lustre/ptlrpc/sec.c

   1 /*
   2  * GPL HEADER START
   3  *
   4  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 only,
   8  * as published by the Free Software Foundation.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13  * General Public License version 2 for more details (a copy is included
  14  * in the LICENSE file that accompanied this code).
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * version 2 along with this program; If not, see
  18  * http://www.gnu.org/licenses/gpl-2.0.html
  19  *
  20  * GPL HEADER END
  21  */
  22 /*
  23  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Use is subject to license terms.
  25  *
  26  * Copyright (c) 2011, 2017, Intel Corporation.
  27  */
  28 /*
  29  * This file is part of Lustre, http://www.lustre.org/
  30  * Lustre is a trademark of Sun Microsystems, Inc.
  31  *
  32  * lustre/ptlrpc/sec.c
  33  *
  34  * Author: Eric Mei <ericm@clusterfs.com>
  35  */
  36
  37 #define DEBUG_SUBSYSTEM S_SEC
  38
  39 #include <linux/user_namespace.h>
  40 #include <linux/uidgid.h>
  41 #include <linux/crypto.h>
  42 #include <linux/key.h>
  43
  44 #include <libcfs/libcfs.h>
  45 #include <obd.h>
  46 #include <obd_class.h>
  47 #include <obd_support.h>
  48 #include <lustre_net.h>
  49 #include <lustre_import.h>
  50 #include <lustre_dlm.h>
  51 #include <lustre_sec.h>
  52
  53 #include "ptlrpc_internal.h"
  54
  55 static int send_sepol;
  56 module_param(send_sepol, int, 0644);
  57 MODULE_PARM_DESC(send_sepol, "Client sends SELinux policy status");
  58
  59 /*
  60  * policy registers
  61  */
  62
  63 static rwlock_t policy_lock;
  64 static struct ptlrpc_sec_policy *policies[SPTLRPC_POLICY_MAX] = {
  65         NULL,
  66 };
  67
  68 int sptlrpc_register_policy(struct ptlrpc_sec_policy *policy)
  69 {
  70         __u16 number = policy->sp_policy;
  71
  72         LASSERT(policy->sp_name);
  73         LASSERT(policy->sp_cops);
  74         LASSERT(policy->sp_sops);
  75
  76         if (number >= SPTLRPC_POLICY_MAX)
  77                 return -EINVAL;
  78
  79         write_lock(&policy_lock);
  80         if (unlikely(policies[number])) {
  81                 write_unlock(&policy_lock);
  82                 return -EALREADY;
  83         }
  84         policies[number] = policy;
  85         write_unlock(&policy_lock);
  86
  87         CDEBUG(D_SEC, "%s: registered\n", policy->sp_name);
  88         return 0;
  89 }
  90 EXPORT_SYMBOL(sptlrpc_register_policy);
  91
  92 int sptlrpc_unregister_policy(struct ptlrpc_sec_policy *policy)
  93 {
  94         __u16 number = policy->sp_policy;
  95
  96         LASSERT(number < SPTLRPC_POLICY_MAX);
  97
  98         write_lock(&policy_lock);
  99         if (unlikely(policies[number] == NULL)) {
 100                 write_unlock(&policy_lock);
 101                 CERROR("%s: already unregistered\n", policy->sp_name);
 102                 return -EINVAL;
 103         }
 104
 105         LASSERT(policies[number] == policy);
 106         policies[number] = NULL;
 107         write_unlock(&policy_lock);
 108
 109         CDEBUG(D_SEC, "%s: unregistered\n", policy->sp_name);
 110         return 0;
 111 }
 112 EXPORT_SYMBOL(sptlrpc_unregister_policy);
 113
 114 static
 115 struct ptlrpc_sec_policy *sptlrpc_wireflavor2policy(__u32 flavor)
 116 {
 117         static DEFINE_MUTEX(load_mutex);
 118         static atomic_t           loaded = ATOMIC_INIT(0);
 119         struct ptlrpc_sec_policy *policy;
 120         __u16                     number = SPTLRPC_FLVR_POLICY(flavor);
 121         __u16                     flag = 0;
 122
 123         if (number >= SPTLRPC_POLICY_MAX)
 124                 return NULL;
 125
 126         while (1) {
 127                 read_lock(&policy_lock);
 128                 policy = policies[number];
 129                 if (policy && !try_module_get(policy->sp_owner))
 130                         policy = NULL;
 131                 if (policy == NULL)
 132                         flag = atomic_read(&loaded);
 133                 read_unlock(&policy_lock);
 134
 135                 if (policy != NULL || flag != 0 ||
 136                     number != SPTLRPC_POLICY_GSS)
 137                         break;
 138
 139                 /* try to load gss module, once */
 140                 mutex_lock(&load_mutex);
 141                 if (atomic_read(&loaded) == 0) {
 142                         if (request_module("ptlrpc_gss") == 0)
 143                                 CDEBUG(D_SEC,
 144                                        "module ptlrpc_gss loaded on demand\n");
 145                         else
 146                                 CERROR("Unable to load module ptlrpc_gss\n");
 147
 148                         atomic_set(&loaded, 1);
 149                 }
 150                 mutex_unlock(&load_mutex);
 151         }
 152
 153         return policy;
 154 }
 155
 156 __u32 sptlrpc_name2flavor_base(const char *name)
 157 {
 158         if (!strcmp(name, "null"))
 159                 return SPTLRPC_FLVR_NULL;
 160         if (!strcmp(name, "plain"))
 161                 return SPTLRPC_FLVR_PLAIN;
 162         if (!strcmp(name, "gssnull"))
 163                 return SPTLRPC_FLVR_GSSNULL;
 164         if (!strcmp(name, "krb5n"))
 165                 return SPTLRPC_FLVR_KRB5N;
 166         if (!strcmp(name, "krb5a"))
 167                 return SPTLRPC_FLVR_KRB5A;
 168         if (!strcmp(name, "krb5i"))
 169                 return SPTLRPC_FLVR_KRB5I;
 170         if (!strcmp(name, "krb5p"))
 171                 return SPTLRPC_FLVR_KRB5P;
 172         if (!strcmp(name, "skn"))
 173                 return SPTLRPC_FLVR_SKN;
 174         if (!strcmp(name, "ska"))
 175                 return SPTLRPC_FLVR_SKA;
 176         if (!strcmp(name, "ski"))
 177                 return SPTLRPC_FLVR_SKI;
 178         if (!strcmp(name, "skpi"))
 179                 return SPTLRPC_FLVR_SKPI;
 180
 181         return SPTLRPC_FLVR_INVALID;
 182 }
 183 EXPORT_SYMBOL(sptlrpc_name2flavor_base);
 184
 185 const char *sptlrpc_flavor2name_base(__u32 flvr)
 186 {
 187         __u32   base = SPTLRPC_FLVR_BASE(flvr);
 188
 189         if (base == SPTLRPC_FLVR_BASE(SPTLRPC_FLVR_NULL))
 190                 return "null";
 191         else if (base == SPTLRPC_FLVR_BASE(SPTLRPC_FLVR_PLAIN))
 192                 return "plain";
 193         else if (base == SPTLRPC_FLVR_BASE(SPTLRPC_FLVR_GSSNULL))
 194                 return "gssnull";
 195         else if (base == SPTLRPC_FLVR_BASE(SPTLRPC_FLVR_KRB5N))
 196                 return "krb5n";
 197         else if (base == SPTLRPC_FLVR_BASE(SPTLRPC_FLVR_KRB5A))
 198                 return "krb5a";
 199         else if (base == SPTLRPC_FLVR_BASE(SPTLRPC_FLVR_KRB5I))
 200                 return "krb5i";
 201         else if (base == SPTLRPC_FLVR_BASE(SPTLRPC_FLVR_KRB5P))
 202                 return "krb5p";
 203         else if (base == SPTLRPC_FLVR_BASE(SPTLRPC_FLVR_SKN))
 204                 return "skn";
 205         else if (base == SPTLRPC_FLVR_BASE(SPTLRPC_FLVR_SKA))
 206                 return "ska";
 207         else if (base == SPTLRPC_FLVR_BASE(SPTLRPC_FLVR_SKI))
 208                 return "ski";
 209         else if (base == SPTLRPC_FLVR_BASE(SPTLRPC_FLVR_SKPI))
 210                 return "skpi";
 211
 212         CERROR("invalid wire flavor 0x%x\n", flvr);
 213         return "invalid";
 214 }
 215 EXPORT_SYMBOL(sptlrpc_flavor2name_base);
 216
 217 char *sptlrpc_flavor2name_bulk(struct sptlrpc_flavor *sf,
 218                                char *buf, int bufsize)
 219 {
 220         if (SPTLRPC_FLVR_POLICY(sf->sf_rpc) == SPTLRPC_POLICY_PLAIN)
 221                 snprintf(buf, bufsize, "hash:%s",
 222                         sptlrpc_get_hash_name(sf->u_bulk.hash.hash_alg));
 223         else
 224                 snprintf(buf, bufsize, "%s",
 225                         sptlrpc_flavor2name_base(sf->sf_rpc));
 226
 227         buf[bufsize - 1] = '\0';
 228         return buf;
 229 }
 230 EXPORT_SYMBOL(sptlrpc_flavor2name_bulk);
 231
 232 char *sptlrpc_flavor2name(struct sptlrpc_flavor *sf, char *buf, int bufsize)
 233 {
 234         snprintf(buf, bufsize, "%s", sptlrpc_flavor2name_base(sf->sf_rpc));
 235
 236         /*
 237          * currently we don't support customized bulk specification for
 238          * flavors other than plain
 239          */
 240         if (SPTLRPC_FLVR_POLICY(sf->sf_rpc) == SPTLRPC_POLICY_PLAIN) {
 241                 char bspec[16];
 242
 243                 bspec[0] = '-';
 244                 sptlrpc_flavor2name_bulk(sf, &bspec[1], sizeof(bspec) - 1);
 245                 strncat(buf, bspec, bufsize);
 246         }
 247
 248         buf[bufsize - 1] = '\0';
 249         return buf;
 250 }
 251 EXPORT_SYMBOL(sptlrpc_flavor2name);
 252
 253 char *sptlrpc_secflags2str(__u32 flags, char *buf, int bufsize)
 254 {
 255         buf[0] = '\0';
 256
 257         if (flags & PTLRPC_SEC_FL_REVERSE)
 258                 strlcat(buf, "reverse,", bufsize);
 259         if (flags & PTLRPC_SEC_FL_ROOTONLY)
 260                 strlcat(buf, "rootonly,", bufsize);
 261         if (flags & PTLRPC_SEC_FL_UDESC)
 262                 strlcat(buf, "udesc,", bufsize);
 263         if (flags & PTLRPC_SEC_FL_BULK)
 264                 strlcat(buf, "bulk,", bufsize);
 265         if (buf[0] == '\0')
 266                 strlcat(buf, "-,", bufsize);
 267
 268         return buf;
 269 }
 270 EXPORT_SYMBOL(sptlrpc_secflags2str);
 271
 272 /*
 273  * client context APIs
 274  */
 275
 276 static
 277 struct ptlrpc_cli_ctx *get_my_ctx(struct ptlrpc_sec *sec)
 278 {
 279         struct vfs_cred vcred;
 280         int create = 1, remove_dead = 1;
 281
 282         LASSERT(sec);
 283         LASSERT(sec->ps_policy->sp_cops->lookup_ctx);
 284
 285         if (sec->ps_flvr.sf_flags & (PTLRPC_SEC_FL_REVERSE |
 286                                      PTLRPC_SEC_FL_ROOTONLY)) {
 287                 vcred.vc_uid = 0;
 288                 vcred.vc_gid = 0;
 289                 if (sec->ps_flvr.sf_flags & PTLRPC_SEC_FL_REVERSE) {
 290                         create = 0;
 291                         remove_dead = 0;
 292                 }
 293         } else {
 294                 vcred.vc_uid = from_kuid(&init_user_ns, current_uid());
 295                 vcred.vc_gid = from_kgid(&init_user_ns, current_gid());
 296         }
 297
 298         return sec->ps_policy->sp_cops->lookup_ctx(sec, &vcred, create,
 299                                                    remove_dead);
 300 }
 301
 302 struct ptlrpc_cli_ctx *sptlrpc_cli_ctx_get(struct ptlrpc_cli_ctx *ctx)
 303 {
 304         atomic_inc(&ctx->cc_refcount);
 305         return ctx;
 306 }
 307 EXPORT_SYMBOL(sptlrpc_cli_ctx_get);
 308
 309 void sptlrpc_cli_ctx_put(struct ptlrpc_cli_ctx *ctx, int sync)
 310 {
 311         struct ptlrpc_sec *sec = ctx->cc_sec;
 312
 313         LASSERT(sec);
 314         LASSERT_ATOMIC_POS(&ctx->cc_refcount);
 315
 316         if (!atomic_dec_and_test(&ctx->cc_refcount))
 317                 return;
 318
 319         sec->ps_policy->sp_cops->release_ctx(sec, ctx, sync);
 320 }
 321 EXPORT_SYMBOL(sptlrpc_cli_ctx_put);
 322
 323 /**
 324  * Expire the client context immediately.
 325  *
 326  * \pre Caller must hold at least 1 reference on the \a ctx.
 327  */
 328 void sptlrpc_cli_ctx_expire(struct ptlrpc_cli_ctx *ctx)
 329 {
 330         LASSERT(ctx->cc_ops->die);
 331         ctx->cc_ops->die(ctx, 0);
 332 }
 333 EXPORT_SYMBOL(sptlrpc_cli_ctx_expire);
 334
 335 /**
 336  * To wake up the threads who are waiting for this client context. Called
 337  * after some status change happened on \a ctx.
