2 * linux/net/sunrpc/auth_gss/auth_gss.c
4 * RPCSEC_GSS client authentication.
6 * Copyright (c) 2000 The Regents of the University of Michigan.
9 * Dug Song <dugsong@monkey.org>
10 * Andy Adamson <andros@umich.edu>
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions
16 * 1. Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
21 * 3. Neither the name of the University nor the names of its
22 * contributors may be used to endorse or promote products derived
23 * from this software without specific prior written permission.
25 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
26 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
27 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
28 * DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
30 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
31 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
32 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
33 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
34 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
35 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 #include <linux/module.h>
40 #include <linux/init.h>
41 #include <linux/types.h>
42 #include <linux/slab.h>
43 #include <linux/sched.h>
44 #include <linux/pagemap.h>
45 #include <linux/sunrpc/clnt.h>
46 #include <linux/sunrpc/auth.h>
47 #include <linux/sunrpc/auth_gss.h>
48 #include <linux/sunrpc/svcauth_gss.h>
49 #include <linux/sunrpc/gss_err.h>
50 #include <linux/workqueue.h>
51 #include <linux/sunrpc/rpc_pipe_fs.h>
52 #include <linux/sunrpc/gss_api.h>
53 #include <linux/uaccess.h>
54 #include <linux/hashtable.h>
58 #include <trace/events/rpcgss.h>
60 static const struct rpc_authops authgss_ops;
62 static const struct rpc_credops gss_credops;
63 static const struct rpc_credops gss_nullops;
65 #define GSS_RETRY_EXPIRED 5
66 static unsigned int gss_expired_cred_retry_delay = GSS_RETRY_EXPIRED;
68 #define GSS_KEY_EXPIRE_TIMEO 240
69 static unsigned int gss_key_expire_timeo = GSS_KEY_EXPIRE_TIMEO;
71 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
72 # define RPCDBG_FACILITY RPCDBG_AUTH
75 #define GSS_CRED_SLACK (RPC_MAX_AUTH_SIZE * 2)
76 /* length of a krb5 verifier (48), plus data added before arguments when
77 * using integrity (two 4-byte integers): */
78 #define GSS_VERF_SLACK 100
80 static DEFINE_HASHTABLE(gss_auth_hash_table, 4);
81 static DEFINE_SPINLOCK(gss_auth_hash_lock);
84 struct rpc_pipe_dir_object pdo;
85 struct rpc_pipe *pipe;
86 struct rpc_clnt *clnt;
93 struct hlist_node hash;
94 struct rpc_auth rpc_auth;
95 struct gss_api_mech *mech;
96 enum rpc_gss_svc service;
97 struct rpc_clnt *client;
100 * There are two upcall pipes; dentry[1], named "gssd", is used
101 * for the new text-based upcall; dentry[0] is named after the
102 * mechanism (for example, "krb5") and exists for
103 * backwards-compatibility with older gssd's.
105 struct gss_pipe *gss_pipe[2];
106 const char *target_name;
109 /* pipe_version >= 0 if and only if someone has a pipe open. */
110 static DEFINE_SPINLOCK(pipe_version_lock);
111 static struct rpc_wait_queue pipe_version_rpc_waitqueue;
112 static DECLARE_WAIT_QUEUE_HEAD(pipe_version_waitqueue);
113 static void gss_put_auth(struct gss_auth *gss_auth);
115 static void gss_free_ctx(struct gss_cl_ctx *);
116 static const struct rpc_pipe_ops gss_upcall_ops_v0;
117 static const struct rpc_pipe_ops gss_upcall_ops_v1;
119 static inline struct gss_cl_ctx *
120 gss_get_ctx(struct gss_cl_ctx *ctx)
122 refcount_inc(&ctx->count);
127 gss_put_ctx(struct gss_cl_ctx *ctx)
129 if (refcount_dec_and_test(&ctx->count))
134 * called by gss_upcall_callback and gss_create_upcall in order
135 * to set the gss context. The actual exchange of an old context
136 * and a new one is protected by the pipe->lock.
139 gss_cred_set_ctx(struct rpc_cred *cred, struct gss_cl_ctx *ctx)
141 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
143 if (!test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags))
146 rcu_assign_pointer(gss_cred->gc_ctx, ctx);
147 set_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
148 smp_mb__before_atomic();
149 clear_bit(RPCAUTH_CRED_NEW, &cred->cr_flags);
153 simple_get_bytes(const void *p, const void *end, void *res, size_t len)
155 const void *q = (const void *)((const char *)p + len);
156 if (unlikely(q > end || q < p))
157 return ERR_PTR(-EFAULT);
162 static inline const void *
163 simple_get_netobj(const void *p, const void *end, struct xdr_netobj *dest)
168 p = simple_get_bytes(p, end, &len, sizeof(len));
171 q = (const void *)((const char *)p + len);
172 if (unlikely(q > end || q < p))
173 return ERR_PTR(-EFAULT);
174 dest->data = kmemdup(p, len, GFP_NOFS);
175 if (unlikely(dest->data == NULL))
176 return ERR_PTR(-ENOMEM);
181 static struct gss_cl_ctx *
182 gss_cred_get_ctx(struct rpc_cred *cred)
184 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
185 struct gss_cl_ctx *ctx = NULL;
188 ctx = rcu_dereference(gss_cred->gc_ctx);
195 static struct gss_cl_ctx *
196 gss_alloc_context(void)
198 struct gss_cl_ctx *ctx;
200 ctx = kzalloc(sizeof(*ctx), GFP_NOFS);
202 ctx->gc_proc = RPC_GSS_PROC_DATA;
203 ctx->gc_seq = 1; /* NetApp 6.4R1 doesn't accept seq. no. 0 */
204 spin_lock_init(&ctx->gc_seq_lock);
205 refcount_set(&ctx->count,1);
210 #define GSSD_MIN_TIMEOUT (60 * 60)
212 gss_fill_context(const void *p, const void *end, struct gss_cl_ctx *ctx, struct gss_api_mech *gm)
216 unsigned int timeout;
217 unsigned long now = jiffies;
221 /* First unsigned int gives the remaining lifetime in seconds of the
222 * credential - e.g. the remaining TGT lifetime for Kerberos or
223 * the -t value passed to GSSD.
225 p = simple_get_bytes(p, end, &timeout, sizeof(timeout));
229 timeout = GSSD_MIN_TIMEOUT;
230 ctx->gc_expiry = now + ((unsigned long)timeout * HZ);
231 /* Sequence number window. Determines the maximum number of
232 * simultaneous requests
234 p = simple_get_bytes(p, end, &window_size, sizeof(window_size));
237 ctx->gc_win = window_size;
238 /* gssd signals an error by passing ctx->gc_win = 0: */
239 if (ctx->gc_win == 0) {
241 * in which case, p points to an error code. Anything other
242 * than -EKEYEXPIRED gets converted to -EACCES.
244 p = simple_get_bytes(p, end, &ret, sizeof(ret));
246 p = (ret == -EKEYEXPIRED) ? ERR_PTR(-EKEYEXPIRED) :
250 /* copy the opaque wire context */
251 p = simple_get_netobj(p, end, &ctx->gc_wire_ctx);
254 /* import the opaque security context */
255 p = simple_get_bytes(p, end, &seclen, sizeof(seclen));
258 q = (const void *)((const char *)p + seclen);
259 if (unlikely(q > end || q < p)) {
260 p = ERR_PTR(-EFAULT);
263 ret = gss_import_sec_context(p, seclen, gm, &ctx->gc_gss_ctx, NULL, GFP_NOFS);
265 trace_rpcgss_import_ctx(ret);
270 /* is there any trailing data? */
276 /* pull in acceptor name (if there is one) */
277 p = simple_get_netobj(q, end, &ctx->gc_acceptor);
281 trace_rpcgss_context(ctx->gc_expiry, now, timeout,
282 ctx->gc_acceptor.len, ctx->gc_acceptor.data);
287 /* XXX: Need some documentation about why UPCALL_BUF_LEN is so small.
