1// SPDX-License-Identifier: BSD-3-Clause
   2/*
   3 * linux/net/sunrpc/auth_gss/auth_gss.c
   4 *
   5 * RPCSEC_GSS client authentication.
   6 *
   7 *  Copyright (c) 2000 The Regents of the University of Michigan.
   8 *  All rights reserved.
   9 *
  10 *  Dug Song       <dugsong@monkey.org>
  11 *  Andy Adamson   <andros@umich.edu>
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  12 */
  13
 
  14#include <linux/module.h>
  15#include <linux/init.h>
  16#include <linux/types.h>
  17#include <linux/slab.h>
  18#include <linux/sched.h>
  19#include <linux/pagemap.h>
  20#include <linux/sunrpc/clnt.h>
  21#include <linux/sunrpc/auth.h>
  22#include <linux/sunrpc/auth_gss.h>
  23#include <linux/sunrpc/gss_krb5.h>
  24#include <linux/sunrpc/svcauth_gss.h>
  25#include <linux/sunrpc/gss_err.h>
  26#include <linux/workqueue.h>
  27#include <linux/sunrpc/rpc_pipe_fs.h>
  28#include <linux/sunrpc/gss_api.h>
  29#include <linux/uaccess.h>
  30#include <linux/hashtable.h>
  31
  32#include "auth_gss_internal.h"
  33#include "../netns.h"
  34
  35#include <trace/events/rpcgss.h>
  36
  37static const struct rpc_authops authgss_ops;
  38
  39static const struct rpc_credops gss_credops;
  40static const struct rpc_credops gss_nullops;
  41
  42#define GSS_RETRY_EXPIRED 5
  43static unsigned int gss_expired_cred_retry_delay = GSS_RETRY_EXPIRED;
  44
  45#define GSS_KEY_EXPIRE_TIMEO 240
  46static unsigned int gss_key_expire_timeo = GSS_KEY_EXPIRE_TIMEO;
  47
  48#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
  49# define RPCDBG_FACILITY	RPCDBG_AUTH
  50#endif
  51
  52#define GSS_CRED_SLACK		(RPC_MAX_AUTH_SIZE * 2)
  53/* length of a krb5 verifier (48), plus data added before arguments when
  54 * using integrity (two 4-byte integers): */
  55#define GSS_VERF_SLACK		100
  56
  57static DEFINE_HASHTABLE(gss_auth_hash_table, 4);
  58static DEFINE_SPINLOCK(gss_auth_hash_lock);
  59
  60struct gss_pipe {
  61	struct rpc_pipe_dir_object pdo;
  62	struct rpc_pipe *pipe;
  63	struct rpc_clnt *clnt;
  64	const char *name;
  65	struct kref kref;
  66};
  67
  68struct gss_auth {
  69	struct kref kref;
  70	struct hlist_node hash;
  71	struct rpc_auth rpc_auth;
  72	struct gss_api_mech *mech;
  73	enum rpc_gss_svc service;
  74	struct rpc_clnt *client;
  75	struct net	*net;
  76	netns_tracker	ns_tracker;
  77	/*
  78	 * There are two upcall pipes; dentry[1], named "gssd", is used
  79	 * for the new text-based upcall; dentry[0] is named after the
  80	 * mechanism (for example, "krb5") and exists for
  81	 * backwards-compatibility with older gssd's.
  82	 */
  83	struct gss_pipe *gss_pipe[2];
  84	const char *target_name;
  85};
  86
  87/* pipe_version >= 0 if and only if someone has a pipe open. */
 
 
  88static DEFINE_SPINLOCK(pipe_version_lock);
  89static struct rpc_wait_queue pipe_version_rpc_waitqueue;
  90static DECLARE_WAIT_QUEUE_HEAD(pipe_version_waitqueue);
  91static void gss_put_auth(struct gss_auth *gss_auth);
  92
  93static void gss_free_ctx(struct gss_cl_ctx *);
  94static const struct rpc_pipe_ops gss_upcall_ops_v0;
  95static const struct rpc_pipe_ops gss_upcall_ops_v1;
  96
  97static inline struct gss_cl_ctx *
  98gss_get_ctx(struct gss_cl_ctx *ctx)
  99{
 100	refcount_inc(&ctx->count);
 101	return ctx;
 102}
 103
 104static inline void
 105gss_put_ctx(struct gss_cl_ctx *ctx)
 106{
 107	if (refcount_dec_and_test(&ctx->count))
 108		gss_free_ctx(ctx);
 109}
 110
 111/* gss_cred_set_ctx:
 112 * called by gss_upcall_callback and gss_create_upcall in order
 113 * to set the gss context. The actual exchange of an old context
 114 * and a new one is protected by the pipe->lock.
 115 */
 116static void
 117gss_cred_set_ctx(struct rpc_cred *cred, struct gss_cl_ctx *ctx)
 118{
 119	struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
 120
 121	if (!test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags))
 122		return;
 123	gss_get_ctx(ctx);
 124	rcu_assign_pointer(gss_cred->gc_ctx, ctx);
 125	set_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
 126	smp_mb__before_atomic();
 127	clear_bit(RPCAUTH_CRED_NEW, &cred->cr_flags);
 128}
 129
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 130static struct gss_cl_ctx *
 131gss_cred_get_ctx(struct rpc_cred *cred)
 132{
 133	struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
 134	struct gss_cl_ctx *ctx = NULL;
 135
 136	rcu_read_lock();
 137	ctx = rcu_dereference(gss_cred->gc_ctx);
 138	if (ctx)
 139		gss_get_ctx(ctx);
 140	rcu_read_unlock();
 141	return ctx;
 142}
 143
 144static struct gss_cl_ctx *
 145gss_alloc_context(void)
 146{
 147	struct gss_cl_ctx *ctx;
 148
 149	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
 150	if (ctx != NULL) {
 151		ctx->gc_proc = RPC_GSS_PROC_DATA;
 152		ctx->gc_seq = 1;	/* NetApp 6.4R1 doesn't accept seq. no. 0 */
 153		spin_lock_init(&ctx->gc_seq_lock);
 154		refcount_set(&ctx->count,1);
 155	}
 156	return ctx;
 157}
 158
 159#define GSSD_MIN_TIMEOUT (60 * 60)
 160static const void *
 161gss_fill_context(const void *p, const void *end, struct gss_cl_ctx *ctx, struct gss_api_mech *gm)
 162{
 163	const void *q;
 164	unsigned int seclen;
 165	unsigned int timeout;
 166	unsigned long now = jiffies;
 167	u32 window_size;
 168	int ret;
 169
 170	/* First unsigned int gives the remaining lifetime in seconds of the
 171	 * credential - e.g. the remaining TGT lifetime for Kerberos or
 172	 * the -t value passed to GSSD.
 173	 */
 174	p = simple_get_bytes(p, end, &timeout, sizeof(timeout));
 175	if (IS_ERR(p))
 176		goto err;
 177	if (timeout == 0)
 178		timeout = GSSD_MIN_TIMEOUT;
 179	ctx->gc_expiry = now + ((unsigned long)timeout * HZ);
 180	/* Sequence number window. Determines the maximum number of
 181	 * simultaneous requests
 182	 */
 183	p = simple_get_bytes(p, end, &window_size, sizeof(window_size));
 184	if (IS_ERR(p))
 185		goto err;
 186	ctx->gc_win = window_size;
 187	/* gssd signals an error by passing ctx->gc_win = 0: */
 188	if (ctx->gc_win == 0) {
 189		/*
 190		 * in which case, p points to an error code. Anything other
 191		 * than -EKEYEXPIRED gets converted to -EACCES.
 192		 */
 193		p = simple_get_bytes(p, end, &ret, sizeof(ret));
 194		if (!IS_ERR(p))
 195			p = (ret == -EKEYEXPIRED) ? ERR_PTR(-EKEYEXPIRED) :
 196						    ERR_PTR(-EACCES);
 197		goto err;
 198	}
 199	/* copy the opaque wire context */
 200	p = simple_get_netobj(p, end, &ctx->gc_wire_ctx);
 201	if (IS_ERR(p))
 202		goto err;
 203	/* import the opaque security context */
 204	p  = simple_get_bytes(p, end, &seclen, sizeof(seclen));
 205	if (IS_ERR(p))
 206		goto err;
 207	q = (const void *)((const char *)p + seclen);
 208	if (unlikely(q > end || q < p)) {
 209		p = ERR_PTR(-EFAULT);
 210		goto err;
 211	}
 212	ret = gss_import_sec_context(p, seclen, gm, &ctx->gc_gss_ctx, NULL, GFP_KERNEL);
 213	if (ret < 0) {
 214		trace_rpcgss_import_ctx(ret);
 215		p = ERR_PTR(ret);
 216		goto err;
 217	}
 218
 219	/* is there any trailing data? */
 220	if (q == end) {
 221		p = q;
 222		goto done;
 223	}
 224
 225	/* pull in acceptor name (if there is one) */
 226	p = simple_get_netobj(q, end, &ctx->gc_acceptor);
 227	if (IS_ERR(p))
 228		goto err;
 229done:
 230	trace_rpcgss_context(window_size, ctx->gc_expiry, now, timeout,
 231			     ctx->gc_acceptor.len, ctx->gc_acceptor.data);
 232err:
 
 233	return p;
 234}
 235
 236/* XXX: Need some documentation about why UPCALL_BUF_LEN is so small.
 237 *	Is user space expecting no more than UPCALL_BUF_LEN bytes?
 238 *	Note that there are now _two_ NI_MAXHOST sized data items
 239 *	being passed in this string.
 240 */
 241#define UPCALL_BUF_LEN	256
 242
 243struct gss_upcall_msg {
 244	refcount_t count;
 245	kuid_t	uid;
 246	const char *service_name;
 247	struct rpc_pipe_msg msg;
 248	struct list_head list;
 249	struct gss_auth *auth;
 250	struct rpc_pipe *pipe;
 251	struct rpc_wait_queue rpc_waitqueue;
 252	wait_queue_head_t waitqueue;
 253	struct gss_cl_ctx *ctx;
 254	char databuf[UPCALL_BUF_LEN];
 255};
 256
 257static int get_pipe_version(struct net *net)
 258{
 259	struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 260	int ret;
 261
 262	spin_lock(&pipe_version_lock);
 263	if (sn->pipe_version >= 0) {
 264		atomic_inc(&sn->pipe_users);
 265		ret = sn->pipe_version;
 266	} else
 267		ret = -EAGAIN;
 268	spin_unlock(&pipe_version_lock);
 269	return ret;
 270}
 271
 272static void put_pipe_version(struct net *net)
 273{
 274	struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 275
 276	if (atomic_dec_and_lock(&sn->pipe_users, &pipe_version_lock)) {
 277		sn->pipe_version = -1;
 278		spin_unlock(&pipe_version_lock);
 279	}
 280}
 281
 282static void
 283gss_release_msg(struct gss_upcall_msg *gss_msg)
 284{
 285	struct net *net = gss_msg->auth->net;
 286	if (!refcount_dec_and_test(&gss_msg->count))
 287		return;
 288	put_pipe_version(net);
 289	BUG_ON(!list_empty(&gss_msg->list));
 290	if (gss_msg->ctx != NULL)
 291		gss_put_ctx(gss_msg->ctx);
 292	rpc_destroy_wait_queue(&gss_msg->rpc_waitqueue);
 293	gss_put_auth(gss_msg->auth);
 294	kfree_const(gss_msg->service_name);
 295	kfree(gss_msg);
 296}
 297
 298static struct gss_upcall_msg *
 299__gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid, const struct gss_auth *auth)
 300{
 301	struct gss_upcall_msg *pos;
 302	list_for_each_entry(pos, &pipe->in_downcall, list) {
 303		if (!uid_eq(pos->uid, uid))
 304			continue;
 305		if (pos->auth->service != auth->service)
 306			continue;
 307		refcount_inc(&pos->count);
 
