1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * XDR support for nfsd 4 * 5 * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de> 6 */ 7 8 #include "vfs.h" 9 #include "xdr.h" 10 #include "auth.h" 11 12 #define NFSDDBG_FACILITY NFSDDBG_XDR 13 14 /* 15 * Mapping of S_IF* types to NFS file types 16 */ 17 static u32 nfs_ftypes[] = { 18 NFNON, NFCHR, NFCHR, NFBAD, 19 NFDIR, NFBAD, NFBLK, NFBAD, 20 NFREG, NFBAD, NFLNK, NFBAD, 21 NFSOCK, NFBAD, NFLNK, NFBAD, 22 }; 23 24 25 /* 26 * XDR functions for basic NFS types 27 */ 28 static __be32 * 29 decode_fh(__be32 *p, struct svc_fh *fhp) 30 { 31 fh_init(fhp, NFS_FHSIZE); 32 memcpy(&fhp->fh_handle.fh_base, p, NFS_FHSIZE); 33 fhp->fh_handle.fh_size = NFS_FHSIZE; 34 35 /* FIXME: Look up export pointer here and verify 36 * Sun Secure RPC if requested */ 37 return p + (NFS_FHSIZE >> 2); 38 } 39 40 /* Helper function for NFSv2 ACL code */ 41 __be32 *nfs2svc_decode_fh(__be32 *p, struct svc_fh *fhp) 42 { 43 return decode_fh(p, fhp); 44 } 45 46 static __be32 * 47 encode_fh(__be32 *p, struct svc_fh *fhp) 48 { 49 memcpy(p, &fhp->fh_handle.fh_base, NFS_FHSIZE); 50 return p + (NFS_FHSIZE>> 2); 51 } 52 53 /* 54 * Decode a file name and make sure that the path contains 55 * no slashes or null bytes. 56 */ 57 static __be32 * 58 decode_filename(__be32 *p, char **namp, unsigned int *lenp) 59 { 60 char *name; 61 unsigned int i; 62 63 if ((p = xdr_decode_string_inplace(p, namp, lenp, NFS_MAXNAMLEN)) != NULL) { 64 for (i = 0, name = *namp; i < *lenp; i++, name++) { 65 if (*name == '\0' || *name == '/') 66 return NULL; 67 } 68 } 69 70 return p; 71 } 72 73 static __be32 * 74 decode_sattr(__be32 *p, struct iattr *iap, struct user_namespace *userns) 75 { 76 u32 tmp, tmp1; 77 78 iap->ia_valid = 0; 79 80 /* Sun client bug compatibility check: some sun clients seem to 81 * put 0xffff in the mode field when they mean 0xffffffff. 82 * Quoting the 4.4BSD nfs server code: Nah nah nah nah na nah. 83 */ 84 if ((tmp = ntohl(*p++)) != (u32)-1 && tmp != 0xffff) { 85 iap->ia_valid |= ATTR_MODE; 86 iap->ia_mode = tmp; 87 } 88 if ((tmp = ntohl(*p++)) != (u32)-1) { 89 iap->ia_uid = make_kuid(userns, tmp); 90 if (uid_valid(iap->ia_uid)) 91 iap->ia_valid |= ATTR_UID; 92 } 93 if ((tmp = ntohl(*p++)) != (u32)-1) { 94 iap->ia_gid = make_kgid(userns, tmp); 95 if (gid_valid(iap->ia_gid)) 96 iap->ia_valid |= ATTR_GID; 97 } 98 if ((tmp = ntohl(*p++)) != (u32)-1) { 99 iap->ia_valid |= ATTR_SIZE; 100 iap->ia_size = tmp; 101 } 102 tmp = ntohl(*p++); tmp1 = ntohl(*p++); 103 if (tmp != (u32)-1 && tmp1 != (u32)-1) { 104 iap->ia_valid |= ATTR_ATIME | ATTR_ATIME_SET; 105 iap->ia_atime.tv_sec = tmp; 106 iap->ia_atime.tv_nsec = tmp1 * 1000; 107 } 108 tmp = ntohl(*p++); tmp1 = ntohl(*p++); 109 if (tmp != (u32)-1 && tmp1 != (u32)-1) { 110 iap->ia_valid |= ATTR_MTIME | ATTR_MTIME_SET; 111 iap->ia_mtime.tv_sec = tmp; 112 iap->ia_mtime.tv_nsec = tmp1 * 1000; 113 /* 114 * Passing the invalid value useconds=1000000 for mtime 115 * is a Sun convention for "set both mtime and atime to 116 * current server time". It's needed to make permissions 117 * checks for the "touch" program across v2 mounts to 118 * Solaris and Irix boxes work correctly. See description of 119 * sattr in section 6.1 of "NFS Illustrated" by 120 * Brent Callaghan, Addison-Wesley, ISBN 