lustre/ptlrpc/sec_config.c

   1 /*
   2  * GPL HEADER START
   3  *
   4  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 only,
   8  * as published by the Free Software Foundation.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13  * General Public License version 2 for more details (a copy is included
  14  * in the LICENSE file that accompanied this code).
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * version 2 along with this program; If not, see
  18  * http://www.sun.com/software/products/lustre/docs/GPLv2.pdf
  19  *
  20  * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
  21  * CA 95054 USA or visit www.sun.com if you need additional information or
  22  * have any questions.
  23  *
  24  * GPL HEADER END
  25  */
  26 /*
  27  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
  28  * Use is subject to license terms.
  29  *
  30  * Copyright (c) 2011, 2012, Intel Corporation.
  31  */
  32 /*
  33  * This file is part of Lustre, http://www.lustre.org/
  34  * Lustre is a trademark of Sun Microsystems, Inc.
  35  */
  36
  37 #define DEBUG_SUBSYSTEM S_SEC
  38
  39 #include <libcfs/libcfs.h>
  40 #ifndef __KERNEL__
  41 #include <liblustre.h>
  42 #include <libcfs/list.h>
  43 #else
  44 #include <linux/crypto.h>
  45 #include <linux/key.h>
  46 #endif
  47
  48 #include <obd.h>
  49 #include <obd_class.h>
  50 #include <obd_support.h>
  51 #include <lustre_net.h>
  52 #include <lustre_import.h>
  53 #include <lustre_log.h>
  54 #include <lustre_disk.h>
  55 #include <lustre_dlm.h>
  56 #include <lustre_param.h>
  57 #include <lustre_sec.h>
  58
  59 #include "ptlrpc_internal.h"
  60
  61 const char *sptlrpc_part2name(enum lustre_sec_part part)
  62 {
  63         switch (part) {
  64         case LUSTRE_SP_CLI:
  65                 return "cli";
  66         case LUSTRE_SP_MDT:
  67                 return "mdt";
  68         case LUSTRE_SP_OST:
  69                 return "ost";
  70         case LUSTRE_SP_MGC:
  71                 return "mgc";
  72         case LUSTRE_SP_MGS:
  73                 return "mgs";
  74         case LUSTRE_SP_ANY:
  75                 return "any";
  76         default:
  77                 return "err";
  78         }
  79 }
  80 EXPORT_SYMBOL(sptlrpc_part2name);
  81
  82 enum lustre_sec_part sptlrpc_target_sec_part(struct obd_device *obd)
  83 {
  84         const char *type = obd->obd_type->typ_name;
  85
  86         if (!strcmp(type, LUSTRE_MDT_NAME))
  87                 return LUSTRE_SP_MDT;
  88         if (!strcmp(type, LUSTRE_OST_NAME))
  89                 return LUSTRE_SP_OST;
  90         if (!strcmp(type, LUSTRE_MGS_NAME))
  91                 return LUSTRE_SP_MGS;
  92
  93         CERROR("unknown target %p(%s)\n", obd, type);
  94         return LUSTRE_SP_ANY;
  95 }
  96 EXPORT_SYMBOL(sptlrpc_target_sec_part);
  97
  98 /****************************************
  99  * user supplied flavor string parsing  *
 100  ****************************************/
 101
 102 /*
 103  * format: <base_flavor>[-<bulk_type:alg_spec>]
 104  */
 105 int sptlrpc_parse_flavor(const char *str, struct sptlrpc_flavor *flvr)
 106 {
 107         char            buf[32];
 108         char           *bulk, *alg;
 109
 110         memset(flvr, 0, sizeof(*flvr));
 111
 112         if (str == NULL || str[0] == '\0') {
 113                 flvr->sf_rpc = SPTLRPC_FLVR_INVALID;
 114                 return 0;
 115         }
 116
 117         strlcpy(buf, str, sizeof(buf));
 118
 119         bulk = strchr(buf, '-');
 120         if (bulk)
 121                 *bulk++ = '\0';
 122
 123         flvr->sf_rpc = sptlrpc_name2flavor_base(buf);
 124         if (flvr->sf_rpc == SPTLRPC_FLVR_INVALID)
 125                 goto err_out;
 126
 127         /*
 128          * currently only base flavor "plain" can have bulk specification.
 129          */
 130         if (flvr->sf_rpc == SPTLRPC_FLVR_PLAIN) {
 131                 flvr->u_bulk.hash.hash_alg = BULK_HASH_ALG_ADLER32;
 132                 if (bulk) {
 133                         /*
 134                          * format: plain-hash:<hash_alg>
 135                          */
 136                         alg = strchr(bulk, ':');
 137                         if (alg == NULL)
 138                                 goto err_out;
 139                         *alg++ = '\0';
 140
 141                         if (strcmp(bulk, "hash"))
 142                                 goto err_out;
 143
 144                         flvr->u_bulk.hash.hash_alg = sptlrpc_get_hash_alg(alg);
 145                         if (flvr->u_bulk.hash.hash_alg >= BULK_HASH_ALG_MAX)
 146                                 goto err_out;
 147                 }
 148
 149                 if (flvr->u_bulk.hash.hash_alg == BULK_HASH_ALG_NULL)
 150                         flvr_set_bulk_svc(&flvr->sf_rpc, SPTLRPC_BULK_SVC_NULL);
 151                 else
 152                         flvr_set_bulk_svc(&flvr->sf_rpc, SPTLRPC_BULK_SVC_INTG);
 153         } else {
 154                 if (bulk)
 155                         goto err_out;
 156         }
 157
 158         flvr->sf_flags = 0;
 159         return 0;
 160
 161 err_out:
 162         CERROR("invalid flavor string: %s\n", str);
 163         return -EINVAL;
