nfs4idmap.c 19.5 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35
/*
 * fs/nfs/idmap.c
 *
 *  UID and GID to name mapping for clients.
 *
 *  Copyright (c) 2002 The Regents of the University of Michigan.
 *  All rights reserved.
 *
 *  Marius Aamodt Eriksen <marius@umich.edu>
 *
 *  Redistribution and use in source and binary forms, with or without
 *  modification, are permitted provided that the following conditions
 *  are met:
 *
 *  1. Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 *  2. Redistributions in binary form must reproduce the above copyright
 *     notice, this list of conditions and the following disclaimer in the
 *     documentation and/or other materials provided with the distribution.
 *  3. Neither the name of the University nor the names of its
 *     contributors may be used to endorse or promote products derived
 *     from this software without specific prior written permission.
 *
 *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
 *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
36
#include <linux/types.h>
37 38 39 40
#include <linux/parser.h>
#include <linux/fs.h>
#include <net/net_namespace.h>
#include <linux/sunrpc/rpc_pipe_fs.h>
41
#include <linux/nfs_fs.h>
42
#include <linux/nfs_fs_sb.h>
43
#include <linux/key.h>
44 45 46
#include <linux/keyctl.h>
#include <linux/key-type.h>
#include <keys/user-type.h>
47
#include <keys/request_key_auth-type.h>
48
#include <linux/module.h>
49

50
#include "internal.h"
51
#include "netns.h"
52
#include "nfs4idmap.h"
53
#include "nfs4trace.h"
54 55 56

#define NFS_UINT_MAXLEN 11

57 58
static const struct cred *id_resolver_cache;
static struct key_type key_type_id_resolver_legacy;
59

60 61 62
struct idmap_legacy_upcalldata {
	struct rpc_pipe_msg pipe_msg;
	struct idmap_msg idmap_msg;
63
	struct key	*authkey;
64 65 66
	struct idmap *idmap;
};

67
struct idmap {
68
	struct rpc_pipe_dir_object idmap_pdo;
69 70 71 72 73
	struct rpc_pipe		*idmap_pipe;
	struct idmap_legacy_upcalldata *idmap_upcall_data;
	struct mutex		idmap_mutex;
};

74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102
/**
 * nfs_fattr_init_names - initialise the nfs_fattr owner_name/group_name fields
 * @fattr: fully initialised struct nfs_fattr
 * @owner_name: owner name string cache
 * @group_name: group name string cache
 */
void nfs_fattr_init_names(struct nfs_fattr *fattr,
		struct nfs4_string *owner_name,
		struct nfs4_string *group_name)
{
	fattr->owner_name = owner_name;
	fattr->group_name = group_name;
}

static void nfs_fattr_free_owner_name(struct nfs_fattr *fattr)
{
	fattr->valid &= ~NFS_ATTR_FATTR_OWNER_NAME;
	kfree(fattr->owner_name->data);
}

static void nfs_fattr_free_group_name(struct nfs_fattr *fattr)
{
	fattr->valid &= ~NFS_ATTR_FATTR_GROUP_NAME;
	kfree(fattr->group_name->data);
}

static bool nfs_fattr_map_owner_name(struct nfs_server *server, struct nfs_fattr *fattr)
{
	struct nfs4_string *owner = fattr->owner_name;
103
	kuid_t uid;
104 105 106 107 108 109 110 111 112 113 114 115 116

	if (!(fattr->valid & NFS_ATTR_FATTR_OWNER_NAME))
		return false;
	if (nfs_map_name_to_uid(server, owner->data, owner->len, &uid) == 0) {
		fattr->uid = uid;
		fattr->valid |= NFS_ATTR_FATTR_OWNER;
	}
	return true;
}

static bool nfs_fattr_map_group_name(struct nfs_server *server, struct nfs_fattr *fattr)
{
	struct nfs4_string *group = fattr->group_name;
117
	kgid_t gid;
118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154

	if (!(fattr->valid & NFS_ATTR_FATTR_GROUP_NAME))
		return false;
	if (nfs_map_group_to_gid(server, group->data, group->len, &gid) == 0) {
		fattr->gid = gid;
		fattr->valid |= NFS_ATTR_FATTR_GROUP;
	}
	return true;
}

