| // Copyright 2018 The ChromiumOS Authors |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| mod read_dir; |
| |
| use std::cmp::min; |
| use std::collections::btree_map; |
| use std::collections::BTreeMap; |
| use std::ffi::CStr; |
| use std::ffi::CString; |
| use std::fs::File; |
| use std::io; |
| use std::io::Cursor; |
| use std::io::Read; |
| use std::io::Write; |
| use std::mem; |
| use std::mem::MaybeUninit; |
| use std::ops::Deref; |
| use std::os::unix::ffi::OsStrExt; |
| use std::os::unix::fs::FileExt; |
| use std::os::unix::io::AsRawFd; |
| use std::os::unix::io::FromRawFd; |
| use std::os::unix::io::RawFd; |
| use std::path::Path; |
| use std::str::FromStr; |
| |
| use read_dir::read_dir; |
| use serde::Deserialize; |
| use serde::Serialize; |
| |
| use crate::protocol::*; |
| use crate::syscall; |
| |
| // Tlopen and Tlcreate flags. Taken from "include/net/9p/9p.h" in the linux tree. |
| const P9_RDONLY: u32 = 0o00000000; |
| const P9_WRONLY: u32 = 0o00000001; |
| const P9_RDWR: u32 = 0o00000002; |
| const P9_NOACCESS: u32 = 0o00000003; |
| const P9_CREATE: u32 = 0o00000100; |
| const P9_EXCL: u32 = 0o00000200; |
| const P9_NOCTTY: u32 = 0o00000400; |
| const P9_TRUNC: u32 = 0o00001000; |
| const P9_APPEND: u32 = 0o00002000; |
| const P9_NONBLOCK: u32 = 0o00004000; |
| const P9_DSYNC: u32 = 0o00010000; |
| const P9_FASYNC: u32 = 0o00020000; |
| const P9_DIRECT: u32 = 0o00040000; |
| const P9_LARGEFILE: u32 = 0o00100000; |
| const P9_DIRECTORY: u32 = 0o00200000; |
| const P9_NOFOLLOW: u32 = 0o00400000; |
| const P9_NOATIME: u32 = 0o01000000; |
| const _P9_CLOEXEC: u32 = 0o02000000; |
| const P9_SYNC: u32 = 0o04000000; |
| |
| // Mapping from 9P flags to libc flags. |
| const MAPPED_FLAGS: [(u32, i32); 16] = [ |
| (P9_WRONLY, libc::O_WRONLY), |
| (P9_RDWR, libc::O_RDWR), |
| (P9_CREATE, libc::O_CREAT), |
| (P9_EXCL, libc::O_EXCL), |
| (P9_NOCTTY, libc::O_NOCTTY), |
| (P9_TRUNC, libc::O_TRUNC), |
| (P9_APPEND, libc::O_APPEND), |
| (P9_NONBLOCK, libc::O_NONBLOCK), |
| (P9_DSYNC, libc::O_DSYNC), |
| (P9_FASYNC, 0), // Unsupported |
| (P9_DIRECT, libc::O_DIRECT), |
| (P9_LARGEFILE, libc::O_LARGEFILE), |
| (P9_DIRECTORY, libc::O_DIRECTORY), |
| (P9_NOFOLLOW, libc::O_NOFOLLOW), |
| (P9_NOATIME, libc::O_NOATIME), |
| (P9_SYNC, libc::O_SYNC), |
| ]; |
| |
| // 9P Qid types. Taken from "include/net/9p/9p.h" in the linux tree. |
| const P9_QTDIR: u8 = 0x80; |
| const _P9_QTAPPEND: u8 = 0x40; |
| const _P9_QTEXCL: u8 = 0x20; |
| const _P9_QTMOUNT: u8 = 0x10; |
| const _P9_QTAUTH: u8 = 0x08; |
| const _P9_QTTMP: u8 = 0x04; |
| const P9_QTSYMLINK: u8 = 0x02; |
| const _P9_QTLINK: u8 = 0x01; |
| const P9_QTFILE: u8 = 0x00; |
| |
| // Bitmask values for the getattr request. |
| const _P9_GETATTR_MODE: u64 = 0x00000001; |
| const _P9_GETATTR_NLINK: u64 = 0x00000002; |
| const _P9_GETATTR_UID: u64 = 0x00000004; |
| const _P9_GETATTR_GID: u64 = 0x00000008; |
| const _P9_GETATTR_RDEV: u64 = 0x00000010; |
| const _P9_GETATTR_ATIME: u64 = 0x00000020; |
| const _P9_GETATTR_MTIME: u64 = 0x00000040; |
| const _P9_GETATTR_CTIME: u64 = 0x00000080; |
| const _P9_GETATTR_INO: u64 = 0x00000100; |
| const _P9_GETATTR_SIZE: u64 = 0x00000200; |
| const _P9_GETATTR_BLOCKS: u64 = 0x00000400; |
| |
| const _P9_GETATTR_BTIME: u64 = 0x00000800; |
| const _P9_GETATTR_GEN: u64 = 0x00001000; |
| const _P9_GETATTR_DATA_VERSION: u64 = 0x00002000; |
| |
| const P9_GETATTR_BASIC: u64 = 0x000007ff; /* Mask for fields up to BLOCKS */ |
| const _P9_GETATTR_ALL: u64 = 0x00003fff; /* Mask for All fields above */ |
| |
| // Bitmask values for the setattr request. |
| const P9_SETATTR_MODE: u32 = 0x00000001; |
| const P9_SETATTR_UID: u32 = 0x00000002; |
| const P9_SETATTR_GID: u32 = 0x00000004; |
| const P9_SETATTR_SIZE: u32 = 0x00000008; |
| const P9_SETATTR_ATIME: u32 = 0x00000010; |
| const P9_SETATTR_MTIME: u32 = 0x00000020; |
| const P9_SETATTR_CTIME: u32 = 0x00000040; |
| const P9_SETATTR_ATIME_SET: u32 = 0x00000080; |
| const P9_SETATTR_MTIME_SET: u32 = 0x00000100; |
| |
| // 9p lock constants. Taken from "include/net/9p/9p.h" in the linux kernel. |
| const _P9_LOCK_TYPE_RDLCK: u8 = 0; |
| const _P9_LOCK_TYPE_WRLCK: u8 = 1; |
| const P9_LOCK_TYPE_UNLCK: u8 = 2; |
| const _P9_LOCK_FLAGS_BLOCK: u8 = 1; |
| const _P9_LOCK_FLAGS_RECLAIM: u8 = 2; |
| const P9_LOCK_SUCCESS: u8 = 0; |
| const _P9_LOCK_BLOCKED: u8 = 1; |
| const _P9_LOCK_ERROR: u8 = 2; |
| const _P9_LOCK_GRACE: u8 = 3; |
| |
| // Minimum and maximum message size that we'll expect from the client. |