 164 }
 165 EXPORT_SYMBOL(sptlrpc_parse_flavor);
 166
 167 /****************************************
 168  * configure rules                      *
 169  ****************************************/
 170
 171 static void get_default_flavor(struct sptlrpc_flavor *sf)
 172 {
 173         memset(sf, 0, sizeof(*sf));
 174
 175         sf->sf_rpc = SPTLRPC_FLVR_NULL;
 176         sf->sf_flags = 0;
 177 }
 178
 179 static void sptlrpc_rule_init(struct sptlrpc_rule *rule)
 180 {
 181         rule->sr_netid = LNET_NIDNET(LNET_NID_ANY);
 182         rule->sr_from = LUSTRE_SP_ANY;
 183         rule->sr_to = LUSTRE_SP_ANY;
 184         rule->sr_padding = 0;
 185
 186         get_default_flavor(&rule->sr_flvr);
 187 }
 188
 189 /*
 190  * format: network[.direction]=flavor
 191  */
 192 int sptlrpc_parse_rule(char *param, struct sptlrpc_rule *rule)
 193 {
 194         char           *flavor, *dir;
 195         int             rc;
 196
 197         sptlrpc_rule_init(rule);
 198
 199         flavor = strchr(param, '=');
 200         if (flavor == NULL) {
 201                 CERROR("invalid param, no '='\n");
 202                 RETURN(-EINVAL);
 203         }
 204         *flavor++ = '\0';
 205
 206         dir = strchr(param, '.');
 207         if (dir)
 208                 *dir++ = '\0';
 209
 210         /* 1.1 network */
 211         if (strcmp(param, "default")) {
 212                 rule->sr_netid = libcfs_str2net(param);
 213                 if (rule->sr_netid == LNET_NIDNET(LNET_NID_ANY)) {
 214                         CERROR("invalid network name: %s\n", param);
 215                         RETURN(-EINVAL);
 216                 }
 217         }
 218
 219         /* 1.2 direction */
 220         if (dir) {
 221                 if (!strcmp(dir, "mdt2ost")) {
 222                         rule->sr_from = LUSTRE_SP_MDT;
 223                         rule->sr_to = LUSTRE_SP_OST;
 224                 } else if (!strcmp(dir, "mdt2mdt")) {
 225                         rule->sr_from = LUSTRE_SP_MDT;
 226                         rule->sr_to = LUSTRE_SP_MDT;
 227                 } else if (!strcmp(dir, "cli2ost")) {
 228                         rule->sr_from = LUSTRE_SP_CLI;
 229                         rule->sr_to = LUSTRE_SP_OST;
 230                 } else if (!strcmp(dir, "cli2mdt")) {
 231                         rule->sr_from = LUSTRE_SP_CLI;
 232                         rule->sr_to = LUSTRE_SP_MDT;
 233                 } else {
 234                         CERROR("invalid rule dir segment: %s\n", dir);
 235                         RETURN(-EINVAL);
 236                 }
 237         }
 238
 239         /* 2.1 flavor */
 240         rc = sptlrpc_parse_flavor(flavor, &rule->sr_flvr);
 241         if (rc)
 242                 RETURN(-EINVAL);
 243
 244         RETURN(0);
 245 }
 246 EXPORT_SYMBOL(sptlrpc_parse_rule);
 247
 248 void sptlrpc_rule_set_free(struct sptlrpc_rule_set *rset)
 249 {
 250         LASSERT(rset->srs_nslot ||
 251                 (rset->srs_nrule == 0 && rset->srs_rules == NULL));
 252
 253         if (rset->srs_nslot) {
 254                 OBD_FREE(rset->srs_rules,
 255                          rset->srs_nslot * sizeof(*rset->srs_rules));
 256                 sptlrpc_rule_set_init(rset);
 257         }
 258 }
 259 EXPORT_SYMBOL(sptlrpc_rule_set_free);
 260
 261 /*
 262  * return 0 if the rule set could accomodate one more rule.
 263  */
 264 int sptlrpc_rule_set_expand(struct sptlrpc_rule_set *rset)
 265 {
 266         struct sptlrpc_rule *rules;
 267         int nslot;
 268
 269         might_sleep();
 270
 271         if (rset->srs_nrule < rset->srs_nslot)
 272                 return 0;
 273
 274         nslot = rset->srs_nslot + 8;
 275
 276         /* better use realloc() if available */
 277         OBD_ALLOC(rules, nslot * sizeof(*rset->srs_rules));
 278         if (rules == NULL)
 279                 return -ENOMEM;
 280
 281         if (rset->srs_nrule) {
 282                 LASSERT(rset->srs_nslot && rset->srs_rules);
 283                 memcpy(rules, rset->srs_rules,
 284                        rset->srs_nrule * sizeof(*rset->srs_rules));
 285
 286                 OBD_FREE(rset->srs_rules,
 287                          rset->srs_nslot * sizeof(*rset->srs_rules));
 288         }
 289
 290         rset->srs_rules = rules;
 291         rset->srs_nslot = nslot;
 292         return 0;
 293 }
 294 EXPORT_SYMBOL(sptlrpc_rule_set_expand);
 295
 296 static inline int rule_spec_dir(struct sptlrpc_rule *rule)
 297 {
 298         return (rule->sr_from != LUSTRE_SP_ANY ||
 299                 rule->sr_to != LUSTRE_SP_ANY);
 300 }
 301 static inline int rule_spec_net(struct sptlrpc_rule *rule)
 302 {
 303         return (rule->sr_netid != LNET_NIDNET(LNET_NID_ANY));
 304 }
 305 static inline int rule_match_dir(struct sptlrpc_rule *r1,
 306                                  struct sptlrpc_rule *r2)
 307 {
 308         return (r1->sr_from == r2->sr_from && r1->sr_to == r2->sr_to);
 309 }
 310 static inline int rule_match_net(struct sptlrpc_rule *r1,
 311                                  struct sptlrpc_rule *r2)
 312 {
 313         return (r1->sr_netid == r2->sr_netid);
 314 }
 315
 316 /*
 317  * merge @rule into @rset.
 318  * the @rset slots might be expanded.