288 * Is user space expecting no more than UPCALL_BUF_LEN bytes?
289 * Note that there are now _two_ NI_MAXHOST sized data items
290 * being passed in this string.
292 #define UPCALL_BUF_LEN 256
294 struct gss_upcall_msg {
297 struct rpc_pipe_msg msg;
298 struct list_head list;
299 struct gss_auth *auth;
300 struct rpc_pipe *pipe;
301 struct rpc_wait_queue rpc_waitqueue;
302 wait_queue_head_t waitqueue;
303 struct gss_cl_ctx *ctx;
304 char databuf[UPCALL_BUF_LEN];
307 static int get_pipe_version(struct net *net)
309 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
312 spin_lock(&pipe_version_lock);
313 if (sn->pipe_version >= 0) {
314 atomic_inc(&sn->pipe_users);
315 ret = sn->pipe_version;
318 spin_unlock(&pipe_version_lock);
322 static void put_pipe_version(struct net *net)
324 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
326 if (atomic_dec_and_lock(&sn->pipe_users, &pipe_version_lock)) {
327 sn->pipe_version = -1;
328 spin_unlock(&pipe_version_lock);
333 gss_release_msg(struct gss_upcall_msg *gss_msg)
335 struct net *net = gss_msg->auth->net;
336 if (!refcount_dec_and_test(&gss_msg->count))
338 put_pipe_version(net);
339 BUG_ON(!list_empty(&gss_msg->list));
340 if (gss_msg->ctx != NULL)
341 gss_put_ctx(gss_msg->ctx);
342 rpc_destroy_wait_queue(&gss_msg->rpc_waitqueue);
343 gss_put_auth(gss_msg->auth);
347 static struct gss_upcall_msg *
348 __gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid, const struct gss_auth *auth)
350 struct gss_upcall_msg *pos;
351 list_for_each_entry(pos, &pipe->in_downcall, list) {
352 if (!uid_eq(pos->uid, uid))
354 if (auth && pos->auth->service != auth->service)
356 refcount_inc(&pos->count);
362 /* Try to add an upcall to the pipefs queue.
363 * If an upcall owned by our uid already exists, then we return a reference
364 * to that upcall instead of adding the new upcall.
366 static inline struct gss_upcall_msg *
367 gss_add_msg(struct gss_upcall_msg *gss_msg)
369 struct rpc_pipe *pipe = gss_msg->pipe;
370 struct gss_upcall_msg *old;
372 spin_lock(&pipe->lock);
373 old = __gss_find_upcall(pipe, gss_msg->uid, gss_msg->auth);
375 refcount_inc(&gss_msg->count);
376 list_add(&gss_msg->list, &pipe->in_downcall);
379 spin_unlock(&pipe->lock);
384 __gss_unhash_msg(struct gss_upcall_msg *gss_msg)
386 list_del_init(&gss_msg->list);
387 rpc_wake_up_status(&gss_msg->rpc_waitqueue, gss_msg->msg.errno);
388 wake_up_all(&gss_msg->waitqueue);
389 refcount_dec(&gss_msg->count);
393 gss_unhash_msg(struct gss_upcall_msg *gss_msg)
395 struct rpc_pipe *pipe = gss_msg->pipe;
397 if (list_empty(&gss_msg->list))
399 spin_lock(&pipe->lock);
400 if (!list_empty(&gss_msg->list))
401 __gss_unhash_msg(gss_msg);
402 spin_unlock(&pipe->lock);
406 gss_handle_downcall_result(struct gss_cred *gss_cred, struct gss_upcall_msg *gss_msg)
408 switch (gss_msg->msg.errno) {
410 if (gss_msg->ctx == NULL)
412 clear_bit(RPCAUTH_CRED_NEGATIVE, &gss_cred->gc_base.cr_flags);
413 gss_cred_set_ctx(&gss_cred->gc_base, gss_msg->ctx);
416 set_bit(RPCAUTH_CRED_NEGATIVE, &gss_cred->gc_base.cr_flags);
418 gss_cred->gc_upcall_timestamp = jiffies;
419 gss_cred->gc_upcall = NULL;
420 rpc_wake_up_status(&gss_msg->rpc_waitqueue, gss_msg->msg.errno);
424 gss_upcall_callback(struct rpc_task *task)
426 struct gss_cred *gss_cred = container_of(task->tk_rqstp->rq_cred,
427 struct gss_cred, gc_base);
428 struct gss_upcall_msg *gss_msg = gss_cred->gc_upcall;
429 struct rpc_pipe *pipe = gss_msg->pipe;
431 spin_lock(&pipe->lock);
432 gss_handle_downcall_result(gss_cred, gss_msg);
433 spin_unlock(&pipe->lock);
434 task->tk_status = gss_msg->msg.errno;
435 gss_release_msg(gss_msg);
438 static void gss_encode_v0_msg(struct gss_upcall_msg *gss_msg)
440 uid_t uid = from_kuid(&init_user_ns, gss_msg->uid);
441 memcpy(gss_msg->databuf, &uid, sizeof(uid));
442 gss_msg->msg.data = gss_msg->databuf;
443 gss_msg->msg.len = sizeof(uid);
445 BUILD_BUG_ON(sizeof(uid) > sizeof(gss_msg->databuf));
448 static int gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
449 const char *service_name,
450 const char *target_name)
452 struct gss_api_mech *mech = gss_msg->auth->mech;
453 char *p = gss_msg->databuf;
454 size_t buflen = sizeof(gss_msg->databuf);
457 len = scnprintf(p, buflen, "mech=%s uid=%d", mech->gm_name,
458 from_kuid(&init_user_ns, gss_msg->uid));
461 gss_msg->msg.len = len;
464 * target= is a full service principal that names the remote
465 * identity that we are authenticating to.
468 len = scnprintf(p, buflen, " target=%s", target_name);
471 gss_msg->msg.len += len;
475 * gssd uses service= and srchost= to select a matching key from
476 * the system's keytab to use as the source principal.
478 * service= is the service name part of the source principal,
479 * or "*" (meaning choose any).
481 * srchost= is the hostname part of the source principal. When
482 * not provided, gssd uses the local hostname.
