module/zcommon/zfs_namecheck.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25
  26 /*
  27  * Common name validation routines for ZFS.  These routines are shared by the
  28  * userland code as well as the ioctl() layer to ensure that we don't
  29  * inadvertently expose a hole through direct ioctl()s that never gets tested.
  30  * In userland, however, we want significantly more information about _why_ the
  31  * name is invalid.  In the kernel, we only care whether it's valid or not.
  32  * Each routine therefore takes a 'namecheck_err_t' which describes exactly why
  33  * the name failed to validate.
  34  *
  35  * Each function returns 0 on success, -1 on error.
  36  */
  37
  38 #if defined(_KERNEL)
  39 #include <sys/systm.h>
  40 #else
  41 #include <string.h>
  42 #endif
  43
  44 #include <sys/param.h>
  45 #include <sys/nvpair.h>
  46 #include "zfs_namecheck.h"
  47 #include "zfs_deleg.h"
  48
  49 static int
  50 valid_char(char c)
  51 {
  52         return ((c >= 'a' && c <= 'z') ||
  53             (c >= 'A' && c <= 'Z') ||
  54             (c >= '0' && c <= '9') ||
  55             c == '-' || c == '_' || c == '.' || c == ':' || c == ' ');
  56 }
  57
  58 /*
  59  * Snapshot names must be made up of alphanumeric characters plus the following
  60  * characters:
  61  *
  62  *      [-_.:]
  63  */
  64 int
  65 snapshot_namecheck(const char *path, namecheck_err_t *why, char *what)
  66 {
  67         const char *loc;
  68
  69         if (strlen(path) >= MAXNAMELEN) {
  70                 if (why)
  71                         *why = NAME_ERR_TOOLONG;
  72                 return (-1);
  73         }
  74
  75         if (path[0] == '\0') {
  76                 if (why)
  77                         *why = NAME_ERR_EMPTY_COMPONENT;
  78                 return (-1);
  79         }
  80
  81         for (loc = path; *loc; loc++) {
  82                 if (!valid_char(*loc)) {
  83                         if (why) {
  84                                 *why = NAME_ERR_INVALCHAR;
  85                                 *what = *loc;
  86                         }
  87                         return (-1);
  88                 }
  89         }
  90         return (0);
  91 }
  92
  93
  94 /*
  95  * Permissions set name must start with the letter '@' followed by the
  96  * same character restrictions as snapshot names, except that the name
  97  * cannot exceed 64 characters.
  98  */
  99 int
 100 permset_namecheck(const char *path, namecheck_err_t *why, char *what)
 101 {
 102         if (strlen(path) >= ZFS_PERMSET_MAXLEN) {
 103                 if (why)
 104                         *why = NAME_ERR_TOOLONG;
 105                 return (-1);
 106         }
 107
 108         if (path[0] != '@') {
 109                 if (why) {
 110                         *why = NAME_ERR_NO_AT;
 111                         *what = path[0];
 112                 }
 113                 return (-1);
 114         }
 115
 116         return (snapshot_namecheck(&path[1], why, what));
 117 }
 118
 119 /*
 120  * Dataset names must be of the following form:
 121  *
 122  *      [component][/]*[component][@component]
 123  *
 124  * Where each component is made up of alphanumeric characters plus the following
 125  * characters:
 126  *
 127  *      [-_.:%]
 128  *
 129  * We allow '%' here as we use that character internally to create unique
 130  * names for temporary clones (for online recv).
 131  */
 132 int
 133 dataset_namecheck(const char *path, namecheck_err_t *why, char *what)
 134 {
 135         const char *loc, *end;
 136         int found_snapshot;
 137
 138         /*
 139          * Make sure the name is not too long.
 140          *
 141          * ZFS_MAXNAMELEN is the maximum dataset length used in the userland
 142          * which is the same as MAXNAMELEN used in the kernel.
 143          * If ZFS_MAXNAMELEN value is changed, make sure to cleanup all
 144          * places using MAXNAMELEN.
 145          */
 146
 147         if (strlen(path) >= MAXNAMELEN) {
 148                 if (why)
 149                         *why = NAME_ERR_TOOLONG;
 150                 return (-1);
 151         }
 152
 153         /* Explicitly check for a leading slash.  */
 154         if (path[0] == '/') {
 155                 if (why)
 156                         *why = NAME_ERR_LEADING_SLASH;
 157                 return (-1);
 158         }
 159
 160         if (path[0] == '\0') {
 161                 if (why)
 162                         *why = NAME_ERR_EMPTY_COMPONENT;
 163                 return (-1);
 164         }
 165
 166         loc = path;
 167         found_snapshot = 0;
 168         for (;;) {
 169                 /* Find the end of this component */
 170                 end = loc;
 171                 while (*end != '/' && *end != '@' && *end != '\0')
 172                         end++;
 173
 174                 if (*end == '\0' && end[-1] == '/') {
 175                         /* trailing slashes are not allowed */
 176                         if (why)
 177                                 *why = NAME_ERR_TRAILING_SLASH;
 178                         return (-1);
 179                 }
 180
 181                 /* Zero-length components are not allowed */
 182                 if (loc == end) {
 183                         if (why) {
 184                                 /*
 185                                  * Make sure this is really a zero-length
 186                                  * component and not a '@@'.