/**
 * nfs_fattr_free_names - free up the NFSv4 owner and group strings
 * @fattr: a fully initialised nfs_fattr structure
 */
void nfs_fattr_free_names(struct nfs_fattr *fattr)
{
	if (fattr->valid & NFS_ATTR_FATTR_OWNER_NAME)
		nfs_fattr_free_owner_name(fattr);
	if (fattr->valid & NFS_ATTR_FATTR_GROUP_NAME)
		nfs_fattr_free_group_name(fattr);
}

/**
 * nfs_fattr_map_and_free_names - map owner/group strings into uid/gid and free
 * @server: pointer to the filesystem nfs_server structure
 * @fattr: a fully initialised nfs_fattr structure
 *
 * This helper maps the cached NFSv4 owner/group strings in fattr into
 * their numeric uid/gid equivalents, and then frees the cached strings.
 */
void nfs_fattr_map_and_free_names(struct nfs_server *server, struct nfs_fattr *fattr)
{
	if (nfs_fattr_map_owner_name(server, fattr))
		nfs_fattr_free_owner_name(fattr);
	if (nfs_fattr_map_group_name(server, fattr))
		nfs_fattr_free_group_name(fattr);
}
155

156
int nfs_map_string_to_numeric(const char *name, size_t namelen, __u32 *res)
157 158 159 160 161 162 163 164
{
	unsigned long val;
	char buf[16];

	if (memchr(name, '@', namelen) != NULL || namelen >= sizeof(buf))
		return 0;
	memcpy(buf, name, namelen);
	buf[namelen] = '\0';
165
	if (kstrtoul(buf, 0, &val) != 0)
166 167 168 169
		return 0;
	*res = val;
	return 1;
}
170
EXPORT_SYMBOL_GPL(nfs_map_string_to_numeric);
Linus Torvalds's avatar
Linus Torvalds committed
171

172 173 174 175 176
static int nfs_map_numeric_to_string(__u32 id, char *buf, size_t buflen)
{
	return snprintf(buf, buflen, "%u", id);
}

177
static struct key_type key_type_id_resolver = {
Bryan Schumaker's avatar
Bryan Schumaker committed
178
	.name		= "id_resolver",
179 180 181
	.preparse	= user_preparse,
	.free_preparse	= user_free_preparse,
	.instantiate	= generic_key_instantiate,
Bryan Schumaker's avatar
Bryan Schumaker committed
182 183 184 185 186 187
	.revoke		= user_revoke,
	.destroy	= user_destroy,
	.describe	= user_describe,
	.read		= user_read,
};

188
int nfs_idmap_init(void)
Bryan Schumaker's avatar
Bryan Schumaker committed
189 190 191 192 193
{
	struct cred *cred;
	struct key *keyring;
	int ret = 0;

194 195
	printk(KERN_NOTICE "NFS: Registering the %s key type\n",
		key_type_id_resolver.name);
Bryan Schumaker's avatar
Bryan Schumaker committed
196 197 198 199 200

	cred = prepare_kernel_cred(NULL);
	if (!cred)
		return -ENOMEM;

201 202
	keyring = keyring_alloc(".id_resolver",
				GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,
203 204
				(KEY_POS_ALL & ~KEY_POS_SETATTR) |
				KEY_USR_VIEW | KEY_USR_READ,
205
				KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
Bryan Schumaker's avatar
Bryan Schumaker committed
206 207 208 209 210 211 212 213 214
	if (IS_ERR(keyring)) {
		ret = PTR_ERR(keyring);
		goto failed_put_cred;
	}

	ret = register_key_type(&key_type_id_resolver);
	if (ret < 0)
		goto failed_put_key;

215 216 217 218
	ret = register_key_type(&key_type_id_resolver_legacy);
	if (ret < 0)
		goto failed_reg_legacy;

219
	set_bit(KEY_FLAG_ROOT_CAN_CLEAR, &keyring->flags);
Bryan Schumaker's avatar
Bryan Schumaker committed
220 221 222 223 224
	cred->thread_keyring = keyring;
	cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
	id_resolver_cache = cred;
	return 0;

