1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * XDR support for nfsd
4 *
5 * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
6 */
7
8 #include "vfs.h"
9 #include "xdr.h"
10 #include "auth.h"
11
12 #define NFSDDBG_FACILITY NFSDDBG_XDR
13
14 /*
15 * Mapping of S_IF* types to NFS file types
16 */
17 static u32 nfs_ftypes[] = {
18 NFNON, NFCHR, NFCHR, NFBAD,
19 NFDIR, NFBAD, NFBLK, NFBAD,
20 NFREG, NFBAD, NFLNK, NFBAD,
21 NFSOCK, NFBAD, NFLNK, NFBAD,
22 };
23
24
25 /*
26 * XDR functions for basic NFS types
27 */
28 static __be32 *
decode_fh(__be32 * p,struct svc_fh * fhp)29 decode_fh(__be32 *p, struct svc_fh *fhp)
30 {
31 fh_init(fhp, NFS_FHSIZE);
32 memcpy(&fhp->fh_handle.fh_base, p, NFS_FHSIZE);
33 fhp->fh_handle.fh_size = NFS_FHSIZE;
34
35 /* FIXME: Look up export pointer here and verify
36 * Sun Secure RPC if requested */
37 return p + (NFS_FHSIZE >> 2);
38 }
39
40 /* Helper function for NFSv2 ACL code */
nfs2svc_decode_fh(__be32 * p,struct svc_fh * fhp)41 __be32 *nfs2svc_decode_fh(__be32 *p, struct svc_fh *fhp)
42 {
43 return decode_fh(p, fhp);
44 }
45
46 static __be32 *
encode_fh(__be32 * p,struct svc_fh * fhp)47 encode_fh(__be32 *p, struct svc_fh *fhp)
48 {
49 memcpy(p, &fhp->fh_handle.fh_base, NFS_FHSIZE);
50 return p + (NFS_FHSIZE>> 2);
51 }
52
53 /*
54 * Decode a file name and make sure that the path contains
55 * no slashes or null bytes.
56 */
57 static __be32 *
decode_filename(__be32 * p,char ** namp,unsigned int * lenp)58 decode_filename(__be32 *p, char **namp, unsigned int *lenp)
59 {
60 char *name;
61 unsigned int i;
62
63 if ((p = xdr_decode_string_inplace(p, namp, lenp, NFS_MAXNAMLEN)) != NULL) {
64 for (i = 0, name = *namp; i < *lenp; i++, name++) {
65 if (*name == '\0' || *name == '/')
66 return NULL;
67 }
68 }
69
70 return p;
71 }
72
73 static __be32 *
decode_sattr(__be32 * p,struct iattr * iap)74 decode_sattr(__be32 *p, struct iattr *iap)
75 {
76 u32 tmp, tmp1;
77
78 iap->ia_valid = 0;
79
80 /* Sun client bug compatibility check: some sun clients seem to
81 * put 0xffff in the mode field when they mean 0xffffffff.
82 * Quoting the 4.4BSD nfs server code: Nah nah nah nah na nah.
