1// SPDX-License-Identifier: BSD-3-Clause
   2/*
   3 * linux/net/sunrpc/auth_gss/auth_gss.c
   4 *
   5 * RPCSEC_GSS client authentication.
   6 *
   7 *  Copyright (c) 2000 The Regents of the University of Michigan.
   8 *  All rights reserved.
   9 *
  10 *  Dug Song       <dugsong@monkey.org>
  11 *  Andy Adamson   <andros@umich.edu>
  12 */
  13
  14#include <linux/module.h>
  15#include <linux/init.h>
  16#include <linux/types.h>
  17#include <linux/slab.h>
  18#include <linux/sched.h>
  19#include <linux/pagemap.h>
  20#include <linux/sunrpc/clnt.h>
  21#include <linux/sunrpc/auth.h>
  22#include <linux/sunrpc/auth_gss.h>
  23#include <linux/sunrpc/gss_krb5.h>
  24#include <linux/sunrpc/svcauth_gss.h>
  25#include <linux/sunrpc/gss_err.h>
  26#include <linux/workqueue.h>
  27#include <linux/sunrpc/rpc_pipe_fs.h>
  28#include <linux/sunrpc/gss_api.h>
  29#include <linux/uaccess.h>
  30#include <linux/hashtable.h>
  31
 
  32#include "../netns.h"
  33
  34#include <trace/events/rpcgss.h>
  35
  36static const struct rpc_authops authgss_ops;
  37
  38static const struct rpc_credops gss_credops;
  39static const struct rpc_credops gss_nullops;
  40
  41#define GSS_RETRY_EXPIRED 5
  42static unsigned int gss_expired_cred_retry_delay = GSS_RETRY_EXPIRED;
  43
  44#define GSS_KEY_EXPIRE_TIMEO 240
  45static unsigned int gss_key_expire_timeo = GSS_KEY_EXPIRE_TIMEO;
  46
  47#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
  48# define RPCDBG_FACILITY	RPCDBG_AUTH
  49#endif
  50
  51#define GSS_CRED_SLACK		(RPC_MAX_AUTH_SIZE * 2)
  52/* length of a krb5 verifier (48), plus data added before arguments when
  53 * using integrity (two 4-byte integers): */
  54#define GSS_VERF_SLACK		100
  55
  56static DEFINE_HASHTABLE(gss_auth_hash_table, 4);
  57static DEFINE_SPINLOCK(gss_auth_hash_lock);
  58
  59struct gss_pipe {
  60	struct rpc_pipe_dir_object pdo;
  61	struct rpc_pipe *pipe;
  62	struct rpc_clnt *clnt;
  63	const char *name;
  64	struct kref kref;
  65};
  66
  67struct gss_auth {
  68	struct kref kref;
  69	struct hlist_node hash;
  70	struct rpc_auth rpc_auth;
  71	struct gss_api_mech *mech;
  72	enum rpc_gss_svc service;
  73	struct rpc_clnt *client;
  74	struct net *net;
 
  75	/*
  76	 * There are two upcall pipes; dentry[1], named "gssd", is used
  77	 * for the new text-based upcall; dentry[0] is named after the
  78	 * mechanism (for example, "krb5") and exists for
  79	 * backwards-compatibility with older gssd's.
  80	 */
  81	struct gss_pipe *gss_pipe[2];
  82	const char *target_name;
  83};
  84
  85/* pipe_version >= 0 if and only if someone has a pipe open. */
  86static DEFINE_SPINLOCK(pipe_version_lock);
  87static struct rpc_wait_queue pipe_version_rpc_waitqueue;
  88static DECLARE_WAIT_QUEUE_HEAD(pipe_version_waitqueue);
  89static void gss_put_auth(struct gss_auth *gss_auth);
  90
  91static void gss_free_ctx(struct gss_cl_ctx *);
  92static const struct rpc_pipe_ops gss_upcall_ops_v0;
  93static const struct rpc_pipe_ops gss_upcall_ops_v1;
  94
  95static inline struct gss_cl_ctx *
  96gss_get_ctx(struct gss_cl_ctx *ctx)
  97{
  98	refcount_inc(&ctx->count);
  99	return ctx;
 100}
 101
 102static inline void
 103gss_put_ctx(struct gss_cl_ctx *ctx)
 104{
 105	if (refcount_dec_and_test(&ctx->count))
 106		gss_free_ctx(ctx);
 107}
 108
 109/* gss_cred_set_ctx:
 110 * called by gss_upcall_callback and gss_create_upcall in order
 111 * to set the gss context. The actual exchange of an old context
 112 * and a new one is protected by the pipe->lock.
 113 */
 114static void
 115gss_cred_set_ctx(struct rpc_cred *cred, struct gss_cl_ctx *ctx)
 116{
 117	struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
 118
 119	if (!test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags))
 120		return;
 121	gss_get_ctx(ctx);
 122	rcu_assign_pointer(gss_cred->gc_ctx, ctx);
 123	set_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
 124	smp_mb__before_atomic();
 125	clear_bit(RPCAUTH_CRED_NEW, &cred->cr_flags);
 126}
 127
 128static const void *
 129simple_get_bytes(const void *p, const void *end, void *res, size_t len)
 130{
 131	const void *q = (const void *)((const char *)p + len);
 132	if (unlikely(q > end || q < p))
 133		return ERR_PTR(-EFAULT);
 134	memcpy(res, p, len);
 135	return q;
 136}
 137
 138static inline const void *
 139simple_get_netobj(const void *p, const void *end, struct xdr_netobj *dest)
 140{
 141	const void *q;
 142	unsigned int len;
 143
 144	p = simple_get_bytes(p, end, &len, sizeof(len));
 145	if (IS_ERR(p))
 146		return p;
 147	q = (const void *)((const char *)p + len);
 148	if (unlikely(q > end || q < p))
 149		return ERR_PTR(-EFAULT);
 150	dest->data = kmemdup(p, len, GFP_NOFS);
 151	if (unlikely(dest->data == NULL))
 152		return ERR_PTR(-ENOMEM);
 153	dest->len = len;
 154	return q;
 155}
 156
 157static struct gss_cl_ctx *
 158gss_cred_get_ctx(struct rpc_cred *cred)
 159{
 160	struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
 161	struct gss_cl_ctx *ctx = NULL;
 162
 163	rcu_read_lock();
 164	ctx = rcu_dereference(gss_cred->gc_ctx);
 165	if (ctx)
 166		gss_get_ctx(ctx);
 167	rcu_read_unlock();
 168	return ctx;
 169}
 170
 171static struct gss_cl_ctx *
 172gss_alloc_context(void)
 173{
 174	struct gss_cl_ctx *ctx;
 175
 176	ctx = kzalloc(sizeof(*ctx), GFP_NOFS);
 177	if (ctx != NULL) {
 178		ctx->gc_proc = RPC_GSS_PROC_DATA;
 179		ctx->gc_seq = 1;	/* NetApp 6.4R1 doesn't accept seq. no. 0 */
 180		spin_lock_init(&ctx->gc_seq_lock);
 181		refcount_set(&ctx->count,1);
 182	}
 183	return ctx;
 184}
 185
 186#define GSSD_MIN_TIMEOUT (60 * 60)
 187static const void *
 188gss_fill_context(const void *p, const void *end, struct gss_cl_ctx *ctx, struct gss_api_mech *gm)
 189{
 190	const void *q;
 191	unsigned int seclen;
 192	unsigned int timeout;
 193	unsigned long now = jiffies;
 194	u32 window_size;
 195	int ret;
 196
 197	/* First unsigned int gives the remaining lifetime in seconds of the
 198	 * credential - e.g. the remaining TGT lifetime for Kerberos or
 199	 * the -t value passed to GSSD.
 200	 */
 201	p = simple_get_bytes(p, end, &timeout, sizeof(timeout));
 202	if (IS_ERR(p))
 203		goto err;
 204	if (timeout == 0)
 205		timeout = GSSD_MIN_TIMEOUT;
 206	ctx->gc_expiry = now + ((unsigned long)timeout * HZ);
 207	/* Sequence number window. Determines the maximum number of
 208	 * simultaneous requests
 209	 */
 210	p = simple_get_bytes(p, end, &window_size, sizeof(window_size));
 211	if (IS_ERR(p))
 212		goto err;
 213	ctx->gc_win = window_size;
 214	/* gssd signals an error by passing ctx->gc_win = 0: */
 215	if (ctx->gc_win == 0) {
 216		/*
 217		 * in which case, p points to an error code. Anything other
 218		 * than -EKEYEXPIRED gets converted to -EACCES.
 219		 */
 220		p = simple_get_bytes(p, end, &ret, sizeof(ret));
 221		if (!IS_ERR(p))
 222			p = (ret == -EKEYEXPIRED) ? ERR_PTR(-EKEYEXPIRED) :
 223						    ERR_PTR(-EACCES);
 224		goto err;
 225	}
 226	/* copy the opaque wire context */
 227	p = simple_get_netobj(p, end, &ctx->gc_wire_ctx);
 228	if (IS_ERR(p))
 229		goto err;
 230	/* import the opaque security context */
 231	p  = simple_get_bytes(p, end, &seclen, sizeof(seclen));
 232	if (IS_ERR(p))
 233		goto err;
 234	q = (const void *)((const char *)p + seclen);
 235	if (unlikely(q > end || q < p)) {
 236		p = ERR_PTR(-EFAULT);
 237		goto err;
 238	}
 239	ret = gss_import_sec_context(p, seclen, gm, &ctx->gc_gss_ctx, NULL, GFP_NOFS);
 240	if (ret < 0) {
 241		trace_rpcgss_import_ctx(ret);
 242		p = ERR_PTR(ret);
 243		goto err;
 244	}
 245
 246	/* is there any trailing data? */
 247	if (q == end) {
 248		p = q;
 249		goto done;
 250	}
 251
 252	/* pull in acceptor name (if there is one) */
 253	p = simple_get_netobj(q, end, &ctx->gc_acceptor);
 254	if (IS_ERR(p))
 255		goto err;
 256done:
 257	trace_rpcgss_context(window_size, ctx->gc_expiry, now, timeout,
 258			     ctx->gc_acceptor.len, ctx->gc_acceptor.data);
 259err:
 260	return p;
 261}
 262
 263/* XXX: Need some documentation about why UPCALL_BUF_LEN is so small.
 264 *	Is user space expecting no more than UPCALL_BUF_LEN bytes?
 265 *	Note that there are now _two_ NI_MAXHOST sized data items
 266 *	being passed in this string.
