path: root/xlators/nfs/server/src/auth-cache.c

/*
   Copyright 2014-present Facebook. All Rights Reserved
   This file is part of GlusterFS.

   Author :
   Shreyas Siravara <shreyas.siravara@gmail.com>

   This file is licensed to you under your choice of the GNU Lesser
   General Public License, version 3 or any later version (LGPLv3 or
   later), or the GNU General Public License, version 2 (GPLv2), in all
   cases as published by the Free Software Foundation.
*/

#include "refcount.h"
#include "auth-cache.h"
#include "nfs3.h"
#include "exports.h"
#include "nfs-messages.h"

enum auth_cache_lookup_results {
        ENTRY_FOUND     =  0,
        ENTRY_NOT_FOUND = -1,
        ENTRY_EXPIRED   = -2,
};

struct auth_cache_entry {
        GF_REF_DECL;                    /* refcounting */
        data_t             *data;       /* data_unref() on refcount == 0 */

        time_t              timestamp;
        struct export_item *item;
};

/* Given a filehandle and an ip, creates a colon delimited hashkey.
 */
static char*
make_hashkey(struct nfs3_fh *fh, const char *host)
{
        char   *hashkey          = NULL;
        char    exportid[256]    = {0, };
        char    gfid[256]        = {0, };
        char    mountid[256]     = {0, };
        size_t  nbytes           = 0;

        gf_uuid_unparse (fh->exportid, exportid);
        gf_uuid_unparse (fh->gfid, gfid);
        gf_uuid_unparse (fh->mountid, mountid);

        nbytes = strlen (exportid) + strlen (host)
                 + strlen (mountid) + 3;
        hashkey = GF_MALLOC (nbytes, gf_common_mt_char);
        if (!hashkey)
                return NULL;

        snprintf (hashkey, nbytes, "%s:%s:%s", exportid,
                  mountid, host);

        return hashkey;
}

/**
 * auth_cache_init -- Initialize an auth cache and set the ttl_sec
 *
 * @ttl_sec : The TTL to set in seconds
 *
 * @return : allocated auth cache struct, NULL if allocation failed.
 */
struct auth_cache *
auth_cache_init (time_t ttl_sec)
{
        struct auth_cache *cache = GF_CALLOC (1, sizeof (*cache),
                                              gf_nfs_mt_auth_cache);

        GF_VALIDATE_OR_GOTO ("auth-cache", cache, out);

        cache->cache_dict = dict_new ();
        if (!cache->cache_dict) {
                GF_FREE (cache);
                cache = NULL;
                goto out;
        }

        LOCK_INIT (&cache->lock);
        cache->ttl_sec = ttl_sec;
out:
        return cache;
}

/* auth_cache_entry_free -- called by refcounting subsystem on refcount == 0
 *
 * @to_free: auth_cache_entry that has refcount == 0 and needs to get free'd
 */
void
auth_cache_entry_free (void *to_free)
{
        struct auth_cache_entry *entry      = to_free;
        data_t                  *entry_data = NULL;

        GF_VALIDATE_OR_GOTO (GF_NFS, entry, out);
        GF_VALIDATE_OR_GOTO (GF_NFS, entry->data, out);

        entry_data = entry->data;
        /* set data_t->data to NULL, otherwise data_unref() tries to free it */
        entry_data->data = NULL;
        data_unref (entry_data);

        GF_FREE (entry);
out:
        return;
}

/**
 * auth_cache_entry_init -- Initialize an auth cache entry
 *
 * @return: Pointer to an allocated auth cache entry, NULL if allocation
 *          failed.
 */
static struct auth_cache_entry *
auth_cache_entry_init ()
{
        struct auth_cache_entry *entry = NULL;

        entry = GF_CALLOC (1, sizeof (*entry), gf_nfs_mt_auth_cache_entry);
        if (!entry)
                gf_msg (GF_NFS, GF_LOG_WARNING, ENOMEM, NFS_MSG_NO_MEMORY,
                        "failed to allocate entry");
        else
                GF_REF_INIT (entry, auth_cache_entry_free);

        return entry;
}

/**
 * auth_cache_add -- Add an auth_cache_entry to the cache->dict
 *
 * @return: 0 on success, non-zero otherwise.
 */
static int
auth_cache_add (struct auth_cache *cache, char *hashkey,
                struct auth_cache_entry *entry)
{
        int      ret        = -1;
        data_t  *entry_data = NULL;

