module/zcommon/zfs_namecheck.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25 /*
  26  * Copyright (c) 2013 by Delphix. All rights reserved.
  27  */
  28
  29 /*
  30  * Common name validation routines for ZFS.  These routines are shared by the
  31  * userland code as well as the ioctl() layer to ensure that we don't
  32  * inadvertently expose a hole through direct ioctl()s that never gets tested.
  33  * In userland, however, we want significantly more information about _why_ the
  34  * name is invalid.  In the kernel, we only care whether it's valid or not.
  35  * Each routine therefore takes a 'namecheck_err_t' which describes exactly why
  36  * the name failed to validate.
  37  *
  38  * Each function returns 0 on success, -1 on error.
  39  */
  40
  41 #if defined(_KERNEL)
  42 #include <sys/systm.h>
  43 #else
  44 #include <string.h>
  45 #endif
  46
  47 #include <sys/param.h>
  48 #include <sys/nvpair.h>
  49 #include "zfs_namecheck.h"
  50 #include "zfs_deleg.h"
  51
  52 static int
  53 valid_char(char c)
  54 {
  55         return ((c >= 'a' && c <= 'z') ||
  56             (c >= 'A' && c <= 'Z') ||
  57             (c >= '0' && c <= '9') ||
  58             c == '-' || c == '_' || c == '.' || c == ':' || c == ' ');
  59 }
  60
  61 /*
  62  * Snapshot names must be made up of alphanumeric characters plus the following
  63  * characters:
  64  *
  65  *      [-_.: ]
  66  */
  67 int
  68 zfs_component_namecheck(const char *path, namecheck_err_t *why, char *what)
  69 {
  70         const char *loc;
  71
  72         if (strlen(path) >= MAXNAMELEN) {
  73                 if (why)
  74                         *why = NAME_ERR_TOOLONG;
  75                 return (-1);
  76         }
  77
  78         if (path[0] == '\0') {
  79                 if (why)
  80                         *why = NAME_ERR_EMPTY_COMPONENT;
  81                 return (-1);
  82         }
  83
  84         for (loc = path; *loc; loc++) {
  85                 if (!valid_char(*loc)) {
  86                         if (why) {
  87                                 *why = NAME_ERR_INVALCHAR;
  88                                 *what = *loc;
  89                         }
  90                         return (-1);
  91                 }
  92         }
  93         return (0);
  94 }
  95
  96
  97 /*
  98  * Permissions set name must start with the letter '@' followed by the
  99  * same character restrictions as snapshot names, except that the name
 100  * cannot exceed 64 characters.
 101  */
 102 int
 103 permset_namecheck(const char *path, namecheck_err_t *why, char *what)
 104 {
 105         if (strlen(path) >= ZFS_PERMSET_MAXLEN) {
 106                 if (why)
 107                         *why = NAME_ERR_TOOLONG;
 108                 return (-1);
 109         }
 110
 111         if (path[0] != '@') {
 112                 if (why) {
 113                         *why = NAME_ERR_NO_AT;
 114                         *what = path[0];
 115                 }
 116                 return (-1);
 117         }
 118
 119         return (zfs_component_namecheck(&path[1], why, what));
 120 }
 121
 122 /*
 123  * Dataset names must be of the following form:
 124  *
 125  *      [component][/]*[component][@component]
 126  *
 127  * Where each component is made up of alphanumeric characters plus the following
 128  * characters:
 129  *
 130  *      [-_.:%]
 131  *
 132  * We allow '%' here as we use that character internally to create unique
 133  * names for temporary clones (for online recv).
 134  */
 135 int
 136 dataset_namecheck(const char *path, namecheck_err_t *why, char *what)
 137 {
 138         const char *loc, *end;
 139         int found_snapshot;
 140
 141         /*
 142          * Make sure the name is not too long.
 143          *
 144          * ZFS_MAXNAMELEN is the maximum dataset length used in the userland
 145          * which is the same as MAXNAMELEN used in the kernel.
 146          * If ZFS_MAXNAMELEN value is changed, make sure to cleanup all
 147          * places using MAXNAMELEN.