485 char *c = strchr(service_name, '@');
488 len = scnprintf(p, buflen, " service=%s",
491 len = scnprintf(p, buflen,
492 " service=%.*s srchost=%s",
493 (int)(c - service_name),
494 service_name, c + 1);
497 gss_msg->msg.len += len;
500 if (mech->gm_upcall_enctypes) {
501 len = scnprintf(p, buflen, " enctypes=%s",
502 mech->gm_upcall_enctypes);
505 gss_msg->msg.len += len;
507 trace_rpcgss_upcall_msg(gss_msg->databuf);
508 len = scnprintf(p, buflen, "\n");
511 gss_msg->msg.len += len;
512 gss_msg->msg.data = gss_msg->databuf;
519 static struct gss_upcall_msg *
520 gss_alloc_msg(struct gss_auth *gss_auth,
521 kuid_t uid, const char *service_name)
523 struct gss_upcall_msg *gss_msg;
527 gss_msg = kzalloc(sizeof(*gss_msg), GFP_NOFS);
530 vers = get_pipe_version(gss_auth->net);
534 gss_msg->pipe = gss_auth->gss_pipe[vers]->pipe;
535 INIT_LIST_HEAD(&gss_msg->list);
536 rpc_init_wait_queue(&gss_msg->rpc_waitqueue, "RPCSEC_GSS upcall waitq");
537 init_waitqueue_head(&gss_msg->waitqueue);
538 refcount_set(&gss_msg->count, 1);
540 gss_msg->auth = gss_auth;
543 gss_encode_v0_msg(gss_msg);
546 err = gss_encode_v1_msg(gss_msg, service_name, gss_auth->target_name);
548 goto err_put_pipe_version;
550 kref_get(&gss_auth->kref);
552 err_put_pipe_version:
553 put_pipe_version(gss_auth->net);
560 static struct gss_upcall_msg *
561 gss_setup_upcall(struct gss_auth *gss_auth, struct rpc_cred *cred)
563 struct gss_cred *gss_cred = container_of(cred,
564 struct gss_cred, gc_base);
565 struct gss_upcall_msg *gss_new, *gss_msg;
566 kuid_t uid = cred->cr_cred->fsuid;
568 gss_new = gss_alloc_msg(gss_auth, uid, gss_cred->gc_principal);
571 gss_msg = gss_add_msg(gss_new);
572 if (gss_msg == gss_new) {
574 refcount_inc(&gss_msg->count);
575 res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg);
577 gss_unhash_msg(gss_new);
578 refcount_dec(&gss_msg->count);
579 gss_release_msg(gss_new);
580 gss_msg = ERR_PTR(res);
583 gss_release_msg(gss_new);
587 static void warn_gssd(void)
589 dprintk("AUTH_GSS upcall failed. Please check user daemon is running.\n");
593 gss_refresh_upcall(struct rpc_task *task)
595 struct rpc_cred *cred = task->tk_rqstp->rq_cred;
596 struct gss_auth *gss_auth = container_of(cred->cr_auth,
597 struct gss_auth, rpc_auth);
598 struct gss_cred *gss_cred = container_of(cred,
599 struct gss_cred, gc_base);
600 struct gss_upcall_msg *gss_msg;
601 struct rpc_pipe *pipe;
604 gss_msg = gss_setup_upcall(gss_auth, cred);
605 if (PTR_ERR(gss_msg) == -EAGAIN) {
606 /* XXX: warning on the first, under the assumption we
607 * shouldn't normally hit this case on a refresh. */
609 task->tk_timeout = 15*HZ;
610 rpc_sleep_on(&pipe_version_rpc_waitqueue, task, NULL);
614 if (IS_ERR(gss_msg)) {
615 err = PTR_ERR(gss_msg);
618 pipe = gss_msg->pipe;
619 spin_lock(&pipe->lock);
620 if (gss_cred->gc_upcall != NULL)
621 rpc_sleep_on(&gss_cred->gc_upcall->rpc_waitqueue, task, NULL);
622 else if (gss_msg->ctx == NULL && gss_msg->msg.errno >= 0) {
623 task->tk_timeout = 0;
624 gss_cred->gc_upcall = gss_msg;
625 /* gss_upcall_callback will release the reference to gss_upcall_msg */
626 refcount_inc(&gss_msg->count);
627 rpc_sleep_on(&gss_msg->rpc_waitqueue, task, gss_upcall_callback);
629 gss_handle_downcall_result(gss_cred, gss_msg);
630 err = gss_msg->msg.errno;
632 spin_unlock(&pipe->lock);
633 gss_release_msg(gss_msg);
635 trace_rpcgss_upcall_result(from_kuid(&init_user_ns,
636 cred->cr_cred->fsuid), err);
641 gss_create_upcall(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
643 struct net *net = gss_auth->net;
644 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
645 struct rpc_pipe *pipe;
646 struct rpc_cred *cred = &gss_cred->gc_base;
647 struct gss_upcall_msg *gss_msg;
653 /* if gssd is down, just skip upcalling altogether */
654 if (!gssd_running(net)) {
659 gss_msg = gss_setup_upcall(gss_auth, cred);
660 if (PTR_ERR(gss_msg) == -EAGAIN) {
661 err = wait_event_interruptible_timeout(pipe_version_waitqueue,
662 sn->pipe_version >= 0, 15 * HZ);
663 if (sn->pipe_version < 0) {
671 if (IS_ERR(gss_msg)) {
672 err = PTR_ERR(gss_msg);
675 pipe = gss_msg->pipe;
677 prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_KILLABLE);
678 spin_lock(&pipe->lock);
679 if (gss_msg->ctx != NULL || gss_msg->msg.errno < 0) {
682 spin_unlock(&pipe->lock);
683 if (fatal_signal_pending(current)) {
690 gss_cred_set_ctx(cred, gss_msg->ctx);
692 err = gss_msg->msg.errno;
693 spin_unlock(&pipe->lock);
695 finish_wait(&gss_msg->waitqueue, &wait);
696 gss_release_msg(gss_msg);
698 trace_rpcgss_upcall_result(from_kuid(&init_user_ns,
699 cred->cr_cred->fsuid), err);
703 #define MSG_BUF_MAXSIZE 1024
706 gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
710 struct gss_upcall_msg *gss_msg;
711 struct rpc_pipe *pipe = RPC_I(file_inode(filp))->pipe;
712 struct gss_cl_ctx *ctx;
715 ssize_t err = -EFBIG;
717 if (mlen > MSG_BUF_MAXSIZE)
720 buf = kmalloc(mlen, GFP_NOFS);
725 if (copy_from_user(buf, src, mlen))
728 end = (const void *)((char *)buf + mlen);
729 p = simple_get_bytes(buf, end, &id, sizeof(id));
735 uid = make_kuid(&init_user_ns, id);
736 if (!uid_valid(uid)) {
742 ctx = gss_alloc_context();
747 /* Find a matching upcall */
748 spin_lock(&pipe->lock);
749 gss_msg = __gss_find_upcall(pipe, uid, NULL);
750 if (gss_msg == NULL) {
751 spin_unlock(&pipe->lock);
754 list_del_init(&gss_msg->list);
755 spin_unlock(&pipe->lock);
757 p = gss_fill_context(p, end, ctx, gss_msg->auth->mech);
763 gss_msg->msg.errno = err;
770 gss_msg->msg.errno = -EAGAIN;
773 printk(KERN_CRIT "%s: bad return from "
774 "gss_fill_context: %zd\n", __func__, err);
775 gss_msg->msg.errno = -EIO;
777 goto err_release_msg;
779 gss_msg->ctx = gss_get_ctx(ctx);
783 spin_lock(&pipe->lock);
784 __gss_unhash_msg(gss_msg);
785 spin_unlock(&pipe->lock);
786 gss_release_msg(gss_msg);
795 static int gss_pipe_open(struct inode *inode, int new_version)
797 struct net *net = inode->i_sb->s_fs_info;
798 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
801 spin_lock(&pipe_version_lock);
802 if (sn->pipe_version < 0) {
803 /* First open of any gss pipe determines the version: */
804 sn->pipe_version = new_version;
805 rpc_wake_up(&pipe_version_rpc_waitqueue);
806 wake_up(&pipe_version_waitqueue);
807 } else if (sn->pipe_version != new_version) {
808 /* Trying to open a pipe of a different version */
812 atomic_inc(&sn->pipe_users);
814 spin_unlock(&pipe_version_lock);
819 static int gss_pipe_open_v0(struct inode *inode)
821 return gss_pipe_open(inode, 0);
824 static int gss_pipe_open_v1(struct inode *inode)
826 return gss_pipe_open(inode, 1);
830 gss_pipe_release(struct inode *inode)
832 struct net *net = inode->i_sb->s_fs_info;
833 struct rpc_pipe *pipe = RPC_I(inode)->pipe;
834 struct gss_upcall_msg *gss_msg;
837 spin_lock(&pipe->lock);
838 list_for_each_entry(gss_msg, &pipe->in_downcall, list) {
840 if (!list_empty(&gss_msg->msg.list))