 338  */
 339 void sptlrpc_cli_ctx_wakeup(struct ptlrpc_cli_ctx *ctx)
 340 {
 341         struct ptlrpc_request *req, *next;
 342
 343         spin_lock(&ctx->cc_lock);
 344         list_for_each_entry_safe(req, next, &ctx->cc_req_list,
 345                                      rq_ctx_chain) {
 346                 list_del_init(&req->rq_ctx_chain);
 347                 ptlrpc_client_wake_req(req);
 348         }
 349         spin_unlock(&ctx->cc_lock);
 350 }
 351 EXPORT_SYMBOL(sptlrpc_cli_ctx_wakeup);
 352
 353 int sptlrpc_cli_ctx_display(struct ptlrpc_cli_ctx *ctx, char *buf, int bufsize)
 354 {
 355         LASSERT(ctx->cc_ops);
 356
 357         if (ctx->cc_ops->display == NULL)
 358                 return 0;
 359
 360         return ctx->cc_ops->display(ctx, buf, bufsize);
 361 }
 362
 363 static int import_sec_check_expire(struct obd_import *imp)
 364 {
 365         int adapt = 0;
 366
 367         write_lock(&imp->imp_sec_lock);
 368         if (imp->imp_sec_expire &&
 369             imp->imp_sec_expire < ktime_get_real_seconds()) {
 370                 adapt = 1;
 371                 imp->imp_sec_expire = 0;
 372         }
 373         write_unlock(&imp->imp_sec_lock);
 374
 375         if (!adapt)
 376                 return 0;
 377
 378         CDEBUG(D_SEC, "found delayed sec adapt expired, do it now\n");
 379         return sptlrpc_import_sec_adapt(imp, NULL, NULL);
 380 }
 381
 382 /**
 383  * Get and validate the client side ptlrpc security facilities from
 384  * \a imp. There is a race condition on client reconnect when the import is
 385  * being destroyed while there are outstanding client bound requests. In
 386  * this case do not output any error messages if import secuity is not
 387  * found.
 388  *
 389  * \param[in] imp obd import associated with client
 390  * \param[out] sec client side ptlrpc security
 391  *
 392  * \retval 0 if security retrieved successfully
 393  * \retval -ve errno if there was a problem
 394  */
 395 static int import_sec_validate_get(struct obd_import *imp,
 396                                    struct ptlrpc_sec **sec)
 397 {
 398         int rc;
 399
 400         if (unlikely(imp->imp_sec_expire)) {
 401                 rc = import_sec_check_expire(imp);
 402                 if (rc)
 403                         return rc;
 404         }
 405
 406         *sec = sptlrpc_import_sec_ref(imp);
 407         if (*sec == NULL) {
 408                 CERROR("import %p (%s) with no sec\n",
 409                         imp, ptlrpc_import_state_name(imp->imp_state));
 410                 return -EACCES;
 411         }
 412
 413         if (unlikely((*sec)->ps_dying)) {
 414                 CERROR("attempt to use dying sec %p\n", sec);
 415                 sptlrpc_sec_put(*sec);
 416                 return -EACCES;
 417         }
 418
 419         return 0;
 420 }
 421
 422 /**
 423  * Given a \a req, find or allocate an appropriate context for it.
 424  * \pre req->rq_cli_ctx == NULL.
 425  *
 426  * \retval 0 succeed, and req->rq_cli_ctx is set.
 427  * \retval -ev error number, and req->rq_cli_ctx == NULL.
 428  */
 429 int sptlrpc_req_get_ctx(struct ptlrpc_request *req)
 430 {
 431         struct obd_import *imp = req->rq_import;
 432         struct ptlrpc_sec *sec;
 433         int rc;
 434
 435         ENTRY;
 436
 437         LASSERT(!req->rq_cli_ctx);
 438         LASSERT(imp);
 439
 440         rc = import_sec_validate_get(imp, &sec);
 441         if (rc)
 442                 RETURN(rc);
 443
 444         req->rq_cli_ctx = get_my_ctx(sec);
 445
 446         sptlrpc_sec_put(sec);
 447
 448         if (!req->rq_cli_ctx) {
 449                 CERROR("req %p: fail to get context\n", req);
 450                 RETURN(-ECONNREFUSED);
 451         }
 452
 453         RETURN(0);
 454 }
 455
 456 /**
 457  * Drop the context for \a req.
 458  * \pre req->rq_cli_ctx != NULL.
 459  * \post req->rq_cli_ctx == NULL.
 460  *
 461  * If \a sync == 0, this function should return quickly without sleep;
 462  * otherwise it might trigger and wait for the whole process of sending
 463  * an context-destroying rpc to server.
 464  */
 465 void sptlrpc_req_put_ctx(struct ptlrpc_request *req, int sync)
 466 {
 467         ENTRY;
 468
 469         LASSERT(req);
 470         LASSERT(req->rq_cli_ctx);
 471
 472         /*
 473          * request might be asked to release earlier while still
 474          * in the context waiting list.
 475          */
 476         if (!list_empty(&req->rq_ctx_chain)) {
 477                 spin_lock(&req->rq_cli_ctx->cc_lock);
 478                 list_del_init(&req->rq_ctx_chain);
 479                 spin_unlock(&req->rq_cli_ctx->cc_lock);
 480         }
 481
 482         sptlrpc_cli_ctx_put(req->rq_cli_ctx, sync);
 483         req->rq_cli_ctx = NULL;
 484         EXIT;
 485 }
 486
 487 static
 488 int sptlrpc_req_ctx_switch(struct ptlrpc_request *req,
 489                            struct ptlrpc_cli_ctx *oldctx,
 490                            struct ptlrpc_cli_ctx *newctx)
 491 {
 492         struct sptlrpc_flavor   old_flvr;
 493         char *reqmsg = NULL; /* to workaround old gcc */
 494         int reqmsg_size;
 495         int rc = 0;
 496
 497         LASSERT(req->rq_reqmsg);
 498         LASSERT(req->rq_reqlen);
 499         LASSERT(req->rq_replen);
 500
 501         CDEBUG(D_SEC,
 502                "req %p: switch ctx %p(%u->%s) -> %p(%u->%s), switch sec %p(%s) -> %p(%s)\n",
 503                req, oldctx, oldctx->cc_vcred.vc_uid,
 504                sec2target_str(oldctx->cc_sec), newctx, newctx->cc_vcred.vc_uid,
 505                sec2target_str(newctx->cc_sec), oldctx->cc_sec,
 506                oldctx->cc_sec->ps_policy->sp_name, newctx->cc_sec,
 507                newctx->cc_sec->ps_policy->sp_name);
 508
 509         /* save flavor */
 510         old_flvr = req->rq_flvr;
 511
 512         /* save request message */
 513         reqmsg_size = req->rq_reqlen;
 514         if (reqmsg_size != 0) {
 515                 OBD_ALLOC_LARGE(reqmsg, reqmsg_size);
 516                 if (reqmsg == NULL)
 517                         return -ENOMEM;
 518                 memcpy(reqmsg, req->rq_reqmsg, reqmsg_size);
 519         }
 520
 521         /* release old req/rep buf */
 522         req->rq_cli_ctx = oldctx;
 523         sptlrpc_cli_free_reqbuf(req);
 524         sptlrpc_cli_free_repbuf(req);
 525         req->rq_cli_ctx = newctx;
 526
 527         /* recalculate the flavor */
 528         sptlrpc_req_set_flavor(req, 0);
 529
 530         /*
 531          * alloc new request buffer
 532          * we don't need to alloc reply buffer here, leave it to the
 533          * rest procedure of ptlrpc
 534          */
 535         if (reqmsg_size != 0) {
 536                 rc = sptlrpc_cli_alloc_reqbuf(req, reqmsg_size);
 537                 if (!rc) {
 538                         LASSERT(req->rq_reqmsg);
 539                         memcpy(req->rq_reqmsg, reqmsg, reqmsg_size);
 540                 } else {
 541                         CWARN("failed to alloc reqbuf: %d\n", rc);
 542                         req->rq_flvr = old_flvr;
 543                 }
 544
 545                 OBD_FREE_LARGE(reqmsg, reqmsg_size);
 546         }
 547         return rc;
 548 }
 549
 550 /**
 551  * If current context of \a req is dead somehow, e.g. we just switched flavor
 552  * thus marked original contexts dead, we'll find a new context for it. if
 553  * no switch is needed, \a req will end up with the same context.
 554  *
 555  * \note a request must have a context, to keep other parts of code happy.
 556  * In any case of failure during the switching, we must restore the old one.
 557  */
 558 int sptlrpc_req_replace_dead_ctx(struct ptlrpc_request *req)
 559 {
 560         struct ptlrpc_cli_ctx *oldctx = req->rq_cli_ctx;
 561         struct ptlrpc_cli_ctx *newctx;
 562         int rc;
 563
 564         ENTRY;
 565
 566         LASSERT(oldctx);
 567
 568         sptlrpc_cli_ctx_get(oldctx);
 569         sptlrpc_req_put_ctx(req, 0);
 570
 571         rc = sptlrpc_req_get_ctx(req);
 572         if (unlikely(rc)) {
 573                 LASSERT(!req->rq_cli_ctx);
 574
 575                 /* restore old ctx */
 576                 req->rq_cli_ctx = oldctx;
 577                 RETURN(rc);
 578         }
 579
 580         newctx = req->rq_cli_ctx;
 581         LASSERT(newctx);
 582
 583         if (unlikely(newctx == oldctx &&
 584                      test_bit(PTLRPC_CTX_DEAD_BIT, &oldctx->cc_flags))) {
 585                 /*
 586                  * still get the old dead ctx, usually means system too busy
 587                  */
 588                 CDEBUG(D_SEC,
 589                        "ctx (%p, fl %lx) doesn't switch, relax a little bit\n",
 590                        newctx, newctx->cc_flags);
 591
 592                 set_current_state(TASK_INTERRUPTIBLE);
 593                 schedule_timeout(cfs_time_seconds(1));
 594         } else if (unlikely(test_bit(PTLRPC_CTX_UPTODATE_BIT, &newctx->cc_flags)
 595                             == 0)) {
 596                 /*
 597                  * new ctx not up to date yet
 598                  */
 599                 CDEBUG(D_SEC,
 600                        "ctx (%p, fl %lx) doesn't switch, not up to date yet\n",
 601                        newctx, newctx->cc_flags);
 602         } else {
 603                 /*
 604                  * it's possible newctx == oldctx if we're switching
 605                  * subflavor with the same sec.
 606                  */
 607                 rc = sptlrpc_req_ctx_switch(req, oldctx, newctx);
 608                 if (rc) {
 609                         /* restore old ctx */
 610                         sptlrpc_req_put_ctx(req, 0);
 611                         req->rq_cli_ctx = oldctx;
 612                         RETURN(rc);
 613                 }
 614
 615                 LASSERT(req->rq_cli_ctx == newctx);
 616         }
 617
 618         sptlrpc_cli_ctx_put(oldctx, 1);
 619         RETURN(0);
 620 }
 621 EXPORT_SYMBOL(sptlrpc_req_replace_dead_ctx);
 622
 623 static
 624 int ctx_check_refresh(struct ptlrpc_cli_ctx *ctx)
 625 {
 626         if (cli_ctx_is_refreshed(ctx))
 627                 return 1;
 628         return 0;
 629 }
 630
 631 static
 632 int ctx_refresh_timeout(struct ptlrpc_request *req)
 633 {
 634         int rc;
 635
 636         /* conn_cnt is needed in expire_one_request */
 637         lustre_msg_set_conn_cnt(req->rq_reqmsg, req->rq_import->imp_conn_cnt);
 638
 639         rc = ptlrpc_expire_one_request(req, 1);
 640         /*
 641          * if we started recovery, we should mark this ctx dead; otherwise
 642          * in case of lgssd died nobody would retire this ctx, following
 643          * connecting will still find the same ctx thus cause deadlock.
 644          * there's an assumption that expire time of the request should be
 645          * later than the context refresh expire time.
 646          */
 647         if (rc == 0)
 648                 req->rq_cli_ctx->cc_ops->die(req->rq_cli_ctx, 0);
 649         return rc;
 650 }
 651
 652 static
 653 void ctx_refresh_interrupt(struct ptlrpc_request *req)
 654 {
 655
 656         spin_lock(&req->rq_lock);
 657         req->rq_intr = 1;
 658         spin_unlock(&req->rq_lock);
 659 }
 660
 661 static
 662 void req_off_ctx_list(struct ptlrpc_request *req, struct ptlrpc_cli_ctx *ctx)
 663 {
 664         spin_lock(&ctx->cc_lock);
 665         if (!list_empty(&req->rq_ctx_chain))
 666                 list_del_init(&req->rq_ctx_chain);
 667         spin_unlock(&ctx->cc_lock);
 668 }
 669
 670 /**
 671  * To refresh the context of \req, if it's not up-to-date.
 672  * \param timeout
 673  * - < 0: don't wait
 674  * - = 0: wait until success or fatal error occur
 675  * - > 0: timeout value (in seconds)
 676  *
 677  * The status of the context could be subject to be changed by other threads
 678  * at any time. We allow this race, but once we return with 0, the caller will
 679  * suppose it's uptodated and keep using it until the owning rpc is done.
 680  *
 681  * \retval 0 only if the context is uptodated.
 682  * \retval -ev error number.
