linux/fs/nfsd/nfs4idmap.c
<<
>>
Prefs
   1/*
   2 *  Mapping of UID/GIDs to name and vice versa.
   3 *
   4 *  Copyright (c) 2002, 2003 The Regents of the University of
   5 *  Michigan.  All rights reserved.
   6 *
   7 *  Marius Aamodt Eriksen <marius@umich.edu>
   8 *
   9 *  Redistribution and use in source and binary forms, with or without
  10 *  modification, are permitted provided that the following conditions
  11 *  are met:
  12 *
  13 *  1. Redistributions of source code must retain the above copyright
  14 *     notice, this list of conditions and the following disclaimer.
  15 *  2. Redistributions in binary form must reproduce the above copyright
  16 *     notice, this list of conditions and the following disclaimer in the
  17 *     documentation and/or other materials provided with the distribution.
  18 *  3. Neither the name of the University nor the names of its
  19 *     contributors may be used to endorse or promote products derived
  20 *     from this software without specific prior written permission.
  21 *
  22 *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  23 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  24 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  25 *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  26 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  27 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  28 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  29 *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  30 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  31 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  32 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  33 */
  34
  35#include <linux/module.h>
  36#include <linux/seq_file.h>
  37#include <linux/sched.h>
  38#include <linux/slab.h>
  39#include <linux/sunrpc/svc_xprt.h>
  40#include <net/net_namespace.h>
  41#include "idmap.h"
  42#include "nfsd.h"
  43#include "netns.h"
  44
  45/*
  46 * Turn off idmapping when using AUTH_SYS.
  47 */
  48static bool nfs4_disable_idmapping = true;
  49module_param(nfs4_disable_idmapping, bool, 0644);
  50MODULE_PARM_DESC(nfs4_disable_idmapping,
  51                "Turn off server's NFSv4 idmapping when using 'sec=sys'");
  52
  53/*
  54 * Cache entry
  55 */
  56
  57/*
  58 * XXX we know that IDMAP_NAMESZ < PAGE_SIZE, but it's ugly to rely on
  59 * that.
  60 */
  61
  62#define IDMAP_TYPE_USER  0
  63#define IDMAP_TYPE_GROUP 1
  64
  65struct ent {
  66        struct cache_head h;
  67        int               type;                /* User / Group */
  68        u32               id;
  69        char              name[IDMAP_NAMESZ];
  70        char              authname[IDMAP_NAMESZ];
  71};
  72
  73/* Common entry handling */
  74
  75#define ENT_HASHBITS          8
  76#define ENT_HASHMAX           (1 << ENT_HASHBITS)
  77
  78static void
  79ent_init(struct cache_head *cnew, struct cache_head *citm)
  80{
  81        struct ent *new = container_of(cnew, struct ent, h);
  82        struct ent *itm = container_of(citm, struct ent, h);
  83
  84        new->id = itm->id;
  85        new->type = itm->type;
  86
  87        strlcpy(new->name, itm->name, sizeof(new->name));
  88        strlcpy(new->authname, itm->authname, sizeof(new->name));
  89}
  90
  91static void
  92ent_put(struct kref *ref)
  93{
  94        struct ent *map = container_of(ref, struct ent, h.ref);
  95        kfree(map);
  96}
  97
  98static struct cache_head *
  99ent_alloc(void)
 100{
 101        struct ent *e = kmalloc(sizeof(*e), GFP_KERNEL);
 102        if (e)
 103                return &e->h;
 104        else
 105                return NULL;
 106}
 107
 108/*
 109 * ID -> Name cache
 110 */
 111
 112static uint32_t
 113idtoname_hash(struct ent *ent)