83 */
84 if ((tmp = ntohl(*p++)) != (u32)-1 && tmp != 0xffff) {
85 iap->ia_valid |= ATTR_MODE;
86 iap->ia_mode = tmp;
87 }
88 if ((tmp = ntohl(*p++)) != (u32)-1) {
89 iap->ia_uid = make_kuid(&init_user_ns, tmp);
90 if (uid_valid(iap->ia_uid))
91 iap->ia_valid |= ATTR_UID;
92 }
93 if ((tmp = ntohl(*p++)) != (u32)-1) {
94 iap->ia_gid = make_kgid(&init_user_ns, tmp);
95 if (gid_valid(iap->ia_gid))
96 iap->ia_valid |= ATTR_GID;
97 }
98 if ((tmp = ntohl(*p++)) != (u32)-1) {
99 iap->ia_valid |= ATTR_SIZE;
100 iap->ia_size = tmp;
101 }
102 tmp = ntohl(*p++); tmp1 = ntohl(*p++);
103 if (tmp != (u32)-1 && tmp1 != (u32)-1) {
104 iap->ia_valid |= ATTR_ATIME | ATTR_ATIME_SET;
105 iap->ia_atime.tv_sec = tmp;
106 iap->ia_atime.tv_nsec = tmp1 * 1000;
107 }
108 tmp = ntohl(*p++); tmp1 = ntohl(*p++);
109 if (tmp != (u32)-1 && tmp1 != (u32)-1) {
110 iap->ia_valid |= ATTR_MTIME | ATTR_MTIME_SET;
111 iap->ia_mtime.tv_sec = tmp;
112 iap->ia_mtime.tv_nsec = tmp1 * 1000;
113 /*
114 * Passing the invalid value useconds=1000000 for mtime
115 * is a Sun convention for "set both mtime and atime to
116 * current server time". It's needed to make permissions
117 * checks for the "touch" program across v2 mounts to
118 * Solaris and Irix boxes work correctly. See description of
119 * sattr in section 6.1 of "NFS Illustrated" by
120 * Brent Callaghan, Addison-Wesley, ISBN 0-201-32750-5
121 */
122 if (tmp1 == 1000000)
123 iap->ia_valid &= ~(ATTR_ATIME_SET|ATTR_MTIME_SET);
124 }
125 return p;
126 }
127
128 static __be32 *
encode_fattr(struct svc_rqst * rqstp,__be32 * p,struct svc_fh * fhp,struct kstat * stat)129 encode_fattr(struct svc_rqst *rqstp, __be32 *p, struct svc_fh *fhp,
130 struct kstat *stat)
131 {
132 struct dentry *dentry = fhp->fh_dentry;
133 int type;
134 struct timespec64 time;
135 u32 f;
136
137 type = (stat->mode & S_IFMT);
138
139 *p++ = htonl(nfs_ftypes[type >> 12]);
140 *p++ = htonl((u32) stat->mode);
141 *p++ = htonl((u32) stat->nlink);
142 *p++ = htonl((u32) from_kuid(&init_user_ns, stat->uid));
143 *p++ = htonl((u32) from_kgid(&init_user_ns, stat->gid));
144
145 if (S_ISLNK(type) && stat->size > NFS_MAXPATHLEN) {
146 *p++ = htonl(NFS_MAXPATHLEN);
147 } else {
148 *p++ = htonl((u32) stat->size);
149 }
150 *p++ = htonl((u32) stat->blksize);
151 if (S_ISCHR(type) || S_ISBLK(type))
152 *p++ = htonl(new_encode_dev(stat->rdev));
153 else
154 *p++ = htonl(0xffffffff);
155 *p++ = htonl((u32) stat->blocks);
156 switch (fsid_source(fhp)) {
157 default:
158 case FSIDSOURCE_DEV:
159 *p++ = htonl(new_encode_dev(stat->dev));
160 break;
161 case FSIDSOURCE_FSID:
162 *p++ = htonl((u32) fhp->fh_export->ex_fsid);
163 break;
164 case FSIDSOURCE_UUID:
165 f = ((u32*)fhp->fh_export->ex_uuid)[0];
166 f ^= ((u32*)fhp->fh_export->ex_uuid)[1];
167 f ^= ((u32*)fhp->fh_export->ex_uuid)[2];
168 f ^= ((u32*)fhp->fh_export->ex_uuid)[3];
169 *p++ = htonl(f);
170 break;
171 }
172 *p++ = htonl((u32) stat->ino);
173 *p++ = htonl((u32) stat->atime.tv_sec);
174 *p++ = htonl(stat->atime.tv_nsec ? stat->atime.tv_nsec / 1000 : 0);
175 time = stat->mtime;
176 lease_get_mtime(d_inode(dentry), &time);
177 *p++ = htonl((u32) time.tv_sec);