 683  */
 684 int sptlrpc_req_refresh_ctx(struct ptlrpc_request *req, long timeout)
 685 {
 686         struct ptlrpc_cli_ctx *ctx = req->rq_cli_ctx;
 687         struct ptlrpc_sec *sec;
 688         int rc;
 689
 690         ENTRY;
 691
 692         LASSERT(ctx);
 693
 694         if (req->rq_ctx_init || req->rq_ctx_fini)
 695                 RETURN(0);
 696
 697         /*
 698          * during the process a request's context might change type even
 699          * (e.g. from gss ctx to null ctx), so each loop we need to re-check
 700          * everything
 701          */
 702 again:
 703         rc = import_sec_validate_get(req->rq_import, &sec);
 704         if (rc)
 705                 RETURN(rc);
 706
 707         if (sec->ps_flvr.sf_rpc != req->rq_flvr.sf_rpc) {
 708                 CDEBUG(D_SEC, "req %p: flavor has changed %x -> %x\n",
 709                        req, req->rq_flvr.sf_rpc, sec->ps_flvr.sf_rpc);
 710                 req_off_ctx_list(req, ctx);
 711                 sptlrpc_req_replace_dead_ctx(req);
 712                 ctx = req->rq_cli_ctx;
 713         }
 714         sptlrpc_sec_put(sec);
 715
 716         if (cli_ctx_is_eternal(ctx))
 717                 RETURN(0);
 718
 719         if (unlikely(test_bit(PTLRPC_CTX_NEW_BIT, &ctx->cc_flags))) {
 720                 LASSERT(ctx->cc_ops->refresh);
 721                 ctx->cc_ops->refresh(ctx);
 722         }
 723         LASSERT(test_bit(PTLRPC_CTX_NEW_BIT, &ctx->cc_flags) == 0);
 724
 725         LASSERT(ctx->cc_ops->validate);
 726         if (ctx->cc_ops->validate(ctx) == 0) {
 727                 req_off_ctx_list(req, ctx);
 728                 RETURN(0);
 729         }
 730
 731         if (unlikely(test_bit(PTLRPC_CTX_ERROR_BIT, &ctx->cc_flags))) {
 732                 spin_lock(&req->rq_lock);
 733                 req->rq_err = 1;
 734                 spin_unlock(&req->rq_lock);
 735                 req_off_ctx_list(req, ctx);
 736                 RETURN(-EPERM);
 737         }
 738
 739         /*
 740          * There's a subtle issue for resending RPCs, suppose following
 741          * situation:
 742          *  1. the request was sent to server.
 743          *  2. recovery was kicked start, after finished the request was
 744          *     marked as resent.
 745          *  3. resend the request.
 746          *  4. old reply from server received, we accept and verify the reply.
 747          *     this has to be success, otherwise the error will be aware
 748          *     by application.
 749          *  5. new reply from server received, dropped by LNet.
 750          *
 751          * Note the xid of old & new request is the same. We can't simply
 752          * change xid for the resent request because the server replies on
 753          * it for reply reconstruction.
 754          *
 755          * Commonly the original context should be uptodate because we
 756          * have an expiry nice time; server will keep its context because
 757          * we at least hold a ref of old context which prevent context
 758          * from destroying RPC being sent. So server still can accept the
 759          * request and finish the RPC. But if that's not the case:
 760          *  1. If server side context has been trimmed, a NO_CONTEXT will
 761          *     be returned, gss_cli_ctx_verify/unseal will switch to new
 762          *     context by force.
 763          *  2. Current context never be refreshed, then we are fine: we
 764          *     never really send request with old context before.
 765          */
 766         if (test_bit(PTLRPC_CTX_UPTODATE_BIT, &ctx->cc_flags) &&
 767             unlikely(req->rq_reqmsg) &&
 768             lustre_msg_get_flags(req->rq_reqmsg) & MSG_RESENT) {
 769                 req_off_ctx_list(req, ctx);
 770                 RETURN(0);
 771         }
 772
 773         if (unlikely(test_bit(PTLRPC_CTX_DEAD_BIT, &ctx->cc_flags))) {
 774                 req_off_ctx_list(req, ctx);
 775                 /*
 776                  * don't switch ctx if import was deactivated
 777                  */
 778                 if (req->rq_import->imp_deactive) {
 779                         spin_lock(&req->rq_lock);
 780                         req->rq_err = 1;
 781                         spin_unlock(&req->rq_lock);
 782                         RETURN(-EINTR);
 783                 }
 784
 785                 rc = sptlrpc_req_replace_dead_ctx(req);
 786                 if (rc) {
 787                         LASSERT(ctx == req->rq_cli_ctx);
 788                         CERROR("req %p: failed to replace dead ctx %p: %d\n",
 789                                req, ctx, rc);
 790                         spin_lock(&req->rq_lock);
 791                         req->rq_err = 1;
 792                         spin_unlock(&req->rq_lock);
 793                         RETURN(rc);
 794                 }
 795
 796                 ctx = req->rq_cli_ctx;
 797                 goto again;
 798         }
 799
 800         /*
 801          * Now we're sure this context is during upcall, add myself into
 802          * waiting list
 803          */
 804         spin_lock(&ctx->cc_lock);
 805         if (list_empty(&req->rq_ctx_chain))
 806                 list_add(&req->rq_ctx_chain, &ctx->cc_req_list);
 807         spin_unlock(&ctx->cc_lock);
 808
 809         if (timeout < 0)
 810                 RETURN(-EWOULDBLOCK);
 811
 812         /* Clear any flags that may be present from previous sends */
 813         LASSERT(req->rq_receiving_reply == 0);
 814         spin_lock(&req->rq_lock);
 815         req->rq_err = 0;
 816         req->rq_timedout = 0;
 817         req->rq_resend = 0;
 818         req->rq_restart = 0;
 819         spin_unlock(&req->rq_lock);
 820
 821         if (wait_event_idle_timeout(req->rq_reply_waitq,
 822                                     ctx_check_refresh(ctx),
 823                                     cfs_time_seconds(timeout)) == 0) {
 824                 rc = -ETIMEDOUT;
 825                 if (!ctx_refresh_timeout(req) &&
 826                     l_wait_event_abortable(req->rq_reply_waitq,
 827                                            ctx_check_refresh(ctx))
 828                     == -ERESTARTSYS) {
 829                         rc = -EINTR;
 830                         ctx_refresh_interrupt(req);
 831                 }
 832         }
 833
 834         /*
 835          * following cases could lead us here:
 836          * - successfully refreshed;
 837          * - interrupted;
 838          * - timedout, and we don't want recover from the failure;
 839          * - timedout, and waked up upon recovery finished;
 840          * - someone else mark this ctx dead by force;
 841          * - someone invalidate the req and call ptlrpc_client_wake_req(),
 842          *   e.g. ptlrpc_abort_inflight();
 843          */
 844         if (!cli_ctx_is_refreshed(ctx)) {
 845                 /* timed out or interruptted */
 846                 req_off_ctx_list(req, ctx);
 847
 848                 LASSERT(rc != 0);
 849                 RETURN(rc);
 850         }
 851
 852         goto again;
 853 }
 854
 855 /**
 856  * Initialize flavor settings for \a req, according to \a opcode.
 857  *
 858  * \note this could be called in two situations:
 859  * - new request from ptlrpc_pre_req(), with proper @opcode
 860  * - old request which changed ctx in the middle, with @opcode == 0
 861  */
 862 void sptlrpc_req_set_flavor(struct ptlrpc_request *req, int opcode)
 863 {
 864         struct ptlrpc_sec *sec;
 865
 866         LASSERT(req->rq_import);
 867         LASSERT(req->rq_cli_ctx);
 868         LASSERT(req->rq_cli_ctx->cc_sec);
 869         LASSERT(req->rq_bulk_read == 0 || req->rq_bulk_write == 0);
 870
 871         /* special security flags according to opcode */
 872         switch (opcode) {
 873         case OST_READ:
 874         case MDS_READPAGE:
 875         case MGS_CONFIG_READ:
 876         case OBD_IDX_READ:
 877                 req->rq_bulk_read = 1;
 878                 break;
 879         case OST_WRITE:
 880         case MDS_WRITEPAGE:
 881                 req->rq_bulk_write = 1;
 882                 break;
 883         case SEC_CTX_INIT:
 884                 req->rq_ctx_init = 1;
 885                 break;
 886         case SEC_CTX_FINI:
 887                 req->rq_ctx_fini = 1;
 888                 break;
 889         case 0:
 890                 /* init/fini rpc won't be resend, so can't be here */
 891                 LASSERT(req->rq_ctx_init == 0);
 892                 LASSERT(req->rq_ctx_fini == 0);
 893
 894                 /* cleanup flags, which should be recalculated */
 895                 req->rq_pack_udesc = 0;
 896                 req->rq_pack_bulk = 0;
 897                 break;
 898         }
 899
 900         sec = req->rq_cli_ctx->cc_sec;
 901
 902         spin_lock(&sec->ps_lock);
 903         req->rq_flvr = sec->ps_flvr;
 904         spin_unlock(&sec->ps_lock);
 905
 906         /*
 907          * force SVC_NULL for context initiation rpc, SVC_INTG for context
 908          * destruction rpc
 909          */
 910         if (unlikely(req->rq_ctx_init))
 911                 flvr_set_svc(&req->rq_flvr.sf_rpc, SPTLRPC_SVC_NULL);
 912         else if (unlikely(req->rq_ctx_fini))
 913                 flvr_set_svc(&req->rq_flvr.sf_rpc, SPTLRPC_SVC_INTG);
 914
 915         /* user descriptor flag, null security can't do it anyway */
 916         if ((sec->ps_flvr.sf_flags & PTLRPC_SEC_FL_UDESC) &&
 917             (req->rq_flvr.sf_rpc != SPTLRPC_FLVR_NULL))
 918                 req->rq_pack_udesc = 1;
 919
 920         /* bulk security flag */
 921         if ((req->rq_bulk_read || req->rq_bulk_write) &&
 922             sptlrpc_flavor_has_bulk(&req->rq_flvr))
 923                 req->rq_pack_bulk = 1;
 924 }
 925
 926 void sptlrpc_request_out_callback(struct ptlrpc_request *req)
 927 {
 928         if (SPTLRPC_FLVR_SVC(req->rq_flvr.sf_rpc) != SPTLRPC_SVC_PRIV)
 929                 return;
 930
 931         LASSERT(req->rq_clrbuf);
 932         if (req->rq_pool || !req->rq_reqbuf)
 933                 return;
 934
 935         OBD_FREE(req->rq_reqbuf, req->rq_reqbuf_len);
 936         req->rq_reqbuf = NULL;
 937         req->rq_reqbuf_len = 0;
 938 }
 939
 940 /**
 941  * Given an import \a imp, check whether current user has a valid context
 942  * or not. We may create a new context and try to refresh it, and try
 943  * repeatedly try in case of non-fatal errors. Return 0 means success.
 944  */
 945 int sptlrpc_import_check_ctx(struct obd_import *imp)
 946 {
 947         struct ptlrpc_sec     *sec;
 948         struct ptlrpc_cli_ctx *ctx;
 949         struct ptlrpc_request *req = NULL;
 950         int rc;
 951
 952         ENTRY;
 953
 954         might_sleep();
 955
 956         sec = sptlrpc_import_sec_ref(imp);
 957         ctx = get_my_ctx(sec);
 958         sptlrpc_sec_put(sec);
 959
 960         if (!ctx)
 961                 RETURN(-ENOMEM);
 962
 963         if (cli_ctx_is_eternal(ctx) ||
 964             ctx->cc_ops->validate(ctx) == 0) {
 965                 sptlrpc_cli_ctx_put(ctx, 1);
 966                 RETURN(0);
 967         }
 968
 969         if (cli_ctx_is_error(ctx)) {
 970                 sptlrpc_cli_ctx_put(ctx, 1);
 971                 RETURN(-EACCES);
 972         }
 973
 974         req = ptlrpc_request_cache_alloc(GFP_NOFS);
 975         if (!req)
 976                 RETURN(-ENOMEM);
 977
 978         ptlrpc_cli_req_init(req);
 979         atomic_set(&req->rq_refcount, 10000);
 980
 981         req->rq_import = imp;
 982         req->rq_flvr = sec->ps_flvr;
 983         req->rq_cli_ctx = ctx;
 984
 985         rc = sptlrpc_req_refresh_ctx(req, 0);
 986         LASSERT(list_empty(&req->rq_ctx_chain));
 987         sptlrpc_cli_ctx_put(req->rq_cli_ctx, 1);
 988         ptlrpc_request_cache_free(req);
 989
 990         RETURN(rc);
 991 }
 992
 993 /**
 994  * Used by ptlrpc client, to perform the pre-defined security transformation
 995  * upon the request message of \a req. After this function called,
 996  * req->rq_reqmsg is still accessible as clear text.
 997  */
 998 int sptlrpc_cli_wrap_request(struct ptlrpc_request *req)
 999 {
1000         struct ptlrpc_cli_ctx *ctx = req->rq_cli_ctx;
1001         int rc = 0;
1002
1003         ENTRY;
1004
1005         LASSERT(ctx);
1006         LASSERT(ctx->cc_sec);
1007         LASSERT(req->rq_reqbuf || req->rq_clrbuf);
1008
1009         /*
1010          * we wrap bulk request here because now we can be sure
1011          * the context is uptodate.