842 gss_msg->msg.errno = -EPIPE;
843 refcount_inc(&gss_msg->count);
844 __gss_unhash_msg(gss_msg);
845 spin_unlock(&pipe->lock);
846 gss_release_msg(gss_msg);
849 spin_unlock(&pipe->lock);
851 put_pipe_version(net);
855 gss_pipe_destroy_msg(struct rpc_pipe_msg *msg)
857 struct gss_upcall_msg *gss_msg = container_of(msg, struct gss_upcall_msg, msg);
859 if (msg->errno < 0) {
860 refcount_inc(&gss_msg->count);
861 gss_unhash_msg(gss_msg);
862 if (msg->errno == -ETIMEDOUT)
864 gss_release_msg(gss_msg);
866 gss_release_msg(gss_msg);
869 static void gss_pipe_dentry_destroy(struct dentry *dir,
870 struct rpc_pipe_dir_object *pdo)
872 struct gss_pipe *gss_pipe = pdo->pdo_data;
873 struct rpc_pipe *pipe = gss_pipe->pipe;
875 if (pipe->dentry != NULL) {
876 rpc_unlink(pipe->dentry);
881 static int gss_pipe_dentry_create(struct dentry *dir,
882 struct rpc_pipe_dir_object *pdo)
884 struct gss_pipe *p = pdo->pdo_data;
885 struct dentry *dentry;
887 dentry = rpc_mkpipe_dentry(dir, p->name, p->clnt, p->pipe);
889 return PTR_ERR(dentry);
890 p->pipe->dentry = dentry;
894 static const struct rpc_pipe_dir_object_ops gss_pipe_dir_object_ops = {
895 .create = gss_pipe_dentry_create,
896 .destroy = gss_pipe_dentry_destroy,
899 static struct gss_pipe *gss_pipe_alloc(struct rpc_clnt *clnt,
901 const struct rpc_pipe_ops *upcall_ops)
906 p = kmalloc(sizeof(*p), GFP_KERNEL);
909 p->pipe = rpc_mkpipe_data(upcall_ops, RPC_PIPE_WAIT_FOR_OPEN);
910 if (IS_ERR(p->pipe)) {
911 err = PTR_ERR(p->pipe);
912 goto err_free_gss_pipe;
917 rpc_init_pipe_dir_object(&p->pdo,
918 &gss_pipe_dir_object_ops,
927 struct gss_alloc_pdo {
928 struct rpc_clnt *clnt;
930 const struct rpc_pipe_ops *upcall_ops;
933 static int gss_pipe_match_pdo(struct rpc_pipe_dir_object *pdo, void *data)
935 struct gss_pipe *gss_pipe;
936 struct gss_alloc_pdo *args = data;
938 if (pdo->pdo_ops != &gss_pipe_dir_object_ops)
940 gss_pipe = container_of(pdo, struct gss_pipe, pdo);
941 if (strcmp(gss_pipe->name, args->name) != 0)
943 if (!kref_get_unless_zero(&gss_pipe->kref))
948 static struct rpc_pipe_dir_object *gss_pipe_alloc_pdo(void *data)
950 struct gss_pipe *gss_pipe;
951 struct gss_alloc_pdo *args = data;
953 gss_pipe = gss_pipe_alloc(args->clnt, args->name, args->upcall_ops);
954 if (!IS_ERR(gss_pipe))
955 return &gss_pipe->pdo;
959 static struct gss_pipe *gss_pipe_get(struct rpc_clnt *clnt,
961 const struct rpc_pipe_ops *upcall_ops)
963 struct net *net = rpc_net_ns(clnt);
964 struct rpc_pipe_dir_object *pdo;
965 struct gss_alloc_pdo args = {
968 .upcall_ops = upcall_ops,
971 pdo = rpc_find_or_alloc_pipe_dir_object(net,
972 &clnt->cl_pipedir_objects,
977 return container_of(pdo, struct gss_pipe, pdo);
978 return ERR_PTR(-ENOMEM);
981 static void __gss_pipe_free(struct gss_pipe *p)
983 struct rpc_clnt *clnt = p->clnt;
984 struct net *net = rpc_net_ns(clnt);
986 rpc_remove_pipe_dir_object(net,
987 &clnt->cl_pipedir_objects,
989 rpc_destroy_pipe_data(p->pipe);
993 static void __gss_pipe_release(struct kref *kref)
995 struct gss_pipe *p = container_of(kref, struct gss_pipe, kref);
1000 static void gss_pipe_free(struct gss_pipe *p)
1003 kref_put(&p->kref, __gss_pipe_release);
1007 * NOTE: we have the opportunity to use different
1008 * parameters based on the input flavor (which must be a pseudoflavor)
1010 static struct gss_auth *
1011 gss_create_new(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
1013 rpc_authflavor_t flavor = args->pseudoflavor;
1014 struct gss_auth *gss_auth;
1015 struct gss_pipe *gss_pipe;
1016 struct rpc_auth * auth;
1017 int err = -ENOMEM; /* XXX? */
1019 if (!try_module_get(THIS_MODULE))
1020 return ERR_PTR(err);
1021 if (!(gss_auth = kmalloc(sizeof(*gss_auth), GFP_KERNEL)))
1023 INIT_HLIST_NODE(&gss_auth->hash);
1024 gss_auth->target_name = NULL;
1025 if (args->target_name) {
1026 gss_auth->target_name = kstrdup(args->target_name, GFP_KERNEL);
1027 if (gss_auth->target_name == NULL)
1030 gss_auth->client = clnt;
1031 gss_auth->net = get_net(rpc_net_ns(clnt));
1033 gss_auth->mech = gss_mech_get_by_pseudoflavor(flavor);
1034 if (!gss_auth->mech)
1036 gss_auth->service = gss_pseudoflavor_to_service(gss_auth->mech, flavor);
1037 if (gss_auth->service == 0)
1039 if (!gssd_running(gss_auth->net))
1041 auth = &gss_auth->rpc_auth;
1042 auth->au_cslack = GSS_CRED_SLACK >> 2;
1043 auth->au_rslack = GSS_VERF_SLACK >> 2;
1045 auth->au_ops = &authgss_ops;
1046 auth->au_flavor = flavor;
1047 if (gss_pseudoflavor_to_datatouch(gss_auth->mech, flavor))
1048 auth->au_flags |= RPCAUTH_AUTH_DATATOUCH;
1049 refcount_set(&auth->au_count, 1);
1050 kref_init(&gss_auth->kref);
1052 err = rpcauth_init_credcache(auth);
1056 * Note: if we created the old pipe first, then someone who
1057 * examined the directory at the right moment might conclude
1058 * that we supported only the old pipe. So we instead create
1059 * the new pipe first.
1061 gss_pipe = gss_pipe_get(clnt, "gssd", &gss_upcall_ops_v1);
1062 if (IS_ERR(gss_pipe)) {
1063 err = PTR_ERR(gss_pipe);
1064 goto err_destroy_credcache;
1066 gss_auth->gss_pipe[1] = gss_pipe;
1068 gss_pipe = gss_pipe_get(clnt, gss_auth->mech->gm_name,
1069 &gss_upcall_ops_v0);
1070 if (IS_ERR(gss_pipe)) {
1071 err = PTR_ERR(gss_pipe);
1072 goto err_destroy_pipe_1;
1074 gss_auth->gss_pipe[0] = gss_pipe;
1078 gss_pipe_free(gss_auth->gss_pipe[1]);
1079 err_destroy_credcache:
1080 rpcauth_destroy_credcache(auth);
1082 gss_mech_put(gss_auth->mech);
1084 put_net(gss_auth->net);
1086 kfree(gss_auth->target_name);
1089 module_put(THIS_MODULE);
1090 trace_rpcgss_createauth(flavor, err);
1091 return ERR_PTR(err);
1095 gss_free(struct gss_auth *gss_auth)
1097 gss_pipe_free(gss_auth->gss_pipe[0]);
1098 gss_pipe_free(gss_auth->gss_pipe[1]);
1099 gss_mech_put(gss_auth->mech);
1100 put_net(gss_auth->net);
1101 kfree(gss_auth->target_name);
1104 module_put(THIS_MODULE);
1108 gss_free_callback(struct kref *kref)
1110 struct gss_auth *gss_auth = container_of(kref, struct gss_auth, kref);
1116 gss_put_auth(struct gss_auth *gss_auth)
1118 kref_put(&gss_auth->kref, gss_free_callback);
1122 gss_destroy(struct rpc_auth *auth)
1124 struct gss_auth *gss_auth = container_of(auth,
1125 struct gss_auth, rpc_auth);
1127 if (hash_hashed(&gss_auth->hash)) {
1128 spin_lock(&gss_auth_hash_lock);
1129 hash_del(&gss_auth->hash);
1130 spin_unlock(&gss_auth_hash_lock);
1133 gss_pipe_free(gss_auth->gss_pipe[0]);
1134 gss_auth->gss_pipe[0] = NULL;
1135 gss_pipe_free(gss_auth->gss_pipe[1]);
1136 gss_auth->gss_pipe[1] = NULL;
1137 rpcauth_destroy_credcache(auth);
1139 gss_put_auth(gss_auth);
1143 * Auths may be shared between rpc clients that were cloned from a
1144 * common client with the same xprt, if they also share the flavor and
1147 * The auth is looked up from the oldest parent sharing the same
1148 * cl_xprt, and the auth itself references only that common parent
1149 * (which is guaranteed to last as long as any of its descendants).