 308		return pos;
 309	}
 
 310	return NULL;
 311}
 312
 313/* Try to add an upcall to the pipefs queue.
 314 * If an upcall owned by our uid already exists, then we return a reference
 315 * to that upcall instead of adding the new upcall.
 316 */
 317static inline struct gss_upcall_msg *
 318gss_add_msg(struct gss_upcall_msg *gss_msg)
 319{
 320	struct rpc_pipe *pipe = gss_msg->pipe;
 
 321	struct gss_upcall_msg *old;
 322
 323	spin_lock(&pipe->lock);
 324	old = __gss_find_upcall(pipe, gss_msg->uid, gss_msg->auth);
 325	if (old == NULL) {
 326		refcount_inc(&gss_msg->count);
 327		list_add(&gss_msg->list, &pipe->in_downcall);
 328	} else
 329		gss_msg = old;
 330	spin_unlock(&pipe->lock);
 331	return gss_msg;
 332}
 333
 334static void
 335__gss_unhash_msg(struct gss_upcall_msg *gss_msg)
 336{
 337	list_del_init(&gss_msg->list);
 338	rpc_wake_up_status(&gss_msg->rpc_waitqueue, gss_msg->msg.errno);
 339	wake_up_all(&gss_msg->waitqueue);
 340	refcount_dec(&gss_msg->count);
 341}
 342
 343static void
 344gss_unhash_msg(struct gss_upcall_msg *gss_msg)
 345{
 346	struct rpc_pipe *pipe = gss_msg->pipe;
 347
 348	if (list_empty(&gss_msg->list))
 349		return;
 350	spin_lock(&pipe->lock);
 351	if (!list_empty(&gss_msg->list))
 352		__gss_unhash_msg(gss_msg);
 353	spin_unlock(&pipe->lock);
 354}
 355
 356static void
 357gss_handle_downcall_result(struct gss_cred *gss_cred, struct gss_upcall_msg *gss_msg)
 358{
 359	switch (gss_msg->msg.errno) {
 360	case 0:
 361		if (gss_msg->ctx == NULL)
 362			break;
 363		clear_bit(RPCAUTH_CRED_NEGATIVE, &gss_cred->gc_base.cr_flags);
 364		gss_cred_set_ctx(&gss_cred->gc_base, gss_msg->ctx);
 365		break;
 366	case -EKEYEXPIRED:
 367		set_bit(RPCAUTH_CRED_NEGATIVE, &gss_cred->gc_base.cr_flags);
 368	}
 369	gss_cred->gc_upcall_timestamp = jiffies;
 370	gss_cred->gc_upcall = NULL;
 371	rpc_wake_up_status(&gss_msg->rpc_waitqueue, gss_msg->msg.errno);
 372}
 373
 374static void
 375gss_upcall_callback(struct rpc_task *task)
 376{
 377	struct gss_cred *gss_cred = container_of(task->tk_rqstp->rq_cred,
 378			struct gss_cred, gc_base);
 379	struct gss_upcall_msg *gss_msg = gss_cred->gc_upcall;
 380	struct rpc_pipe *pipe = gss_msg->pipe;
 381
 382	spin_lock(&pipe->lock);
 383	gss_handle_downcall_result(gss_cred, gss_msg);
 384	spin_unlock(&pipe->lock);
 385	task->tk_status = gss_msg->msg.errno;
 386	gss_release_msg(gss_msg);
 387}
 388
 389static void gss_encode_v0_msg(struct gss_upcall_msg *gss_msg,
 390			      const struct cred *cred)
 391{
 392	struct user_namespace *userns = cred->user_ns;
 393
 394	uid_t uid = from_kuid_munged(userns, gss_msg->uid);
 395	memcpy(gss_msg->databuf, &uid, sizeof(uid));
 396	gss_msg->msg.data = gss_msg->databuf;
 397	gss_msg->msg.len = sizeof(uid);
 398
 399	BUILD_BUG_ON(sizeof(uid) > sizeof(gss_msg->databuf));
 400}
 401
 402static ssize_t
 403gss_v0_upcall(struct file *file, struct rpc_pipe_msg *msg,
 404		char __user *buf, size_t buflen)
 405{
 406	struct gss_upcall_msg *gss_msg = container_of(msg,
 407						      struct gss_upcall_msg,
 408						      msg);
 409	if (msg->copied == 0)
 410		gss_encode_v0_msg(gss_msg, file->f_cred);
 411	return rpc_pipe_generic_upcall(file, msg, buf, buflen);
 412}
 413
 414static int gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
 415				const char *service_name,
 416				const char *target_name,
 417				const struct cred *cred)
 418{
 419	struct user_namespace *userns = cred->user_ns;
 420	struct gss_api_mech *mech = gss_msg->auth->mech;
 421	char *p = gss_msg->databuf;
 422	size_t buflen = sizeof(gss_msg->databuf);
 423	int len;
 424
 425	len = scnprintf(p, buflen, "mech=%s uid=%d", mech->gm_name,
 426			from_kuid_munged(userns, gss_msg->uid));
 427	buflen -= len;
 428	p += len;
 429	gss_msg->msg.len = len;
 430
 431	/*
 432	 * target= is a full service principal that names the remote
 433	 * identity that we are authenticating to.
 434	 */
 435	if (target_name) {
 436		len = scnprintf(p, buflen, " target=%s", target_name);
 437		buflen -= len;
 438		p += len;
 439		gss_msg->msg.len += len;
 440	}
 441
 442	/*
 443	 * gssd uses service= and srchost= to select a matching key from
 444	 * the system's keytab to use as the source principal.
 445	 *
 446	 * service= is the service name part of the source principal,
 447	 * or "*" (meaning choose any).
 448	 *
 449	 * srchost= is the hostname part of the source principal. When
 450	 * not provided, gssd uses the local hostname.
 451	 */
 452	if (service_name) {
 453		char *c = strchr(service_name, '@');
 454
 455		if (!c)
 456			len = scnprintf(p, buflen, " service=%s",
 457					service_name);
 458		else
 459			len = scnprintf(p, buflen,
 460					" service=%.*s srchost=%s",
 461					(int)(c - service_name),
 462					service_name, c + 1);
 463		buflen -= len;
 464		p += len;
 465		gss_msg->msg.len += len;
 466	}
 467
 468	if (mech->gm_upcall_enctypes) {
 469		len = scnprintf(p, buflen, " enctypes=%s",
 470				mech->gm_upcall_enctypes);
 471		buflen -= len;
 472		p += len;
 473		gss_msg->msg.len += len;
 474	}
 475	trace_rpcgss_upcall_msg(gss_msg->databuf);
 476	len = scnprintf(p, buflen, "\n");
 477	if (len == 0)
 478		goto out_overflow;
 479	gss_msg->msg.len += len;
 
 480	gss_msg->msg.data = gss_msg->databuf;
 481	return 0;
 482out_overflow:
 483	WARN_ON_ONCE(1);
 484	return -ENOMEM;
 485}
 486
 487static ssize_t
 488gss_v1_upcall(struct file *file, struct rpc_pipe_msg *msg,
 489		char __user *buf, size_t buflen)
 490{
 491	struct gss_upcall_msg *gss_msg = container_of(msg,
 492						      struct gss_upcall_msg,
 493						      msg);
 494	int err;
 495	if (msg->copied == 0) {
 496		err = gss_encode_v1_msg(gss_msg,
 497					gss_msg->service_name,
 498					gss_msg->auth->target_name,
 499					file->f_cred);
 500		if (err)
 501			return err;
 502	}
 503	return rpc_pipe_generic_upcall(file, msg, buf, buflen);
 504}
 505
 506static struct gss_upcall_msg *
 507gss_alloc_msg(struct gss_auth *gss_auth,
 508		kuid_t uid, const char *service_name)
 509{
 510	struct gss_upcall_msg *gss_msg;
 511	int vers;
 512	int err = -ENOMEM;
 513
 514	gss_msg = kzalloc(sizeof(*gss_msg), GFP_KERNEL);
 515	if (gss_msg == NULL)
 516		goto err;
 517	vers = get_pipe_version(gss_auth->net);
 518	err = vers;
 519	if (err < 0)
 520		goto err_free_msg;
 521	gss_msg->pipe = gss_auth->gss_pipe[vers]->pipe;
 
 522	INIT_LIST_HEAD(&gss_msg->list);
 523	rpc_init_wait_queue(&gss_msg->rpc_waitqueue, "RPCSEC_GSS upcall waitq");
 524	init_waitqueue_head(&gss_msg->waitqueue);
 525	refcount_set(&gss_msg->count, 1);
 526	gss_msg->uid = uid;
 527	gss_msg->auth = gss_auth;
 528	kref_get(&gss_auth->kref);
 529	if (service_name) {
 530		gss_msg->service_name = kstrdup_const(service_name, GFP_KERNEL);
 531		if (!gss_msg->service_name) {
 532			err = -ENOMEM;
 533			goto err_put_pipe_version;
 534		}
 535	}
 536	return gss_msg;
 537err_put_pipe_version:
 538	put_pipe_version(gss_auth->net);
 539err_free_msg:
 540	kfree(gss_msg);
 541err:
 542	return ERR_PTR(err);
 543}
 544
 545static struct gss_upcall_msg *
 546gss_setup_upcall(struct gss_auth *gss_auth, struct rpc_cred *cred)
 547{
 548	struct gss_cred *gss_cred = container_of(cred,
 549			struct gss_cred, gc_base);
 550	struct gss_upcall_msg *gss_new, *gss_msg;
 551	kuid_t uid = cred->cr_cred->fsuid;
 552
 553	gss_new = gss_alloc_msg(gss_auth, uid, gss_cred->gc_principal);
 554	if (IS_ERR(gss_new))
 555		return gss_new;
 556	gss_msg = gss_add_msg(gss_new);
 557	if (gss_msg == gss_new) {
 558		int res;
 559		refcount_inc(&gss_msg->count);
 560		res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg);
 561		if (res) {
 562			gss_unhash_msg(gss_new);
 563			refcount_dec(&gss_msg->count);
 564			gss_release_msg(gss_new);
 565			gss_msg = ERR_PTR(res);
 566		}
 567	} else
 568		gss_release_msg(gss_new);
 569	return gss_msg;
 570}
 571
 572static void warn_gssd(void)
 573{
 574	dprintk("AUTH_GSS upcall failed. Please check user daemon is running.\n");
 
