/* AFS security handling
   *
   * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
   * Written by David Howells (dhowells@redhat.com)
   *
   * This program is free software; you can redistribute it and/or
   * modify it under the terms of the GNU General Public License
   * as published by the Free Software Foundation; either version
   * 2 of the License, or (at your option) any later version.
   */
  
  #include <linux/init.h>
  #include <linux/slab.h>
  #include <linux/fs.h>
  #include <linux/ctype.h>
  #include <linux/sched.h>
  #include <keys/rxrpc-type.h>
  #include "internal.h"
  
  /*
   * get a key
   */
  struct key *afs_request_key(struct afs_cell *cell)
  {
  	struct key *key;
  
  	_enter("{%x}", key_serial(cell->anonymous_key));
  
  	_debug("key %s", cell->anonymous_key->description);
  	key = request_key(&key_type_rxrpc, cell->anonymous_key->description,
  			  NULL);
  	if (IS_ERR(key)) {
  		if (PTR_ERR(key) != -ENOKEY) {
  			_leave(" = %ld", PTR_ERR(key));
  			return key;
  		}
  
  		/* act as anonymous user */
  		_leave(" = {%x} [anon]", key_serial(cell->anonymous_key));
  		return key_get(cell->anonymous_key);
  	} else {
  		/* act as authorised user */
  		_leave(" = {%x} [auth]", key_serial(key));
  		return key;
  	}
  }
  
  /*
   * dispose of a permits list
   */
  void afs_zap_permits(struct rcu_head *rcu)
  {
  	struct afs_permits *permits =
  		container_of(rcu, struct afs_permits, rcu);
  	int loop;
  
  	_enter("{%d}", permits->count);
  
  	for (loop = permits->count - 1; loop >= 0; loop--)
  		key_put(permits->permits[loop].key);
  	kfree(permits);
  }
  
  /*
   * dispose of a permits list in which all the key pointers have been copied
   */
  static void afs_dispose_of_permits(struct rcu_head *rcu)
  {
  	struct afs_permits *permits =
  		container_of(rcu, struct afs_permits, rcu);
  
  	_enter("{%d}", permits->count);
  
  	kfree(permits);
  }
  
  /*
   * get the authorising vnode - this is the specified inode itself if it's a
   * directory or it's the parent directory if the specified inode is a file or
   * symlink
   * - the caller must release the ref on the inode
   */
  static struct afs_vnode *afs_get_auth_inode(struct afs_vnode *vnode,
  					    struct key *key)
  {
  	struct afs_vnode *auth_vnode;
  	struct inode *auth_inode;
  
  	_enter("");
  
  	if (S_ISDIR(vnode->vfs_inode.i_mode)) {
  		auth_inode = igrab(&vnode->vfs_inode);
  		ASSERT(auth_inode != NULL);
  	} else {
  		auth_inode = afs_iget(vnode->vfs_inode.i_sb, key,
  				      &vnode->status.parent, NULL, NULL);
  		if (IS_ERR(auth_inode))
  			return ERR_CAST(auth_inode);
  	}
  
  	auth_vnode = AFS_FS_I(auth_inode);
  	_leave(" = {%x}", auth_vnode->fid.vnode);
  	return auth_vnode;
  }
  
  /*
   * clear the permit cache on a directory vnode
   */
  void afs_clear_permits(struct afs_vnode *vnode)
  {
  	struct afs_permits *permits;
  
  	_enter("{%x:%u}", vnode->fid.vid, vnode->fid.vnode);
  
  	mutex_lock(&vnode->permits_lock);
  	permits = vnode->permits;
  	rcu_assign_pointer(vnode->permits, NULL);
  	mutex_unlock(&vnode->permits_lock);
  
  	if (permits)
  		call_rcu(&permits->rcu, afs_zap_permits);
  	_leave("");
  }
  
  /*
   * add the result obtained for a vnode to its or its parent directory's cache
   * for the key used to access it
   */
  void afs_cache_permit(struct afs_vnode *vnode, struct key *key, long acl_order)
  {
  	struct afs_permits *permits, *xpermits;
  	struct afs_permit *permit;
  	struct afs_vnode *auth_vnode;
  	int count, loop;
  
