lustre/ptlrpc/sec_config.c

   1 /* -*- mode: c; c-basic-offset: 8; indent-tabs-mode: nil; -*-
   2  * vim:expandtab:shiftwidth=8:tabstop=8:
   3  *
   4  * GPL HEADER START
   5  *
   6  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License version 2 only,
  10  * as published by the Free Software Foundation.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * General Public License version 2 for more details (a copy is included
  16  * in the LICENSE file that accompanied this code).
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * version 2 along with this program; If not, see
  20  * http://www.sun.com/software/products/lustre/docs/GPLv2.pdf
  21  *
  22  * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
  23  * CA 95054 USA or visit www.sun.com if you need additional information or
  24  * have any questions.
  25  *
  26  * GPL HEADER END
  27  */
  28 /*
  29  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
  30  * Use is subject to license terms.
  31  */
  32 /*
  33  * This file is part of Lustre, http://www.lustre.org/
  34  * Lustre is a trademark of Sun Microsystems, Inc.
  35  */
  36
  37 #ifndef EXPORT_SYMTAB
  38 #define EXPORT_SYMTAB
  39 #endif
  40 #define DEBUG_SUBSYSTEM S_SEC
  41
  42 #include <libcfs/libcfs.h>
  43 #ifndef __KERNEL__
  44 #include <liblustre.h>
  45 #include <libcfs/list.h>
  46 #else
  47 #include <linux/crypto.h>
  48 #include <linux/key.h>
  49 #endif
  50
  51 #include <obd.h>
  52 #include <obd_class.h>
  53 #include <obd_support.h>
  54 #include <lustre_net.h>
  55 #include <lustre_import.h>
  56 #include <lustre_log.h>
  57 #include <lustre_disk.h>
  58 #include <lustre_dlm.h>
  59 #include <lustre_param.h>
  60 #include <lustre_sec.h>
  61
  62 #include "ptlrpc_internal.h"
  63
  64 const char *sptlrpc_part2name(enum lustre_sec_part part)
  65 {
  66         switch (part) {
  67         case LUSTRE_SP_CLI:
  68                 return "cli";
  69         case LUSTRE_SP_MDT:
  70                 return "mdt";
  71         case LUSTRE_SP_OST:
  72                 return "ost";
  73         case LUSTRE_SP_MGC:
  74                 return "mgc";
  75         case LUSTRE_SP_MGS:
  76                 return "mgs";
  77         case LUSTRE_SP_ANY:
  78                 return "any";
  79         default:
  80                 return "err";
  81         }
  82 }
  83 EXPORT_SYMBOL(sptlrpc_part2name);
  84
  85 enum lustre_sec_part sptlrpc_target_sec_part(struct obd_device *obd)
  86 {
  87         const char *type = obd->obd_type->typ_name;
  88
  89         if (!strcmp(type, LUSTRE_MDT_NAME))
  90                 return LUSTRE_SP_MDT;
  91         if (!strcmp(type, LUSTRE_OST_NAME))
  92                 return LUSTRE_SP_OST;
  93         if (!strcmp(type, LUSTRE_MGS_NAME))
  94                 return LUSTRE_SP_MGS;
  95
  96         CERROR("unknown target %p(%s)\n", obd, type);
  97         return LUSTRE_SP_ANY;
  98 }
  99 EXPORT_SYMBOL(sptlrpc_target_sec_part);
 100
 101 /****************************************
 102  * user supplied flavor string parsing  *
 103  ****************************************/
 104
 105 /*
 106  * format: <base_flavor>[-<bulk_type:alg_spec>]
 107  */
 108 int sptlrpc_parse_flavor(const char *str, struct sptlrpc_flavor *flvr)
 109 {
 110         char            buf[32];
 111         char           *bulk, *alg;
 112
 113         memset(flvr, 0, sizeof(*flvr));
 114
 115         if (str == NULL || str[0] == '\0') {
 116                 flvr->sf_rpc = SPTLRPC_FLVR_INVALID;
 117                 return 0;
 118         }
 119
 120         strncpy(buf, str, sizeof(buf));
 121         buf[sizeof(buf) - 1] = '\0';
 122
 123         bulk = strchr(buf, '-');
 124         if (bulk)
 125                 *bulk++ = '\0';
 126
 127         flvr->sf_rpc = sptlrpc_name2flavor_base(buf);
 128         if (flvr->sf_rpc == SPTLRPC_FLVR_INVALID)
 129                 goto err_out;
 130
 131         /*
 132          * currently only base flavor "plain" can have bulk specification.