 148          *
 149          * When HAVE_KOBJ_NAME_LEN is defined the maximum safe kobject name
 150          * length is 20 bytes.  This 20 bytes is broken down as follows to
 151          * provide a maximum safe <pool>/<dataset>[@snapshot] length of only
 152          * 18 bytes.  To ensure bytes are left for <dataset>[@snapshot] the
 153          * <pool> portition is futher limited to 9 bytes.  For 2.6.27 and
 154          * newer kernels this limit is set to MAXNAMELEN.
 155          *
 156          *   <pool>/<dataset> + <partition> + <newline>
 157          *   (18)             + (1)         + (1)
 158          */
 159 #ifdef HAVE_KOBJ_NAME_LEN
 160         if (strlen(path) > 18) {
 161 #else
 162         if (strlen(path) >= MAXNAMELEN) {
 163 #endif /* HAVE_KOBJ_NAME_LEN */
 164                 if (why)
 165                         *why = NAME_ERR_TOOLONG;
 166                 return (-1);
 167         }
 168
 169         /* Explicitly check for a leading slash.  */
 170         if (path[0] == '/') {
 171                 if (why)
 172                         *why = NAME_ERR_LEADING_SLASH;
 173                 return (-1);
 174         }
 175
 176         if (path[0] == '\0') {
 177                 if (why)
 178                         *why = NAME_ERR_EMPTY_COMPONENT;
 179                 return (-1);
 180         }
 181
 182         loc = path;
 183         found_snapshot = 0;
 184         for (;;) {
 185                 /* Find the end of this component */
 186                 end = loc;
 187                 while (*end != '/' && *end != '@' && *end != '\0')
 188                         end++;
 189
 190                 if (*end == '\0' && end[-1] == '/') {
 191                         /* trailing slashes are not allowed */
 192                         if (why)
 193                                 *why = NAME_ERR_TRAILING_SLASH;
 194                         return (-1);
 195                 }
 196
 197                 /* Zero-length components are not allowed */
 198                 if (loc == end) {
 199                         if (why) {
 200                                 /*
 201                                  * Make sure this is really a zero-length
 202                                  * component and not a '@@'.
 203                                  */
 204                                 if (*end == '@' && found_snapshot) {
 205                                         *why = NAME_ERR_MULTIPLE_AT;
 206                                 } else {
 207                                         *why = NAME_ERR_EMPTY_COMPONENT;
 208                                 }
 209                         }
 210
 211                         return (-1);
 212                 }
 213
 214                 /* Validate the contents of this component */
 215                 while (loc != end) {
 216                         if (!valid_char(*loc) && *loc != '%') {
 217                                 if (why) {
 218                                         *why = NAME_ERR_INVALCHAR;
 219                                         *what = *loc;
 220                                 }
 221                                 return (-1);
 222                         }
 223                         loc++;
 224                 }
 225
 226                 /* If we've reached the end of the string, we're OK */
 227                 if (*end == '\0')
 228                         return (0);
 229
 230                 if (*end == '@') {
 231                         /*
 232                          * If we've found an @ symbol, indicate that we're in
 233                          * the snapshot component, and report a second '@'
 234                          * character as an error.
 235                          */
 236                         if (found_snapshot) {
 237                                 if (why)
 238                                         *why = NAME_ERR_MULTIPLE_AT;
 239                                 return (-1);
 240                         }
 241
 242                         found_snapshot = 1;
 243                 }
 244
 245                 /*
 246                  * If there is a '/' in a snapshot name
 247                  * then report an error
 248                  */
 249                 if (*end == '/' && found_snapshot) {
 250                         if (why)
 251                                 *why = NAME_ERR_TRAILING_SLASH;
 252                         return (-1);
 253                 }
 254
 255                 /* Update to the next component */
 256                 loc = end + 1;
 257         }
 258 }
 259
 260
 261 /*
 262  * mountpoint names must be of the following form:
 263  *
 264  *      /[component][/]*[component][/]
 265  */
 266 int
 267 mountpoint_namecheck(const char *path, namecheck_err_t *why)
 268 {
 269         const char *start, *end;
 270
 271         /*
 272          * Make sure none of the mountpoint component names are too long.