0-201-32750-5 121 */ 122 if (tmp1 == 1000000) 123 iap->ia_valid &= ~(ATTR_ATIME_SET|ATTR_MTIME_SET); 124 } 125 return p; 126 } 127 128 static __be32 * 129 encode_fattr(struct svc_rqst *rqstp, __be32 *p, struct svc_fh *fhp, 130 struct kstat *stat) 131 { 132 struct user_namespace *userns = nfsd_user_namespace(rqstp); 133 struct dentry *dentry = fhp->fh_dentry; 134 int type; 135 struct timespec64 time; 136 u32 f; 137 138 type = (stat->mode & S_IFMT); 139 140 *p++ = htonl(nfs_ftypes[type >> 12]); 141 *p++ = htonl((u32) stat->mode); 142 *p++ = htonl((u32) stat->nlink); 143 *p++ = htonl((u32) from_kuid_munged(userns, stat->uid)); 144 *p++ = htonl((u32) from_kgid_munged(userns, stat->gid)); 145 146 if (S_ISLNK(type) && stat->size > NFS_MAXPATHLEN) { 147 *p++ = htonl(NFS_MAXPATHLEN); 148 } else { 149 *p++ = htonl((u32) stat->size); 150 } 151 *p++ = htonl((u32) stat->blksize); 152 if (S_ISCHR(type) || S_ISBLK(type)) 153 *p++ = htonl(new_encode_dev(stat->rdev)); 154 else 155 *p++ = htonl(0xffffffff); 156 *p++ = htonl((u32) stat->blocks); 157 switch (fsid_source(fhp)) { 158 default: 159 case FSIDSOURCE_DEV: 160 *p++ = htonl(new_encode_dev(stat->dev)); 161 break; 162 case FSIDSOURCE_FSID: 163 *p++ = htonl((u32) fhp->fh_export->ex_fsid); 164 break; 165 case FSIDSOURCE_UUID: 166 f = ((u32*)fhp->fh_export->ex_uuid)[0]; 167 f ^= ((u32*)fhp->fh_export->ex_uuid)[1]; 168 f ^= ((u32*)fhp->fh_export->ex_uuid)[2]; 169 f ^= ((u32*)fhp->fh_export->ex_uuid)[3]; 170 *p++ = htonl(f); 171 break; 172 } 173 *p++ = htonl((u32) stat->ino); 174 *p++ = htonl((u32) stat->atime.tv_sec); 175 *p++ = htonl(stat->atime.tv_nsec ? stat->atime.tv_nsec / 1000 : 0); 176 time = stat->mtime; 177 lease_get_mtime(d_inode(dentry), &time); 178 *p++ = htonl((u32) time.tv_sec); 179 *p++ = htonl(time.tv_nsec ? time.tv_nsec / 1000 : 0); 180 *p++ = htonl((u32) stat->ctime.tv_sec); 181 *p++ = htonl(stat->ctime.tv_nsec ? stat->ctime.tv_nsec / 1000 : 0); 182 183 return p; 184 } 185 186 /* Helper function for NFSv2 ACL code */ 187 __be32 *nfs2svc_encode_fattr(struct svc_rqst *rqstp, __be32 *p, struct svc_fh *fhp, struct kstat *stat) 188 { 189 return encode_fattr(rqstp, p, fhp, stat); 190 } 191 192 /* 193 * XDR decode functions 194 */ 195 196 int 197 nfssvc_decode_fhandle(struct svc_rqst *rqstp, __be32 *p) 198 { 199 struct nfsd_fhandle *args = rqstp->rq_argp; 200 201 p = decode_fh(p, &args->fh); 202 if (!p) 203 return 0; 204 return xdr_argsize_check(rqstp, p); 205 } 206 207 int 208 nfssvc_decode_sattrargs(struct svc_rqst *rqstp, __be32 *p) 209 { 210 struct nfsd_sattrargs *args = rqstp->rq_argp; 211 212 p = decode_fh(p, &args->fh); 213 if (!p) 214 return 0; 215 p = decode_sattr(p, &args->attrs, nfsd_user_namespace(rqstp)); 216 217 return xdr_argsize_check(rqstp, p); 218 } 219 220 int 221 nfssvc_decode_diropargs(struct svc_rqst *rqstp, __be32 *p) 222 { 223 struct nfsd_diropargs *args = rqstp->rq_argp; 224 225 if (!(p = decode_fh(p, &args->fh)) 226 || !(p = decode_filename(p, &args->name, &args->len))) 227 return 0; 228 229 return xdr_argsize_check(rqstp, p); 230 } 231 232 int 233 nfssvc_decode_readargs(struct svc_rqst *rqstp, __be32 *p) 234 { 235 struct nfsd_readargs *args = rqstp->rq_argp; 236 unsigned int len; 237 int v; 238 p = decode_fh(p, &args->fh); 239 if (!p) 240 return 0; 241 242 args->offset = ntohl(*p++); 243 len = args->count = ntohl(*p++); 244 p++; /* totalcount - unused */ 245 246 len = min_t(unsigned int, len, NFSSVC_MAXBLKSIZE_V2); 247 248 /* set up somewhere to store response. 