 114{
 115        uint32_t hash;
 116
 117        hash = hash_str(ent->authname, ENT_HASHBITS);
 118        hash = hash_long(hash ^ ent->id, ENT_HASHBITS);
 119
 120        /* Flip LSB for user/group */
 121        if (ent->type == IDMAP_TYPE_GROUP)
 122                hash ^= 1;
 123
 124        return hash;
 125}
 126
 127static void
 128idtoname_request(struct cache_detail *cd, struct cache_head *ch, char **bpp,
 129    int *blen)
 130{
 131        struct ent *ent = container_of(ch, struct ent, h);
 132        char idstr[11];
 133
 134        qword_add(bpp, blen, ent->authname);
 135        snprintf(idstr, sizeof(idstr), "%u", ent->id);
 136        qword_add(bpp, blen, ent->type == IDMAP_TYPE_GROUP ? "group" : "user");
 137        qword_add(bpp, blen, idstr);
 138
 139        (*bpp)[-1] = '\n';
 140}
 141
 142static int
 143idtoname_match(struct cache_head *ca, struct cache_head *cb)
 144{
 145        struct ent *a = container_of(ca, struct ent, h);
 146        struct ent *b = container_of(cb, struct ent, h);
 147
 148        return (a->id == b->id && a->type == b->type &&
 149            strcmp(a->authname, b->authname) == 0);
 150}
 151
 152static int
 153idtoname_show(struct seq_file *m, struct cache_detail *cd, struct cache_head *h)
 154{
 155        struct ent *ent;
 156
 157        if (h == NULL) {
 158                seq_puts(m, "#domain type id [name]\n");
 159                return 0;
 160        }
 161        ent = container_of(h, struct ent, h);
 162        seq_printf(m, "%s %s %u", ent->authname,
 163                        ent->type == IDMAP_TYPE_GROUP ? "group" : "user",
 164                        ent->id);
 165        if (test_bit(CACHE_VALID, &h->flags))
 166                seq_printf(m, " %s", ent->name);
 167        seq_printf(m, "\n");
 168        return 0;
 169}
 170
 171static void
 172warn_no_idmapd(struct cache_detail *detail, int has_died)
 173{
 174        printk("nfsd: nfsv4 idmapping failing: has idmapd %s?\n",
 175                        has_died ? "died" : "not been started");
 176}
 177
 178
 179static int         idtoname_parse(struct cache_detail *, char *, int);
 180static struct ent *idtoname_lookup(struct cache_detail *, struct ent *);
 181static struct ent *idtoname_update(struct cache_detail *, struct ent *,
 182                                   struct ent *);
 183
 184static struct cache_detail idtoname_cache_template = {
 185        .owner          = THIS_MODULE,
 186        .hash_size      = ENT_HASHMAX,
 187        .name           = "nfs4.idtoname",
 188        .cache_put      = ent_put,
 189        .cache_request  = idtoname_request,
 190        .cache_parse    = idtoname_parse,
 191        .cache_show     = idtoname_show,
 192        .warn_no_listener = warn_no_idmapd,
 193        .match          = idtoname_match,
 194        .init           = ent_init,
 195        .update         = ent_init,
 196        .alloc          = ent_alloc,
 197};
 198
 199static int
 200idtoname_parse(struct cache_detail *cd, char *buf, int buflen)
 201{
 202        struct ent ent, *res;
 203        char *buf1, *bp;
 204        int len;
 205        int error = -EINVAL;
 206
 207        if (buf[buflen - 1] != '\n')
 208                return (-EINVAL);
 209        buf[buflen - 1]= '\0';
 210
 211        buf1 = kmalloc(PAGE_SIZE, GFP_KERNEL);
 212        if (buf1 == NULL)
 213                return (-ENOMEM);
 214
 215        memset(&ent, 0, sizeof(ent));
 216
 217        /* Authentication name */
 218        if (qword_get(&buf, buf1, PAGE_SIZE) <= 0)
 219                goto out;
 220        memcpy(ent.authname, buf1, sizeof(ent.authname));
 221
 222        /* Type */
 223        if (qword_get(&buf, buf1, PAGE_SIZE) <= 0)
 224                goto out;
 225        ent.type = strcmp(buf1, "user") == 0 ?