1012          */
1013         if (req->rq_bulk) {
1014                 rc = sptlrpc_cli_wrap_bulk(req, req->rq_bulk);
1015                 if (rc)
1016                         RETURN(rc);
1017         }
1018
1019         switch (SPTLRPC_FLVR_SVC(req->rq_flvr.sf_rpc)) {
1020         case SPTLRPC_SVC_NULL:
1021         case SPTLRPC_SVC_AUTH:
1022         case SPTLRPC_SVC_INTG:
1023                 LASSERT(ctx->cc_ops->sign);
1024                 rc = ctx->cc_ops->sign(ctx, req);
1025                 break;
1026         case SPTLRPC_SVC_PRIV:
1027                 LASSERT(ctx->cc_ops->seal);
1028                 rc = ctx->cc_ops->seal(ctx, req);
1029                 break;
1030         default:
1031                 LBUG();
1032         }
1033
1034         if (rc == 0) {
1035                 LASSERT(req->rq_reqdata_len);
1036                 LASSERT(req->rq_reqdata_len % 8 == 0);
1037                 LASSERT(req->rq_reqdata_len <= req->rq_reqbuf_len);
1038         }
1039
1040         RETURN(rc);
1041 }
1042
1043 static int do_cli_unwrap_reply(struct ptlrpc_request *req)
1044 {
1045         struct ptlrpc_cli_ctx *ctx = req->rq_cli_ctx;
1046         int rc;
1047
1048         ENTRY;
1049
1050         LASSERT(ctx);
1051         LASSERT(ctx->cc_sec);
1052         LASSERT(req->rq_repbuf);
1053         LASSERT(req->rq_repdata);
1054         LASSERT(req->rq_repmsg == NULL);
1055
1056         req->rq_rep_swab_mask = 0;
1057
1058         rc = __lustre_unpack_msg(req->rq_repdata, req->rq_repdata_len);
1059         switch (rc) {
1060         case 1:
1061                 lustre_set_rep_swabbed(req, MSG_PTLRPC_HEADER_OFF);
1062         case 0:
1063                 break;
1064         default:
1065                 CERROR("failed unpack reply: x%llu\n", req->rq_xid);
1066                 RETURN(-EPROTO);
1067         }
1068
1069         if (req->rq_repdata_len < sizeof(struct lustre_msg)) {
1070                 CERROR("replied data length %d too small\n",
1071                        req->rq_repdata_len);
1072                 RETURN(-EPROTO);
1073         }
1074
1075         if (SPTLRPC_FLVR_POLICY(req->rq_repdata->lm_secflvr) !=
1076             SPTLRPC_FLVR_POLICY(req->rq_flvr.sf_rpc)) {
1077                 CERROR("reply policy %u doesn't match request policy %u\n",
1078                        SPTLRPC_FLVR_POLICY(req->rq_repdata->lm_secflvr),
1079                        SPTLRPC_FLVR_POLICY(req->rq_flvr.sf_rpc));
1080                 RETURN(-EPROTO);
1081         }
1082
1083         switch (SPTLRPC_FLVR_SVC(req->rq_flvr.sf_rpc)) {
1084         case SPTLRPC_SVC_NULL:
1085         case SPTLRPC_SVC_AUTH:
1086         case SPTLRPC_SVC_INTG:
1087                 LASSERT(ctx->cc_ops->verify);
1088                 rc = ctx->cc_ops->verify(ctx, req);
1089                 break;
1090         case SPTLRPC_SVC_PRIV:
1091                 LASSERT(ctx->cc_ops->unseal);
1092                 rc = ctx->cc_ops->unseal(ctx, req);
1093                 break;
1094         default:
1095                 LBUG();
1096         }
1097         LASSERT(rc || req->rq_repmsg || req->rq_resend);
1098
1099         if (SPTLRPC_FLVR_POLICY(req->rq_flvr.sf_rpc) != SPTLRPC_POLICY_NULL &&
1100             !req->rq_ctx_init)
1101                 req->rq_rep_swab_mask = 0;
1102         RETURN(rc);
1103 }
1104
1105 /**
1106  * Used by ptlrpc client, to perform security transformation upon the reply
1107  * message of \a req. After return successfully, req->rq_repmsg points to
1108  * the reply message in clear text.
1109  *
1110  * \pre the reply buffer should have been un-posted from LNet, so nothing is
1111  * going to change.
1112  */
1113 int sptlrpc_cli_unwrap_reply(struct ptlrpc_request *req)
1114 {
1115         LASSERT(req->rq_repbuf);
1116         LASSERT(req->rq_repdata == NULL);
1117         LASSERT(req->rq_repmsg == NULL);
1118         LASSERT(req->rq_reply_off + req->rq_nob_received <= req->rq_repbuf_len);
1119
1120         if (req->rq_reply_off == 0 &&
1121             (lustre_msghdr_get_flags(req->rq_reqmsg) & MSGHDR_AT_SUPPORT)) {
1122                 CERROR("real reply with offset 0\n");
1123                 return -EPROTO;
1124         }
1125
1126         if (req->rq_reply_off % 8 != 0) {
1127                 CERROR("reply at odd offset %u\n", req->rq_reply_off);
1128                 return -EPROTO;
1129         }
1130
1131         req->rq_repdata = (struct lustre_msg *)
1132                                 (req->rq_repbuf + req->rq_reply_off);
1133         req->rq_repdata_len = req->rq_nob_received;
1134
1135         return do_cli_unwrap_reply(req);
1136 }
1137
1138 /**
1139  * Used by ptlrpc client, to perform security transformation upon the early
1140  * reply message of \a req. We expect the rq_reply_off is 0, and
1141  * rq_nob_received is the early reply size.
1142  *
1143  * Because the receive buffer might be still posted, the reply data might be
1144  * changed at any time, no matter we're holding rq_lock or not. For this reason
1145  * we allocate a separate ptlrpc_request and reply buffer for early reply
1146  * processing.
1147  *
1148  * \retval 0 success, \a req_ret is filled with a duplicated ptlrpc_request.
1149  * Later the caller must call sptlrpc_cli_finish_early_reply() on the returned
1150  * \a *req_ret to release it.
1151  * \retval -ev error number, and \a req_ret will not be set.
1152  */
1153 int sptlrpc_cli_unwrap_early_reply(struct ptlrpc_request *req,
1154                                    struct ptlrpc_request **req_ret)
1155 {
1156         struct ptlrpc_request *early_req;
1157         char *early_buf;
1158         int early_bufsz, early_size;
1159         int rc;
1160
1161         ENTRY;
1162
1163         early_req = ptlrpc_request_cache_alloc(GFP_NOFS);
1164         if (early_req == NULL)
1165                 RETURN(-ENOMEM);
1166
1167         ptlrpc_cli_req_init(early_req);
1168
1169         early_size = req->rq_nob_received;
1170         early_bufsz = size_roundup_power2(early_size);
1171         OBD_ALLOC_LARGE(early_buf, early_bufsz);
1172         if (early_buf == NULL)
1173                 GOTO(err_req, rc = -ENOMEM);
1174
1175         /* sanity checkings and copy data out, do it inside spinlock */
1176         spin_lock(&req->rq_lock);
1177
1178         if (req->rq_replied) {
1179                 spin_unlock(&req->rq_lock);
1180                 GOTO(err_buf, rc = -EALREADY);
1181         }
1182
1183         LASSERT(req->rq_repbuf);
1184         LASSERT(req->rq_repdata == NULL);
1185         LASSERT(req->rq_repmsg == NULL);
1186
1187         if (req->rq_reply_off != 0) {
1188                 CERROR("early reply with offset %u\n", req->rq_reply_off);
1189                 spin_unlock(&req->rq_lock);
1190                 GOTO(err_buf, rc = -EPROTO);
1191         }
1192
1193         if (req->rq_nob_received != early_size) {
1194                 /* even another early arrived the size should be the same */
1195                 CERROR("data size has changed from %u to %u\n",
1196                        early_size, req->rq_nob_received);
1197                 spin_unlock(&req->rq_lock);
1198                 GOTO(err_buf, rc = -EINVAL);
1199         }
1200
1201         if (req->rq_nob_received < sizeof(struct lustre_msg)) {
1202                 CERROR("early reply length %d too small\n",
1203                        req->rq_nob_received);
1204                 spin_unlock(&req->rq_lock);
1205                 GOTO(err_buf, rc = -EALREADY);
1206         }
1207
1208         memcpy(early_buf, req->rq_repbuf, early_size);
1209         spin_unlock(&req->rq_lock);
1210
1211         early_req->rq_cli_ctx = sptlrpc_cli_ctx_get(req->rq_cli_ctx);
1212         early_req->rq_flvr = req->rq_flvr;
1213         early_req->rq_repbuf = early_buf;
1214         early_req->rq_repbuf_len = early_bufsz;
1215         early_req->rq_repdata = (struct lustre_msg *) early_buf;
1216         early_req->rq_repdata_len = early_size;
1217         early_req->rq_early = 1;
1218         early_req->rq_reqmsg = req->rq_reqmsg;
1219
1220         rc = do_cli_unwrap_reply(early_req);
1221         if (rc) {
1222                 DEBUG_REQ(D_ADAPTTO, early_req,
1223                           "unwrap early reply: rc = %d", rc);
1224                 GOTO(err_ctx, rc);
1225         }
1226
1227         LASSERT(early_req->rq_repmsg);
1228         *req_ret = early_req;
1229         RETURN(0);
1230
1231 err_ctx:
1232         sptlrpc_cli_ctx_put(early_req->rq_cli_ctx, 1);
1233 err_buf:
1234         OBD_FREE_LARGE(early_buf, early_bufsz);
1235 err_req:
1236         ptlrpc_request_cache_free(early_req);
1237         RETURN(rc);
1238 }
1239
1240 /**
1241  * Used by ptlrpc client, to release a processed early reply \a early_req.
1242  *
1243  * \pre \a early_req was obtained from calling sptlrpc_cli_unwrap_early_reply().
1244  */
1245 void sptlrpc_cli_finish_early_reply(struct ptlrpc_request *early_req)
1246 {
1247         LASSERT(early_req->rq_repbuf);
1248         LASSERT(early_req->rq_repdata);
1249         LASSERT(early_req->rq_repmsg);
1250
1251         sptlrpc_cli_ctx_put(early_req->rq_cli_ctx, 1);
1252         OBD_FREE_LARGE(early_req->rq_repbuf, early_req->rq_repbuf_len);
1253         ptlrpc_request_cache_free(early_req);
1254 }
1255
1256 /**************************************************
1257  * sec ID                                         *
1258  **************************************************/
1259
1260 /*
1261  * "fixed" sec (e.g. null) use sec_id < 0
1262  */
1263 static atomic_t sptlrpc_sec_id = ATOMIC_INIT(1);
1264
1265 int sptlrpc_get_next_secid(void)
1266 {
1267         return atomic_inc_return(&sptlrpc_sec_id);
1268 }
1269 EXPORT_SYMBOL(sptlrpc_get_next_secid);
1270
1271 /*
1272  * client side high-level security APIs
1273  */
1274
1275 static int sec_cop_flush_ctx_cache(struct ptlrpc_sec *sec, uid_t uid,
1276                                    int grace, int force)
1277 {
1278         struct ptlrpc_sec_policy *policy = sec->ps_policy;
1279
1280         LASSERT(policy->sp_cops);
1281         LASSERT(policy->sp_cops->flush_ctx_cache);
1282
1283         return policy->sp_cops->flush_ctx_cache(sec, uid, grace, force);
1284 }
1285
1286 static void sec_cop_destroy_sec(struct ptlrpc_sec *sec)
1287 {
1288         struct ptlrpc_sec_policy *policy = sec->ps_policy;
1289
1290         LASSERT_ATOMIC_ZERO(&sec->ps_refcount);
1291         LASSERT_ATOMIC_ZERO(&sec->ps_nctx);
1292         LASSERT(policy->sp_cops->destroy_sec);
1293
1294         CDEBUG(D_SEC, "%s@%p: being destroied\n", sec->ps_policy->sp_name, sec);
1295
1296         policy->sp_cops->destroy_sec(sec);
1297         sptlrpc_policy_put(policy);
1298 }
1299
1300 void sptlrpc_sec_destroy(struct ptlrpc_sec *sec)
1301 {
1302         sec_cop_destroy_sec(sec);
1303 }
1304 EXPORT_SYMBOL(sptlrpc_sec_destroy);
1305
1306 static void sptlrpc_sec_kill(struct ptlrpc_sec *sec)
1307 {
1308         LASSERT_ATOMIC_POS(&sec->ps_refcount);
1309
1310         if (sec->ps_policy->sp_cops->kill_sec) {
1311                 sec->ps_policy->sp_cops->kill_sec(sec);
1312
1313                 sec_cop_flush_ctx_cache(sec, -1, 1, 1);
1314         }
1315 }
1316
1317 struct ptlrpc_sec *sptlrpc_sec_get(struct ptlrpc_sec *sec)
1318 {
1319         if (sec)
1320                 atomic_inc(&sec->ps_refcount);
1321
1322         return sec;
1323 }
1324 EXPORT_SYMBOL(sptlrpc_sec_get);
1325
1326 void sptlrpc_sec_put(struct ptlrpc_sec *sec)
1327 {
1328         if (sec) {
1329                 LASSERT_ATOMIC_POS(&sec->ps_refcount);
1330
1331                 if (atomic_dec_and_test(&sec->ps_refcount)) {
1332                         sptlrpc_gc_del_sec(sec);
1333                         sec_cop_destroy_sec(sec);
1334                 }
1335         }
1336 }
1337 EXPORT_SYMBOL(sptlrpc_sec_put);
1338
1339 /*
1340  * policy module is responsible for taking refrence of import
1341  */
1342 static
1343 struct ptlrpc_sec * sptlrpc_sec_create(struct obd_import *imp,
1344                                        struct ptlrpc_svc_ctx *svc_ctx,
1345                                        struct sptlrpc_flavor *sf,
1346                                        enum lustre_sec_part sp)
1347 {
1348         struct ptlrpc_sec_policy *policy;
1349         struct ptlrpc_sec *sec;
1350         char str[32];
1351
1352         ENTRY;
1353
1354         if (svc_ctx) {
1355                 LASSERT(imp->imp_dlm_fake == 1);
1356
1357                 CDEBUG(D_SEC, "%s %s: reverse sec using flavor %s\n",
1358                        imp->imp_obd->obd_type->typ_name,
1359                        imp->imp_obd->obd_name,
1360                        sptlrpc_flavor2name(sf, str, sizeof(str)));
1361
1362                 policy = sptlrpc_policy_get(svc_ctx->sc_policy);
1363                 sf->sf_flags |= PTLRPC_SEC_FL_REVERSE | PTLRPC_SEC_FL_ROOTONLY;
1364         } else {
1365                 LASSERT(imp->imp_dlm_fake == 0);
1366
1367                 CDEBUG(D_SEC, "%s %s: select security flavor %s\n",
1368                        imp->imp_obd->obd_type->typ_name,
1369                        imp->imp_obd->obd_name,
1370                        sptlrpc_flavor2name(sf, str, sizeof(str)));
1371
1372                 policy = sptlrpc_wireflavor2policy(sf->sf_rpc);
1373                 if (!policy) {
1374                         CERROR("invalid flavor 0x%x\n", sf->sf_rpc);
1375                         RETURN(NULL);
1376                 }
1377         }
1378
1379         sec = policy->sp_cops->create_sec(imp, svc_ctx, sf);
1380         if (sec) {
1381                 atomic_inc(&sec->ps_refcount);
1382
1383                 sec->ps_part = sp;
1384
1385                 if (sec->ps_gc_interval && policy->sp_cops->gc_ctx)
1386                         sptlrpc_gc_add_sec(sec);
1387         } else {
1388                 sptlrpc_policy_put(policy);
1389         }
1390
1391         RETURN(sec);
1392 }
1393
1394 struct ptlrpc_sec *sptlrpc_import_sec_ref(struct obd_import *imp)
1395 {
1396         struct ptlrpc_sec *sec;
1397
1398         read_lock(&imp->imp_sec_lock);
1399         sec = sptlrpc_sec_get(imp->imp_sec);
1400         read_unlock(&imp->imp_sec_lock);
1401
1402         return sec;
1403 }
1404 EXPORT_SYMBOL(sptlrpc_import_sec_ref);
1405
1406 static void sptlrpc_import_sec_install(struct obd_import *imp,
1407                                        struct ptlrpc_sec *sec)
1408 {
1409         struct ptlrpc_sec *old_sec;
1410
1411         LASSERT_ATOMIC_POS(&sec->ps_refcount);
1412
1413         write_lock(&imp->imp_sec_lock);
1414         old_sec = imp->imp_sec;
1415         imp->imp_sec = sec;
1416         write_unlock(&imp->imp_sec_lock);
1417
1418         if (old_sec) {
1419                 sptlrpc_sec_kill(old_sec);
1420
1421                 /* balance the ref taken by this import */
1422                 sptlrpc_sec_put(old_sec);
1423         }
1424 }
1425
1426 static inline
1427 int flavor_equal(struct sptlrpc_flavor *sf1, struct sptlrpc_flavor *sf2)
1428 {
1429         return (memcmp(sf1, sf2, sizeof(*sf1)) == 0);
1430 }
1431
1432 static inline
1433 void flavor_copy(struct sptlrpc_flavor *dst, struct sptlrpc_flavor *src)
1434 {
1435         *dst = *src;
1436 }
1437
1438 /**
1439  * To get an appropriate ptlrpc_sec for the \a imp, according to the current
1440  * configuration. Upon called, imp->imp_sec may or may not be NULL.