| const MIN_MESSAGE_SIZE: u32 = 256; |
| const MAX_MESSAGE_SIZE: u32 = 64 * 1024 + 24; // 64 KiB of payload plus some extra for the header |
| |
| #[derive(PartialEq, Eq)] |
| enum FileType { |
| Regular, |
| Directory, |
| Other, |
| } |
| |
| impl From<libc::mode_t> for FileType { |
| fn from(mode: libc::mode_t) -> Self { |
| match mode & libc::S_IFMT { |
| libc::S_IFREG => FileType::Regular, |
| libc::S_IFDIR => FileType::Directory, |
| _ => FileType::Other, |
| } |
| } |
| } |
| |
| // Represents state that the server is holding on behalf of a client. Fids are somewhat like file |
| // descriptors but are not restricted to open files and directories. Fids are identified by a unique |
| // 32-bit number chosen by the client. Most messages sent by clients include a fid on which to |
| // operate. The fid in a Tattach message represents the root of the file system tree that the client |
| // is allowed to access. A client can create more fids by walking the directory tree from that fid. |
| struct Fid { |
| path: File, |
| file: Option<File>, |
| filetype: FileType, |
| } |
| |
| impl From<libc::stat64> for Qid { |
| fn from(st: libc::stat64) -> Qid { |
| let ty = match st.st_mode & libc::S_IFMT { |
| libc::S_IFDIR => P9_QTDIR, |
| libc::S_IFREG => P9_QTFILE, |
| libc::S_IFLNK => P9_QTSYMLINK, |
| _ => 0, |
| }; |
| |
| Qid { |
| ty, |
| // TODO: deal with the 2038 problem before 2038 |
| version: st.st_mtime as u32, |
| path: st.st_ino, |
| } |
| } |
| } |
| |
| fn statat(d: &File, name: &CStr, flags: libc::c_int) -> io::Result<libc::stat64> { |
| let mut st = MaybeUninit::<libc::stat64>::zeroed(); |
| |
| // Safe because the kernel will only write data in `st` and we check the return |
| // value. |
| let res = unsafe { |
| libc::fstatat64( |
| d.as_raw_fd(), |
| name.as_ptr(), |
| st.as_mut_ptr(), |
| flags | libc::AT_SYMLINK_NOFOLLOW, |
| ) |
| }; |
| if res >= 0 { |
| // Safe because the kernel guarantees that the struct is now fully initialized. |
| Ok(unsafe { st.assume_init() }) |
| } else { |
| Err(io::Error::last_os_error()) |
| } |
| } |
| |
| fn stat(f: &File) -> io::Result<libc::stat64> { |
| // Safe because this is a constant value and a valid C string. |
| let pathname = unsafe { CStr::from_bytes_with_nul_unchecked(b"\0") }; |
| |
| statat(f, pathname, libc::AT_EMPTY_PATH) |
| } |
| |
| fn string_to_cstring(s: String) -> io::Result<CString> { |
| CString::new(s).map_err(|_| io::Error::from_raw_os_error(libc::EINVAL)) |
| } |
| |
| fn error_to_rmessage(err: io::Error) -> Rmessage { |
| let errno = if let Some(errno) = err.raw_os_error() { |
| errno |
| } else { |
| // Make a best-effort guess based on the kind. |
| match err.kind() { |
| io::ErrorKind::NotFound => libc::ENOENT, |
| io::ErrorKind::PermissionDenied => libc::EPERM, |
| io::ErrorKind::ConnectionRefused => libc::ECONNREFUSED, |
| io::ErrorKind::ConnectionReset => libc::ECONNRESET, |
| io::ErrorKind::ConnectionAborted => libc::ECONNABORTED, |
| io::ErrorKind::NotConnected => libc::ENOTCONN, |
| io::ErrorKind::AddrInUse => libc::EADDRINUSE, |
| io::ErrorKind::AddrNotAvailable => libc::EADDRNOTAVAIL, |
| io::ErrorKind::BrokenPipe => libc::EPIPE, |
| io::ErrorKind::AlreadyExists => libc::EEXIST, |
| io::ErrorKind::WouldBlock => libc::EWOULDBLOCK, |
| io::ErrorKind::InvalidInput => libc::EINVAL, |
| io::ErrorKind::InvalidData => libc::EINVAL, |
| io::ErrorKind::TimedOut => libc::ETIMEDOUT, |
| io::ErrorKind::WriteZero => libc::EIO, |
| io::ErrorKind::Interrupted => libc::EINTR, |
| io::ErrorKind::Other => libc::EIO, |
| io::ErrorKind::UnexpectedEof => libc::EIO, |
| _ => libc::EIO, |
| } |
| }; |
| |
| Rmessage::Lerror(Rlerror { |
| ecode: errno as u32, |
| }) |
| } |
| |
| // Sigh.. Cow requires the underlying type to implement Clone. |
| enum MaybeOwned<'b, T> { |
| Borrowed(&'b T), |
| Owned(T), |
| } |
| |
| impl<'a, T> Deref for MaybeOwned<'a, T> { |
| type Target = T; |
| fn deref(&self) -> &Self::Target { |
| use MaybeOwned::*; |
| match *self { |
| Borrowed(borrowed) => borrowed, |
| Owned(ref owned) => owned, |
| } |
| } |
| } |
| |
| impl<'a, T> AsRef<T> for MaybeOwned<'a, T> { |
| fn as_ref(&self) -> &T { |
| use MaybeOwned::*; |
| match self { |
| Borrowed(borrowed) => borrowed, |
| Owned(ref owned) => owned, |
| } |
| } |
| } |
| |
| fn ebadf() -> io::Error { |
| io::Error::from_raw_os_error(libc::EBADF) |
| } |
| |
| pub type ServerIdMap<T> = BTreeMap<T, T>; |
| pub type ServerUidMap = ServerIdMap<libc::uid_t>; |