 319  */
 320 int sptlrpc_rule_set_merge(struct sptlrpc_rule_set *rset,
 321                            struct sptlrpc_rule *rule)
 322 {
 323         struct sptlrpc_rule      *p = rset->srs_rules;
 324         int                       spec_dir, spec_net;
 325         int                       rc, n, match = 0;
 326
 327         might_sleep();
 328
 329         spec_net = rule_spec_net(rule);
 330         spec_dir = rule_spec_dir(rule);
 331
 332         for (n = 0; n < rset->srs_nrule; n++) {
 333                 p = &rset->srs_rules[n];
 334
 335                 /* test network match, if failed:
 336                  * - spec rule: skip rules which is also spec rule match, until
 337                  *   we hit a wild rule, which means no more chance
 338                  * - wild rule: skip until reach the one which is also wild
 339                  *   and matches
 340                  */
 341                 if (!rule_match_net(p, rule)) {
 342                         if (spec_net) {
 343                                 if (rule_spec_net(p))
 344                                         continue;
 345                                 else
 346                                         break;
 347                         } else {
 348                                 continue;
 349                         }
 350                 }
 351
 352                 /* test dir match, same logic as net matching */
 353                 if (!rule_match_dir(p, rule)) {
 354                         if (spec_dir) {
 355                                 if (rule_spec_dir(p))
 356                                         continue;
 357                                 else
 358                                         break;
 359                         } else {
 360                                 continue;
 361                         }
 362                 }
 363
 364                 /* find a match */
 365                 match = 1;
 366                 break;
 367         }
 368
 369         if (match) {
 370                 LASSERT(n >= 0 && n < rset->srs_nrule);
 371
 372                 if (rule->sr_flvr.sf_rpc == SPTLRPC_FLVR_INVALID) {
 373                         /* remove this rule */
 374                         if (n < rset->srs_nrule - 1)
 375                                 memmove(&rset->srs_rules[n],
 376                                         &rset->srs_rules[n + 1],
 377                                         (rset->srs_nrule - n - 1) *
 378                                         sizeof(*rule));
 379                         rset->srs_nrule--;
 380                 } else {
 381                         /* override the rule */
 382                         memcpy(&rset->srs_rules[n], rule, sizeof(*rule));
 383                 }
 384         } else {
 385                 LASSERT(n >= 0 && n <= rset->srs_nrule);
 386
 387                 if (rule->sr_flvr.sf_rpc != SPTLRPC_FLVR_INVALID) {
 388                         rc = sptlrpc_rule_set_expand(rset);
 389                         if (rc)
 390                                 return rc;
 391
 392                         if (n < rset->srs_nrule)
 393                                 memmove(&rset->srs_rules[n + 1],
 394                                         &rset->srs_rules[n],
 395                                         (rset->srs_nrule - n) * sizeof(*rule));
 396                         memcpy(&rset->srs_rules[n], rule, sizeof(*rule));
 397                         rset->srs_nrule++;
 398                 } else {
 399                         CDEBUG(D_CONFIG, "ignore the unmatched deletion\n");
 400                 }
 401         }
 402
 403         return 0;
 404 }
 405 EXPORT_SYMBOL(sptlrpc_rule_set_merge);
 406
 407 /**
 408  * given from/to/nid, determine a matching flavor in ruleset.
 409  * return 1 if a match found, otherwise return 0.
 410  */
 411 int sptlrpc_rule_set_choose(struct sptlrpc_rule_set *rset,
 412                             enum lustre_sec_part from,
 413                             enum lustre_sec_part to,
 414                             lnet_nid_t nid,
 415                             struct sptlrpc_flavor *sf)
 416 {
 417         struct sptlrpc_rule    *r;
 418         int                     n;
 419
 420         for (n = 0; n < rset->srs_nrule; n++) {
 421                 r = &rset->srs_rules[n];
 422
 423                 if (LNET_NIDNET(nid) != LNET_NIDNET(LNET_NID_ANY) &&
 424                     r->sr_netid != LNET_NIDNET(LNET_NID_ANY) &&
 425                     LNET_NIDNET(nid) != r->sr_netid)
 426                         continue;
 427
 428                 if (from != LUSTRE_SP_ANY && r->sr_from != LUSTRE_SP_ANY &&
 429                     from != r->sr_from)
 430                         continue;
 431
 432                 if (to != LUSTRE_SP_ANY && r->sr_to != LUSTRE_SP_ANY &&
 433                     to != r->sr_to)
 434                         continue;
 435
 436                 *sf = r->sr_flvr;
 437                 return 1;
 438         }
 439
 440         return 0;
 441 }
 442 EXPORT_SYMBOL(sptlrpc_rule_set_choose);
 443
 444 void sptlrpc_rule_set_dump(struct sptlrpc_rule_set *rset)
 445 {
 446         struct sptlrpc_rule *r;
 447         int     n;
 448
 449         for (n = 0; n < rset->srs_nrule; n++) {
 450                 r = &rset->srs_rules[n];
 451                 CDEBUG(D_SEC, "<%02d> from %x to %x, net %x, rpc %x\n", n,
 452                        r->sr_from, r->sr_to, r->sr_netid, r->sr_flvr.sf_rpc);
 453         }
 454 }
 455 EXPORT_SYMBOL(sptlrpc_rule_set_dump);
 456
 457 static int sptlrpc_rule_set_extract(struct sptlrpc_rule_set *gen,
 458                                     struct sptlrpc_rule_set *tgt,
 459                                     enum lustre_sec_part from,
 460                                     enum lustre_sec_part to,
 461                                     struct sptlrpc_rule_set *rset)
 462 {
 463         struct sptlrpc_rule_set *src[2] = { gen, tgt };
 464         struct sptlrpc_rule     *rule;