 187                                  */
 188                                 if (*end == '@' && found_snapshot) {
 189                                         *why = NAME_ERR_MULTIPLE_AT;
 190                                 } else {
 191                                         *why = NAME_ERR_EMPTY_COMPONENT;
 192                                 }
 193                         }
 194
 195                         return (-1);
 196                 }
 197
 198                 /* Validate the contents of this component */
 199                 while (loc != end) {
 200                         if (!valid_char(*loc) && *loc != '%') {
 201                                 if (why) {
 202                                         *why = NAME_ERR_INVALCHAR;
 203                                         *what = *loc;
 204                                 }
 205                                 return (-1);
 206                         }
 207                         loc++;
 208                 }
 209
 210                 /* If we've reached the end of the string, we're OK */
 211                 if (*end == '\0')
 212                         return (0);
 213
 214                 if (*end == '@') {
 215                         /*
 216                          * If we've found an @ symbol, indicate that we're in
 217                          * the snapshot component, and report a second '@'
 218                          * character as an error.
 219                          */
 220                         if (found_snapshot) {
 221                                 if (why)
 222                                         *why = NAME_ERR_MULTIPLE_AT;
 223                                 return (-1);
 224                         }
 225
 226                         found_snapshot = 1;
 227                 }
 228
 229                 /*
 230                  * If there is a '/' in a snapshot name
 231                  * then report an error
 232                  */
 233                 if (*end == '/' && found_snapshot) {
 234                         if (why)
 235                                 *why = NAME_ERR_TRAILING_SLASH;
 236                         return (-1);
 237                 }
 238
 239                 /* Update to the next component */
 240                 loc = end + 1;
 241         }
 242 }
 243
 244
 245 /*
 246  * mountpoint names must be of the following form:
 247  *
 248  *      /[component][/]*[component][/]
 249  */
 250 int
 251 mountpoint_namecheck(const char *path, namecheck_err_t *why)
 252 {
 253         const char *start, *end;
 254
 255         /*
 256          * Make sure none of the mountpoint component names are too long.
 257          * If a component name is too long then the mkdir of the mountpoint
 258          * will fail but then the mountpoint property will be set to a value
 259          * that can never be mounted.  Better to fail before setting the prop.
 260          * Extra slashes are OK, they will be tossed by the mountpoint mkdir.
 261          */
 262
 263         if (path == NULL || *path != '/') {
 264                 if (why)
 265                         *why = NAME_ERR_LEADING_SLASH;
 266                 return (-1);
 267         }
 268
 269         /* Skip leading slash  */
 270         start = &path[1];
 271         do {
 272                 end = start;
 273                 while (*end != '/' && *end != '\0')
 274                         end++;
 275
 276                 if (end - start >= MAXNAMELEN) {
 277                         if (why)
 278                                 *why = NAME_ERR_TOOLONG;
 279                         return (-1);
 280                 }
 281                 start = end + 1;
 282
 283         } while (*end != '\0');
 284
 285         return (0);
 286 }
 287
 288 /*
 289  * For pool names, we have the same set of valid characters as described in
 290  * dataset names, with the additional restriction that the pool name must begin
 291  * with a letter.  The pool names 'raidz' and 'mirror' are also reserved names
 292  * that cannot be used.
 293  */
 294 int
 295 pool_namecheck(const char *pool, namecheck_err_t *why, char *what)
 296 {
 297         const char *c;
 298
 299         /*
 300          * Make sure the name is not too long.
 301          *
 302          * ZPOOL_MAXNAMELEN is the maximum pool length used in the userland
 303          * which is the same as MAXNAMELEN used in the kernel.
 304          * If ZPOOL_MAXNAMELEN value is changed, make sure to cleanup all
 305          * places using MAXNAMELEN.
 306          */
 307         if (strlen(pool) >= MAXNAMELEN) {
 308                 if (why)
 309                         *why = NAME_ERR_TOOLONG;
 310                 return (-1);
 311         }
 312
 313         c = pool;
 314         while (*c != '\0') {
 315                 if (!valid_char(*c)) {
 316                         if (why) {
 317                                 *why = NAME_ERR_INVALCHAR;
 318                                 *what = *c;
 319                         }
 320                         return (-1);
 321                 }
 322                 c++;
 323         }
 324
 325         if (!(*pool >= 'a' && *pool <= 'z') &&
 326             !(*pool >= 'A' && *pool <= 'Z')) {
 327                 if (why)
 328                         *why = NAME_ERR_NOLETTER;
 329                 return (-1);
 330         }
 331
 332         if (strcmp(pool, "mirror") == 0 || strcmp(pool, "raidz") == 0) {
 333                 if (why)
 334                         *why = NAME_ERR_RESERVED;
 335                 return (-1);
 336         }
 337
 338         if (pool[0] == 'c' && (pool[1] >= '0' && pool[1] <= '9')) {
 339                 if (why)
 340                         *why = NAME_ERR_DISKLIKE;
 341                 return (-1);
 342         }
 343
 344         return (0);
 345 }