR(conf);
 565                 return NULL;
 566         }
 567         sptlrpc_rule_set_init(&conf->sc_rset);
 568         INIT_LIST_HEAD(&conf->sc_tgts);
 569         list_add(&conf->sc_list, &sptlrpc_confs);
 570
 571         CDEBUG(D_SEC, "create sptlrpc conf %s\n", conf->sc_fsname);
 572         return conf;
 573 }
 574
 575 /* caller must hold conf_lock already. */
 576 static int sptlrpc_conf_merge_rule(struct sptlrpc_conf *conf,
 577                                    const char *target,
 578                                    struct sptlrpc_rule *rule)
 579 {
 580         struct sptlrpc_conf_tgt  *conf_tgt;
 581         struct sptlrpc_rule_set  *rule_set;
 582
 583         /* fsname == target means general rules for the whole fs */
 584         if (strcmp(conf->sc_fsname, target) == 0) {
 585                 rule_set = &conf->sc_rset;
 586         } else {
 587                 conf_tgt = sptlrpc_conf_get_tgt(conf, target, 1);
 588                 if (conf_tgt) {
 589                         rule_set = &conf_tgt->sct_rset;
 590                 } else {
 591                         CERROR("out of memory, can't merge rule!\n");
 592                         return -ENOMEM;
 593                 }
 594         }
 595
 596         return sptlrpc_rule_set_merge(rule_set, rule);
 597 }
 598
 599 /**
 600  * process one LCFG_SPTLRPC_CONF record. if \a conf is NULL, we
 601  * find one through the target name in the record inside conf_lock;
 602  * otherwise means caller already hold conf_lock.
 603  */
 604 static int __sptlrpc_process_config(char *target, const char *fsname,
 605                                     struct sptlrpc_rule *rule,
 606                                     struct sptlrpc_conf *conf)
 607 {
 608         int rc;
 609
 610         ENTRY;
 611         if (!conf) {
 612                 if (!fsname)
 613                         return -ENODEV;
 614
 615                 mutex_lock(&sptlrpc_conf_lock);
 616                 conf = sptlrpc_conf_get(fsname, 0);
 617                 if (!conf) {
 618                         CERROR("can't find conf\n");
 619                         rc = -ENOMEM;
 620                 } else {
 621                         rc = sptlrpc_conf_merge_rule(conf, target, rule);
 622                 }
 623                 mutex_unlock(&sptlrpc_conf_lock);
 624         } else {
 625                 LASSERT(mutex_is_locked(&sptlrpc_conf_lock));
 626                 rc = sptlrpc_conf_merge_rule(conf, target, rule);
 627         }
 628
 629         if (!rc)
 630                 conf->sc_modified++;
 631
 632         RETURN(rc);
 633 }
 634
 635 int sptlrpc_process_config(struct lustre_cfg *lcfg)
 636 {
 637         char fsname[MTI_NAME_MAXLEN];
 638         struct sptlrpc_rule rule;
 639         char *target, *param;
 640         int rc;
 641
 642         print_lustre_cfg(lcfg);
 643
 644         target = lustre_cfg_string(lcfg, 1);
 645         if (!target) {
 646                 CERROR("missing target name\n");
 647                 return -EINVAL;
 648         }
 649
 650         param = lustre_cfg_string(lcfg, 2);
 651         if (!param) {
 652                 CERROR("missing parameter\n");
 653                 return -EINVAL;
 654         }
 655
 656         /* parse rule to make sure the format is correct */
 657         if (strncmp(param, PARAM_SRPC_FLVR,
 658                     sizeof(PARAM_SRPC_FLVR) - 1) != 0) {
 659                 CERROR("Invalid sptlrpc parameter: %s\n", param);
 660                 return -EINVAL;
 661         }
 662         param += sizeof(PARAM_SRPC_FLVR) - 1;
 663
 664         CDEBUG(D_SEC, "processing rule: %s.%s\n", target, param);
 665
 666         /*
 667          * Three types of targets exist for sptlrpc using conf_param
 668          * 1.   '_mgs' which targets mgc srpc settings. Treat it as
 669          *      as a special file system name.