        GF_VALIDATE_OR_GOTO (GF_NFS, cache, out);
        GF_VALIDATE_OR_GOTO (GF_NFS, cache->cache_dict, out);

        /* FIXME: entry is passed as parameter, this can never fail? */
        entry = GF_REF_GET (entry);
        if (!entry) {
                /* entry does not have any references */
                ret = -1;
                goto out;
        }

        entry_data = bin_to_data (entry, sizeof (*entry));
        if (!entry_data) {
                ret = -1;
                GF_REF_PUT (entry);
                goto out;
        }

        /* we'll take an extra ref on the data_t, it gets unref'd when the
         * auth_cache_entry is released */
        entry->data = data_ref (entry_data);

        LOCK (&cache->lock);
        {
                ret = dict_set (cache->cache_dict, hashkey, entry_data);
        }
        UNLOCK (&cache->lock);

        if (ret) {
                /* adding to dict failed */
                GF_REF_PUT (entry);
        }
out:
        return ret;
}

/**
 * _auth_cache_expired -- Check if the auth_cache_entry has expired
 *
 * The auth_cache->lock should have been taken when this function is called.
 *
 * @return: true when the auth_cache_entry is expired, false otherwise.
 */
static int
_auth_cache_expired (struct auth_cache *cache, struct auth_cache_entry *entry)
{
        return ((time (NULL) - entry->timestamp) > cache->ttl_sec);
}

/**
 * auth_cache_get -- Get the @hashkey entry from the cache->cache_dict
 *
 * @cache: The auth_cache that should contain the @entry.
 * @haskkey: The key associated with the auth_cache_entry.
 * @entry: The found auth_cache_entry, unmodified if not found/expired.
 *
 * The using the cache->dict requires locking, this function takes care of
 * that. When the entry is found, but has expired, it will be removed from the
 * cache_dict.
 *
 * @return: 0 when found, ENTRY_NOT_FOUND or ENTRY_EXPIRED otherwise.
 */
static enum auth_cache_lookup_results
auth_cache_get (struct auth_cache *cache, char *hashkey,
                struct auth_cache_entry **entry)
{
        enum auth_cache_lookup_results  ret        = ENTRY_NOT_FOUND;
        data_t                         *entry_data = NULL;
        struct auth_cache_entry        *lookup_res = NULL;

        GF_VALIDATE_OR_GOTO (GF_NFS, cache, out);
        GF_VALIDATE_OR_GOTO (GF_NFS, cache->cache_dict, out);
        GF_VALIDATE_OR_GOTO (GF_NFS, hashkey, out);

        LOCK (&cache->lock);
        {
                entry_data = dict_get (cache->cache_dict, hashkey);
                if (!entry_data)
                        goto unlock;

                /* FIXME: this is dangerous use of entry_data */
                lookup_res = GF_REF_GET ((struct auth_cache_entry *) entry_data->data);
                if (lookup_res == NULL) {
                        /* entry has been free'd */
                        ret = ENTRY_EXPIRED;
                        goto unlock;
                }

                if (_auth_cache_expired (cache, lookup_res)) {
                        ret = ENTRY_EXPIRED;
                        GF_REF_PUT (lookup_res->item);
                        lookup_res->item = NULL;

                        /* free entry and remove from the cache */
                        GF_FREE (lookup_res);
                        entry_data->data = NULL;
                        dict_del (cache->cache_dict, hashkey);