225 226
failed_reg_legacy:
	unregister_key_type(&key_type_id_resolver);
Bryan Schumaker's avatar
Bryan Schumaker committed
227 228 229 230 231 232 233
failed_put_key:
	key_put(keyring);
failed_put_cred:
	put_cred(cred);
	return ret;
}

234
void nfs_idmap_quit(void)
Bryan Schumaker's avatar
Bryan Schumaker committed
235 236 237
{
	key_revoke(id_resolver_cache->thread_keyring);
	unregister_key_type(&key_type_id_resolver);
238
	unregister_key_type(&key_type_id_resolver_legacy);
Bryan Schumaker's avatar
Bryan Schumaker committed
239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255
	put_cred(id_resolver_cache);
}

/*
 * Assemble the description to pass to request_key()
 * This function will allocate a new string and update dest to point
 * at it.  The caller is responsible for freeing dest.
 *
 * On error 0 is returned.  Otherwise, the length of dest is returned.
 */
static ssize_t nfs_idmap_get_desc(const char *name, size_t namelen,
				const char *type, size_t typelen, char **desc)
{
	char *cp;
	size_t desclen = typelen + namelen + 2;

	*desc = kmalloc(desclen, GFP_KERNEL);
256
	if (!*desc)
Bryan Schumaker's avatar
Bryan Schumaker committed
257 258 259 260 261 262 263 264 265 266 267 268 269
		return -ENOMEM;

	cp = *desc;
	memcpy(cp, type, typelen);
	cp += typelen;
	*cp++ = ':';

	memcpy(cp, name, namelen);
	cp += namelen;
	*cp = '\0';
	return desclen;
}

270 271
static struct key *nfs_idmap_request_key(const char *name, size_t namelen,
					 const char *type, struct idmap *idmap)
Bryan Schumaker's avatar
Bryan Schumaker committed
272 273
{
	char *desc;
274
	struct key *rkey;
Bryan Schumaker's avatar
Bryan Schumaker committed
275 276 277
	ssize_t ret;

	ret = nfs_idmap_get_desc(name, namelen, type, strlen(type), &desc);
278
	if (ret < 0)
279 280 281 282 283 284 285 286 287
		return ERR_PTR(ret);

	rkey = request_key(&key_type_id_resolver, desc, "");
	if (IS_ERR(rkey)) {
		mutex_lock(&idmap->idmap_mutex);
		rkey = request_key_with_auxdata(&key_type_id_resolver_legacy,
						desc, "", 0, idmap);
		mutex_unlock(&idmap->idmap_mutex);
	}
288 289
	if (!IS_ERR(rkey))
		set_bit(KEY_FLAG_ROOT_CAN_INVAL, &rkey->flags);
290 291 292 293 294 295 296 297 298 299 300

	kfree(desc);
	return rkey;
}

static ssize_t nfs_idmap_get_key(const char *name, size_t namelen,
				 const char *type, void *data,
				 size_t data_size, struct idmap *idmap)
{
	const struct cred *saved_cred;
	struct key *rkey;
301
	const struct user_key_payload *payload;
302
	ssize_t ret;
Bryan Schumaker's avatar
Bryan Schumaker committed
303 304

	saved_cred = override_creds(id_resolver_cache);
305
	rkey = nfs_idmap_request_key(name, namelen, type, idmap);
Bryan Schumaker's avatar
Bryan Schumaker committed
306
	revert_creds(saved_cred);
307

Bryan Schumaker's avatar
Bryan Schumaker committed
308 309 310 311 312 313 314 315 316 317 318 319
	if (IS_ERR(rkey)) {
		ret = PTR_ERR(rkey);
		goto out;
	}

	rcu_read_lock();
	rkey->perm |= KEY_USR_VIEW;

	ret = key_validate(rkey);
	if (ret < 0)
		goto out_up;

320
	payload = user_key_payload_rcu(rkey);
Bryan Schumaker's avatar
Bryan Schumaker committed
321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339
	if (IS_ERR_OR_NULL(payload)) {
		ret = PTR_ERR(payload);
		goto out_up;
	}

	ret = payload->datalen;
	if (ret > 0 && ret <= data_size)
		memcpy(data, payload->data, ret);
	else
		ret = -EINVAL;

out_up:
	rcu_read_unlock();
	key_put(rkey);
out:
	return ret;
}

/* ID -> Name */
340 341
static ssize_t nfs_idmap_lookup_name(__u32 id, const char *type, char *buf,
				     size_t buflen, struct idmap *idmap)
Bryan Schumaker's avatar
Bryan Schumaker committed
342 343 344 345 346
{
	char id_str[NFS_UINT_MAXLEN];
	int id_len;
	ssize_t ret;