 133          */
 134         if (flvr->sf_rpc == SPTLRPC_FLVR_PLAIN) {
 135                 flvr->u_bulk.hash.hash_alg = BULK_HASH_ALG_ADLER32;
 136                 if (bulk) {
 137                         /*
 138                          * format: plain-hash:<hash_alg>
 139                          */
 140                         alg = strchr(bulk, ':');
 141                         if (alg == NULL)
 142                                 goto err_out;
 143                         *alg++ = '\0';
 144
 145                         if (strcmp(bulk, "hash"))
 146                                 goto err_out;
 147
 148                         flvr->u_bulk.hash.hash_alg = sptlrpc_get_hash_alg(alg);
 149                         if (flvr->u_bulk.hash.hash_alg >= BULK_HASH_ALG_MAX)
 150                                 goto err_out;
 151                 }
 152
 153                 if (flvr->u_bulk.hash.hash_alg == BULK_HASH_ALG_NULL)
 154                         flvr_set_bulk_svc(&flvr->sf_rpc, SPTLRPC_BULK_SVC_NULL);
 155                 else
 156                         flvr_set_bulk_svc(&flvr->sf_rpc, SPTLRPC_BULK_SVC_INTG);
 157         } else {
 158                 if (bulk)
 159                         goto err_out;
 160         }
 161
 162         flvr->sf_flags = 0;
 163         return 0;
 164
 165 err_out:
 166         CERROR("invalid flavor string: %s\n", str);
 167         return -EINVAL;
 168 }
 169 EXPORT_SYMBOL(sptlrpc_parse_flavor);
 170
 171 /****************************************
 172  * configure rules                      *
 173  ****************************************/
 174
 175 static void get_default_flavor(struct sptlrpc_flavor *sf)
 176 {
 177         memset(sf, 0, sizeof(*sf));
 178
 179         sf->sf_rpc = SPTLRPC_FLVR_NULL;
 180         sf->sf_flags = 0;
 181 }
 182
 183 static void sptlrpc_rule_init(struct sptlrpc_rule *rule)
 184 {
 185         rule->sr_netid = LNET_NIDNET(LNET_NID_ANY);
 186         rule->sr_from = LUSTRE_SP_ANY;
 187         rule->sr_to = LUSTRE_SP_ANY;
 188         rule->sr_padding = 0;
 189
 190         get_default_flavor(&rule->sr_flvr);
 191 }
 192
 193 /*
 194  * format: network[.direction]=flavor
 195  */
 196 int sptlrpc_parse_rule(char *param, struct sptlrpc_rule *rule)
 197 {
 198         char           *flavor, *dir;
 199         int             rc;
 200
 201         sptlrpc_rule_init(rule);
 202
 203         flavor = strchr(param, '=');
 204         if (flavor == NULL) {
 205                 CERROR("invalid param, no '='\n");
 206                 RETURN(-EINVAL);
 207         }
 208         *flavor++ = '\0';
 209
 210         dir = strchr(param, '.');
 211         if (dir)
 212                 *dir++ = '\0';
 213
 214         /* 1.1 network */
 215         if (strcmp(param, "default")) {
 216                 rule->sr_netid = libcfs_str2net(param);
 217                 if (rule->sr_netid == LNET_NIDNET(LNET_NID_ANY)) {
 218                         CERROR("invalid network name: %s\n", param);
 219                         RETURN(-EINVAL);
 220                 }
 221         }
 222
 223         /* 1.2 direction */
 224         if (dir) {
 225                 if (!strcmp(dir, "mdt2ost")) {
 226                         rule->sr_from = LUSTRE_SP_MDT;
 227                         rule->sr_to = LUSTRE_SP_OST;
 228                 } else if (!strcmp(dir, "mdt2mdt")) {
 229                         rule->sr_from = LUSTRE_SP_MDT;
 230                         rule->sr_to = LUSTRE_SP_MDT;
 231                 } else if (!strcmp(dir, "cli2ost")) {
 232                         rule->sr_from = LUSTRE_SP_CLI;
 233                         rule->sr_to = LUSTRE_SP_OST;
 234                 } else if (!strcmp(dir, "cli2mdt")) {
 235                         rule->sr_from = LUSTRE_SP_CLI;
 236                         rule->sr_to = LUSTRE_SP_MDT;
 237                 } else {
 238                         CERROR("invalid rule dir segment: %s\n", dir);
 239                         RETURN(-EINVAL);
 240                 }
 241         }
 242
 243         /* 2.1 flavor */
 244         rc = sptlrpc_parse_flavor(flavor, &rule->sr_flvr);
 245         if (rc)
 246                 RETURN(-EINVAL);
 247
 248         RETURN(0);
 249 }
 250 EXPORT_SYMBOL(sptlrpc_parse_rule);
 251
 252 void sptlrpc_rule_set_free(struct sptlrpc_rule_set *rset)
 253 {
 254         LASSERT(rset->srs_nslot ||
 255                 (rset->srs_nrule == 0 && rset->srs_rules == NULL));
 256
 257         if (rset->srs_nslot) {
 258                 OBD_FREE(rset->srs_rules,
 259                          rset->srs_nslot * sizeof(*rset->srs_rules));
 260                 sptlrpc_rule_set_init(rset);
 261         }
 262 }
 263 EXPORT_SYMBOL(sptlrpc_rule_set_free);
 264
 265 /*
 266  * return 0 if the rule set could accomodate one more rule.
 267  */
 268 int sptlrpc_rule_set_expand(struct sptlrpc_rule_set *rset)
 269 {
 270         struct sptlrpc_rule *rules;
 271         int nslot;
 272
 273         cfs_might_sleep();
 274
 275         if (rset->srs_nrule < rset->srs_nslot)
 276                 return 0;
 277
 278         nslot = rset->srs_nslot + 8;
 279
 280         /* better use realloc() if available */
 281         OBD_ALLOC(rules, nslot * sizeof(*rset->srs_rules));
 282         if (rules == NULL)
 283                 return -ENOMEM;
 284
 285         if (rset->srs_nrule) {
 286                 LASSERT(rset->srs_nslot && rset->srs_rules);
 287                 memcpy(rules, rset->srs_rules,
 288                        rset->srs_nrule * sizeof(*rset->srs_rules));
 289
 290                 OBD_FREE(rset->srs_rules,
 291                          rset->srs_nslot * sizeof(*rset->srs_rules));
 292         }
 293
 294         rset->srs_rules = rules;
 295         rset->srs_nslot = nslot;
 296         return 0;
 297 }
 298 EXPORT_SYMBOL(sptlrpc_rule_set_expand);
 299
 300 static inline int rule_spec_dir(struct sptlrpc_rule *rule)
 301 {
 302         return (rule->sr_from != LUSTRE_SP_ANY ||
 303                 rule->sr_to != LUSTRE_SP_ANY);
 304 }
 305 static inline int rule_spec_net(struct sptlrpc_rule *rule)
 306 {
 307         return (rule->sr_netid != LNET_NIDNET(LNET_NID_ANY));
 308 }
 309 static inline int rule_match_dir(struct sptlrpc_rule *r1,
 310                                  struct sptlrpc_rule *r2)
 311 {
 312         return (r1->sr_from == r2->sr_from && r1->sr_to == r2->sr_to);
 313 }
 314 static inline int rule_match_net(struct sptlrpc_rule *r1,
 315                                  struct sptlrpc_rule *r2)
 316 {
 317         return (r1->sr_netid == r2->sr_netid);
 318 }
 319
 320 /*
 321  * merge @rule into @rset.
 322  * the @rset slots might be expanded.