| pub type ServerGidMap = ServerIdMap<libc::gid_t>; |
| |
| fn map_id_from_host<T: Clone + Ord>(map: &ServerIdMap<T>, id: T) -> T { |
| map.get(&id).map_or(id.clone(), |v| v.clone()) |
| } |
| |
| // Performs an ascii case insensitive lookup and returns an O_PATH fd for the entry, if found. |
| fn ascii_casefold_lookup(proc: &File, parent: &File, name: &[u8]) -> io::Result<File> { |
| let mut dir = open_fid(proc, parent, P9_DIRECTORY)?; |
| let mut dirents = read_dir(&mut dir, 0)?; |
| |
| while let Some(entry) = dirents.next().transpose()? { |
| if name.eq_ignore_ascii_case(entry.name.to_bytes()) { |
| return lookup(parent, entry.name); |
| } |
| } |
| |
| Err(io::Error::from_raw_os_error(libc::ENOENT)) |
| } |
| |
| fn lookup(parent: &File, name: &CStr) -> io::Result<File> { |
| // Safe because this doesn't modify any memory and we check the return value. |
| let fd = syscall!(unsafe { |
| libc::openat64( |
| parent.as_raw_fd(), |
| name.as_ptr(), |
| libc::O_PATH | libc::O_NOFOLLOW | libc::O_CLOEXEC, |
| ) |
| })?; |
| |
| // Safe because we just opened this fd. |
| Ok(unsafe { File::from_raw_fd(fd) }) |
| } |
| |
| fn do_walk( |
| proc: &File, |
| wnames: Vec<String>, |
| start: &File, |
| ascii_casefold: bool, |
| mds: &mut Vec<libc::stat64>, |
| ) -> io::Result<File> { |
| let mut current = MaybeOwned::Borrowed(start); |
| |
| for wname in wnames { |
| let name = string_to_cstring(wname)?; |
| current = MaybeOwned::Owned(lookup(current.as_ref(), &name).or_else(|e| { |
| if ascii_casefold { |
| if let Some(libc::ENOENT) = e.raw_os_error() { |
| return ascii_casefold_lookup(proc, current.as_ref(), name.to_bytes()); |
| } |
| } |
| |
| Err(e) |
| })?); |
| mds.push(stat(¤t)?); |
| } |
| |
| match current { |
| MaybeOwned::Owned(owned) => Ok(owned), |
| MaybeOwned::Borrowed(borrowed) => borrowed.try_clone(), |
| } |
| } |
| |
| fn open_fid(proc: &File, path: &File, p9_flags: u32) -> io::Result<File> { |
| let pathname = string_to_cstring(format!("self/fd/{}", path.as_raw_fd()))?; |
| |
| // We always open files with O_CLOEXEC. |
| let mut flags: i32 = libc::O_CLOEXEC; |
| for &(p9f, of) in &MAPPED_FLAGS { |
| if (p9_flags & p9f) != 0 { |
| flags |= of; |
| } |
| } |
| |
| if p9_flags & P9_NOACCESS == P9_RDONLY { |
| flags |= libc::O_RDONLY; |
| } |
| |
| // Safe because this doesn't modify any memory and we check the return value. We need to |
| // clear the O_NOFOLLOW flag because we want to follow the proc symlink. |
| let fd = syscall!(unsafe { |
| libc::openat64( |
| proc.as_raw_fd(), |
| pathname.as_ptr(), |
| flags & !libc::O_NOFOLLOW, |
| ) |
| })?; |
| |
| // Safe because we just opened this fd and we know it is valid. |
| Ok(unsafe { File::from_raw_fd(fd) }) |
| } |
| |
| #[derive(Clone, Serialize, Deserialize)] |
| pub struct Config { |
| pub root: Box<Path>, |
| pub msize: u32, |
| |
| pub uid_map: ServerUidMap, |
| pub gid_map: ServerGidMap, |
| |
| pub ascii_casefold: bool, |
| } |
| |
| impl FromStr for Config { |
| type Err = &'static str; |
| |
| fn from_str(params: &str) -> Result<Self, Self::Err> { |
| let mut cfg = Self::default(); |
| if params.is_empty() { |
| return Ok(cfg); |
| } |
| for opt in params.split(':') { |
| let mut o = opt.splitn(2, '='); |
| let kind = o.next().ok_or("`cfg` options mut not be empty")?; |
| let value = o |
| .next() |
| .ok_or("`cfg` options must be of the form `kind=value`")?; |
| match kind { |
| "ascii_casefold" => { |
| let ascii_casefold = value |
| .parse() |
| .map_err(|_| "`ascii_casefold` must be a boolean")?; |
| cfg.ascii_casefold = ascii_casefold; |
| } |
| _ => return Err("unrecognized option for p9 config"), |
| } |
| } |
| Ok(cfg) |
| } |
| } |
| |
| impl Default for Config { |
| fn default() -> Config { |
| Config { |
| root: Path::new("/").into(), |
| msize: MAX_MESSAGE_SIZE, |
| uid_map: Default::default(), |
| gid_map: Default::default(), |
| ascii_casefold: false, |
| } |
| } |
| } |
| pub struct Server { |
| fids: BTreeMap<u32, Fid>, |
| proc: File, |
| cfg: Config, |
| } |
| |
| impl Server { |
| pub fn new<P: Into<Box<Path>>>( |
| root: P, |
| uid_map: ServerUidMap, |
| gid_map: ServerGidMap, |
| ) -> io::Result<Server> { |
| Server::with_config(Config { |
| root: root.into(), |
| msize: MAX_MESSAGE_SIZE, |
| uid_map, |
| gid_map, |
| ascii_casefold: false, |
| }) |
| } |
| |
| pub fn with_config(cfg: Config) -> io::Result<Server> { |
| // Safe because this is a valid c-string. |
| let proc_cstr = unsafe { CStr::from_bytes_with_nul_unchecked(b"/proc\0") }; |
