2 * Mapping of UID/GIDs to name and vice versa.
4 * Copyright (c) 2002, 2003 The Regents of the University of
5 * Michigan. All rights reserved.
7 * Marius Aamodt Eriksen <marius@umich.edu>
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. Neither the name of the University nor the names of its
19 * contributors may be used to endorse or promote products derived
20 * from this software without specific prior written permission.
22 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
23 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
24 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
25 * DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
29 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
30 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
31 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
32 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35 #include <linux/module.h>
36 #include <linux/seq_file.h>
37 #include <linux/sched.h>
38 #include <linux/slab.h>
39 #include <linux/sunrpc/svc_xprt.h>
40 #include <net/net_namespace.h>
46 * Turn off idmapping when using AUTH_SYS.
48 static bool nfs4_disable_idmapping
= true;
49 module_param(nfs4_disable_idmapping
, bool, 0644);
50 MODULE_PARM_DESC(nfs4_disable_idmapping
,
51 "Turn off server's NFSv4 idmapping when using 'sec=sys'");
58 * XXX we know that IDMAP_NAMESZ < PAGE_SIZE, but it's ugly to rely on
62 #define IDMAP_TYPE_USER 0
63 #define IDMAP_TYPE_GROUP 1
67 int type
; /* User / Group */
69 char name
[IDMAP_NAMESZ
];
70 char authname
[IDMAP_NAMESZ
];
73 /* Common entry handling */
75 #define ENT_HASHBITS 8
76 #define ENT_HASHMAX (1 << ENT_HASHBITS)
79 ent_init(struct cache_head
*cnew
, struct cache_head
*citm
)
81 struct ent
*new = container_of(cnew
, struct ent
, h
);
82 struct ent
*itm
= container_of(citm
, struct ent
, h
);
85 new->type
= itm
->type
;
87 strlcpy(new->name
, itm
->name
, sizeof(new->name
));
88 strlcpy(new->authname
, itm
->authname
, sizeof(new->name
));
92 ent_put(struct kref
*ref
)
94 struct ent
*map
= container_of(ref
, struct ent
, h
.ref
);
98 static struct cache_head
*
101 struct ent
*e
= kmalloc(sizeof(*e
), GFP_KERNEL
);
113 idtoname_hash(struct ent
*ent
)
117 hash
= hash_str(ent
->authname
, ENT_HASHBITS
);
118 hash
= hash_long(hash
^ ent
->id
, ENT_HASHBITS
);
120 /* Flip LSB for user/group */
121 if (ent
->type
== IDMAP_TYPE_GROUP
)
128 idtoname_request(struct cache_detail
*cd
, struct cache_head
*ch
, char **bpp
,
131 struct ent
*ent
= container_of(ch
, struct ent
, h
);
134 qword_add(bpp
, blen
, ent
->authname
);
135 snprintf(idstr
, sizeof(idstr
), "%u", ent
->id
);
136 qword_add(bpp
, blen
, ent
->type
== IDMAP_TYPE_GROUP
? "group" : "user");
137 qword_add(bpp
, blen
, idstr
);
143 idtoname_match(struct cache_head
*ca
, struct cache_head
*cb
)
145 struct ent
*a
= container_of(ca
, struct ent
, h
);
146 struct ent
*b
= container_of(cb
, struct ent
, h
);
148 return (a
->id
== b
->id
&& a
->type
== b
->type
&&
149 strcmp(a
->authname
, b
->authname
) == 0);
153 idtoname_show(struct seq_file
*m
, struct cache_detail
*cd
, struct cache_head
*h
)
158 seq_puts(m
, "#domain type id [name]\n");
161 ent
= container_of(h
, struct ent
, h
);
162 seq_printf(m
, "%s %s %u", ent
->authname
,
163 ent
->type
== IDMAP_TYPE_GROUP
? "group" : "user",
165 if (test_bit(CACHE_VALID
, &h
->flags
))
166 seq_printf(m
, " %s", ent
->name
);
172 warn_no_idmapd(struct cache_detail
*detail
, int has_died
)
174 printk("nfsd: nfsv4 idmapping failing: has idmapd %s?\n",
175 has_died
? "died" : "not been started");
179 static int idtoname_parse(struct cache_detail
*, char *, int);
180 static struct ent
*idtoname_lookup(struct cache_detail
*, struct ent
*);
181 static struct ent
*idtoname_update(struct cache_detail
*, struct ent
*,
184 static struct cache_detail idtoname_cache_template
= {
185 .owner
= THIS_MODULE
,
186 .hash_size
= ENT_HASHMAX
,
187 .name
= "nfs4.idtoname",
188 .cache_put
= ent_put
,
189 .cache_request
= idtoname_request
,
190 .cache_parse
= idtoname_parse
,
191 .cache_show
= idtoname_show
,
192 .warn_no_listener
= warn_no_idmapd
,
193 .match
= idtoname_match
,
200 idtoname_parse(struct cache_detail
*cd
, char *buf
, int buflen
)
202 struct ent ent
, *res
;
207 if (buf
[buflen
- 1] != '\n')
209 buf
[buflen
- 1]= '\0';
211 buf1
= kmalloc(PAGE_SIZE
, GFP_KERNEL
);
215 memset(&ent
, 0, sizeof(ent
));
217 /* Authentication name */
218 if (qword_get(&buf
, buf1
, PAGE_SIZE
) <= 0)
220 memcpy(ent
.authname
, buf1
, sizeof(ent
.authname
));
223 if (qword_get(&buf
, buf1
, PAGE_SIZE
) <= 0)
225 ent
.type
= strcmp(buf1
, "user") == 0 ?
