lustre/obdfilter/filter_capa.c

   1 /* -*- mode: c; c-basic-offset: 8; indent-tabs-mode: nil; -*-
   2  * vim:expandtab:shiftwidth=8:tabstop=8:
   3  *
   4  * Copyright (C) 2005 Cluster File Systems, Inc.
   5  *
   6  * Author: Lai Siyao <lsy@clusterfs.com>
   7  *
   8  *   This file is part of Lustre, http://www.lustre.org.
   9  *
  10  *   Lustre is free software; you can redistribute it and/or
  11  *   modify it under the terms of version 2 of the GNU General Public
  12  *   License as published by the Free Software Foundation.
  13  *
  14  *   Lustre is distributed in the hope that it will be useful,
  15  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *   GNU General Public License for more details.
  18  *
  19  *   You should have received a copy of the GNU General Public License
  20  *   along with Lustre; if not, write to the Free Software
  21  *   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22  */
  23
  24 #define DEBUG_SUBSYSTEM S_FILTER
  25
  26 #include <linux/fs.h>
  27 #include <linux/version.h>
  28 #include <asm/uaccess.h>
  29 #include <linux/file.h>
  30 #include <linux/kmod.h>
  31
  32 #include <lustre_fsfilt.h>
  33 #include <lustre_capa.h>
  34
  35 #include "filter_internal.h"
  36
  37 /*
  38  * FIXME
  39  * keep this as simple as possible. we suppose the blacklist usually
  40  * be empry or very short (<5), since long term blacklist should be
  41  * done on MDS side. A more sophisticated blacklist will be implemented
  42  * later.
  43  *
  44  * note blacklist didn't take effect when OSS capability disabled. this
  45  * looks reasonable to me.
  46  */
  47 #define BLACKLIST_MAX   (32)
  48 static int nblacklist = 0;
  49 static uid_t blacklist[BLACKLIST_MAX];
  50 static spinlock_t blacklist_lock = SPIN_LOCK_UNLOCKED;
  51
  52 int blacklist_display(char *buf, int bufsize)
  53 {
  54         char one[16];
  55         int i;
  56         LASSERT(buf);
  57
  58         buf[0] = '\0';
  59         spin_lock(&blacklist_lock);
  60         for (i = 0; i < nblacklist; i++) {
  61                 snprintf(one, 16, "%u\n", blacklist[i]);
  62                 strncat(buf, one, bufsize);
  63         }
  64         spin_unlock(&blacklist_lock);
  65         return strnlen(buf, bufsize);
  66 }
  67
  68 void blacklist_add(uid_t uid)
  69 {
  70         int i;
  71
  72         spin_lock(&blacklist_lock);
  73         if (nblacklist == BLACKLIST_MAX) {
  74                 CERROR("can't add more in blacklist\n");
  75                 spin_unlock(&blacklist_lock);
  76                 return;
  77         }
  78
  79         for (i = 0; i < nblacklist; i++) {
  80                 if (blacklist[i] == uid) {
  81                         spin_unlock(&blacklist_lock);
  82                         return;
  83                 }
  84         }
  85
  86         blacklist[nblacklist++] = uid;
  87         spin_unlock(&blacklist_lock);
  88 }
  89
  90 void blacklist_del(uid_t uid)
  91 {
  92         int i;
  93
  94         spin_lock(&blacklist_lock);
  95         for (i = 0; i < nblacklist; i++) {
  96                 if (blacklist[i] == uid) {
  97                         nblacklist--;
  98                         while (i < nblacklist) {
  99                                 blacklist[i] = blacklist[i+1];
 100                                 i++;
 101                         }
 102                         spin_unlock(&blacklist_lock);
 103                         return;
 104                 }
 105         }
 106         spin_unlock(&blacklist_lock);
 107 }
 108
 109 static int blacklist_check(uid_t uid)
 110 {
 111         int i, rc = 0;
 112
 113         spin_lock(&blacklist_lock);
 114         for (i = 0; i < nblacklist; i++) {
 115                 if (blacklist[i] == uid) {
 116                         rc = 1;
 117                         break;
 118                 }
 119         }
 120         spin_unlock(&blacklist_lock);
 121         return rc;
 122 }
 123
 124 static inline __u32 filter_ck_keyid(struct filter_capa_key *key)
 125 {
 126         return key->k_key.lk_keyid;
 127 }
 128
 129 int filter_update_capa_key(struct obd_device *obd, struct lustre_capa_key *new)
 130 {
 131         struct filter_obd *filter = &obd->u.filter;
 132         struct filter_capa_key *k, *keys[2] = { NULL, NULL };
 133         int i;
 134
 135         spin_lock(&capa_lock);
 136         list_for_each_entry(k, &filter->fo_capa_keys, k_list) {
 137                 if (k->k_key.lk_mdsid != new->lk_mdsid)
 138                         continue;
 139
 140                 if (keys[0]) {
 141                         keys[1] = k;
 142                         if (filter_ck_keyid(keys[1]) > filter_ck_keyid(keys[0]))
 143                                 keys[1] = keys[0], keys[0] = k;
 144                 } else {
 145                         keys[0] = k;
 146                 }
 147         }
 148         spin_unlock(&capa_lock);
 149
 150         for (i = 0; i < 2; i++) {
 151                 if (!keys[i])
 152                         continue;
 153                 if (filter_ck_keyid(keys[i]) != new->lk_keyid)
 154                         continue;
 155                 /* maybe because of recovery or other reasons, MDS sent the
 156                  * the old capability key again.
