2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
4 * Copyright (c) 2009 Rick Macklem, University of Guelph
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
33 #include <fs/nfs/nfsport.h>
35 extern int nfsrv_useacl;
37 static int nfsrv_acemasktoperm(u_int32_t acetype, u_int32_t mask, int owner,
38 enum vtype type, acl_perm_t *permp);
41 * Handle xdr for an ace.
44 nfsrv_dissectace(struct nfsrv_descript *nd, struct acl_entry *acep,
45 int *aceerrp, int *acesizep, NFSPROC_T *p)
48 int len, gotid = 0, owner = 0, error = 0, aceerr = 0;
49 u_char *name, namestr[NFSV4_SMALLSTR + 1];
50 u_int32_t flag, mask, acetype;
56 NFSM_DISSECT(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
57 acetype = fxdr_unsigned(u_int32_t, *tl++);
58 flag = fxdr_unsigned(u_int32_t, *tl++);
59 mask = fxdr_unsigned(u_int32_t, *tl++);
60 len = fxdr_unsigned(int, *tl);
62 error = NFSERR_BADXDR;
64 } else if (len == 0) {
65 /* Netapp filers return a 0 length who for nil users */
66 acep->ae_tag = ACL_UNDEFINED_TAG;
67 acep->ae_id = ACL_UNDEFINED_ID;
68 acep->ae_perm = (acl_perm_t)0;
69 acep->ae_entry_type = ACL_ENTRY_TYPE_DENY;
71 *acesizep = 4 * NFSX_UNSIGNED;
75 if (len > NFSV4_SMALLSTR)
76 name = malloc(len + 1, M_NFSSTRING, M_WAITOK);
79 error = nfsrv_mtostr(nd, name, len);
81 if (len > NFSV4_SMALLSTR)
82 free(name, M_NFSSTRING);
86 if (!NFSBCMP(name, "OWNER@", 6)) {
87 acep->ae_tag = ACL_USER_OBJ;
88 acep->ae_id = ACL_UNDEFINED_ID;
91 } else if (!NFSBCMP(name, "GROUP@", 6)) {
92 acep->ae_tag = ACL_GROUP_OBJ;
93 acep->ae_id = ACL_UNDEFINED_ID;
96 } else if (len == 9 && !NFSBCMP(name, "EVERYONE@", 9)) {
97 acep->ae_tag = ACL_EVERYONE;
98 acep->ae_id = ACL_UNDEFINED_ID;
102 if (flag & NFSV4ACE_IDENTIFIERGROUP) {
103 acep->ae_tag = ACL_GROUP;
104 aceerr = nfsv4_strtogid(nd, name, len, &gid);
106 acep->ae_id = (uid_t)gid;
108 acep->ae_tag = ACL_USER;
109 aceerr = nfsv4_strtouid(nd, name, len, &uid);
114 if (len > NFSV4_SMALLSTR)
115 free(name, M_NFSSTRING);
121 flag &= ~NFSV4ACE_IDENTIFIERGROUP;
122 if (flag & NFSV4ACE_FILEINHERIT) {
123 flag &= ~NFSV4ACE_FILEINHERIT;
124 acep->ae_flags |= ACL_ENTRY_FILE_INHERIT;
126 if (flag & NFSV4ACE_DIRECTORYINHERIT) {
127 flag &= ~NFSV4ACE_DIRECTORYINHERIT;
128 acep->ae_flags |= ACL_ENTRY_DIRECTORY_INHERIT;
130 if (flag & NFSV4ACE_NOPROPAGATEINHERIT) {
131 flag &= ~NFSV4ACE_NOPROPAGATEINHERIT;
132 acep->ae_flags |= ACL_ENTRY_NO_PROPAGATE_INHERIT;
134 if (flag & NFSV4ACE_INHERITONLY) {
135 flag &= ~NFSV4ACE_INHERITONLY;
136 acep->ae_flags |= ACL_ENTRY_INHERIT_ONLY;
138 if (flag & NFSV4ACE_SUCCESSFULACCESS) {
139 flag &= ~NFSV4ACE_SUCCESSFULACCESS;
140 acep->ae_flags |= ACL_ENTRY_SUCCESSFUL_ACCESS;
142 if (flag & NFSV4ACE_FAILEDACCESS) {
143 flag &= ~NFSV4ACE_FAILEDACCESS;
144 acep->ae_flags |= ACL_ENTRY_FAILED_ACCESS;
149 if (acetype == NFSV4ACE_ALLOWEDTYPE)
150 acep->ae_entry_type = ACL_ENTRY_TYPE_ALLOW;
151 else if (acetype == NFSV4ACE_DENIEDTYPE)
152 acep->ae_entry_type = ACL_ENTRY_TYPE_DENY;
153 else if (acetype == NFSV4ACE_AUDITTYPE)
154 acep->ae_entry_type = ACL_ENTRY_TYPE_AUDIT;
155 else if (acetype == NFSV4ACE_ALARMTYPE)
156 acep->ae_entry_type = ACL_ENTRY_TYPE_ALARM;
158 aceerr = NFSERR_ATTRNOTSUPP;
162 * Now, check for unsupported flag bits.