347
	id_len = nfs_map_numeric_to_string(id, id_str, sizeof(id_str));
348
	ret = nfs_idmap_get_key(id_str, id_len, type, buf, buflen, idmap);
Bryan Schumaker's avatar
Bryan Schumaker committed
349 350 351 352 353 354
	if (ret < 0)
		return -EINVAL;
	return ret;
}

/* Name -> ID */
355 356
static int nfs_idmap_lookup_id(const char *name, size_t namelen, const char *type,
			       __u32 *id, struct idmap *idmap)
Bryan Schumaker's avatar
Bryan Schumaker committed
357 358 359 360 361 362
{
	char id_str[NFS_UINT_MAXLEN];
	long id_long;
	ssize_t data_size;
	int ret = 0;

363
	data_size = nfs_idmap_get_key(name, namelen, type, id_str, NFS_UINT_MAXLEN, idmap);
Bryan Schumaker's avatar
Bryan Schumaker committed
364 365 366
	if (data_size <= 0) {
		ret = -EINVAL;
	} else {
367
		ret = kstrtol(id_str, 10, &id_long);
368 369
		if (!ret)
			*id = (__u32)id_long;
Bryan Schumaker's avatar
Bryan Schumaker committed
370 371 372 373
	}
	return ret;
}

374
/* idmap classic begins here */
375

376 377
enum {
	Opt_find_uid, Opt_find_gid, Opt_find_user, Opt_find_group, Opt_find_err
Linus Torvalds's avatar
Linus Torvalds committed
378 379
};

380 381 382 383 384 385
static const match_table_t nfs_idmap_tokens = {
	{ Opt_find_uid, "uid:%s" },
	{ Opt_find_gid, "gid:%s" },
	{ Opt_find_user, "user:%s" },
	{ Opt_find_group, "group:%s" },
	{ Opt_find_err, NULL }
Linus Torvalds's avatar
Linus Torvalds committed
386 387
};

388
static int nfs_idmap_legacy_upcall(struct key *, void *);
389 390
static ssize_t idmap_pipe_downcall(struct file *, const char __user *,
				   size_t);
391
static void idmap_release_pipe(struct inode *);
392
static void idmap_pipe_destroy_msg(struct rpc_pipe_msg *);
Linus Torvalds's avatar
Linus Torvalds committed
393

394
static const struct rpc_pipe_ops idmap_upcall_ops = {
395
	.upcall		= rpc_pipe_generic_upcall,
396
	.downcall	= idmap_pipe_downcall,
397
	.release_pipe	= idmap_release_pipe,
398
	.destroy_msg	= idmap_pipe_destroy_msg,
Linus Torvalds's avatar
Linus Torvalds committed
399 400
};

401
static struct key_type key_type_id_resolver_legacy = {
402
	.name		= "id_legacy",
403 404 405
	.preparse	= user_preparse,
	.free_preparse	= user_free_preparse,
	.instantiate	= generic_key_instantiate,
406 407 408 409 410 411 412
	.revoke		= user_revoke,
	.destroy	= user_destroy,
	.describe	= user_describe,
	.read		= user_read,
	.request_key	= nfs_idmap_legacy_upcall,
};

413 414
static void nfs_idmap_pipe_destroy(struct dentry *dir,
		struct rpc_pipe_dir_object *pdo)
415
{
416 417 418
	struct idmap *idmap = pdo->pdo_data;
	struct rpc_pipe *pipe = idmap->idmap_pipe;

419
	if (pipe->dentry) {
420
		rpc_unlink(pipe->dentry);
421 422
		pipe->dentry = NULL;
	}
423 424
}