 226                IDMAP_TYPE_USER : IDMAP_TYPE_GROUP;
 227
 228        /* ID */
 229        if (qword_get(&buf, buf1, PAGE_SIZE) <= 0)
 230                goto out;
 231        ent.id = simple_strtoul(buf1, &bp, 10);
 232        if (bp == buf1)
 233                goto out;
 234
 235        /* expiry */
 236        ent.h.expiry_time = get_expiry(&buf);
 237        if (ent.h.expiry_time == 0)
 238                goto out;
 239
 240        error = -ENOMEM;
 241        res = idtoname_lookup(cd, &ent);
 242        if (!res)
 243                goto out;
 244
 245        /* Name */
 246        error = -EINVAL;
 247        len = qword_get(&buf, buf1, PAGE_SIZE);
 248        if (len < 0)
 249                goto out;
 250        if (len == 0)
 251                set_bit(CACHE_NEGATIVE, &ent.h.flags);
 252        else if (len >= IDMAP_NAMESZ)
 253                goto out;
 254        else
 255                memcpy(ent.name, buf1, sizeof(ent.name));
 256        error = -ENOMEM;
 257        res = idtoname_update(cd, &ent, res);
 258        if (res == NULL)
 259                goto out;
 260
 261        cache_put(&res->h, cd);
 262
 263        error = 0;
 264out:
 265        kfree(buf1);
 266
 267        return error;
 268}
 269
 270
 271static struct ent *
 272idtoname_lookup(struct cache_detail *cd, struct ent *item)
 273{
 274        struct cache_head *ch = sunrpc_cache_lookup(cd, &item->h,
 275                                                    idtoname_hash(item));
 276        if (ch)
 277                return container_of(ch, struct ent, h);
 278        else
 279                return NULL;
 280}
 281
 282static struct ent *
 283idtoname_update(struct cache_detail *cd, struct ent *new, struct ent *old)
 284{
 285        struct cache_head *ch = sunrpc_cache_update(cd, &new->h, &old->h,
 286                                                    idtoname_hash(new));
 287        if (ch)
 288                return container_of(ch, struct ent, h);
 289        else
 290                return NULL;
 291}
 292
 293
 294/*
 295 * Name -> ID cache
 296 */
 297
 298static inline int
 299nametoid_hash(struct ent *ent)
 300{
 301        return hash_str(ent->name, ENT_HASHBITS);
 302}
 303
 304static void
 305nametoid_request(struct cache_detail *cd, struct cache_head *ch, char **bpp,
 306    int *blen)
 307{
 308        struct ent *ent = container_of(ch, struct ent, h);
 309
 310        qword_add(bpp, blen, ent->authname);
 311        qword_add(bpp, blen, ent->type == IDMAP_TYPE_GROUP ? "group" : "user");
 312        qword_add(bpp, blen, ent->name);
 313
 314        (*bpp)[-1] = '\n';
 315}
 316
 317static int
 318nametoid_match(struct cache_head *ca, struct cache_head *cb)
 319{
 320        struct ent *a = container_of(ca, struct ent, h);
 321        struct ent *b = container_of(cb, struct ent, h);
 322
 323        return (a->type == b->type && strcmp(a->name, b->name) == 0 &&
 324            strcmp(a->authname, b->authname) == 0);
 325}
 326
 327static int
 328nametoid_show(struct seq_file *m, struct cache_detail *cd, struct cache_head *h)
 329{
 330        struct ent *ent;
 331
 332        if (h == NULL) {
 333                seq_puts(m, "#domain type name [id]\n");
 334                return 0;
 335        }
 336        ent = container_of(h, struct ent, h);
 337        seq_printf(m, "%s %s %s", ent->authname,
 338                        ent->type == IDMAP_TYPE_GROUP ? "group" : "user",
 339                        ent->name);
 340        if (test_bit(CACHE_VALID, &h->flags))
 341                seq_printf(m, " %u", ent->id);