1151 static struct gss_auth *
1152 gss_auth_find_or_add_hashed(const struct rpc_auth_create_args *args,
1153 struct rpc_clnt *clnt,
1154 struct gss_auth *new)
1156 struct gss_auth *gss_auth;
1157 unsigned long hashval = (unsigned long)clnt;
1159 spin_lock(&gss_auth_hash_lock);
1160 hash_for_each_possible(gss_auth_hash_table,
1164 if (gss_auth->client != clnt)
1166 if (gss_auth->rpc_auth.au_flavor != args->pseudoflavor)
1168 if (gss_auth->target_name != args->target_name) {
1169 if (gss_auth->target_name == NULL)
1171 if (args->target_name == NULL)
1173 if (strcmp(gss_auth->target_name, args->target_name))
1176 if (!refcount_inc_not_zero(&gss_auth->rpc_auth.au_count))
1181 hash_add(gss_auth_hash_table, &new->hash, hashval);
1184 spin_unlock(&gss_auth_hash_lock);
1188 static struct gss_auth *
1189 gss_create_hashed(const struct rpc_auth_create_args *args,
1190 struct rpc_clnt *clnt)
1192 struct gss_auth *gss_auth;
1193 struct gss_auth *new;
1195 gss_auth = gss_auth_find_or_add_hashed(args, clnt, NULL);
1196 if (gss_auth != NULL)
1198 new = gss_create_new(args, clnt);
1201 gss_auth = gss_auth_find_or_add_hashed(args, clnt, new);
1202 if (gss_auth != new)
1203 gss_destroy(&new->rpc_auth);
1208 static struct rpc_auth *
1209 gss_create(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
1211 struct gss_auth *gss_auth;
1212 struct rpc_xprt_switch *xps = rcu_access_pointer(clnt->cl_xpi.xpi_xpswitch);
1214 while (clnt != clnt->cl_parent) {
1215 struct rpc_clnt *parent = clnt->cl_parent;
1216 /* Find the original parent for this transport */
1217 if (rcu_access_pointer(parent->cl_xpi.xpi_xpswitch) != xps)
1222 gss_auth = gss_create_hashed(args, clnt);
1223 if (IS_ERR(gss_auth))
1224 return ERR_CAST(gss_auth);
1225 return &gss_auth->rpc_auth;
1228 static struct gss_cred *
1229 gss_dup_cred(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
1231 struct gss_cred *new;
1233 /* Make a copy of the cred so that we can reference count it */
1234 new = kzalloc(sizeof(*gss_cred), GFP_NOIO);
1236 struct auth_cred acred = {
1237 .cred = gss_cred->gc_base.cr_cred,
1239 struct gss_cl_ctx *ctx =
1240 rcu_dereference_protected(gss_cred->gc_ctx, 1);
1242 rpcauth_init_cred(&new->gc_base, &acred,
1243 &gss_auth->rpc_auth,
1245 new->gc_base.cr_flags = 1UL << RPCAUTH_CRED_UPTODATE;
1246 new->gc_service = gss_cred->gc_service;
1247 new->gc_principal = gss_cred->gc_principal;
1248 kref_get(&gss_auth->kref);
1249 rcu_assign_pointer(new->gc_ctx, ctx);
1256 * gss_send_destroy_context will cause the RPCSEC_GSS to send a NULL RPC call
1257 * to the server with the GSS control procedure field set to
1258 * RPC_GSS_PROC_DESTROY. This should normally cause the server to release
1259 * all RPCSEC_GSS state associated with that context.
1262 gss_send_destroy_context(struct rpc_cred *cred)
1264 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1265 struct gss_auth *gss_auth = container_of(cred->cr_auth, struct gss_auth, rpc_auth);
1266 struct gss_cl_ctx *ctx = rcu_dereference_protected(gss_cred->gc_ctx, 1);
1267 struct gss_cred *new;
1268 struct rpc_task *task;
1270 new = gss_dup_cred(gss_auth, gss_cred);
1272 ctx->gc_proc = RPC_GSS_PROC_DESTROY;
1274 task = rpc_call_null(gss_auth->client, &new->gc_base,
1275 RPC_TASK_ASYNC|RPC_TASK_SOFT);
1279 put_rpccred(&new->gc_base);
1283 /* gss_destroy_cred (and gss_free_ctx) are used to clean up after failure
1284 * to create a new cred or context, so they check that things have been
1285 * allocated before freeing them. */
1287 gss_do_free_ctx(struct gss_cl_ctx *ctx)
1289 gss_delete_sec_context(&ctx->gc_gss_ctx);
1290 kfree(ctx->gc_wire_ctx.data);
1291 kfree(ctx->gc_acceptor.data);
1296 gss_free_ctx_callback(struct rcu_head *head)
1298 struct gss_cl_ctx *ctx = container_of(head, struct gss_cl_ctx, gc_rcu);
1299 gss_do_free_ctx(ctx);
1303 gss_free_ctx(struct gss_cl_ctx *ctx)
1305 call_rcu(&ctx->gc_rcu, gss_free_ctx_callback);
1309 gss_free_cred(struct gss_cred *gss_cred)
1315 gss_free_cred_callback(struct rcu_head *head)
1317 struct gss_cred *gss_cred = container_of(head, struct gss_cred, gc_base.cr_rcu);
1318 gss_free_cred(gss_cred);
1322 gss_destroy_nullcred(struct rpc_cred *cred)
1324 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1325 struct gss_auth *gss_auth = container_of(cred->cr_auth, struct gss_auth, rpc_auth);
1326 struct gss_cl_ctx *ctx = rcu_dereference_protected(gss_cred->gc_ctx, 1);
1328 RCU_INIT_POINTER(gss_cred->gc_ctx, NULL);
1329 put_cred(cred->cr_cred);
1330 call_rcu(&cred->cr_rcu, gss_free_cred_callback);
1333 gss_put_auth(gss_auth);
1337 gss_destroy_cred(struct rpc_cred *cred)
1340 if (test_and_clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0)
1341 gss_send_destroy_context(cred);
1342 gss_destroy_nullcred(cred);
1346 gss_hash_cred(struct auth_cred *acred, unsigned int hashbits)
1348 return hash_64(from_kuid(&init_user_ns, acred->cred->fsuid), hashbits);
1352 * Lookup RPCSEC_GSS cred for the current process
1354 static struct rpc_cred *
1355 gss_lookup_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
1357 return rpcauth_lookup_credcache(auth, acred, flags, GFP_NOFS);
1360 static struct rpc_cred *
1361 gss_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags, gfp_t gfp)
1363 struct gss_auth *gss_auth = container_of(auth, struct gss_auth, rpc_auth);
1364 struct gss_cred *cred = NULL;
1367 if (!(cred = kzalloc(sizeof(*cred), gfp)))
1370 rpcauth_init_cred(&cred->gc_base, acred, auth, &gss_credops);
1372 * Note: in order to force a call to call_refresh(), we deliberately
1373 * fail to flag the credential as RPCAUTH_CRED_UPTODATE.