425 426
static int nfs_idmap_pipe_create(struct dentry *dir,
		struct rpc_pipe_dir_object *pdo)
427
{
428 429
	struct idmap *idmap = pdo->pdo_data;
	struct rpc_pipe *pipe = idmap->idmap_pipe;
430 431 432 433 434 435 436 437 438
	struct dentry *dentry;

	dentry = rpc_mkpipe_dentry(dir, "idmap", idmap, pipe);
	if (IS_ERR(dentry))
		return PTR_ERR(dentry);
	pipe->dentry = dentry;
	return 0;
}

439 440 441 442
static const struct rpc_pipe_dir_object_ops nfs_idmap_pipe_dir_object_ops = {
	.create = nfs_idmap_pipe_create,
	.destroy = nfs_idmap_pipe_destroy,
};
443

444
int
445
nfs_idmap_new(struct nfs_client *clp)
Linus Torvalds's avatar
Linus Torvalds committed
446 447
{
	struct idmap *idmap;
448
	struct rpc_pipe *pipe;
449
	int error;
Linus Torvalds's avatar
Linus Torvalds committed
450

451 452 453
	idmap = kzalloc(sizeof(*idmap), GFP_KERNEL);
	if (idmap == NULL)
		return -ENOMEM;
Linus Torvalds's avatar
Linus Torvalds committed
454

455 456 457 458
	rpc_init_pipe_dir_object(&idmap->idmap_pdo,
			&nfs_idmap_pipe_dir_object_ops,
			idmap);

459 460 461
	pipe = rpc_mkpipe_data(&idmap_upcall_ops, 0);
	if (IS_ERR(pipe)) {
		error = PTR_ERR(pipe);
462
		goto err;
463 464
	}
	idmap->idmap_pipe = pipe;
465
	mutex_init(&idmap->idmap_mutex);
Linus Torvalds's avatar
Linus Torvalds committed
466

467 468 469 470 471 472
	error = rpc_add_pipe_dir_object(clp->cl_net,
			&clp->cl_rpcclient->cl_pipedir_objects,
			&idmap->idmap_pdo);
	if (error)
		goto err_destroy_pipe;

Linus Torvalds's avatar
Linus Torvalds committed
473
	clp->cl_idmap = idmap;
474
	return 0;
475 476 477 478 479
err_destroy_pipe:
	rpc_destroy_pipe_data(idmap->idmap_pipe);
err:
	kfree(idmap);
	return error;
Linus Torvalds's avatar
Linus Torvalds committed
480 481 482
}

void
483
nfs_idmap_delete(struct nfs_client *clp)
Linus Torvalds's avatar
Linus Torvalds committed
484 485 486 487 488 489
{
	struct idmap *idmap = clp->cl_idmap;

	if (!idmap)
		return;
	clp->cl_idmap = NULL;
490 491 492 493
	rpc_remove_pipe_dir_object(clp->cl_net,
			&clp->cl_rpcclient->cl_pipedir_objects,
			&idmap->idmap_pdo);
	rpc_destroy_pipe_data(idmap->idmap_pipe);
Linus Torvalds's avatar
Linus Torvalds committed
494 495 496
	kfree(idmap);
}

497 498
static int nfs_idmap_prepare_message(char *desc, struct idmap *idmap,
				     struct idmap_msg *im,
499
				     struct rpc_pipe_msg *msg)
Linus Torvalds's avatar
Linus Torvalds committed
500
{
501 502
	substring_t substr;
	int token, ret;
Linus Torvalds's avatar
Linus Torvalds committed
503

504 505
	im->im_type = IDMAP_TYPE_GROUP;
	token = match_token(desc, nfs_idmap_tokens, &substr);
Linus Torvalds's avatar
Linus Torvalds committed
506

507 508 509
	switch (token) {
	case Opt_find_uid:
		im->im_type = IDMAP_TYPE_USER;
510
		/* Fall through */
511 512 513 514
	case Opt_find_gid:
		im->im_conv = IDMAP_CONV_NAMETOID;
		ret = match_strlcpy(im->im_name, &substr, IDMAP_NAMESZ);
		break;
Linus Torvalds's avatar
Linus Torvalds committed
515

516 517
	case Opt_find_user:
		im->im_type = IDMAP_TYPE_USER;
518
		/* Fall through */
519 520 521
	case Opt_find_group:
		im->im_conv = IDMAP_CONV_IDTONAME;
		ret = match_int(&substr, &im->im_id);
522 523
		if (ret)
			goto out;
524
		break;
Linus Torvalds's avatar
Linus Torvalds committed
525