178 *p++ = htonl(time.tv_nsec ? time.tv_nsec / 1000 : 0);
179 *p++ = htonl((u32) stat->ctime.tv_sec);
180 *p++ = htonl(stat->ctime.tv_nsec ? stat->ctime.tv_nsec / 1000 : 0);
181
182 return p;
183 }
184
185 /* Helper function for NFSv2 ACL code */
nfs2svc_encode_fattr(struct svc_rqst * rqstp,__be32 * p,struct svc_fh * fhp,struct kstat * stat)186 __be32 *nfs2svc_encode_fattr(struct svc_rqst *rqstp, __be32 *p, struct svc_fh *fhp, struct kstat *stat)
187 {
188 return encode_fattr(rqstp, p, fhp, stat);
189 }
190
191 /*
192 * XDR decode functions
193 */
194 int
nfssvc_decode_void(struct svc_rqst * rqstp,__be32 * p)195 nfssvc_decode_void(struct svc_rqst *rqstp, __be32 *p)
196 {
197 return xdr_argsize_check(rqstp, p);
198 }
199
200 int
nfssvc_decode_fhandle(struct svc_rqst * rqstp,__be32 * p)201 nfssvc_decode_fhandle(struct svc_rqst *rqstp, __be32 *p)
202 {
203 struct nfsd_fhandle *args = rqstp->rq_argp;
204
205 p = decode_fh(p, &args->fh);
206 if (!p)
207 return 0;
208 return xdr_argsize_check(rqstp, p);
209 }
210
211 int
nfssvc_decode_sattrargs(struct svc_rqst * rqstp,__be32 * p)212 nfssvc_decode_sattrargs(struct svc_rqst *rqstp, __be32 *p)
213 {
214 struct nfsd_sattrargs *args = rqstp->rq_argp;
215
216 p = decode_fh(p, &args->fh);
217 if (!p)
218 return 0;
219 p = decode_sattr(p, &args->attrs);
220
221 return xdr_argsize_check(rqstp, p);
222 }
223
224 int
nfssvc_decode_diropargs(struct svc_rqst * rqstp,__be32 * p)225 nfssvc_decode_diropargs(struct svc_rqst *rqstp, __be32 *p)
226 {
227 struct nfsd_diropargs *args = rqstp->rq_argp;
228
229 if (!(p = decode_fh(p, &args->fh))
230 || !(p = decode_filename(p, &args->name, &args->len)))
231 return 0;
232
233 return xdr_argsize_check(rqstp, p);
234 }
235
236 int
nfssvc_decode_readargs(struct svc_rqst * rqstp,__be32 * p)237 nfssvc_decode_readargs(struct svc_rqst *rqstp, __be32 *p)
238 {
239 struct nfsd_readargs *args = rqstp->rq_argp;
240 unsigned int len;
241 int v;
242 p = decode_fh(p, &args->fh);
243 if (!p)
244 return 0;
245
246 args->offset = ntohl(*p++);
247 len = args->count = ntohl(*p++);
248 p++; /* totalcount - unused */
249
250 len = min_t(unsigned int, len, NFSSVC_MAXBLKSIZE_V2);
251
252 /* set up somewhere to store response.
253 * We take pages, put them on reslist and include in iovec
254 */
255 v=0;
256 while (len > 0) {
257 struct page *p = *(rqstp->rq_next_page++);
258
259 rqstp->rq_vec[v].iov_base = page_address(p);
260 rqstp->rq_vec[v].iov_len = min_t(unsigned int, len, PAGE_SIZE);
261 len -= rqstp->rq_vec[v].iov_len;
262 v++;
263 }
264 args->vlen = v;
265 return xdr_argsize_check(rqstp, p);
266 }
267
268 int
nfssvc_decode_writeargs(struct svc_rqst * rqstp,__be32 * p)269 nfssvc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p)
270 {
271 struct nfsd_writeargs *args = rqstp->rq_argp;
272 unsigned int len, hdr, dlen;
273 struct kvec *head = rqstp->rq_arg.head;
274
275 p = decode_fh(p, &args->fh);
276 if (!p)
277 return 0;
278
279 p++; /* beginoffset */
280 args->offset = ntohl(*p++); /* offset */
281 p++; /* totalcount */
282 len = args->len = ntohl(*p++);
283 /*
284 * The protocol specifies a maximum of 8192 bytes.