| |
| // Safe because this doesn't modify any memory and we check the return value. |
| let fd = syscall!(unsafe { |
| libc::openat64( |
| libc::AT_FDCWD, |
| proc_cstr.as_ptr(), |
| libc::O_PATH | libc::O_NOFOLLOW | libc::O_CLOEXEC, |
| ) |
| })?; |
| |
| // Safe because we just opened this fd and we know it is valid. |
| let proc = unsafe { File::from_raw_fd(fd) }; |
| Ok(Server { |
| fids: BTreeMap::new(), |
| proc, |
| cfg, |
| }) |
| } |
| |
| pub fn keep_fds(&self) -> Vec<RawFd> { |
| vec![self.proc.as_raw_fd()] |
| } |
| |
| pub fn handle_message<R: Read, W: Write>( |
| &mut self, |
| reader: &mut R, |
| writer: &mut W, |
| ) -> io::Result<()> { |
| let Tframe { tag, msg } = WireFormat::decode(&mut reader.take(self.cfg.msize as u64))?; |
| |
| let rmsg = match msg { |
| Ok(Tmessage::Version(ref version)) => self.version(version).map(Rmessage::Version), |
| Ok(Tmessage::Flush(ref flush)) => self.flush(flush).and(Ok(Rmessage::Flush)), |
| Ok(Tmessage::Walk(walk)) => self.walk(walk).map(Rmessage::Walk), |
| Ok(Tmessage::Read(ref read)) => self.read(read).map(Rmessage::Read), |
| Ok(Tmessage::Write(ref write)) => self.write(write).map(Rmessage::Write), |
| Ok(Tmessage::Clunk(ref clunk)) => self.clunk(clunk).and(Ok(Rmessage::Clunk)), |
| Ok(Tmessage::Remove(ref remove)) => self.remove(remove).and(Ok(Rmessage::Remove)), |
| Ok(Tmessage::Attach(ref attach)) => self.attach(attach).map(Rmessage::Attach), |
| Ok(Tmessage::Auth(ref auth)) => self.auth(auth).map(Rmessage::Auth), |
| Ok(Tmessage::Statfs(ref statfs)) => self.statfs(statfs).map(Rmessage::Statfs), |
| Ok(Tmessage::Lopen(ref lopen)) => self.lopen(lopen).map(Rmessage::Lopen), |
| Ok(Tmessage::Lcreate(lcreate)) => self.lcreate(lcreate).map(Rmessage::Lcreate), |
| Ok(Tmessage::Symlink(ref symlink)) => self.symlink(symlink).map(Rmessage::Symlink), |
| Ok(Tmessage::Mknod(ref mknod)) => self.mknod(mknod).map(Rmessage::Mknod), |
| Ok(Tmessage::Rename(ref rename)) => self.rename(rename).and(Ok(Rmessage::Rename)), |
| Ok(Tmessage::Readlink(ref readlink)) => self.readlink(readlink).map(Rmessage::Readlink), |
| Ok(Tmessage::GetAttr(ref get_attr)) => self.get_attr(get_attr).map(Rmessage::GetAttr), |
| Ok(Tmessage::SetAttr(ref set_attr)) => { |
| self.set_attr(set_attr).and(Ok(Rmessage::SetAttr)) |
| } |
| Ok(Tmessage::XattrWalk(ref xattr_walk)) => { |
| self.xattr_walk(xattr_walk).map(Rmessage::XattrWalk) |
| } |
| Ok(Tmessage::XattrCreate(ref xattr_create)) => self |
| .xattr_create(xattr_create) |
| .and(Ok(Rmessage::XattrCreate)), |
| Ok(Tmessage::Readdir(ref readdir)) => self.readdir(readdir).map(Rmessage::Readdir), |
| Ok(Tmessage::Fsync(ref fsync)) => self.fsync(fsync).and(Ok(Rmessage::Fsync)), |
| Ok(Tmessage::Lock(ref lock)) => self.lock(lock).map(Rmessage::Lock), |
| Ok(Tmessage::GetLock(ref get_lock)) => self.get_lock(get_lock).map(Rmessage::GetLock), |
| Ok(Tmessage::Link(link)) => self.link(link).and(Ok(Rmessage::Link)), |
| Ok(Tmessage::Mkdir(mkdir)) => self.mkdir(mkdir).map(Rmessage::Mkdir), |
| Ok(Tmessage::RenameAt(rename_at)) => { |
| self.rename_at(rename_at).and(Ok(Rmessage::RenameAt)) |
| } |
| Ok(Tmessage::UnlinkAt(unlink_at)) => { |
| self.unlink_at(unlink_at).and(Ok(Rmessage::UnlinkAt)) |
| } |
| Err(e) => { |
| // The header was successfully decoded, but the body failed to decode - send an |
| // error response for this tag. |
| let error = format!("Tframe message decode failed: {}", e); |
| Err(io::Error::new(io::ErrorKind::InvalidData, error)) |
| } |
| }; |
| |
| // Errors while handling requests are never fatal. |
| let response = Rframe { |
| tag, |
| msg: rmsg.unwrap_or_else(error_to_rmessage), |
| }; |
| |
| response.encode(writer)?; |
| writer.flush() |
| } |
| |
| fn auth(&mut self, _auth: &Tauth) -> io::Result<Rauth> { |
| // Returning an error for the auth message means that the server does not require |
| // authentication. |
| Err(io::Error::from_raw_os_error(libc::EOPNOTSUPP)) |
| } |
| |
| fn attach(&mut self, attach: &Tattach) -> io::Result<Rattach> { |
| // TODO: Check attach parameters |
| match self.fids.entry(attach.fid) { |
| btree_map::Entry::Vacant(entry) => { |
| let root = CString::new(self.cfg.root.as_os_str().as_bytes()) |
| .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?; |
| |
| // Safe because this doesn't modify any memory and we check the return value. |
| let fd = syscall!(unsafe { |
| libc::openat64( |
| libc::AT_FDCWD, |
| root.as_ptr(), |
| libc::O_PATH | libc::O_NOFOLLOW | libc::O_CLOEXEC, |
| ) |
| })?; |