526 527
	default:
		ret = -EINVAL;
Linus Torvalds's avatar
Linus Torvalds committed
528 529 530
		goto out;
	}

531 532
	msg->data = im;
	msg->len  = sizeof(struct idmap_msg);
Linus Torvalds's avatar
Linus Torvalds committed
533

534
out:
535
	return ret;
Linus Torvalds's avatar
Linus Torvalds committed
536 537
}

538 539
static bool
nfs_idmap_prepare_pipe_upcall(struct idmap *idmap,
540
		struct idmap_legacy_upcalldata *data)
541
{
542
	if (idmap->idmap_upcall_data != NULL) {
543 544 545
		WARN_ON_ONCE(1);
		return false;
	}
546
	idmap->idmap_upcall_data = data;
547 548 549 550 551 552
	return true;
}

static void
nfs_idmap_complete_pipe_upcall_locked(struct idmap *idmap, int ret)
{
553
	struct key *authkey = idmap->idmap_upcall_data->authkey;
554

555 556
	kfree(idmap->idmap_upcall_data);
	idmap->idmap_upcall_data = NULL;
557 558
	complete_request_key(authkey, ret);
	key_put(authkey);
559 560 561 562 563
}

static void
nfs_idmap_abort_pipe_upcall(struct idmap *idmap, int ret)
{
564
	if (idmap->idmap_upcall_data != NULL)
565 566 567
		nfs_idmap_complete_pipe_upcall_locked(idmap, ret);
}

568
static int nfs_idmap_legacy_upcall(struct key *authkey, void *aux)
Linus Torvalds's avatar
Linus Torvalds committed
569
{
570
	struct idmap_legacy_upcalldata *data;
571
	struct request_key_auth *rka = get_request_key_auth(authkey);
572
	struct rpc_pipe_msg *msg;
Linus Torvalds's avatar
Linus Torvalds committed
573
	struct idmap_msg *im;
574
	struct idmap *idmap = (struct idmap *)aux;
575
	struct key *key = rka->target_key;
576 577 578 579
	int ret = -ENOKEY;

	if (!aux)
		goto out1;
Linus Torvalds's avatar
Linus Torvalds committed
580

581
	/* msg and im are freed in idmap_pipe_destroy_msg */
582
	ret = -ENOMEM;
583
	data = kzalloc(sizeof(*data), GFP_KERNEL);
584
	if (!data)
585
		goto out1;
Linus Torvalds's avatar
Linus Torvalds committed
586

587 588 589
	msg = &data->pipe_msg;
	im = &data->idmap_msg;
	data->idmap = idmap;
590
	data->authkey = key_get(authkey);
591 592

	ret = nfs_idmap_prepare_message(key->description, idmap, im, msg);
593 594
	if (ret < 0)
		goto out2;
Linus Torvalds's avatar
Linus Torvalds committed
595

596
	ret = -EAGAIN;
597
	if (!nfs_idmap_prepare_pipe_upcall(idmap, data))
598
		goto out2;
Linus Torvalds's avatar
Linus Torvalds committed
599

600 601
	ret = rpc_queue_upcall(idmap->idmap_pipe, msg);
	if (ret < 0)
602
		nfs_idmap_abort_pipe_upcall(idmap, ret);
Linus Torvalds's avatar
Linus Torvalds committed
603

604
	return ret;
605
out2:
606
	kfree(data);
607
out1:
608
	complete_request_key(authkey, ret);
609
	return ret;
Linus Torvalds's avatar
Linus Torvalds committed
610 611
}

612
static int nfs_idmap_instantiate(struct key *key, struct key *authkey, char *data, size_t datalen)
Linus Torvalds's avatar
Linus Torvalds committed
613
{
614
	return key_instantiate_and_link(key, data, datalen,
615 616 617
					id_resolver_cache->thread_keyring,
					authkey);
}
Linus Torvalds's avatar
Linus Torvalds committed
618