285 */
286 if (len > NFSSVC_MAXBLKSIZE_V2)
287 return 0;
288
289 /*
290 * Check to make sure that we got the right number of
291 * bytes.
292 */
293 hdr = (void*)p - head->iov_base;
294 if (hdr > head->iov_len)
295 return 0;
296 dlen = head->iov_len + rqstp->rq_arg.page_len - hdr;
297
298 /*
299 * Round the length of the data which was specified up to
300 * the next multiple of XDR units and then compare that
301 * against the length which was actually received.
302 * Note that when RPCSEC/GSS (for example) is used, the
303 * data buffer can be padded so dlen might be larger
304 * than required. It must never be smaller.
305 */
306 if (dlen < XDR_QUADLEN(len)*4)
307 return 0;
308
309 args->first.iov_base = (void *)p;
310 args->first.iov_len = head->iov_len - hdr;
311 return 1;
312 }
313
314 int
nfssvc_decode_createargs(struct svc_rqst * rqstp,__be32 * p)315 nfssvc_decode_createargs(struct svc_rqst *rqstp, __be32 *p)
316 {
317 struct nfsd_createargs *args = rqstp->rq_argp;
318
319 if ( !(p = decode_fh(p, &args->fh))
320 || !(p = decode_filename(p, &args->name, &args->len)))
321 return 0;
322 p = decode_sattr(p, &args->attrs);
323
324 return xdr_argsize_check(rqstp, p);
325 }
326
327 int
nfssvc_decode_renameargs(struct svc_rqst * rqstp,__be32 * p)328 nfssvc_decode_renameargs(struct svc_rqst *rqstp, __be32 *p)
329 {
330 struct nfsd_renameargs *args = rqstp->rq_argp;
331
332 if (!(p = decode_fh(p, &args->ffh))
333 || !(p = decode_filename(p, &args->fname, &args->flen))
334 || !(p = decode_fh(p, &args->tfh))
335 || !(p = decode_filename(p, &args->tname, &args->tlen)))
336 return 0;
337
338 return xdr_argsize_check(rqstp, p);
339 }
340
341 int
nfssvc_decode_readlinkargs(struct svc_rqst * rqstp,__be32 * p)342 nfssvc_decode_readlinkargs(struct svc_rqst *rqstp, __be32 *p)
343 {
344 struct nfsd_readlinkargs *args = rqstp->rq_argp;
345
346 p = decode_fh(p, &args->fh);
347 if (!p)
348 return 0;
349 args->buffer = page_address(*(rqstp->rq_next_page++));
350
351 return xdr_argsize_check(rqstp, p);
352 }
353
354 int
nfssvc_decode_linkargs(struct svc_rqst * rqstp,__be32 * p)355 nfssvc_decode_linkargs(struct svc_rqst *rqstp, __be32 *p)
356 {
357 struct nfsd_linkargs *args = rqstp->rq_argp;
358
359 if (!(p = decode_fh(p, &args->ffh))
360 || !(p = decode_fh(p, &args->tfh))
361 || !(p = decode_filename(p, &args->tname, &args->tlen)))
362 return 0;
363
364 return xdr_argsize_check(rqstp, p);
365 }
366
367 int
nfssvc_decode_symlinkargs(struct svc_rqst * rqstp,__be32 * p)368 nfssvc_decode_symlinkargs(struct svc_rqst *rqstp, __be32 *p)
369 {
370 struct nfsd_symlinkargs *args = rqstp->rq_argp;
371 char *base = (char *)p;
372 size_t xdrlen;
373
374 if ( !(p = decode_fh(p, &args->ffh))
375 || !(p = decode_filename(p, &args->fname, &args->flen)))
376 return 0;
377
378 args->tlen = ntohl(*p++);
379 if (args->tlen == 0)
380 return 0;
381
382 args->first.iov_base = p;
383 args->first.iov_len = rqstp->rq_arg.head[0].iov_len;
384 args->first.iov_len -= (char *)p - base;
385
386 /* This request is never larger than a page. Therefore,
387 * transport will deliver either:
388 * 1. pathname in the pagelist -> sattr is in the tail.