1441  *
1442  *  - regular import: \a svc_ctx should be NULL and \a flvr is ignored;
1443  *  - reverse import: \a svc_ctx and \a flvr are obtained from incoming request.
1444  */
1445 int sptlrpc_import_sec_adapt(struct obd_import *imp,
1446                              struct ptlrpc_svc_ctx *svc_ctx,
1447                              struct sptlrpc_flavor *flvr)
1448 {
1449         struct ptlrpc_connection *conn;
1450         struct sptlrpc_flavor sf;
1451         struct ptlrpc_sec *sec, *newsec;
1452         enum lustre_sec_part sp;
1453         char str[24];
1454         int rc = 0;
1455
1456         ENTRY;
1457
1458         might_sleep();
1459
1460         if (imp == NULL)
1461                 RETURN(0);
1462
1463         conn = imp->imp_connection;
1464
1465         if (svc_ctx == NULL) {
1466                 struct client_obd *cliobd = &imp->imp_obd->u.cli;
1467                 /*
1468                  * normal import, determine flavor from rule set, except
1469                  * for mgc the flavor is predetermined.
1470                  */
1471                 if (cliobd->cl_sp_me == LUSTRE_SP_MGC)
1472                         sf = cliobd->cl_flvr_mgc;
1473                 else
1474                         sptlrpc_conf_choose_flavor(cliobd->cl_sp_me,
1475                                                    cliobd->cl_sp_to,
1476                                                    &cliobd->cl_target_uuid,
1477                                                    conn->c_self, &sf);
1478
1479                 sp = imp->imp_obd->u.cli.cl_sp_me;
1480         } else {
1481                 /* reverse import, determine flavor from incoming reqeust */
1482                 sf = *flvr;
1483
1484                 if (sf.sf_rpc != SPTLRPC_FLVR_NULL)
1485                         sf.sf_flags = PTLRPC_SEC_FL_REVERSE |
1486                                       PTLRPC_SEC_FL_ROOTONLY;
1487
1488                 sp = sptlrpc_target_sec_part(imp->imp_obd);
1489         }
1490
1491         sec = sptlrpc_import_sec_ref(imp);
1492         if (sec) {
1493                 char str2[24];
1494
1495                 if (flavor_equal(&sf, &sec->ps_flvr))
1496                         GOTO(out, rc);
1497
1498                 CDEBUG(D_SEC, "import %s->%s: changing flavor %s -> %s\n",
1499                        imp->imp_obd->obd_name,
1500                        obd_uuid2str(&conn->c_remote_uuid),
1501                        sptlrpc_flavor2name(&sec->ps_flvr, str, sizeof(str)),
1502                        sptlrpc_flavor2name(&sf, str2, sizeof(str2)));
1503         } else if (SPTLRPC_FLVR_BASE(sf.sf_rpc) !=
1504                    SPTLRPC_FLVR_BASE(SPTLRPC_FLVR_NULL)) {
1505                 CDEBUG(D_SEC, "import %s->%s netid %x: select flavor %s\n",
1506                        imp->imp_obd->obd_name,
1507                        obd_uuid2str(&conn->c_remote_uuid),
1508                        LNET_NIDNET(conn->c_self),
1509                        sptlrpc_flavor2name(&sf, str, sizeof(str)));
1510         }
1511
1512         newsec = sptlrpc_sec_create(imp, svc_ctx, &sf, sp);
1513         if (newsec) {
1514                 sptlrpc_import_sec_install(imp, newsec);
1515         } else {
1516                 CERROR("import %s->%s: failed to create new sec\n",
1517                        imp->imp_obd->obd_name,
1518                        obd_uuid2str(&conn->c_remote_uuid));
1519                 rc = -EPERM;
1520         }
1521
1522 out:
1523         sptlrpc_sec_put(sec);
1524         RETURN(rc);
1525 }
1526
1527 void sptlrpc_import_sec_put(struct obd_import *imp)
1528 {
1529         if (imp->imp_sec) {
1530                 sptlrpc_sec_kill(imp->imp_sec);
1531
1532                 sptlrpc_sec_put(imp->imp_sec);
1533                 imp->imp_sec = NULL;
1534         }
1535 }
1536
1537 static void import_flush_ctx_common(struct obd_import *imp,
1538                                     uid_t uid, int grace, int force)
1539 {
1540         struct ptlrpc_sec *sec;
1541
1542         if (imp == NULL)
1543                 return;
1544
1545         sec = sptlrpc_import_sec_ref(imp);
1546         if (sec == NULL)
1547                 return;
1548
1549         sec_cop_flush_ctx_cache(sec, uid, grace, force);
1550         sptlrpc_sec_put(sec);
1551 }
1552
1553 void sptlrpc_import_flush_root_ctx(struct obd_import *imp)
1554 {
1555         /*
1556          * it's important to use grace mode, see explain in
1557          * sptlrpc_req_refresh_ctx()
1558          */
1559         import_flush_ctx_common(imp, 0, 1, 1);
1560 }
1561
1562 void sptlrpc_import_flush_my_ctx(struct obd_import *imp)
1563 {
1564         import_flush_ctx_common(imp, from_kuid(&init_user_ns, current_uid()),
1565                                 1, 1);
1566 }
1567 EXPORT_SYMBOL(sptlrpc_import_flush_my_ctx);
1568
1569 void sptlrpc_import_flush_all_ctx(struct obd_import *imp)
1570 {
1571         import_flush_ctx_common(imp, -1, 1, 1);
1572 }
1573 EXPORT_SYMBOL(sptlrpc_import_flush_all_ctx);
1574
1575 /**
1576  * Used by ptlrpc client to allocate request buffer of \a req. Upon return
1577  * successfully, req->rq_reqmsg points to a buffer with size \a msgsize.
1578  */
1579 int sptlrpc_cli_alloc_reqbuf(struct ptlrpc_request *req, int msgsize)
1580 {
1581         struct ptlrpc_cli_ctx *ctx = req->rq_cli_ctx;
1582         struct ptlrpc_sec_policy *policy;
1583         int rc;
1584
1585         LASSERT(ctx);
1586         LASSERT(ctx->cc_sec);
1587         LASSERT(ctx->cc_sec->ps_policy);
1588         LASSERT(req->rq_reqmsg == NULL);
1589         LASSERT_ATOMIC_POS(&ctx->cc_refcount);
1590
1591         policy = ctx->cc_sec->ps_policy;
1592         rc = policy->sp_cops->alloc_reqbuf(ctx->cc_sec, req, msgsize);
1593         if (!rc) {
1594                 LASSERT(req->rq_reqmsg);
1595                 LASSERT(req->rq_reqbuf || req->rq_clrbuf);
1596
1597                 /* zeroing preallocated buffer */
1598                 if (req->rq_pool)
1599                         memset(req->rq_reqmsg, 0, msgsize);
1600         }
1601
1602         return rc;
1603 }
1604
1605 /**
1606  * Used by ptlrpc client to free request buffer of \a req. After this
1607  * req->rq_reqmsg is set to NULL and should not be accessed anymore.
1608  */
1609 void sptlrpc_cli_free_reqbuf(struct ptlrpc_request *req)
1610 {
1611         struct ptlrpc_cli_ctx *ctx = req->rq_cli_ctx;
1612         struct ptlrpc_sec_policy *policy;
1613
1614         LASSERT(ctx);
1615         LASSERT(ctx->cc_sec);
1616         LASSERT(ctx->cc_sec->ps_policy);
1617         LASSERT_ATOMIC_POS(&ctx->cc_refcount);
1618
1619         if (req->rq_reqbuf == NULL && req->rq_clrbuf == NULL)
1620                 return;
1621
1622         policy = ctx->cc_sec->ps_policy;
1623         policy->sp_cops->free_reqbuf(ctx->cc_sec, req);
1624         req->rq_reqmsg = NULL;
1625 }
1626
1627 /*
1628  * NOTE caller must guarantee the buffer size is enough for the enlargement
1629  */
1630 void _sptlrpc_enlarge_msg_inplace(struct lustre_msg *msg,
1631                                   int segment, int newsize)
1632 {
1633         void *src, *dst;
1634         int oldsize, oldmsg_size, movesize;
1635
1636         LASSERT(segment < msg->lm_bufcount);
1637         LASSERT(msg->lm_buflens[segment] <= newsize);
1638
1639         if (msg->lm_buflens[segment] == newsize)
1640                 return;
1641
1642         /* nothing to do if we are enlarging the last segment */
1643         if (segment == msg->lm_bufcount - 1) {
1644                 msg->lm_buflens[segment] = newsize;
1645                 return;
1646         }
1647
1648         oldsize = msg->lm_buflens[segment];
1649
1650         src = lustre_msg_buf(msg, segment + 1, 0);
1651         msg->lm_buflens[segment] = newsize;
1652         dst = lustre_msg_buf(msg, segment + 1, 0);
1653         msg->lm_buflens[segment] = oldsize;
1654
1655         /* move from segment + 1 to end segment */
1656         LASSERT(msg->lm_magic == LUSTRE_MSG_MAGIC_V2);
1657         oldmsg_size = lustre_msg_size_v2(msg->lm_bufcount, msg->lm_buflens);
1658         movesize = oldmsg_size - ((unsigned long) src - (unsigned long) msg);
1659         LASSERT(movesize >= 0);
1660
1661         if (movesize)
1662                 memmove(dst, src, movesize);
1663
1664         /* note we don't clear the ares where old data live, not secret */
1665
1666         /* finally set new segment size */
1667         msg->lm_buflens[segment] = newsize;
1668 }
1669 EXPORT_SYMBOL(_sptlrpc_enlarge_msg_inplace);
1670
1671 /**
1672  * Used by ptlrpc client to enlarge the \a segment of request message pointed
1673  * by req->rq_reqmsg to size \a newsize, all previously filled-in data will be
1674  * preserved after the enlargement. this must be called after original request
1675  * buffer being allocated.
1676  *
1677  * \note after this be called, rq_reqmsg and rq_reqlen might have been changed,
1678  * so caller should refresh its local pointers if needed.
1679  */
1680 int sptlrpc_cli_enlarge_reqbuf(struct ptlrpc_request *req,
1681                                const struct req_msg_field *field,
1682                                int newsize)
1683 {
1684         struct req_capsule *pill = &req->rq_pill;
1685         struct ptlrpc_cli_ctx *ctx = req->rq_cli_ctx;
1686         struct ptlrpc_sec_cops *cops;
1687         struct lustre_msg *msg = req->rq_reqmsg;
1688         int segment = __req_capsule_offset(pill, field, RCL_CLIENT);
1689
1690         LASSERT(ctx);
1691         LASSERT(msg);
1692         LASSERT(msg->lm_bufcount > segment);
1693         LASSERT(msg->lm_buflens[segment] <= newsize);
1694
1695         if (msg->lm_buflens[segment] == newsize)
1696                 return 0;
1697
1698         cops = ctx->cc_sec->ps_policy->sp_cops;
1699         LASSERT(cops->enlarge_reqbuf);
1700         return cops->enlarge_reqbuf(ctx->cc_sec, req, segment, newsize);
1701 }
1702 EXPORT_SYMBOL(sptlrpc_cli_enlarge_reqbuf);
1703
1704 /**
1705  * Used by ptlrpc client to allocate reply buffer of \a req.
1706  *
1707  * \note After this, req->rq_repmsg is still not accessible.
1708  */
1709 int sptlrpc_cli_alloc_repbuf(struct ptlrpc_request *req, int msgsize)
1710 {
1711         struct ptlrpc_cli_ctx *ctx = req->rq_cli_ctx;
1712         struct ptlrpc_sec_policy *policy;
1713
1714         ENTRY;
1715
1716         LASSERT(ctx);
1717         LASSERT(ctx->cc_sec);
1718         LASSERT(ctx->cc_sec->ps_policy);
1719
1720         if (req->rq_repbuf)
1721                 RETURN(0);
1722
1723         policy = ctx->cc_sec->ps_policy;
1724         RETURN(policy->sp_cops->alloc_repbuf(ctx->cc_sec, req, msgsize));
1725 }
1726
1727 /**
1728  * Used by ptlrpc client to free reply buffer of \a req. After this
1729  * req->rq_repmsg is set to NULL and should not be accessed anymore.