 323  */
 324 int sptlrpc_rule_set_merge(struct sptlrpc_rule_set *rset,
 325                            struct sptlrpc_rule *rule)
 326 {
 327         struct sptlrpc_rule      *p = rset->srs_rules;
 328         int                       spec_dir, spec_net;
 329         int                       rc, n, match = 0;
 330
 331         cfs_might_sleep();
 332
 333         spec_net = rule_spec_net(rule);
 334         spec_dir = rule_spec_dir(rule);
 335
 336         for (n = 0; n < rset->srs_nrule; n++) {
 337                 p = &rset->srs_rules[n];
 338
 339                 /* test network match, if failed:
 340                  * - spec rule: skip rules which is also spec rule match, until
 341                  *   we hit a wild rule, which means no more chance
 342                  * - wild rule: skip until reach the one which is also wild
 343                  *   and matches
 344                  */
 345                 if (!rule_match_net(p, rule)) {
 346                         if (spec_net) {
 347                                 if (rule_spec_net(p))
 348                                         continue;
 349                                 else
 350                                         break;
 351                         } else {
 352                                 continue;
 353                         }
 354                 }
 355
 356                 /* test dir match, same logic as net matching */
 357                 if (!rule_match_dir(p, rule)) {
 358                         if (spec_dir) {
 359                                 if (rule_spec_dir(p))
 360                                         continue;
 361                                 else
 362                                         break;
 363                         } else {
 364                                 continue;
 365                         }
 366                 }
 367
 368                 /* find a match */
 369                 match = 1;
 370                 break;
 371         }
 372
 373         if (match) {
 374                 LASSERT(n >= 0 && n < rset->srs_nrule);
 375
 376                 if (rule->sr_flvr.sf_rpc == SPTLRPC_FLVR_INVALID) {
 377                         /* remove this rule */
 378                         if (n < rset->srs_nrule - 1)
 379                                 memmove(&rset->srs_rules[n],
 380                                         &rset->srs_rules[n + 1],
 381                                         (rset->srs_nrule - n - 1) *
 382                                         sizeof(*rule));
 383                         rset->srs_nrule--;
 384                 } else {
 385                         /* override the rule */
 386                         memcpy(&rset->srs_rules[n], rule, sizeof(*rule));
 387                 }
 388         } else {
 389                 LASSERT(n >= 0 && n <= rset->srs_nrule);
 390
 391                 if (rule->sr_flvr.sf_rpc != SPTLRPC_FLVR_INVALID) {
 392                         rc = sptlrpc_rule_set_expand(rset);
 393                         if (rc)
 394                                 return rc;
 395
 396                         if (n < rset->srs_nrule)
 397                                 memmove(&rset->srs_rules[n + 1],
 398                                         &rset->srs_rules[n],
 399                                         (rset->srs_nrule - n) * sizeof(*rule));
 400                         memcpy(&rset->srs_rules[n], rule, sizeof(*rule));
 401                         rset->srs_nrule++;
 402                 } else {
 403                         CDEBUG(D_CONFIG, "ignore the unmatched deletion\n");
 404                 }
 405         }
 406
 407         return 0;
 408 }
 409 EXPORT_SYMBOL(sptlrpc_rule_set_merge);
 410
 411 /**
 412  * given from/to/nid, determine a matching flavor in ruleset.
 413  * return 1 if a match found, otherwise return 0.
 414  */
 415 int sptlrpc_rule_set_choose(struct sptlrpc_rule_set *rset,
 416                             enum lustre_sec_part from,
 417                             enum lustre_sec_part to,
 418                             lnet_nid_t nid,
 419                             struct sptlrpc_flavor *sf)
 420 {
 421         struct sptlrpc_rule    *r;
 422         int                     n;
 423
 424         for (n = 0; n < rset->srs_nrule; n++) {
 425                 r = &rset->srs_rules[n];
 426
 427                 if (LNET_NIDNET(nid) != LNET_NIDNET(LNET_NID_ANY) &&
 428                     r->sr_netid != LNET_NIDNET(LNET_NID_ANY) &&
 429                     LNET_NIDNET(nid) != r->sr_netid)
 430                         continue;
 431
 432                 if (from != LUSTRE_SP_ANY && r->sr_from != LUSTRE_SP_ANY &&
 433                     from != r->sr_from)
 434                         continue;
 435
 436                 if (to != LUSTRE_SP_ANY && r->sr_to != LUSTRE_SP_ANY &&
 437                     to != r->sr_to)
 438                         continue;
 439
 440                 *sf = r->sr_flvr;
 441                 return 1;
 442         }
 443
 444         return 0;
 445 }
 446 EXPORT_SYMBOL(sptlrpc_rule_set_choose);
 447
 448 void sptlrpc_rule_set_dump(struct sptlrpc_rule_set *rset)
 449 {
 450         struct sptlrpc_rule *r;
 451         int     n;
 452
 453         for (n = 0; n < rset->srs_nrule; n++) {
 454                 r = &rset->srs_rules[n];
 455                 CWARN("<%02d> from %x to %x, net %x, rpc %x\n", n,
 456                       r->sr_from, r->sr_to, r->sr_netid, r->sr_flvr.sf_rpc);
 457         }
 458 }
 459 EXPORT_SYMBOL(sptlrpc_rule_set_dump);
 460
 461 static int sptlrpc_rule_set_extract(struct sptlrpc_rule_set *gen,
 462                                     struct sptlrpc_rule_set *tgt,
 463                                     enum lustre_sec_part from,
 464                                     enum lustre_sec_part to,
 465                                     struct sptlrpc_rule_set *rset)
 466 {
 467         struct sptlrpc_rule_set *src[2] = { gen, tgt };
 468         struct sptlrpc_rule     *rule;
 469         int                      i, n, rc;
 470
 471         cfs_might_sleep();
 472
 473         /* merge general rules firstly, then target-specific rules */
 474         for (i = 0; i < 2; i++) {
 475                 if (src[i] == NULL)
 476                         continue;
 477
 478                 for (n = 0; n < src[i]->srs_nrule; n++) {
 479                         rule = &src[i]->srs_rules[n];
 480
 481                         if (from != LUSTRE_SP_ANY &&
 482                             rule->sr_from != LUSTRE_SP_ANY &&