 
 
 
 
 
 
 575}
 576
 577static inline int
 578gss_refresh_upcall(struct rpc_task *task)
 579{
 580	struct rpc_cred *cred = task->tk_rqstp->rq_cred;
 581	struct gss_auth *gss_auth = container_of(cred->cr_auth,
 582			struct gss_auth, rpc_auth);
 583	struct gss_cred *gss_cred = container_of(cred,
 584			struct gss_cred, gc_base);
 585	struct gss_upcall_msg *gss_msg;
 586	struct rpc_pipe *pipe;
 587	int err = 0;
 588
 589	gss_msg = gss_setup_upcall(gss_auth, cred);
 
 
 590	if (PTR_ERR(gss_msg) == -EAGAIN) {
 591		/* XXX: warning on the first, under the assumption we
 592		 * shouldn't normally hit this case on a refresh. */
 593		warn_gssd();
 594		rpc_sleep_on_timeout(&pipe_version_rpc_waitqueue,
 595				task, NULL, jiffies + (15 * HZ));
 596		err = -EAGAIN;
 597		goto out;
 598	}
 599	if (IS_ERR(gss_msg)) {
 600		err = PTR_ERR(gss_msg);
 601		goto out;
 602	}
 603	pipe = gss_msg->pipe;
 604	spin_lock(&pipe->lock);
 605	if (gss_cred->gc_upcall != NULL)
 606		rpc_sleep_on(&gss_cred->gc_upcall->rpc_waitqueue, task, NULL);
 607	else if (gss_msg->ctx == NULL && gss_msg->msg.errno >= 0) {
 
 608		gss_cred->gc_upcall = gss_msg;
 609		/* gss_upcall_callback will release the reference to gss_upcall_msg */
 610		refcount_inc(&gss_msg->count);
 611		rpc_sleep_on(&gss_msg->rpc_waitqueue, task, gss_upcall_callback);
 612	} else {
 613		gss_handle_downcall_result(gss_cred, gss_msg);
 614		err = gss_msg->msg.errno;
 615	}
 616	spin_unlock(&pipe->lock);
 617	gss_release_msg(gss_msg);
 618out:
 619	trace_rpcgss_upcall_result(from_kuid(&init_user_ns,
 620					     cred->cr_cred->fsuid), err);
 621	return err;
 622}
 623
 624static inline int
 625gss_create_upcall(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
 626{
 627	struct net *net = gss_auth->net;
 628	struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 629	struct rpc_pipe *pipe;
 630	struct rpc_cred *cred = &gss_cred->gc_base;
 631	struct gss_upcall_msg *gss_msg;
 632	DEFINE_WAIT(wait);
 633	int err;
 634
 
 635retry:
 636	err = 0;
 637	/* if gssd is down, just skip upcalling altogether */
 638	if (!gssd_running(net)) {
 639		warn_gssd();
 640		err = -EACCES;
 641		goto out;
 642	}
 643	gss_msg = gss_setup_upcall(gss_auth, cred);
 644	if (PTR_ERR(gss_msg) == -EAGAIN) {
 645		err = wait_event_interruptible_timeout(pipe_version_waitqueue,
 646				sn->pipe_version >= 0, 15 * HZ);
 647		if (sn->pipe_version < 0) {
 648			warn_gssd();
 649			err = -EACCES;
 650		}
 651		if (err < 0)
 652			goto out;
 653		goto retry;
 654	}
 655	if (IS_ERR(gss_msg)) {
 656		err = PTR_ERR(gss_msg);
 657		goto out;
 658	}
 659	pipe = gss_msg->pipe;
 660	for (;;) {
 661		prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_KILLABLE);
 662		spin_lock(&pipe->lock);
 663		if (gss_msg->ctx != NULL || gss_msg->msg.errno < 0) {
 664			break;
 665		}
 666		spin_unlock(&pipe->lock);
 667		if (fatal_signal_pending(current)) {
 668			err = -ERESTARTSYS;
 669			goto out_intr;
 670		}
 671		schedule();
 672	}
 673	if (gss_msg->ctx) {
 674		trace_rpcgss_ctx_init(gss_cred);
 675		gss_cred_set_ctx(cred, gss_msg->ctx);
 676	} else {
 677		err = gss_msg->msg.errno;
 678	}
 679	spin_unlock(&pipe->lock);
 680out_intr:
 681	finish_wait(&gss_msg->waitqueue, &wait);
 682	gss_release_msg(gss_msg);
 683out:
 684	trace_rpcgss_upcall_result(from_kuid(&init_user_ns,
 685					     cred->cr_cred->fsuid), err);
 686	return err;
 687}
 688
 689static struct gss_upcall_msg *
 690gss_find_downcall(struct rpc_pipe *pipe, kuid_t uid)
 
 691{
 692	struct gss_upcall_msg *pos;
 693	list_for_each_entry(pos, &pipe->in_downcall, list) {
 694		if (!uid_eq(pos->uid, uid))
 695			continue;
 696		if (!rpc_msg_is_inflight(&pos->msg))
 697			continue;
 698		refcount_inc(&pos->count);
 699		return pos;
 700	}
 701	return NULL;
 
 
 
 
 702}
 703
 704#define MSG_BUF_MAXSIZE 1024
 705
 706static ssize_t
 707gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
 708{
 709	const void *p, *end;
 710	void *buf;
 711	struct gss_upcall_msg *gss_msg;
 712	struct rpc_pipe *pipe = RPC_I(file_inode(filp))->pipe;
 713	struct gss_cl_ctx *ctx;
 714	uid_t id;
 715	kuid_t uid;
 716	ssize_t err = -EFBIG;
 717
 718	if (mlen > MSG_BUF_MAXSIZE)
 719		goto out;
 720	err = -ENOMEM;
 721	buf = kmalloc(mlen, GFP_KERNEL);
 722	if (!buf)
 723		goto out;
 724
 725	err = -EFAULT;
 726	if (copy_from_user(buf, src, mlen))
 727		goto err;
 728
 729	end = (const void *)((char *)buf + mlen);
 730	p = simple_get_bytes(buf, end, &id, sizeof(id));
 731	if (IS_ERR(p)) {
 732		err = PTR_ERR(p);
 733		goto err;
 734	}
 735
 736	uid = make_kuid(current_user_ns(), id);
 737	if (!uid_valid(uid)) {
 738		err = -EINVAL;
 739		goto err;
 740	}
 741
 742	err = -ENOMEM;
 743	ctx = gss_alloc_context();
 744	if (ctx == NULL)
 745		goto err;
 746
 747	err = -ENOENT;
 748	/* Find a matching upcall */
 749	spin_lock(&pipe->lock);
 750	gss_msg = gss_find_downcall(pipe, uid);
 751	if (gss_msg == NULL) {
 752		spin_unlock(&pipe->lock);
 753		goto err_put_ctx;
 754	}
 755	list_del_init(&gss_msg->list);
 756	spin_unlock(&pipe->lock);
 757
 758	p = gss_fill_context(p, end, ctx, gss_msg->auth->mech);
 759	if (IS_ERR(p)) {
 760		err = PTR_ERR(p);
 761		switch (err) {
 762		case -EACCES:
 763		case -EKEYEXPIRED:
 764			gss_msg->msg.errno = err;
 765			err = mlen;
 766			break;
 767		case -EFAULT:
 768		case -ENOMEM:
 769		case -EINVAL:
 770		case -ENOSYS:
 771			gss_msg->msg.errno = -EAGAIN;
 772			break;
 773		default:
 774			printk(KERN_CRIT "%s: bad return from "
 775				"gss_fill_context: %zd\n", __func__, err);
 776			gss_msg->msg.errno = -EIO;
 777		}
 778		goto err_release_msg;
 779	}
 780	gss_msg->ctx = gss_get_ctx(ctx);
 781	err = mlen;
 782
 783err_release_msg:
 784	spin_lock(&pipe->lock);
 785	__gss_unhash_msg(gss_msg);
 786	spin_unlock(&pipe->lock);
 787	gss_release_msg(gss_msg);
 788err_put_ctx:
 789	gss_put_ctx(ctx);
 790err:
 791	kfree(buf);
 792out:
 
 793	return err;
 794}
 795
 796static int gss_pipe_open(struct inode *inode, int new_version)
 797{
 798	struct net *net = inode->i_sb->s_fs_info;
 799	struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 800	int ret = 0;
 801
 802	spin_lock(&pipe_version_lock);
 803	if (sn->pipe_version < 0) {
 804		/* First open of any gss pipe determines the version: */
 805		sn->pipe_version = new_version;
 806		rpc_wake_up(&pipe_version_rpc_waitqueue);
 807		wake_up(&pipe_version_waitqueue);
 808	} else if (sn->pipe_version != new_version) {
 809		/* Trying to open a pipe of a different version */
 810		ret = -EBUSY;
 811		goto out;
 812	}
 813	atomic_inc(&sn->pipe_users);
 814out:
 815	spin_unlock(&pipe_version_lock);
 816	return ret;
 817
 818}
 819
 820static int gss_pipe_open_v0(struct inode *inode)
 821{
 822	return gss_pipe_open(inode, 0);
 823}
 824
 825static int gss_pipe_open_v1(struct inode *inode)
 826{
 827	return gss_pipe_open(inode, 1);
 828}
 829
 830static void
 831gss_pipe_release(struct inode *inode)
 832{
 833	struct net *net = inode->i_sb->s_fs_info;
 834	struct rpc_pipe *pipe = RPC_I(inode)->pipe;
 835	struct gss_upcall_msg *gss_msg;
 836
 837restart:
 838	spin_lock(&pipe->lock);
 839	list_for_each_entry(gss_msg, &pipe->in_downcall, list) {
 840
 841		if (!list_empty(&gss_msg->msg.list))
 842			continue;
 843		gss_msg->msg.errno = -EPIPE;
 844		refcount_inc(&gss_msg->count);
 845		__gss_unhash_msg(gss_msg);
 846		spin_unlock(&pipe->lock);
 847		gss_release_msg(gss_msg);
 848		goto restart;
 849	}
 850	spin_unlock(&pipe->lock);
 851
 852	put_pipe_version(net);
 853}
 854
 855static void
 856gss_pipe_destroy_msg(struct rpc_pipe_msg *msg)
 857{
 858	struct gss_upcall_msg *gss_msg = container_of(msg, struct gss_upcall_msg, msg);
 859
 860	if (msg->errno < 0) {
 861		refcount_inc(&gss_msg->count);
 
