lustre/obdfilter/filter_capa.c

   1 /* -*- mode: c; c-basic-offset: 8; indent-tabs-mode: nil; -*-
   2  * vim:expandtab:shiftwidth=8:tabstop=8:
   3  *
   4  * GPL HEADER START
   5  *
   6  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License version 2 only,
  10  * as published by the Free Software Foundation.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * General Public License version 2 for more details (a copy is included
  16  * in the LICENSE file that accompanied this code).
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * version 2 along with this program; If not, see
  20  * http://www.sun.com/software/products/lustre/docs/GPLv2.pdf
  21  *
  22  * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
  23  * CA 95054 USA or visit www.sun.com if you need additional information or
  24  * have any questions.
  25  *
  26  * GPL HEADER END
  27  */
  28 /*
  29  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  30  * Use is subject to license terms.
  31  */
  32 /*
  33  * This file is part of Lustre, http://www.lustre.org/
  34  * Lustre is a trademark of Sun Microsystems, Inc.
  35  *
  36  * lustre/obdfilter/filter_capa.c
  37  *
  38  * Author: Lai Siyao <lsy@clusterfs.com>
  39  */
  40
  41 #define DEBUG_SUBSYSTEM S_FILTER
  42
  43 #include <linux/fs.h>
  44 #include <linux/version.h>
  45 #include <asm/uaccess.h>
  46 #include <linux/file.h>
  47 #include <linux/kmod.h>
  48
  49 #include <lustre_fsfilt.h>
  50 #include <lustre_capa.h>
  51
  52 #include "filter_internal.h"
  53
  54 static inline __u32 filter_ck_keyid(struct filter_capa_key *key)
  55 {
  56         return key->k_key.lk_keyid;
  57 }
  58
  59 int filter_update_capa_key(struct obd_device *obd, struct lustre_capa_key *new)
  60 {
  61         struct filter_obd *filter = &obd->u.filter;
  62         struct filter_capa_key *k, *keys[2] = { NULL, NULL };
  63         int i;
  64
  65         cfs_spin_lock(&capa_lock);
  66         cfs_list_for_each_entry(k, &filter->fo_capa_keys, k_list) {
  67                 if (k->k_key.lk_seq != new->lk_seq)
  68                         continue;
  69
  70                 if (keys[0]) {
  71                         keys[1] = k;
  72                         if (filter_ck_keyid(keys[1]) > filter_ck_keyid(keys[0]))
  73                                 keys[1] = keys[0], keys[0] = k;
  74                 } else {
  75                         keys[0] = k;
  76                 }
  77         }
  78         cfs_spin_unlock(&capa_lock);
  79
  80         for (i = 0; i < 2; i++) {
  81                 if (!keys[i])
  82                         continue;
  83                 if (filter_ck_keyid(keys[i]) != new->lk_keyid)
  84                         continue;
  85                 /* maybe because of recovery or other reasons, MDS sent the
  86                  * the old capability key again.
  87                  */
  88                 cfs_spin_lock(&capa_lock);
  89                 keys[i]->k_key = *new;
  90                 cfs_spin_unlock(&capa_lock);
  91
  92                 RETURN(0);
  93         }
  94
  95         if (keys[1]) {
  96                 /* if OSS already have two keys, update the old one */
  97                 k = keys[1];
  98         } else {
  99                 OBD_ALLOC_PTR(k);
 100                 if (!k)
 101                         RETURN(-ENOMEM);
 102                 CFS_INIT_LIST_HEAD(&k->k_list);
 103         }
 104
 105         cfs_spin_lock(&capa_lock);
 106         k->k_key = *new;
 107         if (cfs_list_empty(&k->k_list))
 108                 cfs_list_add(&k->k_list, &filter->fo_capa_keys);
 109         cfs_spin_unlock(&capa_lock);
 110
 111         DEBUG_CAPA_KEY(D_SEC, new, "new");
 112         RETURN(0);
 113 }
 114
 115 int filter_auth_capa(struct obd_export *exp, struct lu_fid *fid, obd_seq seq,
 116                      struct lustre_capa *capa, __u64 opc)
 117 {
 118         struct obd_device *obd = exp->exp_obd;
 119         struct filter_obd *filter = &obd->u.filter;
 120         struct filter_capa_key *k;
 121         struct lustre_capa_key key;
 122         struct obd_capa *oc;
 123         __u8 *hmac;
 124         int keys_ready = 0, key_found = 0, rc = 0;
 125         ENTRY;
 126
 127         /* skip capa check for llog and obdecho */
 128         if (!fid_seq_is_mdt(seq))
 129                 RETURN(0);
 130
 131         /* capability is disabled */
 132         if (!filter->fo_fl_oss_capa)
 133                 RETURN(0);
 134
 135         if (!(exp->exp_connect_flags & OBD_CONNECT_OSS_CAPA))
 136                 RETURN(0);
 137
 138         if (capa == NULL) {
 139                 if (fid)
 140                         CERROR("seq/fid/opc "LPU64"/"DFID"/"LPX64
 141                                ": no capability has been passed\n",
 142                                seq, PFID(fid), opc);
 143                 else
 144                         CERROR("seq/opc "LPU64"/"LPX64
 145                                ": no capability has been passed\n",
 146                                seq, opc);
 147                 RETURN(-EACCES);
 148         }
 149
 150         if (opc == CAPA_OPC_OSS_READ) {
 151                 if (!(capa->lc_opc & CAPA_OPC_OSS_RW))
 152                         rc = -EACCES;
 153         } else if (!capa_opc_supported(capa, opc)) {
 154                 rc = -EACCES;
 155         }