 267 */
 268#define UPCALL_BUF_LEN	256
 269
 270struct gss_upcall_msg {
 271	refcount_t count;
 272	kuid_t	uid;
 273	const char *service_name;
 274	struct rpc_pipe_msg msg;
 275	struct list_head list;
 276	struct gss_auth *auth;
 277	struct rpc_pipe *pipe;
 278	struct rpc_wait_queue rpc_waitqueue;
 279	wait_queue_head_t waitqueue;
 280	struct gss_cl_ctx *ctx;
 281	char databuf[UPCALL_BUF_LEN];
 282};
 283
 284static int get_pipe_version(struct net *net)
 285{
 286	struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 287	int ret;
 288
 289	spin_lock(&pipe_version_lock);
 290	if (sn->pipe_version >= 0) {
 291		atomic_inc(&sn->pipe_users);
 292		ret = sn->pipe_version;
 293	} else
 294		ret = -EAGAIN;
 295	spin_unlock(&pipe_version_lock);
 296	return ret;
 297}
 298
 299static void put_pipe_version(struct net *net)
 300{
 301	struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 302
 303	if (atomic_dec_and_lock(&sn->pipe_users, &pipe_version_lock)) {
 304		sn->pipe_version = -1;
 305		spin_unlock(&pipe_version_lock);
 306	}
 307}
 308
 309static void
 310gss_release_msg(struct gss_upcall_msg *gss_msg)
 311{
 312	struct net *net = gss_msg->auth->net;
 313	if (!refcount_dec_and_test(&gss_msg->count))
 314		return;
 315	put_pipe_version(net);
 316	BUG_ON(!list_empty(&gss_msg->list));
 317	if (gss_msg->ctx != NULL)
 318		gss_put_ctx(gss_msg->ctx);
 319	rpc_destroy_wait_queue(&gss_msg->rpc_waitqueue);
 320	gss_put_auth(gss_msg->auth);
 321	kfree_const(gss_msg->service_name);
 322	kfree(gss_msg);
 323}
 324
 325static struct gss_upcall_msg *
 326__gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid, const struct gss_auth *auth)
 327{
 328	struct gss_upcall_msg *pos;
 329	list_for_each_entry(pos, &pipe->in_downcall, list) {
 330		if (!uid_eq(pos->uid, uid))
 331			continue;
 332		if (auth && pos->auth->service != auth->service)
 333			continue;
 334		refcount_inc(&pos->count);
 335		return pos;
 336	}
 337	return NULL;
 338}
 339
 340/* Try to add an upcall to the pipefs queue.
 341 * If an upcall owned by our uid already exists, then we return a reference
 342 * to that upcall instead of adding the new upcall.
 343 */
 344static inline struct gss_upcall_msg *
 345gss_add_msg(struct gss_upcall_msg *gss_msg)
 346{
 347	struct rpc_pipe *pipe = gss_msg->pipe;
 348	struct gss_upcall_msg *old;
 349
 350	spin_lock(&pipe->lock);
 351	old = __gss_find_upcall(pipe, gss_msg->uid, gss_msg->auth);
 352	if (old == NULL) {
 353		refcount_inc(&gss_msg->count);
 354		list_add(&gss_msg->list, &pipe->in_downcall);
 355	} else
 356		gss_msg = old;
 357	spin_unlock(&pipe->lock);
 358	return gss_msg;
 359}
 360
 361static void
 362__gss_unhash_msg(struct gss_upcall_msg *gss_msg)
 363{
 364	list_del_init(&gss_msg->list);
 365	rpc_wake_up_status(&gss_msg->rpc_waitqueue, gss_msg->msg.errno);
 366	wake_up_all(&gss_msg->waitqueue);
 367	refcount_dec(&gss_msg->count);
 368}
 369
 370static void
 371gss_unhash_msg(struct gss_upcall_msg *gss_msg)
 372{
 373	struct rpc_pipe *pipe = gss_msg->pipe;
 374
 375	if (list_empty(&gss_msg->list))
 376		return;
 377	spin_lock(&pipe->lock);
 378	if (!list_empty(&gss_msg->list))
 379		__gss_unhash_msg(gss_msg);
 380	spin_unlock(&pipe->lock);
 381}
 382
 383static void
 384gss_handle_downcall_result(struct gss_cred *gss_cred, struct gss_upcall_msg *gss_msg)
 385{
 386	switch (gss_msg->msg.errno) {
 387	case 0:
 388		if (gss_msg->ctx == NULL)
 389			break;
 390		clear_bit(RPCAUTH_CRED_NEGATIVE, &gss_cred->gc_base.cr_flags);
 391		gss_cred_set_ctx(&gss_cred->gc_base, gss_msg->ctx);
 392		break;
 393	case -EKEYEXPIRED:
 394		set_bit(RPCAUTH_CRED_NEGATIVE, &gss_cred->gc_base.cr_flags);
 395	}
 396	gss_cred->gc_upcall_timestamp = jiffies;
 397	gss_cred->gc_upcall = NULL;
 398	rpc_wake_up_status(&gss_msg->rpc_waitqueue, gss_msg->msg.errno);
 399}
 400
 401static void
 402gss_upcall_callback(struct rpc_task *task)
 403{
 404	struct gss_cred *gss_cred = container_of(task->tk_rqstp->rq_cred,
 405			struct gss_cred, gc_base);
 406	struct gss_upcall_msg *gss_msg = gss_cred->gc_upcall;
 407	struct rpc_pipe *pipe = gss_msg->pipe;
 408
 409	spin_lock(&pipe->lock);
 410	gss_handle_downcall_result(gss_cred, gss_msg);
 411	spin_unlock(&pipe->lock);
 412	task->tk_status = gss_msg->msg.errno;
 413	gss_release_msg(gss_msg);
 414}
 415
 416static void gss_encode_v0_msg(struct gss_upcall_msg *gss_msg,
 417			      const struct cred *cred)
 418{
 419	struct user_namespace *userns = cred->user_ns;
 420
 421	uid_t uid = from_kuid_munged(userns, gss_msg->uid);
 422	memcpy(gss_msg->databuf, &uid, sizeof(uid));
 423	gss_msg->msg.data = gss_msg->databuf;
 424	gss_msg->msg.len = sizeof(uid);
 425
 426	BUILD_BUG_ON(sizeof(uid) > sizeof(gss_msg->databuf));
 427}
 428
 429static ssize_t
 430gss_v0_upcall(struct file *file, struct rpc_pipe_msg *msg,
 431		char __user *buf, size_t buflen)
 432{
 433	struct gss_upcall_msg *gss_msg = container_of(msg,
 434						      struct gss_upcall_msg,
 435						      msg);
 436	if (msg->copied == 0)
 437		gss_encode_v0_msg(gss_msg, file->f_cred);
 438	return rpc_pipe_generic_upcall(file, msg, buf, buflen);
 439}
 440
 441static int gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
 442				const char *service_name,
 443				const char *target_name,
 444				const struct cred *cred)
 445{
 446	struct user_namespace *userns = cred->user_ns;
 447	struct gss_api_mech *mech = gss_msg->auth->mech;
 448	char *p = gss_msg->databuf;
 449	size_t buflen = sizeof(gss_msg->databuf);
 450	int len;
 451
 452	len = scnprintf(p, buflen, "mech=%s uid=%d", mech->gm_name,
 453			from_kuid_munged(userns, gss_msg->uid));
 454	buflen -= len;
 455	p += len;
 456	gss_msg->msg.len = len;
 457
 458	/*
 459	 * target= is a full service principal that names the remote
 460	 * identity that we are authenticating to.
 461	 */
 462	if (target_name) {
 463		len = scnprintf(p, buflen, " target=%s", target_name);
 464		buflen -= len;
 465		p += len;
 466		gss_msg->msg.len += len;
 467	}
 468
 469	/*
 470	 * gssd uses service= and srchost= to select a matching key from
 471	 * the system's keytab to use as the source principal.
 472	 *
 473	 * service= is the service name part of the source principal,
 474	 * or "*" (meaning choose any).
 475	 *
 476	 * srchost= is the hostname part of the source principal. When
 477	 * not provided, gssd uses the local hostname.
 478	 */
 479	if (service_name) {
 480		char *c = strchr(service_name, '@');
 481
 482		if (!c)
 483			len = scnprintf(p, buflen, " service=%s",
 484					service_name);
 485		else
 486			len = scnprintf(p, buflen,
 487					" service=%.*s srchost=%s",
 488					(int)(c - service_name),
 489					service_name, c + 1);
 490		buflen -= len;
 491		p += len;
 492		gss_msg->msg.len += len;
 493	}
 494
 495	if (mech->gm_upcall_enctypes) {
 496		len = scnprintf(p, buflen, " enctypes=%s",
 497				mech->gm_upcall_enctypes);
 498		buflen -= len;
 499		p += len;
 500		gss_msg->msg.len += len;
 501	}
 502	trace_rpcgss_upcall_msg(gss_msg->databuf);
 503	len = scnprintf(p, buflen, "\n");
 504	if (len == 0)
 505		goto out_overflow;
 506	gss_msg->msg.len += len;
 507	gss_msg->msg.data = gss_msg->databuf;
 508	return 0;
 509out_overflow:
 510	WARN_ON_ONCE(1);
 511	return -ENOMEM;
 512}
 513
 514static ssize_t
 515gss_v1_upcall(struct file *file, struct rpc_pipe_msg *msg,
 516		char __user *buf, size_t buflen)
 517{
 518	struct gss_upcall_msg *gss_msg = container_of(msg,
 519						      struct gss_upcall_msg,
 520						      msg);
 521	int err;
 522	if (msg->copied == 0) {
 523		err = gss_encode_v1_msg(gss_msg,
 524					gss_msg->service_name,
 525					gss_msg->auth->target_name,
 526					file->f_cred);
 527		if (err)
 528			return err;
 529	}
 530	return rpc_pipe_generic_upcall(file, msg, buf, buflen);
 531}
 532
 533static struct gss_upcall_msg *
 534gss_alloc_msg(struct gss_auth *gss_auth,
 535		kuid_t uid, const char *service_name)
 536{
 537	struct gss_upcall_msg *gss_msg;
 538	int vers;
 539	int err = -ENOMEM;
 540
 541	gss_msg = kzalloc(sizeof(*gss_msg), GFP_NOFS);
 542	if (gss_msg == NULL)
 543		goto err;
 544	vers = get_pipe_version(gss_auth->net);
 545	err = vers;
 546	if (err < 0)
 547		goto err_free_msg;
 548	gss_msg->pipe = gss_auth->gss_pipe[vers]->pipe;
 549	INIT_LIST_HEAD(&gss_msg->list);
 550	rpc_init_wait_queue(&gss_msg->rpc_waitqueue, "RPCSEC_GSS upcall waitq");
 551	init_waitqueue_head(&gss_msg->waitqueue);
 552	refcount_set(&gss_msg->count, 1);