 670          * 2.   target is a device which can be fsname-MDTXXXX or
 671          *      fsname-OSTXXXX. This can be verified by the function
 672          *      server_name2fsname.
 673          * 3.   If both above conditions are not meet then the target
 674          *      is a actual filesystem.
 675          */
 676         if (server_name2fsname(target, fsname, NULL))
 677                 strlcpy(fsname, target, sizeof(fsname));
 678
 679         rc = sptlrpc_parse_rule(param, &rule);
 680         if (rc)
 681                 return rc;
 682
 683         return __sptlrpc_process_config(target, fsname, &rule, NULL);
 684 }
 685 EXPORT_SYMBOL(sptlrpc_process_config);
 686
 687 static int logname2fsname(const char *logname, char *buf, int buflen)
 688 {
 689         char   *ptr;
 690         int     len;
 691
 692         ptr = strrchr(logname, '-');
 693         if (ptr == NULL || strcmp(ptr, "-sptlrpc")) {
 694                 CERROR("%s is not a sptlrpc config log\n", logname);
 695                 return -EINVAL;
 696         }
 697
 698         len = min((int) (ptr - logname), buflen - 1);
 699
 700         memcpy(buf, logname, len);
 701         buf[len] = '\0';
 702         return 0;
 703 }
 704
 705 void sptlrpc_conf_log_update_begin(const char *logname)
 706 {
 707         struct sptlrpc_conf *conf;
 708         char                 fsname[16];
 709
 710         if (logname2fsname(logname, fsname, sizeof(fsname)))
 711                 return;
 712
 713         mutex_lock(&sptlrpc_conf_lock);
 714
 715         conf = sptlrpc_conf_get(fsname, 0);
 716         if (conf) {
 717                 if (conf->sc_local) {
 718                         LASSERT(conf->sc_updated == 0);
 719                         sptlrpc_conf_free_rsets(conf);
 720                 }
 721                 conf->sc_modified = 0;
 722         }
 723
 724         mutex_unlock(&sptlrpc_conf_lock);
 725 }
 726 EXPORT_SYMBOL(sptlrpc_conf_log_update_begin);
 727
 728 /* mark a config log has been updated */
 729 void sptlrpc_conf_log_update_end(const char *logname)
 730 {
 731         struct sptlrpc_conf *conf;
 732         char                 fsname[16];
 733
 734         if (logname2fsname(logname, fsname, sizeof(fsname)))
 735                 return;
 736
 737         mutex_lock(&sptlrpc_conf_lock);
 738
 739         conf = sptlrpc_conf_get(fsname, 0);
 740         if (conf) {
 741                 /* if original state is not updated, make sure the
 742                  * modified counter > 0 to enforce updating local copy.
 743                  */
 744                 if (conf->sc_updated == 0)
 745                         conf->sc_modified++;
 746
 747                 conf->sc_updated = 1;
 748         }
 749
 750         mutex_unlock(&sptlrpc_conf_lock);
 751 }
 752 EXPORT_SYMBOL(sptlrpc_conf_log_update_end);
 753
 754 void sptlrpc_conf_log_start(const char *logname)
 755 {
 756         char                 fsname[16];
 757
 758         if (logname2fsname(logname, fsname, sizeof(fsname)))
 759                 return;
 760
 761         mutex_lock(&sptlrpc_conf_lock);
 762         sptlrpc_conf_get(fsname, 1);
 763         mutex_unlock(&sptlrpc_conf_lock);
 764 }
 765 EXPORT_SYMBOL(sptlrpc_conf_log_start);
 766
 767 void sptlrpc_conf_log_stop(const char *logname)
 768 {
 769         struct sptlrpc_conf *conf;
 770         char                 fsname[16];
 771
 772         if (logname2fsname(logname, fsname, sizeof(fsname)))
 773                 return;
 774
 775         mutex_lock(&sptlrpc_conf_lock);
 776         conf = sptlrpc_conf_get(fsname, 0);
 777         if (conf)
 778                 sptlrpc_conf_free(conf);
 779         mutex_unlock(&sptlrpc_conf_lock);
 780 }
 781 EXPORT_SYMBOL(sptlrpc_conf_log_stop);
 782
 783 static inline void flavor_set_flags(struct sptlrpc_flavor *sf,
 784                                     enum lustre_sec_part from,
 785                                     enum lustre_sec_part to,
 786                                     unsigned int fl_udesc)
 787 {
 788         /* null flavor doesn't need to set any flavor, and in fact
 789          * we'd better not do that because everybody share a single sec.
