net/sunrpc/auth.c

   1 /*
   2  * linux/net/sunrpc/auth.c
   3  *
   4  * Generic RPC client authentication API.
   5  *
   6  * Copyright (C) 1996, Olaf Kirch <okir@monad.swb.de>
   7  */
   8
   9 #include <linux/types.h>
  10 #include <linux/sched.h>
  11 #include <linux/module.h>
  12 #include <linux/slab.h>
  13 #include <linux/errno.h>
  14 #include <linux/socket.h>
  15 #include <linux/sunrpc/clnt.h>
  16 #include <linux/spinlock.h>
  17
  18 #ifdef RPC_DEBUG
  19 # define RPCDBG_FACILITY        RPCDBG_AUTH
  20 #endif
  21
  22 static struct rpc_authops *     auth_flavors[RPC_AUTH_MAXFLAVOR] = {
  23         &authnull_ops,          /* AUTH_NULL */
  24         &authunix_ops,          /* AUTH_UNIX */
  25         NULL,                   /* others can be loadable modules */
  26 };
  27
  28 u32
  29 pseudoflavor_to_flavor(u32 flavor) {
  30         if (flavor >= RPC_AUTH_MAXFLAVOR)
  31                 return RPC_AUTH_GSS;
  32         return flavor;
  33 }
  34
  35 int
  36 rpcauth_register(struct rpc_authops *ops)
  37 {
  38         rpc_authflavor_t flavor;
  39
  40         if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR)
  41                 return -EINVAL;
  42         if (auth_flavors[flavor] != NULL)
  43                 return -EPERM;          /* what else? */
  44         auth_flavors[flavor] = ops;
  45         return 0;
  46 }
  47
  48 int
  49 rpcauth_unregister(struct rpc_authops *ops)
  50 {
  51         rpc_authflavor_t flavor;
  52
  53         if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR)
  54                 return -EINVAL;
  55         if (auth_flavors[flavor] != ops)
  56                 return -EPERM;          /* what else? */
  57         auth_flavors[flavor] = NULL;
  58         return 0;
  59 }
  60
  61 struct rpc_auth *
  62 rpcauth_create(rpc_authflavor_t pseudoflavor, struct rpc_clnt *clnt)
  63 {
  64         struct rpc_auth         *auth;
  65         struct rpc_authops      *ops;
  66         u32                     flavor = pseudoflavor_to_flavor(pseudoflavor);
  67
  68         if (flavor >= RPC_AUTH_MAXFLAVOR || !(ops = auth_flavors[flavor]))
  69                 return NULL;
  70         if (!try_module_get(ops->owner))
  71                 return NULL;
  72         auth = ops->create(clnt, pseudoflavor);
  73         if (!auth)
  74                 return NULL;
  75         atomic_set(&auth->au_count, 1);
  76         if (clnt->cl_auth)
  77                 rpcauth_destroy(clnt->cl_auth);
  78         clnt->cl_auth = auth;
  79         return auth;
  80 }
  81
  82 void
  83 rpcauth_destroy(struct rpc_auth *auth)
  84 {
  85         if (!atomic_dec_and_test(&auth->au_count))
  86                 return;
  87         auth->au_ops->destroy(auth);
  88         module_put(auth->au_ops->owner);
  89         kfree(auth);
  90 }
  91
  92 static spinlock_t rpc_credcache_lock = SPIN_LOCK_UNLOCKED;
  93
  94 /*
  95  * Initialize RPC credential cache
  96  */
  97 void
  98 rpcauth_init_credcache(struct rpc_auth *auth)
  99 {
 100         int i;
 101         for (i = 0; i < RPC_CREDCACHE_NR; i++)
 102                 INIT_LIST_HEAD(&auth->au_credcache[i]);
 103         auth->au_nextgc = jiffies + (auth->au_expire >> 1);
 104 }
 105
 106 /*
 107  * Destroy an unreferenced credential
 108  */
 109 static inline void
 110 rpcauth_crdestroy(struct rpc_cred *cred)
 111 {
 112 #ifdef RPC_DEBUG
 113         BUG_ON(cred->cr_magic != RPCAUTH_CRED_MAGIC ||
 114                         atomic_read(&cred->cr_count) ||
 115                         !list_empty(&cred->cr_hash));
 116         cred->cr_magic = 0;
 117 #endif
 118         cred->cr_ops->crdestroy(cred);
 119 }
 120
 121 /*
 122  * Destroy a list of credentials
 123  */
 124 static inline
 125 void rpcauth_destroy_credlist(struct list_head *head)
 126 {
 127         struct rpc_cred *cred;
 128
 129         while (!list_empty(head)) {
 130                 cred = list_entry(head->next, struct rpc_cred, cr_hash);
 131                 list_del_init(&cred->cr_hash);
 132                 rpcauth_crdestroy(cred);
 133         }
 134 }
 135
 136 /*
 137  * Clear the RPC credential cache, and delete those credentials
 138  * that are not referenced.