| |
| let root_path = unsafe { File::from_raw_fd(fd) }; |
| let st = stat(&root_path)?; |
| |
| let fid = Fid { |
| // Safe because we just opened this fd. |
| path: root_path, |
| file: None, |
| filetype: st.st_mode.into(), |
| }; |
| let response = Rattach { qid: st.into() }; |
| entry.insert(fid); |
| Ok(response) |
| } |
| btree_map::Entry::Occupied(_) => Err(io::Error::from_raw_os_error(libc::EBADF)), |
| } |
| } |
| |
| fn version(&mut self, version: &Tversion) -> io::Result<Rversion> { |
| if version.msize < MIN_MESSAGE_SIZE { |
| return Err(io::Error::from_raw_os_error(libc::EINVAL)); |
| } |
| |
| // A Tversion request clunks all open fids and terminates any pending I/O. |
| self.fids.clear(); |
| self.cfg.msize = min(self.cfg.msize, version.msize); |
| |
| Ok(Rversion { |
| msize: self.cfg.msize, |
| version: if version.version == "9P2000.L" { |
| String::from("9P2000.L") |
| } else { |
| String::from("unknown") |
| }, |
| }) |
| } |
| |
| #[allow(clippy::unnecessary_wraps)] |
| fn flush(&mut self, _flush: &Tflush) -> io::Result<()> { |
| // TODO: Since everything is synchronous we can't actually flush requests. |
| Ok(()) |
| } |
| |
| fn walk(&mut self, walk: Twalk) -> io::Result<Rwalk> { |
| // `newfid` must not currently be in use unless it is the same as `fid`. |
| if walk.fid != walk.newfid && self.fids.contains_key(&walk.newfid) { |
| return Err(io::Error::from_raw_os_error(libc::EBADF)); |
| } |
| |
| // We need to walk the tree. First get the starting path. |
| let start = &self.fids.get(&walk.fid).ok_or_else(ebadf)?.path; |
| |
| // Now walk the tree and break on the first error, if any. |
| let expected_len = walk.wnames.len(); |
| let mut mds = Vec::with_capacity(expected_len); |
| match do_walk( |
| &self.proc, |
| walk.wnames, |
| start, |
| self.cfg.ascii_casefold, |
| &mut mds, |
| ) { |
| Ok(end) => { |
| // Store the new fid if the full walk succeeded. |
| if mds.len() == expected_len { |
| let st = mds.last().copied().map(Ok).unwrap_or_else(|| stat(&end))?; |
| self.fids.insert( |
| walk.newfid, |
| Fid { |
| path: end, |
| file: None, |
| filetype: st.st_mode.into(), |
| }, |
| ); |
| } |
| } |
| Err(e) => { |
| // Only return an error if it occurred on the first component. |
| if mds.is_empty() { |
| return Err(e); |
| } |
| } |
| } |
| |
| Ok(Rwalk { |
| wqids: mds.into_iter().map(Qid::from).collect(), |
| }) |
| } |
| |
| fn read(&mut self, read: &Tread) -> io::Result<Rread> { |
| // Thankfully, `read` cannot be used to read directories in 9P2000.L. |
| let file = self |
| .fids |
| .get_mut(&read.fid) |
| .and_then(|fid| fid.file.as_mut()) |
| .ok_or_else(ebadf)?; |
| |
| // Use an empty Rread struct to figure out the overhead of the header. |
| let header_size = Rframe { |
| tag: 0, |
| msg: Rmessage::Read(Rread { |
| data: Data(Vec::new()), |
| }), |
| } |
| .byte_size(); |
| |
| let capacity = min(self.cfg.msize - header_size, read.count); |
| let mut buf = Data(vec![0u8; capacity as usize]); |
| |
| let count = file.read_at(&mut buf, read.offset)?; |
| buf.truncate(count); |
| |
| Ok(Rread { data: buf }) |
| } |
| |
| fn write(&mut self, write: &Twrite) -> io::Result<Rwrite> { |
| let file = self |
| .fids |
| .get_mut(&write.fid) |
| .and_then(|fid| fid.file.as_mut()) |
| .ok_or_else(ebadf)?; |
| |
| let count = file.write_at(&write.data, write.offset)?; |
| Ok(Rwrite { |
| count: count as u32, |
| }) |
| } |
| |
| fn clunk(&mut self, clunk: &Tclunk) -> io::Result<()> { |
| match self.fids.entry(clunk.fid) { |
| btree_map::Entry::Vacant(_) => Err(io::Error::from_raw_os_error(libc::EBADF)), |
| btree_map::Entry::Occupied(entry) => { |
| entry.remove(); |
| Ok(()) |
| } |
| } |
| } |
| |
| fn remove(&mut self, _remove: &Tremove) -> io::Result<()> { |
| // Since a file could be linked into multiple locations, there is no way to know exactly |
| // which path we are supposed to unlink. Linux uses unlink_at anyway, so we can just return |
| // an error here. |
| Err(io::Error::from_raw_os_error(libc::EOPNOTSUPP)) |
| } |
| |
| fn statfs(&mut self, statfs: &Tstatfs) -> io::Result<Rstatfs> { |
| let fid = self.fids.get(&statfs.fid).ok_or_else(ebadf)?; |
| let mut buf = MaybeUninit::zeroed(); |
| |
| // Safe because this will only modify `out` and we check the return value. |
| syscall!(unsafe { libc::fstatfs64(fid.path.as_raw_fd(), buf.as_mut_ptr()) })?; |
| |
| // Safe because this only has integer types and any value is valid. |
| let out = unsafe { buf.assume_init() }; |
| Ok(Rstatfs { |