 273          * If a component name is too long then the mkdir of the mountpoint
 274          * will fail but then the mountpoint property will be set to a value
 275          * that can never be mounted.  Better to fail before setting the prop.
 276          * Extra slashes are OK, they will be tossed by the mountpoint mkdir.
 277          */
 278
 279         if (path == NULL || *path != '/') {
 280                 if (why)
 281                         *why = NAME_ERR_LEADING_SLASH;
 282                 return (-1);
 283         }
 284
 285         /* Skip leading slash  */
 286         start = &path[1];
 287         do {
 288                 end = start;
 289                 while (*end != '/' && *end != '\0')
 290                         end++;
 291
 292                 if (end - start >= MAXNAMELEN) {
 293                         if (why)
 294                                 *why = NAME_ERR_TOOLONG;
 295                         return (-1);
 296                 }
 297                 start = end + 1;
 298
 299         } while (*end != '\0');
 300
 301         return (0);
 302 }
 303
 304 /*
 305  * For pool names, we have the same set of valid characters as described in
 306  * dataset names, with the additional restriction that the pool name must begin
 307  * with a letter.  The pool names 'raidz' and 'mirror' are also reserved names
 308  * that cannot be used.
 309  */
 310 int
 311 pool_namecheck(const char *pool, namecheck_err_t *why, char *what)
 312 {
 313         const char *c;
 314
 315         /*
 316          * Make sure the name is not too long.
 317          *
 318          * ZPOOL_MAXNAMELEN is the maximum pool length used in the userland
 319          * which is the same as MAXNAMELEN used in the kernel.
 320          * If ZPOOL_MAXNAMELEN value is changed, make sure to cleanup all
 321          * places using MAXNAMELEN.
 322          *
 323          * When HAVE_KOBJ_NAME_LEN is defined the maximum safe kobject name
 324          * length is 20 bytes.  This 20 bytes is broken down as follows to
 325          * provide a maximum safe <pool>/<dataset>[@snapshot] length of only
 326          * 18 bytes.  To ensure bytes are left for <dataset>[@snapshot] the
 327          * <pool> portition is futher limited to 8 bytes.  For 2.6.27 and
 328          * newer kernels this limit is set to MAXNAMELEN.
 329          *
 330          *   <pool>/<dataset> + <partition> + <newline>
 331          *   (18)             + (1)         + (1)
 332          */
 333 #ifdef HAVE_KOBJ_NAME_LEN
 334         if (strlen(pool) > 8) {
 335 #else
 336         if (strlen(pool) >= MAXNAMELEN) {
 337 #endif /* HAVE_KOBJ_NAME_LEN */
 338                 if (why)
 339                         *why = NAME_ERR_TOOLONG;
 340                 return (-1);
 341         }
 342
 343         c = pool;
 344         while (*c != '\0') {
 345                 if (!valid_char(*c)) {
 346                         if (why) {
 347                                 *why = NAME_ERR_INVALCHAR;
 348                                 *what = *c;
 349                         }
 350                         return (-1);
 351                 }
 352                 c++;
 353         }
 354
 355         if (!(*pool >= 'a' && *pool <= 'z') &&
 356             !(*pool >= 'A' && *pool <= 'Z')) {
 357                 if (why)
 358                         *why = NAME_ERR_NOLETTER;
 359                 return (-1);
 360         }
 361
 362         if (strcmp(pool, "mirror") == 0 || strcmp(pool, "raidz") == 0) {
 363                 if (why)
 364                         *why = NAME_ERR_RESERVED;
 365                 return (-1);
 366         }
 367
 368         if (pool[0] == 'c' && (pool[1] >= '0' && pool[1] <= '9')) {
 369                 if (why)
 370                         *why = NAME_ERR_DISKLIKE;
 371                 return (-1);
 372         }
 373
 374         return (0);
 375 }
 376
 377 #if defined(_KERNEL) && defined(HAVE_SPL)
 378 EXPORT_SYMBOL(pool_namecheck);
 379 EXPORT_SYMBOL(dataset_namecheck);
 380 EXPORT_SYMBOL(zfs_component_namecheck);
 381 #endif