 139  */
 140 void
 141 rpcauth_free_credcache(struct rpc_auth *auth)
 142 {
 143         LIST_HEAD(free);
 144         struct list_head *pos, *next;
 145         struct rpc_cred *cred;
 146         int             i;
 147
 148         spin_lock(&rpc_credcache_lock);
 149         for (i = 0; i < RPC_CREDCACHE_NR; i++) {
 150                 list_for_each_safe(pos, next, &auth->au_credcache[i]) {
 151                         cred = list_entry(pos, struct rpc_cred, cr_hash);
 152                         cred->cr_auth = NULL;
 153                         list_del_init(&cred->cr_hash);
 154                         if (atomic_read(&cred->cr_count) == 0)
 155                                 list_add(&cred->cr_hash, &free);
 156                 }
 157         }
 158         spin_unlock(&rpc_credcache_lock);
 159         rpcauth_destroy_credlist(&free);
 160 }
 161
 162 static inline int
 163 rpcauth_prune_expired(struct rpc_cred *cred, struct list_head *free)
 164 {
 165         if (atomic_read(&cred->cr_count) != 0)
 166                return 0;
 167         if (time_before(jiffies, cred->cr_expire))
 168                 return 0;
 169         cred->cr_auth = NULL;
 170         list_del(&cred->cr_hash);
 171         list_add(&cred->cr_hash, free);
 172         return 1;
 173 }
 174
 175 /*
 176  * Remove stale credentials. Avoid sleeping inside the loop.
 177  */
 178 static void
 179 rpcauth_gc_credcache(struct rpc_auth *auth, struct list_head *free)
 180 {
 181         struct list_head *pos, *next;
 182         struct rpc_cred *cred;
 183         int             i;
 184
 185         dprintk("RPC: gc'ing RPC credentials for auth %p\n", auth);
 186         for (i = 0; i < RPC_CREDCACHE_NR; i++) {
 187                 list_for_each_safe(pos, next, &auth->au_credcache[i]) {
 188                         cred = list_entry(pos, struct rpc_cred, cr_hash);
 189                         rpcauth_prune_expired(cred, free);
 190                 }
 191         }
 192         auth->au_nextgc = jiffies + auth->au_expire;
 193 }
 194
 195 /*
 196  * Look up a process' credentials in the authentication cache
 197  */
 198 struct rpc_cred *
 199 rpcauth_lookup_credcache(struct rpc_auth *auth, struct auth_cred * acred,
 200                 int taskflags)
 201 {
 202         LIST_HEAD(free);
 203         struct list_head *pos, *next;
 204         struct rpc_cred *new = NULL,
 205                         *cred = NULL;
 206         int             nr = 0;
 207
 208         if (!(taskflags & RPC_TASK_ROOTCREDS))
 209                 nr = acred->uid & RPC_CREDCACHE_MASK;
 210 retry:
 211         spin_lock(&rpc_credcache_lock);
 212         if (time_before(auth->au_nextgc, jiffies))
 213                 rpcauth_gc_credcache(auth, &free);
 214         list_for_each_safe(pos, next, &auth->au_credcache[nr]) {
 215                 struct rpc_cred *entry;
 216                 entry = list_entry(pos, struct rpc_cred, cr_hash);
 217                 if (entry->cr_flags & RPCAUTH_CRED_DEAD)
 218                         continue;
 219                 if (rpcauth_prune_expired(entry, &free))
 220                         continue;
 221                 if (entry->cr_ops->crmatch(acred, entry, taskflags)) {
 222                         list_del(&entry->cr_hash);
 223                         cred = entry;
 224                         break;
 225                 }
 226         }
 227         if (new) {
 228                 if (cred)