164 if (aceerr == 0 && flag != 0)
165 aceerr = NFSERR_ATTRNOTSUPP;
168 * And turn the mask into perm bits.
171 aceerr = nfsrv_acemasktoperm(acetype, mask, owner, VREG,
175 *acesizep = NFSM_RNDUP(len) + (4 * NFSX_UNSIGNED);
183 * Turn an NFSv4 ace mask into R/W/X flag bits.
186 nfsrv_acemasktoperm(u_int32_t acetype, u_int32_t mask, int owner,
187 enum vtype type, acl_perm_t *permp)
189 acl_perm_t perm = 0x0;
192 if (mask & NFSV4ACE_READDATA) {
193 mask &= ~NFSV4ACE_READDATA;
194 perm |= ACL_READ_DATA;
196 if (mask & NFSV4ACE_LISTDIRECTORY) {
197 mask &= ~NFSV4ACE_LISTDIRECTORY;
198 perm |= ACL_LIST_DIRECTORY;
200 if (mask & NFSV4ACE_WRITEDATA) {
201 mask &= ~NFSV4ACE_WRITEDATA;
202 perm |= ACL_WRITE_DATA;
204 if (mask & NFSV4ACE_ADDFILE) {
205 mask &= ~NFSV4ACE_ADDFILE;
206 perm |= ACL_ADD_FILE;
208 if (mask & NFSV4ACE_APPENDDATA) {
209 mask &= ~NFSV4ACE_APPENDDATA;
210 perm |= ACL_APPEND_DATA;
212 if (mask & NFSV4ACE_ADDSUBDIRECTORY) {
213 mask &= ~NFSV4ACE_ADDSUBDIRECTORY;
214 perm |= ACL_ADD_SUBDIRECTORY;
216 if (mask & NFSV4ACE_READNAMEDATTR) {
217 mask &= ~NFSV4ACE_READNAMEDATTR;
218 perm |= ACL_READ_NAMED_ATTRS;
220 if (mask & NFSV4ACE_WRITENAMEDATTR) {
221 mask &= ~NFSV4ACE_WRITENAMEDATTR;
222 perm |= ACL_WRITE_NAMED_ATTRS;
224 if (mask & NFSV4ACE_EXECUTE) {
225 mask &= ~NFSV4ACE_EXECUTE;
228 if (mask & NFSV4ACE_SEARCH) {
229 mask &= ~NFSV4ACE_SEARCH;
232 if (mask & NFSV4ACE_DELETECHILD) {
233 mask &= ~NFSV4ACE_DELETECHILD;
234 perm |= ACL_DELETE_CHILD;
236 if (mask & NFSV4ACE_READATTRIBUTES) {
237 mask &= ~NFSV4ACE_READATTRIBUTES;
238 perm |= ACL_READ_ATTRIBUTES;
240 if (mask & NFSV4ACE_WRITEATTRIBUTES) {
241 mask &= ~NFSV4ACE_WRITEATTRIBUTES;
242 perm |= ACL_WRITE_ATTRIBUTES;
244 if (mask & NFSV4ACE_DELETE) {
245 mask &= ~NFSV4ACE_DELETE;
248 if (mask & NFSV4ACE_READACL) {
249 mask &= ~NFSV4ACE_READACL;
250 perm |= ACL_READ_ACL;
252 if (mask & NFSV4ACE_WRITEACL) {
253 mask &= ~NFSV4ACE_WRITEACL;
254 perm |= ACL_WRITE_ACL;
256 if (mask & NFSV4ACE_WRITEOWNER) {
257 mask &= ~NFSV4ACE_WRITEOWNER;
258 perm |= ACL_WRITE_OWNER;
260 if (mask & NFSV4ACE_SYNCHRONIZE) {
261 mask &= ~NFSV4ACE_SYNCHRONIZE;
262 perm |= ACL_SYNCHRONIZE;
265 error = NFSERR_ATTRNOTSUPP;
275 /* local functions */
276 static int nfsrv_buildace(struct nfsrv_descript *, u_char *, int,
277 enum vtype, int, int, struct acl_entry *);
280 * This function builds an NFS ace.