 483                             rule->sr_from != from)
 484                                 continue;
 485                         if (to != LUSTRE_SP_ANY &&
 486                             rule->sr_to != LUSTRE_SP_ANY &&
 487                             rule->sr_to != to)
 488                                 continue;
 489
 490                         rc = sptlrpc_rule_set_merge(rset, rule);
 491                         if (rc) {
 492                                 CERROR("can't merge: %d\n", rc);
 493                                 return rc;
 494                         }
 495                 }
 496         }
 497
 498         return 0;
 499 }
 500
 501 /**********************************
 502  * sptlrpc configuration support  *
 503  **********************************/
 504
 505 struct sptlrpc_conf_tgt {
 506         cfs_list_t              sct_list;
 507         char                    sct_name[MAX_OBD_NAME];
 508         struct sptlrpc_rule_set sct_rset;
 509 };
 510
 511 struct sptlrpc_conf {
 512         cfs_list_t              sc_list;
 513         char                    sc_fsname[MTI_NAME_MAXLEN];
 514         unsigned int            sc_modified;  /* modified during updating */
 515         unsigned int            sc_updated:1, /* updated copy from MGS */
 516                                 sc_local:1;   /* local copy from target */
 517         struct sptlrpc_rule_set sc_rset;      /* fs general rules */
 518         cfs_list_t              sc_tgts;      /* target-specific rules */
 519 };
 520
 521 static cfs_mutex_t sptlrpc_conf_lock;
 522 static CFS_LIST_HEAD(sptlrpc_confs);
 523
 524 static inline int is_hex(char c)
 525 {
 526         return ((c >= '0' && c <= '9') ||
 527                 (c >= 'a' && c <= 'f'));
 528 }
 529
 530 static void target2fsname(const char *tgt, char *fsname, int buflen)
 531 {
 532         const char     *ptr;
 533         int             len;
 534
 535         ptr = strrchr(tgt, '-');
 536         if (ptr) {
 537                 if ((strncmp(ptr, "-MDT", 4) != 0 &&
 538                      strncmp(ptr, "-OST", 4) != 0) ||
 539                     !is_hex(ptr[4]) || !is_hex(ptr[5]) ||
 540                     !is_hex(ptr[6]) || !is_hex(ptr[7]))
 541                         ptr = NULL;
 542         }
 543
 544         /* if we didn't find the pattern, treat the whole string as fsname */
 545         if (ptr == NULL)
 546                 len = strlen(tgt);
 547         else
 548                 len = ptr - tgt;
 549
 550         len = min(len, buflen - 1);
 551         memcpy(fsname, tgt, len);
 552         fsname[len] = '\0';
 553 }
 554
 555 static void sptlrpc_conf_free_rsets(struct sptlrpc_conf *conf)
 556 {
 557         struct sptlrpc_conf_tgt *conf_tgt, *conf_tgt_next;
 558
 559         sptlrpc_rule_set_free(&conf->sc_rset);
 560
 561         cfs_list_for_each_entry_safe(conf_tgt, conf_tgt_next,
 562                                      &conf->sc_tgts, sct_list) {
 563                 sptlrpc_rule_set_free(&conf_tgt->sct_rset);
 564                 cfs_list_del(&conf_tgt->sct_list);
 565                 OBD_FREE_PTR(conf_tgt);
 566         }
 567         LASSERT(cfs_list_empty(&conf->sc_tgts));
 568
 569         conf->sc_updated = 0;
 570         conf->sc_local = 0;
 571 }
 572
 573 static void sptlrpc_conf_free(struct sptlrpc_conf *conf)
 574 {
 575         CDEBUG(D_SEC, "free sptlrpc conf %s\n", conf->sc_fsname);
 576
 577         sptlrpc_conf_free_rsets(conf);
 578         cfs_list_del(&conf->sc_list);
 579         OBD_FREE_PTR(conf);
 580 }
 581
 582 static
 583 struct sptlrpc_conf_tgt *sptlrpc_conf_get_tgt(struct sptlrpc_conf *conf,
 584                                               const char *name,
 585                                               int create)
 586 {
 587         struct sptlrpc_conf_tgt *conf_tgt;
 588
 589         cfs_list_for_each_entry(conf_tgt, &conf->sc_tgts, sct_list) {
 590                 if (strcmp(conf_tgt->sct_name, name) == 0)
 591                         return conf_tgt;
 592         }
 593
 594         if (!create)
 595                 return NULL;
 596
 597         OBD_ALLOC_PTR(conf_tgt);
 598         if (conf_tgt) {
 599                 strncpy(conf_tgt->sct_name, name, sizeof(conf_tgt->sct_name));
 600                 sptlrpc_rule_set_init(&conf_tgt->sct_rset);
 601                 cfs_list_add(&conf_tgt->sct_list, &conf->sc_tgts);
 602         }
 603
 604         return conf_tgt;
 605 }
 606
 607 static
 608 struct sptlrpc_conf *sptlrpc_conf_get(const char *fsname,
 609                                       int create)
 610 {
 611         struct sptlrpc_conf *conf;
 612
 613         cfs_list_for_each_entry(conf, &sptlrpc_confs, sc_list) {
 614                 if (strcmp(conf->sc_fsname, fsname) == 0)
 615                         return conf;
 616         }
 617
 618         if (!create)
 619                 return NULL;
 620
 621         OBD_ALLOC_PTR(conf);
 622         if (conf == NULL)
 623                 return NULL;
 624
 625         strcpy(conf->sc_fsname, fsname);
 626         sptlrpc_rule_set_init(&conf->sc_rset);
 627         CFS_INIT_LIST_HEAD(&conf->sc_tgts);
 628         cfs_list_add(&conf->sc_list, &sptlrpc_confs);
 629
 630         CDEBUG(D_SEC, "create sptlrpc conf %s\n", conf->sc_fsname);
 631         return conf;
 632 }
 633
 634 /**
 635  * caller must hold conf_lock already.
 636  */
 637 static int sptlrpc_conf_merge_rule(struct sptlrpc_conf *conf,
 638                                    const char *target,
 639                                    struct sptlrpc_rule *rule)
 640 {
 641         struct sptlrpc_conf_tgt  *conf_tgt;
 642         struct sptlrpc_rule_set  *rule_set;
 643
 644         /* fsname == target means general rules for the whole fs */
 645         if (strcmp(conf->sc_fsname, target) == 0) {
 646                 rule_set = &conf->sc_rset;
 647         } else {
 648                 conf_tgt = sptlrpc_conf_get_tgt(conf, target, 1);
 649                 if (conf_tgt) {
 650                         rule_set = &conf_tgt->sct_rset;
 651                 } else {
 652                         CERROR("out of memory, can't merge rule!\n");
 653                         return -ENOMEM;
 654                 }
 655         }
 656
 657         return sptlrpc_rule_set_merge(rule_set, rule);
 658 }
 659
 660 /**
 661  * process one LCFG_SPTLRPC_CONF record. if \a conf is NULL, we
 662  * find one through the target name in the record inside conf_lock;
 663  * otherwise means caller already hold conf_lock.