 465         int                      i, n, rc;
 466
 467         might_sleep();
 468
 469         /* merge general rules firstly, then target-specific rules */
 470         for (i = 0; i < 2; i++) {
 471                 if (src[i] == NULL)
 472                         continue;
 473
 474                 for (n = 0; n < src[i]->srs_nrule; n++) {
 475                         rule = &src[i]->srs_rules[n];
 476
 477                         if (from != LUSTRE_SP_ANY &&
 478                             rule->sr_from != LUSTRE_SP_ANY &&
 479                             rule->sr_from != from)
 480                                 continue;
 481                         if (to != LUSTRE_SP_ANY &&
 482                             rule->sr_to != LUSTRE_SP_ANY &&
 483                             rule->sr_to != to)
 484                                 continue;
 485
 486                         rc = sptlrpc_rule_set_merge(rset, rule);
 487                         if (rc) {
 488                                 CERROR("can't merge: %d\n", rc);
 489                                 return rc;
 490                         }
 491                 }
 492         }
 493
 494         return 0;
 495 }
 496
 497 /**********************************
 498  * sptlrpc configuration support  *
 499  **********************************/
 500
 501 struct sptlrpc_conf_tgt {
 502         struct list_head              sct_list;
 503         char                    sct_name[MAX_OBD_NAME];
 504         struct sptlrpc_rule_set sct_rset;
 505 };
 506
 507 struct sptlrpc_conf {
 508         struct list_head        sc_list;
 509         char                    sc_fsname[MTI_NAME_MAXLEN];
 510         unsigned int            sc_modified;    /* modified during updating */
 511         unsigned int            sc_updated:1,   /* updated copy from MGS */
 512                                 sc_local:1;     /* local copy from target */
 513         struct sptlrpc_rule_set sc_rset;        /* fs general rules */
 514         struct list_head        sc_tgts;        /* target-specific rules */
 515 };
 516
 517 static struct mutex sptlrpc_conf_lock;
 518 static struct list_head sptlrpc_confs;
 519
 520 static inline int is_hex(char c)
 521 {
 522         return ((c >= '0' && c <= '9') ||
 523                 (c >= 'a' && c <= 'f'));
 524 }
 525
 526 static void target2fsname(const char *tgt, char *fsname, int buflen)
 527 {
 528         const char     *ptr;
 529         int             len;
 530
 531         ptr = strrchr(tgt, '-');
 532         if (ptr) {
 533                 if ((strncmp(ptr, "-MDT", 4) != 0 &&
 534                      strncmp(ptr, "-OST", 4) != 0) ||
 535                     !is_hex(ptr[4]) || !is_hex(ptr[5]) ||
 536                     !is_hex(ptr[6]) || !is_hex(ptr[7]))
 537                         ptr = NULL;
 538         }
 539
 540         /* if we didn't find the pattern, treat the whole string as fsname */
 541         if (ptr == NULL)
 542                 len = strlen(tgt);
 543         else
 544                 len = ptr - tgt;
 545
 546         len = min(len, buflen - 1);
 547         memcpy(fsname, tgt, len);
 548         fsname[len] = '\0';
 549 }
 550
 551 static void sptlrpc_conf_free_rsets(struct sptlrpc_conf *conf)
 552 {
 553         struct sptlrpc_conf_tgt *conf_tgt, *conf_tgt_next;
 554
 555         sptlrpc_rule_set_free(&conf->sc_rset);
 556
 557         list_for_each_entry_safe(conf_tgt, conf_tgt_next,
 558                                  &conf->sc_tgts, sct_list) {
 559                 sptlrpc_rule_set_free(&conf_tgt->sct_rset);
 560                 list_del(&conf_tgt->sct_list);
 561                 OBD_FREE_PTR(conf_tgt);
 562         }
 563         LASSERT(list_empty(&conf->sc_tgts));
 564
 565         conf->sc_updated = 0;
 566         conf->sc_local = 0;
 567 }
 568
 569 static void sptlrpc_conf_free(struct sptlrpc_conf *conf)
 570 {
 571         CDEBUG(D_SEC, "free sptlrpc conf %s\n", conf->sc_fsname);
 572
 573         sptlrpc_conf_free_rsets(conf);
 574         list_del(&conf->sc_list);
 575         OBD_FREE_PTR(conf);
 576 }
 577
 578 static
 579 struct sptlrpc_conf_tgt *sptlrpc_conf_get_tgt(struct sptlrpc_conf *conf,
 580                                               const char *name,
 581                                               int create)
 582 {
 583         struct sptlrpc_conf_tgt *conf_tgt;
 584
 585         list_for_each_entry(conf_tgt, &conf->sc_tgts, sct_list) {
 586                 if (strcmp(conf_tgt->sct_name, name) == 0)
 587                         return conf_tgt;
 588         }
 589
 590         if (!create)
 591                 return NULL;
 592
 593         OBD_ALLOC_PTR(conf_tgt);
 594         if (conf_tgt) {
 595                 strlcpy(conf_tgt->sct_name, name, sizeof(conf_tgt->sct_name));
 596                 sptlrpc_rule_set_init(&conf_tgt->sct_rset);
 597                 list_add(&conf_tgt->sct_list, &conf->sc_tgts);
 598         }
 599
 600         return conf_tgt;
 601 }
 602
 603 static
 604 struct sptlrpc_conf *sptlrpc_conf_get(const char *fsname,
 605                                       int create)
 606 {
 607         struct sptlrpc_conf *conf;
 608
 609         list_for_each_entry(conf, &sptlrpc_confs, sc_list) {
 610                 if (strcmp(conf->sc_fsname, fsname) == 0)
 611                         return conf;
 612         }
 613
 614         if (!create)
 615                 return NULL;
 616
 617         OBD_ALLOC_PTR(conf);
 618         if (conf == NULL)
 619                 return NULL;
 620
 621         if (strlcpy(conf->sc_fsname, fsname, sizeof(conf->sc_fsname)) >=
 622             sizeof(conf->sc_fsname)) {
 623                 OBD_FREE_PTR(conf);
 624                 return NULL;
 625         }
 626         sptlrpc_rule_set_init(&conf->sc_rset);
 627         INIT_LIST_HEAD(&conf->sc_tgts);
 628         list_add(&conf->sc_list, &sptlrpc_confs);
 629
 630         CDEBUG(D_SEC, "create sptlrpc conf %s\n", conf->sc_fsname);
 631         return conf;
 632 }
 633
 634 /**
 635  * caller must hold conf_lock already.