 553	gss_msg->uid = uid;
 554	gss_msg->auth = gss_auth;
 555	kref_get(&gss_auth->kref);
 556	if (service_name) {
 557		gss_msg->service_name = kstrdup_const(service_name, GFP_NOFS);
 558		if (!gss_msg->service_name) {
 559			err = -ENOMEM;
 560			goto err_put_pipe_version;
 561		}
 562	}
 563	return gss_msg;
 564err_put_pipe_version:
 565	put_pipe_version(gss_auth->net);
 566err_free_msg:
 567	kfree(gss_msg);
 568err:
 569	return ERR_PTR(err);
 570}
 571
 572static struct gss_upcall_msg *
 573gss_setup_upcall(struct gss_auth *gss_auth, struct rpc_cred *cred)
 574{
 575	struct gss_cred *gss_cred = container_of(cred,
 576			struct gss_cred, gc_base);
 577	struct gss_upcall_msg *gss_new, *gss_msg;
 578	kuid_t uid = cred->cr_cred->fsuid;
 579
 580	gss_new = gss_alloc_msg(gss_auth, uid, gss_cred->gc_principal);
 581	if (IS_ERR(gss_new))
 582		return gss_new;
 583	gss_msg = gss_add_msg(gss_new);
 584	if (gss_msg == gss_new) {
 585		int res;
 586		refcount_inc(&gss_msg->count);
 587		res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg);
 588		if (res) {
 589			gss_unhash_msg(gss_new);
 590			refcount_dec(&gss_msg->count);
 591			gss_release_msg(gss_new);
 592			gss_msg = ERR_PTR(res);
 593		}
 594	} else
 595		gss_release_msg(gss_new);
 596	return gss_msg;
 597}
 598
 599static void warn_gssd(void)
 600{
 601	dprintk("AUTH_GSS upcall failed. Please check user daemon is running.\n");
 602}
 603
 604static inline int
 605gss_refresh_upcall(struct rpc_task *task)
 606{
 607	struct rpc_cred *cred = task->tk_rqstp->rq_cred;
 608	struct gss_auth *gss_auth = container_of(cred->cr_auth,
 609			struct gss_auth, rpc_auth);
 610	struct gss_cred *gss_cred = container_of(cred,
 611			struct gss_cred, gc_base);
 612	struct gss_upcall_msg *gss_msg;
 613	struct rpc_pipe *pipe;
 614	int err = 0;
 615
 616	gss_msg = gss_setup_upcall(gss_auth, cred);
 617	if (PTR_ERR(gss_msg) == -EAGAIN) {
 618		/* XXX: warning on the first, under the assumption we
 619		 * shouldn't normally hit this case on a refresh. */
 620		warn_gssd();
 621		rpc_sleep_on_timeout(&pipe_version_rpc_waitqueue,
 622				task, NULL, jiffies + (15 * HZ));
 623		err = -EAGAIN;
 624		goto out;
 625	}
 626	if (IS_ERR(gss_msg)) {
 627		err = PTR_ERR(gss_msg);
 628		goto out;
 629	}
 630	pipe = gss_msg->pipe;
 631	spin_lock(&pipe->lock);
 632	if (gss_cred->gc_upcall != NULL)
 633		rpc_sleep_on(&gss_cred->gc_upcall->rpc_waitqueue, task, NULL);
 634	else if (gss_msg->ctx == NULL && gss_msg->msg.errno >= 0) {
 635		gss_cred->gc_upcall = gss_msg;
 636		/* gss_upcall_callback will release the reference to gss_upcall_msg */
 637		refcount_inc(&gss_msg->count);
 638		rpc_sleep_on(&gss_msg->rpc_waitqueue, task, gss_upcall_callback);
 639	} else {
 640		gss_handle_downcall_result(gss_cred, gss_msg);
 641		err = gss_msg->msg.errno;
 642	}
 643	spin_unlock(&pipe->lock);
 644	gss_release_msg(gss_msg);
 645out:
 646	trace_rpcgss_upcall_result(from_kuid(&init_user_ns,
 647					     cred->cr_cred->fsuid), err);
 648	return err;
 649}
 650
 651static inline int
 652gss_create_upcall(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
 653{
 654	struct net *net = gss_auth->net;
 655	struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 656	struct rpc_pipe *pipe;
 657	struct rpc_cred *cred = &gss_cred->gc_base;
 658	struct gss_upcall_msg *gss_msg;
 659	DEFINE_WAIT(wait);
 660	int err;
 661
 662retry:
 663	err = 0;
 664	/* if gssd is down, just skip upcalling altogether */
 665	if (!gssd_running(net)) {
 666		warn_gssd();
 667		err = -EACCES;
 668		goto out;
 669	}
 670	gss_msg = gss_setup_upcall(gss_auth, cred);
 671	if (PTR_ERR(gss_msg) == -EAGAIN) {
 672		err = wait_event_interruptible_timeout(pipe_version_waitqueue,
 673				sn->pipe_version >= 0, 15 * HZ);
 674		if (sn->pipe_version < 0) {
 675			warn_gssd();
 676			err = -EACCES;
 677		}
 678		if (err < 0)
 679			goto out;
 680		goto retry;
 681	}
 682	if (IS_ERR(gss_msg)) {
 683		err = PTR_ERR(gss_msg);
 684		goto out;
 685	}
 686	pipe = gss_msg->pipe;
 687	for (;;) {
 688		prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_KILLABLE);
 689		spin_lock(&pipe->lock);
 690		if (gss_msg->ctx != NULL || gss_msg->msg.errno < 0) {
 691			break;
 692		}
 693		spin_unlock(&pipe->lock);
 694		if (fatal_signal_pending(current)) {
 695			err = -ERESTARTSYS;
 696			goto out_intr;
 697		}
 698		schedule();
 699	}
 700	if (gss_msg->ctx) {
 701		trace_rpcgss_ctx_init(gss_cred);
 702		gss_cred_set_ctx(cred, gss_msg->ctx);
 703	} else {
 704		err = gss_msg->msg.errno;
 705	}
 706	spin_unlock(&pipe->lock);
 707out_intr:
 708	finish_wait(&gss_msg->waitqueue, &wait);
 709	gss_release_msg(gss_msg);
 710out:
 711	trace_rpcgss_upcall_result(from_kuid(&init_user_ns,
 712					     cred->cr_cred->fsuid), err);
 713	return err;
 714}
 715
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 716#define MSG_BUF_MAXSIZE 1024
 717
 718static ssize_t
 719gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
 720{
 721	const void *p, *end;
 722	void *buf;
 723	struct gss_upcall_msg *gss_msg;
 724	struct rpc_pipe *pipe = RPC_I(file_inode(filp))->pipe;
 725	struct gss_cl_ctx *ctx;
 726	uid_t id;
 727	kuid_t uid;
 728	ssize_t err = -EFBIG;
 729
 730	if (mlen > MSG_BUF_MAXSIZE)
 731		goto out;
 732	err = -ENOMEM;
 733	buf = kmalloc(mlen, GFP_NOFS);
 734	if (!buf)
 735		goto out;
 736
 737	err = -EFAULT;
 738	if (copy_from_user(buf, src, mlen))
 739		goto err;
 740
 741	end = (const void *)((char *)buf + mlen);
 742	p = simple_get_bytes(buf, end, &id, sizeof(id));
 743	if (IS_ERR(p)) {
 744		err = PTR_ERR(p);
 745		goto err;
 746	}
 747
 748	uid = make_kuid(current_user_ns(), id);
 749	if (!uid_valid(uid)) {
 750		err = -EINVAL;
 751		goto err;
 752	}
 753
 754	err = -ENOMEM;
 755	ctx = gss_alloc_context();
 756	if (ctx == NULL)
 757		goto err;
 758
 759	err = -ENOENT;
 760	/* Find a matching upcall */
 761	spin_lock(&pipe->lock);
 762	gss_msg = __gss_find_upcall(pipe, uid, NULL);
 763	if (gss_msg == NULL) {
 764		spin_unlock(&pipe->lock);
 765		goto err_put_ctx;
 766	}
 767	list_del_init(&gss_msg->list);
 768	spin_unlock(&pipe->lock);
 769
 770	p = gss_fill_context(p, end, ctx, gss_msg->auth->mech);
 771	if (IS_ERR(p)) {
 772		err = PTR_ERR(p);
 773		switch (err) {
 774		case -EACCES:
 775		case -EKEYEXPIRED:
 776			gss_msg->msg.errno = err;
 777			err = mlen;
 778			break;
 779		case -EFAULT:
 780		case -ENOMEM:
 781		case -EINVAL:
 782		case -ENOSYS:
 783			gss_msg->msg.errno = -EAGAIN;
 784			break;
 785		default:
 786			printk(KERN_CRIT "%s: bad return from "
 787				"gss_fill_context: %zd\n", __func__, err);
 788			gss_msg->msg.errno = -EIO;
 789		}
 790		goto err_release_msg;
 791	}
 792	gss_msg->ctx = gss_get_ctx(ctx);
 793	err = mlen;
 794
 795err_release_msg:
 796	spin_lock(&pipe->lock);
 797	__gss_unhash_msg(gss_msg);
 798	spin_unlock(&pipe->lock);
 799	gss_release_msg(gss_msg);
 800err_put_ctx:
 801	gss_put_ctx(ctx);
 802err:
 803	kfree(buf);
 804out:
 805	return err;
 806}
 807
 808static int gss_pipe_open(struct inode *inode, int new_version)
 809{
 810	struct net *net = inode->i_sb->s_fs_info;
 811	struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 812	int ret = 0;
 813
 814	spin_lock(&pipe_version_lock);
 815	if (sn->pipe_version < 0) {
 816		/* First open of any gss pipe determines the version: */
 817		sn->pipe_version = new_version;
 818		rpc_wake_up(&pipe_version_rpc_waitqueue);
 819		wake_up(&pipe_version_waitqueue);
 820	} else if (sn->pipe_version != new_version) {
 821		/* Trying to open a pipe of a different version */
 822		ret = -EBUSY;
 823		goto out;
 824	}
 825	atomic_inc(&sn->pipe_users);
 826out:
 827	spin_unlock(&pipe_version_lock);
 828	return ret;
 829
 830}
 831
 832static int gss_pipe_open_v0(struct inode *inode)
 833{
 834	return gss_pipe_open(inode, 0);
 835}
 836
 837static int gss_pipe_open_v1(struct inode *inode)
 838{
 839	return gss_pipe_open(inode, 1);
 840}
 841
 842static void
 843gss_pipe_release(struct inode *inode)
 844{
 845	struct net *net = inode->i_sb->s_fs_info;
 846	struct rpc_pipe *pipe = RPC_I(inode)->pipe;
 847	struct gss_upcall_msg *gss_msg;
 848
 849restart:
 850	spin_lock(&pipe->lock);
 851	list_for_each_entry(gss_msg, &pipe->in_downcall, list) {
 852
 853		if (!list_empty(&gss_msg->msg.list))
 854			continue;
 855		gss_msg->msg.errno = -EPIPE;
 856		refcount_inc(&gss_msg->count);
 857		__gss_unhash_msg(gss_msg);
 858		spin_unlock(&pipe->lock);
 859		gss_release_msg(gss_msg);