 664  */
 665 static int __sptlrpc_process_config(struct lustre_cfg *lcfg,
 666                                     struct sptlrpc_conf *conf)
 667 {
 668         char                   *target, *param;
 669         char                    fsname[MTI_NAME_MAXLEN];
 670         struct sptlrpc_rule     rule;
 671         int                     rc;
 672         ENTRY;
 673
 674         target = lustre_cfg_string(lcfg, 1);
 675         if (target == NULL) {
 676                 CERROR("missing target name\n");
 677                 RETURN(-EINVAL);
 678         }
 679
 680         param = lustre_cfg_string(lcfg, 2);
 681         if (param == NULL) {
 682                 CERROR("missing parameter\n");
 683                 RETURN(-EINVAL);
 684         }
 685
 686         CDEBUG(D_SEC, "processing rule: %s.%s\n", target, param);
 687
 688         /* parse rule to make sure the format is correct */
 689         if (strncmp(param, PARAM_SRPC_FLVR, sizeof(PARAM_SRPC_FLVR) - 1) != 0) {
 690                 CERROR("Invalid sptlrpc parameter: %s\n", param);
 691                 RETURN(-EINVAL);
 692         }
 693         param += sizeof(PARAM_SRPC_FLVR) - 1;
 694
 695         rc = sptlrpc_parse_rule(param, &rule);
 696         if (rc)
 697                 RETURN(-EINVAL);
 698
 699         if (conf == NULL) {
 700                 target2fsname(target, fsname, sizeof(fsname));
 701
 702                 cfs_mutex_lock(&sptlrpc_conf_lock);
 703                 conf = sptlrpc_conf_get(fsname, 0);
 704                 if (conf == NULL) {
 705                         CERROR("can't find conf\n");
 706                         rc = -ENOMEM;
 707                 } else {
 708                         rc = sptlrpc_conf_merge_rule(conf, target, &rule);
 709                 }
 710                 cfs_mutex_unlock(&sptlrpc_conf_lock);
 711         } else {
 712                 LASSERT(cfs_mutex_is_locked(&sptlrpc_conf_lock));
 713                 rc = sptlrpc_conf_merge_rule(conf, target, &rule);
 714         }
 715
 716         if (rc == 0)
 717                 conf->sc_modified++;
 718
 719         RETURN(rc);
 720 }
 721
 722 int sptlrpc_process_config(struct lustre_cfg *lcfg)
 723 {
 724         return __sptlrpc_process_config(lcfg, NULL);
 725 }
 726 EXPORT_SYMBOL(sptlrpc_process_config);
 727
 728 static int logname2fsname(const char *logname, char *buf, int buflen)
 729 {
 730         char   *ptr;
 731         int     len;
 732
 733         ptr = strrchr(logname, '-');
 734         if (ptr == NULL || strcmp(ptr, "-sptlrpc")) {
 735                 CERROR("%s is not a sptlrpc config log\n", logname);
 736                 return -EINVAL;
 737         }
 738
 739         len = min((int) (ptr - logname), buflen - 1);
 740
 741         memcpy(buf, logname, len);
 742         buf[len] = '\0';
 743         return 0;
 744 }
 745
 746 void sptlrpc_conf_log_update_begin(const char *logname)
 747 {
 748         struct sptlrpc_conf *conf;
 749         char                 fsname[16];
 750
 751         if (logname2fsname(logname, fsname, sizeof(fsname)))
 752                 return;
 753
 754         cfs_mutex_lock(&sptlrpc_conf_lock);
 755
 756         conf = sptlrpc_conf_get(fsname, 0);
 757         if (conf && conf->sc_local) {
 758                 LASSERT(conf->sc_updated == 0);
 759                 sptlrpc_conf_free_rsets(conf);
 760         }
 761         conf->sc_modified = 0;
 762
 763         cfs_mutex_unlock(&sptlrpc_conf_lock);
 764 }
 765 EXPORT_SYMBOL(sptlrpc_conf_log_update_begin);
 766
 767 /**
 768  * mark a config log has been updated
 769  */
 770 void sptlrpc_conf_log_update_end(const char *logname)
 771 {
 772         struct sptlrpc_conf *conf;
 773         char                 fsname[16];
 774
 775         if (logname2fsname(logname, fsname, sizeof(fsname)))
 776                 return;
 777
 778         cfs_mutex_lock(&sptlrpc_conf_lock);
 779
 780         conf = sptlrpc_conf_get(fsname, 0);
 781         if (conf) {
 782                 /*
 783                  * if original state is not updated, make sure the
 784                  * modified counter > 0 to enforce updating local copy.
 785                  */
 786                 if (conf->sc_updated == 0)
 787                         conf->sc_modified++;
 788
 789                 conf->sc_updated = 1;
 790         }
 791
 792         cfs_mutex_unlock(&sptlrpc_conf_lock);
 793 }
 794 EXPORT_SYMBOL(sptlrpc_conf_log_update_end);
 795
 796 void sptlrpc_conf_log_start(const char *logname)
 797 {
 798         struct sptlrpc_conf *conf;
 799         char                 fsname[16];
 800
 801         if (logname2fsname(logname, fsname, sizeof(fsname)))
 802                 return;
 803
 804         cfs_mutex_lock(&sptlrpc_conf_lock);
 805         conf = sptlrpc_conf_get(fsname, 1);
 806         cfs_mutex_unlock(&sptlrpc_conf_lock);
 807 }
 808 EXPORT_SYMBOL(sptlrpc_conf_log_start);
 809
 810 void sptlrpc_conf_log_stop(const char *logname)
 811 {
 812         struct sptlrpc_conf *conf;
 813         char                 fsname[16];
 814
 815         if (logname2fsname(logname, fsname, sizeof(fsname)))
 816                 return;
 817
 818         cfs_mutex_lock(&sptlrpc_conf_lock);
 819         conf = sptlrpc_conf_get(fsname, 0);
 820         if (conf)
 821                 sptlrpc_conf_free(conf);
 822         cfs_mutex_unlock(&sptlrpc_conf_lock);
 823 }
 824 EXPORT_SYMBOL(sptlrpc_conf_log_stop);
 825
 826 static void inline flavor_set_flags(struct sptlrpc_flavor *sf,
 827                                     enum lustre_sec_part from,
 828                                     enum lustre_sec_part to,
 829                                     unsigned int fl_udesc)
 830 {
 831         /*
 832          * null flavor doesn't need to set any flavor, and in fact
 833          * we'd better not do that because everybody share a single sec.