  	_enter("{%x:%u},%x,%lx",
  	       vnode->fid.vid, vnode->fid.vnode, key_serial(key), acl_order);
  
  	auth_vnode = afs_get_auth_inode(vnode, key);
  	if (IS_ERR(auth_vnode)) {
  		_leave(" [get error %ld]", PTR_ERR(auth_vnode));
  		return;
  	}
  
  	mutex_lock(&auth_vnode->permits_lock);
  
  	/* guard against a rename being detected whilst we waited for the
  	 * lock */
  	if (memcmp(&auth_vnode->fid, &vnode->status.parent,
  		   sizeof(struct afs_fid)) != 0) {
  		_debug("renamed");
  		goto out_unlock;
  	}
  
  	/* have to be careful as the directory's callback may be broken between
  	 * us receiving the status we're trying to cache and us getting the
  	 * lock to update the cache for the status */
  	if (auth_vnode->acl_order - acl_order > 0) {
  		_debug("ACL changed?");
  		goto out_unlock;
  	}
  
  	/* always update the anonymous mask */
  	_debug("anon access %x", vnode->status.anon_access);
  	auth_vnode->status.anon_access = vnode->status.anon_access;
  	if (key == vnode->volume->cell->anonymous_key)
  		goto out_unlock;
  
  	xpermits = auth_vnode->permits;
  	count = 0;
  	if (xpermits) {
  		/* see if the permit is already in the list
  		 * - if it is then we just amend the list
  		 */
  		count = xpermits->count;
  		permit = xpermits->permits;
  		for (loop = count; loop > 0; loop--) {
  			if (permit->key == key) {
  				permit->access_mask =
  					vnode->status.caller_access;
  				goto out_unlock;
  			}
  			permit++;
  		}
  	}
  
  	permits = kmalloc(sizeof(*permits) + sizeof(*permit) * (count + 1),
  			  GFP_NOFS);
  	if (!permits)
  		goto out_unlock;
  
  	if (xpermits)
  		memcpy(permits->permits, xpermits->permits,
  			count * sizeof(struct afs_permit));
  
  	_debug("key %x access %x",
  	       key_serial(key), vnode->status.caller_access);
  	permits->permits[count].access_mask = vnode->status.caller_access;
  	permits->permits[count].key = key_get(key);
  	permits->count = count + 1;
  
  	rcu_assign_pointer(auth_vnode->permits, permits);
  	if (xpermits)
  		call_rcu(&xpermits->rcu, afs_dispose_of_permits);
  
  out_unlock:
  	mutex_unlock(&auth_vnode->permits_lock);
  	iput(&auth_vnode->vfs_inode);
  	_leave("");
  }
  
  /*
   * check with the fileserver to see if the directory or parent directory is
   * permitted to be accessed with this authorisation, and if so, what access it
   * is granted
   */
  static int afs_check_permit(struct afs_vnode *vnode, struct key *key,
  			    afs_access_t *_access)
  {
  	struct afs_permits *permits;
  	struct afs_permit *permit;
  	struct afs_vnode *auth_vnode;
  	bool valid;
  	int loop, ret;
  
  	_enter("{%x:%u},%x",
  	       vnode->fid.vid, vnode->fid.vnode, key_serial(key));
  
  	auth_vnode = afs_get_auth_inode(vnode, key);
  	if (IS_ERR(auth_vnode)) {
  		*_access = 0;
  		_leave(" = %ld", PTR_ERR(auth_vnode));
  		return PTR_ERR(auth_vnode);
  	}
  
  	ASSERT(S_ISDIR(auth_vnode->vfs_inode.i_mode));
  