 860		goto restart;
 861	}
 862	spin_unlock(&pipe->lock);
 863
 864	put_pipe_version(net);
 865}
 866
 867static void
 868gss_pipe_destroy_msg(struct rpc_pipe_msg *msg)
 869{
 870	struct gss_upcall_msg *gss_msg = container_of(msg, struct gss_upcall_msg, msg);
 871
 872	if (msg->errno < 0) {
 873		refcount_inc(&gss_msg->count);
 874		gss_unhash_msg(gss_msg);
 875		if (msg->errno == -ETIMEDOUT)
 876			warn_gssd();
 877		gss_release_msg(gss_msg);
 878	}
 879	gss_release_msg(gss_msg);
 880}
 881
 882static void gss_pipe_dentry_destroy(struct dentry *dir,
 883		struct rpc_pipe_dir_object *pdo)
 884{
 885	struct gss_pipe *gss_pipe = pdo->pdo_data;
 886	struct rpc_pipe *pipe = gss_pipe->pipe;
 887
 888	if (pipe->dentry != NULL) {
 889		rpc_unlink(pipe->dentry);
 890		pipe->dentry = NULL;
 891	}
 892}
 893
 894static int gss_pipe_dentry_create(struct dentry *dir,
 895		struct rpc_pipe_dir_object *pdo)
 896{
 897	struct gss_pipe *p = pdo->pdo_data;
 898	struct dentry *dentry;
 899
 900	dentry = rpc_mkpipe_dentry(dir, p->name, p->clnt, p->pipe);
 901	if (IS_ERR(dentry))
 902		return PTR_ERR(dentry);
 903	p->pipe->dentry = dentry;
 904	return 0;
 905}
 906
 907static const struct rpc_pipe_dir_object_ops gss_pipe_dir_object_ops = {
 908	.create = gss_pipe_dentry_create,
 909	.destroy = gss_pipe_dentry_destroy,
 910};
 911
 912static struct gss_pipe *gss_pipe_alloc(struct rpc_clnt *clnt,
 913		const char *name,
 914		const struct rpc_pipe_ops *upcall_ops)
 915{
 916	struct gss_pipe *p;
 917	int err = -ENOMEM;
 918
 919	p = kmalloc(sizeof(*p), GFP_KERNEL);
 920	if (p == NULL)
 921		goto err;
 922	p->pipe = rpc_mkpipe_data(upcall_ops, RPC_PIPE_WAIT_FOR_OPEN);
 923	if (IS_ERR(p->pipe)) {
 924		err = PTR_ERR(p->pipe);
 925		goto err_free_gss_pipe;
 926	}
 927	p->name = name;
 928	p->clnt = clnt;
 929	kref_init(&p->kref);
 930	rpc_init_pipe_dir_object(&p->pdo,
 931			&gss_pipe_dir_object_ops,
 932			p);
 933	return p;
 934err_free_gss_pipe:
 935	kfree(p);
 936err:
 937	return ERR_PTR(err);
 938}
 939
 940struct gss_alloc_pdo {
 941	struct rpc_clnt *clnt;
 942	const char *name;
 943	const struct rpc_pipe_ops *upcall_ops;
 944};
 945
 946static int gss_pipe_match_pdo(struct rpc_pipe_dir_object *pdo, void *data)
 947{
 948	struct gss_pipe *gss_pipe;
 949	struct gss_alloc_pdo *args = data;
 950
 951	if (pdo->pdo_ops != &gss_pipe_dir_object_ops)
 952		return 0;
 953	gss_pipe = container_of(pdo, struct gss_pipe, pdo);
 954	if (strcmp(gss_pipe->name, args->name) != 0)
 955		return 0;
 956	if (!kref_get_unless_zero(&gss_pipe->kref))
 957		return 0;
 958	return 1;
 959}
 960
 961static struct rpc_pipe_dir_object *gss_pipe_alloc_pdo(void *data)
 962{
 963	struct gss_pipe *gss_pipe;
 964	struct gss_alloc_pdo *args = data;
 965
 966	gss_pipe = gss_pipe_alloc(args->clnt, args->name, args->upcall_ops);
 967	if (!IS_ERR(gss_pipe))
 968		return &gss_pipe->pdo;
 969	return NULL;
 970}
 971
 972static struct gss_pipe *gss_pipe_get(struct rpc_clnt *clnt,
 973		const char *name,
 974		const struct rpc_pipe_ops *upcall_ops)
 975{
 976	struct net *net = rpc_net_ns(clnt);
 977	struct rpc_pipe_dir_object *pdo;
 978	struct gss_alloc_pdo args = {
 979		.clnt = clnt,
 980		.name = name,
 981		.upcall_ops = upcall_ops,
 982	};
 983
 984	pdo = rpc_find_or_alloc_pipe_dir_object(net,
 985			&clnt->cl_pipedir_objects,
 986			gss_pipe_match_pdo,
 987			gss_pipe_alloc_pdo,
 988			&args);
 989	if (pdo != NULL)
 990		return container_of(pdo, struct gss_pipe, pdo);
 991	return ERR_PTR(-ENOMEM);
 992}
 993
 994static void __gss_pipe_free(struct gss_pipe *p)
 995{
 996	struct rpc_clnt *clnt = p->clnt;
 997	struct net *net = rpc_net_ns(clnt);
 998
 999	rpc_remove_pipe_dir_object(net,
1000			&clnt->cl_pipedir_objects,
1001			&p->pdo);
1002	rpc_destroy_pipe_data(p->pipe);
1003	kfree(p);
1004}
1005
1006static void __gss_pipe_release(struct kref *kref)
1007{
1008	struct gss_pipe *p = container_of(kref, struct gss_pipe, kref);
1009
1010	__gss_pipe_free(p);
1011}
1012
1013static void gss_pipe_free(struct gss_pipe *p)
1014{
1015	if (p != NULL)
1016		kref_put(&p->kref, __gss_pipe_release);
1017}
1018
1019/*
1020 * NOTE: we have the opportunity to use different
1021 * parameters based on the input flavor (which must be a pseudoflavor)
1022 */
1023static struct gss_auth *
1024gss_create_new(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
1025{
1026	rpc_authflavor_t flavor = args->pseudoflavor;
1027	struct gss_auth *gss_auth;
1028	struct gss_pipe *gss_pipe;
1029	struct rpc_auth * auth;
1030	int err = -ENOMEM; /* XXX? */
1031
1032	if (!try_module_get(THIS_MODULE))
1033		return ERR_PTR(err);
1034	if (!(gss_auth = kmalloc(sizeof(*gss_auth), GFP_KERNEL)))
1035		goto out_dec;
1036	INIT_HLIST_NODE(&gss_auth->hash);
1037	gss_auth->target_name = NULL;
1038	if (args->target_name) {
1039		gss_auth->target_name = kstrdup(args->target_name, GFP_KERNEL);
1040		if (gss_auth->target_name == NULL)
1041			goto err_free;
1042	}
1043	gss_auth->client = clnt;
1044	gss_auth->net = get_net(rpc_net_ns(clnt));
 
1045	err = -EINVAL;
1046	gss_auth->mech = gss_mech_get_by_pseudoflavor(flavor);
1047	if (!gss_auth->mech)
1048		goto err_put_net;
1049	gss_auth->service = gss_pseudoflavor_to_service(gss_auth->mech, flavor);
1050	if (gss_auth->service == 0)
1051		goto err_put_mech;
1052	if (!gssd_running(gss_auth->net))
1053		goto err_put_mech;
1054	auth = &gss_auth->rpc_auth;
1055	auth->au_cslack = GSS_CRED_SLACK >> 2;
1056	auth->au_rslack = GSS_KRB5_MAX_SLACK_NEEDED >> 2;
1057	auth->au_verfsize = GSS_VERF_SLACK >> 2;
1058	auth->au_ralign = GSS_VERF_SLACK >> 2;
1059	__set_bit(RPCAUTH_AUTH_UPDATE_SLACK, &auth->au_flags);
1060	auth->au_ops = &authgss_ops;
1061	auth->au_flavor = flavor;
1062	if (gss_pseudoflavor_to_datatouch(gss_auth->mech, flavor))
1063		__set_bit(RPCAUTH_AUTH_DATATOUCH, &auth->au_flags);
1064	refcount_set(&auth->au_count, 1);
1065	kref_init(&gss_auth->kref);
1066
1067	err = rpcauth_init_credcache(auth);
1068	if (err)
1069		goto err_put_mech;
1070	/*
1071	 * Note: if we created the old pipe first, then someone who
1072	 * examined the directory at the right moment might conclude
1073	 * that we supported only the old pipe.  So we instead create
1074	 * the new pipe first.
1075	 */
1076	gss_pipe = gss_pipe_get(clnt, "gssd", &gss_upcall_ops_v1);
1077	if (IS_ERR(gss_pipe)) {
1078		err = PTR_ERR(gss_pipe);
1079		goto err_destroy_credcache;
1080	}
1081	gss_auth->gss_pipe[1] = gss_pipe;
1082
1083	gss_pipe = gss_pipe_get(clnt, gss_auth->mech->gm_name,
1084			&gss_upcall_ops_v0);
1085	if (IS_ERR(gss_pipe)) {
1086		err = PTR_ERR(gss_pipe);
1087		goto err_destroy_pipe_1;
1088	}
1089	gss_auth->gss_pipe[0] = gss_pipe;
1090
1091	return gss_auth;
1092err_destroy_pipe_1:
1093	gss_pipe_free(gss_auth->gss_pipe[1]);
1094err_destroy_credcache:
1095	rpcauth_destroy_credcache(auth);
1096err_put_mech:
1097	gss_mech_put(gss_auth->mech);
1098err_put_net:
1099	put_net(gss_auth->net);
1100err_free:
1101	kfree(gss_auth->target_name);
1102	kfree(gss_auth);
1103out_dec:
1104	module_put(THIS_MODULE);
1105	trace_rpcgss_createauth(flavor, err);
1106	return ERR_PTR(err);
1107}
1108
1109static void
1110gss_free(struct gss_auth *gss_auth)
1111{
1112	gss_pipe_free(gss_auth->gss_pipe[0]);
1113	gss_pipe_free(gss_auth->gss_pipe[1]);
1114	gss_mech_put(gss_auth->mech);
1115	put_net(gss_auth->net);
1116	kfree(gss_auth->target_name);
1117
1118	kfree(gss_auth);
1119	module_put(THIS_MODULE);
1120}
1121
1122static void
1123gss_free_callback(struct kref *kref)
1124{
1125	struct gss_auth *gss_auth = container_of(kref, struct gss_auth, kref);
1126
1127	gss_free(gss_auth);
1128}
1129
1130static void
1131gss_put_auth(struct gss_auth *gss_auth)
1132{
1133	kref_put(&gss_auth->kref, gss_free_callback);
1134}
1135
1136static void
1137gss_destroy(struct rpc_auth *auth)
1138{
1139	struct gss_auth *gss_auth = container_of(auth,
1140			struct gss_auth, rpc_auth);
1141
1142	if (hash_hashed(&gss_auth->hash)) {
1143		spin_lock(&gss_auth_hash_lock);
1144		hash_del(&gss_auth->hash);
1145		spin_unlock(&gss_auth_hash_lock);
1146	}
1147
1148	gss_pipe_free(gss_auth->gss_pipe[0]);
1149	gss_auth->gss_pipe[0] = NULL;
1150	gss_pipe_free(gss_auth->gss_pipe[1]);
1151	gss_auth->gss_pipe[1] = NULL;
1152	rpcauth_destroy_credcache(auth);
1153
1154	gss_put_auth(gss_auth);
1155}
1156
1157/*
1158 * Auths may be shared between rpc clients that were cloned from a
1159 * common client with the same xprt, if they also share the flavor and
1160 * target_name.