 156         if (rc) {
 157                 DEBUG_CAPA(D_ERROR, capa, "opc "LPX64" not supported by", opc);
 158                 RETURN(rc);
 159         }
 160
 161         oc = capa_lookup(filter->fo_capa_hash, capa, 0);
 162         if (oc) {
 163                 cfs_spin_lock(&oc->c_lock);
 164                 if (capa_is_expired(oc)) {
 165                         DEBUG_CAPA(D_ERROR, capa, "expired");
 166                         rc = -ESTALE;
 167                 }
 168                 cfs_spin_unlock(&oc->c_lock);
 169
 170                 capa_put(oc);
 171                 RETURN(rc);
 172         }
 173
 174         if (capa_is_expired_sec(capa)) {
 175                 DEBUG_CAPA(D_ERROR, capa, "expired");
 176                 RETURN(-ESTALE);
 177         }
 178
 179         cfs_spin_lock(&capa_lock);
 180         cfs_list_for_each_entry(k, &filter->fo_capa_keys, k_list) {
 181                 if (k->k_key.lk_seq == seq) {
 182                         keys_ready = 1;
 183                         if (k->k_key.lk_keyid == capa_keyid(capa)) {
 184                                 key = k->k_key;
 185                                 key_found = 1;
 186                                 break;
 187                         }
 188                 }
 189         }
 190         cfs_spin_unlock(&capa_lock);
 191
 192         if (!keys_ready) {
 193                 CDEBUG(D_SEC, "MDS hasn't propagated capability keys yet, "
 194                        "ignore check!\n");
 195                 RETURN(0);
 196         }
 197
 198        if (!key_found) {
 199                 DEBUG_CAPA(D_ERROR, capa, "no matched capability key for");
 200                 RETURN(-ESTALE);
 201         }
 202
 203         OBD_ALLOC(hmac, CAPA_HMAC_MAX_LEN);
 204         if (hmac == NULL)
 205                 RETURN(-ENOMEM);
 206
 207         rc = capa_hmac(hmac, capa, key.lk_key);
 208         if (rc) {
 209                 DEBUG_CAPA(D_ERROR, capa, "HMAC failed: rc %d", rc);
 210                 OBD_FREE(hmac, CAPA_HMAC_MAX_LEN);
 211                 RETURN(rc);
 212         }
 213
 214         rc = memcmp(hmac, capa->lc_hmac, CAPA_HMAC_MAX_LEN);
 215         OBD_FREE(hmac, CAPA_HMAC_MAX_LEN);
 216         if (rc) {
 217                 DEBUG_CAPA_KEY(D_ERROR, &key, "calculate HMAC with ");
 218                 DEBUG_CAPA(D_ERROR, capa, "HMAC mismatch");
 219                 RETURN(-EACCES);
 220         }
 221
 222         /* store in capa hash */
 223         oc = capa_add(filter->fo_capa_hash, capa);
 224         capa_put(oc);
 225         RETURN(0);
 226 }
 227
 228 int filter_capa_fixoa(struct obd_export *exp, struct obdo *oa, obd_seq seq,
 229                       struct lustre_capa *capa)
 230 {
 231         int rc = 0;
 232         ENTRY;
 233
 234         /* skip capa check for llog and obdecho */
 235         if (!fid_seq_is_mdt(seq))
 236                 RETURN(0);
 237
 238         if (!(exp->exp_connect_flags & OBD_CONNECT_OSS_CAPA))
 239                 RETURN(0);
 240
 241         if (unlikely(!capa))
 242                 RETURN(-EACCES);
 243
 244         if (capa_flags(capa) == LC_ID_CONVERT) {
 245                 struct obd_device *obd = exp->exp_obd;
 246                 struct filter_obd *filter = &obd->u.filter;
 247                 struct filter_capa_key *k;
 248                 int found = 0;
 249
 250                 cfs_spin_lock(&capa_lock);
 251                 cfs_list_for_each_entry(k, &filter->fo_capa_keys, k_list) {
 252                         if (k->k_key.lk_seq == seq &&
 253                             k->k_key.lk_keyid == capa_keyid(capa)) {
 254                                 found = 1;
 255                                 break;
 256                         }
 257                 }
 258                 cfs_spin_unlock(&capa_lock);
 259
 260                 if (found) {
 261                         union {
 262                                 __u64 id64;
 263                                 __u32 id32[2];
 264                         } uid, gid;
 265                         __u32 d[4], s[4];
 266
 267                         uid.id64 = capa_uid(capa);
 268                         gid.id64 = capa_gid(capa);
 269                         s[0] = uid.id32[0];
 270                         s[1] = uid.id32[1];
 271                         s[2] = gid.id32[0];
 272                         s[3] = gid.id32[1];
 273
 274                         rc = capa_decrypt_id(d, s, k->k_key.lk_key,
 275                                              CAPA_HMAC_KEY_MAX_LEN);
 276                         if (unlikely(rc))
 277                                 RETURN(rc);
 278
 279                         oa->o_uid = d[0];
 280                         oa->o_gid = d[2];
 281                 } else {
 282                         DEBUG_CAPA(D_ERROR, capa, "no matched capability key for");
 283                         rc = -ESTALE;
 284                 }
 285         }
 286
 287         RETURN(rc);
 288 }
 289
 290 void filter_free_capa_keys(struct filter_obd *filter)
 291 {
 292         struct filter_capa_key *key, *n;
 293
 294         cfs_spin_lock(&capa_lock);
 295         cfs_list_for_each_entry_safe(key, n, &filter->fo_capa_keys, k_list) {
 296                 cfs_list_del_init(&key->k_list);
 297                 OBD_FREE(key, sizeof(*key));
 298         }
 299         cfs_spin_unlock(&capa_lock);
 300 }