249 * We take pages, put them on reslist and include in iovec 250 */ 251 v=0; 252 while (len > 0) { 253 struct page *p = *(rqstp->rq_next_page++); 254 255 rqstp->rq_vec[v].iov_base = page_address(p); 256 rqstp->rq_vec[v].iov_len = min_t(unsigned int, len, PAGE_SIZE); 257 len -= rqstp->rq_vec[v].iov_len; 258 v++; 259 } 260 args->vlen = v; 261 return xdr_argsize_check(rqstp, p); 262 } 263 264 int 265 nfssvc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p) 266 { 267 struct nfsd_writeargs *args = rqstp->rq_argp; 268 unsigned int len, hdr, dlen; 269 struct kvec *head = rqstp->rq_arg.head; 270 271 p = decode_fh(p, &args->fh); 272 if (!p) 273 return 0; 274 275 p++; /* beginoffset */ 276 args->offset = ntohl(*p++); /* offset */ 277 p++; /* totalcount */ 278 len = args->len = ntohl(*p++); 279 /* 280 * The protocol specifies a maximum of 8192 bytes. 281 */ 282 if (len > NFSSVC_MAXBLKSIZE_V2) 283 return 0; 284 285 /* 286 * Check to make sure that we got the right number of 287 * bytes. 288 */ 289 hdr = (void*)p - head->iov_base; 290 if (hdr > head->iov_len) 291 return 0; 292 dlen = head->iov_len + rqstp->rq_arg.page_len - hdr; 293 294 /* 295 * Round the length of the data which was specified up to 296 * the next multiple of XDR units and then compare that 297 * against the length which was actually received. 298 * Note that when RPCSEC/GSS (for example) is used, the 299 * data buffer can be padded so dlen might be larger 300 * than required. It must never be smaller. 301 */ 302 if (dlen < XDR_QUADLEN(len)*4) 303 return 0; 304 305 args->first.iov_base = (void *)p; 306 args->first.iov_len = head->iov_len - hdr; 307 return 1; 308 } 309 310 int 311 nfssvc_decode_createargs(struct svc_rqst *rqstp, __be32 *p) 312 { 313 struct nfsd_createargs *args = rqstp->rq_argp; 314 315 if ( !(p = decode_fh(p, &args->fh)) 316 || !(p = decode_filename(p, &args->name, &args->len))) 317 return 0; 318 p = decode_sattr(p, &args->attrs, nfsd_user_namespace(rqstp)); 319 320 return xdr_argsize_check(rqstp, p); 321 } 322 323 int 324 nfssvc_decode_renameargs(struct svc_rqst *rqstp, __be32 *p) 325 { 326 struct nfsd_renameargs *args = rqstp->rq_argp; 327 328 if (!(p = decode_fh(p, &args->ffh)) 329 || !(p = decode_filename(p, &args->fname, &args->flen)) 330 || !(p = decode_fh(p, &args->tfh)) 331 || !(p = decode_filename(p, &args->tname, &args->tlen))) 332 return 0; 333 334 return xdr_argsize_check(rqstp, p); 335 } 336 337 int 338 nfssvc_decode_readlinkargs(struct svc_rqst *rqstp, __be32 *p) 339 { 340 struct nfsd_readlinkargs *args = rqstp->rq_argp; 341 342 p = decode_fh(p, &args->fh); 343 if (!p) 344 return 0; 345 args->buffer = page_address(*(rqstp->rq_next_page++)); 346 347 return xdr_argsize_check(rqstp, p); 348 } 349 350 int 351 nfssvc_decode_linkargs(struct svc_rqst *rqstp, __be32 *p) 352 { 353 struct nfsd_linkargs *args = rqstp->rq_argp; 354 355 if (!(p = decode_fh(p, &args->ffh)) 356 || !(p = decode_fh(p, &args->tfh)) 357 || !