1161 *
1162 * The auth is looked up from the oldest parent sharing the same
1163 * cl_xprt, and the auth itself references only that common parent
1164 * (which is guaranteed to last as long as any of its descendants).
1165 */
1166static struct gss_auth *
1167gss_auth_find_or_add_hashed(const struct rpc_auth_create_args *args,
1168		struct rpc_clnt *clnt,
1169		struct gss_auth *new)
1170{
1171	struct gss_auth *gss_auth;
1172	unsigned long hashval = (unsigned long)clnt;
1173
1174	spin_lock(&gss_auth_hash_lock);
1175	hash_for_each_possible(gss_auth_hash_table,
1176			gss_auth,
1177			hash,
1178			hashval) {
1179		if (gss_auth->client != clnt)
1180			continue;
1181		if (gss_auth->rpc_auth.au_flavor != args->pseudoflavor)
1182			continue;
1183		if (gss_auth->target_name != args->target_name) {
1184			if (gss_auth->target_name == NULL)
1185				continue;
1186			if (args->target_name == NULL)
1187				continue;
1188			if (strcmp(gss_auth->target_name, args->target_name))
1189				continue;
1190		}
1191		if (!refcount_inc_not_zero(&gss_auth->rpc_auth.au_count))
1192			continue;
1193		goto out;
1194	}
1195	if (new)
1196		hash_add(gss_auth_hash_table, &new->hash, hashval);
1197	gss_auth = new;
1198out:
1199	spin_unlock(&gss_auth_hash_lock);
1200	return gss_auth;
1201}
1202
1203static struct gss_auth *
1204gss_create_hashed(const struct rpc_auth_create_args *args,
1205		  struct rpc_clnt *clnt)
1206{
1207	struct gss_auth *gss_auth;
1208	struct gss_auth *new;
1209
1210	gss_auth = gss_auth_find_or_add_hashed(args, clnt, NULL);
1211	if (gss_auth != NULL)
1212		goto out;
1213	new = gss_create_new(args, clnt);
1214	if (IS_ERR(new))
1215		return new;
1216	gss_auth = gss_auth_find_or_add_hashed(args, clnt, new);
1217	if (gss_auth != new)
1218		gss_destroy(&new->rpc_auth);
1219out:
1220	return gss_auth;
1221}
1222
1223static struct rpc_auth *
1224gss_create(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
1225{
1226	struct gss_auth *gss_auth;
1227	struct rpc_xprt_switch *xps = rcu_access_pointer(clnt->cl_xpi.xpi_xpswitch);
1228
1229	while (clnt != clnt->cl_parent) {
1230		struct rpc_clnt *parent = clnt->cl_parent;
1231		/* Find the original parent for this transport */
1232		if (rcu_access_pointer(parent->cl_xpi.xpi_xpswitch) != xps)
1233			break;
1234		clnt = parent;
1235	}
1236
1237	gss_auth = gss_create_hashed(args, clnt);
1238	if (IS_ERR(gss_auth))
1239		return ERR_CAST(gss_auth);
1240	return &gss_auth->rpc_auth;
1241}
1242
1243static struct gss_cred *
1244gss_dup_cred(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
1245{
1246	struct gss_cred *new;
1247
1248	/* Make a copy of the cred so that we can reference count it */
1249	new = kzalloc(sizeof(*gss_cred), GFP_NOFS);
1250	if (new) {
1251		struct auth_cred acred = {
1252			.cred = gss_cred->gc_base.cr_cred,
1253		};
1254		struct gss_cl_ctx *ctx =
1255			rcu_dereference_protected(gss_cred->gc_ctx, 1);
1256
1257		rpcauth_init_cred(&new->gc_base, &acred,
1258				&gss_auth->rpc_auth,
1259				&gss_nullops);
1260		new->gc_base.cr_flags = 1UL << RPCAUTH_CRED_UPTODATE;
1261		new->gc_service = gss_cred->gc_service;
1262		new->gc_principal = gss_cred->gc_principal;
1263		kref_get(&gss_auth->kref);
1264		rcu_assign_pointer(new->gc_ctx, ctx);
1265		gss_get_ctx(ctx);
1266	}
1267	return new;
1268}
1269
1270/*
1271 * gss_send_destroy_context will cause the RPCSEC_GSS to send a NULL RPC call
1272 * to the server with the GSS control procedure field set to
1273 * RPC_GSS_PROC_DESTROY. This should normally cause the server to release
1274 * all RPCSEC_GSS state associated with that context.
1275 */
1276static void
1277gss_send_destroy_context(struct rpc_cred *cred)
1278{
1279	struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1280	struct gss_auth *gss_auth = container_of(cred->cr_auth, struct gss_auth, rpc_auth);
1281	struct gss_cl_ctx *ctx = rcu_dereference_protected(gss_cred->gc_ctx, 1);
1282	struct gss_cred *new;
1283	struct rpc_task *task;
1284
1285	new = gss_dup_cred(gss_auth, gss_cred);
1286	if (new) {
1287		ctx->gc_proc = RPC_GSS_PROC_DESTROY;
1288
1289		trace_rpcgss_ctx_destroy(gss_cred);
1290		task = rpc_call_null(gss_auth->client, &new->gc_base,
1291				     RPC_TASK_ASYNC);
1292		if (!IS_ERR(task))
1293			rpc_put_task(task);
1294
1295		put_rpccred(&new->gc_base);
1296	}
1297}
1298
1299/* gss_destroy_cred (and gss_free_ctx) are used to clean up after failure
1300 * to create a new cred or context, so they check that things have been
1301 * allocated before freeing them. */
1302static void
1303gss_do_free_ctx(struct gss_cl_ctx *ctx)
1304{
1305	gss_delete_sec_context(&ctx->gc_gss_ctx);
1306	kfree(ctx->gc_wire_ctx.data);
1307	kfree(ctx->gc_acceptor.data);
1308	kfree(ctx);
1309}
1310
1311static void
1312gss_free_ctx_callback(struct rcu_head *head)
1313{
1314	struct gss_cl_ctx *ctx = container_of(head, struct gss_cl_ctx, gc_rcu);
1315	gss_do_free_ctx(ctx);
1316}
1317
1318static void
1319gss_free_ctx(struct gss_cl_ctx *ctx)
1320{
1321	call_rcu(&ctx->gc_rcu, gss_free_ctx_callback);
1322}
1323
1324static void
1325gss_free_cred(struct gss_cred *gss_cred)
1326{
1327	kfree(gss_cred);
1328}
1329
1330static void
1331gss_free_cred_callback(struct rcu_head *head)
1332{
1333	struct gss_cred *gss_cred = container_of(head, struct gss_cred, gc_base.cr_rcu);
1334	gss_free_cred(gss_cred);
1335}
1336
1337static void
1338gss_destroy_nullcred(struct rpc_cred *cred)
1339{
1340	struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1341	struct gss_auth *gss_auth = container_of(cred->cr_auth, struct gss_auth, rpc_auth);
1342	struct gss_cl_ctx *ctx = rcu_dereference_protected(gss_cred->gc_ctx, 1);
1343
1344	RCU_INIT_POINTER(gss_cred->gc_ctx, NULL);
1345	put_cred(cred->cr_cred);
1346	call_rcu(&cred->cr_rcu, gss_free_cred_callback);
1347	if (ctx)
1348		gss_put_ctx(ctx);
1349	gss_put_auth(gss_auth);
1350}
1351
1352static void
1353gss_destroy_cred(struct rpc_cred *cred)
1354{
1355	if (test_and_clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0)
1356		gss_send_destroy_context(cred);
1357	gss_destroy_nullcred(cred);
1358}
1359
1360static int
1361gss_hash_cred(struct auth_cred *acred, unsigned int hashbits)
1362{
1363	return hash_64(from_kuid(&init_user_ns, acred->cred->fsuid), hashbits);
1364}
1365
1366/*
1367 * Lookup RPCSEC_GSS cred for the current process
1368 */
1369static struct rpc_cred *
1370gss_lookup_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
1371{
1372	return rpcauth_lookup_credcache(auth, acred, flags, GFP_NOFS);
 
1373}
1374
1375static struct rpc_cred *
1376gss_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags, gfp_t gfp)
1377{
1378	struct gss_auth *gss_auth = container_of(auth, struct gss_auth, rpc_auth);
1379	struct gss_cred	*cred = NULL;
1380	int err = -ENOMEM;
1381
1382	if (!(cred = kzalloc(sizeof(*cred), gfp)))
1383		goto out_err;
1384
1385	rpcauth_init_cred(&cred->gc_base, acred, auth, &gss_credops);
1386	/*
1387	 * Note: in order to force a call to call_refresh(), we deliberately
1388	 * fail to flag the credential as RPCAUTH_CRED_UPTODATE.
1389	 */
1390	cred->gc_base.cr_flags = 1UL << RPCAUTH_CRED_NEW;
1391	cred->gc_service = gss_auth->service;
1392	cred->gc_principal = acred->principal;
1393	kref_get(&gss_auth->kref);
1394	return &cred->gc_base;
1395
1396out_err:
1397	return ERR_PTR(err);
1398}
1399
1400static int
1401gss_cred_init(struct rpc_auth *auth, struct rpc_cred *cred)
1402{
1403	struct gss_auth *gss_auth = container_of(auth, struct gss_auth, rpc_auth);
1404	struct gss_cred *gss_cred = container_of(cred,struct gss_cred, gc_base);
1405	int err;
1406
1407	do {
1408		err = gss_create_upcall(gss_auth, gss_cred);
1409	} while (err == -EAGAIN);
1410	return err;
1411}
1412
1413static char *
1414gss_stringify_acceptor(struct rpc_cred *cred)
1415{
1416	char *string = NULL;
1417	struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1418	struct gss_cl_ctx *ctx;
1419	unsigned int len;
1420	struct xdr_netobj *acceptor;
1421
1422	rcu_read_lock();
1423	ctx = rcu_dereference(gss_cred->gc_ctx);
1424	if (!ctx)
1425		goto out;
1426
1427	len = ctx->gc_acceptor.len;
1428	rcu_read_unlock();
1429
1430	/* no point if there's no string */
1431	if (!len)
1432		return NULL;
1433realloc:
1434	string = kmalloc(len + 1, GFP_KERNEL);
1435	if (!string)
1436		return NULL;
1437
1438	rcu_read_lock();
1439	ctx = rcu_dereference(gss_cred->gc_ctx);
1440
1441	/* did the ctx disappear or was it replaced by one with no acceptor? */
1442	if (!ctx || !ctx->gc_acceptor.len) {
1443		kfree(string);
1444		string = NULL;
1445		goto out;
1446	}
1447
1448	acceptor = &ctx->gc_acceptor;
1449
1450	/*
1451	 * Did we find a new acceptor that's longer than the original? Allocate
1452	 * a longer buffer and try again.