 834          */
 835         if (sf->sf_rpc == SPTLRPC_FLVR_NULL)
 836                 return;
 837
 838         if (from == LUSTRE_SP_MDT) {
 839                 /* MDT->MDT; MDT->OST */
 840                 sf->sf_flags |= PTLRPC_SEC_FL_ROOTONLY;
 841         } else if (from == LUSTRE_SP_CLI && to == LUSTRE_SP_OST) {
 842                 /* CLI->OST */
 843                 sf->sf_flags |= PTLRPC_SEC_FL_ROOTONLY | PTLRPC_SEC_FL_BULK;
 844         } else if (from == LUSTRE_SP_CLI && to == LUSTRE_SP_MDT) {
 845                 /* CLI->MDT */
 846                 if (fl_udesc && sf->sf_rpc != SPTLRPC_FLVR_NULL)
 847                         sf->sf_flags |= PTLRPC_SEC_FL_UDESC;
 848         }
 849 }
 850
 851 void sptlrpc_conf_choose_flavor(enum lustre_sec_part from,
 852                                 enum lustre_sec_part to,
 853                                 struct obd_uuid *target,
 854                                 lnet_nid_t nid,
 855                                 struct sptlrpc_flavor *sf)
 856 {
 857         struct sptlrpc_conf     *conf;
 858         struct sptlrpc_conf_tgt *conf_tgt;
 859         char                     name[MTI_NAME_MAXLEN];
 860         int                      len, rc = 0;
 861
 862         target2fsname(target->uuid, name, sizeof(name));
 863
 864         cfs_mutex_lock(&sptlrpc_conf_lock);
 865
 866         conf = sptlrpc_conf_get(name, 0);
 867         if (conf == NULL)
 868                 goto out;
 869
 870         /* convert uuid name (supposed end with _UUID) to target name */
 871         len = strlen(target->uuid);
 872         LASSERT(len > 5);
 873         memcpy(name, target->uuid, len - 5);
 874         name[len - 5] = '\0';
 875
 876         conf_tgt = sptlrpc_conf_get_tgt(conf, name, 0);
 877         if (conf_tgt) {
 878                 rc = sptlrpc_rule_set_choose(&conf_tgt->sct_rset,
 879                                              from, to, nid, sf);
 880                 if (rc)
 881                         goto out;
 882         }
 883
 884         rc = sptlrpc_rule_set_choose(&conf->sc_rset, from, to, nid, sf);
 885 out:
 886         cfs_mutex_unlock(&sptlrpc_conf_lock);
 887
 888         if (rc == 0)
 889                 get_default_flavor(sf);
 890
 891         flavor_set_flags(sf, from, to, 1);
 892 }
 893
 894 /**
 895  * called by target devices, determine the expected flavor from
 896  * certain peer (from, nid).
 897  */
 898 void sptlrpc_target_choose_flavor(struct sptlrpc_rule_set *rset,
 899                                   enum lustre_sec_part from,
 900                                   lnet_nid_t nid,
 901                                   struct sptlrpc_flavor *sf)
 902 {
 903         if (sptlrpc_rule_set_choose(rset, from, LUSTRE_SP_ANY, nid, sf) == 0)
 904                 get_default_flavor(sf);
 905 }
 906 EXPORT_SYMBOL(sptlrpc_target_choose_flavor);
 907
 908 #define SEC_ADAPT_DELAY         (10)
 909
 910 /**
 911  * called by client devices, notify the sptlrpc config has changed and
 912  * do import_sec_adapt later.
 913  */
 914 void sptlrpc_conf_client_adapt(struct obd_device *obd)
 915 {
 916         struct obd_import  *imp;
 917         ENTRY;
 918
 919         LASSERT(strcmp(obd->obd_type->typ_name, LUSTRE_MDC_NAME) == 0 ||
 920                 strcmp(obd->obd_type->typ_name, LUSTRE_OSC_NAME) ==0);
 921         CDEBUG(D_SEC, "obd %s\n", obd->u.cli.cl_target_uuid.uuid);
 922
 923         /* serialize with connect/disconnect import */
 924         cfs_down_read(&obd->u.cli.cl_sem);
 925
 926         imp = obd->u.cli.cl_import;
 927         if (imp) {
 928                 cfs_spin_lock(&imp->imp_lock);
 929                 if (imp->imp_sec)
 930                         imp->imp_sec_expire = cfs_time_current_sec() +
 931                                               SEC_ADAPT_DELAY;
 932                 cfs_spin_unlock(&imp->imp_lock);
 933         }
 934
 935         cfs_up_read(&obd->u.cli.cl_sem);
 936         EXIT;
 937 }
 938 EXPORT_SYMBOL(sptlrpc_conf_client_adapt);
 939
 940 #ifdef __KERNEL__
 941
 942 static void rule2string(struct sptlrpc_rule *r, char *buf, int buflen)
 943 {
 944         char    dirbuf[8];
 945         char   *net;
 946         char   *ptr = buf;
 947
 948         if (r->sr_netid == LNET_NIDNET(LNET_NID_ANY))
 949                 net = "default";
 950         else
 951                 net = libcfs_net2str(r->sr_netid);
 952
 953         if (r->sr_from == LUSTRE_SP_ANY && r->sr_to == LUSTRE_SP_ANY)
 954                 dirbuf[0] = '\0';
 955         else
 956                 snprintf(dirbuf, sizeof(dirbuf), ".%s2%s",
 957                          sptlrpc_part2name(r->sr_from),
 958                          sptlrpc_part2name(r->sr_to));
 959
 960         ptr += snprintf(buf, buflen, "srpc.flavor.%s%s=", net, dirbuf);
 961
 962         sptlrpc_flavor2name(&r->sr_flvr, ptr, buflen - (ptr - buf));
 963         buf[buflen - 1] = '\0';
 964 }
 965
 966 static int sptlrpc_record_rule_set(struct llog_handle *llh,
 967                                    char *target,
 968                                    struct sptlrpc_rule_set *rset)
 969 {
 970         struct lustre_cfg_bufs  bufs;
 971         struct lustre_cfg      *lcfg;
 972         struct llog_rec_hdr     rec;
 973         int                     buflen;