283 nfsrv_buildace(struct nfsrv_descript *nd, u_char *name, int namelen,
284 enum vtype type, int group, int owner, struct acl_entry *ace)
286 u_int32_t *tl, aceflag = 0x0, acemask = 0x0, acetype;
289 full_len = NFSM_RNDUP(namelen);
290 NFSM_BUILD(tl, u_int32_t *, 4 * NFSX_UNSIGNED + full_len);
293 * Fill in the ace type.
295 if (ace->ae_entry_type & ACL_ENTRY_TYPE_ALLOW)
296 acetype = NFSV4ACE_ALLOWEDTYPE;
297 else if (ace->ae_entry_type & ACL_ENTRY_TYPE_DENY)
298 acetype = NFSV4ACE_DENIEDTYPE;
299 else if (ace->ae_entry_type & ACL_ENTRY_TYPE_AUDIT)
300 acetype = NFSV4ACE_AUDITTYPE;
302 acetype = NFSV4ACE_ALARMTYPE;
303 *tl++ = txdr_unsigned(acetype);
306 * Set the flag bits from the ACL.
308 if (ace->ae_flags & ACL_ENTRY_FILE_INHERIT)
309 aceflag |= NFSV4ACE_FILEINHERIT;
310 if (ace->ae_flags & ACL_ENTRY_DIRECTORY_INHERIT)
311 aceflag |= NFSV4ACE_DIRECTORYINHERIT;
312 if (ace->ae_flags & ACL_ENTRY_NO_PROPAGATE_INHERIT)
313 aceflag |= NFSV4ACE_NOPROPAGATEINHERIT;
314 if (ace->ae_flags & ACL_ENTRY_INHERIT_ONLY)
315 aceflag |= NFSV4ACE_INHERITONLY;
316 if (ace->ae_flags & ACL_ENTRY_SUCCESSFUL_ACCESS)
317 aceflag |= NFSV4ACE_SUCCESSFULACCESS;
318 if (ace->ae_flags & ACL_ENTRY_FAILED_ACCESS)
319 aceflag |= NFSV4ACE_FAILEDACCESS;
321 aceflag |= NFSV4ACE_IDENTIFIERGROUP;
322 *tl++ = txdr_unsigned(aceflag);
324 if (ace->ae_perm & ACL_LIST_DIRECTORY)
325 acemask |= NFSV4ACE_LISTDIRECTORY;
326 if (ace->ae_perm & ACL_ADD_FILE)
327 acemask |= NFSV4ACE_ADDFILE;
328 if (ace->ae_perm & ACL_ADD_SUBDIRECTORY)
329 acemask |= NFSV4ACE_ADDSUBDIRECTORY;
330 if (ace->ae_perm & ACL_READ_NAMED_ATTRS)
331 acemask |= NFSV4ACE_READNAMEDATTR;
332 if (ace->ae_perm & ACL_WRITE_NAMED_ATTRS)
333 acemask |= NFSV4ACE_WRITENAMEDATTR;
334 if (ace->ae_perm & ACL_EXECUTE)
335 acemask |= NFSV4ACE_SEARCH;
336 if (ace->ae_perm & ACL_DELETE_CHILD)
337 acemask |= NFSV4ACE_DELETECHILD;
338 if (ace->ae_perm & ACL_READ_ATTRIBUTES)
339 acemask |= NFSV4ACE_READATTRIBUTES;
340 if (ace->ae_perm & ACL_WRITE_ATTRIBUTES)
341 acemask |= NFSV4ACE_WRITEATTRIBUTES;
342 if (ace->ae_perm & ACL_DELETE)
343 acemask |= NFSV4ACE_DELETE;
344 if (ace->ae_perm & ACL_READ_ACL)
345 acemask |= NFSV4ACE_READACL;
346 if (ace->ae_perm & ACL_WRITE_ACL)
347 acemask |= NFSV4ACE_WRITEACL;
348 if (ace->ae_perm & ACL_WRITE_OWNER)
349 acemask |= NFSV4ACE_WRITEOWNER;
350 if (ace->ae_perm & ACL_SYNCHRONIZE)
351 acemask |= NFSV4ACE_SYNCHRONIZE;
353 if (ace->ae_perm & ACL_READ_DATA)