 
 862		gss_unhash_msg(gss_msg);
 863		if (msg->errno == -ETIMEDOUT)
 864			warn_gssd();
 865		gss_release_msg(gss_msg);
 866	}
 867	gss_release_msg(gss_msg);
 868}
 869
 870static void gss_pipe_dentry_destroy(struct dentry *dir,
 871		struct rpc_pipe_dir_object *pdo)
 872{
 873	struct gss_pipe *gss_pipe = pdo->pdo_data;
 874	struct rpc_pipe *pipe = gss_pipe->pipe;
 875
 876	if (pipe->dentry != NULL) {
 877		rpc_unlink(pipe->dentry);
 878		pipe->dentry = NULL;
 879	}
 880}
 881
 882static int gss_pipe_dentry_create(struct dentry *dir,
 883		struct rpc_pipe_dir_object *pdo)
 884{
 885	struct gss_pipe *p = pdo->pdo_data;
 886	struct dentry *dentry;
 887
 888	dentry = rpc_mkpipe_dentry(dir, p->name, p->clnt, p->pipe);
 889	if (IS_ERR(dentry))
 890		return PTR_ERR(dentry);
 891	p->pipe->dentry = dentry;
 892	return 0;
 893}
 894
 895static const struct rpc_pipe_dir_object_ops gss_pipe_dir_object_ops = {
 896	.create = gss_pipe_dentry_create,
 897	.destroy = gss_pipe_dentry_destroy,
 898};
 899
 900static struct gss_pipe *gss_pipe_alloc(struct rpc_clnt *clnt,
 901		const char *name,
 902		const struct rpc_pipe_ops *upcall_ops)
 903{
 904	struct gss_pipe *p;
 905	int err = -ENOMEM;
 906
 907	p = kmalloc(sizeof(*p), GFP_KERNEL);
 908	if (p == NULL)
 909		goto err;
 910	p->pipe = rpc_mkpipe_data(upcall_ops, RPC_PIPE_WAIT_FOR_OPEN);
 911	if (IS_ERR(p->pipe)) {
 912		err = PTR_ERR(p->pipe);
 913		goto err_free_gss_pipe;
 914	}
 915	p->name = name;
 916	p->clnt = clnt;
 917	kref_init(&p->kref);
 918	rpc_init_pipe_dir_object(&p->pdo,
 919			&gss_pipe_dir_object_ops,
 920			p);
 921	return p;
 922err_free_gss_pipe:
 923	kfree(p);
 924err:
 925	return ERR_PTR(err);
 926}
 927
 928struct gss_alloc_pdo {
 929	struct rpc_clnt *clnt;
 930	const char *name;
 931	const struct rpc_pipe_ops *upcall_ops;
 932};
 933
 934static int gss_pipe_match_pdo(struct rpc_pipe_dir_object *pdo, void *data)
 935{
 936	struct gss_pipe *gss_pipe;
 937	struct gss_alloc_pdo *args = data;
 938
 939	if (pdo->pdo_ops != &gss_pipe_dir_object_ops)
 940		return 0;
 941	gss_pipe = container_of(pdo, struct gss_pipe, pdo);
 942	if (strcmp(gss_pipe->name, args->name) != 0)
 943		return 0;
 944	if (!kref_get_unless_zero(&gss_pipe->kref))
 945		return 0;
 946	return 1;
 947}
 948
 949static struct rpc_pipe_dir_object *gss_pipe_alloc_pdo(void *data)
 950{
 951	struct gss_pipe *gss_pipe;
 952	struct gss_alloc_pdo *args = data;
 953
 954	gss_pipe = gss_pipe_alloc(args->clnt, args->name, args->upcall_ops);
 955	if (!IS_ERR(gss_pipe))
 956		return &gss_pipe->pdo;
 957	return NULL;
 958}
 959
 960static struct gss_pipe *gss_pipe_get(struct rpc_clnt *clnt,
 961		const char *name,
 962		const struct rpc_pipe_ops *upcall_ops)
 963{
 964	struct net *net = rpc_net_ns(clnt);
 965	struct rpc_pipe_dir_object *pdo;
 966	struct gss_alloc_pdo args = {
 967		.clnt = clnt,
 968		.name = name,
 969		.upcall_ops = upcall_ops,
 970	};
 971
 972	pdo = rpc_find_or_alloc_pipe_dir_object(net,
 973			&clnt->cl_pipedir_objects,
 974			gss_pipe_match_pdo,
 975			gss_pipe_alloc_pdo,
 976			&args);
 977	if (pdo != NULL)
 978		return container_of(pdo, struct gss_pipe, pdo);
 979	return ERR_PTR(-ENOMEM);
 980}
 981
 982static void __gss_pipe_free(struct gss_pipe *p)
 983{
 984	struct rpc_clnt *clnt = p->clnt;
 985	struct net *net = rpc_net_ns(clnt);
 986
 987	rpc_remove_pipe_dir_object(net,
 988			&clnt->cl_pipedir_objects,
 989			&p->pdo);
 990	rpc_destroy_pipe_data(p->pipe);
 991	kfree(p);
 992}
 993
 994static void __gss_pipe_release(struct kref *kref)
 995{
 996	struct gss_pipe *p = container_of(kref, struct gss_pipe, kref);
 997
 998	__gss_pipe_free(p);
 999}
1000
1001static void gss_pipe_free(struct gss_pipe *p)
1002{
1003	if (p != NULL)
1004		kref_put(&p->kref, __gss_pipe_release);
1005}
1006
1007/*
1008 * NOTE: we have the opportunity to use different
1009 * parameters based on the input flavor (which must be a pseudoflavor)
1010 */
1011static struct gss_auth *
1012gss_create_new(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
1013{
1014	rpc_authflavor_t flavor = args->pseudoflavor;
1015	struct gss_auth *gss_auth;
1016	struct gss_pipe *gss_pipe;
1017	struct rpc_auth * auth;
1018	int err = -ENOMEM; /* XXX? */
1019
 
 
1020	if (!try_module_get(THIS_MODULE))
1021		return ERR_PTR(err);
1022	if (!(gss_auth = kmalloc(sizeof(*gss_auth), GFP_KERNEL)))
1023		goto out_dec;
1024	INIT_HLIST_NODE(&gss_auth->hash);
1025	gss_auth->target_name = NULL;
1026	if (args->target_name) {
1027		gss_auth->target_name = kstrdup(args->target_name, GFP_KERNEL);
1028		if (gss_auth->target_name == NULL)
1029			goto err_free;
1030	}
1031	gss_auth->client = clnt;
1032	gss_auth->net = get_net_track(rpc_net_ns(clnt), &gss_auth->ns_tracker,
1033				      GFP_KERNEL);
1034	err = -EINVAL;
1035	gss_auth->mech = gss_mech_get_by_pseudoflavor(flavor);
1036	if (!gss_auth->mech)
1037		goto err_put_net;
 
 
 
1038	gss_auth->service = gss_pseudoflavor_to_service(gss_auth->mech, flavor);
1039	if (gss_auth->service == 0)
1040		goto err_put_mech;
1041	if (!gssd_running(gss_auth->net))
1042		goto err_put_mech;
1043	auth = &gss_auth->rpc_auth;
1044	auth->au_cslack = GSS_CRED_SLACK >> 2;
1045	auth->au_rslack = GSS_KRB5_MAX_SLACK_NEEDED >> 2;
1046	auth->au_verfsize = GSS_VERF_SLACK >> 2;
1047	auth->au_ralign = GSS_VERF_SLACK >> 2;
1048	__set_bit(RPCAUTH_AUTH_UPDATE_SLACK, &auth->au_flags);
1049	auth->au_ops = &authgss_ops;
1050	auth->au_flavor = flavor;
1051	if (gss_pseudoflavor_to_datatouch(gss_auth->mech, flavor))
1052		__set_bit(RPCAUTH_AUTH_DATATOUCH, &auth->au_flags);
1053	refcount_set(&auth->au_count, 1);
1054	kref_init(&gss_auth->kref);
1055
1056	err = rpcauth_init_credcache(auth);
1057	if (err)
1058		goto err_put_mech;
1059	/*
1060	 * Note: if we created the old pipe first, then someone who
1061	 * examined the directory at the right moment might conclude
1062	 * that we supported only the old pipe.  So we instead create
1063	 * the new pipe first.
1064	 */
1065	gss_pipe = gss_pipe_get(clnt, "gssd", &gss_upcall_ops_v1);
1066	if (IS_ERR(gss_pipe)) {
1067		err = PTR_ERR(gss_pipe);
1068		goto err_destroy_credcache;
1069	}
1070	gss_auth->gss_pipe[1] = gss_pipe;
1071
1072	gss_pipe = gss_pipe_get(clnt, gss_auth->mech->gm_name,
1073			&gss_upcall_ops_v0);
1074	if (IS_ERR(gss_pipe)) {
1075		err = PTR_ERR(gss_pipe);
1076		goto err_destroy_pipe_1;
1077	}
1078	gss_auth->gss_pipe[0] = gss_pipe;
1079
1080	return gss_auth;
1081err_destroy_pipe_1:
1082	gss_pipe_free(gss_auth->gss_pipe[1]);
1083err_destroy_credcache:
1084	rpcauth_destroy_credcache(auth);
 
 
 
 
 