 974         char                    param[48];
 975         int                     i, rc;
 976
 977         for (i = 0; i < rset->srs_nrule; i++) {
 978                 rule2string(&rset->srs_rules[i], param, sizeof(param));
 979
 980                 lustre_cfg_bufs_reset(&bufs, NULL);
 981                 lustre_cfg_bufs_set_string(&bufs, 1, target);
 982                 lustre_cfg_bufs_set_string(&bufs, 2, param);
 983                 lcfg = lustre_cfg_new(LCFG_SPTLRPC_CONF, &bufs);
 984                 LASSERT(lcfg);
 985
 986                 buflen = lustre_cfg_len(lcfg->lcfg_bufcount,
 987                                         lcfg->lcfg_buflens);
 988                 rec.lrh_len = llog_data_len(buflen);
 989                 rec.lrh_type = OBD_CFG_REC;
 990                 rc = llog_write_rec(llh, &rec, NULL, 0, (void *)lcfg, -1);
 991                 if (rc)
 992                         CERROR("failed to write a rec: rc = %d\n", rc);
 993                 lustre_cfg_free(lcfg);
 994         }
 995         return 0;
 996 }
 997
 998 static int sptlrpc_record_rules(struct llog_handle *llh,
 999                                 struct sptlrpc_conf *conf)
1000 {
1001         struct sptlrpc_conf_tgt *conf_tgt;
1002
1003         sptlrpc_record_rule_set(llh, conf->sc_fsname, &conf->sc_rset);
1004
1005         cfs_list_for_each_entry(conf_tgt, &conf->sc_tgts, sct_list) {
1006                 sptlrpc_record_rule_set(llh, conf_tgt->sct_name,
1007                                         &conf_tgt->sct_rset);
1008         }
1009         return 0;
1010 }
1011
1012 #define LOG_SPTLRPC_TMP "sptlrpc.tmp"
1013 #define LOG_SPTLRPC     "sptlrpc"
1014
1015 static
1016 int sptlrpc_target_local_copy_conf(struct obd_device *obd,
1017                                    struct sptlrpc_conf *conf)
1018 {
1019         struct llog_handle   *llh = NULL;
1020         struct llog_ctxt     *ctxt;
1021         struct lvfs_run_ctxt  saved;
1022         struct dentry        *dentry;
1023         int                   rc;
1024         ENTRY;
1025
1026         ctxt = llog_get_context(obd, LLOG_CONFIG_ORIG_CTXT);
1027         if (ctxt == NULL) {
1028                 CERROR("missing llog context\n");
1029                 RETURN(-EINVAL);
1030         }
1031
1032         push_ctxt(&saved, &obd->obd_lvfs_ctxt, NULL);
1033
1034         dentry = lookup_one_len(MOUNT_CONFIGS_DIR, cfs_fs_pwd(current->fs),
1035                                 strlen(MOUNT_CONFIGS_DIR));
1036         if (IS_ERR(dentry)) {
1037                 rc = PTR_ERR(dentry);
1038                 CERROR("cannot lookup %s directory: rc = %d\n",
1039                        MOUNT_CONFIGS_DIR, rc);
1040                 GOTO(out_ctx, rc);
1041         }
1042
1043         /* erase the old tmp log */
1044         rc = llog_create(ctxt, &llh, NULL, LOG_SPTLRPC_TMP);
1045         if (rc == 0) {
1046                 rc = llog_init_handle(llh, LLOG_F_IS_PLAIN, NULL);
1047                 if (rc == 0) {
1048                         rc = llog_destroy(llh);
1049                         llog_free_handle(llh);
1050                 } else {
1051                         llog_close(llh);
1052                 }
1053         }
1054
1055         if (rc) {
1056                 CERROR("target %s: cannot erase temporary sptlrpc log: "
1057                        "rc = %d\n", obd->obd_name, rc);
1058                 GOTO(out_dput, rc);
1059         }
1060
1061         /* write temporary log */
1062         rc = llog_create(ctxt, &llh, NULL, LOG_SPTLRPC_TMP);
1063         if (rc)
1064                 GOTO(out_dput, rc);
1065         rc = llog_init_handle(llh, LLOG_F_IS_PLAIN, NULL);
1066         if (rc)
1067                 GOTO(out_close, rc);
1068
1069         rc = sptlrpc_record_rules(llh, conf);
1070
1071 out_close:
1072         llog_close(llh);
1073
1074         if (rc == 0) {
1075                 rc = lustre_rename(dentry, obd->obd_lvfs_ctxt.pwdmnt,
1076                                    LOG_SPTLRPC_TMP, LOG_SPTLRPC);
1077         }
1078
1079 out_dput:
1080         l_dput(dentry);
1081 out_ctx:
1082         pop_ctxt(&saved, &obd->obd_lvfs_ctxt, NULL);
1083         llog_ctxt_put(ctxt);
1084         CDEBUG(D_SEC, "target %s: write local sptlrpc conf: rc = %d\n",
1085                obd->obd_name, rc);
1086         RETURN(rc);
1087 }
1088
1089 static int local_read_handler(struct llog_handle *llh,
1090                               struct llog_rec_hdr *rec,
1091                               void *data)
1092 {
1093         struct sptlrpc_conf  *conf = (struct sptlrpc_conf *) data;
1094         struct lustre_cfg    *lcfg = (struct lustre_cfg *)(rec + 1);
1095         int                   cfg_len, rc;
1096         ENTRY;
1097
1098         if (rec->lrh_type != OBD_CFG_REC) {
1099                 CERROR("unhandled lrh_type: %#x\n", rec->lrh_type);
1100                 RETURN(-EINVAL);
1101         }
1102
1103         cfg_len = rec->lrh_len - sizeof(struct llog_rec_hdr) -
1104                   sizeof(struct llog_rec_tail);
1105
1106         rc = lustre_cfg_sanity_check(lcfg, cfg_len);
1107         if (rc) {
1108                 CERROR("Insane cfg\n");
1109                 RETURN(rc);
1110         }
1111
1112         if (lcfg->lcfg_command != LCFG_SPTLRPC_CONF) {