                        goto unlock;
                }

                *entry = lookup_res;
                ret = ENTRY_FOUND;
        }
unlock:
        UNLOCK (&cache->lock);

out:
        return ret;
}

/**
 * auth_cache_lookup -- Lookup an item from the cache
 *
 * @cache: cache to lookup from
 * @fh   : FH to use in lookup
 * @host_addr: Address to use in lookup
 * @timestamp: The timestamp to set when lookup succeeds
 * @can_write: Is the host authorized to write to the filehandle?
 *
 * If the current time - entry time of the cache entry > ttl_sec,
 * we remove the element from the dict and return ENTRY_EXPIRED.
 *
 * @return: ENTRY_EXPIRED if entry expired
 *          ENTRY_NOT_FOUND if entry not found in dict
 *          0 if found
 */
enum auth_cache_lookup_results
auth_cache_lookup (struct auth_cache *cache, struct nfs3_fh *fh,
                   const char *host_addr, time_t *timestamp,
                   gf_boolean_t *can_write)
{
        char                           *hashkey    = NULL;
        struct auth_cache_entry        *lookup_res = NULL;
        enum auth_cache_lookup_results  ret        = ENTRY_NOT_FOUND;

        GF_VALIDATE_OR_GOTO (GF_NFS, cache, out);
        GF_VALIDATE_OR_GOTO (GF_NFS, fh, out);
        GF_VALIDATE_OR_GOTO (GF_NFS, host_addr, out);
        GF_VALIDATE_OR_GOTO (GF_NFS, timestamp, out);
        GF_VALIDATE_OR_GOTO (GF_NFS, can_write, out);

        hashkey = make_hashkey (fh, host_addr);
        if (!hashkey) {
                ret = -ENOMEM;
                goto out;
        }

        ret = auth_cache_get (cache, hashkey, &lookup_res);
        switch (ret) {
        case ENTRY_FOUND:
                *timestamp = lookup_res->timestamp;
                *can_write = lookup_res->item->opts->rw;
                GF_REF_PUT (lookup_res);
                break;

        case ENTRY_NOT_FOUND:
                gf_msg_debug (GF_NFS, 0, "could not find entry for %s",
                              host_addr);
                break;

        case ENTRY_EXPIRED:
                gf_msg_debug (GF_NFS, 0, "entry for host %s has expired",
                              host_addr);
                break;
        }

out:
        GF_FREE (hashkey);

        return ret;
}

/* auth_cache_entry_purge -- free up the auth_cache_entry
 *
 * This gets called through dict_foreach() by auth_cache_purge(). Each
 * auth_cache_entry has a refcount which needs to be decremented. Once the
 * auth_cache_entry reaches refcount == 0, auth_cache_entry_free() will call
 * data_unref() to free the associated data_t.
 *
 * @d: dict that gets purged by auth_cache_purge()
 * @k: hashkey of the current entry
 * @v: data_t of the current entry
 */
int
auth_cache_entry_purge (dict_t *d, char *k, data_t *v, void *_unused)
{
        struct auth_cache_entry *entry = (struct auth_cache_entry *) v->data;

        if (entry)
                GF_REF_PUT (entry);

        return 0;
}

/**
 * auth_cache_purge -- Purge the dict in the cache and create a new empty one.
 *
 * @cache: Cache to purge
 *
 */
void
auth_cache_purge (struct auth_cache *cache)
{
        dict_t *new_cache_dict = dict_new ();
        dict_t *old_cache_dict = NULL;

        if (!cache || !new_cache_dict)
                goto out;

        LOCK (&cache->lock);
        {
                old_cache_dict = cache->cache_dict;
                cache->cache_dict = new_cache_dict;
        }
        UNLOCK (&cache->lock);

        /* walk all entries and refcount-- with GF_REF_PUT() */
        dict_foreach (old_cache_dict, auth_cache_entry_purge, NULL);
        dict_unref (old_cache_dict);
out:
        return;
}