1453	 */
1454	if (len < acceptor->len) {
1455		len = acceptor->len;
1456		rcu_read_unlock();
1457		kfree(string);
1458		goto realloc;
1459	}
1460
1461	memcpy(string, acceptor->data, acceptor->len);
1462	string[acceptor->len] = '\0';
1463out:
1464	rcu_read_unlock();
1465	return string;
1466}
1467
1468/*
1469 * Returns -EACCES if GSS context is NULL or will expire within the
1470 * timeout (miliseconds)
1471 */
1472static int
1473gss_key_timeout(struct rpc_cred *rc)
1474{
1475	struct gss_cred *gss_cred = container_of(rc, struct gss_cred, gc_base);
1476	struct gss_cl_ctx *ctx;
1477	unsigned long timeout = jiffies + (gss_key_expire_timeo * HZ);
1478	int ret = 0;
1479
1480	rcu_read_lock();
1481	ctx = rcu_dereference(gss_cred->gc_ctx);
1482	if (!ctx || time_after(timeout, ctx->gc_expiry))
1483		ret = -EACCES;
1484	rcu_read_unlock();
1485
1486	return ret;
1487}
1488
1489static int
1490gss_match(struct auth_cred *acred, struct rpc_cred *rc, int flags)
1491{
1492	struct gss_cred *gss_cred = container_of(rc, struct gss_cred, gc_base);
1493	struct gss_cl_ctx *ctx;
1494	int ret;
1495
1496	if (test_bit(RPCAUTH_CRED_NEW, &rc->cr_flags))
1497		goto out;
1498	/* Don't match with creds that have expired. */
1499	rcu_read_lock();
1500	ctx = rcu_dereference(gss_cred->gc_ctx);
1501	if (!ctx || time_after(jiffies, ctx->gc_expiry)) {
1502		rcu_read_unlock();
1503		return 0;
1504	}
1505	rcu_read_unlock();
1506	if (!test_bit(RPCAUTH_CRED_UPTODATE, &rc->cr_flags))
1507		return 0;
1508out:
1509	if (acred->principal != NULL) {
1510		if (gss_cred->gc_principal == NULL)
1511			return 0;
1512		ret = strcmp(acred->principal, gss_cred->gc_principal) == 0;
1513	} else {
1514		if (gss_cred->gc_principal != NULL)
1515			return 0;
1516		ret = uid_eq(rc->cr_cred->fsuid, acred->cred->fsuid);
1517	}
1518	return ret;
1519}
1520
1521/*
1522 * Marshal credentials.
1523 *
1524 * The expensive part is computing the verifier. We can't cache a
1525 * pre-computed version of the verifier because the seqno, which
1526 * is different every time, is included in the MIC.
1527 */
1528static int gss_marshal(struct rpc_task *task, struct xdr_stream *xdr)
1529{
1530	struct rpc_rqst *req = task->tk_rqstp;
1531	struct rpc_cred *cred = req->rq_cred;
1532	struct gss_cred	*gss_cred = container_of(cred, struct gss_cred,
1533						 gc_base);
1534	struct gss_cl_ctx	*ctx = gss_cred_get_ctx(cred);
1535	__be32		*p, *cred_len;
1536	u32             maj_stat = 0;
1537	struct xdr_netobj mic;
1538	struct kvec	iov;
1539	struct xdr_buf	verf_buf;
1540	int status;
1541
1542	/* Credential */
1543
1544	p = xdr_reserve_space(xdr, 7 * sizeof(*p) +
1545			      ctx->gc_wire_ctx.len);
1546	if (!p)
1547		goto marshal_failed;
1548	*p++ = rpc_auth_gss;
1549	cred_len = p++;
1550
1551	spin_lock(&ctx->gc_seq_lock);
1552	req->rq_seqno = (ctx->gc_seq < MAXSEQ) ? ctx->gc_seq++ : MAXSEQ;
1553	spin_unlock(&ctx->gc_seq_lock);
1554	if (req->rq_seqno == MAXSEQ)
1555		goto expired;
1556	trace_rpcgss_seqno(task);
1557
1558	*p++ = cpu_to_be32(RPC_GSS_VERSION);
1559	*p++ = cpu_to_be32(ctx->gc_proc);
1560	*p++ = cpu_to_be32(req->rq_seqno);
1561	*p++ = cpu_to_be32(gss_cred->gc_service);
1562	p = xdr_encode_netobj(p, &ctx->gc_wire_ctx);
1563	*cred_len = cpu_to_be32((p - (cred_len + 1)) << 2);
1564
1565	/* Verifier */
1566
1567	/* We compute the checksum for the verifier over the xdr-encoded bytes
1568	 * starting with the xid and ending at the end of the credential: */
1569	iov.iov_base = req->rq_snd_buf.head[0].iov_base;
1570	iov.iov_len = (u8 *)p - (u8 *)iov.iov_base;
1571	xdr_buf_from_iov(&iov, &verf_buf);
1572
1573	p = xdr_reserve_space(xdr, sizeof(*p));
1574	if (!p)
1575		goto marshal_failed;
1576	*p++ = rpc_auth_gss;
1577	mic.data = (u8 *)(p + 1);
1578	maj_stat = gss_get_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
1579	if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1580		goto expired;
1581	else if (maj_stat != 0)
1582		goto bad_mic;
1583	if (xdr_stream_encode_opaque_inline(xdr, (void **)&p, mic.len) < 0)
1584		goto marshal_failed;
1585	status = 0;
1586out:
1587	gss_put_ctx(ctx);
1588	return status;
1589expired:
1590	clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1591	status = -EKEYEXPIRED;
1592	goto out;
1593marshal_failed:
1594	status = -EMSGSIZE;
1595	goto out;
1596bad_mic:
1597	trace_rpcgss_get_mic(task, maj_stat);
1598	status = -EIO;
1599	goto out;
1600}
1601
1602static int gss_renew_cred(struct rpc_task *task)
1603{
1604	struct rpc_cred *oldcred = task->tk_rqstp->rq_cred;
1605	struct gss_cred *gss_cred = container_of(oldcred,
1606						 struct gss_cred,
1607						 gc_base);
1608	struct rpc_auth *auth = oldcred->cr_auth;
1609	struct auth_cred acred = {
1610		.cred = oldcred->cr_cred,
1611		.principal = gss_cred->gc_principal,
1612	};
1613	struct rpc_cred *new;
1614
1615	new = gss_lookup_cred(auth, &acred, RPCAUTH_LOOKUP_NEW);
1616	if (IS_ERR(new))
1617		return PTR_ERR(new);
1618
1619	task->tk_rqstp->rq_cred = new;
1620	put_rpccred(oldcred);
1621	return 0;
1622}
1623
1624static int gss_cred_is_negative_entry(struct rpc_cred *cred)
1625{
1626	if (test_bit(RPCAUTH_CRED_NEGATIVE, &cred->cr_flags)) {
1627		unsigned long now = jiffies;
1628		unsigned long begin, expire;
1629		struct gss_cred *gss_cred;
1630
1631		gss_cred = container_of(cred, struct gss_cred, gc_base);
1632		begin = gss_cred->gc_upcall_timestamp;
1633		expire = begin + gss_expired_cred_retry_delay * HZ;
1634
1635		if (time_in_range_open(now, begin, expire))
1636			return 1;
1637	}
1638	return 0;
1639}
1640
1641/*
1642* Refresh credentials. XXX - finish
1643*/
1644static int
1645gss_refresh(struct rpc_task *task)
1646{
1647	struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1648	int ret = 0;
1649
1650	if (gss_cred_is_negative_entry(cred))
1651		return -EKEYEXPIRED;
1652
1653	if (!test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags) &&
1654			!test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags)) {
1655		ret = gss_renew_cred(task);
1656		if (ret < 0)
1657			goto out;
1658		cred = task->tk_rqstp->rq_cred;
1659	}
1660
1661	if (test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags))
1662		ret = gss_refresh_upcall(task);
1663out:
1664	return ret;
1665}
1666
1667/* Dummy refresh routine: used only when destroying the context */
1668static int
1669gss_refresh_null(struct rpc_task *task)
1670{
1671	return 0;
1672}
1673
1674static int
1675gss_validate(struct rpc_task *task, struct xdr_stream *xdr)
1676{
1677	struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1678	struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
1679	__be32		*p, *seq = NULL;
1680	struct kvec	iov;
1681	struct xdr_buf	verf_buf;
1682	struct xdr_netobj mic;
1683	u32		len, maj_stat;
1684	int		status;
1685
1686	p = xdr_inline_decode(xdr, 2 * sizeof(*p));
1687	if (!p)
1688		goto validate_failed;
1689	if (*p++ != rpc_auth_gss)
1690		goto validate_failed;
1691	len = be32_to_cpup(p);
1692	if (len > RPC_MAX_AUTH_SIZE)
1693		goto validate_failed;
1694	p = xdr_inline_decode(xdr, len);
1695	if (!p)
1696		goto validate_failed;
1697
1698	seq = kmalloc(4, GFP_NOFS);
1699	if (!seq)
1700		goto validate_failed;
1701	*seq = cpu_to_be32(task->tk_rqstp->rq_seqno);
1702	iov.iov_base = seq;
1703	iov.iov_len = 4;
1704	xdr_buf_from_iov(&iov, &verf_buf);
1705	mic.data = (u8 *)p;
1706	mic.len = len;
1707	maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
1708	if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1709		clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1710	if (maj_stat)
1711		goto bad_mic;
1712
1713	/* We leave it to unwrap to calculate au_rslack. For now we just
1714	 * calculate the length of the verifier: */
1715	if (test_bit(RPCAUTH_AUTH_UPDATE_SLACK, &cred->cr_auth->au_flags))
1716		cred->cr_auth->au_verfsize = XDR_QUADLEN(len) + 2;
1717	status = 0;
1718out:
1719	gss_put_ctx(ctx);
1720	kfree(seq);
1721	return status;
1722
1723validate_failed:
1724	status = -EIO;
1725	goto out;
1726bad_mic:
1727	trace_rpcgss_verify_mic(task, maj_stat);
1728	status = -EACCES;
1729	goto out;
1730}
1731
1732static noinline_for_stack int
1733gss_wrap_req_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
1734		   struct rpc_task *task, struct xdr_stream *xdr)
1735{
1736	struct rpc_rqst *rqstp = task->tk_rqstp;
1737	struct xdr_buf integ_buf, *snd_buf = &rqstp->rq_snd_buf;
1738	struct xdr_netobj mic;