 
1085err_put_mech:
1086	gss_mech_put(gss_auth->mech);
1087err_put_net:
1088	put_net_track(gss_auth->net, &gss_auth->ns_tracker);
1089err_free:
1090	kfree(gss_auth->target_name);
1091	kfree(gss_auth);
1092out_dec:
1093	module_put(THIS_MODULE);
1094	trace_rpcgss_createauth(flavor, err);
1095	return ERR_PTR(err);
1096}
1097
1098static void
1099gss_free(struct gss_auth *gss_auth)
1100{
1101	gss_pipe_free(gss_auth->gss_pipe[0]);
1102	gss_pipe_free(gss_auth->gss_pipe[1]);
1103	gss_mech_put(gss_auth->mech);
1104	put_net_track(gss_auth->net, &gss_auth->ns_tracker);
1105	kfree(gss_auth->target_name);
1106
1107	kfree(gss_auth);
1108	module_put(THIS_MODULE);
1109}
1110
1111static void
1112gss_free_callback(struct kref *kref)
1113{
1114	struct gss_auth *gss_auth = container_of(kref, struct gss_auth, kref);
1115
1116	gss_free(gss_auth);
1117}
1118
1119static void
1120gss_put_auth(struct gss_auth *gss_auth)
1121{
1122	kref_put(&gss_auth->kref, gss_free_callback);
1123}
1124
1125static void
1126gss_destroy(struct rpc_auth *auth)
1127{
1128	struct gss_auth *gss_auth = container_of(auth,
1129			struct gss_auth, rpc_auth);
1130
1131	if (hash_hashed(&gss_auth->hash)) {
1132		spin_lock(&gss_auth_hash_lock);
1133		hash_del(&gss_auth->hash);
1134		spin_unlock(&gss_auth_hash_lock);
1135	}
1136
1137	gss_pipe_free(gss_auth->gss_pipe[0]);
1138	gss_auth->gss_pipe[0] = NULL;
1139	gss_pipe_free(gss_auth->gss_pipe[1]);
1140	gss_auth->gss_pipe[1] = NULL;
1141	rpcauth_destroy_credcache(auth);
1142
1143	gss_put_auth(gss_auth);
1144}
1145
1146/*
1147 * Auths may be shared between rpc clients that were cloned from a
1148 * common client with the same xprt, if they also share the flavor and
1149 * target_name.
1150 *
1151 * The auth is looked up from the oldest parent sharing the same
1152 * cl_xprt, and the auth itself references only that common parent
1153 * (which is guaranteed to last as long as any of its descendants).
1154 */
1155static struct gss_auth *
1156gss_auth_find_or_add_hashed(const struct rpc_auth_create_args *args,
1157		struct rpc_clnt *clnt,
1158		struct gss_auth *new)
1159{
1160	struct gss_auth *gss_auth;
1161	unsigned long hashval = (unsigned long)clnt;
1162
1163	spin_lock(&gss_auth_hash_lock);
1164	hash_for_each_possible(gss_auth_hash_table,
1165			gss_auth,
1166			hash,
1167			hashval) {
1168		if (gss_auth->client != clnt)
1169			continue;
1170		if (gss_auth->rpc_auth.au_flavor != args->pseudoflavor)
1171			continue;
1172		if (gss_auth->target_name != args->target_name) {
1173			if (gss_auth->target_name == NULL)
1174				continue;
1175			if (args->target_name == NULL)
1176				continue;
1177			if (strcmp(gss_auth->target_name, args->target_name))
1178				continue;
1179		}
1180		if (!refcount_inc_not_zero(&gss_auth->rpc_auth.au_count))
1181			continue;
1182		goto out;
1183	}
1184	if (new)
1185		hash_add(gss_auth_hash_table, &new->hash, hashval);
1186	gss_auth = new;
1187out:
1188	spin_unlock(&gss_auth_hash_lock);
1189	return gss_auth;
1190}
1191
1192static struct gss_auth *
1193gss_create_hashed(const struct rpc_auth_create_args *args,
1194		  struct rpc_clnt *clnt)
1195{
1196	struct gss_auth *gss_auth;
1197	struct gss_auth *new;
1198
1199	gss_auth = gss_auth_find_or_add_hashed(args, clnt, NULL);
1200	if (gss_auth != NULL)
1201		goto out;
1202	new = gss_create_new(args, clnt);
1203	if (IS_ERR(new))
1204		return new;
1205	gss_auth = gss_auth_find_or_add_hashed(args, clnt, new);
1206	if (gss_auth != new)
1207		gss_destroy(&new->rpc_auth);
1208out:
1209	return gss_auth;
1210}
1211
1212static struct rpc_auth *
1213gss_create(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
1214{
1215	struct gss_auth *gss_auth;
1216	struct rpc_xprt_switch *xps = rcu_access_pointer(clnt->cl_xpi.xpi_xpswitch);
1217
1218	while (clnt != clnt->cl_parent) {
1219		struct rpc_clnt *parent = clnt->cl_parent;
1220		/* Find the original parent for this transport */
1221		if (rcu_access_pointer(parent->cl_xpi.xpi_xpswitch) != xps)
1222			break;
1223		clnt = parent;
1224	}
1225
1226	gss_auth = gss_create_hashed(args, clnt);
1227	if (IS_ERR(gss_auth))
1228		return ERR_CAST(gss_auth);
1229	return &gss_auth->rpc_auth;
1230}
1231
1232static struct gss_cred *
1233gss_dup_cred(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
1234{
1235	struct gss_cred *new;
1236
1237	/* Make a copy of the cred so that we can reference count it */
1238	new = kzalloc(sizeof(*gss_cred), GFP_KERNEL);
1239	if (new) {
1240		struct auth_cred acred = {
1241			.cred = gss_cred->gc_base.cr_cred,
1242		};
1243		struct gss_cl_ctx *ctx =
1244			rcu_dereference_protected(gss_cred->gc_ctx, 1);
1245
1246		rpcauth_init_cred(&new->gc_base, &acred,
1247				&gss_auth->rpc_auth,
1248				&gss_nullops);
1249		new->gc_base.cr_flags = 1UL << RPCAUTH_CRED_UPTODATE;
1250		new->gc_service = gss_cred->gc_service;
1251		new->gc_principal = gss_cred->gc_principal;
1252		kref_get(&gss_auth->kref);
1253		rcu_assign_pointer(new->gc_ctx, ctx);
1254		gss_get_ctx(ctx);
1255	}
1256	return new;
1257}
1258
1259/*
1260 * gss_send_destroy_context will cause the RPCSEC_GSS to send a NULL RPC call
1261 * to the server with the GSS control procedure field set to
1262 * RPC_GSS_PROC_DESTROY. This should normally cause the server to release
1263 * all RPCSEC_GSS state associated with that context.
1264 */
1265static void
1266gss_send_destroy_context(struct rpc_cred *cred)
1267{
1268	struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1269	struct gss_auth *gss_auth = container_of(cred->cr_auth, struct gss_auth, rpc_auth);
1270	struct gss_cl_ctx *ctx = rcu_dereference_protected(gss_cred->gc_ctx, 1);
1271	struct gss_cred *new;
1272	struct rpc_task *task;
1273
1274	new = gss_dup_cred(gss_auth, gss_cred);
1275	if (new) {
1276		ctx->gc_proc = RPC_GSS_PROC_DESTROY;
1277
1278		trace_rpcgss_ctx_destroy(gss_cred);
1279		task = rpc_call_null(gss_auth->client, &new->gc_base,
1280				     RPC_TASK_ASYNC);
1281		if (!IS_ERR(task))
1282			rpc_put_task(task);
1283
1284		put_rpccred(&new->gc_base);
1285	}
 
 
 
 
 
 
 
 
 
 
 
1286}
1287
1288/* gss_destroy_cred (and gss_free_ctx) are used to clean up after failure
1289 * to create a new cred or context, so they check that things have been
1290 * allocated before freeing them. */
1291static void
1292gss_do_free_ctx(struct gss_cl_ctx *ctx)
1293{
 
 
1294	gss_delete_sec_context(&ctx->gc_gss_ctx);
1295	kfree(ctx->gc_wire_ctx.data);
1296	kfree(ctx->gc_acceptor.data);
1297	kfree(ctx);
1298}
1299
1300static void
1301gss_free_ctx_callback(struct rcu_head *head)
1302{
1303	struct gss_cl_ctx *ctx = container_of(head, struct gss_cl_ctx, gc_rcu);
1304	gss_do_free_ctx(ctx);
1305}
1306
1307static void
1308gss_free_ctx(struct gss_cl_ctx *ctx)
1309{
1310	call_rcu(&ctx->gc_rcu, gss_free_ctx_callback);
1311}
1312
1313static void
1314gss_free_cred(struct gss_cred *gss_cred)
1315{
 
1316	kfree(gss_cred);
1317}
1318
1319static void
1320gss_free_cred_callback(struct rcu_head *head)
1321{
1322	struct gss_cred *gss_cred = container_of(head, struct gss_cred, gc_base.cr_rcu);
1323	gss_free_cred(gss_cred);
1324}
1325
1326static void
1327gss_destroy_nullcred(struct rpc_cred *cred)
1328{
1329	struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1330	struct gss_auth *gss_auth = container_of(cred->cr_auth, struct gss_auth, rpc_auth);
1331	struct gss_cl_ctx *ctx = rcu_dereference_protected(gss_cred->gc_ctx, 1);
1332
1333	RCU_INIT_POINTER(gss_cred->gc_ctx, NULL);
1334	put_cred(cred->cr_cred);
1335	call_rcu(&cred->cr_rcu, gss_free_cred_callback);
1336	if (ctx)
1337		gss_put_ctx(ctx);
1338	gss_put_auth(gss_auth);
1339}
1340
1341static void
1342gss_destroy_cred(struct rpc_cred *cred)
1343{
1344	if (test_and_clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0)
1345		gss_send_destroy_context(cred);
1346	gss_destroy_nullcred(cred);
1347}
1348
1349static int
1350gss_hash_cred(struct auth_cred *acred, unsigned int hashbits)
1351{
1352	return hash_64(from_kuid(&init_user_ns, acred->cred->fsuid), hashbits);
1353}
1354
1355/*
1356 * Lookup RPCSEC_GSS cred for the current process
1357 */
1358static struct rpc_cred *gss_lookup_cred(struct rpc_auth *auth,
1359					struct auth_cred *acred, int flags)
1360{
1361	return rpcauth_lookup_credcache(auth, acred, flags,
1362					rpc_task_gfp_mask());
1363}
1364
1365static struct rpc_cred *
1366gss_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags, gfp_t gfp)
1367{
1368	struct gss_auth *gss_auth = container_of(auth, struct gss_auth, rpc_auth);
1369	struct gss_cred	*cred = NULL;
1370	int err = -ENOMEM;
1371
1372	if (!(cred = kzalloc(sizeof(*cred), gfp)))
 
 
 
1373		goto out_err;
1374
1375	rpcauth_init_cred(&cred->gc_base, acred, auth, &gss_credops);
1376	/*
1377	 * Note: in order to force a call to call_refresh(), we deliberately
1378	 * fail to flag the credential as RPCAUTH_CRED_UPTODATE.
1379	 */
1380	cred->gc_base.cr_flags = 1UL << RPCAUTH_CRED_NEW;
1381	cred->gc_service = gss_auth->service;
1382	cred->gc_principal = acred->principal;
1383	kref_get(&gss_auth->kref);
1384	return &cred->gc_base;
1385
1386out_err:
 