1375 cred->gc_base.cr_flags = 1UL << RPCAUTH_CRED_NEW;
1376 cred->gc_service = gss_auth->service;
1377 cred->gc_principal = acred->principal;
1378 kref_get(&gss_auth->kref);
1379 return &cred->gc_base;
1382 return ERR_PTR(err);
1386 gss_cred_init(struct rpc_auth *auth, struct rpc_cred *cred)
1388 struct gss_auth *gss_auth = container_of(auth, struct gss_auth, rpc_auth);
1389 struct gss_cred *gss_cred = container_of(cred,struct gss_cred, gc_base);
1393 err = gss_create_upcall(gss_auth, gss_cred);
1394 } while (err == -EAGAIN);
1399 gss_stringify_acceptor(struct rpc_cred *cred)
1401 char *string = NULL;
1402 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1403 struct gss_cl_ctx *ctx;
1405 struct xdr_netobj *acceptor;
1408 ctx = rcu_dereference(gss_cred->gc_ctx);
1412 len = ctx->gc_acceptor.len;
1415 /* no point if there's no string */
1419 string = kmalloc(len + 1, GFP_KERNEL);
1424 ctx = rcu_dereference(gss_cred->gc_ctx);
1426 /* did the ctx disappear or was it replaced by one with no acceptor? */
1427 if (!ctx || !ctx->gc_acceptor.len) {
1433 acceptor = &ctx->gc_acceptor;
1436 * Did we find a new acceptor that's longer than the original? Allocate
1437 * a longer buffer and try again.
1439 if (len < acceptor->len) {
1440 len = acceptor->len;
1446 memcpy(string, acceptor->data, acceptor->len);
1447 string[acceptor->len] = '\0';
1454 * Returns -EACCES if GSS context is NULL or will expire within the
1455 * timeout (miliseconds)
1458 gss_key_timeout(struct rpc_cred *rc)
1460 struct gss_cred *gss_cred = container_of(rc, struct gss_cred, gc_base);
1461 struct gss_cl_ctx *ctx;
1462 unsigned long timeout = jiffies + (gss_key_expire_timeo * HZ);
1466 ctx = rcu_dereference(gss_cred->gc_ctx);
1467 if (!ctx || time_after(timeout, ctx->gc_expiry))
1475 gss_match(struct auth_cred *acred, struct rpc_cred *rc, int flags)
1477 struct gss_cred *gss_cred = container_of(rc, struct gss_cred, gc_base);
1478 struct gss_cl_ctx *ctx;
1481 if (test_bit(RPCAUTH_CRED_NEW, &rc->cr_flags))
1483 /* Don't match with creds that have expired. */
1485 ctx = rcu_dereference(gss_cred->gc_ctx);
1486 if (!ctx || time_after(jiffies, ctx->gc_expiry)) {
1491 if (!test_bit(RPCAUTH_CRED_UPTODATE, &rc->cr_flags))
1494 if (acred->principal != NULL) {
1495 if (gss_cred->gc_principal == NULL)
1497 ret = strcmp(acred->principal, gss_cred->gc_principal) == 0;
1499 if (gss_cred->gc_principal != NULL)
1501 ret = uid_eq(rc->cr_cred->fsuid, acred->cred->fsuid);
1507 * Marshal credentials.
1509 * The expensive part is computing the verifier. We can't cache a
1510 * pre-computed version of the verifier because the seqno, which
1511 * is different every time, is included in the MIC.
1513 static int gss_marshal(struct rpc_task *task, struct xdr_stream *xdr)
1515 struct rpc_rqst *req = task->tk_rqstp;
1516 struct rpc_cred *cred = req->rq_cred;
1517 struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
1519 struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
1520 __be32 *p, *cred_len;
1522 struct xdr_netobj mic;
1524 struct xdr_buf verf_buf;
1529 p = xdr_reserve_space(xdr, 7 * sizeof(*p) +
1530 ctx->gc_wire_ctx.len);
1532 goto marshal_failed;
1533 *p++ = rpc_auth_gss;
1536 spin_lock(&ctx->gc_seq_lock);
1537 req->rq_seqno = (ctx->gc_seq < MAXSEQ) ? ctx->gc_seq++ : MAXSEQ;
1538 spin_unlock(&ctx->gc_seq_lock);
1539 if (req->rq_seqno == MAXSEQ)
1541 trace_rpcgss_seqno(task);
1543 *p++ = cpu_to_be32(RPC_GSS_VERSION);
1544 *p++ = cpu_to_be32(ctx->gc_proc);
1545 *p++ = cpu_to_be32(req->rq_seqno);
1546 *p++ = cpu_to_be32(gss_cred->gc_service);
1547 p = xdr_encode_netobj(p, &ctx->gc_wire_ctx);
1548 *cred_len = cpu_to_be32((p - (cred_len + 1)) << 2);
1552 /* We compute the checksum for the verifier over the xdr-encoded bytes
1553 * starting with the xid and ending at the end of the credential: */
1554 iov.iov_base = req->rq_snd_buf.head[0].iov_base;
1555 iov.iov_len = (u8 *)p - (u8 *)iov.iov_base;
1556 xdr_buf_from_iov(&iov, &verf_buf);
1558 p = xdr_reserve_space(xdr, sizeof(*p));
1560 goto marshal_failed;
1561 *p++ = rpc_auth_gss;
1562 mic.data = (u8 *)(p + 1);
1563 maj_stat = gss_get_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
1564 if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1566 else if (maj_stat != 0)
1568 if (xdr_stream_encode_opaque_inline(xdr, (void **)&p, mic.len) < 0)
1569 goto marshal_failed;
1575 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1576 status = -EKEYEXPIRED;
1582 trace_rpcgss_get_mic(task, maj_stat);
1587 static int gss_renew_cred(struct rpc_task *task)
1589 struct rpc_cred *oldcred = task->tk_rqstp->rq_cred;
1590 struct gss_cred *gss_cred = container_of(oldcred,
1593 struct rpc_auth *auth = oldcred->cr_auth;
1594 struct auth_cred acred = {
1595 .cred = oldcred->cr_cred,
1596 .principal = gss_cred->gc_principal,
1598 struct rpc_cred *new;
1600 new = gss_lookup_cred(auth, &acred, RPCAUTH_LOOKUP_NEW);
1602 return PTR_ERR(new);
1603 task->tk_rqstp->rq_cred = new;
1604 put_rpccred(oldcred);
1608 static int gss_cred_is_negative_entry(struct rpc_cred *cred)
1610 if (test_bit(RPCAUTH_CRED_NEGATIVE, &cred->cr_flags)) {
1611 unsigned long now = jiffies;
1612 unsigned long begin, expire;
1613 struct gss_cred *gss_cred;
1615 gss_cred = container_of(cred, struct gss_cred, gc_base);
1616 begin = gss_cred->gc_upcall_timestamp;
1617 expire = begin + gss_expired_cred_retry_delay * HZ;
1619 if (time_in_range_open(now, begin, expire))
1626 * Refresh credentials. XXX - finish
1629 gss_refresh(struct rpc_task *task)
1631 struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1634 if (gss_cred_is_negative_entry(cred))
1635 return -EKEYEXPIRED;
1637 if (!test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags) &&
1638 !test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags)) {
1639 ret = gss_renew_cred(task);
1642 cred = task->tk_rqstp->rq_cred;
1645 if (test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags))
1646 ret = gss_refresh_upcall(task);
1651 /* Dummy refresh routine: used only when destroying the context */
1653 gss_refresh_null(struct rpc_task *task)
1659 gss_validate(struct rpc_task *task, struct xdr_stream *xdr)
1661 struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1662 struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
1663 __be32 *p, *seq = NULL;
1665 struct xdr_buf verf_buf;
1666 struct xdr_netobj mic;
1670 p = xdr_inline_decode(xdr, 2 * sizeof(*p));
1672 goto validate_failed;
1673 if (*p++ != rpc_auth_gss)
1674 goto validate_failed;
1675 len = be32_to_cpup(p);
1676 if (len > RPC_MAX_AUTH_SIZE)
1677 goto validate_failed;
1678 p = xdr_inline_decode(xdr, len);
1680 goto validate_failed;
1682 seq = kmalloc(4, GFP_NOFS);
1684 goto validate_failed;
1685 *seq = cpu_to_be32(task->tk_rqstp->rq_seqno);
1688 xdr_buf_from_iov(&iov, &verf_buf);
1691 maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
1692 if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1693 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1697 /* We leave it to unwrap to calculate au_rslack. For now we just
1698 * calculate the length of the verifier: */
1699 cred->cr_auth->au_verfsize = XDR_QUADLEN(len) + 2;
1710 trace_rpcgss_verify_mic(task, maj_stat);