1113                 CERROR("invalid command (%x)\n", lcfg->lcfg_command);
1114                 RETURN(-EINVAL);
1115         }
1116
1117         RETURN(__sptlrpc_process_config(lcfg, conf));
1118 }
1119
1120 static
1121 int sptlrpc_target_local_read_conf(struct obd_device *obd,
1122                                    struct sptlrpc_conf *conf)
1123 {
1124         struct llog_handle    *llh = NULL;
1125         struct llog_ctxt      *ctxt;
1126         struct lvfs_run_ctxt   saved;
1127         int                    rc;
1128         ENTRY;
1129
1130         LASSERT(conf->sc_updated == 0 && conf->sc_local == 0);
1131
1132         ctxt = llog_get_context(obd, LLOG_CONFIG_ORIG_CTXT);
1133         if (ctxt == NULL) {
1134                 CERROR("missing llog context\n");
1135                 RETURN(-EINVAL);
1136         }
1137
1138         push_ctxt(&saved, &obd->obd_lvfs_ctxt, NULL);
1139
1140         rc = llog_create(ctxt, &llh, NULL, LOG_SPTLRPC);
1141         if (rc)
1142                 GOTO(out_pop, rc);
1143
1144         rc = llog_init_handle(llh, LLOG_F_IS_PLAIN, NULL);
1145         if (rc)
1146                 GOTO(out_close, rc);
1147
1148         if (llog_get_size(llh) <= 1) {
1149                 CDEBUG(D_SEC, "no local sptlrpc copy found\n");
1150                 GOTO(out_close, rc = 0);
1151         }
1152
1153         rc = llog_process(llh, local_read_handler, (void *) conf, NULL);
1154
1155         if (rc == 0) {
1156                 conf->sc_local = 1;
1157         } else {
1158                 sptlrpc_conf_free_rsets(conf);
1159         }
1160
1161 out_close:
1162         llog_close(llh);
1163 out_pop:
1164         pop_ctxt(&saved, &obd->obd_lvfs_ctxt, NULL);
1165         llog_ctxt_put(ctxt);
1166         CDEBUG(D_SEC, "target %s: read local sptlrpc conf: rc = %d\n",
1167                obd->obd_name, rc);
1168         RETURN(rc);
1169 }
1170
1171 #endif /* __KRENEL__ */
1172
1173 /**
1174  * called by target devices, extract sptlrpc rules which applies to
1175  * this target, to be used for future rpc flavor checking.
1176  */
1177 int sptlrpc_conf_target_get_rules(struct obd_device *obd,
1178                                   struct sptlrpc_rule_set *rset,
1179                                   int initial)
1180 {
1181         struct sptlrpc_conf      *conf;
1182         struct sptlrpc_conf_tgt  *conf_tgt;
1183         enum lustre_sec_part      sp_dst;
1184         char                      fsname[MTI_NAME_MAXLEN];
1185         int                       rc = 0;
1186         ENTRY;
1187
1188         if (strcmp(obd->obd_type->typ_name, LUSTRE_MDT_NAME) == 0) {
1189                 sp_dst = LUSTRE_SP_MDT;
1190         } else if (strcmp(obd->obd_type->typ_name, LUSTRE_OST_NAME) == 0) {
1191                 sp_dst = LUSTRE_SP_OST;
1192         } else {
1193                 CERROR("unexpected obd type %s\n", obd->obd_type->typ_name);
1194                 RETURN(-EINVAL);
1195         }
1196         CDEBUG(D_SEC, "get rules for target %s\n", obd->obd_uuid.uuid);
1197
1198         target2fsname(obd->obd_uuid.uuid, fsname, sizeof(fsname));
1199
1200         cfs_mutex_lock(&sptlrpc_conf_lock);
1201
1202         conf = sptlrpc_conf_get(fsname, 0);
1203         if (conf == NULL) {
1204                 CERROR("missing sptlrpc config log\n");
1205                 GOTO(out, rc);
1206         }
1207
1208 #ifdef __KERNEL__
1209         if (conf->sc_updated  == 0) {
1210                 /*
1211                  * always read from local copy. here another option is
1212                  * if we already have a local copy (read from another
1213                  * target device hosted on the same node) we simply use that.
1214                  */
1215                 if (conf->sc_local)
1216                         sptlrpc_conf_free_rsets(conf);
1217
1218                 sptlrpc_target_local_read_conf(obd, conf);
1219         } else {
1220                 LASSERT(conf->sc_local == 0);
1221
1222                 /* write a local copy */
1223                 if (initial || conf->sc_modified)
1224                         sptlrpc_target_local_copy_conf(obd, conf);
1225                 else
1226                         CDEBUG(D_SEC, "unchanged, skip updating local copy\n");
1227         }
1228 #endif
1229
1230         /* extract rule set for this target */
1231         conf_tgt = sptlrpc_conf_get_tgt(conf, obd->obd_name, 0);
1232
1233         rc = sptlrpc_rule_set_extract(&conf->sc_rset,
1234                                       conf_tgt ? &conf_tgt->sct_rset: NULL,
1235                                       LUSTRE_SP_ANY, sp_dst, rset);
1236 out:
1237         cfs_mutex_unlock(&sptlrpc_conf_lock);
1238         RETURN(rc);
1239 }
1240 EXPORT_SYMBOL(sptlrpc_conf_target_get_rules);
1241
1242 int  sptlrpc_conf_init(void)
1243 {
1244         cfs_mutex_init(&sptlrpc_conf_lock);
1245         return 0;
1246 }
1247
1248 void sptlrpc_conf_fini(void)
1249 {
1250         struct sptlrpc_conf  *conf, *conf_next;
1251
1252         cfs_mutex_lock(&sptlrpc_conf_lock);
1253         cfs_list_for_each_entry_safe(conf, conf_next, &sptlrpc_confs, sc_list) {
1254                 sptlrpc_conf_free(conf);
1255         }
1256         LASSERT(cfs_list_empty(&sptlrpc_confs));
1257         cfs_mutex_unlock(&sptlrpc_conf_lock);
1258 }