1387	return ERR_PTR(err);
1388}
1389
1390static int
1391gss_cred_init(struct rpc_auth *auth, struct rpc_cred *cred)
1392{
1393	struct gss_auth *gss_auth = container_of(auth, struct gss_auth, rpc_auth);
1394	struct gss_cred *gss_cred = container_of(cred,struct gss_cred, gc_base);
1395	int err;
1396
1397	do {
1398		err = gss_create_upcall(gss_auth, gss_cred);
1399	} while (err == -EAGAIN);
1400	return err;
1401}
1402
1403static char *
1404gss_stringify_acceptor(struct rpc_cred *cred)
1405{
1406	char *string = NULL;
1407	struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1408	struct gss_cl_ctx *ctx;
1409	unsigned int len;
1410	struct xdr_netobj *acceptor;
1411
1412	rcu_read_lock();
1413	ctx = rcu_dereference(gss_cred->gc_ctx);
1414	if (!ctx)
1415		goto out;
1416
1417	len = ctx->gc_acceptor.len;
1418	rcu_read_unlock();
1419
1420	/* no point if there's no string */
1421	if (!len)
1422		return NULL;
1423realloc:
1424	string = kmalloc(len + 1, GFP_KERNEL);
1425	if (!string)
1426		return NULL;
1427
1428	rcu_read_lock();
1429	ctx = rcu_dereference(gss_cred->gc_ctx);
1430
1431	/* did the ctx disappear or was it replaced by one with no acceptor? */
1432	if (!ctx || !ctx->gc_acceptor.len) {
1433		kfree(string);
1434		string = NULL;
1435		goto out;
1436	}
1437
1438	acceptor = &ctx->gc_acceptor;
1439
1440	/*
1441	 * Did we find a new acceptor that's longer than the original? Allocate
1442	 * a longer buffer and try again.
1443	 */
1444	if (len < acceptor->len) {
1445		len = acceptor->len;
1446		rcu_read_unlock();
1447		kfree(string);
1448		goto realloc;
1449	}
1450
1451	memcpy(string, acceptor->data, acceptor->len);
1452	string[acceptor->len] = '\0';
1453out:
1454	rcu_read_unlock();
1455	return string;
1456}
1457
1458/*
1459 * Returns -EACCES if GSS context is NULL or will expire within the
1460 * timeout (miliseconds)
1461 */
1462static int
1463gss_key_timeout(struct rpc_cred *rc)
1464{
1465	struct gss_cred *gss_cred = container_of(rc, struct gss_cred, gc_base);
1466	struct gss_cl_ctx *ctx;
1467	unsigned long timeout = jiffies + (gss_key_expire_timeo * HZ);
1468	int ret = 0;
1469
1470	rcu_read_lock();
1471	ctx = rcu_dereference(gss_cred->gc_ctx);
1472	if (!ctx || time_after(timeout, ctx->gc_expiry))
1473		ret = -EACCES;
1474	rcu_read_unlock();
1475
1476	return ret;
1477}
1478
1479static int
1480gss_match(struct auth_cred *acred, struct rpc_cred *rc, int flags)
1481{
1482	struct gss_cred *gss_cred = container_of(rc, struct gss_cred, gc_base);
1483	struct gss_cl_ctx *ctx;
1484	int ret;
1485
1486	if (test_bit(RPCAUTH_CRED_NEW, &rc->cr_flags))
1487		goto out;
1488	/* Don't match with creds that have expired. */
1489	rcu_read_lock();
1490	ctx = rcu_dereference(gss_cred->gc_ctx);
1491	if (!ctx || time_after(jiffies, ctx->gc_expiry)) {
1492		rcu_read_unlock();
1493		return 0;
1494	}
1495	rcu_read_unlock();
1496	if (!test_bit(RPCAUTH_CRED_UPTODATE, &rc->cr_flags))
1497		return 0;
1498out:
1499	if (acred->principal != NULL) {
1500		if (gss_cred->gc_principal == NULL)
1501			return 0;
1502		ret = strcmp(acred->principal, gss_cred->gc_principal) == 0;
1503	} else {
1504		if (gss_cred->gc_principal != NULL)
1505			return 0;
1506		ret = uid_eq(rc->cr_cred->fsuid, acred->cred->fsuid);
1507	}
1508	return ret;
1509}
1510
1511/*
1512 * Marshal credentials.
1513 *
1514 * The expensive part is computing the verifier. We can't cache a
1515 * pre-computed version of the verifier because the seqno, which
1516 * is different every time, is included in the MIC.
1517 */
1518static int gss_marshal(struct rpc_task *task, struct xdr_stream *xdr)
1519{
1520	struct rpc_rqst *req = task->tk_rqstp;
1521	struct rpc_cred *cred = req->rq_cred;
1522	struct gss_cred	*gss_cred = container_of(cred, struct gss_cred,
1523						 gc_base);
1524	struct gss_cl_ctx	*ctx = gss_cred_get_ctx(cred);
1525	__be32		*p, *cred_len;
1526	u32             maj_stat = 0;
1527	struct xdr_netobj mic;
1528	struct kvec	iov;
1529	struct xdr_buf	verf_buf;
1530	int status;
1531
1532	/* Credential */
1533
1534	p = xdr_reserve_space(xdr, 7 * sizeof(*p) +
1535			      ctx->gc_wire_ctx.len);
1536	if (!p)
1537		goto marshal_failed;
1538	*p++ = rpc_auth_gss;
1539	cred_len = p++;
1540
1541	spin_lock(&ctx->gc_seq_lock);
1542	req->rq_seqno = (ctx->gc_seq < MAXSEQ) ? ctx->gc_seq++ : MAXSEQ;
1543	spin_unlock(&ctx->gc_seq_lock);
1544	if (req->rq_seqno == MAXSEQ)
1545		goto expired;
1546	trace_rpcgss_seqno(task);
1547
1548	*p++ = cpu_to_be32(RPC_GSS_VERSION);
1549	*p++ = cpu_to_be32(ctx->gc_proc);
1550	*p++ = cpu_to_be32(req->rq_seqno);
1551	*p++ = cpu_to_be32(gss_cred->gc_service);
1552	p = xdr_encode_netobj(p, &ctx->gc_wire_ctx);
1553	*cred_len = cpu_to_be32((p - (cred_len + 1)) << 2);
1554
1555	/* Verifier */
 
 
 
 
 
1556
1557	/* We compute the checksum for the verifier over the xdr-encoded bytes
1558	 * starting with the xid and ending at the end of the credential: */
1559	iov.iov_base = req->rq_snd_buf.head[0].iov_base;
 
1560	iov.iov_len = (u8 *)p - (u8 *)iov.iov_base;
1561	xdr_buf_from_iov(&iov, &verf_buf);
1562
1563	p = xdr_reserve_space(xdr, sizeof(*p));
1564	if (!p)
1565		goto marshal_failed;
1566	*p++ = rpc_auth_gss;
1567	mic.data = (u8 *)(p + 1);
1568	maj_stat = gss_get_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
1569	if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1570		goto expired;
1571	else if (maj_stat != 0)
1572		goto bad_mic;
1573	if (xdr_stream_encode_opaque_inline(xdr, (void **)&p, mic.len) < 0)
1574		goto marshal_failed;
1575	status = 0;
1576out:
1577	gss_put_ctx(ctx);
1578	return status;
1579expired:
1580	clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1581	status = -EKEYEXPIRED;
1582	goto out;
1583marshal_failed:
1584	status = -EMSGSIZE;
1585	goto out;
1586bad_mic:
1587	trace_rpcgss_get_mic(task, maj_stat);
1588	status = -EIO;
1589	goto out;
1590}
1591
1592static int gss_renew_cred(struct rpc_task *task)
1593{
1594	struct rpc_cred *oldcred = task->tk_rqstp->rq_cred;
1595	struct gss_cred *gss_cred = container_of(oldcred,
1596						 struct gss_cred,
1597						 gc_base);
1598	struct rpc_auth *auth = oldcred->cr_auth;
1599	struct auth_cred acred = {
1600		.cred = oldcred->cr_cred,
1601		.principal = gss_cred->gc_principal,
1602	};
1603	struct rpc_cred *new;
1604
1605	new = gss_lookup_cred(auth, &acred, RPCAUTH_LOOKUP_NEW);
1606	if (IS_ERR(new))
1607		return PTR_ERR(new);
1608
1609	task->tk_rqstp->rq_cred = new;
1610	put_rpccred(oldcred);
1611	return 0;
1612}
1613
1614static int gss_cred_is_negative_entry(struct rpc_cred *cred)
1615{
1616	if (test_bit(RPCAUTH_CRED_NEGATIVE, &cred->cr_flags)) {
1617		unsigned long now = jiffies;
1618		unsigned long begin, expire;
1619		struct gss_cred *gss_cred;
1620
1621		gss_cred = container_of(cred, struct gss_cred, gc_base);
1622		begin = gss_cred->gc_upcall_timestamp;
1623		expire = begin + gss_expired_cred_retry_delay * HZ;
1624
1625		if (time_in_range_open(now, begin, expire))
1626			return 1;
1627	}
1628	return 0;
1629}
1630
1631/*
1632* Refresh credentials. XXX - finish
1633*/
1634static int
1635gss_refresh(struct rpc_task *task)
1636{
1637	struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1638	int ret = 0;
1639
1640	if (gss_cred_is_negative_entry(cred))
1641		return -EKEYEXPIRED;
1642
1643	if (!test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags) &&
1644			!test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags)) {
1645		ret = gss_renew_cred(task);
1646		if (ret < 0)
1647			goto out;
1648		cred = task->tk_rqstp->rq_cred;
1649	}
1650
1651	if (test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags))
1652		ret = gss_refresh_upcall(task);
1653out:
1654	return ret;
1655}
1656
1657/* Dummy refresh routine: used only when destroying the context */
1658static int
1659gss_refresh_null(struct rpc_task *task)
1660{
1661	return 0;
1662}
1663
1664static int
1665gss_validate(struct rpc_task *task, struct xdr_stream *xdr)
1666{
1667	struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1668	struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
1669	__be32		*p, *seq = NULL;
1670	struct kvec	iov;
1671	struct xdr_buf	verf_buf;
1672	struct xdr_netobj mic;
1673	u32		len, maj_stat;
1674	int		status;
1675
1676	p = xdr_inline_decode(xdr, 2 * sizeof(*p));
1677	if (!p)
1678		goto validate_failed;
1679	if (*p++ != rpc_auth_gss)
1680		goto validate_failed;
1681	len = be32_to_cpup(p);
1682	if (len > RPC_MAX_AUTH_SIZE)
1683		goto validate_failed;
1684	p = xdr_inline_decode(xdr, len);
1685	if (!p)
1686		goto validate_failed;
1687
1688	seq = kmalloc(4, GFP_KERNEL);
1689	if (!seq)
1690		goto validate_failed;
1691	*seq = cpu_to_be32(task->tk_rqstp->rq_seqno);
1692	iov.iov_base = seq;
1693	iov.iov_len = 4;
1694	xdr_buf_from_iov(&iov, &verf_buf);
1695	mic.data = (u8 *)p;
1696	mic.len = len;
 
1697	maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
1698	if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1699		clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1700	if (maj_stat)
1701		goto bad_mic;
1702
 
 
1703	/* We leave it to unwrap to calculate au_rslack. For now we just
1704	 * calculate the length of the verifier: */
1705	if (test_bit(RPCAUTH_AUTH_UPDATE_SLACK, &cred->cr_auth->au_flags))
1706		cred->cr_auth->au_verfsize = XDR_QUADLEN(len) + 2;
1707	status = 0;
1708out:
1709	gss_put_ctx(ctx);
1710	kfree(seq);
1711	return status;
 
 
 
 
 
 
1712
1713validate_failed:
1714	status = -EIO;
1715	goto out;
1716bad_mic:
1717	trace_rpcgss_verify_mic(task, maj_stat);
1718	status = -EACCES;
1719	goto out;
1720}
1721
1722static noinline_for_stack int
1723gss_wrap_req_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
1724		   struct rpc_task *task, struct xdr_stream *xdr)
 