389 * 2. everything in the head buffer -> sattr is in the head.
390 */
391 if (rqstp->rq_arg.page_len) {
392 if (args->tlen != rqstp->rq_arg.page_len)
393 return 0;
394 p = rqstp->rq_arg.tail[0].iov_base;
395 } else {
396 xdrlen = XDR_QUADLEN(args->tlen);
397 if (xdrlen > args->first.iov_len - (8 * sizeof(__be32)))
398 return 0;
399 p += xdrlen;
400 }
401 decode_sattr(p, &args->attrs);
402
403 return 1;
404 }
405
406 int
nfssvc_decode_readdirargs(struct svc_rqst * rqstp,__be32 * p)407 nfssvc_decode_readdirargs(struct svc_rqst *rqstp, __be32 *p)
408 {
409 struct nfsd_readdirargs *args = rqstp->rq_argp;
410
411 p = decode_fh(p, &args->fh);
412 if (!p)
413 return 0;
414 args->cookie = ntohl(*p++);
415 args->count = ntohl(*p++);
416 args->count = min_t(u32, args->count, PAGE_SIZE);
417 args->buffer = page_address(*(rqstp->rq_next_page++));
418
419 return xdr_argsize_check(rqstp, p);
420 }
421
422 /*
423 * XDR encode functions
424 */
425 int
nfssvc_encode_void(struct svc_rqst * rqstp,__be32 * p)426 nfssvc_encode_void(struct svc_rqst *rqstp, __be32 *p)
427 {
428 return xdr_ressize_check(rqstp, p);
429 }
430
431 int
nfssvc_encode_attrstat(struct svc_rqst * rqstp,__be32 * p)432 nfssvc_encode_attrstat(struct svc_rqst *rqstp, __be32 *p)
433 {
434 struct nfsd_attrstat *resp = rqstp->rq_resp;
435
436 p = encode_fattr(rqstp, p, &resp->fh, &resp->stat);
437 return xdr_ressize_check(rqstp, p);
438 }
439
440 int
nfssvc_encode_diropres(struct svc_rqst * rqstp,__be32 * p)441 nfssvc_encode_diropres(struct svc_rqst *rqstp, __be32 *p)
442 {
443 struct nfsd_diropres *resp = rqstp->rq_resp;
444
445 p = encode_fh(p, &resp->fh);
446 p = encode_fattr(rqstp, p, &resp->fh, &resp->stat);
447 return xdr_ressize_check(rqstp, p);
448 }
449
450 int
nfssvc_encode_readlinkres(struct svc_rqst * rqstp,__be32 * p)451 nfssvc_encode_readlinkres(struct svc_rqst *rqstp, __be32 *p)
452 {
453 struct nfsd_readlinkres *resp = rqstp->rq_resp;
454
455 *p++ = htonl(resp->len);
456 xdr_ressize_check(rqstp, p);
457 rqstp->rq_res.page_len = resp->len;
458 if (resp->len & 3) {
459 /* need to pad the tail */
460 rqstp->rq_res.tail[0].iov_base = p;
461 *p = 0;
462 rqstp->rq_res.tail[0].iov_len = 4 - (resp->len&3);
463 }
464 return 1;
465 }
466
467 int
nfssvc_encode_readres(struct svc_rqst * rqstp,__be32 * p)468 nfssvc_encode_readres(struct svc_rqst *rqstp, __be32 *p)
469 {
470 struct nfsd_readres *resp = rqstp->rq_resp;
471
472 p = encode_fattr(rqstp, p, &resp->fh, &resp->stat);
473 *p++ = htonl(resp->count);
474 xdr_ressize_check(rqstp, p);
475
476 /* now update rqstp->rq_res to reflect data as well */
477 rqstp->rq_res.page_len = resp->count;