 342        seq_printf(m, "\n");
 343        return 0;
 344}
 345
 346static struct ent *nametoid_lookup(struct cache_detail *, struct ent *);
 347static struct ent *nametoid_update(struct cache_detail *, struct ent *,
 348                                   struct ent *);
 349static int         nametoid_parse(struct cache_detail *, char *, int);
 350
 351static struct cache_detail nametoid_cache_template = {
 352        .owner          = THIS_MODULE,
 353        .hash_size      = ENT_HASHMAX,
 354        .name           = "nfs4.nametoid",
 355        .cache_put      = ent_put,
 356        .cache_request  = nametoid_request,
 357        .cache_parse    = nametoid_parse,
 358        .cache_show     = nametoid_show,
 359        .warn_no_listener = warn_no_idmapd,
 360        .match          = nametoid_match,
 361        .init           = ent_init,
 362        .update         = ent_init,
 363        .alloc          = ent_alloc,
 364};
 365
 366static int
 367nametoid_parse(struct cache_detail *cd, char *buf, int buflen)
 368{
 369        struct ent ent, *res;
 370        char *buf1;
 371        int error = -EINVAL;
 372
 373        if (buf[buflen - 1] != '\n')
 374                return (-EINVAL);
 375        buf[buflen - 1]= '\0';
 376
 377        buf1 = kmalloc(PAGE_SIZE, GFP_KERNEL);
 378        if (buf1 == NULL)
 379                return (-ENOMEM);
 380
 381        memset(&ent, 0, sizeof(ent));
 382
 383        /* Authentication name */
 384        if (qword_get(&buf, buf1, PAGE_SIZE) <= 0)
 385                goto out;
 386        memcpy(ent.authname, buf1, sizeof(ent.authname));
 387
 388        /* Type */
 389        if (qword_get(&buf, buf1, PAGE_SIZE) <= 0)
 390                goto out;
 391        ent.type = strcmp(buf1, "user") == 0 ?
 392                IDMAP_TYPE_USER : IDMAP_TYPE_GROUP;
 393
 394        /* Name */
 395        error = qword_get(&buf, buf1, PAGE_SIZE);
 396        if (error <= 0 || error >= IDMAP_NAMESZ)
 397                goto out;
 398        memcpy(ent.name, buf1, sizeof(ent.name));
 399
 400        /* expiry */
 401        ent.h.expiry_time = get_expiry(&buf);
 402        if (ent.h.expiry_time == 0)
 403                goto out;
 404
 405        /* ID */
 406        error = get_int(&buf, &ent.id);
 407        if (error == -EINVAL)
 408                goto out;
 409        if (error == -ENOENT)
 410                set_bit(CACHE_NEGATIVE, &ent.h.flags);
 411
 412        error = -ENOMEM;
 413        res = nametoid_lookup(cd, &ent);
 414        if (res == NULL)
 415                goto out;
 416        res = nametoid_update(cd, &ent, res);
 417        if (res == NULL)
 418                goto out;
 419
 420        cache_put(&res->h, cd);
 421        error = 0;
 422out:
 423        kfree(buf1);
 424
 425        return (error);
 426}
 427
 428
 429static struct ent *
 430nametoid_lookup(struct cache_detail *cd, struct ent *item)
 431{
 432        struct cache_head *ch = sunrpc_cache_lookup(cd, &item->h,
 433                                                    nametoid_hash(item));
 434        if (ch)
 435                return container_of(ch, struct ent, h);
 436        else
 437                return NULL;
 438}
 439
 440static struct ent *
 441nametoid_update(struct cache_detail *cd, struct ent *new, struct ent *old)
 442{
 443        struct cache_head *ch = sunrpc_cache_update(cd, &new->h, &old->h,
 444                                                    nametoid_hash(new));
 445        if (ch)
 446                return container_of(ch, struct ent, h);
 447        else