1725{
1726	struct rpc_rqst *rqstp = task->tk_rqstp;
1727	struct xdr_buf integ_buf, *snd_buf = &rqstp->rq_snd_buf;
 
1728	struct xdr_netobj mic;
1729	__be32 *p, *integ_len;
1730	u32 offset, maj_stat;
 
 
 
1731
1732	p = xdr_reserve_space(xdr, 2 * sizeof(*p));
1733	if (!p)
1734		goto wrap_failed;
1735	integ_len = p++;
1736	*p = cpu_to_be32(rqstp->rq_seqno);
 
1737
1738	if (rpcauth_wrap_req_encode(task, xdr))
1739		goto wrap_failed;
1740
1741	offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base;
1742	if (xdr_buf_subsegment(snd_buf, &integ_buf,
1743				offset, snd_buf->len - offset))
1744		goto wrap_failed;
1745	*integ_len = cpu_to_be32(integ_buf.len);
1746
1747	p = xdr_reserve_space(xdr, 0);
1748	if (!p)
1749		goto wrap_failed;
 
 
 
1750	mic.data = (u8 *)(p + 1);
 
1751	maj_stat = gss_get_mic(ctx->gc_gss_ctx, &integ_buf, &mic);
 
1752	if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1753		clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1754	else if (maj_stat)
1755		goto bad_mic;
1756	/* Check that the trailing MIC fit in the buffer, after the fact */
1757	if (xdr_stream_encode_opaque_inline(xdr, (void **)&p, mic.len) < 0)
1758		goto wrap_failed;
 
 
1759	return 0;
1760wrap_failed:
1761	return -EMSGSIZE;
1762bad_mic:
1763	trace_rpcgss_get_mic(task, maj_stat);
1764	return -EIO;
1765}
1766
1767static void
1768priv_release_snd_buf(struct rpc_rqst *rqstp)
1769{
1770	int i;
1771
1772	for (i=0; i < rqstp->rq_enc_pages_num; i++)
1773		__free_page(rqstp->rq_enc_pages[i]);
1774	kfree(rqstp->rq_enc_pages);
1775	rqstp->rq_release_snd_buf = NULL;
1776}
1777
1778static int
1779alloc_enc_pages(struct rpc_rqst *rqstp)
1780{
1781	struct xdr_buf *snd_buf = &rqstp->rq_snd_buf;
1782	int first, last, i;
1783
1784	if (rqstp->rq_release_snd_buf)
1785		rqstp->rq_release_snd_buf(rqstp);
1786
1787	if (snd_buf->page_len == 0) {
1788		rqstp->rq_enc_pages_num = 0;
1789		return 0;
1790	}
1791
1792	first = snd_buf->page_base >> PAGE_SHIFT;
1793	last = (snd_buf->page_base + snd_buf->page_len - 1) >> PAGE_SHIFT;
1794	rqstp->rq_enc_pages_num = last - first + 1 + 1;
1795	rqstp->rq_enc_pages
1796		= kmalloc_array(rqstp->rq_enc_pages_num,
1797				sizeof(struct page *),
1798				GFP_KERNEL);
1799	if (!rqstp->rq_enc_pages)
1800		goto out;
1801	for (i=0; i < rqstp->rq_enc_pages_num; i++) {
1802		rqstp->rq_enc_pages[i] = alloc_page(GFP_KERNEL);
1803		if (rqstp->rq_enc_pages[i] == NULL)
1804			goto out_free;
1805	}
1806	rqstp->rq_release_snd_buf = priv_release_snd_buf;
1807	return 0;
1808out_free:
1809	rqstp->rq_enc_pages_num = i;
1810	priv_release_snd_buf(rqstp);
1811out:
1812	return -EAGAIN;
1813}
1814
1815static noinline_for_stack int
1816gss_wrap_req_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
1817		  struct rpc_task *task, struct xdr_stream *xdr)
 
1818{
1819	struct rpc_rqst *rqstp = task->tk_rqstp;
1820	struct xdr_buf	*snd_buf = &rqstp->rq_snd_buf;
1821	u32		pad, offset, maj_stat;
 
1822	int		status;
1823	__be32		*p, *opaque_len;
1824	struct page	**inpages;
1825	int		first;
 
1826	struct kvec	*iov;
 
1827
1828	status = -EIO;
1829	p = xdr_reserve_space(xdr, 2 * sizeof(*p));
1830	if (!p)
1831		goto wrap_failed;
1832	opaque_len = p++;
1833	*p = cpu_to_be32(rqstp->rq_seqno);
 
1834
1835	if (rpcauth_wrap_req_encode(task, xdr))
1836		goto wrap_failed;
1837
1838	status = alloc_enc_pages(rqstp);
1839	if (unlikely(status))
1840		goto wrap_failed;
1841	first = snd_buf->page_base >> PAGE_SHIFT;
1842	inpages = snd_buf->pages + first;
1843	snd_buf->pages = rqstp->rq_enc_pages;
1844	snd_buf->page_base -= first << PAGE_SHIFT;
1845	/*
1846	 * Move the tail into its own page, in case gss_wrap needs
1847	 * more space in the head when wrapping.
1848	 *
1849	 * Still... Why can't gss_wrap just slide the tail down?
 
 
1850	 */
1851	if (snd_buf->page_len || snd_buf->tail[0].iov_len) {
1852		char *tmp;
1853
1854		tmp = page_address(rqstp->rq_enc_pages[rqstp->rq_enc_pages_num - 1]);
1855		memcpy(tmp, snd_buf->tail[0].iov_base, snd_buf->tail[0].iov_len);
1856		snd_buf->tail[0].iov_base = tmp;
1857	}
1858	offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base;
1859	maj_stat = gss_wrap(ctx->gc_gss_ctx, offset, snd_buf, inpages);
1860	/* slack space should prevent this ever happening: */
1861	if (unlikely(snd_buf->len > snd_buf->buflen))
1862		goto wrap_failed;
1863	/* We're assuming that when GSS_S_CONTEXT_EXPIRED, the encryption was
1864	 * done anyway, so it's safe to put the request on the wire: */
1865	if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1866		clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1867	else if (maj_stat)
1868		goto bad_wrap;
1869
1870	*opaque_len = cpu_to_be32(snd_buf->len - offset);
1871	/* guess whether the pad goes into the head or the tail: */
1872	if (snd_buf->page_len || snd_buf->tail[0].iov_len)
1873		iov = snd_buf->tail;
1874	else
1875		iov = snd_buf->head;
1876	p = iov->iov_base + iov->iov_len;
1877	pad = xdr_pad_size(snd_buf->len - offset);
1878	memset(p, 0, pad);
1879	iov->iov_len += pad;
1880	snd_buf->len += pad;
1881
1882	return 0;
1883wrap_failed:
1884	return status;
1885bad_wrap:
1886	trace_rpcgss_wrap(task, maj_stat);
1887	return -EIO;
1888}
1889
1890static int gss_wrap_req(struct rpc_task *task, struct xdr_stream *xdr)
 
 
1891{
1892	struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1893	struct gss_cred	*gss_cred = container_of(cred, struct gss_cred,
1894			gc_base);
1895	struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
1896	int status;
1897
1898	status = -EIO;
1899	if (ctx->gc_proc != RPC_GSS_PROC_DATA) {
1900		/* The spec seems a little ambiguous here, but I think that not
1901		 * wrapping context destruction requests makes the most sense.
1902		 */
1903		status = rpcauth_wrap_req_encode(task, xdr);
 
1904		goto out;
1905	}
1906	switch (gss_cred->gc_service) {
1907	case RPC_GSS_SVC_NONE:
1908		status = rpcauth_wrap_req_encode(task, xdr);
 
1909		break;
1910	case RPC_GSS_SVC_INTEGRITY:
1911		status = gss_wrap_req_integ(cred, ctx, task, xdr);
1912		break;
1913	case RPC_GSS_SVC_PRIVACY:
1914		status = gss_wrap_req_priv(cred, ctx, task, xdr);
1915		break;
1916	default:
1917		status = -EIO;
1918	}
1919out:
1920	gss_put_ctx(ctx);
 
1921	return status;
1922}
1923
1924/**
1925 * gss_update_rslack - Possibly update RPC receive buffer size estimates
1926 * @task: rpc_task for incoming RPC Reply being unwrapped
1927 * @cred: controlling rpc_cred for @task
1928 * @before: XDR words needed before each RPC Reply message
1929 * @after: XDR words needed following each RPC Reply message
1930 *
1931 */
1932static void gss_update_rslack(struct rpc_task *task, struct rpc_cred *cred,
1933			      unsigned int before, unsigned int after)
1934{
1935	struct rpc_auth *auth = cred->cr_auth;
1936
1937	if (test_and_clear_bit(RPCAUTH_AUTH_UPDATE_SLACK, &auth->au_flags)) {
1938		auth->au_ralign = auth->au_verfsize + before;
1939		auth->au_rslack = auth->au_verfsize + after;
1940		trace_rpcgss_update_slack(task, auth);
1941	}
1942}
1943
1944static int
1945gss_unwrap_resp_auth(struct rpc_task *task, struct rpc_cred *cred)
1946{
1947	gss_update_rslack(task, cred, 0, 0);
1948	return 0;
1949}
1950
1951/*
1952 * RFC 2203, Section 5.3.2.2
1953 *
1954 *	struct rpc_gss_integ_data {
1955 *		opaque databody_integ<>;
1956 *		opaque checksum<>;
1957 *	};
1958 *
1959 *	struct rpc_gss_data_t {
1960 *		unsigned int seq_num;
1961 *		proc_req_arg_t arg;
1962 *	};
1963 */
1964static noinline_for_stack int
1965gss_unwrap_resp_integ(struct rpc_task *task, struct rpc_cred *cred,
1966		      struct gss_cl_ctx *ctx, struct rpc_rqst *rqstp,
1967		      struct xdr_stream *xdr)
1968{
1969	struct xdr_buf gss_data, *rcv_buf = &rqstp->rq_rcv_buf;
1970	u32 len, offset, seqno, maj_stat;
1971	struct xdr_netobj mic;
1972	int ret;
1973
1974	ret = -EIO;
1975	mic.data = NULL;
1976
1977	/* opaque databody_integ<>; */
1978	if (xdr_stream_decode_u32(xdr, &len))
1979		goto unwrap_failed;
1980	if (len & 3)
1981		goto unwrap_failed;
1982	offset = rcv_buf->len - xdr_stream_remaining(xdr);
1983	if (xdr_stream_decode_u32(xdr, &seqno))
1984		goto unwrap_failed;
1985	if (seqno != rqstp->rq_seqno)
1986		goto bad_seqno;
1987	if (xdr_buf_subsegment(rcv_buf, &gss_data, offset, len))
1988		goto unwrap_failed;
1989
1990	/*
1991	 * The xdr_stream now points to the beginning of the
1992	 * upper layer payload, to be passed below to
1993	 * rpcauth_unwrap_resp_decode(). The checksum, which
1994	 * follows the upper layer payload in @rcv_buf, is
1995	 * located and parsed without updating the xdr_stream.
1996	 */
 