| ty: out.f_type as u32, |
| bsize: out.f_bsize as u32, |
| blocks: out.f_blocks, |
| bfree: out.f_bfree, |
| bavail: out.f_bavail, |
| files: out.f_files, |
| ffree: out.f_ffree, |
| // Safe because the fsid has only integer fields and the compiler will verify that is |
| // the same width as the `fsid` field in Rstatfs. |
| fsid: unsafe { mem::transmute(out.f_fsid) }, |
| namelen: out.f_namelen as u32, |
| }) |
| } |
| |
| fn lopen(&mut self, lopen: &Tlopen) -> io::Result<Rlopen> { |
| let fid = self.fids.get_mut(&lopen.fid).ok_or_else(ebadf)?; |
| |
| let file = open_fid(&self.proc, &fid.path, lopen.flags)?; |
| let st = stat(&file)?; |
| |
| fid.file = Some(file); |
| Ok(Rlopen { |
| qid: st.into(), |
| iounit: 0, // Allow the client to send requests up to the negotiated max message size. |
| }) |
| } |
| |
| fn lcreate(&mut self, lcreate: Tlcreate) -> io::Result<Rlcreate> { |
| let fid = self.fids.get_mut(&lcreate.fid).ok_or_else(ebadf)?; |
| |
| if fid.filetype != FileType::Directory { |
| return Err(io::Error::from_raw_os_error(libc::ENOTDIR)); |
| } |
| |
| let mut flags: i32 = libc::O_CLOEXEC | libc::O_CREAT | libc::O_EXCL; |
| for &(p9f, of) in &MAPPED_FLAGS { |
| if (lcreate.flags & p9f) != 0 { |
| flags |= of; |
| } |
| } |
| if lcreate.flags & P9_NOACCESS == P9_RDONLY { |
| flags |= libc::O_RDONLY; |
| } |
| |
| let name = string_to_cstring(lcreate.name)?; |
| |
| // Safe because this doesn't modify any memory and we check the return value. |
| let fd = syscall!(unsafe { |
| libc::openat64(fid.path.as_raw_fd(), name.as_ptr(), flags, lcreate.mode) |
| })?; |
| |
| // Safe because we just opened this fd and we know it is valid. |
| let file = unsafe { File::from_raw_fd(fd) }; |
| let st = stat(&file)?; |
| |
| fid.file = Some(file); |
| fid.filetype = FileType::Regular; |
| |
| // This fid now refers to the newly created file so we need to update the O_PATH fd for it |
| // as well. |
| fid.path = lookup(&fid.path, &name)?; |
| |
| Ok(Rlcreate { |
| qid: st.into(), |
| iounit: 0, // Allow the client to send requests up to the negotiated max message size. |
| }) |
| } |
| |
| fn symlink(&mut self, _symlink: &Tsymlink) -> io::Result<Rsymlink> { |
| // symlinks are not allowed. |
| Err(io::Error::from_raw_os_error(libc::EACCES)) |
| } |
| |
| fn mknod(&mut self, _mknod: &Tmknod) -> io::Result<Rmknod> { |
| // No nodes either. |
| Err(io::Error::from_raw_os_error(libc::EACCES)) |
| } |
| |
| fn rename(&mut self, _rename: &Trename) -> io::Result<()> { |
| // We cannot support this as an inode may be linked into multiple directories but we don't |
| // know which one the client wants us to rename. Linux uses rename_at anyway, so we don't |
| // need to worry about this. |
| Err(io::Error::from_raw_os_error(libc::EOPNOTSUPP)) |
| } |
| |
| fn readlink(&mut self, readlink: &Treadlink) -> io::Result<Rreadlink> { |
| let fid = self.fids.get(&readlink.fid).ok_or_else(ebadf)?; |
| |
| let mut link = vec![0; libc::PATH_MAX as usize]; |
| |
| // Safe because this will only modify `link` and we check the return value. |
| let len = syscall!(unsafe { |
| libc::readlinkat( |
| fid.path.as_raw_fd(), |
| [0].as_ptr(), |
| link.as_mut_ptr() as *mut libc::c_char, |
| link.len(), |
| ) |
| })? as usize; |
| link.truncate(len); |
| let target = String::from_utf8(link) |
| .map_err(|err| io::Error::new(io::ErrorKind::InvalidData, err))?; |
| Ok(Rreadlink { target }) |
| } |
| |
| #[allow(clippy::unnecessary_cast)] // nlink_t is u32 on 32-bit platforms |
| fn get_attr(&mut self, get_attr: &Tgetattr) -> io::Result<Rgetattr> { |
| let fid = self.fids.get_mut(&get_attr.fid).ok_or_else(ebadf)?; |
| |
| let st = stat(&fid.path)?; |
| |
| Ok(Rgetattr { |
| valid: P9_GETATTR_BASIC, |
| qid: st.into(), |
| mode: st.st_mode, |
| uid: map_id_from_host(&self.cfg.uid_map, st.st_uid), |
| gid: map_id_from_host(&self.cfg.gid_map, st.st_gid), |
| nlink: st.st_nlink as u64, |
| rdev: st.st_rdev, |
| size: st.st_size as u64, |
| blksize: st.st_blksize as u64, |
| blocks: st.st_blocks as u64, |
| atime_sec: st.st_atime as u64, |
| atime_nsec: st.st_atime_nsec as u64, |
| mtime_sec: st.st_mtime as u64, |
| mtime_nsec: st.st_mtime_nsec as u64, |
| ctime_sec: st.st_ctime as u64, |
| ctime_nsec: st.st_ctime_nsec as u64, |
| btime_sec: 0, |
| btime_nsec: 0, |
| gen: 0, |
| data_version: 0, |
| }) |
| } |
| |
| fn set_attr(&mut self, set_attr: &Tsetattr) -> io::Result<()> { |
| let fid = self.fids.get(&set_attr.fid).ok_or_else(ebadf)?; |