619 620 621
static int nfs_idmap_read_and_verify_message(struct idmap_msg *im,
		struct idmap_msg *upcall,
		struct key *key, struct key *authkey)
622 623
{
	char id_str[NFS_UINT_MAXLEN];
624
	size_t len;
625
	int ret = -ENOKEY;
Linus Torvalds's avatar
Linus Torvalds committed
626

627 628 629
	/* ret = -ENOKEY */
	if (upcall->im_type != im->im_type || upcall->im_conv != im->im_conv)
		goto out;
630 631
	switch (im->im_conv) {
	case IDMAP_CONV_NAMETOID:
632 633
		if (strcmp(upcall->im_name, im->im_name) != 0)
			break;
634
		/* Note: here we store the NUL terminator too */
635 636
		len = 1 + nfs_map_numeric_to_string(im->im_id, id_str,
						    sizeof(id_str));
637
		ret = nfs_idmap_instantiate(key, authkey, id_str, len);
638 639
		break;
	case IDMAP_CONV_IDTONAME:
640 641
		if (upcall->im_id != im->im_id)
			break;
642 643
		len = strlen(im->im_name);
		ret = nfs_idmap_instantiate(key, authkey, im->im_name, len);
644
		break;
645 646
	default:
		ret = -EINVAL;
Linus Torvalds's avatar
Linus Torvalds committed
647
	}
648
out:
Linus Torvalds's avatar
Linus Torvalds committed
649 650 651 652 653 654
	return ret;
}

static ssize_t
idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
{
655
	struct request_key_auth *rka;
Al Viro's avatar
Al Viro committed
656
	struct rpc_inode *rpci = RPC_I(file_inode(filp));
Linus Torvalds's avatar
Linus Torvalds committed
657
	struct idmap *idmap = (struct idmap *)rpci->private;
658
	struct key *authkey;
659
	struct idmap_msg im;
660
	size_t namelen_in;
661
	int ret = -ENOKEY;
Linus Torvalds's avatar
Linus Torvalds committed
662

663 664 665 666
	/* If instantiation is successful, anyone waiting for key construction
	 * will have been woken up and someone else may now have used
	 * idmap_key_cons - so after this point we may no longer touch it.
	 */
667
	if (idmap->idmap_upcall_data == NULL)
668
		goto out_noupcall;
669

670 671
	authkey = idmap->idmap_upcall_data->authkey;
	rka = get_request_key_auth(authkey);
672

673 674
	if (mlen != sizeof(im)) {
		ret = -ENOSPC;
Linus Torvalds's avatar
Linus Torvalds committed
675 676 677
		goto out;
	}

678 679
	if (copy_from_user(&im, src, mlen) != 0) {
		ret = -EFAULT;
Linus Torvalds's avatar
Linus Torvalds committed
680
		goto out;
681
	}
Linus Torvalds's avatar
Linus Torvalds committed
682

683
	if (!(im.im_status & IDMAP_STATUS_SUCCESS)) {
684 685
		ret = -ENOKEY;
		goto out;
Linus Torvalds's avatar
Linus Torvalds committed
686 687
	}

688 689 690
	namelen_in = strnlen(im.im_name, IDMAP_NAMESZ);
	if (namelen_in == 0 || namelen_in == IDMAP_NAMESZ) {
		ret = -EINVAL;
Linus Torvalds's avatar
Linus Torvalds committed
691
		goto out;
692
}
Linus Torvalds's avatar
Linus Torvalds committed
693

694 695
	ret = nfs_idmap_read_and_verify_message(&im,
			&idmap->idmap_upcall_data->idmap_msg,
696
			rka->target_key, authkey);
697
	if (ret >= 0) {
698
		key_set_timeout(rka->target_key, nfs_idmap_cache_timeout);
699 700 701
		ret = mlen;
	}

Linus Torvalds's avatar
Linus Torvalds committed
702
out:
703 704
	nfs_idmap_complete_pipe_upcall_locked(idmap, ret);
out_noupcall:
Linus Torvalds's avatar
Linus Torvalds committed
705 706 707
	return ret;
}