1715 static int gss_wrap_req_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
1716 struct rpc_task *task, struct xdr_stream *xdr)
1718 struct rpc_rqst *rqstp = task->tk_rqstp;
1719 struct xdr_buf integ_buf, *snd_buf = &rqstp->rq_snd_buf;
1720 struct xdr_netobj mic;
1721 __be32 *p, *integ_len;
1722 u32 offset, maj_stat;
1724 p = xdr_reserve_space(xdr, 2 * sizeof(*p));
1728 *p = cpu_to_be32(rqstp->rq_seqno);
1730 if (rpcauth_wrap_req_encode(task, xdr))
1733 offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base;
1734 if (xdr_buf_subsegment(snd_buf, &integ_buf,
1735 offset, snd_buf->len - offset))
1737 *integ_len = cpu_to_be32(integ_buf.len);
1739 p = xdr_reserve_space(xdr, 0);
1742 mic.data = (u8 *)(p + 1);
1743 maj_stat = gss_get_mic(ctx->gc_gss_ctx, &integ_buf, &mic);
1744 if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1745 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1748 /* Check that the trailing MIC fit in the buffer, after the fact */
1749 if (xdr_stream_encode_opaque_inline(xdr, (void **)&p, mic.len) < 0)
1755 trace_rpcgss_get_mic(task, maj_stat);
1760 priv_release_snd_buf(struct rpc_rqst *rqstp)
1764 for (i=0; i < rqstp->rq_enc_pages_num; i++)
1765 __free_page(rqstp->rq_enc_pages[i]);
1766 kfree(rqstp->rq_enc_pages);
1767 rqstp->rq_release_snd_buf = NULL;
1771 alloc_enc_pages(struct rpc_rqst *rqstp)
1773 struct xdr_buf *snd_buf = &rqstp->rq_snd_buf;
1776 if (rqstp->rq_release_snd_buf)
1777 rqstp->rq_release_snd_buf(rqstp);
1779 if (snd_buf->page_len == 0) {
1780 rqstp->rq_enc_pages_num = 0;
1784 first = snd_buf->page_base >> PAGE_SHIFT;
1785 last = (snd_buf->page_base + snd_buf->page_len - 1) >> PAGE_SHIFT;
1786 rqstp->rq_enc_pages_num = last - first + 1 + 1;
1788 = kmalloc_array(rqstp->rq_enc_pages_num,
1789 sizeof(struct page *),
1791 if (!rqstp->rq_enc_pages)
1793 for (i=0; i < rqstp->rq_enc_pages_num; i++) {
1794 rqstp->rq_enc_pages[i] = alloc_page(GFP_NOFS);
1795 if (rqstp->rq_enc_pages[i] == NULL)
1798 rqstp->rq_release_snd_buf = priv_release_snd_buf;
1801 rqstp->rq_enc_pages_num = i;
1802 priv_release_snd_buf(rqstp);
1807 static int gss_wrap_req_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
1808 struct rpc_task *task, struct xdr_stream *xdr)
1810 struct rpc_rqst *rqstp = task->tk_rqstp;
1811 struct xdr_buf *snd_buf = &rqstp->rq_snd_buf;
1812 u32 pad, offset, maj_stat;
1814 __be32 *p, *opaque_len;
1815 struct page **inpages;
1820 p = xdr_reserve_space(xdr, 2 * sizeof(*p));
1824 *p = cpu_to_be32(rqstp->rq_seqno);
1826 if (rpcauth_wrap_req_encode(task, xdr))
1829 status = alloc_enc_pages(rqstp);
1830 if (unlikely(status))
1832 first = snd_buf->page_base >> PAGE_SHIFT;
1833 inpages = snd_buf->pages + first;
1834 snd_buf->pages = rqstp->rq_enc_pages;
1835 snd_buf->page_base -= first << PAGE_SHIFT;
1837 * Move the tail into its own page, in case gss_wrap needs
1838 * more space in the head when wrapping.
1840 * Still... Why can't gss_wrap just slide the tail down?
1842 if (snd_buf->page_len || snd_buf->tail[0].iov_len) {
1845 tmp = page_address(rqstp->rq_enc_pages[rqstp->rq_enc_pages_num - 1]);
1846 memcpy(tmp, snd_buf->tail[0].iov_base, snd_buf->tail[0].iov_len);
1847 snd_buf->tail[0].iov_base = tmp;
1849 offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base;
1850 maj_stat = gss_wrap(ctx->gc_gss_ctx, offset, snd_buf, inpages);
1851 /* slack space should prevent this ever happening: */
1852 if (unlikely(snd_buf->len > snd_buf->buflen))
1854 /* We're assuming that when GSS_S_CONTEXT_EXPIRED, the encryption was
1855 * done anyway, so it's safe to put the request on the wire: */
1856 if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1857 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1861 *opaque_len = cpu_to_be32(snd_buf->len - offset);
1862 /* guess whether the pad goes into the head or the tail: */
1863 if (snd_buf->page_len || snd_buf->tail[0].iov_len)
1864 iov = snd_buf->tail;
1866 iov = snd_buf->head;
1867 p = iov->iov_base + iov->iov_len;
1868 pad = 3 - ((snd_buf->len - offset - 1) & 3);
1870 iov->iov_len += pad;
1871 snd_buf->len += pad;
1877 trace_rpcgss_wrap(task, maj_stat);
1881 static int gss_wrap_req(struct rpc_task *task, struct xdr_stream *xdr)
1883 struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1884 struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
1886 struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
1890 if (ctx->gc_proc != RPC_GSS_PROC_DATA) {
1891 /* The spec seems a little ambiguous here, but I think that not
1892 * wrapping context destruction requests makes the most sense.
1894 status = rpcauth_wrap_req_encode(task, xdr);
1897 switch (gss_cred->gc_service) {
1898 case RPC_GSS_SVC_NONE:
1899 status = rpcauth_wrap_req_encode(task, xdr);
1901 case RPC_GSS_SVC_INTEGRITY:
1902 status = gss_wrap_req_integ(cred, ctx, task, xdr);
1904 case RPC_GSS_SVC_PRIVACY:
1905 status = gss_wrap_req_priv(cred, ctx, task, xdr);
1916 gss_unwrap_resp_auth(struct rpc_cred *cred)
1918 cred->cr_auth->au_rslack = cred->cr_auth->au_verfsize;
1923 gss_unwrap_resp_integ(struct rpc_task *task, struct rpc_cred *cred,
1924 struct gss_cl_ctx *ctx, struct rpc_rqst *rqstp,
1925 struct xdr_stream *xdr)
1927 struct xdr_buf integ_buf, *rcv_buf = &rqstp->rq_rcv_buf;
1928 u32 data_offset, mic_offset, integ_len, maj_stat;
1929 struct xdr_netobj mic;
1932 p = xdr_inline_decode(xdr, 2 * sizeof(*p));
1935 integ_len = be32_to_cpup(p++);
1938 data_offset = (u8 *)(p) - (u8 *)rcv_buf->head[0].iov_base;
1939 mic_offset = integ_len + data_offset;
1940 if (mic_offset > rcv_buf->len)
1942 if (be32_to_cpup(p) != rqstp->rq_seqno)
1945 if (xdr_buf_subsegment(rcv_buf, &integ_buf, data_offset, integ_len))
1947 if (xdr_buf_read_netobj(rcv_buf, &mic, mic_offset))
1949 maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &integ_buf, &mic);
1950 if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1951 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1952 if (maj_stat != GSS_S_COMPLETE)
1955 cred->cr_auth->au_rslack = cred->cr_auth->au_verfsize + 2 +
1956 1 + XDR_QUADLEN(mic.len);
1959 trace_rpcgss_unwrap_failed(task);
1962 trace_rpcgss_bad_seqno(task, rqstp->rq_seqno, be32_to_cpup(p));
1965 trace_rpcgss_verify_mic(task, maj_stat);
1970 gss_unwrap_resp_priv(struct rpc_task *task, struct rpc_cred *cred,
1971 struct gss_cl_ctx *ctx, struct rpc_rqst *rqstp,
1972 struct xdr_stream *xdr)
1974 struct xdr_buf *rcv_buf = &rqstp->rq_rcv_buf;
1975 struct kvec *head = rqstp->rq_rcv_buf.head;
1976 unsigned int savedlen = rcv_buf->len;
1977 u32 offset, opaque_len, maj_stat;
1980 p = xdr_inline_decode(xdr, 2 * sizeof(*p));
1983 opaque_len = be32_to_cpup(p++);
1984 offset = (u8 *)(p) - (u8 *)head->iov_base;
1985 if (offset + opaque_len > rcv_buf->len)
1987 rcv_buf->len = offset + opaque_len;
1989 maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset, rcv_buf);
1990 if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1991 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1992 if (maj_stat != GSS_S_COMPLETE)
1994 /* gss_unwrap decrypted the sequence number */
1995 if (be32_to_cpup(p++) != rqstp->rq_seqno)
1998 /* gss_unwrap redacts the opaque blob from the head iovec.