 157                  */
 158                 spin_lock(&capa_lock);
 159                 keys[i]->k_key = *new;
 160                 spin_unlock(&capa_lock);
 161
 162                 RETURN(0);
 163         }
 164
 165         if (keys[1]) {
 166                 /* if OSS already have two keys, update the old one */
 167                 k = keys[1];
 168         } else {
 169                 OBD_ALLOC_PTR(k);
 170                 if (!k)
 171                         RETURN(-ENOMEM);
 172                 INIT_LIST_HEAD(&k->k_list);
 173         }
 174
 175         spin_lock(&capa_lock);
 176         k->k_key = *new;
 177         if (list_empty(&k->k_list))
 178                 list_add(&k->k_list, &filter->fo_capa_keys);
 179         spin_unlock(&capa_lock);
 180
 181         DEBUG_CAPA_KEY(D_SEC, new, "new");
 182         RETURN(0);
 183 }
 184
 185 int filter_auth_capa(struct obd_export *exp, struct lu_fid *fid, __u64 mdsid,
 186                      struct lustre_capa *capa, __u64 opc)
 187 {
 188         struct obd_device *obd = exp->exp_obd;
 189         struct filter_obd *filter = &obd->u.filter;
 190         struct filter_capa_key *k;
 191         struct lustre_capa_key key;
 192         struct obd_capa *oc;
 193         __u8 *hmac;
 194         int keys_ready = 0, key_found = 0, rc = 0;
 195         ENTRY;
 196
 197         /* capability is disabled */
 198         if (!filter->fo_fl_oss_capa)
 199                 RETURN(0);
 200
 201         if (capa == NULL) {
 202                 if (fid)
 203                         CERROR("mdsno/fid/opc "LPU64"/"DFID"/"LPX64
 204                                ": no capability has been passed\n",
 205                                mdsid, PFID(fid), opc);
 206                 else
 207                         CERROR("mdsno/opc "LPU64"/"LPX64
 208                                ": no capability has been passed\n",
 209                                mdsid, opc);
 210                 RETURN(-EACCES);
 211         }
 212
 213         if (blacklist_check(capa->lc_uid)) {
 214                 DEBUG_CAPA(D_ERROR, capa, "uid %u found in blacklist,",
 215                            capa->lc_uid);
 216                 RETURN(-EACCES);
 217         }
 218
 219 #warning "enable fid check in filter_auth_capa() when fid stored in OSS object"
 220
 221         if (opc == CAPA_OPC_OSS_READ) {
 222                 if (!(capa->lc_opc & CAPA_OPC_OSS_RW))
 223                         rc = -EACCES;
 224         } else if (!capa_opc_supported(capa, opc)) {
 225                 rc = -EACCES;
 226         }
 227         if (rc) {
 228                 DEBUG_CAPA(D_ERROR, capa, "opc "LPX64" not supported by", opc);
 229                 RETURN(rc);
 230         }
 231
 232         oc = capa_lookup(filter->fo_capa_hash, capa, 0);
 233         if (oc) {
 234                 spin_lock(&oc->c_lock);
 235                 if (capa_is_expired(oc)) {
 236                         DEBUG_CAPA(D_ERROR, capa, "expired");
 237                         rc = -ESTALE;
 238                 }
 239                 spin_unlock(&oc->c_lock);
 240
 241                 capa_put(oc);
 242                 RETURN(rc);
 243         }
 244
 245         spin_lock(&capa_lock);
 246         list_for_each_entry(k, &filter->fo_capa_keys, k_list)
 247                 if (k->k_key.lk_mdsid == mdsid) {
 248                         keys_ready = 1;
 249                         if (k->k_key.lk_keyid == capa_keyid(capa)) {
 250                                 key = k->k_key;
 251                                 key_found = 1;
 252                                 break;
 253                         }
 254                 }
 255         spin_unlock(&capa_lock);
 256
 257         if (!keys_ready) {
 258                 CDEBUG(D_SEC, "MDS hasn't propagated capability keys yet, "
 259                        "ignore check!\n");
 260                 RETURN(0);
 261         }
 262
 263        if (!key_found) {
 264                 DEBUG_CAPA(D_ERROR, capa, "no matched capability key for");
 265                 RETURN(-ESTALE);
 266         }
 267
 268         OBD_ALLOC(hmac, CAPA_HMAC_MAX_LEN);
 269         if (hmac == NULL)
 270                 RETURN(-ENOMEM);
 271
 272         rc = capa_hmac(hmac, capa, key.lk_key);
 273         if (rc) {
 274                 DEBUG_CAPA(D_ERROR, capa, "HMAC failed: rc %d", rc);
 275                 OBD_FREE(hmac, CAPA_HMAC_MAX_LEN);
 276                 RETURN(rc);
 277         }
 278
 279         rc = memcmp(hmac, capa->lc_hmac, CAPA_HMAC_MAX_LEN);
 280         OBD_FREE(hmac, CAPA_HMAC_MAX_LEN);
 281         if (rc) {
 282                 DEBUG_CAPA_KEY(D_ERROR, &key, "calculate HMAC with ");
 283                 DEBUG_CAPA(D_ERROR, capa, "HMAC mismatch");
 284                 RETURN(-EACCES);
 285         }
 286
 287         /* store in capa hash */
 288         oc = capa_add(filter->fo_capa_hash, capa);
 289         capa_put(oc);
 290         RETURN(0);
 291 }
 292
 293 void filter_free_capa_keys(struct filter_obd *filter)
 294 {
 295         struct filter_capa_key *key, *n;
 296
 297         spin_lock(&capa_lock);
 298         list_for_each_entry_safe(key, n, &filter->fo_capa_keys, k_list) {
 299                 list_del_init(&key->k_list);
 300                 OBD_FREE(key, sizeof(*key));
 301         }
 302         spin_unlock(&capa_lock);
 303 }