Whamcloud - gitweb
b=21571 stacksize and locking fixes for loadgen patch from umka
[fs/lustre-release.git] / lustre / obdfilter / filter_capa.c
1 /* -*- mode: c; c-basic-offset: 8; indent-tabs-mode: nil; -*-
2  * vim:expandtab:shiftwidth=8:tabstop=8:
3  *
4  * GPL HEADER START
5  *
6  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License version 2 only,
10  * as published by the Free Software Foundation.
11  *
12  * This program is distributed in the hope that it will be useful, but
13  * WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * General Public License version 2 for more details (a copy is included
16  * in the LICENSE file that accompanied this code).
17  *
18  * You should have received a copy of the GNU General Public License
19  * version 2 along with this program; If not, see
20  * http://www.sun.com/software/products/lustre/docs/GPLv2.pdf
21  *
22  * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
23  * CA 95054 USA or visit www.sun.com if you need additional information or
24  * have any questions.
25  *
26  * GPL HEADER END
27  */
28 /*
29  * Copyright  2008 Sun Microsystems, Inc. All rights reserved
30  * Use is subject to license terms.
31  */
32 /*
33  * This file is part of Lustre, http://www.lustre.org/
34  * Lustre is a trademark of Sun Microsystems, Inc.
35  *
36  * lustre/obdfilter/filter_capa.c
37  *
38  * Author: Lai Siyao <lsy@clusterfs.com>
39  */
40
41 #define DEBUG_SUBSYSTEM S_FILTER
42
43 #include <linux/fs.h>
44 #include <linux/version.h>
45 #include <asm/uaccess.h>
46 #include <linux/file.h>
47 #include <linux/kmod.h>
48
49 #include <lustre_fsfilt.h>
50 #include <lustre_capa.h>
51
52 #include "filter_internal.h"
53
54 static inline __u32 filter_ck_keyid(struct filter_capa_key *key)
55 {
56         return key->k_key.lk_keyid;
57 }
58
59 int filter_update_capa_key(struct obd_device *obd, struct lustre_capa_key *new)
60 {
61         struct filter_obd *filter = &obd->u.filter;
62         struct filter_capa_key *k, *keys[2] = { NULL, NULL };
63         int i;
64
65         spin_lock(&capa_lock);
66         list_for_each_entry(k, &filter->fo_capa_keys, k_list) {
67                 if (k->k_key.lk_mdsid != new->lk_mdsid)
68                         continue;
69
70                 if (keys[0]) {
71                         keys[1] = k;
72                         if (filter_ck_keyid(keys[1]) > filter_ck_keyid(keys[0]))
73                                 keys[1] = keys[0], keys[0] = k;
74                 } else {
75                         keys[0] = k;
76                 }
77         }
78         spin_unlock(&capa_lock);
79
80         for (i = 0; i < 2; i++) {
81                 if (!keys[i])
82                         continue;
83                 if (filter_ck_keyid(keys[i]) != new->lk_keyid)
84                         continue;
85                 /* maybe because of recovery or other reasons, MDS sent the
86                  * the old capability key again.
87                  */
88                 spin_lock(&capa_lock);
89                 keys[i]->k_key = *new;
90                 spin_unlock(&capa_lock);
91
92                 RETURN(0);
93         }
94
95         if (keys[1]) {
96                 /* if OSS already have two keys, update the old one */
97                 k = keys[1];
98         } else {
99                 OBD_ALLOC_PTR(k);
100                 if (!k)
101                         RETURN(-ENOMEM);
102                 CFS_INIT_LIST_HEAD(&k->k_list);
103         }
104
105         spin_lock(&capa_lock);
106         k->k_key = *new;
107         if (list_empty(&k->k_list))
108                 list_add(&k->k_list, &filter->fo_capa_keys);
109         spin_unlock(&capa_lock);
110
111         DEBUG_CAPA_KEY(D_SEC, new, "new");
112         RETURN(0);
113 }
114
115 int filter_auth_capa(struct obd_export *exp, struct lu_fid *fid, obd_gr group,
116                      struct lustre_capa *capa, __u64 opc)
117 {
118         struct obd_device *obd = exp->exp_obd;
119         struct filter_obd *filter = &obd->u.filter;
120         struct filter_capa_key *k;
121         struct lustre_capa_key key;
122         struct obd_capa *oc;
123         __u64 mdsid;
124         __u8 *hmac;
125         int keys_ready = 0, key_found = 0, rc = 0;
126         ENTRY;
127
128         /* skip capa check for llog and obdecho */
129         if (!filter_group_is_mds(group))
130                 RETURN(0);
131
132         /* capability is disabled */
133         if (!filter->fo_fl_oss_capa)
134                 RETURN(0);
135
136         if (!(exp->exp_connect_flags & OBD_CONNECT_OSS_CAPA))
137                 RETURN(0);
138
139         mdsid = objgrp_to_mdsno(group);
140         if (capa == NULL) {
141                 if (fid)
142                         CERROR("mdsno/fid/opc "LPU64"/"DFID"/"LPX64
143                                ": no capability has been passed\n",
144                                mdsid, PFID(fid), opc);
145                 else
146                         CERROR("mdsno/opc "LPU64"/"LPX64
147                                ": no capability has been passed\n",
148                                mdsid, opc);
149                 RETURN(-EACCES);
150         }
151
152         if (opc == CAPA_OPC_OSS_READ) {
153                 if (!(capa->lc_opc & CAPA_OPC_OSS_RW))
154                         rc = -EACCES;