708
static void
Linus Torvalds's avatar
Linus Torvalds committed
709 710
idmap_pipe_destroy_msg(struct rpc_pipe_msg *msg)
{
711 712 713 714
	struct idmap_legacy_upcalldata *data = container_of(msg,
			struct idmap_legacy_upcalldata,
			pipe_msg);
	struct idmap *idmap = data->idmap;
715 716 717

	if (msg->errno)
		nfs_idmap_abort_pipe_upcall(idmap, msg->errno);
718 719 720 721 722 723 724
}

static void
idmap_release_pipe(struct inode *inode)
{
	struct rpc_inode *rpci = RPC_I(inode);
	struct idmap *idmap = (struct idmap *)rpci->private;
725 726

	nfs_idmap_abort_pipe_upcall(idmap, -EPIPE);
Linus Torvalds's avatar
Linus Torvalds committed
727 728
}

729
int nfs_map_name_to_uid(const struct nfs_server *server, const char *name, size_t namelen, kuid_t *uid)
Linus Torvalds's avatar
Linus Torvalds committed
730
{
731
	struct idmap *idmap = server->nfs_client->cl_idmap;
732 733
	__u32 id = -1;
	int ret = 0;
Linus Torvalds's avatar
Linus Torvalds committed
734

735 736 737 738 739 740 741
	if (!nfs_map_string_to_numeric(name, namelen, &id))
		ret = nfs_idmap_lookup_id(name, namelen, "uid", &id, idmap);
	if (ret == 0) {
		*uid = make_kuid(&init_user_ns, id);
		if (!uid_valid(*uid))
			ret = -ERANGE;
	}
742
	trace_nfs4_map_name_to_uid(name, namelen, id, ret);
743
	return ret;
Linus Torvalds's avatar
Linus Torvalds committed
744 745
}

746
int nfs_map_group_to_gid(const struct nfs_server *server, const char *name, size_t namelen, kgid_t *gid)
Linus Torvalds's avatar
Linus Torvalds committed
747
{
748
	struct idmap *idmap = server->nfs_client->cl_idmap;
749 750
	__u32 id = -1;
	int ret = 0;
Linus Torvalds's avatar
Linus Torvalds committed
751

752 753 754 755 756 757 758
	if (!nfs_map_string_to_numeric(name, namelen, &id))
		ret = nfs_idmap_lookup_id(name, namelen, "gid", &id, idmap);
	if (ret == 0) {
		*gid = make_kgid(&init_user_ns, id);
		if (!gid_valid(*gid))
			ret = -ERANGE;
	}
759
	trace_nfs4_map_group_to_gid(name, namelen, id, ret);
760
	return ret;
Linus Torvalds's avatar
Linus Torvalds committed
761 762
}

763
int nfs_map_uid_to_name(const struct nfs_server *server, kuid_t uid, char *buf, size_t buflen)
Linus Torvalds's avatar
Linus Torvalds committed
764
{
765
	struct idmap *idmap = server->nfs_client->cl_idmap;
766
	int ret = -EINVAL;
767
	__u32 id;
Linus Torvalds's avatar
Linus Torvalds committed
768

769
	id = from_kuid(&init_user_ns, uid);
770
	if (!(server->caps & NFS_CAP_UIDGID_NOMAP))
771
		ret = nfs_idmap_lookup_name(id, "user", buf, buflen, idmap);
772
	if (ret < 0)
773
		ret = nfs_map_numeric_to_string(id, buf, buflen);
774
	trace_nfs4_map_uid_to_name(buf, ret, id, ret);
775
	return ret;
Linus Torvalds's avatar
Linus Torvalds committed
776
}
777
int nfs_map_gid_to_group(const struct nfs_server *server, kgid_t gid, char *buf, size_t buflen)
Linus Torvalds's avatar
Linus Torvalds committed
778
{
779
	struct idmap *idmap = server->nfs_client->cl_idmap;
780
	int ret = -EINVAL;
781
	__u32 id;
Linus Torvalds's avatar
Linus Torvalds committed
782

783
	id = from_kgid(&init_user_ns, gid);
784
	if (!(server->caps & NFS_CAP_UIDGID_NOMAP))
785
		ret = nfs_idmap_lookup_name(id, "group", buf, buflen, idmap);
786
	if (ret < 0)
787
		ret = nfs_map_numeric_to_string(id, buf, buflen);
788
	trace_nfs4_map_gid_to_group(buf, ret, id, ret);
789
	return ret;
Linus Torvalds's avatar
Linus Torvalds committed
790
}