1730  */
1731 void sptlrpc_cli_free_repbuf(struct ptlrpc_request *req)
1732 {
1733         struct ptlrpc_cli_ctx *ctx = req->rq_cli_ctx;
1734         struct ptlrpc_sec_policy *policy;
1735
1736         ENTRY;
1737
1738         LASSERT(ctx);
1739         LASSERT(ctx->cc_sec);
1740         LASSERT(ctx->cc_sec->ps_policy);
1741         LASSERT_ATOMIC_POS(&ctx->cc_refcount);
1742
1743         if (req->rq_repbuf == NULL)
1744                 return;
1745         LASSERT(req->rq_repbuf_len);
1746
1747         policy = ctx->cc_sec->ps_policy;
1748         policy->sp_cops->free_repbuf(ctx->cc_sec, req);
1749         req->rq_repmsg = NULL;
1750         EXIT;
1751 }
1752 EXPORT_SYMBOL(sptlrpc_cli_free_repbuf);
1753
1754 int sptlrpc_cli_install_rvs_ctx(struct obd_import *imp,
1755                                 struct ptlrpc_cli_ctx *ctx)
1756 {
1757         struct ptlrpc_sec_policy *policy = ctx->cc_sec->ps_policy;
1758
1759         if (!policy->sp_cops->install_rctx)
1760                 return 0;
1761         return policy->sp_cops->install_rctx(imp, ctx->cc_sec, ctx);
1762 }
1763
1764 int sptlrpc_svc_install_rvs_ctx(struct obd_import *imp,
1765                                 struct ptlrpc_svc_ctx *ctx)
1766 {
1767         struct ptlrpc_sec_policy *policy = ctx->sc_policy;
1768
1769         if (!policy->sp_sops->install_rctx)
1770                 return 0;
1771         return policy->sp_sops->install_rctx(imp, ctx);
1772 }
1773
1774 /* Get SELinux policy info from userspace */
1775 static int sepol_helper(struct obd_import *imp)
1776 {
1777         char mtime_str[21] = { 0 }, mode_str[2] = { 0 };
1778         char *argv[] = {
1779                 [0] = "/usr/sbin/l_getsepol",
1780                 [1] = "-o",
1781                 [2] = NULL,         /* obd type */
1782                 [3] = "-n",
1783                 [4] = NULL,         /* obd name */
1784                 [5] = "-t",
1785                 [6] = mtime_str,    /* policy mtime */
1786                 [7] = "-m",
1787                 [8] = mode_str,     /* enforcing mode */
1788                 [9] = NULL
1789         };
1790         char *envp[] = {
1791                 [0] = "HOME=/",
1792                 [1] = "PATH=/sbin:/usr/sbin",
1793                 [2] = NULL
1794         };
1795         signed short ret;
1796         int rc = 0;
1797
1798         if (imp == NULL || imp->imp_obd == NULL ||
1799             imp->imp_obd->obd_type == NULL) {
1800                 rc = -EINVAL;
1801         } else {
1802                 argv[2] = (char *)imp->imp_obd->obd_type->typ_name;
1803                 argv[4] = imp->imp_obd->obd_name;
1804                 spin_lock(&imp->imp_sec->ps_lock);
1805                 if (imp->imp_sec->ps_sepol_mtime == 0 &&
1806                     imp->imp_sec->ps_sepol[0] == '\0') {
1807                         /* ps_sepol has not been initialized */
1808                         argv[5] = NULL;
1809                         argv[7] = NULL;
1810                 } else {
1811                         snprintf(mtime_str, sizeof(mtime_str), "%lu",
1812                                  imp->imp_sec->ps_sepol_mtime);
1813                         mode_str[0] = imp->imp_sec->ps_sepol[0];
1814                 }
1815                 spin_unlock(&imp->imp_sec->ps_lock);
1816                 ret = call_usermodehelper(argv[0], argv, envp, UMH_WAIT_PROC);
1817                 rc = ret>>8;
1818         }
1819
1820         return rc;
1821 }
1822
1823 static inline int sptlrpc_sepol_needs_check(struct ptlrpc_sec *imp_sec)
1824 {
1825         ktime_t checknext;
1826
1827         if (send_sepol == 0 || !selinux_is_enabled())
1828                 return 0;
1829
1830         if (send_sepol == -1)
1831                 /* send_sepol == -1 means fetch sepol status every time */
1832                 return 1;
1833
1834         spin_lock(&imp_sec->ps_lock);
1835         checknext = imp_sec->ps_sepol_checknext;
1836         spin_unlock(&imp_sec->ps_lock);
1837
1838         /* next check is too far in time, please update */
1839         if (ktime_after(checknext,
1840                         ktime_add(ktime_get(), ktime_set(send_sepol, 0))))
1841                 goto setnext;
1842
1843         if (ktime_before(ktime_get(), checknext))
1844                 /* too early to fetch sepol status */
1845                 return 0;
1846
1847 setnext:
1848         /* define new sepol_checknext time */
1849         spin_lock(&imp_sec->ps_lock);
1850         imp_sec->ps_sepol_checknext = ktime_add(ktime_get(),
1851                                                 ktime_set(send_sepol, 0));
1852         spin_unlock(&imp_sec->ps_lock);
1853
1854         return 1;
1855 }
1856
1857 int sptlrpc_get_sepol(struct ptlrpc_request *req)
1858 {
1859         struct ptlrpc_sec *imp_sec = req->rq_import->imp_sec;
1860         int rc = 0;
1861
1862         ENTRY;
1863
1864         (req->rq_sepol)[0] = '\0';
1865
1866 #ifndef HAVE_SELINUX
1867         if (unlikely(send_sepol != 0))
1868                 CDEBUG(D_SEC,
1869                        "Client cannot report SELinux status, it was not built against libselinux.\n");
1870         RETURN(0);
1871 #endif
1872
1873         if (send_sepol == 0 || !selinux_is_enabled())
1874                 RETURN(0);
1875
1876         if (imp_sec == NULL)
1877                 RETURN(-EINVAL);
1878
1879         /* Retrieve SELinux status info */
1880         if (sptlrpc_sepol_needs_check(imp_sec))
1881                 rc = sepol_helper(req->rq_import);
1882         if (likely(rc == 0)) {
1883                 spin_lock(&imp_sec->ps_lock);
1884                 memcpy(req->rq_sepol, imp_sec->ps_sepol,
1885                        sizeof(req->rq_sepol));
1886                 spin_unlock(&imp_sec->ps_lock);
1887         }
1888
1889         RETURN(rc);
1890 }
1891 EXPORT_SYMBOL(sptlrpc_get_sepol);
1892
1893 /*
1894  * server side security
1895  */
1896
1897 static int flavor_allowed(struct sptlrpc_flavor *exp,
1898                           struct ptlrpc_request *req)
1899 {
1900         struct sptlrpc_flavor *flvr = &req->rq_flvr;
1901
1902         if (exp->sf_rpc == SPTLRPC_FLVR_ANY || exp->sf_rpc == flvr->sf_rpc)
1903                 return 1;
1904
1905         if ((req->rq_ctx_init || req->rq_ctx_fini) &&
1906             SPTLRPC_FLVR_POLICY(exp->sf_rpc) ==
1907             SPTLRPC_FLVR_POLICY(flvr->sf_rpc) &&
1908             SPTLRPC_FLVR_MECH(exp->sf_rpc) == SPTLRPC_FLVR_MECH(flvr->sf_rpc))
1909                 return 1;
1910
1911         return 0;
1912 }
1913
1914 #define EXP_FLVR_UPDATE_EXPIRE      (OBD_TIMEOUT_DEFAULT + 10)
1915
1916 /**
1917  * Given an export \a exp, check whether the flavor of incoming \a req
1918  * is allowed by the export \a exp. Main logic is about taking care of
1919  * changing configurations. Return 0 means success.
1920  */
1921 int sptlrpc_target_export_check(struct obd_export *exp,
1922                                 struct ptlrpc_request *req)
1923 {
1924         struct sptlrpc_flavor   flavor;
1925
1926         if (exp == NULL)
1927                 return 0;
1928
1929         /*
1930          * client side export has no imp_reverse, skip
1931          * FIXME maybe we should check flavor this as well???
1932          */
1933         if (exp->exp_imp_reverse == NULL)
1934                 return 0;
1935
1936         /* don't care about ctx fini rpc */
1937         if (req->rq_ctx_fini)
1938                 return 0;
1939
1940         spin_lock(&exp->exp_lock);
1941
1942         /*
1943          * if flavor just changed (exp->exp_flvr_changed != 0), we wait for
1944          * the first req with the new flavor, then treat it as current flavor,
1945          * adapt reverse sec according to it.
1946          * note the first rpc with new flavor might not be with root ctx, in
1947          * which case delay the sec_adapt by leaving exp_flvr_adapt == 1.
1948          */
1949         if (unlikely(exp->exp_flvr_changed) &&
1950             flavor_allowed(&exp->exp_flvr_old[1], req)) {
1951                 /*
1952                  * make the new flavor as "current", and old ones as
1953                  * about-to-expire
1954                  */
1955                 CDEBUG(D_SEC, "exp %p: just changed: %x->%x\n", exp,
1956                        exp->exp_flvr.sf_rpc, exp->exp_flvr_old[1].sf_rpc);
1957                 flavor = exp->exp_flvr_old[1];
1958                 exp->exp_flvr_old[1] = exp->exp_flvr_old[0];
1959                 exp->exp_flvr_expire[1] = exp->exp_flvr_expire[0];
1960                 exp->exp_flvr_old[0] = exp->exp_flvr;
1961                 exp->exp_flvr_expire[0] = ktime_get_real_seconds() +
1962                                           EXP_FLVR_UPDATE_EXPIRE;
1963                 exp->exp_flvr = flavor;
1964
1965                 /* flavor change finished */
1966                 exp->exp_flvr_changed = 0;
1967                 LASSERT(exp->exp_flvr_adapt == 1);
1968
1969                 /* if it's gss, we only interested in root ctx init */
1970                 if (req->rq_auth_gss &&
1971                     !(req->rq_ctx_init &&
1972                     (req->rq_auth_usr_root || req->rq_auth_usr_mdt ||
1973                     req->rq_auth_usr_ost))) {
1974                         spin_unlock(&exp->exp_lock);
1975                         CDEBUG(D_SEC, "is good but not root(%d:%d:%d:%d:%d)\n",
1976                                req->rq_auth_gss, req->rq_ctx_init,
1977                                req->rq_auth_usr_root, req->rq_auth_usr_mdt,
1978                                req->rq_auth_usr_ost);
1979                         return 0;
1980                 }
1981
1982                 exp->exp_flvr_adapt = 0;
1983                 spin_unlock(&exp->exp_lock);
1984
1985                 return sptlrpc_import_sec_adapt(exp->exp_imp_reverse,
1986                                                 req->rq_svc_ctx, &flavor);
1987         }
1988
1989         /*
1990          * if it equals to the current flavor, we accept it, but need to
1991          * dealing with reverse sec/ctx
1992          */
1993         if (likely(flavor_allowed(&exp->exp_flvr, req))) {
1994                 /*
1995                  * most cases should return here, we only interested in
1996                  * gss root ctx init
1997                  */
1998                 if (!req->rq_auth_gss || !req->rq_ctx_init ||
1999                     (!req->rq_auth_usr_root && !req->rq_auth_usr_mdt &&
2000                      !req->rq_auth_usr_ost)) {
2001                         spin_unlock(&exp->exp_lock);
2002                         return 0;
2003                 }
2004
2005                 /*
2006                  * if flavor just changed, we should not proceed, just leave
2007                  * it and current flavor will be discovered and replaced
2008                  * shortly, and let _this_ rpc pass through
2009                  */
2010                 if (exp->exp_flvr_changed) {
2011                         LASSERT(exp->exp_flvr_adapt);
2012                         spin_unlock(&exp->exp_lock);
2013                         return 0;
2014                 }
2015
2016                 if (exp->exp_flvr_adapt) {
2017                         exp->exp_flvr_adapt = 0;
2018                         CDEBUG(D_SEC, "exp %p (%x|%x|%x): do delayed adapt\n",
2019                                exp, exp->exp_flvr.sf_rpc,
2020                                exp->exp_flvr_old[0].sf_rpc,
2021                                exp->exp_flvr_old[1].sf_rpc);
2022                         flavor = exp->exp_flvr;
2023                         spin_unlock(&exp->exp_lock);
2024
2025                         return sptlrpc_import_sec_adapt(exp->exp_imp_reverse,
2026                                                         req->rq_svc_ctx,
2027                                                         &flavor);
2028                 } else {
2029                         CDEBUG(D_SEC,
2030                                "exp %p (%x|%x|%x): is current flavor, install rvs ctx\n",
2031                                exp, exp->exp_flvr.sf_rpc,
2032                                exp->exp_flvr_old[0].sf_rpc,
2033                                exp->exp_flvr_old[1].sf_rpc);
2034                         spin_unlock(&exp->exp_lock);
2035
2036                         return sptlrpc_svc_install_rvs_ctx(exp->exp_imp_reverse,
2037                                                            req->rq_svc_ctx);
2038                 }
2039         }
2040
2041         if (exp->exp_flvr_expire[0]) {
2042                 if (exp->exp_flvr_expire[0] >= ktime_get_real_seconds()) {
2043                         if (flavor_allowed(&exp->exp_flvr_old[0], req)) {
2044                                 CDEBUG(D_SEC,
2045                                        "exp %p (%x|%x|%x): match the middle one (%lld)\n",
2046                                        exp, exp->exp_flvr.sf_rpc,
2047                                        exp->exp_flvr_old[0].sf_rpc,
2048                                        exp->exp_flvr_old[1].sf_rpc,
2049                                        (s64)(exp->exp_flvr_expire[0] -
2050                                              ktime_get_real_seconds()));
2051                                 spin_unlock(&exp->exp_lock);
2052                                 return 0;
2053                         }
2054                 } else {
2055                         CDEBUG(D_SEC, "mark middle expired\n");
2056                         exp->exp_flvr_expire[0] = 0;
2057                 }
2058                 CDEBUG(D_SEC, "exp %p (%x|%x|%x): %x not match middle\n", exp,
2059                        exp->exp_flvr.sf_rpc,
2060                        exp->exp_flvr_old[0].sf_rpc, exp->exp_flvr_old[1].sf_rpc,
2061                        req->rq_flvr.sf_rpc);
2062         }
2063
2064         /*
2065          * now it doesn't match the current flavor, the only chance we can
2066          * accept it is match the old flavors which is not expired.