 636  */
 637 static int sptlrpc_conf_merge_rule(struct sptlrpc_conf *conf,
 638                                    const char *target,
 639                                    struct sptlrpc_rule *rule)
 640 {
 641         struct sptlrpc_conf_tgt  *conf_tgt;
 642         struct sptlrpc_rule_set  *rule_set;
 643
 644         /* fsname == target means general rules for the whole fs */
 645         if (strcmp(conf->sc_fsname, target) == 0) {
 646                 rule_set = &conf->sc_rset;
 647         } else {
 648                 conf_tgt = sptlrpc_conf_get_tgt(conf, target, 1);
 649                 if (conf_tgt) {
 650                         rule_set = &conf_tgt->sct_rset;
 651                 } else {
 652                         CERROR("out of memory, can't merge rule!\n");
 653                         return -ENOMEM;
 654                 }
 655         }
 656
 657         return sptlrpc_rule_set_merge(rule_set, rule);
 658 }
 659
 660 /**
 661  * process one LCFG_SPTLRPC_CONF record. if \a conf is NULL, we
 662  * find one through the target name in the record inside conf_lock;
 663  * otherwise means caller already hold conf_lock.
 664  */
 665 static int __sptlrpc_process_config(struct lustre_cfg *lcfg,
 666                                     struct sptlrpc_conf *conf)
 667 {
 668         char                   *target, *param;
 669         char                    fsname[MTI_NAME_MAXLEN];
 670         struct sptlrpc_rule     rule;
 671         int                     rc;
 672         ENTRY;
 673
 674         target = lustre_cfg_string(lcfg, 1);
 675         if (target == NULL) {
 676                 CERROR("missing target name\n");
 677                 RETURN(-EINVAL);
 678         }
 679
 680         param = lustre_cfg_string(lcfg, 2);
 681         if (param == NULL) {
 682                 CERROR("missing parameter\n");
 683                 RETURN(-EINVAL);
 684         }
 685
 686         CDEBUG(D_SEC, "processing rule: %s.%s\n", target, param);
 687
 688         /* parse rule to make sure the format is correct */
 689         if (strncmp(param, PARAM_SRPC_FLVR, sizeof(PARAM_SRPC_FLVR) - 1) != 0) {
 690                 CERROR("Invalid sptlrpc parameter: %s\n", param);
 691                 RETURN(-EINVAL);
 692         }
 693         param += sizeof(PARAM_SRPC_FLVR) - 1;
 694
 695         rc = sptlrpc_parse_rule(param, &rule);
 696         if (rc)
 697                 RETURN(-EINVAL);
 698
 699         if (conf == NULL) {
 700                 target2fsname(target, fsname, sizeof(fsname));
 701
 702                 mutex_lock(&sptlrpc_conf_lock);
 703                 conf = sptlrpc_conf_get(fsname, 0);
 704                 if (conf == NULL) {
 705                         CERROR("can't find conf\n");
 706                         rc = -ENOMEM;
 707                 } else {
 708                         rc = sptlrpc_conf_merge_rule(conf, target, &rule);
 709                 }
 710                 mutex_unlock(&sptlrpc_conf_lock);
 711         } else {
 712                 LASSERT(mutex_is_locked(&sptlrpc_conf_lock));
 713                 rc = sptlrpc_conf_merge_rule(conf, target, &rule);
 714         }
 715
 716         if (rc == 0)
 717                 conf->sc_modified++;
 718
 719         RETURN(rc);
 720 }
 721
 722 int sptlrpc_process_config(struct lustre_cfg *lcfg)
 723 {
 724         return __sptlrpc_process_config(lcfg, NULL);
 725 }
 726 EXPORT_SYMBOL(sptlrpc_process_config);
 727
 728 static int logname2fsname(const char *logname, char *buf, int buflen)
 729 {
 730         char   *ptr;
 731         int     len;
 732
 733         ptr = strrchr(logname, '-');
 734         if (ptr == NULL || strcmp(ptr, "-sptlrpc")) {
 735                 CERROR("%s is not a sptlrpc config log\n", logname);
 736                 return -EINVAL;
 737         }
 738
 739         len = min((int) (ptr - logname), buflen - 1);
 740
 741         memcpy(buf, logname, len);
 742         buf[len] = '\0';
 743         return 0;
 744 }
 745
 746 void sptlrpc_conf_log_update_begin(const char *logname)
 747 {
 748         struct sptlrpc_conf *conf;
 749         char                 fsname[16];
 750
 751         if (logname2fsname(logname, fsname, sizeof(fsname)))
 752                 return;
 753
 754         mutex_lock(&sptlrpc_conf_lock);
 755
 756         conf = sptlrpc_conf_get(fsname, 0);
 757         if (conf) {
 758                 if (conf->sc_local) {
 759                         LASSERT(conf->sc_updated == 0);
 760                         sptlrpc_conf_free_rsets(conf);
 761                 }
 762                 conf->sc_modified = 0;
 763         }
 764
 765         mutex_unlock(&sptlrpc_conf_lock);
 766 }
 767 EXPORT_SYMBOL(sptlrpc_conf_log_update_begin);
 768
 769 /**
 770  * mark a config log has been updated
 771  */
 772 void sptlrpc_conf_log_update_end(const char *logname)
 773 {
 774         struct sptlrpc_conf *conf;
 775         char                 fsname[16];
 776
 777         if (logname2fsname(logname, fsname, sizeof(fsname)))
 778                 return;
 779
 780         mutex_lock(&sptlrpc_conf_lock);
 781
 782         conf = sptlrpc_conf_get(fsname, 0);
 783         if (conf) {
 784                 /*
 785                  * if original state is not updated, make sure the
 786                  * modified counter > 0 to enforce updating local copy.
 787                  */
 788                 if (conf->sc_updated == 0)
 789                         conf->sc_modified++;
 790
 791                 conf->sc_updated = 1;
 792         }
 793
 794         mutex_unlock(&sptlrpc_conf_lock);
 795 }
 796 EXPORT_SYMBOL(sptlrpc_conf_log_update_end);
 797
 798 void sptlrpc_conf_log_start(const char *logname)
 799 {
 800         char                 fsname[16];
 801
 802         if (logname2fsname(logname, fsname, sizeof(fsname)))
 803                 return;
 804
 805         mutex_lock(&sptlrpc_conf_lock);
 806         sptlrpc_conf_get(fsname, 1);
 807         mutex_unlock(&sptlrpc_conf_lock);
 808 }
 809 EXPORT_SYMBOL(sptlrpc_conf_log_start);
 810
 811 void sptlrpc_conf_log_stop(const char *logname)
 812 {
 813         struct sptlrpc_conf *conf;
 814         char                 fsname[16];
 815
 816         if (logname2fsname(logname, fsname, sizeof(fsname)))
 817                 return;
 818
 819         mutex_lock(&sptlrpc_conf_lock);
 820         conf = sptlrpc_conf_get(fsname, 0);
 821         if (conf)
 822                 sptlrpc_conf_free(conf);
 823         mutex_unlock(&sptlrpc_conf_lock);
 824 }
 825 EXPORT_SYMBOL(sptlrpc_conf_log_stop);
 826
 827 static void inline flavor_set_flags(struct sptlrpc_flavor *sf,
 828                                     enum lustre_sec_part from,
 829                                     enum lustre_sec_part to,
 830                                     unsigned int fl_udesc)
 831 {
 832         /*
 833          * null flavor doesn't need to set any flavor, and in fact
 834          * we'd better not do that because everybody share a single sec.