478 if (resp->count & 3) {
479 /* need to pad the tail */
480 rqstp->rq_res.tail[0].iov_base = p;
481 *p = 0;
482 rqstp->rq_res.tail[0].iov_len = 4 - (resp->count&3);
483 }
484 return 1;
485 }
486
487 int
nfssvc_encode_readdirres(struct svc_rqst * rqstp,__be32 * p)488 nfssvc_encode_readdirres(struct svc_rqst *rqstp, __be32 *p)
489 {
490 struct nfsd_readdirres *resp = rqstp->rq_resp;
491
492 xdr_ressize_check(rqstp, p);
493 p = resp->buffer;
494 *p++ = 0; /* no more entries */
495 *p++ = htonl((resp->common.err == nfserr_eof));
496 rqstp->rq_res.page_len = (((unsigned long)p-1) & ~PAGE_MASK)+1;
497
498 return 1;
499 }
500
501 int
nfssvc_encode_statfsres(struct svc_rqst * rqstp,__be32 * p)502 nfssvc_encode_statfsres(struct svc_rqst *rqstp, __be32 *p)
503 {
504 struct nfsd_statfsres *resp = rqstp->rq_resp;
505 struct kstatfs *stat = &resp->stats;
506
507 *p++ = htonl(NFSSVC_MAXBLKSIZE_V2); /* max transfer size */
508 *p++ = htonl(stat->f_bsize);
509 *p++ = htonl(stat->f_blocks);
510 *p++ = htonl(stat->f_bfree);
511 *p++ = htonl(stat->f_bavail);
512 return xdr_ressize_check(rqstp, p);
513 }
514
515 int
nfssvc_encode_entry(void * ccdv,const char * name,int namlen,loff_t offset,u64 ino,unsigned int d_type)516 nfssvc_encode_entry(void *ccdv, const char *name,
517 int namlen, loff_t offset, u64 ino, unsigned int d_type)
518 {
519 struct readdir_cd *ccd = ccdv;
520 struct nfsd_readdirres *cd = container_of(ccd, struct nfsd_readdirres, common);
521 __be32 *p = cd->buffer;
522 int buflen, slen;
523
524 /*
525 dprintk("nfsd: entry(%.*s off %ld ino %ld)\n",
526 namlen, name, offset, ino);
527 */
528
529 if (offset > ~((u32) 0)) {
530 cd->common.err = nfserr_fbig;
531 return -EINVAL;
532 }
533 if (cd->offset)
534 *cd->offset = htonl(offset);
535
536 /* truncate filename */
537 namlen = min(namlen, NFS2_MAXNAMLEN);
538 slen = XDR_QUADLEN(namlen);
539
540 if ((buflen = cd->buflen - slen - 4) < 0) {
541 cd->common.err = nfserr_toosmall;
542 return -EINVAL;
543 }
544 if (ino > ~((u32) 0)) {
545 cd->common.err = nfserr_fbig;
546 return -EINVAL;
547 }
548 *p++ = xdr_one; /* mark entry present */
549 *p++ = htonl((u32) ino); /* file id */
550 p = xdr_encode_array(p, name, namlen);/* name length & name */
551 cd->offset = p; /* remember pointer */
552 *p++ = htonl(~0U); /* offset of next entry */
553
554 cd->buflen = buflen;
555 cd->buffer = p;
556 cd->common.err = nfs_ok;
557 return 0;
558 }
559
560 /*
561 * XDR release functions
562 */
563 void
nfssvc_release_fhandle(struct svc_rqst * rqstp)564 nfssvc_release_fhandle(struct svc_rqst *rqstp)
565 {
566 struct nfsd_fhandle *resp = rqstp->rq_resp;
567
568 fh_put(&resp->fh);
569 }
570