| let path = string_to_cstring(format!("self/fd/{}", fid.path.as_raw_fd()))?; |
| |
| if set_attr.valid & P9_SETATTR_MODE != 0 { |
| // Safe because this doesn't modify any memory and we check the return value. |
| syscall!(unsafe { |
| libc::fchmodat(self.proc.as_raw_fd(), path.as_ptr(), set_attr.mode, 0) |
| })?; |
| } |
| |
| if set_attr.valid & (P9_SETATTR_UID | P9_SETATTR_GID) != 0 { |
| let uid = if set_attr.valid & P9_SETATTR_UID != 0 { |
| set_attr.uid |
| } else { |
| -1i32 as u32 |
| }; |
| let gid = if set_attr.valid & P9_SETATTR_GID != 0 { |
| set_attr.gid |
| } else { |
| -1i32 as u32 |
| }; |
| |
| // Safe because this doesn't modify any memory and we check the return value. |
| syscall!(unsafe { libc::fchownat(self.proc.as_raw_fd(), path.as_ptr(), uid, gid, 0) })?; |
| } |
| |
| if set_attr.valid & P9_SETATTR_SIZE != 0 { |
| let file = if fid.filetype == FileType::Directory { |
| return Err(io::Error::from_raw_os_error(libc::EISDIR)); |
| } else if let Some(ref file) = fid.file { |
| MaybeOwned::Borrowed(file) |
| } else { |
| MaybeOwned::Owned(open_fid(&self.proc, &fid.path, P9_NONBLOCK | P9_RDWR)?) |
| }; |
| |
| file.set_len(set_attr.size)?; |
| } |
| |
| if set_attr.valid & (P9_SETATTR_ATIME | P9_SETATTR_MTIME) != 0 { |
| let times = [ |
| libc::timespec { |
| tv_sec: set_attr.atime_sec as _, |
| tv_nsec: if set_attr.valid & P9_SETATTR_ATIME == 0 { |
| libc::UTIME_OMIT |
| } else if set_attr.valid & P9_SETATTR_ATIME_SET == 0 { |
| libc::UTIME_NOW |
| } else { |
| set_attr.atime_nsec as _ |
| }, |
| }, |
| libc::timespec { |
| tv_sec: set_attr.mtime_sec as _, |
| tv_nsec: if set_attr.valid & P9_SETATTR_MTIME == 0 { |
| libc::UTIME_OMIT |
| } else if set_attr.valid & P9_SETATTR_MTIME_SET == 0 { |
| libc::UTIME_NOW |
| } else { |
| set_attr.mtime_nsec as _ |
| }, |
| }, |
| ]; |
| |
| // Safe because file is valid and we have initialized times fully. |
| let ret = unsafe { |
| libc::utimensat( |
| self.proc.as_raw_fd(), |
| path.as_ptr(), |
| × as *const libc::timespec, |
| 0, |
| ) |
| }; |
| if ret < 0 { |
| return Err(io::Error::last_os_error()); |
| } |
| } |
| |
| // The ctime would have been updated by any of the above operations so we only |
| // need to change it if it was the only option given. |
| if set_attr.valid & P9_SETATTR_CTIME != 0 && set_attr.valid & (!P9_SETATTR_CTIME) == 0 { |
| // Setting -1 as the uid and gid will not actually change anything but will |
| // still update the ctime. |
| let ret = unsafe { |
| libc::fchownat( |
| self.proc.as_raw_fd(), |
| path.as_ptr(), |
| libc::uid_t::max_value(), |
| libc::gid_t::max_value(), |
| 0, |
| ) |
| }; |
| if ret < 0 { |
| return Err(io::Error::last_os_error()); |
| } |
| } |
| |
| Ok(()) |
| } |
| |
| fn xattr_walk(&mut self, _xattr_walk: &Txattrwalk) -> io::Result<Rxattrwalk> { |
| Err(io::Error::from_raw_os_error(libc::EOPNOTSUPP)) |
| } |
| |
| fn xattr_create(&mut self, _xattr_create: &Txattrcreate) -> io::Result<()> { |
| Err(io::Error::from_raw_os_error(libc::EOPNOTSUPP)) |
| } |
| |
| fn readdir(&mut self, readdir: &Treaddir) -> io::Result<Rreaddir> { |
| let fid = self.fids.get_mut(&readdir.fid).ok_or_else(ebadf)?; |
| |
| if fid.filetype != FileType::Directory { |
| return Err(io::Error::from_raw_os_error(libc::ENOTDIR)); |
| } |
| |
| // Use an empty Rreaddir struct to figure out the maximum number of bytes that |
| // can be returned. |
| let header_size = Rframe { |
| tag: 0, |
| msg: Rmessage::Readdir(Rreaddir { |
| data: Data(Vec::new()), |
| }), |
| } |
| .byte_size(); |
| let count = min(self.cfg.msize - header_size, readdir.count); |
| let mut cursor = Cursor::new(Vec::with_capacity(count as usize)); |
| |
| let dir = fid.file.as_mut().ok_or_else(ebadf)?; |
| let mut dirents = read_dir(dir, readdir.offset as libc::off64_t)?; |
| while let Some(dirent) = dirents.next().transpose()? { |
| let st = statat(&fid.path, dirent.name, 0)?; |
| |
| let name = dirent |
| .name |
| .to_str() |
| .map(String::from) |
| .map_err(|err| io::Error::new(io::ErrorKind::InvalidData, err))?; |
| |
| let entry = Dirent { |
| qid: st.into(), |
| offset: dirent.offset, |
| ty: dirent.type_, |
| name, |
| }; |
| |
| let byte_size = entry.byte_size() as usize; |
| |
| if cursor.get_ref().capacity() - cursor.get_ref().len() < byte_size { |
| // No more room in the buffer. |
| break; |
| } |
| |
| entry.encode(&mut cursor)?; |
| } |
| |
| Ok(Rreaddir { |
| data: Data(cursor.into_inner()), |
| }) |
| } |
| |
| fn fsync(&mut self, fsync: &Tfsync) -> io::Result<()> { |