 835          */
 836         if (sf->sf_rpc == SPTLRPC_FLVR_NULL)
 837                 return;
 838
 839         if (from == LUSTRE_SP_MDT) {
 840                 /* MDT->MDT; MDT->OST */
 841                 sf->sf_flags |= PTLRPC_SEC_FL_ROOTONLY;
 842         } else if (from == LUSTRE_SP_CLI && to == LUSTRE_SP_OST) {
 843                 /* CLI->OST */
 844                 sf->sf_flags |= PTLRPC_SEC_FL_ROOTONLY | PTLRPC_SEC_FL_BULK;
 845         } else if (from == LUSTRE_SP_CLI && to == LUSTRE_SP_MDT) {
 846                 /* CLI->MDT */
 847                 if (fl_udesc && sf->sf_rpc != SPTLRPC_FLVR_NULL)
 848                         sf->sf_flags |= PTLRPC_SEC_FL_UDESC;
 849         }
 850 }
 851
 852 void sptlrpc_conf_choose_flavor(enum lustre_sec_part from,
 853                                 enum lustre_sec_part to,
 854                                 struct obd_uuid *target,
 855                                 lnet_nid_t nid,
 856                                 struct sptlrpc_flavor *sf)
 857 {
 858         struct sptlrpc_conf     *conf;
 859         struct sptlrpc_conf_tgt *conf_tgt;
 860         char                     name[MTI_NAME_MAXLEN];
 861         int                      len, rc = 0;
 862
 863         target2fsname(target->uuid, name, sizeof(name));
 864
 865         mutex_lock(&sptlrpc_conf_lock);
 866
 867         conf = sptlrpc_conf_get(name, 0);
 868         if (conf == NULL)
 869                 goto out;
 870
 871         /* convert uuid name (supposed end with _UUID) to target name */
 872         len = strlen(target->uuid);
 873         LASSERT(len > 5);
 874         memcpy(name, target->uuid, len - 5);
 875         name[len - 5] = '\0';
 876
 877         conf_tgt = sptlrpc_conf_get_tgt(conf, name, 0);
 878         if (conf_tgt) {
 879                 rc = sptlrpc_rule_set_choose(&conf_tgt->sct_rset,
 880                                              from, to, nid, sf);
 881                 if (rc)
 882                         goto out;
 883         }
 884
 885         rc = sptlrpc_rule_set_choose(&conf->sc_rset, from, to, nid, sf);
 886 out:
 887         mutex_unlock(&sptlrpc_conf_lock);
 888
 889         if (rc == 0)
 890                 get_default_flavor(sf);
 891
 892         flavor_set_flags(sf, from, to, 1);
 893 }
 894
 895 /**
 896  * called by target devices, determine the expected flavor from
 897  * certain peer (from, nid).
 898  */
 899 void sptlrpc_target_choose_flavor(struct sptlrpc_rule_set *rset,
 900                                   enum lustre_sec_part from,
 901                                   lnet_nid_t nid,
 902                                   struct sptlrpc_flavor *sf)
 903 {
 904         if (sptlrpc_rule_set_choose(rset, from, LUSTRE_SP_ANY, nid, sf) == 0)
 905                 get_default_flavor(sf);
 906 }
 907 EXPORT_SYMBOL(sptlrpc_target_choose_flavor);
 908
 909 #define SEC_ADAPT_DELAY         (10)
 910
 911 /**
 912  * called by client devices, notify the sptlrpc config has changed and
 913  * do import_sec_adapt later.
 914  */
 915 void sptlrpc_conf_client_adapt(struct obd_device *obd)
 916 {
 917         struct obd_import  *imp;
 918         ENTRY;
 919
 920         LASSERT(strcmp(obd->obd_type->typ_name, LUSTRE_MDC_NAME) == 0 ||
 921                 strcmp(obd->obd_type->typ_name, LUSTRE_OSC_NAME) ==0);
 922         CDEBUG(D_SEC, "obd %s\n", obd->u.cli.cl_target_uuid.uuid);
 923
 924         /* serialize with connect/disconnect import */
 925         down_read(&obd->u.cli.cl_sem);
 926
 927         imp = obd->u.cli.cl_import;
 928         if (imp) {
 929                 spin_lock(&imp->imp_lock);
 930                 if (imp->imp_sec)
 931                         imp->imp_sec_expire = cfs_time_current_sec() +
 932                                 SEC_ADAPT_DELAY;
 933                 spin_unlock(&imp->imp_lock);
 934         }
 935
 936         up_read(&obd->u.cli.cl_sem);
 937         EXIT;
 938 }
 939 EXPORT_SYMBOL(sptlrpc_conf_client_adapt);
 940
 941 #ifdef __KERNEL__
 942
 943 static void rule2string(struct sptlrpc_rule *r, char *buf, int buflen)
 944 {
 945         char    dirbuf[8];
 946         char   *net;
 947         char   *ptr = buf;
 948
 949         if (r->sr_netid == LNET_NIDNET(LNET_NID_ANY))
 950                 net = "default";
 951         else
 952                 net = libcfs_net2str(r->sr_netid);
 953
 954         if (r->sr_from == LUSTRE_SP_ANY && r->sr_to == LUSTRE_SP_ANY)
 955                 dirbuf[0] = '\0';
 956         else
 957                 snprintf(dirbuf, sizeof(dirbuf), ".%s2%s",
 958                          sptlrpc_part2name(r->sr_from),
 959                          sptlrpc_part2name(r->sr_to));
 960
 961         ptr += snprintf(buf, buflen, "srpc.flavor.%s%s=", net, dirbuf);
 962
 963         sptlrpc_flavor2name(&r->sr_flvr, ptr, buflen - (ptr - buf));
 964         buf[buflen - 1] = '\0';
 965 }
 966
 967 static int sptlrpc_record_rule_set(struct llog_handle *llh,
 968                                    char *target,
 969                                    struct sptlrpc_rule_set *rset)