226 IDMAP_TYPE_USER
: IDMAP_TYPE_GROUP
;
229 if (qword_get(&buf
, buf1
, PAGE_SIZE
) <= 0)
231 ent
.id
= simple_strtoul(buf1
, &bp
, 10);
236 ent
.h
.expiry_time
= get_expiry(&buf
);
237 if (ent
.h
.expiry_time
== 0)
241 res
= idtoname_lookup(cd
, &ent
);
247 len
= qword_get(&buf
, buf1
, PAGE_SIZE
);
251 set_bit(CACHE_NEGATIVE
, &ent
.h
.flags
);
252 else if (len
>= IDMAP_NAMESZ
)
255 memcpy(ent
.name
, buf1
, sizeof(ent
.name
));
257 res
= idtoname_update(cd
, &ent
, res
);
261 cache_put(&res
->h
, cd
);
272 idtoname_lookup(struct cache_detail
*cd
, struct ent
*item
)
274 struct cache_head
*ch
= sunrpc_cache_lookup(cd
, &item
->h
,
275 idtoname_hash(item
));
277 return container_of(ch
, struct ent
, h
);
283 idtoname_update(struct cache_detail
*cd
, struct ent
*new, struct ent
*old
)
285 struct cache_head
*ch
= sunrpc_cache_update(cd
, &new->h
, &old
->h
,
288 return container_of(ch
, struct ent
, h
);
299 nametoid_hash(struct ent
*ent
)
301 return hash_str(ent
->name
, ENT_HASHBITS
);
305 nametoid_request(struct cache_detail
*cd
, struct cache_head
*ch
, char **bpp
,
308 struct ent
*ent
= container_of(ch
, struct ent
, h
);
310 qword_add(bpp
, blen
, ent
->authname
);
311 qword_add(bpp
, blen
, ent
->type
== IDMAP_TYPE_GROUP
? "group" : "user");
312 qword_add(bpp
, blen
, ent
->name
);
318 nametoid_match(struct cache_head
*ca
, struct cache_head
*cb
)
320 struct ent
*a
= container_of(ca
, struct ent
, h
);
321 struct ent
*b
= container_of(cb
, struct ent
, h
);
323 return (a
->type
== b
->type
&& strcmp(a
->name
, b
->name
) == 0 &&
324 strcmp(a
->authname
, b
->authname
) == 0);
328 nametoid_show(struct seq_file
*m
, struct cache_detail
*cd
, struct cache_head
*h
)
333 seq_puts(m
, "#domain type name [id]\n");
336 ent
= container_of(h
, struct ent
, h
);
337 seq_printf(m
, "%s %s %s", ent
->authname
,
338 ent
->type
== IDMAP_TYPE_GROUP
? "group" : "user",
340 if (test_bit(CACHE_VALID
, &h
->flags
))
341 seq_printf(m
, " %u", ent
->id
);
346 static struct ent
*nametoid_lookup(struct cache_detail
*, struct ent
*);
347 static struct ent
*nametoid_update(struct cache_detail
*, struct ent
*,
349 static int nametoid_parse(struct cache_detail
*, char *, int);
351 static struct cache_detail nametoid_cache_template
= {
352 .owner
= THIS_MODULE
,
353 .hash_size
= ENT_HASHMAX
,
354 .name
= "nfs4.nametoid",
355 .cache_put
= ent_put
,
356 .cache_request
= nametoid_request
,
357 .cache_parse
= nametoid_parse
,
358 .cache_show
= nametoid_show
,
359 .warn_no_listener
= warn_no_idmapd
,
360 .match
= nametoid_match
,
367 nametoid_parse(struct cache_detail
*cd
, char *buf
, int buflen
)
369 struct ent ent
, *res
;
373 if (buf
[buflen
- 1] != '\n')
375 buf
[buflen
- 1]= '\0';
377 buf1
= kmalloc(PAGE_SIZE
, GFP_KERNEL
);
381 memset(&ent
, 0, sizeof(ent
));
383 /* Authentication name */
384 if (qword_get(&buf
, buf1
, PAGE_SIZE
) <= 0)
386 memcpy(ent
.authname
, buf1
, sizeof(ent
.authname
));
389 if (qword_get(&buf
, buf1
, PAGE_SIZE
) <= 0)
391 ent
.type
= strcmp(buf1
, "user") == 0 ?