 229                         list_add(&new->cr_hash, &free);
 230                 else
 231                         cred = new;
 232         }
 233         if (cred) {
 234                 list_add(&cred->cr_hash, &auth->au_credcache[nr]);
 235                 cred->cr_auth = auth;
 236                 get_rpccred(cred);
 237         }
 238         spin_unlock(&rpc_credcache_lock);
 239
 240         rpcauth_destroy_credlist(&free);
 241
 242         if (!cred) {
 243                 new = auth->au_ops->crcreate(auth, acred, taskflags);
 244                 if (new) {
 245 #ifdef RPC_DEBUG
 246                         new->cr_magic = RPCAUTH_CRED_MAGIC;
 247 #endif
 248                         goto retry;
 249                 }
 250         }
 251
 252         return (struct rpc_cred *) cred;
 253 }
 254
 255 struct rpc_cred *
 256 rpcauth_lookupcred(struct rpc_auth *auth, int taskflags)
 257 {
 258         struct auth_cred acred;
 259         struct rpc_cred *ret;
 260
 261         get_group_info(current->group_info);
 262         acred.uid = current->fsuid;
 263         acred.gid = current->fsgid;
 264         acred.group_info = current->group_info;
 265
 266         dprintk("RPC:     looking up %s cred\n",
 267                 auth->au_ops->au_name);
 268         ret = rpcauth_lookup_credcache(auth, &acred, taskflags);
 269         put_group_info(current->group_info);
 270         return ret;
 271 }
 272
 273 struct rpc_cred *
 274 rpcauth_bindcred(struct rpc_task *task)
 275 {
 276         struct rpc_auth *auth = task->tk_auth;
 277         struct auth_cred acred;
 278         struct rpc_cred *ret;
 279
 280         get_group_info(current->group_info);
 281         acred.uid = current->fsuid;
 282         acred.gid = current->fsgid;
 283         acred.group_info = current->group_info;
 284
 285         dprintk("RPC: %4d looking up %s cred\n",
 286                 task->tk_pid, task->tk_auth->au_ops->au_name);
 287         task->tk_msg.rpc_cred = rpcauth_lookup_credcache(auth, &acred, task->tk_flags);
 288         if (task->tk_msg.rpc_cred == 0)
 289                 task->tk_status = -ENOMEM;
 290         ret = task->tk_msg.rpc_cred;
 291         put_group_info(current->group_info);
 292         return ret;
 293 }
 294
 295 void
 296 rpcauth_holdcred(struct rpc_task *task)
 297 {
 298         dprintk("RPC: %4d holding %s cred %p\n",
 299                 task->tk_pid, task->tk_auth->au_ops->au_name, task->tk_msg.rpc_cred);
 300         if (task->tk_msg.rpc_cred)
 301                 get_rpccred(task->tk_msg.rpc_cred);
 302 }
 303
 304 void
 305 put_rpccred(struct rpc_cred *cred)
 306 {
 307         if (!atomic_dec_and_lock(&cred->cr_count, &rpc_credcache_lock))
 308                 return;
 309
 310         if ((cred->cr_flags & RPCAUTH_CRED_DEAD) && !list_empty(&cred->cr_hash))
 311                 list_del_init(&cred->cr_hash);
 312
 313         if (list_empty(&cred->cr_hash)) {
 314                 spin_unlock(&rpc_credcache_lock);
 315                 rpcauth_crdestroy(cred);
 316                 return;
 317         }
 318         cred->cr_expire = jiffies + cred->cr_auth->au_expire;
 319         spin_unlock(&rpc_credcache_lock);
 320 }
 321
 322 void
 323 rpcauth_unbindcred(struct rpc_task *task)
 324 {
 325         struct rpc_auth *auth = task->tk_auth;
 326         struct rpc_cred *cred = task->tk_msg.rpc_cred;
 327
 328         dprintk("RPC: %4d releasing %s cred %p\n",
 329                 task->tk_pid, auth->au_ops->au_name, cred);