 970 {
 971         struct llog_cfg_rec     *lcr;
 972         struct lustre_cfg_bufs   bufs;
 973         char                     param[48];
 974         int                      i, rc;
 975
 976         for (i = 0; i < rset->srs_nrule; i++) {
 977                 rule2string(&rset->srs_rules[i], param, sizeof(param));
 978
 979                 lustre_cfg_bufs_reset(&bufs, NULL);
 980                 lustre_cfg_bufs_set_string(&bufs, 1, target);
 981                 lustre_cfg_bufs_set_string(&bufs, 2, param);
 982                 lcr = lustre_cfg_rec_new(LCFG_SPTLRPC_CONF, &bufs);
 983                 if (lcr == NULL)
 984                         return -ENOMEM;
 985                 rc = llog_write(NULL, llh, &lcr->lcr_hdr, LLOG_NEXT_IDX);
 986                 lustre_cfg_rec_free(lcr);
 987                 if (rc)
 988                         return rc;
 989         }
 990         return 0;
 991 }
 992
 993 static int sptlrpc_record_rules(struct llog_handle *llh,
 994                                 struct sptlrpc_conf *conf)
 995 {
 996         struct sptlrpc_conf_tgt *conf_tgt;
 997
 998         sptlrpc_record_rule_set(llh, conf->sc_fsname, &conf->sc_rset);
 999
1000         list_for_each_entry(conf_tgt, &conf->sc_tgts, sct_list) {
1001                 sptlrpc_record_rule_set(llh, conf_tgt->sct_name,
1002                                         &conf_tgt->sct_rset);
1003         }
1004         return 0;
1005 }
1006
1007 #define LOG_SPTLRPC_TMP "sptlrpc.tmp"
1008 #define LOG_SPTLRPC     "sptlrpc"
1009
1010 static
1011 int sptlrpc_target_local_copy_conf(struct obd_device *obd,
1012                                    struct sptlrpc_conf *conf)
1013 {
1014         struct llog_handle   *llh = NULL;
1015         struct llog_ctxt     *ctxt;
1016         struct lvfs_run_ctxt  saved;
1017         struct dentry        *dentry;
1018         int                   rc;
1019         ENTRY;
1020
1021         ctxt = llog_get_context(obd, LLOG_CONFIG_ORIG_CTXT);
1022         if (ctxt == NULL)
1023                 RETURN(-EINVAL);
1024
1025         push_ctxt(&saved, &obd->obd_lvfs_ctxt);
1026
1027         dentry = ll_lookup_one_len(MOUNT_CONFIGS_DIR, current->fs->pwd.dentry,
1028                                    strlen(MOUNT_CONFIGS_DIR));
1029         if (IS_ERR(dentry)) {
1030                 rc = PTR_ERR(dentry);
1031                 CERROR("cannot lookup %s directory: rc = %d\n",
1032                        MOUNT_CONFIGS_DIR, rc);
1033                 GOTO(out_ctx, rc);
1034         }
1035
1036         /* erase the old tmp log */
1037         rc = llog_erase(NULL, ctxt, NULL, LOG_SPTLRPC_TMP);
1038         if (rc < 0 && rc != -ENOENT) {
1039                 CERROR("%s: cannot erase temporary sptlrpc log: rc = %d\n",
1040                        obd->obd_name, rc);
1041                 GOTO(out_dput, rc);
1042         }
1043
1044         /* write temporary log */
1045         rc = llog_open_create(NULL, ctxt, &llh, NULL, LOG_SPTLRPC_TMP);
1046         if (rc)
1047                 GOTO(out_dput, rc);
1048         rc = llog_init_handle(NULL, llh, LLOG_F_IS_PLAIN, NULL);
1049         if (rc)
1050                 GOTO(out_close, rc);
1051
1052         rc = sptlrpc_record_rules(llh, conf);
1053
1054 out_close:
1055         llog_close(NULL, llh);
1056         if (rc == 0)
1057                 rc = lustre_rename(dentry, obd->obd_lvfs_ctxt.pwdmnt,
1058                                    LOG_SPTLRPC_TMP, LOG_SPTLRPC);
1059 out_dput:
1060         dput(dentry);
1061 out_ctx:
1062         pop_ctxt(&saved, &obd->obd_lvfs_ctxt);
1063         llog_ctxt_put(ctxt);
1064         CDEBUG(D_SEC, "target %s: write local sptlrpc conf: rc = %d\n",
1065                 obd->obd_name, rc);
1066         RETURN(rc);
1067 }
1068
1069 static int local_read_handler(const struct lu_env *env,
1070                               struct llog_handle *llh,
1071                               struct llog_rec_hdr *rec, void *data)
1072 {
1073         struct sptlrpc_conf  *conf = (struct sptlrpc_conf *) data;
1074         struct lustre_cfg    *lcfg = (struct lustre_cfg *)(rec + 1);
1075         int                   cfg_len, rc;
1076         ENTRY;
1077
1078         if (rec->lrh_type != OBD_CFG_REC) {
1079                 CERROR("unhandled lrh_type: %#x\n", rec->lrh_type);
1080                 RETURN(-EINVAL);
1081         }
1082
1083         cfg_len = rec->lrh_len - sizeof(struct llog_rec_hdr) -
1084                   sizeof(struct llog_rec_tail);
1085
1086         rc = lustre_cfg_sanity_check(lcfg, cfg_len);
1087         if (rc) {
1088                 CERROR("Insane cfg\n");
1089                 RETURN(rc);
1090         }
1091
1092         if (lcfg->lcfg_command != LCFG_SPTLRPC_CONF) {
1093                 CERROR("invalid command (%x)\n", lcfg->lcfg_command);
1094                 RETURN(-EINVAL);
1095         }
1096
1097         RETURN(__sptlrpc_process_config(lcfg, conf));
1098 }
1099
1100 static
1101 int sptlrpc_target_local_read_conf(struct obd_device *obd,
1102                                    struct sptlrpc_conf *conf)