1999 * rcv_buf has changed, thus the stream needs to be reset.
2001 xdr_init_decode(xdr, rcv_buf, p, rqstp);
2003 cred->cr_auth->au_rslack = cred->cr_auth->au_verfsize + 2 +
2004 XDR_QUADLEN(savedlen - rcv_buf->len);
2007 trace_rpcgss_unwrap_failed(task);
2010 trace_rpcgss_bad_seqno(task, rqstp->rq_seqno, be32_to_cpup(--p));
2013 trace_rpcgss_unwrap(task, maj_stat);
2018 gss_seq_is_newer(u32 new, u32 old)
2020 return (s32)(new - old) > 0;
2024 gss_xmit_need_reencode(struct rpc_task *task)
2026 struct rpc_rqst *req = task->tk_rqstp;
2027 struct rpc_cred *cred = req->rq_cred;
2028 struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
2029 u32 win, seq_xmit = 0;
2035 if (gss_seq_is_newer(req->rq_seqno, READ_ONCE(ctx->gc_seq)))
2038 seq_xmit = READ_ONCE(ctx->gc_seq_xmit);
2039 while (gss_seq_is_newer(req->rq_seqno, seq_xmit)) {
2042 seq_xmit = cmpxchg(&ctx->gc_seq_xmit, tmp, req->rq_seqno);
2043 if (seq_xmit == tmp) {
2051 ret = !gss_seq_is_newer(req->rq_seqno, seq_xmit - win);
2056 trace_rpcgss_need_reencode(task, seq_xmit, ret);
2061 gss_unwrap_resp(struct rpc_task *task, struct xdr_stream *xdr)
2063 struct rpc_rqst *rqstp = task->tk_rqstp;
2064 struct rpc_cred *cred = rqstp->rq_cred;
2065 struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
2067 struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
2070 if (ctx->gc_proc != RPC_GSS_PROC_DATA)
2072 switch (gss_cred->gc_service) {
2073 case RPC_GSS_SVC_NONE:
2074 status = gss_unwrap_resp_auth(cred);
2076 case RPC_GSS_SVC_INTEGRITY:
2077 status = gss_unwrap_resp_integ(task, cred, ctx, rqstp, xdr);
2079 case RPC_GSS_SVC_PRIVACY:
2080 status = gss_unwrap_resp_priv(task, cred, ctx, rqstp, xdr);
2087 status = rpcauth_unwrap_resp_decode(task, xdr);
2093 static const struct rpc_authops authgss_ops = {
2094 .owner = THIS_MODULE,
2095 .au_flavor = RPC_AUTH_GSS,
2096 .au_name = "RPCSEC_GSS",
2097 .create = gss_create,
2098 .destroy = gss_destroy,
2099 .hash_cred = gss_hash_cred,
2100 .lookup_cred = gss_lookup_cred,
2101 .crcreate = gss_create_cred,
2102 .list_pseudoflavors = gss_mech_list_pseudoflavors,
2103 .info2flavor = gss_mech_info2flavor,
2104 .flavor2info = gss_mech_flavor2info,
2107 static const struct rpc_credops gss_credops = {
2108 .cr_name = "AUTH_GSS",
2109 .crdestroy = gss_destroy_cred,
2110 .cr_init = gss_cred_init,
2111 .crmatch = gss_match,
2112 .crmarshal = gss_marshal,
2113 .crrefresh = gss_refresh,
2114 .crvalidate = gss_validate,
2115 .crwrap_req = gss_wrap_req,
2116 .crunwrap_resp = gss_unwrap_resp,
2117 .crkey_timeout = gss_key_timeout,
2118 .crstringify_acceptor = gss_stringify_acceptor,
2119 .crneed_reencode = gss_xmit_need_reencode,
2122 static const struct rpc_credops gss_nullops = {
2123 .cr_name = "AUTH_GSS",
2124 .crdestroy = gss_destroy_nullcred,
2125 .crmatch = gss_match,
2126 .crmarshal = gss_marshal,
2127 .crrefresh = gss_refresh_null,
2128 .crvalidate = gss_validate,
2129 .crwrap_req = gss_wrap_req,
2130 .crunwrap_resp = gss_unwrap_resp,
2131 .crstringify_acceptor = gss_stringify_acceptor,
2134 static const struct rpc_pipe_ops gss_upcall_ops_v0 = {
2135 .upcall = rpc_pipe_generic_upcall,
2136 .downcall = gss_pipe_downcall,
2137 .destroy_msg = gss_pipe_destroy_msg,
2138 .open_pipe = gss_pipe_open_v0,
2139 .release_pipe = gss_pipe_release,
2142 static const struct rpc_pipe_ops gss_upcall_ops_v1 = {
2143 .upcall = rpc_pipe_generic_upcall,
2144 .downcall = gss_pipe_downcall,
2145 .destroy_msg = gss_pipe_destroy_msg,
2146 .open_pipe = gss_pipe_open_v1,
2147 .release_pipe = gss_pipe_release,
2150 static __net_init int rpcsec_gss_init_net(struct net *net)
2152 return gss_svc_init_net(net);
2155 static __net_exit void rpcsec_gss_exit_net(struct net *net)
2157 gss_svc_shutdown_net(net);
2160 static struct pernet_operations rpcsec_gss_net_ops = {
2161 .init = rpcsec_gss_init_net,
2162 .exit = rpcsec_gss_exit_net,
2166 * Initialize RPCSEC_GSS module
2168 static int __init init_rpcsec_gss(void)
2172 err = rpcauth_register(&authgss_ops);
2175 err = gss_svc_init();
2177 goto out_unregister;
2178 err = register_pernet_subsys(&rpcsec_gss_net_ops);
2181 rpc_init_wait_queue(&pipe_version_rpc_waitqueue, "gss pipe version");
2186 rpcauth_unregister(&authgss_ops);
2191 static void __exit exit_rpcsec_gss(void)
2193 unregister_pernet_subsys(&rpcsec_gss_net_ops);
2195 rpcauth_unregister(&authgss_ops);
2196 rcu_barrier(); /* Wait for completion of call_rcu()'s */
2199 MODULE_ALIAS("rpc-auth-6");
2200 MODULE_LICENSE("GPL");
2201 module_param_named(expired_cred_retry_delay,
2202 gss_expired_cred_retry_delay,
2204 MODULE_PARM_DESC(expired_cred_retry_delay, "Timeout (in seconds) until "
2205 "the RPC engine retries an expired credential");
2207 module_param_named(key_expire_timeo,
2208 gss_key_expire_timeo,
2210 MODULE_PARM_DESC(key_expire_timeo, "Time (in seconds) at the end of a "
2211 "credential keys lifetime where the NFS layer cleans up "
2212 "prior to key expiration");
2214 module_init(init_rpcsec_gss)
2215 module_exit(exit_rpcsec_gss)