 790          */
 791         if (sf->sf_rpc == SPTLRPC_FLVR_NULL)
 792                 return;
 793
 794         if (from == LUSTRE_SP_MDT) {
 795                 /* MDT->MDT; MDT->OST */
 796                 sf->sf_flags |= PTLRPC_SEC_FL_ROOTONLY;
 797         } else if (from == LUSTRE_SP_CLI && to == LUSTRE_SP_OST) {
 798                 /* CLI->OST */
 799                 sf->sf_flags |= PTLRPC_SEC_FL_ROOTONLY | PTLRPC_SEC_FL_BULK;
 800         } else if (from == LUSTRE_SP_CLI && to == LUSTRE_SP_MDT) {
 801                 /* CLI->MDT */
 802                 if (fl_udesc && sf->sf_rpc != SPTLRPC_FLVR_NULL)
 803                         sf->sf_flags |= PTLRPC_SEC_FL_UDESC;
 804         }
 805
 806         /* Some flavors use a single uid (0) context */
 807         if (flvr_is_rootonly(sf->sf_rpc))
 808                 sf->sf_flags |= PTLRPC_SEC_FL_ROOTONLY;
 809
 810         /* User descriptor might need to be cleared */
 811         if (flvr_allows_user_desc(sf->sf_rpc) == 0)
 812                 sf->sf_flags &= ~PTLRPC_SEC_FL_UDESC;
 813 }
 814
 815 void sptlrpc_conf_choose_flavor(enum lustre_sec_part from,
 816                                 enum lustre_sec_part to,
 817                                 struct obd_uuid *target,
 818                                 struct lnet_nid *nid,
 819                                 struct sptlrpc_flavor *sf)
 820 {
 821         struct sptlrpc_conf     *conf;
 822         struct sptlrpc_conf_tgt *conf_tgt;
 823         char                     name[MTI_NAME_MAXLEN];
 824         int                      len, rc = 0;
 825
 826         obd_uuid2fsname(name, target->uuid, sizeof(name));
 827
 828         mutex_lock(&sptlrpc_conf_lock);
 829
 830         conf = sptlrpc_conf_get(name, 0);
 831         if (conf == NULL)
 832                 goto out;
 833
 834         /* convert uuid name (supposed end with _UUID) to target name */
 835         len = strlen(target->uuid);
 836         LASSERT(len > 5);
 837         memcpy(name, target->uuid, len - 5);
 838         name[len - 5] = '\0';
 839
 840         conf_tgt = sptlrpc_conf_get_tgt(conf, name, 0);
 841         if (conf_tgt) {
 842                 rc = sptlrpc_rule_set_choose(&conf_tgt->sct_rset,
 843                                              from, to, nid, sf);
 844                 if (rc)
 845                         goto out;
 846         }
 847
 848         rc = sptlrpc_rule_set_choose(&conf->sc_rset, from, to,
 849                                      nid, sf);
 850 out:
 851         mutex_unlock(&sptlrpc_conf_lock);
 852
 853         if (rc == 0)
 854                 get_default_flavor(sf);
 855
 856         flavor_set_flags(sf, from, to, 1);
 857 }
 858
 859 /**
 860  * called by target devices, determine the expected flavor from
 861  * certain peer (from, nid).
 862  */
 863 void sptlrpc_target_choose_flavor(struct sptlrpc_rule_set *rset,
 864                                   enum lustre_sec_part from,
 865                                   struct lnet_nid *nid,
 866                                   struct sptlrpc_flavor *sf)
 867 {
 868         if (sptlrpc_rule_set_choose(rset, from, LUSTRE_SP_ANY, nid, sf) == 0)
 869                 get_default_flavor(sf);
 870 }
 871
 872 #define SEC_ADAPT_DELAY         (10)
 873
 874 /**
 875  * called by client devices, notify the sptlrpc config has changed and
 876  * do import_sec_adapt later.