 448                return NULL;
 449}
 450
 451/*
 452 * Exported API
 453 */
 454
 455int
 456nfsd_idmap_init(struct net *net)
 457{
 458        int rv;
 459        struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 460
 461        nn->idtoname_cache = cache_create_net(&idtoname_cache_template, net);
 462        if (IS_ERR(nn->idtoname_cache))
 463                return PTR_ERR(nn->idtoname_cache);
 464        rv = cache_register_net(nn->idtoname_cache, net);
 465        if (rv)
 466                goto destroy_idtoname_cache;
 467        nn->nametoid_cache = cache_create_net(&nametoid_cache_template, net);
 468        if (IS_ERR(nn->nametoid_cache)) {
 469                rv = PTR_ERR(nn->nametoid_cache);
 470                goto unregister_idtoname_cache;
 471        }
 472        rv = cache_register_net(nn->nametoid_cache, net);
 473        if (rv)
 474                goto destroy_nametoid_cache;
 475        return 0;
 476
 477destroy_nametoid_cache:
 478        cache_destroy_net(nn->nametoid_cache, net);
 479unregister_idtoname_cache:
 480        cache_unregister_net(nn->idtoname_cache, net);
 481destroy_idtoname_cache:
 482        cache_destroy_net(nn->idtoname_cache, net);
 483        return rv;
 484}
 485
 486void
 487nfsd_idmap_shutdown(struct net *net)
 488{
 489        struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 490
 491        cache_unregister_net(nn->idtoname_cache, net);
 492        cache_unregister_net(nn->nametoid_cache, net);
 493        cache_destroy_net(nn->idtoname_cache, net);
 494        cache_destroy_net(nn->nametoid_cache, net);
 495}
 496
 497static int
 498idmap_lookup(struct svc_rqst *rqstp,
 499                struct ent *(*lookup_fn)(struct cache_detail *, struct ent *),
 500                struct ent *key, struct cache_detail *detail, struct ent **item)
 501{
 502        int ret;
 503
 504        *item = lookup_fn(detail, key);
 505        if (!*item)
 506                return -ENOMEM;
 507 retry:
 508        ret = cache_check(detail, &(*item)->h, &rqstp->rq_chandle);
 509
 510        if (ret == -ETIMEDOUT) {
 511                struct ent *prev_item = *item;
 512                *item = lookup_fn(detail, key);
 513                if (*item != prev_item)
 514                        goto retry;
 515                cache_put(&(*item)->h, detail);
 516        }
 517        return ret;
 518}
 519
 520static char *
 521rqst_authname(struct svc_rqst *rqstp)
 522{
 523        struct auth_domain *clp;
 524
 525        clp = rqstp->rq_gssclient ? rqstp->rq_gssclient : rqstp->rq_client;
 526        return clp->name;
 527}
 528
 529static __be32
 530idmap_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namelen,
 531                u32 *id)
 532{
 533        struct ent *item, key = {
 534                .type = type,
 535        };
 536        int ret;
 537        struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
 538
 539        if (namelen + 1 > sizeof(key.name))
 540                return nfserr_badowner;
 541        memcpy(key.name, name, namelen);
 542        key.name[namelen] = '\0';
 543        strlcpy(key.authname, rqst_authname(rqstp), sizeof(key.authname));
 544        ret = idmap_lookup(rqstp, nametoid_lookup, &key, nn->nametoid_cache, &item);
 545        if (ret == -ENOENT)
 546                return nfserr_badowner;
 547        if (ret)
 548                return nfserrno(ret);
 549        *id = item->id;
 550        cache_put(&item->h, nn->nametoid_cache);
 551        return 0;
 552}
 553
 554static int
