4 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 only,
8 * as published by the Free Software Foundation.
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 * General Public License version 2 for more details (a copy is included
14 * in the LICENSE file that accompanied this code).
16 * You should have received a copy of the GNU General Public License
17 * version 2 along with this program; If not, see
18 * http://www.sun.com/software/products/lustre/docs/GPLv2.pdf
20 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
21 * CA 95054 USA or visit www.sun.com if you need additional information or
27 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
28 * Use is subject to license terms.
31 * This file is part of Lustre, http://www.lustre.org/
32 * Lustre is a trademark of Sun Microsystems, Inc.
34 * lustre/obdfilter/filter_capa.c
36 * Author: Lai Siyao <lsy@clusterfs.com>
39 #define DEBUG_SUBSYSTEM S_FILTER
42 #include <linux/version.h>
43 #include <asm/uaccess.h>
44 #include <linux/file.h>
45 #include <linux/kmod.h>
47 #include <lustre_fsfilt.h>
48 #include <lustre_capa.h>
50 #include "filter_internal.h"
52 static inline __u32 filter_ck_keyid(struct filter_capa_key *key)
54 return key->k_key.lk_keyid;
57 int filter_update_capa_key(struct obd_device *obd, struct lustre_capa_key *new)
59 struct filter_obd *filter = &obd->u.filter;
60 struct filter_capa_key *k, *keys[2] = { NULL, NULL };
63 cfs_spin_lock(&capa_lock);
64 cfs_list_for_each_entry(k, &filter->fo_capa_keys, k_list) {
65 if (k->k_key.lk_seq != new->lk_seq)
70 if (filter_ck_keyid(keys[1]) > filter_ck_keyid(keys[0]))
71 keys[1] = keys[0], keys[0] = k;
76 cfs_spin_unlock(&capa_lock);
78 for (i = 0; i < 2; i++) {
81 if (filter_ck_keyid(keys[i]) != new->lk_keyid)
83 /* maybe because of recovery or other reasons, MDS sent the
84 * the old capability key again.
86 cfs_spin_lock(&capa_lock);
87 keys[i]->k_key = *new;
88 cfs_spin_unlock(&capa_lock);
94 /* if OSS already have two keys, update the old one */
100 CFS_INIT_LIST_HEAD(&k->k_list);
103 cfs_spin_lock(&capa_lock);
105 if (cfs_list_empty(&k->k_list))
106 cfs_list_add(&k->k_list, &filter->fo_capa_keys);
107 cfs_spin_unlock(&capa_lock);
109 DEBUG_CAPA_KEY(D_SEC, new, "new");
113 int filter_auth_capa(struct obd_export *exp,
114 struct lu_fid *fid, obd_seq seq,
115 struct lustre_capa *capa, __u64 opc)
117 struct obd_device *obd = exp->exp_obd;
118 struct filter_obd *filter = &obd->u.filter;
119 struct filter_capa_key *k;
120 struct lustre_capa_key key;
123 int keys_ready = 0, key_found = 0, rc = 0;
126 /* skip capa check for llog and obdecho */
127 if (!fid_seq_is_mdt(seq))
130 if (capa == BYPASS_CAPA)
133 /* capability is disabled */
134 if (!filter->fo_fl_oss_capa)
137 if (!(exp->exp_connect_flags & OBD_CONNECT_OSS_CAPA))
142 CERROR("seq/fid/opc "LPU64"/"DFID"/"LPX64
143 ": no capability has been passed\n",
144 seq, PFID(fid), opc);
146 CERROR("seq/opc "LPU64"/"LPX64
147 ": no capability has been passed\n",
152 if (opc == CAPA_OPC_OSS_READ) {
153 if (!(capa->lc_opc & CAPA_OPC_OSS_RW))
155 } else if (!capa_opc_supported(capa, opc)) {
159 DEBUG_CAPA(D_ERROR, capa, "opc "LPX64" not supported by", opc);
163 oc = capa_lookup(filter->fo_capa_hash, capa, 0);
165 cfs_spin_lock(&oc->c_lock);
166 if (capa_is_expired(oc)) {
167 DEBUG_CAPA(D_ERROR, capa, "expired");
170 cfs_spin_unlock(&oc->c_lock);
176 if (capa_is_expired_sec(capa)) {
177 DEBUG_CAPA(D_ERROR, capa, "expired");
181 cfs_spin_lock(&capa_lock);
182 cfs_list_for_each_entry(k, &filter->fo_capa_keys, k_list) {
183 if (k->k_key.lk_seq == seq) {
185 if (k->k_key.lk_keyid == capa_keyid(capa)) {
192 cfs_spin_unlock(&capa_lock);
195 CDEBUG(D_SEC, "MDS hasn't propagated capability keys yet, "
201 DEBUG_CAPA(D_ERROR, capa, "no matched capability key for");
205 OBD_ALLOC(hmac, CAPA_HMAC_MAX_LEN);
209 rc = capa_hmac(hmac, capa, key.lk_key);
211 DEBUG_CAPA(D_ERROR, capa, "HMAC failed: rc %d", rc);
212 OBD_FREE(hmac, CAPA_HMAC_MAX_LEN);
216 rc = memcmp(hmac, capa->lc_hmac, CAPA_HMAC_MAX_LEN);
217 OBD_FREE(hmac, CAPA_HMAC_MAX_LEN);
219 DEBUG_CAPA_KEY(D_ERROR, &key, "calculate HMAC with ");
220 DEBUG_CAPA(D_ERROR, capa, "HMAC mismatch");
224 /* store in capa hash */
225 oc = capa_add(filter->fo_capa_hash, capa);
230 int filter_capa_fixoa(struct obd_export *exp, struct obdo *oa, obd_seq seq,
231 struct lustre_capa *capa)
233 struct obd_device *obd = exp->exp_obd;
234 struct filter_obd *filter = &obd->u.filter;
238 /* skip capa check for llog and obdecho */
239 if (!fid_seq_is_mdt(seq))
242 if (!(exp->exp_connect_flags & OBD_CONNECT_OSS_CAPA))
245 /* capability is disabled */
246 if (!filter->fo_fl_oss_capa)
252 if (capa_flags(capa) == LC_ID_CONVERT) {
253 struct filter_capa_key *k;
256 cfs_spin_lock(&capa_lock);
257 cfs_list_for_each_entry(k, &filter->fo_capa_keys, k_list) {
258 if (k->k_key.lk_seq == seq &&
259 k->k_key.lk_keyid == capa_keyid(capa)) {
264 cfs_spin_unlock(&capa_lock);
273 uid.id64 = capa_uid(capa);
274 gid.id64 = capa_gid(capa);
280 rc = capa_decrypt_id(d, s, k->k_key.lk_key,
281 CAPA_HMAC_KEY_MAX_LEN);
288 DEBUG_CAPA(D_ERROR, capa, "no matched capability key for");
296 void filter_free_capa_keys(struct filter_obd *filter)
298 struct filter_capa_key *key, *n;
300 cfs_spin_lock(&capa_lock);
301 cfs_list_for_each_entry_safe(key, n, &filter->fo_capa_keys, k_list) {
302 cfs_list_del_init(&key->k_list);
303 OBD_FREE(key, sizeof(*key));
305 cfs_spin_unlock(&capa_lock);