392 IDMAP_TYPE_USER
: IDMAP_TYPE_GROUP
;
395 error
= qword_get(&buf
, buf1
, PAGE_SIZE
);
396 if (error
<= 0 || error
>= IDMAP_NAMESZ
)
398 memcpy(ent
.name
, buf1
, sizeof(ent
.name
));
401 ent
.h
.expiry_time
= get_expiry(&buf
);
402 if (ent
.h
.expiry_time
== 0)
406 error
= get_int(&buf
, &ent
.id
);
407 if (error
== -EINVAL
)
409 if (error
== -ENOENT
)
410 set_bit(CACHE_NEGATIVE
, &ent
.h
.flags
);
413 res
= nametoid_lookup(cd
, &ent
);
416 res
= nametoid_update(cd
, &ent
, res
);
420 cache_put(&res
->h
, cd
);
430 nametoid_lookup(struct cache_detail
*cd
, struct ent
*item
)
432 struct cache_head
*ch
= sunrpc_cache_lookup(cd
, &item
->h
,
433 nametoid_hash(item
));
435 return container_of(ch
, struct ent
, h
);
441 nametoid_update(struct cache_detail
*cd
, struct ent
*new, struct ent
*old
)
443 struct cache_head
*ch
= sunrpc_cache_update(cd
, &new->h
, &old
->h
,
446 return container_of(ch
, struct ent
, h
);
456 nfsd_idmap_init(struct net
*net
)
459 struct nfsd_net
*nn
= net_generic(net
, nfsd_net_id
);
461 nn
->idtoname_cache
= cache_create_net(&idtoname_cache_template
, net
);
462 if (IS_ERR(nn
->idtoname_cache
))
463 return PTR_ERR(nn
->idtoname_cache
);
464 rv
= cache_register_net(nn
->idtoname_cache
, net
);
466 goto destroy_idtoname_cache
;
467 nn
->nametoid_cache
= cache_create_net(&nametoid_cache_template
, net
);
468 if (IS_ERR(nn
->nametoid_cache
)) {
469 rv
= PTR_ERR(nn
->nametoid_cache
);
470 goto unregister_idtoname_cache
;
472 rv
= cache_register_net(nn
->nametoid_cache
, net
);
474 goto destroy_nametoid_cache
;
477 destroy_nametoid_cache
:
478 cache_destroy_net(nn
->nametoid_cache
, net
);
479 unregister_idtoname_cache
:
480 cache_unregister_net(nn
->idtoname_cache
, net
);
481 destroy_idtoname_cache
:
482 cache_destroy_net(nn
->idtoname_cache
, net
);
487 nfsd_idmap_shutdown(struct net
*net
)
489 struct nfsd_net
*nn
= net_generic(net
, nfsd_net_id
);
491 cache_unregister_net(nn
->idtoname_cache
, net
);
492 cache_unregister_net(nn
->nametoid_cache
, net
);
493 cache_destroy_net(nn
->idtoname_cache
, net
);
494 cache_destroy_net(nn
->nametoid_cache
, net
);
498 idmap_lookup(struct svc_rqst
*rqstp
,
499 struct ent
*(*lookup_fn
)(struct cache_detail
*, struct ent
*),
500 struct ent
*key
, struct cache_detail
*detail
, struct ent
**item
)
504 *item
= lookup_fn(detail
, key
);
508 ret
= cache_check(detail
, &(*item
)->h
, &rqstp
->rq_chandle
);
510 if (ret
== -ETIMEDOUT
) {
511 struct ent
*prev_item
= *item
;
512 *item
= lookup_fn(detail
, key
);
513 if (*item
!= prev_item
)
515 cache_put(&(*item
)->h
, detail
);
521 rqst_authname(struct svc_rqst
*rqstp
)
523 struct auth_domain
*clp
;
525 clp
= rqstp
->rq_gssclient
? rqstp
->rq_gssclient
: rqstp
->rq_client
;
530 idmap_name_to_id(struct svc_rqst
*rqstp
, int type
, const char *name
, u32 namelen
,
533 struct ent
*item
, key
= {
537 struct nfsd_net
*nn
= net_generic(SVC_NET(rqstp
), nfsd_net_id
);
539 if (namelen
+ 1 > sizeof(key
.name
))
540 return nfserr_badowner
;
541 memcpy(key
.name
, name
, namelen
);
542 key
.name
[namelen
] = '\0';
543 strlcpy(key
.authname
, rqst_authname(rqstp