| let file = self |
| .fids |
| .get(&fsync.fid) |
| .and_then(|fid| fid.file.as_ref()) |
| .ok_or_else(ebadf)?; |
| |
| if fsync.datasync == 0 { |
| file.sync_all()?; |
| } else { |
| file.sync_data()?; |
| } |
| Ok(()) |
| } |
| |
| /// Implement posix byte range locking code. |
| /// Our implementation mirrors that of QEMU/9p - that is to say, |
| /// we essentially punt on mirroring lock state between client/server |
| /// and defer lock semantics to the VFS layer on the client side. Aside |
| /// from fd existence check we always return success. QEMU reference: |
| /// <https://github.com/qemu/qemu/blob/754f756cc4c6d9d14b7230c62b5bb20f9d655888/hw/9pfs/9p.c#L3669> |
| /// |
| /// NOTE: this means that files locked on the client may be interefered with |
| /// from either the server's side, or from other clients (guests). This |
| /// tracks with QEMU implementation, and will be obviated if crosvm decides |
| /// to drop 9p in favor of virtio-fs. QEMU only allows for a single client, |
| /// and we leave it to users of the crate to provide actual lock handling. |
| fn lock(&mut self, lock: &Tlock) -> io::Result<Rlock> { |
| // Ensure fd passed in TLOCK request exists and has a mapping. |
| let fd = self |
| .fids |
| .get(&lock.fid) |
| .and_then(|fid| fid.file.as_ref()) |
| .ok_or_else(ebadf)? |
| .as_raw_fd(); |
| |
| syscall!(unsafe { |
| // Safe because zero-filled libc::stat is a valid value, fstat |
| // populates the struct fields. |
| let mut stbuf: libc::stat64 = std::mem::zeroed(); |
| // Safe because this doesn't modify memory and we check the return value. |
| libc::fstat64(fd, &mut stbuf) |
| })?; |
| |
| Ok(Rlock { |
| status: P9_LOCK_SUCCESS, |
| }) |
| } |
| |
| /// |
| /// Much like lock(), defer locking semantics to VFS and return success. |
| /// |
| fn get_lock(&mut self, get_lock: &Tgetlock) -> io::Result<Rgetlock> { |
| // Ensure fd passed in GETTLOCK request exists and has a mapping. |
| let fd = self |
| .fids |
| .get(&get_lock.fid) |
| .and_then(|fid| fid.file.as_ref()) |
| .ok_or_else(ebadf)? |
| .as_raw_fd(); |
| |
| // Safe because this doesn't modify memory and we check the return value. |
| syscall!(unsafe { |
| let mut stbuf: libc::stat64 = std::mem::zeroed(); |
| libc::fstat64(fd, &mut stbuf) |
| })?; |
| |
| Ok(Rgetlock { |
| type_: P9_LOCK_TYPE_UNLCK, |
| start: get_lock.start, |
| length: get_lock.length, |
| proc_id: get_lock.proc_id, |
| client_id: get_lock.client_id.clone(), |
| }) |
| } |
| |
| fn link(&mut self, link: Tlink) -> io::Result<()> { |
| let target = self.fids.get(&link.fid).ok_or_else(ebadf)?; |
| let path = string_to_cstring(format!("self/fd/{}", target.path.as_raw_fd()))?; |
| |
| let dir = self.fids.get(&link.dfid).ok_or_else(ebadf)?; |
| let name = string_to_cstring(link.name)?; |
| |
| // Safe because this doesn't modify any memory and we check the return value. |
| syscall!(unsafe { |
| libc::linkat( |
| self.proc.as_raw_fd(), |
| path.as_ptr(), |
| dir.path.as_raw_fd(), |
| name.as_ptr(), |
| libc::AT_SYMLINK_FOLLOW, |
| ) |
| })?; |
| Ok(()) |
| } |
| |
| fn mkdir(&mut self, mkdir: Tmkdir) -> io::Result<Rmkdir> { |
| let fid = self.fids.get(&mkdir.dfid).ok_or_else(ebadf)?; |
| let name = string_to_cstring(mkdir.name)?; |
| |
| // Safe because this doesn't modify any memory and we check the return value. |
| syscall!(unsafe { libc::mkdirat(fid.path.as_raw_fd(), name.as_ptr(), mkdir.mode) })?; |
| Ok(Rmkdir { |
| qid: statat(&fid.path, &name, 0).map(Qid::from)?, |
| }) |
| } |
| |
| fn rename_at(&mut self, rename_at: Trenameat) -> io::Result<()> { |
| let olddir = self.fids.get(&rename_at.olddirfid).ok_or_else(ebadf)?; |
| let oldname = string_to_cstring(rename_at.oldname)?; |
| |
| let newdir = self.fids.get(&rename_at.newdirfid).ok_or_else(ebadf)?; |
| let newname = string_to_cstring(rename_at.newname)?; |
| |
| // Safe because this doesn't modify any memory and we check the return value. |
| syscall!(unsafe { |
| libc::renameat( |
| olddir.path.as_raw_fd(), |
| oldname.as_ptr(), |
| newdir.path.as_raw_fd(), |
| newname.as_ptr(), |
| ) |
| })?; |
| |
| Ok(()) |
| } |
| |
| fn unlink_at(&mut self, unlink_at: Tunlinkat) -> io::Result<()> { |
| let dir = self.fids.get(&unlink_at.dirfd).ok_or_else(ebadf)?; |
| let name = string_to_cstring(unlink_at.name)?; |
| |
| syscall!(unsafe { |
| libc::unlinkat( |
| dir.path.as_raw_fd(), |
| name.as_ptr(), |
| unlink_at.flags as libc::c_int, |
| ) |
| })?; |
| |
| Ok(()) |
| } |
| } |
| |
| #[cfg(test)] |
| mod tests; |