1103 {
1104         struct llog_handle    *llh = NULL;
1105         struct llog_ctxt      *ctxt;
1106         struct lvfs_run_ctxt   saved;
1107         int                    rc;
1108         ENTRY;
1109
1110         LASSERT(conf->sc_updated == 0 && conf->sc_local == 0);
1111
1112         ctxt = llog_get_context(obd, LLOG_CONFIG_ORIG_CTXT);
1113         if (ctxt == NULL) {
1114                 CERROR("missing llog context\n");
1115                 RETURN(-EINVAL);
1116         }
1117
1118         push_ctxt(&saved, &obd->obd_lvfs_ctxt);
1119
1120         rc = llog_open(NULL, ctxt, &llh, NULL, LOG_SPTLRPC, LLOG_OPEN_EXISTS);
1121         if (rc < 0) {
1122                 if (rc == -ENOENT)
1123                         rc = 0;
1124                 GOTO(out_pop, rc);
1125         }
1126
1127         rc = llog_init_handle(NULL, llh, LLOG_F_IS_PLAIN, NULL);
1128         if (rc)
1129                 GOTO(out_close, rc);
1130
1131         if (llog_get_size(llh) <= 1) {
1132                 CDEBUG(D_SEC, "no local sptlrpc copy found\n");
1133                 GOTO(out_close, rc = 0);
1134         }
1135
1136         rc = llog_process(NULL, llh, local_read_handler, (void *)conf, NULL);
1137
1138         if (rc == 0) {
1139                 conf->sc_local = 1;
1140         } else {
1141                 sptlrpc_conf_free_rsets(conf);
1142         }
1143
1144 out_close:
1145         llog_close(NULL, llh);
1146 out_pop:
1147         pop_ctxt(&saved, &obd->obd_lvfs_ctxt);
1148         llog_ctxt_put(ctxt);
1149         CDEBUG(D_SEC, "target %s: read local sptlrpc conf: rc = %d\n",
1150                 obd->obd_name, rc);
1151         RETURN(rc);
1152 }
1153
1154 #endif /* __KRENEL__ */
1155
1156 /**
1157  * called by target devices, extract sptlrpc rules which applies to
1158  * this target, to be used for future rpc flavor checking.
1159  */
1160 int sptlrpc_conf_target_get_rules(struct obd_device *obd,
1161                                   struct sptlrpc_rule_set *rset,
1162                                   int initial)
1163 {
1164         struct sptlrpc_conf      *conf;
1165         struct sptlrpc_conf_tgt  *conf_tgt;
1166         enum lustre_sec_part      sp_dst;
1167         char                      fsname[MTI_NAME_MAXLEN];
1168         int                       rc = 0;
1169         ENTRY;
1170
1171         if (strcmp(obd->obd_type->typ_name, LUSTRE_MDT_NAME) == 0) {
1172                 sp_dst = LUSTRE_SP_MDT;
1173         } else if (strcmp(obd->obd_type->typ_name, LUSTRE_OST_NAME) == 0) {
1174                 sp_dst = LUSTRE_SP_OST;
1175         } else {
1176                 CERROR("unexpected obd type %s\n", obd->obd_type->typ_name);
1177                 RETURN(-EINVAL);
1178         }
1179         CDEBUG(D_SEC, "get rules for target %s\n", obd->obd_uuid.uuid);
1180
1181         target2fsname(obd->obd_uuid.uuid, fsname, sizeof(fsname));
1182
1183         mutex_lock(&sptlrpc_conf_lock);
1184
1185         conf = sptlrpc_conf_get(fsname, 0);
1186         if (conf == NULL) {
1187                 CERROR("missing sptlrpc config log\n");
1188                 GOTO(out, rc);
1189         }
1190
1191 #ifdef __KERNEL__
1192         if (conf->sc_updated  == 0) {
1193                 /*
1194                  * always read from local copy. here another option is
1195                  * if we already have a local copy (read from another
1196                  * target device hosted on the same node) we simply use that.
1197                  */
1198                 if (conf->sc_local)
1199                         sptlrpc_conf_free_rsets(conf);
1200
1201                 sptlrpc_target_local_read_conf(obd, conf);
1202         } else {
1203                 LASSERT(conf->sc_local == 0);
1204
1205                 /* write a local copy */
1206                 if (initial || conf->sc_modified)
1207                         sptlrpc_target_local_copy_conf(obd, conf);
1208                 else
1209                         CDEBUG(D_SEC, "unchanged, skip updating local copy\n");
1210         }
1211 #endif
1212
1213         /* extract rule set for this target */
1214         conf_tgt = sptlrpc_conf_get_tgt(conf, obd->obd_name, 0);
1215
1216         rc = sptlrpc_rule_set_extract(&conf->sc_rset,
1217                                       conf_tgt ? &conf_tgt->sct_rset: NULL,
1218                                       LUSTRE_SP_ANY, sp_dst, rset);
1219 out:
1220         mutex_unlock(&sptlrpc_conf_lock);
1221         RETURN(rc);
1222 }
1223 EXPORT_SYMBOL(sptlrpc_conf_target_get_rules);
1224
1225 int  sptlrpc_conf_init(void)
1226 {
1227         INIT_LIST_HEAD(&sptlrpc_confs);
1228         mutex_init(&sptlrpc_conf_lock);
1229         return 0;
1230 }
1231
1232 void sptlrpc_conf_fini(void)
1233 {
1234         struct sptlrpc_conf  *conf, *conf_next;
1235
1236         mutex_lock(&sptlrpc_conf_lock);
1237         list_for_each_entry_safe(conf, conf_next, &sptlrpc_confs, sc_list)
1238                 sptlrpc_conf_free(conf);
1239         LASSERT(list_empty(&sptlrpc_confs));
1240         mutex_unlock(&sptlrpc_conf_lock);
1241 }