 877  */
 878 void sptlrpc_conf_client_adapt(struct obd_device *obd)
 879 {
 880         struct obd_import  *imp;
 881         int rc;
 882
 883         ENTRY;
 884
 885         LASSERT(strcmp(obd->obd_type->typ_name, LUSTRE_MDC_NAME) == 0 ||
 886                 strcmp(obd->obd_type->typ_name, LUSTRE_OSC_NAME) == 0 ||
 887                 strcmp(obd->obd_type->typ_name, LUSTRE_OSP_NAME) == 0 ||
 888                 strcmp(obd->obd_type->typ_name, LUSTRE_LWP_NAME) == 0);
 889         CDEBUG(D_SEC, "obd %s\n", obd->u.cli.cl_target_uuid.uuid);
 890
 891         /* serialize with connect/disconnect import */
 892         with_imp_locked_nested(obd, imp, rc, OBD_CLI_SEM_MDCOSC) {
 893                 write_lock(&imp->imp_sec_lock);
 894                 if (imp->imp_sec)
 895                         imp->imp_sec_expire = ktime_get_real_seconds() +
 896                                 SEC_ADAPT_DELAY;
 897                 write_unlock(&imp->imp_sec_lock);
 898         }
 899
 900         EXIT;
 901 }
 902 EXPORT_SYMBOL(sptlrpc_conf_client_adapt);
 903
 904 /**
 905  * called by target devices, extract sptlrpc rules which applies to
 906  * this target, to be used for future rpc flavor checking.
 907  */
 908 int sptlrpc_conf_target_get_rules(struct obd_device *obd,
 909                                   struct sptlrpc_rule_set *rset)
 910 {
 911         struct sptlrpc_conf *conf;
 912         struct sptlrpc_conf_tgt *conf_tgt;
 913         enum lustre_sec_part sp_dst;
 914         char fsname[MTI_NAME_MAXLEN];
 915         int rc = 0;
 916
 917         ENTRY;
 918
 919         if (strcmp(obd->obd_type->typ_name, LUSTRE_MDT_NAME) == 0) {
 920                 sp_dst = LUSTRE_SP_MDT;
 921         } else if (strcmp(obd->obd_type->typ_name, LUSTRE_OST_NAME) == 0) {
 922                 sp_dst = LUSTRE_SP_OST;
 923         } else {
 924                 CERROR("unexpected obd type %s\n", obd->obd_type->typ_name);
 925                 RETURN(-EINVAL);
 926         }
 927
 928         obd_uuid2fsname(fsname, obd->obd_uuid.uuid, sizeof(fsname));
 929
 930         mutex_lock(&sptlrpc_conf_lock);
 931         conf = sptlrpc_conf_get(fsname, 0);
 932         if (conf == NULL) {
 933                 CERROR("missing sptlrpc config log\n");
 934                 rc = -EFAULT;
 935         } else {
 936                 /* extract rule set for this target */
 937                 conf_tgt = sptlrpc_conf_get_tgt(conf, obd->obd_name, 0);
 938
 939                 rc = sptlrpc_rule_set_extract(&conf->sc_rset,
 940                                       conf_tgt ? &conf_tgt->sct_rset : NULL,
 941                                       LUSTRE_SP_ANY, sp_dst, rset);
 942         }
 943         mutex_unlock(&sptlrpc_conf_lock);
 944
 945         RETURN(rc);
 946 }
 947
 948 int  sptlrpc_conf_init(void)
 949 {
 950         mutex_init(&sptlrpc_conf_lock);
 951         return 0;
 952 }
 953
 954 void sptlrpc_conf_fini(void)
 955 {
 956         struct sptlrpc_conf  *conf, *conf_next;
 957
 958         mutex_lock(&sptlrpc_conf_lock);
 959         list_for_each_entry_safe(conf, conf_next, &sptlrpc_confs, sc_list)
 960                 sptlrpc_conf_free(conf);
 961         LASSERT(list_empty(&sptlrpc_confs));
 962         mutex_unlock(&sptlrpc_conf_lock);
 963 }