/**
 * is_nfs_fh_cached_and_writeable -- Checks if an NFS FH is cached for the given
 *                                   host
 * @cache: The fh cache
 * @host_addr: Address to use in lookup
 * @fh: The fh to use in lookup
 *
 *
 * @return: TRUE if cached, FALSE otherwise
 *
 */
gf_boolean_t
is_nfs_fh_cached (struct auth_cache *cache, struct nfs3_fh *fh,
                  const char *host_addr)
{
        int          ret       = 0;
        time_t       timestamp = 0;
        gf_boolean_t cached    = _gf_false;
        gf_boolean_t can_write = _gf_false;

        if (!fh)
                goto out;

        ret = auth_cache_lookup (cache, fh, host_addr, &timestamp, &can_write);
        cached = (ret == ENTRY_FOUND);

out:
        return cached;
}


/**
 * is_nfs_fh_cached_and_writeable -- Checks if an NFS FH is cached for the given
 *                                   host and writable
 * @cache: The fh cache
 * @host_addr: Address to use in lookup
 * @fh: The fh to use in lookup
 *
 *
 * @return: TRUE if cached & writable, FALSE otherwise
 *
 */
gf_boolean_t
is_nfs_fh_cached_and_writeable (struct auth_cache *cache, struct nfs3_fh *fh,
                                const char *host_addr)
{
        int          ret       = 0;
        time_t       timestamp = 0;
        gf_boolean_t cached    = _gf_false;
        gf_boolean_t writable  = _gf_false;

        if (!fh)
                goto out;

        ret = auth_cache_lookup (cache, fh, host_addr, &timestamp, &writable);
        cached = ((ret == ENTRY_FOUND) && writable);

out:
        return cached;
}

/**
 * cache_nfs_fh -- Places the nfs file handle in the underlying dict as we are
 *                 using as our cache. The key is "exportid:gfid:host_addr", the
 *                 value is an entry struct containing the export item that
 *                 was authorized for the operation and the file handle that was
 *                 authorized.
 *
 * @cache: The cache to place fh's in
 * @fh   : The fh to cache
 * @host_addr: The address of the host
 * @export_item: The export item that was authorized
 *
 */
int
cache_nfs_fh (struct auth_cache *cache, struct nfs3_fh *fh,
              const char *host_addr, struct export_item *export_item)
{
        int                      ret        = -EINVAL;
        char                    *hashkey    = NULL;
        time_t                   timestamp  = 0;
        gf_boolean_t             can_write  = _gf_false;
        struct auth_cache_entry *entry      = NULL;

        GF_VALIDATE_OR_GOTO (GF_NFS, host_addr, out);
        GF_VALIDATE_OR_GOTO (GF_NFS, cache, out);
        GF_VALIDATE_OR_GOTO (GF_NFS, fh, out);

        /* If we could already find it in the cache, just return */
        ret = auth_cache_lookup (cache, fh, host_addr, &timestamp, &can_write);
        if (ret == 0) {
                gf_msg_trace (GF_NFS, 0, "found cached auth/fh for host "
                              "%s", host_addr);
                goto out;
        }

        hashkey = make_hashkey (fh, host_addr);
        if (!hashkey) {
                ret = -ENOMEM;
                goto out;
        }

        entry = auth_cache_entry_init ();
        if (!entry) {
                ret = -ENOMEM;
                goto out;
        }

        entry->timestamp = time (NULL);
        /* Update entry->item if it is pointing to a different export_item */
        if (entry->item && entry->item != export_item) {
                GF_REF_PUT (entry->item);
        }
        entry->item = GF_REF_GET (export_item);

        ret = auth_cache_add (cache, hashkey, entry);
        GF_REF_PUT (entry);
        if (ret)
                goto out;

        gf_msg_trace (GF_NFS, 0, "Caching file-handle (%s)", host_addr);
        ret = 0;

out:
        GF_FREE (hashkey);

        return ret;
}