 555idmap_id_to_name(struct svc_rqst *rqstp, int type, u32 id, char *name)
 556{
 557        struct ent *item, key = {
 558                .id = id,
 559                .type = type,
 560        };
 561        int ret;
 562        struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
 563
 564        strlcpy(key.authname, rqst_authname(rqstp), sizeof(key.authname));
 565        ret = idmap_lookup(rqstp, idtoname_lookup, &key, nn->idtoname_cache, &item);
 566        if (ret == -ENOENT)
 567                return sprintf(name, "%u", id);
 568        if (ret)
 569                return ret;
 570        ret = strlen(item->name);
 571        BUG_ON(ret > IDMAP_NAMESZ);
 572        memcpy(name, item->name, ret);
 573        cache_put(&item->h, nn->idtoname_cache);
 574        return ret;
 575}
 576
 577static bool
 578numeric_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namelen, u32 *id)
 579{
 580        int ret;
 581        char buf[11];
 582
 583        if (namelen + 1 > sizeof(buf))
 584                /* too long to represent a 32-bit id: */
 585                return false;
 586        /* Just to make sure it's null-terminated: */
 587        memcpy(buf, name, namelen);
 588        buf[namelen] = '\0';
 589        ret = kstrtouint(buf, 10, id);
 590        return ret == 0;
 591}
 592
 593static __be32
 594do_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namelen, u32 *id)
 595{
 596        if (nfs4_disable_idmapping && rqstp->rq_cred.cr_flavor < RPC_AUTH_GSS)
 597                if (numeric_name_to_id(rqstp, type, name, namelen, id))
 598                        return 0;
 599                /*
 600                 * otherwise, fall through and try idmapping, for
 601                 * backwards compatibility with clients sending names:
 602                 */
 603        return idmap_name_to_id(rqstp, type, name, namelen, id);
 604}
 605
 606static int
 607do_id_to_name(struct svc_rqst *rqstp, int type, u32 id, char *name)
 608{
 609        if (nfs4_disable_idmapping && rqstp->rq_cred.cr_flavor < RPC_AUTH_GSS)
 610                return sprintf(name, "%u", id);
 611        return idmap_id_to_name(rqstp, type, id, name);
 612}
 613
 614__be32
 615nfsd_map_name_to_uid(struct svc_rqst *rqstp, const char *name, size_t namelen,
 616                kuid_t *uid)
 617{
 618        __be32 status;
 619        u32 id = -1;
 620        status = do_name_to_id(rqstp, IDMAP_TYPE_USER, name, namelen, &id);
 621        *uid = make_kuid(&init_user_ns, id);
 622        if (!uid_valid(*uid))
 623                status = nfserr_badowner;
 624        return status;
 625}
 626
 627__be32
 628nfsd_map_name_to_gid(struct svc_rqst *rqstp, const char *name, size_t namelen,
 629                kgid_t *gid)
 630{
 631        __be32 status;
 632        u32 id = -1;
 633        status = do_name_to_id(rqstp, IDMAP_TYPE_GROUP, name, namelen, &id);
 634        *gid = make_kgid(&init_user_ns, id);
 635        if (!gid_valid(*gid))
 636                status = nfserr_badowner;
 637        return status;
 638}
 639
 640int
 641nfsd_map_uid_to_name(struct svc_rqst *rqstp, kuid_t uid, char *name)
 642{
 643        u32 id = from_kuid(&init_user_ns, uid);
 644        return do_id_to_name(rqstp, IDMAP_TYPE_USER, id, name);
 645}
 646
 647int
 648nfsd_map_gid_to_name(struct svc_rqst *rqstp, kgid_t gid, char *name)
 649{
 650        u32 id = from_kgid(&init_user_ns, gid);
 651        return do_id_to_name(rqstp, IDMAP_TYPE_GROUP, id, name);
 652}
 653
lxr.linux.no kindly hosted by Redpill Linpro AS, provider of Linux consulting and operations services since 1995.