1739	__be32 *p, *integ_len;
1740	u32 offset, maj_stat;
1741
1742	p = xdr_reserve_space(xdr, 2 * sizeof(*p));
1743	if (!p)
1744		goto wrap_failed;
1745	integ_len = p++;
1746	*p = cpu_to_be32(rqstp->rq_seqno);
1747
1748	if (rpcauth_wrap_req_encode(task, xdr))
1749		goto wrap_failed;
1750
1751	offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base;
1752	if (xdr_buf_subsegment(snd_buf, &integ_buf,
1753				offset, snd_buf->len - offset))
1754		goto wrap_failed;
1755	*integ_len = cpu_to_be32(integ_buf.len);
1756
1757	p = xdr_reserve_space(xdr, 0);
1758	if (!p)
1759		goto wrap_failed;
1760	mic.data = (u8 *)(p + 1);
1761	maj_stat = gss_get_mic(ctx->gc_gss_ctx, &integ_buf, &mic);
1762	if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1763		clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1764	else if (maj_stat)
1765		goto bad_mic;
1766	/* Check that the trailing MIC fit in the buffer, after the fact */
1767	if (xdr_stream_encode_opaque_inline(xdr, (void **)&p, mic.len) < 0)
1768		goto wrap_failed;
1769	return 0;
1770wrap_failed:
1771	return -EMSGSIZE;
1772bad_mic:
1773	trace_rpcgss_get_mic(task, maj_stat);
1774	return -EIO;
1775}
1776
1777static void
1778priv_release_snd_buf(struct rpc_rqst *rqstp)
1779{
1780	int i;
1781
1782	for (i=0; i < rqstp->rq_enc_pages_num; i++)
1783		__free_page(rqstp->rq_enc_pages[i]);
1784	kfree(rqstp->rq_enc_pages);
1785	rqstp->rq_release_snd_buf = NULL;
1786}
1787
1788static int
1789alloc_enc_pages(struct rpc_rqst *rqstp)
1790{
1791	struct xdr_buf *snd_buf = &rqstp->rq_snd_buf;
1792	int first, last, i;
1793
1794	if (rqstp->rq_release_snd_buf)
1795		rqstp->rq_release_snd_buf(rqstp);
1796
1797	if (snd_buf->page_len == 0) {
1798		rqstp->rq_enc_pages_num = 0;
1799		return 0;
1800	}
1801
1802	first = snd_buf->page_base >> PAGE_SHIFT;
1803	last = (snd_buf->page_base + snd_buf->page_len - 1) >> PAGE_SHIFT;
1804	rqstp->rq_enc_pages_num = last - first + 1 + 1;
1805	rqstp->rq_enc_pages
1806		= kmalloc_array(rqstp->rq_enc_pages_num,
1807				sizeof(struct page *),
1808				GFP_NOFS);
1809	if (!rqstp->rq_enc_pages)
1810		goto out;
1811	for (i=0; i < rqstp->rq_enc_pages_num; i++) {
1812		rqstp->rq_enc_pages[i] = alloc_page(GFP_NOFS);
1813		if (rqstp->rq_enc_pages[i] == NULL)
1814			goto out_free;
1815	}
1816	rqstp->rq_release_snd_buf = priv_release_snd_buf;
1817	return 0;
1818out_free:
1819	rqstp->rq_enc_pages_num = i;
1820	priv_release_snd_buf(rqstp);
1821out:
1822	return -EAGAIN;
1823}
1824
1825static noinline_for_stack int
1826gss_wrap_req_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
1827		  struct rpc_task *task, struct xdr_stream *xdr)
1828{
1829	struct rpc_rqst *rqstp = task->tk_rqstp;
1830	struct xdr_buf	*snd_buf = &rqstp->rq_snd_buf;
1831	u32		pad, offset, maj_stat;
1832	int		status;
1833	__be32		*p, *opaque_len;
1834	struct page	**inpages;
1835	int		first;
1836	struct kvec	*iov;
1837
1838	status = -EIO;
1839	p = xdr_reserve_space(xdr, 2 * sizeof(*p));
1840	if (!p)
1841		goto wrap_failed;
1842	opaque_len = p++;
1843	*p = cpu_to_be32(rqstp->rq_seqno);
1844
1845	if (rpcauth_wrap_req_encode(task, xdr))
1846		goto wrap_failed;
1847
1848	status = alloc_enc_pages(rqstp);
1849	if (unlikely(status))
1850		goto wrap_failed;
1851	first = snd_buf->page_base >> PAGE_SHIFT;
1852	inpages = snd_buf->pages + first;
1853	snd_buf->pages = rqstp->rq_enc_pages;
1854	snd_buf->page_base -= first << PAGE_SHIFT;
1855	/*
1856	 * Move the tail into its own page, in case gss_wrap needs
1857	 * more space in the head when wrapping.
1858	 *
1859	 * Still... Why can't gss_wrap just slide the tail down?
1860	 */
1861	if (snd_buf->page_len || snd_buf->tail[0].iov_len) {
1862		char *tmp;
1863
1864		tmp = page_address(rqstp->rq_enc_pages[rqstp->rq_enc_pages_num - 1]);
1865		memcpy(tmp, snd_buf->tail[0].iov_base, snd_buf->tail[0].iov_len);
1866		snd_buf->tail[0].iov_base = tmp;
1867	}
1868	offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base;
1869	maj_stat = gss_wrap(ctx->gc_gss_ctx, offset, snd_buf, inpages);
1870	/* slack space should prevent this ever happening: */
1871	if (unlikely(snd_buf->len > snd_buf->buflen))
1872		goto wrap_failed;
1873	/* We're assuming that when GSS_S_CONTEXT_EXPIRED, the encryption was
1874	 * done anyway, so it's safe to put the request on the wire: */
1875	if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1876		clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1877	else if (maj_stat)
1878		goto bad_wrap;
1879
1880	*opaque_len = cpu_to_be32(snd_buf->len - offset);
1881	/* guess whether the pad goes into the head or the tail: */
1882	if (snd_buf->page_len || snd_buf->tail[0].iov_len)
1883		iov = snd_buf->tail;
1884	else
1885		iov = snd_buf->head;
1886	p = iov->iov_base + iov->iov_len;
1887	pad = xdr_pad_size(snd_buf->len - offset);
1888	memset(p, 0, pad);
1889	iov->iov_len += pad;
1890	snd_buf->len += pad;
1891
1892	return 0;
1893wrap_failed:
1894	return status;
1895bad_wrap:
1896	trace_rpcgss_wrap(task, maj_stat);
1897	return -EIO;
1898}
1899
1900static int gss_wrap_req(struct rpc_task *task, struct xdr_stream *xdr)
1901{
1902	struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1903	struct gss_cred	*gss_cred = container_of(cred, struct gss_cred,
1904			gc_base);
1905	struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
1906	int status;
1907
1908	status = -EIO;
1909	if (ctx->gc_proc != RPC_GSS_PROC_DATA) {
1910		/* The spec seems a little ambiguous here, but I think that not
1911		 * wrapping context destruction requests makes the most sense.
1912		 */
1913		status = rpcauth_wrap_req_encode(task, xdr);
1914		goto out;
1915	}
1916	switch (gss_cred->gc_service) {
1917	case RPC_GSS_SVC_NONE:
1918		status = rpcauth_wrap_req_encode(task, xdr);
1919		break;
1920	case RPC_GSS_SVC_INTEGRITY:
1921		status = gss_wrap_req_integ(cred, ctx, task, xdr);
1922		break;
1923	case RPC_GSS_SVC_PRIVACY:
1924		status = gss_wrap_req_priv(cred, ctx, task, xdr);
1925		break;
1926	default:
1927		status = -EIO;
1928	}
1929out:
1930	gss_put_ctx(ctx);
1931	return status;
1932}
1933
1934/**
1935 * gss_update_rslack - Possibly update RPC receive buffer size estimates
1936 * @task: rpc_task for incoming RPC Reply being unwrapped
1937 * @cred: controlling rpc_cred for @task
1938 * @before: XDR words needed before each RPC Reply message
1939 * @after: XDR words needed following each RPC Reply message
1940 *
1941 */
1942static void gss_update_rslack(struct rpc_task *task, struct rpc_cred *cred,
1943			      unsigned int before, unsigned int after)
1944{
1945	struct rpc_auth *auth = cred->cr_auth;
1946
1947	if (test_and_clear_bit(RPCAUTH_AUTH_UPDATE_SLACK, &auth->au_flags)) {
1948		auth->au_ralign = auth->au_verfsize + before;
1949		auth->au_rslack = auth->au_verfsize + after;
1950		trace_rpcgss_update_slack(task, auth);
1951	}
1952}
1953
1954static int
1955gss_unwrap_resp_auth(struct rpc_task *task, struct rpc_cred *cred)
1956{
1957	gss_update_rslack(task, cred, 0, 0);
1958	return 0;
1959}
1960
1961/*
1962 * RFC 2203, Section 5.3.2.2
1963 *
1964 *	struct rpc_gss_integ_data {
1965 *		opaque databody_integ<>;
1966 *		opaque checksum<>;
1967 *	};
1968 *
1969 *	struct rpc_gss_data_t {
1970 *		unsigned int seq_num;
1971 *		proc_req_arg_t arg;
1972 *	};
1973 */
1974static noinline_for_stack int
1975gss_unwrap_resp_integ(struct rpc_task *task, struct rpc_cred *cred,
1976		      struct gss_cl_ctx *ctx, struct rpc_rqst *rqstp,
1977		      struct xdr_stream *xdr)
1978{
1979	struct xdr_buf gss_data, *rcv_buf = &rqstp->rq_rcv_buf;
1980	u32 len, offset, seqno, maj_stat;
1981	struct xdr_netobj mic;
1982	int ret;
1983
1984	ret = -EIO;
1985	mic.data = NULL;
1986
1987	/* opaque databody_integ<>; */
1988	if (xdr_stream_decode_u32(xdr, &len))
1989		goto unwrap_failed;
1990	if (len & 3)
1991		goto unwrap_failed;
1992	offset = rcv_buf->len - xdr_stream_remaining(xdr);
1993	if (xdr_stream_decode_u32(xdr, &seqno))
1994		goto unwrap_failed;
1995	if (seqno != rqstp->rq_seqno)
1996		goto bad_seqno;
1997	if (xdr_buf_subsegment(rcv_buf, &gss_data, offset, len))
1998		goto unwrap_failed;
1999
2000	/*
2001	 * The xdr_stream now points to the beginning of the
2002	 * upper layer payload, to be passed below to
2003	 * rpcauth_unwrap_resp_decode(). The checksum, which
2004	 * follows the upper layer payload in @rcv_buf, is
2005	 * located and parsed without updating the xdr_stream.