 330
 331         put_rpccred(cred);
 332         task->tk_msg.rpc_cred = NULL;
 333 }
 334
 335 u32 *
 336 rpcauth_marshcred(struct rpc_task *task, u32 *p)
 337 {
 338         struct rpc_auth *auth = task->tk_auth;
 339         struct rpc_cred *cred = task->tk_msg.rpc_cred;
 340
 341         dprintk("RPC: %4d marshaling %s cred %p\n",
 342                 task->tk_pid, auth->au_ops->au_name, cred);
 343         return cred->cr_ops->crmarshal(task, p,
 344                                 task->tk_flags & RPC_CALL_REALUID);
 345 }
 346
 347 u32 *
 348 rpcauth_checkverf(struct rpc_task *task, u32 *p)
 349 {
 350         struct rpc_auth *auth = task->tk_auth;
 351         struct rpc_cred *cred = task->tk_msg.rpc_cred;
 352
 353         dprintk("RPC: %4d validating %s cred %p\n",
 354                 task->tk_pid, auth->au_ops->au_name, cred);
 355         return cred->cr_ops->crvalidate(task, p);
 356 }
 357
 358 int
 359 rpcauth_wrap_req(struct rpc_task *task, kxdrproc_t encode, void *rqstp,
 360                 u32 *data, void *obj)
 361 {
 362         struct rpc_cred *cred = task->tk_msg.rpc_cred;
 363
 364         dprintk("RPC: %4d using %s cred %p to wrap rpc data\n",
 365                         task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
 366         if (cred->cr_ops->crwrap_req)
 367                 return cred->cr_ops->crwrap_req(task, encode, rqstp, data, obj);
 368         /* By default, we encode the arguments normally. */
 369         return encode(rqstp, data, obj);
 370 }
 371
 372 int
 373 rpcauth_unwrap_resp(struct rpc_task *task, kxdrproc_t decode, void *rqstp,
 374                 u32 *data, void *obj)
 375 {
 376         struct rpc_cred *cred = task->tk_msg.rpc_cred;
 377
 378         dprintk("RPC: %4d using %s cred %p to unwrap rpc data\n",
 379                         task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
 380         if (cred->cr_ops->crunwrap_resp)
 381                 return cred->cr_ops->crunwrap_resp(task, decode, rqstp,
 382                                                    data, obj);
 383         /* By default, we decode the arguments normally. */
 384         return decode(rqstp, data, obj);
 385 }
 386
 387 int
 388 rpcauth_refreshcred(struct rpc_task *task)
 389 {
 390         struct rpc_auth *auth = task->tk_auth;
 391         struct rpc_cred *cred = task->tk_msg.rpc_cred;
 392
 393         dprintk("RPC: %4d refreshing %s cred %p\n",
 394                 task->tk_pid, auth->au_ops->au_name, cred);
 395         task->tk_status = cred->cr_ops->crrefresh(task);
 396         return task->tk_status;
 397 }
 398
 399 void
 400 rpcauth_invalcred(struct rpc_task *task)
 401 {
 402         dprintk("RPC: %4d invalidating %s cred %p\n",
 403                 task->tk_pid, task->tk_auth->au_ops->au_name, task->tk_msg.rpc_cred);
 404         spin_lock(&rpc_credcache_lock);
 405         if (task->tk_msg.rpc_cred)
 406                 task->tk_msg.rpc_cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;
 407         spin_unlock(&rpc_credcache_lock);
 408 }
 409
 410 int
 411 rpcauth_uptodatecred(struct rpc_task *task)
 412 {
 413         return !(task->tk_msg.rpc_cred) ||
 414                 (task->tk_msg.rpc_cred->cr_flags & RPCAUTH_CRED_UPTODATE);
 415 }
 416
 417 int
 418 rpcauth_deadcred(struct rpc_task *task)
 419 {
 420         return !(task->tk_msg.rpc_cred) ||
 421                 (task->tk_msg.rpc_cred->cr_flags & RPCAUTH_CRED_DEAD);
 422 }