(p = decode_filename(p, &args->tname, &args->tlen))) 358 return 0; 359 360 return xdr_argsize_check(rqstp, p); 361 } 362 363 int 364 nfssvc_decode_symlinkargs(struct svc_rqst *rqstp, __be32 *p) 365 { 366 struct nfsd_symlinkargs *args = rqstp->rq_argp; 367 char *base = (char *)p; 368 size_t xdrlen; 369 370 if ( !(p = decode_fh(p, &args->ffh)) 371 || !(p = decode_filename(p, &args->fname, &args->flen))) 372 return 0; 373 374 args->tlen = ntohl(*p++); 375 if (args->tlen == 0) 376 return 0; 377 378 args->first.iov_base = p; 379 args->first.iov_len = rqstp->rq_arg.head[0].iov_len; 380 args->first.iov_len -= (char *)p - base; 381 382 /* This request is never larger than a page. Therefore, 383 * transport will deliver either: 384 * 1. pathname in the pagelist -> sattr is in the tail. 385 * 2. everything in the head buffer -> sattr is in the head. 386 */ 387 if (rqstp->rq_arg.page_len) { 388 if (args->tlen != rqstp->rq_arg.page_len) 389 return 0; 390 p = rqstp->rq_arg.tail[0].iov_base; 391 } else { 392 xdrlen = XDR_QUADLEN(args->tlen); 393 if (xdrlen > args->first.iov_len - (8 * sizeof(__be32))) 394 return 0; 395 p += xdrlen; 396 } 397 decode_sattr(p, &args->attrs, nfsd_user_namespace(rqstp)); 398 399 return 1; 400 } 401 402 int 403 nfssvc_decode_readdirargs(struct svc_rqst *rqstp, __be32 *p) 404 { 405 struct nfsd_readdirargs *args = rqstp->rq_argp; 406 407 p = decode_fh(p, &args->fh); 408 if (!p) 409 return 0; 410 args->cookie = ntohl(*p++); 411 args->count = ntohl(*p++); 412 args->count = min_t(u32, args->count, PAGE_SIZE); 413 args->buffer = page_address(*(rqstp->rq_next_page++)); 414 415 return xdr_argsize_check(rqstp, p); 416 } 417 418 /* 419 * XDR encode functions 420 */ 421 422 int 423 nfssvc_encode_stat(struct svc_rqst *rqstp, __be32 *p) 424 { 425 struct nfsd_stat *resp = rqstp->rq_resp; 426 427 *p++ = resp->status; 428 return xdr_ressize_check(rqstp, p); 429 } 430 431 int 432 nfssvc_encode_attrstat(struct svc_rqst *rqstp, __be32 *p) 433 { 434 struct nfsd_attrstat *resp = rqstp->rq_resp; 435 436 *p++ = resp->status; 437 if (resp->status != nfs_ok) 438 goto out; 439 p = encode_fattr(rqstp, p, &resp->fh, &resp->stat); 440 out: 441 return xdr_ressize_check(rqstp, p); 442 } 443 444 int 445 nfssvc_encode_diropres(struct svc_rqst *rqstp, __be32 *p) 446 { 447 struct nfsd_diropres *resp = rqstp->rq_resp; 448 449 *p++ = resp->status; 450 if (resp->status != nfs_ok) 451 goto out; 452 p = encode_fh(p, &resp->fh); 453 p = encode_fattr(rqstp, p, &resp->fh, &resp->stat); 454 out: 455 return xdr_ressize_check(rqstp, p); 456 } 457 458 int 459 nfssvc_encode_readlinkres(struct svc_rqst *rqstp, __be32 *p) 460 { 461 struct nfsd_readlinkres *resp = rqstp->rq_resp; 462 struct kvec *head = rqstp->rq_res.head; 463 464 *p++ = resp->status; 465 if (resp->status != nfs_ok) 466 return xdr_ressize_check(rqstp, p); 467 468 *p++ = htonl(resp->len); 469 xdr_ressize_check(rqstp, p); 470 rqstp->rq_res.page_len = resp->len; 471 if (resp->len & 3) { 472 /* need to pad the tail */ 473 rqstp->rq_res.tail[0].iov_base = p; 474 *p = 0; 475 rqstp->rq_res.tail[0].iov_len = 4 - (resp->len&3); 476 } 477 if (svc_encode_result_payload(rqstp, head->iov_len, resp->len)) 478 return 0; 479 return 1; 480 } 481 482 int 483 nfssvc_encode_readres(struct svc_rqst *rqstp, __be32 *p) 484 { 485 struct nfsd_readres *resp = rqstp->rq_resp; 486 struct kvec *head = rqstp->rq_res.head; 487 488 *p++ = resp->status; 489 if (resp->status != nfs_ok) 490 return xdr_ressize_check(rqstp, p); 491 492 p = encode_fattr(rqstp, p, &resp->fh, &resp->stat); 493 *p++ = htonl(resp->count); 494 xdr_ressize_check(rqstp, p); 495 496 /* now update rqstp->rq_res to reflect data as well */ 497 rqstp->rq_res.page_len = resp->count; 498 if (resp->count & 3) { 499 /* need to pad the tail */ 500 rqstp->rq_res.tail[0].iov_base = p; 501 *p = 0; 502 rqstp->rq_res.tail[0].iov_len = 4 - (resp->count&3); 503 } 504 if (svc_encode_result_payload(rqstp, head->iov_len, resp->count)) 505 return 0; 506 return 1; 507 } 508 509 int 510 nfssvc_encode_readdirres(struct svc_rqst *rqstp, __be32 *p) 511 { 512 struct nfsd_readdirres *resp = rqstp->rq_resp; 513 514 *p++ = resp->status; 515 if (resp->status != nfs_ok) 516 return xdr_ressize_check(rqstp, p); 517 518 xdr_ressize_check(rqstp, p); 519 p = resp->buffer; 520 *p++ = 0; /* no more entries */ 521 *p++ = htonl((resp->common.err == nfserr_eof)); 522 rqstp->rq_res.page_len = (((unsigned long)p-1) & ~PAGE_MASK)+1; 523 524 return 1; 525 } 526 527 int 528 nfssvc_encode_statfsres(struct svc_rqst *rqstp, __be32 *p) 529 { 530 struct nfsd_statfsres *resp = rqstp->rq_resp; 531 struct kstatfs *stat = &resp->stats; 532 533 *p++ = resp->status; 534 if (resp->status != nfs_ok) 535 return xdr_ressize_check(rqstp, p); 536 537 *p++ = htonl(NFSSVC_MAXBLKSIZE_V2); /* max transfer size */ 538 *p++ = htonl(stat->f_bsize); 539 *p++ = htonl(stat->f_blocks); 540 *p++ = htonl(stat->f_bfree); 541 *p++ = htonl(stat->f_bavail); 542 return xdr_ressize_check(rqstp, p); 543 } 544 545 int 546 nfssvc_encode_entry(void *ccdv, const char *name, 547 int namlen, loff_t offset, u64 ino, unsigned int d_type) 548 { 549 struct readdir_cd *ccd = ccdv; 550 struct nfsd_readdirres *cd = container_of(ccd, struct nfsd_readdirres, common); 551 __be32 *p = cd->buffer; 552 int buflen, slen; 553 554 /* 555 dprintk("nfsd: entry(%.*s off %ld ino %ld)\n", 556 namlen, name, offset, ino); 557 */ 558 559 if (offset > ~((u32) 0)) { 560 cd->common.err = nfserr_fbig; 561 return -EINVAL; 562 } 563 if (cd->offset) 564 *cd->offset = htonl(offset); 565 566 /* truncate filename */ 567 namlen = min(namlen, NFS2_MAXNAMLEN); 568 slen = XDR_QUADLEN(namlen); 569 570 if ((buflen = cd->buflen - slen - 4) < 0) { 571 cd->common.err = nfserr_toosmall; 572 return -EINVAL; 573 } 574 if (ino > ~((u32) 0)) { 575 cd->common.err = nfserr_fbig; 576 return -EINVAL; 577 } 578 *p++ = xdr_one; /* mark entry present */ 579 *p++ = htonl((u32) ino); /* file id */ 580 p = xdr_encode_array(p, name, namlen);/* name length & name */ 581 cd->offset = p; /* remember pointer */ 582 *p++ = htonl(~0U); /* offset of next entry */ 583 584 cd->buflen = buflen; 585 cd->buffer = p; 586 cd->common.err = nfs_ok; 587 return 0; 588 } 589 590 /* 591 * XDR release functions 592 */ 593 void nfssvc_release_attrstat(struct svc_rqst *rqstp) 594 { 595 struct nfsd_attrstat *resp = rqstp->rq_resp; 596 597 fh_put(&resp->fh); 598 } 599 600 void nfssvc_release_diropres(struct svc_rqst *rqstp) 601 { 602 struct nfsd_diropres *resp = rqstp->rq_resp; 603 604 fh_put(&resp->fh); 605 } 606 607 void nfssvc_release_readres(struct svc_rqst *rqstp) 608 { 609 struct nfsd_readres *resp = rqstp->rq_resp; 610 611 fh_put(&resp->fh); 612 } 613