  	/* check the permits to see if we've got one yet */
  	if (key == auth_vnode->volume->cell->anonymous_key) {
  		_debug("anon");
  		*_access = auth_vnode->status.anon_access;
  		valid = true;
  	} else {
  		valid = false;
  		rcu_read_lock();
  		permits = rcu_dereference(auth_vnode->permits);
  		if (permits) {
  			permit = permits->permits;
  			for (loop = permits->count; loop > 0; loop--) {
  				if (permit->key == key) {
  					_debug("found in cache");
  					*_access = permit->access_mask;
  					valid = true;
  					break;
  				}
  				permit++;
  			}
  		}
  		rcu_read_unlock();
  	}
  
  	if (!valid) {
  		/* check the status on the file we're actually interested in
  		 * (the post-processing will cache the result on auth_vnode) */
  		_debug("no valid permit");
  
  		set_bit(AFS_VNODE_CB_BROKEN, &vnode->flags);
  		ret = afs_vnode_fetch_status(vnode, auth_vnode, key);
  		if (ret < 0) {
  			iput(&auth_vnode->vfs_inode);
  			*_access = 0;
  			_leave(" = %d", ret);
  			return ret;
  		}
  		*_access = vnode->status.caller_access;
  	}
  
  	iput(&auth_vnode->vfs_inode);
  	_leave(" = 0 [access %x]", *_access);
  	return 0;
  }
  
  /*
   * check the permissions on an AFS file
   * - AFS ACLs are attached to directories only, and a file is controlled by its
   *   parent directory's ACL
   */
  int afs_permission(struct inode *inode, int mask)
  {
  	struct afs_vnode *vnode = AFS_FS_I(inode);
  	afs_access_t uninitialized_var(access);
  	struct key *key;
  	int ret;
  
  	if (mask & MAY_NOT_BLOCK)
  		return -ECHILD;
  
  	_enter("{{%x:%u},%lx},%x,",
  	       vnode->fid.vid, vnode->fid.vnode, vnode->flags, mask);
  
  	key = afs_request_key(vnode->volume->cell);
  	if (IS_ERR(key)) {
  		_leave(" = %ld [key]", PTR_ERR(key));
  		return PTR_ERR(key);
  	}
  
  	/* if the promise has expired, we need to check the server again */
  	if (!vnode->cb_promised) {
  		_debug("not promised");
  		ret = afs_vnode_fetch_status(vnode, NULL, key);
  		if (ret < 0)
  			goto error;
  		_debug("new promise [fl=%lx]", vnode->flags);
  	}
  
  	/* check the permits to see if we've got one yet */
  	ret = afs_check_permit(vnode, key, &access);
  	if (ret < 0)
  		goto error;
  
  	/* interpret the access mask */
  	_debug("REQ %x ACC %x on %s",
  	       mask, access, S_ISDIR(inode->i_mode) ? "dir" : "file");
  
  	if (S_ISDIR(inode->i_mode)) {
  		if (mask & MAY_EXEC) {
  			if (!(access & AFS_ACE_LOOKUP))
  				goto permission_denied;
  		} else if (mask & MAY_READ) {
  			if (!(access & AFS_ACE_READ))
  				goto permission_denied;
  		} else if (mask & MAY_WRITE) {
  			if (!(access & (AFS_ACE_DELETE | /* rmdir, unlink, rename from */
  					AFS_ACE_INSERT | /* create, mkdir, symlink, rename to */
  					AFS_ACE_WRITE))) /* chmod */
  				goto permission_denied;
  		} else {
  			BUG();
  		}
  	} else {
  		if (!(access & AFS_ACE_LOOKUP))
  			goto permission_denied;
  		if (mask & (MAY_EXEC | MAY_READ)) {
  			if (!(access & AFS_ACE_READ))
  				goto permission_denied;
  		} else if (mask & MAY_WRITE) {
  			if (!(access & AFS_ACE_WRITE))
  				goto permission_denied;
  		}
  	}
  
  	key_put(key);
  	ret = generic_permission(inode, mask);
  	_leave(" = %d", ret);
  	return ret;
  
  permission_denied:
  	ret = -EACCES;
  error:
  	key_put(key);
  	_leave(" = %d", ret);
  	return ret;
  }