2067          */
2068         if (exp->exp_flvr_changed == 0 && exp->exp_flvr_expire[1]) {
2069                 if (exp->exp_flvr_expire[1] >= ktime_get_real_seconds()) {
2070                         if (flavor_allowed(&exp->exp_flvr_old[1], req)) {
2071                                 CDEBUG(D_SEC, "exp %p (%x|%x|%x): match the oldest one (%lld)\n",
2072                                        exp,
2073                                        exp->exp_flvr.sf_rpc,
2074                                        exp->exp_flvr_old[0].sf_rpc,
2075                                        exp->exp_flvr_old[1].sf_rpc,
2076                                        (s64)(exp->exp_flvr_expire[1] -
2077                                        ktime_get_real_seconds()));
2078                                 spin_unlock(&exp->exp_lock);
2079                                 return 0;
2080                         }
2081                 } else {
2082                         CDEBUG(D_SEC, "mark oldest expired\n");
2083                         exp->exp_flvr_expire[1] = 0;
2084                 }
2085                 CDEBUG(D_SEC, "exp %p (%x|%x|%x): %x not match found\n",
2086                        exp, exp->exp_flvr.sf_rpc,
2087                        exp->exp_flvr_old[0].sf_rpc, exp->exp_flvr_old[1].sf_rpc,
2088                        req->rq_flvr.sf_rpc);
2089         } else {
2090                 CDEBUG(D_SEC, "exp %p (%x|%x|%x): skip the last one\n",
2091                        exp, exp->exp_flvr.sf_rpc, exp->exp_flvr_old[0].sf_rpc,
2092                        exp->exp_flvr_old[1].sf_rpc);
2093         }
2094
2095         spin_unlock(&exp->exp_lock);
2096
2097         CWARN("exp %p(%s): req %p (%u|%u|%u|%u|%u|%u) with unauthorized flavor %x, expect %x|%x(%+lld)|%x(%+lld)\n",
2098               exp, exp->exp_obd->obd_name,
2099               req, req->rq_auth_gss, req->rq_ctx_init, req->rq_ctx_fini,
2100               req->rq_auth_usr_root, req->rq_auth_usr_mdt, req->rq_auth_usr_ost,
2101               req->rq_flvr.sf_rpc,
2102               exp->exp_flvr.sf_rpc,
2103               exp->exp_flvr_old[0].sf_rpc,
2104               exp->exp_flvr_expire[0] ?
2105               (s64)(exp->exp_flvr_expire[0] - ktime_get_real_seconds()) : 0,
2106               exp->exp_flvr_old[1].sf_rpc,
2107               exp->exp_flvr_expire[1] ?
2108               (s64)(exp->exp_flvr_expire[1] - ktime_get_real_seconds()) : 0);
2109         return -EACCES;
2110 }
2111 EXPORT_SYMBOL(sptlrpc_target_export_check);
2112
2113 void sptlrpc_target_update_exp_flavor(struct obd_device *obd,
2114                                       struct sptlrpc_rule_set *rset)
2115 {
2116         struct obd_export *exp;
2117         struct sptlrpc_flavor new_flvr;
2118
2119         LASSERT(obd);
2120
2121         spin_lock(&obd->obd_dev_lock);
2122
2123         list_for_each_entry(exp, &obd->obd_exports, exp_obd_chain) {
2124                 if (exp->exp_connection == NULL)
2125                         continue;
2126
2127                 /*
2128                  * note if this export had just been updated flavor
2129                  * (exp_flvr_changed == 1), this will override the
2130                  * previous one.
2131                  */
2132                 spin_lock(&exp->exp_lock);
2133                 sptlrpc_target_choose_flavor(rset, exp->exp_sp_peer,
2134                                              exp->exp_connection->c_peer.nid,
2135                                              &new_flvr);
2136                 if (exp->exp_flvr_changed ||
2137                     !flavor_equal(&new_flvr, &exp->exp_flvr)) {
2138                         exp->exp_flvr_old[1] = new_flvr;
2139                         exp->exp_flvr_expire[1] = 0;
2140                         exp->exp_flvr_changed = 1;
2141                         exp->exp_flvr_adapt = 1;
2142
2143                         CDEBUG(D_SEC, "exp %p (%s): updated flavor %x->%x\n",
2144                                exp, sptlrpc_part2name(exp->exp_sp_peer),
2145                                exp->exp_flvr.sf_rpc,
2146                                exp->exp_flvr_old[1].sf_rpc);
2147                 }
2148                 spin_unlock(&exp->exp_lock);
2149         }
2150
2151         spin_unlock(&obd->obd_dev_lock);
2152 }
2153 EXPORT_SYMBOL(sptlrpc_target_update_exp_flavor);
2154
2155 static int sptlrpc_svc_check_from(struct ptlrpc_request *req, int svc_rc)
2156 {
2157         /* peer's claim is unreliable unless gss is being used */
2158         if (!req->rq_auth_gss || svc_rc == SECSVC_DROP)
2159                 return svc_rc;
2160
2161         switch (req->rq_sp_from) {
2162         case LUSTRE_SP_CLI:
2163                 if (req->rq_auth_usr_mdt || req->rq_auth_usr_ost) {
2164                         /* The below message is checked in sanity-sec test_33 */
2165                         DEBUG_REQ(D_ERROR, req, "faked source CLI");
2166                         svc_rc = SECSVC_DROP;
2167                 }
2168                 break;
2169         case LUSTRE_SP_MDT:
2170                 if (!req->rq_auth_usr_mdt) {
2171                         /* The below message is checked in sanity-sec test_33 */
2172                         DEBUG_REQ(D_ERROR, req, "faked source MDT");
2173                         svc_rc = SECSVC_DROP;
2174                 }
2175                 break;
2176         case LUSTRE_SP_OST:
2177                 if (!req->rq_auth_usr_ost) {
2178                         /* The below message is checked in sanity-sec test_33 */
2179                         DEBUG_REQ(D_ERROR, req, "faked source OST");
2180                         svc_rc = SECSVC_DROP;
2181                 }
2182                 break;
2183         case LUSTRE_SP_MGS:
2184         case LUSTRE_SP_MGC:
2185                 if (!req->rq_auth_usr_root && !req->rq_auth_usr_mdt &&
2186                     !req->rq_auth_usr_ost) {
2187                         /* The below message is checked in sanity-sec test_33 */
2188                         DEBUG_REQ(D_ERROR, req, "faked source MGC/MGS");
2189                         svc_rc = SECSVC_DROP;
2190                 }
2191                 break;
2192         case LUSTRE_SP_ANY:
2193         default:
2194                 DEBUG_REQ(D_ERROR, req, "invalid source %u", req->rq_sp_from);
2195                 svc_rc = SECSVC_DROP;
2196         }
2197
2198         return svc_rc;
2199 }
2200
2201 /**
2202  * Used by ptlrpc server, to perform transformation upon request message of
2203  * incoming \a req. This must be the first thing to do with an incoming
2204  * request in ptlrpc layer.
2205  *
2206  * \retval SECSVC_OK success, and req->rq_reqmsg point to request message in
2207  * clear text, size is req->rq_reqlen; also req->rq_svc_ctx is set.
2208  * \retval SECSVC_COMPLETE success, the request has been fully processed, and
2209  * reply message has been prepared.
2210  * \retval SECSVC_DROP failed, this request should be dropped.
2211  */
2212 int sptlrpc_svc_unwrap_request(struct ptlrpc_request *req)
2213 {
2214         struct ptlrpc_sec_policy *policy;
2215         struct lustre_msg *msg = req->rq_reqbuf;
2216         int rc;
2217
2218         ENTRY;
2219
2220         LASSERT(msg);
2221         LASSERT(req->rq_reqmsg == NULL);
2222         LASSERT(req->rq_repmsg == NULL);
2223         LASSERT(req->rq_svc_ctx == NULL);
2224
2225         req->rq_req_swab_mask = 0;
2226
2227         rc = __lustre_unpack_msg(msg, req->rq_reqdata_len);
2228         switch (rc) {
2229         case 1:
2230                 lustre_set_req_swabbed(req, MSG_PTLRPC_HEADER_OFF);
2231         case 0:
2232                 break;
2233         default:
2234                 CERROR("error unpacking request from %s x%llu\n",
2235                        libcfs_id2str(req->rq_peer), req->rq_xid);
2236                 RETURN(SECSVC_DROP);
2237         }
2238
2239         req->rq_flvr.sf_rpc = WIRE_FLVR(msg->lm_secflvr);
2240         req->rq_sp_from = LUSTRE_SP_ANY;
2241         req->rq_auth_uid = -1; /* set to INVALID_UID */
2242         req->rq_auth_mapped_uid = -1;
2243
2244         policy = sptlrpc_wireflavor2policy(req->rq_flvr.sf_rpc);
2245         if (!policy) {
2246                 CERROR("unsupported rpc flavor %x\n", req->rq_flvr.sf_rpc);
2247                 RETURN(SECSVC_DROP);
2248         }
2249
2250         LASSERT(policy->sp_sops->accept);
2251         rc = policy->sp_sops->accept(req);
2252         sptlrpc_policy_put(policy);
2253         LASSERT(req->rq_reqmsg || rc != SECSVC_OK);
2254         LASSERT(req->rq_svc_ctx || rc == SECSVC_DROP);
2255
2256         /*
2257          * if it's not null flavor (which means embedded packing msg),
2258          * reset the swab mask for the comming inner msg unpacking.
2259          */
2260         if (SPTLRPC_FLVR_POLICY(req->rq_flvr.sf_rpc) != SPTLRPC_POLICY_NULL)
2261                 req->rq_req_swab_mask = 0;
2262
2263         /* sanity check for the request source */
2264         rc = sptlrpc_svc_check_from(req, rc);
2265         RETURN(rc);
2266 }
2267
2268 /**
2269  * Used by ptlrpc server, to allocate reply buffer for \a req. If succeed,
2270  * req->rq_reply_state is set, and req->rq_reply_state->rs_msg point to
2271  * a buffer of \a msglen size.
2272  */
2273 int sptlrpc_svc_alloc_rs(struct ptlrpc_request *req, int msglen)
2274 {
2275         struct ptlrpc_sec_policy *policy;
2276         struct ptlrpc_reply_state *rs;
2277         int rc;
2278
2279         ENTRY;
2280
2281         LASSERT(req->rq_svc_ctx);
2282         LASSERT(req->rq_svc_ctx->sc_policy);
2283
2284         policy = req->rq_svc_ctx->sc_policy;
2285         LASSERT(policy->sp_sops->alloc_rs);
2286
2287         rc = policy->sp_sops->alloc_rs(req, msglen);
2288         if (unlikely(rc == -ENOMEM)) {
2289                 struct ptlrpc_service_part *svcpt = req->rq_rqbd->rqbd_svcpt;
2290
2291                 if (svcpt->scp_service->srv_max_reply_size <
2292                    msglen + sizeof(struct ptlrpc_reply_state)) {
2293                         /* Just return failure if the size is too big */
2294                         CERROR("size of message is too big (%zd), %d allowed\n",
2295                                 msglen + sizeof(struct ptlrpc_reply_state),
2296                                 svcpt->scp_service->srv_max_reply_size);
2297                         RETURN(-ENOMEM);
2298                 }
2299
2300                 /* failed alloc, try emergency pool */
2301                 rs = lustre_get_emerg_rs(svcpt);
2302                 if (rs == NULL)
2303                         RETURN(-ENOMEM);
2304
2305                 req->rq_reply_state = rs;
2306                 rc = policy->sp_sops->alloc_rs(req, msglen);
2307                 if (rc) {
2308                         lustre_put_emerg_rs(rs);
2309                         req->rq_reply_state = NULL;
2310                 }
2311         }
2312
2313         LASSERT(rc != 0 ||
2314                 (req->rq_reply_state && req->rq_reply_state->rs_msg));
2315
2316         RETURN(rc);
2317 }
2318
2319 /**
2320  * Used by ptlrpc server, to perform transformation upon reply message.
2321  *
2322  * \post req->rq_reply_off is set to approriate server-controlled reply offset.
2323  * \post req->rq_repmsg and req->rq_reply_state->rs_msg becomes inaccessible.
2324  */
2325 int sptlrpc_svc_wrap_reply(struct ptlrpc_request *req)
2326 {
2327         struct ptlrpc_sec_policy *policy;
2328         int rc;
2329
2330         ENTRY;
2331
2332         LASSERT(req->rq_svc_ctx);
2333         LASSERT(req->rq_svc_ctx->sc_policy);
2334
2335         policy = req->rq_svc_ctx->sc_policy;
2336         LASSERT(policy->sp_sops->authorize);
2337
2338         rc = policy->sp_sops->authorize(req);
2339         LASSERT(rc || req->rq_reply_state->rs_repdata_len);
2340
2341         RETURN(rc);
2342 }
2343
2344 /**
2345  * Used by ptlrpc server, to free reply_state.