), sizeof(key
.authname
));
544 ret
= idmap_lookup(rqstp
, nametoid_lookup
, &key
, nn
->nametoid_cache
, &item
);
546 return nfserr_badowner
;
548 return nfserrno(ret
);
550 cache_put(&item
->h
, nn
->nametoid_cache
);
554 static __be32
encode_ascii_id(u32 id
, __be32
**p
, int *buflen
)
560 len
= sprintf(buf
, "%u", id
);
561 bytes
= 4 + (XDR_QUADLEN(len
) << 2);
563 return nfserr_resource
;
564 *p
= xdr_encode_opaque(*p
, buf
, len
);
569 static __be32
idmap_id_to_name(struct svc_rqst
*rqstp
, int type
, u32 id
, __be32
**p
, int *buflen
)
571 struct ent
*item
, key
= {
577 struct nfsd_net
*nn
= net_generic(SVC_NET(rqstp
), nfsd_net_id
);
579 strlcpy(key
.authname
, rqst_authname(rqstp
), sizeof(key
.authname
));
580 ret
= idmap_lookup(rqstp
, idtoname_lookup
, &key
, nn
->idtoname_cache
, &item
);
582 return encode_ascii_id(id
, p
, buflen
);
584 return nfserrno(ret
);
585 ret
= strlen(item
->name
);
586 WARN_ON_ONCE(ret
> IDMAP_NAMESZ
);
587 bytes
= 4 + (XDR_QUADLEN(ret
) << 2);
589 return nfserr_resource
;
590 *p
= xdr_encode_opaque(*p
, item
->name
, ret
);
592 cache_put(&item
->h
, nn
->idtoname_cache
);
597 numeric_name_to_id(struct svc_rqst
*rqstp
, int type
, const char *name
, u32 namelen
, u32
*id
)
602 if (namelen
+ 1 > sizeof(buf
))
603 /* too long to represent a 32-bit id: */
605 /* Just to make sure it's null-terminated: */
606 memcpy(buf
, name
, namelen
);
608 ret
= kstrtouint(buf
, 10, id
);
613 do_name_to_id(struct svc_rqst
*rqstp
, int type
, const char *name
, u32 namelen
, u32
*id
)
615 if (nfs4_disable_idmapping
&& rqstp
->rq_cred
.cr_flavor
< RPC_AUTH_GSS
)
616 if (numeric_name_to_id(rqstp
, type
, name
, namelen
, id
))
619 * otherwise, fall through and try idmapping, for
620 * backwards compatibility with clients sending names:
622 return idmap_name_to_id(rqstp
, type
, name
, namelen
, id
);
625 static __be32
encode_name_from_id(struct svc_rqst
*rqstp
, int type
, u32 id
, __be32
**p
, int *buflen
)
627 if (nfs4_disable_idmapping
&& rqstp
->rq_cred
.cr_flavor
< RPC_AUTH_GSS
)
628 return encode_ascii_id(id
, p
, buflen
);
629 return idmap_id_to_name(rqstp
, type
, id
, p
, buflen
);
633 nfsd_map_name_to_uid(struct svc_rqst
*rqstp
, const char *name
, size_t namelen
,
638 status
= do_name_to_id(rqstp
, IDMAP_TYPE_USER
, name
, namelen
, &id
);
639 *uid
= make_kuid(&init_user_ns
, id
);
640 if (!uid_valid(*uid
))
641 status
= nfserr_badowner
;
646 nfsd_map_name_to_gid(struct svc_rqst
*rqstp
, const char *name
, size_t namelen
,
651 status
= do_name_to_id(rqstp
, IDMAP_TYPE_GROUP
, name
, namelen
, &id
);
652 *gid
= make_kgid(&init_user_ns
, id
);
653 if (!gid_valid(*gid
))
654 status
= nfserr_badowner
;
658 __be32
nfsd4_encode_user(struct svc_rqst
*rqstp
, kuid_t uid
, __be32
**p
, int *buflen
)
660 u32 id
= from_kuid(&init_user_ns
, uid
);
661 return encode_name_from_id(rqstp
, IDMAP_TYPE_USER
, id
, p
, buflen
);
664 __be32
nfsd4_encode_group(struct svc_rqst
*rqstp
, kgid_t gid
, __be32
**p
, int *buflen
)
666 u32 id
= from_kgid(&init_user_ns
, gid
);
667 return encode_name_from_id(rqstp
, IDMAP_TYPE_GROUP
, id
, p
, buflen
);