354 acemask |= NFSV4ACE_READDATA;
355 if (ace->ae_perm & ACL_WRITE_DATA)
356 acemask |= NFSV4ACE_WRITEDATA;
357 if (ace->ae_perm & ACL_APPEND_DATA)
358 acemask |= NFSV4ACE_APPENDDATA;
359 if (ace->ae_perm & ACL_READ_NAMED_ATTRS)
360 acemask |= NFSV4ACE_READNAMEDATTR;
361 if (ace->ae_perm & ACL_WRITE_NAMED_ATTRS)
362 acemask |= NFSV4ACE_WRITENAMEDATTR;
363 if (ace->ae_perm & ACL_EXECUTE)
364 acemask |= NFSV4ACE_EXECUTE;
365 if (ace->ae_perm & ACL_READ_ATTRIBUTES)
366 acemask |= NFSV4ACE_READATTRIBUTES;
367 if (ace->ae_perm & ACL_WRITE_ATTRIBUTES)
368 acemask |= NFSV4ACE_WRITEATTRIBUTES;
369 if (ace->ae_perm & ACL_DELETE)
370 acemask |= NFSV4ACE_DELETE;
371 if (ace->ae_perm & ACL_READ_ACL)
372 acemask |= NFSV4ACE_READACL;
373 if (ace->ae_perm & ACL_WRITE_ACL)
374 acemask |= NFSV4ACE_WRITEACL;
375 if (ace->ae_perm & ACL_WRITE_OWNER)
376 acemask |= NFSV4ACE_WRITEOWNER;
377 if (ace->ae_perm & ACL_SYNCHRONIZE)
378 acemask |= NFSV4ACE_SYNCHRONIZE;
380 *tl++ = txdr_unsigned(acemask);
381 *tl++ = txdr_unsigned(namelen);
382 if (full_len - namelen)
383 *(tl + (namelen / NFSX_UNSIGNED)) = 0x0;
384 NFSBCOPY(name, (caddr_t)tl, namelen);
385 return (full_len + 4 * NFSX_UNSIGNED);
389 * Build an NFSv4 ACL.
392 nfsrv_buildacl(struct nfsrv_descript *nd, NFSACL_T *aclp, enum vtype type,
395 int i, entrycnt = 0, retlen;
396 u_int32_t *entrycntp;
397 int isowner, isgroup, namelen, malloced;
398 u_char *name, namestr[NFSV4_SMALLSTR];
400 NFSM_BUILD(entrycntp, u_int32_t *, NFSX_UNSIGNED);
401 retlen = NFSX_UNSIGNED;
403 * Loop through the acl entries, building each one.
405 for (i = 0; i < aclp->acl_cnt; i++) {
406 isowner = isgroup = malloced = 0;
407 switch (aclp->acl_entry[i].ae_tag) {
424 nfsv4_uidtostr(aclp->acl_entry[i].ae_id, &name,
432 nfsv4_gidtostr((gid_t)aclp->acl_entry[i].ae_id, &name,
440 retlen += nfsrv_buildace(nd, name, namelen, type, isgroup,
441 isowner, &aclp->acl_entry[i]);
444 free(name, M_NFSSTRING);
446 *entrycntp = txdr_unsigned(entrycnt);
451 * Compare two NFSv4 acls.
452 * Return 0 if they are the same, 1 if not the same.
455 nfsrv_compareacl(NFSACL_T *aclp1, NFSACL_T *aclp2)
458 struct acl_entry *acep1, *acep2;
460 if (aclp1->acl_cnt != aclp2->acl_cnt)
462 acep1 = aclp1->acl_entry;
463 acep2 = aclp2->acl_entry;
464 for (i = 0; i < aclp1->acl_cnt; i++) {
465 if (acep1->ae_tag != acep2->ae_tag)
467 switch (acep1->ae_tag) {
470 if (acep1->ae_id != acep2->ae_id)
476 if (acep1->ae_perm != acep2->ae_perm)