2006	 */
2007
2008	/* opaque checksum<>; */
2009	offset += len;
2010	if (xdr_decode_word(rcv_buf, offset, &len))
2011		goto unwrap_failed;
2012	offset += sizeof(__be32);
2013	if (offset + len > rcv_buf->len)
2014		goto unwrap_failed;
2015	mic.len = len;
2016	mic.data = kmalloc(len, GFP_NOFS);
2017	if (!mic.data)
2018		goto unwrap_failed;
2019	if (read_bytes_from_xdr_buf(rcv_buf, offset, mic.data, mic.len))
2020		goto unwrap_failed;
2021
2022	maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &gss_data, &mic);
2023	if (maj_stat == GSS_S_CONTEXT_EXPIRED)
2024		clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
2025	if (maj_stat != GSS_S_COMPLETE)
2026		goto bad_mic;
2027
2028	gss_update_rslack(task, cred, 2, 2 + 1 + XDR_QUADLEN(mic.len));
2029	ret = 0;
2030
2031out:
2032	kfree(mic.data);
2033	return ret;
2034
2035unwrap_failed:
2036	trace_rpcgss_unwrap_failed(task);
2037	goto out;
2038bad_seqno:
2039	trace_rpcgss_bad_seqno(task, rqstp->rq_seqno, seqno);
2040	goto out;
2041bad_mic:
2042	trace_rpcgss_verify_mic(task, maj_stat);
2043	goto out;
2044}
2045
2046static noinline_for_stack int
2047gss_unwrap_resp_priv(struct rpc_task *task, struct rpc_cred *cred,
2048		     struct gss_cl_ctx *ctx, struct rpc_rqst *rqstp,
2049		     struct xdr_stream *xdr)
2050{
2051	struct xdr_buf *rcv_buf = &rqstp->rq_rcv_buf;
2052	struct kvec *head = rqstp->rq_rcv_buf.head;
2053	u32 offset, opaque_len, maj_stat;
2054	__be32 *p;
2055
2056	p = xdr_inline_decode(xdr, 2 * sizeof(*p));
2057	if (unlikely(!p))
2058		goto unwrap_failed;
2059	opaque_len = be32_to_cpup(p++);
2060	offset = (u8 *)(p) - (u8 *)head->iov_base;
2061	if (offset + opaque_len > rcv_buf->len)
2062		goto unwrap_failed;
2063
2064	maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset,
2065			      offset + opaque_len, rcv_buf);
2066	if (maj_stat == GSS_S_CONTEXT_EXPIRED)
2067		clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
2068	if (maj_stat != GSS_S_COMPLETE)
2069		goto bad_unwrap;
2070	/* gss_unwrap decrypted the sequence number */
2071	if (be32_to_cpup(p++) != rqstp->rq_seqno)
2072		goto bad_seqno;
2073
2074	/* gss_unwrap redacts the opaque blob from the head iovec.
2075	 * rcv_buf has changed, thus the stream needs to be reset.
2076	 */
2077	xdr_init_decode(xdr, rcv_buf, p, rqstp);
2078
2079	gss_update_rslack(task, cred, 2 + ctx->gc_gss_ctx->align,
2080			  2 + ctx->gc_gss_ctx->slack);
2081
2082	return 0;
2083unwrap_failed:
2084	trace_rpcgss_unwrap_failed(task);
2085	return -EIO;
2086bad_seqno:
2087	trace_rpcgss_bad_seqno(task, rqstp->rq_seqno, be32_to_cpup(--p));
2088	return -EIO;
2089bad_unwrap:
2090	trace_rpcgss_unwrap(task, maj_stat);
2091	return -EIO;
2092}
2093
2094static bool
2095gss_seq_is_newer(u32 new, u32 old)
2096{
2097	return (s32)(new - old) > 0;
2098}
2099
2100static bool
2101gss_xmit_need_reencode(struct rpc_task *task)
2102{
2103	struct rpc_rqst *req = task->tk_rqstp;
2104	struct rpc_cred *cred = req->rq_cred;
2105	struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
2106	u32 win, seq_xmit = 0;
2107	bool ret = true;
2108
2109	if (!ctx)
2110		goto out;
2111
2112	if (gss_seq_is_newer(req->rq_seqno, READ_ONCE(ctx->gc_seq)))
2113		goto out_ctx;
2114
2115	seq_xmit = READ_ONCE(ctx->gc_seq_xmit);
2116	while (gss_seq_is_newer(req->rq_seqno, seq_xmit)) {
2117		u32 tmp = seq_xmit;
2118
2119		seq_xmit = cmpxchg(&ctx->gc_seq_xmit, tmp, req->rq_seqno);
2120		if (seq_xmit == tmp) {
2121			ret = false;
2122			goto out_ctx;
2123		}
2124	}
2125
2126	win = ctx->gc_win;
2127	if (win > 0)
2128		ret = !gss_seq_is_newer(req->rq_seqno, seq_xmit - win);
2129
2130out_ctx:
2131	gss_put_ctx(ctx);
2132out:
2133	trace_rpcgss_need_reencode(task, seq_xmit, ret);
2134	return ret;
2135}
2136
2137static int
2138gss_unwrap_resp(struct rpc_task *task, struct xdr_stream *xdr)
2139{
2140	struct rpc_rqst *rqstp = task->tk_rqstp;
2141	struct rpc_cred *cred = rqstp->rq_cred;
2142	struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
2143			gc_base);
2144	struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
2145	int status = -EIO;
2146
2147	if (ctx->gc_proc != RPC_GSS_PROC_DATA)
2148		goto out_decode;
2149	switch (gss_cred->gc_service) {
2150	case RPC_GSS_SVC_NONE:
2151		status = gss_unwrap_resp_auth(task, cred);
2152		break;
2153	case RPC_GSS_SVC_INTEGRITY:
2154		status = gss_unwrap_resp_integ(task, cred, ctx, rqstp, xdr);
2155		break;
2156	case RPC_GSS_SVC_PRIVACY:
2157		status = gss_unwrap_resp_priv(task, cred, ctx, rqstp, xdr);
2158		break;
2159	}
2160	if (status)
2161		goto out;
2162
2163out_decode:
2164	status = rpcauth_unwrap_resp_decode(task, xdr);
2165out:
2166	gss_put_ctx(ctx);
2167	return status;
2168}
2169
2170static const struct rpc_authops authgss_ops = {
2171	.owner		= THIS_MODULE,
2172	.au_flavor	= RPC_AUTH_GSS,
2173	.au_name	= "RPCSEC_GSS",
2174	.create		= gss_create,
2175	.destroy	= gss_destroy,
2176	.hash_cred	= gss_hash_cred,
2177	.lookup_cred	= gss_lookup_cred,
2178	.crcreate	= gss_create_cred,
2179	.info2flavor	= gss_mech_info2flavor,
2180	.flavor2info	= gss_mech_flavor2info,
2181};
2182
2183static const struct rpc_credops gss_credops = {
2184	.cr_name		= "AUTH_GSS",
2185	.crdestroy		= gss_destroy_cred,
2186	.cr_init		= gss_cred_init,
2187	.crmatch		= gss_match,
2188	.crmarshal		= gss_marshal,
2189	.crrefresh		= gss_refresh,
2190	.crvalidate		= gss_validate,
2191	.crwrap_req		= gss_wrap_req,
2192	.crunwrap_resp		= gss_unwrap_resp,
2193	.crkey_timeout		= gss_key_timeout,
2194	.crstringify_acceptor	= gss_stringify_acceptor,
2195	.crneed_reencode	= gss_xmit_need_reencode,
2196};
2197
2198static const struct rpc_credops gss_nullops = {
2199	.cr_name		= "AUTH_GSS",
2200	.crdestroy		= gss_destroy_nullcred,
2201	.crmatch		= gss_match,
2202	.crmarshal		= gss_marshal,
2203	.crrefresh		= gss_refresh_null,
2204	.crvalidate		= gss_validate,
2205	.crwrap_req		= gss_wrap_req,
2206	.crunwrap_resp		= gss_unwrap_resp,
2207	.crstringify_acceptor	= gss_stringify_acceptor,
2208};
2209
2210static const struct rpc_pipe_ops gss_upcall_ops_v0 = {
2211	.upcall		= gss_v0_upcall,
2212	.downcall	= gss_pipe_downcall,
2213	.destroy_msg	= gss_pipe_destroy_msg,
2214	.open_pipe	= gss_pipe_open_v0,
2215	.release_pipe	= gss_pipe_release,
2216};
2217
2218static const struct rpc_pipe_ops gss_upcall_ops_v1 = {
2219	.upcall		= gss_v1_upcall,
2220	.downcall	= gss_pipe_downcall,
2221	.destroy_msg	= gss_pipe_destroy_msg,
2222	.open_pipe	= gss_pipe_open_v1,
2223	.release_pipe	= gss_pipe_release,
2224};
2225
2226static __net_init int rpcsec_gss_init_net(struct net *net)
2227{
2228	return gss_svc_init_net(net);
2229}
2230
2231static __net_exit void rpcsec_gss_exit_net(struct net *net)
2232{
2233	gss_svc_shutdown_net(net);
2234}
2235
2236static struct pernet_operations rpcsec_gss_net_ops = {
2237	.init = rpcsec_gss_init_net,
2238	.exit = rpcsec_gss_exit_net,
2239};
2240
2241/*
2242 * Initialize RPCSEC_GSS module
2243 */
2244static int __init init_rpcsec_gss(void)
2245{
2246	int err = 0;
2247
2248	err = rpcauth_register(&authgss_ops);
2249	if (err)
2250		goto out;
2251	err = gss_svc_init();
2252	if (err)
2253		goto out_unregister;
2254	err = register_pernet_subsys(&rpcsec_gss_net_ops);
2255	if (err)
2256		goto out_svc_exit;
2257	rpc_init_wait_queue(&pipe_version_rpc_waitqueue, "gss pipe version");
2258	return 0;
2259out_svc_exit:
2260	gss_svc_shutdown();
2261out_unregister:
2262	rpcauth_unregister(&authgss_ops);
2263out:
2264	return err;
2265}
2266
2267static void __exit exit_rpcsec_gss(void)
2268{
2269	unregister_pernet_subsys(&rpcsec_gss_net_ops);
2270	gss_svc_shutdown();
2271	rpcauth_unregister(&authgss_ops);
2272	rcu_barrier(); /* Wait for completion of call_rcu()'s */
2273}
2274
2275MODULE_ALIAS("rpc-auth-6");
2276MODULE_LICENSE("GPL");
2277module_param_named(expired_cred_retry_delay,
2278		   gss_expired_cred_retry_delay,
2279		   uint, 0644);
2280MODULE_PARM_DESC(expired_cred_retry_delay, "Timeout (in seconds) until "
2281		"the RPC engine retries an expired credential");
2282
2283module_param_named(key_expire_timeo,
2284		   gss_key_expire_timeo,
2285		   uint, 0644);
2286MODULE_PARM_DESC(key_expire_timeo, "Time (in seconds) at the end of a "
2287		"credential keys lifetime where the NFS layer cleans up "
2288		"prior to key expiration");
2289
2290module_init(init_rpcsec_gss)
2291module_exit(exit_rpcsec_gss)