2346  */
2347 void sptlrpc_svc_free_rs(struct ptlrpc_reply_state *rs)
2348 {
2349         struct ptlrpc_sec_policy *policy;
2350         unsigned int prealloc;
2351
2352         ENTRY;
2353
2354         LASSERT(rs->rs_svc_ctx);
2355         LASSERT(rs->rs_svc_ctx->sc_policy);
2356
2357         policy = rs->rs_svc_ctx->sc_policy;
2358         LASSERT(policy->sp_sops->free_rs);
2359
2360         prealloc = rs->rs_prealloc;
2361         policy->sp_sops->free_rs(rs);
2362
2363         if (prealloc)
2364                 lustre_put_emerg_rs(rs);
2365         EXIT;
2366 }
2367
2368 void sptlrpc_svc_ctx_addref(struct ptlrpc_request *req)
2369 {
2370         struct ptlrpc_svc_ctx *ctx = req->rq_svc_ctx;
2371
2372         if (ctx != NULL)
2373                 atomic_inc(&ctx->sc_refcount);
2374 }
2375
2376 void sptlrpc_svc_ctx_decref(struct ptlrpc_request *req)
2377 {
2378         struct ptlrpc_svc_ctx *ctx = req->rq_svc_ctx;
2379
2380         if (ctx == NULL)
2381                 return;
2382
2383         LASSERT_ATOMIC_POS(&ctx->sc_refcount);
2384         if (atomic_dec_and_test(&ctx->sc_refcount)) {
2385                 if (ctx->sc_policy->sp_sops->free_ctx)
2386                         ctx->sc_policy->sp_sops->free_ctx(ctx);
2387         }
2388         req->rq_svc_ctx = NULL;
2389 }
2390
2391 void sptlrpc_svc_ctx_invalidate(struct ptlrpc_request *req)
2392 {
2393         struct ptlrpc_svc_ctx *ctx = req->rq_svc_ctx;
2394
2395         if (ctx == NULL)
2396                 return;
2397
2398         LASSERT_ATOMIC_POS(&ctx->sc_refcount);
2399         if (ctx->sc_policy->sp_sops->invalidate_ctx)
2400                 ctx->sc_policy->sp_sops->invalidate_ctx(ctx);
2401 }
2402 EXPORT_SYMBOL(sptlrpc_svc_ctx_invalidate);
2403
2404 /*
2405  * bulk security
2406  */
2407
2408 /**
2409  * Perform transformation upon bulk data pointed by \a desc. This is called
2410  * before transforming the request message.
2411  */
2412 int sptlrpc_cli_wrap_bulk(struct ptlrpc_request *req,
2413                           struct ptlrpc_bulk_desc *desc)
2414 {
2415         struct ptlrpc_cli_ctx *ctx;
2416
2417         LASSERT(req->rq_bulk_read || req->rq_bulk_write);
2418
2419         if (!req->rq_pack_bulk)
2420                 return 0;
2421
2422         ctx = req->rq_cli_ctx;
2423         if (ctx->cc_ops->wrap_bulk)
2424                 return ctx->cc_ops->wrap_bulk(ctx, req, desc);
2425         return 0;
2426 }
2427 EXPORT_SYMBOL(sptlrpc_cli_wrap_bulk);
2428
2429 /**
2430  * This is called after unwrap the reply message.
2431  * return nob of actual plain text size received, or error code.
2432  */
2433 int sptlrpc_cli_unwrap_bulk_read(struct ptlrpc_request *req,
2434                                  struct ptlrpc_bulk_desc *desc,
2435                                  int nob)
2436 {
2437         struct ptlrpc_cli_ctx *ctx;
2438         int rc;
2439
2440         LASSERT(req->rq_bulk_read && !req->rq_bulk_write);
2441
2442         if (!req->rq_pack_bulk)
2443                 return desc->bd_nob_transferred;
2444
2445         ctx = req->rq_cli_ctx;
2446         if (ctx->cc_ops->unwrap_bulk) {
2447                 rc = ctx->cc_ops->unwrap_bulk(ctx, req, desc);
2448                 if (rc < 0)
2449                         return rc;
2450         }
2451         return desc->bd_nob_transferred;
2452 }
2453 EXPORT_SYMBOL(sptlrpc_cli_unwrap_bulk_read);
2454
2455 /**
2456  * This is called after unwrap the reply message.
2457  * return 0 for success or error code.
2458  */
2459 int sptlrpc_cli_unwrap_bulk_write(struct ptlrpc_request *req,
2460                                   struct ptlrpc_bulk_desc *desc)
2461 {
2462         struct ptlrpc_cli_ctx *ctx;
2463         int rc;
2464
2465         LASSERT(!req->rq_bulk_read && req->rq_bulk_write);
2466
2467         if (!req->rq_pack_bulk)
2468                 return 0;
2469
2470         ctx = req->rq_cli_ctx;
2471         if (ctx->cc_ops->unwrap_bulk) {
2472                 rc = ctx->cc_ops->unwrap_bulk(ctx, req, desc);
2473                 if (rc < 0)
2474                         return rc;
2475         }
2476
2477         /*
2478          * if everything is going right, nob should equals to nob_transferred.
2479          * in case of privacy mode, nob_transferred needs to be adjusted.
2480          */
2481         if (desc->bd_nob != desc->bd_nob_transferred) {
2482                 CERROR("nob %d doesn't match transferred nob %d\n",
2483                        desc->bd_nob, desc->bd_nob_transferred);
2484                 return -EPROTO;
2485         }
2486
2487         return 0;
2488 }
2489 EXPORT_SYMBOL(sptlrpc_cli_unwrap_bulk_write);
2490
2491 #ifdef HAVE_SERVER_SUPPORT
2492 /**
2493  * Performe transformation upon outgoing bulk read.
2494  */
2495 int sptlrpc_svc_wrap_bulk(struct ptlrpc_request *req,
2496                           struct ptlrpc_bulk_desc *desc)
2497 {
2498         struct ptlrpc_svc_ctx *ctx;
2499
2500         LASSERT(req->rq_bulk_read);
2501
2502         if (!req->rq_pack_bulk)
2503                 return 0;
2504
2505         ctx = req->rq_svc_ctx;
2506         if (ctx->sc_policy->sp_sops->wrap_bulk)
2507                 return ctx->sc_policy->sp_sops->wrap_bulk(req, desc);
2508
2509         return 0;
2510 }
2511 EXPORT_SYMBOL(sptlrpc_svc_wrap_bulk);
2512
2513 /**
2514  * Performe transformation upon incoming bulk write.
2515  */
2516 int sptlrpc_svc_unwrap_bulk(struct ptlrpc_request *req,
2517                             struct ptlrpc_bulk_desc *desc)
2518 {
2519         struct ptlrpc_svc_ctx *ctx;
2520         int rc;
2521
2522         LASSERT(req->rq_bulk_write);
2523
2524         /*
2525          * if it's in privacy mode, transferred should >= expected; otherwise
2526          * transferred should == expected.
2527          */
2528         if (desc->bd_nob_transferred < desc->bd_nob ||
2529             (desc->bd_nob_transferred > desc->bd_nob &&
2530              SPTLRPC_FLVR_BULK_SVC(req->rq_flvr.sf_rpc) !=
2531              SPTLRPC_BULK_SVC_PRIV)) {
2532                 DEBUG_REQ(D_ERROR, req, "truncated bulk GET %d(%d)",
2533                           desc->bd_nob_transferred, desc->bd_nob);
2534                 return -ETIMEDOUT;
2535         }
2536
2537         if (!req->rq_pack_bulk)
2538                 return 0;
2539
2540         ctx = req->rq_svc_ctx;
2541         if (ctx->sc_policy->sp_sops->unwrap_bulk) {
2542                 rc = ctx->sc_policy->sp_sops->unwrap_bulk(req, desc);
2543                 if (rc)
2544                         CERROR("error unwrap bulk: %d\n", rc);
2545         }
2546
2547         /* return 0 to allow reply be sent */
2548         return 0;
2549 }
2550 EXPORT_SYMBOL(sptlrpc_svc_unwrap_bulk);
2551
2552 /**
2553  * Prepare buffers for incoming bulk write.
2554  */
2555 int sptlrpc_svc_prep_bulk(struct ptlrpc_request *req,
2556                           struct ptlrpc_bulk_desc *desc)
2557 {
2558         struct ptlrpc_svc_ctx *ctx;
2559
2560         LASSERT(req->rq_bulk_write);
2561
2562         if (!req->rq_pack_bulk)
2563                 return 0;
2564
2565         ctx = req->rq_svc_ctx;
2566         if (ctx->sc_policy->sp_sops->prep_bulk)
2567                 return ctx->sc_policy->sp_sops->prep_bulk(req, desc);
2568
2569         return 0;
2570 }
2571 EXPORT_SYMBOL(sptlrpc_svc_prep_bulk);
2572
2573 #endif /* HAVE_SERVER_SUPPORT */
2574
2575 /*
2576  * user descriptor helpers
2577  */
2578
2579 int sptlrpc_current_user_desc_size(void)
2580 {
2581         int ngroups;
2582
2583         ngroups = current_ngroups;
2584
2585         if (ngroups > LUSTRE_MAX_GROUPS)
2586                 ngroups = LUSTRE_MAX_GROUPS;
2587         return sptlrpc_user_desc_size(ngroups);
2588 }
2589 EXPORT_SYMBOL(sptlrpc_current_user_desc_size);
2590
2591 int sptlrpc_pack_user_desc(struct lustre_msg *msg, int offset)
2592 {
2593         struct ptlrpc_user_desc *pud;
2594
2595         pud = lustre_msg_buf(msg, offset, 0);
2596
2597         pud->pud_uid = from_kuid(&init_user_ns, current_uid());
2598         pud->pud_gid = from_kgid(&init_user_ns, current_gid());
2599         pud->pud_fsuid = from_kuid(&init_user_ns, current_fsuid());
2600         pud->pud_fsgid = from_kgid(&init_user_ns, current_fsgid());
2601         pud->pud_cap = cfs_curproc_cap_pack();
2602         pud->pud_ngroups = (msg->lm_buflens[offset] - sizeof(*pud)) / 4;
2603
2604         task_lock(current);
2605         if (pud->pud_ngroups > current_ngroups)
2606                 pud->pud_ngroups = current_ngroups;
2607 #ifdef HAVE_GROUP_INFO_GID
2608         memcpy(pud->pud_groups, current_cred()->group_info->gid,
2609                pud->pud_ngroups * sizeof(__u32));
2610 #else /* !HAVE_GROUP_INFO_GID */
2611         memcpy(pud->pud_groups, current_cred()->group_info->blocks[0],
2612                pud->pud_ngroups * sizeof(__u32));
2613 #endif /* HAVE_GROUP_INFO_GID */
2614         task_unlock(current);
2615
2616         return 0;
2617 }
2618 EXPORT_SYMBOL(sptlrpc_pack_user_desc);
2619
2620 int sptlrpc_unpack_user_desc(struct lustre_msg *msg, int offset, int swabbed)
2621 {
2622         struct ptlrpc_user_desc *pud;
2623         int i;
2624
2625         pud = lustre_msg_buf(msg, offset, sizeof(*pud));
2626         if (!pud)
2627                 return -EINVAL;
2628
2629         if (swabbed) {
2630                 __swab32s(&pud->pud_uid);
2631                 __swab32s(&pud->pud_gid);
2632                 __swab32s(&pud->pud_fsuid);
2633                 __swab32s(&pud->pud_fsgid);
2634                 __swab32s(&pud->pud_cap);
2635                 __swab32s(&pud->pud_ngroups);
2636         }
2637
2638         if (pud->pud_ngroups > LUSTRE_MAX_GROUPS) {
2639                 CERROR("%u groups is too large\n", pud->pud_ngroups);
2640                 return -EINVAL;
2641         }
2642
2643         if (sizeof(*pud) + pud->pud_ngroups * sizeof(__u32) >
2644             msg->lm_buflens[offset]) {
2645                 CERROR("%u groups are claimed but bufsize only %u\n",
2646                        pud->pud_ngroups, msg->lm_buflens[offset]);
2647                 return -EINVAL;
2648         }
2649
2650         if (swabbed) {
2651                 for (i = 0; i < pud->pud_ngroups; i++)
2652                         __swab32s(&pud->pud_groups[i]);
2653         }
2654
2655         return 0;
2656 }
2657 EXPORT_SYMBOL(sptlrpc_unpack_user_desc);
2658
2659 /*
2660  * misc helpers
2661  */
2662
2663 const char *sec2target_str(struct ptlrpc_sec *sec)
2664 {
2665         if (!sec || !sec->ps_import || !sec->ps_import->imp_obd)
2666                 return "*";
2667         if (sec_is_reverse(sec))
2668                 return "c";
2669         return obd_uuid2str(&sec->ps_import->imp_obd->u.cli.cl_target_uuid);
2670 }
2671 EXPORT_SYMBOL(sec2target_str);
2672
2673 /*
2674  * return true if the bulk data is protected
2675  */
2676 int sptlrpc_flavor_has_bulk(struct sptlrpc_flavor *flvr)
2677 {
2678         switch (SPTLRPC_FLVR_BULK_SVC(flvr->sf_rpc)) {
2679         case SPTLRPC_BULK_SVC_INTG:
2680         case SPTLRPC_BULK_SVC_PRIV:
2681                 return 1;
2682         default:
2683                 return 0;
2684         }
2685 }
2686 EXPORT_SYMBOL(sptlrpc_flavor_has_bulk);
2687
2688 /*
2689  * crypto API helper/alloc blkciper
2690  */
2691
2692 /*
2693  * initialize/finalize
2694  */
2695
2696 int sptlrpc_init(void)
2697 {
2698         int rc;
2699
2700         rwlock_init(&policy_lock);
2701
2702         rc = sptlrpc_gc_init();
2703         if (rc)
2704                 goto out;
2705
2706         rc = sptlrpc_conf_init();
2707         if (rc)
2708                 goto out_gc;
2709
2710         rc = sptlrpc_enc_pool_init();
2711         if (rc)
2712                 goto out_conf;
2713
2714         rc = sptlrpc_null_init();
2715         if (rc)
2716                 goto out_pool;
2717
2718         rc = sptlrpc_plain_init();
2719         if (rc)
2720                 goto out_null;
2721
2722         rc = sptlrpc_lproc_init();
2723         if (rc)
2724                 goto out_plain;
2725
2726         return 0;
2727
2728 out_plain:
2729         sptlrpc_plain_fini();
2730 out_null:
2731         sptlrpc_null_fini();
2732 out_pool:
2733         sptlrpc_enc_pool_fini();
2734 out_conf:
2735         sptlrpc_conf_fini();
2736 out_gc:
2737         sptlrpc_gc_fini();
2738 out:
2739         return rc;
2740 }
2741
2742 void sptlrpc_fini(void)
2743 {
2744         sptlrpc_lproc_fini();
2745         sptlrpc_plain_fini();
2746         sptlrpc_null_fini();
2747         sptlrpc_enc_pool_fini();
2748         sptlrpc_conf_fini();
2749         sptlrpc_gc_fini();
2750 }