155         } else if (!capa_opc_supported(capa, opc)) {
156                 rc = -EACCES;
157         }
158         if (rc) {
159                 DEBUG_CAPA(D_ERROR, capa, "opc "LPX64" not supported by", opc);
160                 RETURN(rc);
161         }
162
163         oc = capa_lookup(filter->fo_capa_hash, capa, 0);
164         if (oc) {
165                 spin_lock(&oc->c_lock);
166                 if (capa_is_expired(oc)) {
167                         DEBUG_CAPA(D_ERROR, capa, "expired");
168                         rc = -ESTALE;
169                 }
170                 spin_unlock(&oc->c_lock);
171
172                 capa_put(oc);
173                 RETURN(rc);
174         }
175
176         if (capa_is_expired_sec(capa)) {
177                 DEBUG_CAPA(D_ERROR, capa, "expired");
178                 RETURN(-ESTALE);
179         }
180
181         spin_lock(&capa_lock);
182         list_for_each_entry(k, &filter->fo_capa_keys, k_list) {
183                 if (k->k_key.lk_mdsid == mdsid) {
184                         keys_ready = 1;
185                         if (k->k_key.lk_keyid == capa_keyid(capa)) {
186                                 key = k->k_key;
187                                 key_found = 1;
188                                 break;
189                         }
190                 }
191         }
192         spin_unlock(&capa_lock);
193
194         if (!keys_ready) {
195                 CDEBUG(D_SEC, "MDS hasn't propagated capability keys yet, "
196                        "ignore check!\n");
197                 RETURN(0);
198         }
199
200        if (!key_found) {
201                 DEBUG_CAPA(D_ERROR, capa, "no matched capability key for");
202                 RETURN(-ESTALE);
203         }
204
205         OBD_ALLOC(hmac, CAPA_HMAC_MAX_LEN);
206         if (hmac == NULL)
207                 RETURN(-ENOMEM);
208
209         rc = capa_hmac(hmac, capa, key.lk_key);
210         if (rc) {
211                 DEBUG_CAPA(D_ERROR, capa, "HMAC failed: rc %d", rc);
212                 OBD_FREE(hmac, CAPA_HMAC_MAX_LEN);
213                 RETURN(rc);
214         }
215
216         rc = memcmp(hmac, capa->lc_hmac, CAPA_HMAC_MAX_LEN);
217         OBD_FREE(hmac, CAPA_HMAC_MAX_LEN);
218         if (rc) {
219                 DEBUG_CAPA_KEY(D_ERROR, &key, "calculate HMAC with ");
220                 DEBUG_CAPA(D_ERROR, capa, "HMAC mismatch");
221                 RETURN(-EACCES);
222         }
223
224         /* store in capa hash */
225         oc = capa_add(filter->fo_capa_hash, capa);
226         capa_put(oc);
227         RETURN(0);
228 }
229
230 int filter_capa_fixoa(struct obd_export *exp, struct obdo *oa, obd_gr group,
231                       struct lustre_capa *capa)
232 {
233         __u64 mdsid;
234         int rc = 0;
235         ENTRY;
236
237         /* skip capa check for llog and obdecho */
238         if (!filter_group_is_mds(group))
239                 RETURN(0);
240
241         if (!(exp->exp_connect_flags & OBD_CONNECT_OSS_CAPA))
242                 RETURN(0);
243
244         if (unlikely(!capa))
245                 RETURN(-EACCES);
246
247         mdsid = objgrp_to_mdsno(group);
248         if (capa_flags(capa) == LC_ID_CONVERT) {
249                 struct obd_device *obd = exp->exp_obd;
250                 struct filter_obd *filter = &obd->u.filter;
251                 struct filter_capa_key *k;
252                 int found = 0;
253
254                 spin_lock(&capa_lock);
255                 list_for_each_entry(k, &filter->fo_capa_keys, k_list) {
256                         if (k->k_key.lk_mdsid == mdsid &&
257                             k->k_key.lk_keyid == capa_keyid(capa)) {
258                                 found = 1;
259                                 break;
260                         }
261                 }
262                 spin_unlock(&capa_lock);
263
264                 if (found) {
265                         union {
266                                 __u64 id64;
267                                 __u32 id32[2];
268                         } uid, gid;
269                         __u32 d[4], s[4];
270
271                         uid.id64 = capa_uid(capa);
272                         gid.id64 = capa_gid(capa);
273                         s[0] = uid.id32[0];
274                         s[1] = uid.id32[1];
275                         s[2] = gid.id32[0];
276                         s[3] = gid.id32[1];
277
278                         rc = capa_decrypt_id(d, s, k->k_key.lk_key,
279                                              CAPA_HMAC_KEY_MAX_LEN);
280                         if (unlikely(rc))
281                                 RETURN(rc);
282
283                         oa->o_uid = d[0];
284                         oa->o_gid = d[2];
285                 } else {
286                         DEBUG_CAPA(D_ERROR, capa, "no matched capability key for");
287                         rc = -ESTALE;
288                 }
289         }
290
291         RETURN(rc);
292 }
293
294 void filter_free_capa_keys(struct filter_obd *filter)
295 {
296         struct filter_capa_key *key, *n;
297
298         spin_lock(&capa_lock);
299         list_for_each_entry_safe(key, n, &filter->fo_capa_keys, k_list) {
300                 list_del_init(&key->k_list);
301                 OBD_FREE(key, sizeof(*key));
302         }
303         spin_unlock(&capa_lock);
304 }