 
 
 
 
 
1997
1998	/* opaque checksum<>; */
1999	offset += len;
2000	if (xdr_decode_word(rcv_buf, offset, &len))
2001		goto unwrap_failed;
2002	offset += sizeof(__be32);
2003	if (offset + len > rcv_buf->len)
2004		goto unwrap_failed;
2005	mic.len = len;
2006	mic.data = kmalloc(len, GFP_KERNEL);
2007	if (ZERO_OR_NULL_PTR(mic.data))
2008		goto unwrap_failed;
2009	if (read_bytes_from_xdr_buf(rcv_buf, offset, mic.data, mic.len))
2010		goto unwrap_failed;
2011
2012	maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &gss_data, &mic);
2013	if (maj_stat == GSS_S_CONTEXT_EXPIRED)
2014		clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
2015	if (maj_stat != GSS_S_COMPLETE)
2016		goto bad_mic;
2017
2018	gss_update_rslack(task, cred, 2, 2 + 1 + XDR_QUADLEN(mic.len));
2019	ret = 0;
2020
2021out:
2022	kfree(mic.data);
2023	return ret;
 
 
 
 
 
 
2024
2025unwrap_failed:
2026	trace_rpcgss_unwrap_failed(task);
2027	goto out;
2028bad_seqno:
2029	trace_rpcgss_bad_seqno(task, rqstp->rq_seqno, seqno);
2030	goto out;
2031bad_mic:
2032	trace_rpcgss_verify_mic(task, maj_stat);
2033	goto out;
2034}
2035
2036static noinline_for_stack int
2037gss_unwrap_resp_priv(struct rpc_task *task, struct rpc_cred *cred,
2038		     struct gss_cl_ctx *ctx, struct rpc_rqst *rqstp,
2039		     struct xdr_stream *xdr)
2040{
2041	struct xdr_buf *rcv_buf = &rqstp->rq_rcv_buf;
2042	struct kvec *head = rqstp->rq_rcv_buf.head;
2043	u32 offset, opaque_len, maj_stat;
2044	__be32 *p;
2045
2046	p = xdr_inline_decode(xdr, 2 * sizeof(*p));
2047	if (unlikely(!p))
2048		goto unwrap_failed;
2049	opaque_len = be32_to_cpup(p++);
2050	offset = (u8 *)(p) - (u8 *)head->iov_base;
2051	if (offset + opaque_len > rcv_buf->len)
2052		goto unwrap_failed;
 
 
2053
2054	maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset,
2055			      offset + opaque_len, rcv_buf);
2056	if (maj_stat == GSS_S_CONTEXT_EXPIRED)
2057		clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
2058	if (maj_stat != GSS_S_COMPLETE)
2059		goto bad_unwrap;
2060	/* gss_unwrap decrypted the sequence number */
2061	if (be32_to_cpup(p++) != rqstp->rq_seqno)
2062		goto bad_seqno;
2063
2064	/* gss_unwrap redacts the opaque blob from the head iovec.
2065	 * rcv_buf has changed, thus the stream needs to be reset.
2066	 */
2067	xdr_init_decode(xdr, rcv_buf, p, rqstp);
2068
2069	gss_update_rslack(task, cred, 2 + ctx->gc_gss_ctx->align,
2070			  2 + ctx->gc_gss_ctx->slack);
2071
2072	return 0;
2073unwrap_failed:
2074	trace_rpcgss_unwrap_failed(task);
2075	return -EIO;
2076bad_seqno:
2077	trace_rpcgss_bad_seqno(task, rqstp->rq_seqno, be32_to_cpup(--p));
2078	return -EIO;
2079bad_unwrap:
2080	trace_rpcgss_unwrap(task, maj_stat);
2081	return -EIO;
2082}
2083
2084static bool
2085gss_seq_is_newer(u32 new, u32 old)
2086{
2087	return (s32)(new - old) > 0;
2088}
2089
2090static bool
2091gss_xmit_need_reencode(struct rpc_task *task)
2092{
2093	struct rpc_rqst *req = task->tk_rqstp;
2094	struct rpc_cred *cred = req->rq_cred;
2095	struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
2096	u32 win, seq_xmit = 0;
2097	bool ret = true;
2098
2099	if (!ctx)
2100		goto out;
2101
2102	if (gss_seq_is_newer(req->rq_seqno, READ_ONCE(ctx->gc_seq)))
2103		goto out_ctx;
2104
2105	seq_xmit = READ_ONCE(ctx->gc_seq_xmit);
2106	while (gss_seq_is_newer(req->rq_seqno, seq_xmit)) {
2107		u32 tmp = seq_xmit;
2108
2109		seq_xmit = cmpxchg(&ctx->gc_seq_xmit, tmp, req->rq_seqno);
2110		if (seq_xmit == tmp) {
2111			ret = false;
2112			goto out_ctx;
2113		}
2114	}
2115
2116	win = ctx->gc_win;
2117	if (win > 0)
2118		ret = !gss_seq_is_newer(req->rq_seqno, seq_xmit - win);
2119
2120out_ctx:
2121	gss_put_ctx(ctx);
2122out:
2123	trace_rpcgss_need_reencode(task, seq_xmit, ret);
2124	return ret;
2125}
2126
2127static int
2128gss_unwrap_resp(struct rpc_task *task, struct xdr_stream *xdr)
 
2129{
2130	struct rpc_rqst *rqstp = task->tk_rqstp;
2131	struct rpc_cred *cred = rqstp->rq_cred;
2132	struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
2133			gc_base);
2134	struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
2135	int status = -EIO;
 
 
 
2136
2137	if (ctx->gc_proc != RPC_GSS_PROC_DATA)
2138		goto out_decode;
2139	switch (gss_cred->gc_service) {
2140	case RPC_GSS_SVC_NONE:
2141		status = gss_unwrap_resp_auth(task, cred);
2142		break;
2143	case RPC_GSS_SVC_INTEGRITY:
2144		status = gss_unwrap_resp_integ(task, cred, ctx, rqstp, xdr);
 
 
2145		break;
2146	case RPC_GSS_SVC_PRIVACY:
2147		status = gss_unwrap_resp_priv(task, cred, ctx, rqstp, xdr);
 
 
2148		break;
2149	}
2150	if (status)
2151		goto out;
2152
2153out_decode:
2154	status = rpcauth_unwrap_resp_decode(task, xdr);
2155out:
2156	gss_put_ctx(ctx);
 
 
2157	return status;
2158}
2159
2160static const struct rpc_authops authgss_ops = {
2161	.owner		= THIS_MODULE,
2162	.au_flavor	= RPC_AUTH_GSS,
2163	.au_name	= "RPCSEC_GSS",
2164	.create		= gss_create,
2165	.destroy	= gss_destroy,
2166	.hash_cred	= gss_hash_cred,
2167	.lookup_cred	= gss_lookup_cred,
2168	.crcreate	= gss_create_cred,
2169	.info2flavor	= gss_mech_info2flavor,
2170	.flavor2info	= gss_mech_flavor2info,
2171};
2172
2173static const struct rpc_credops gss_credops = {
2174	.cr_name		= "AUTH_GSS",
2175	.crdestroy		= gss_destroy_cred,
2176	.cr_init		= gss_cred_init,
2177	.crmatch		= gss_match,
2178	.crmarshal		= gss_marshal,
2179	.crrefresh		= gss_refresh,
2180	.crvalidate		= gss_validate,
2181	.crwrap_req		= gss_wrap_req,
2182	.crunwrap_resp		= gss_unwrap_resp,
2183	.crkey_timeout		= gss_key_timeout,
2184	.crstringify_acceptor	= gss_stringify_acceptor,
2185	.crneed_reencode	= gss_xmit_need_reencode,
2186};
2187
2188static const struct rpc_credops gss_nullops = {
2189	.cr_name		= "AUTH_GSS",
2190	.crdestroy		= gss_destroy_nullcred,
2191	.crmatch		= gss_match,
2192	.crmarshal		= gss_marshal,
2193	.crrefresh		= gss_refresh_null,
2194	.crvalidate		= gss_validate,
2195	.crwrap_req		= gss_wrap_req,
2196	.crunwrap_resp		= gss_unwrap_resp,
2197	.crstringify_acceptor	= gss_stringify_acceptor,
2198};
2199
2200static const struct rpc_pipe_ops gss_upcall_ops_v0 = {
2201	.upcall		= gss_v0_upcall,
2202	.downcall	= gss_pipe_downcall,
2203	.destroy_msg	= gss_pipe_destroy_msg,
2204	.open_pipe	= gss_pipe_open_v0,
2205	.release_pipe	= gss_pipe_release,
2206};
2207
2208static const struct rpc_pipe_ops gss_upcall_ops_v1 = {
2209	.upcall		= gss_v1_upcall,
2210	.downcall	= gss_pipe_downcall,
2211	.destroy_msg	= gss_pipe_destroy_msg,
2212	.open_pipe	= gss_pipe_open_v1,
2213	.release_pipe	= gss_pipe_release,
2214};
2215
2216static __net_init int rpcsec_gss_init_net(struct net *net)
2217{
2218	return gss_svc_init_net(net);
2219}
2220
2221static __net_exit void rpcsec_gss_exit_net(struct net *net)
2222{
2223	gss_svc_shutdown_net(net);
2224}
2225
2226static struct pernet_operations rpcsec_gss_net_ops = {
2227	.init = rpcsec_gss_init_net,
2228	.exit = rpcsec_gss_exit_net,
2229};
2230
2231/*
2232 * Initialize RPCSEC_GSS module
2233 */
2234static int __init init_rpcsec_gss(void)
2235{
2236	int err = 0;
2237
2238	err = rpcauth_register(&authgss_ops);
2239	if (err)
2240		goto out;
2241	err = gss_svc_init();
2242	if (err)
2243		goto out_unregister;
2244	err = register_pernet_subsys(&rpcsec_gss_net_ops);
2245	if (err)
2246		goto out_svc_exit;
2247	rpc_init_wait_queue(&pipe_version_rpc_waitqueue, "gss pipe version");
2248	return 0;
2249out_svc_exit:
2250	gss_svc_shutdown();
2251out_unregister:
2252	rpcauth_unregister(&authgss_ops);
2253out:
2254	return err;
2255}
2256
2257static void __exit exit_rpcsec_gss(void)
2258{
2259	unregister_pernet_subsys(&rpcsec_gss_net_ops);
2260	gss_svc_shutdown();
2261	rpcauth_unregister(&authgss_ops);
2262	rcu_barrier(); /* Wait for completion of call_rcu()'s */
2263}
2264
2265MODULE_ALIAS("rpc-auth-6");
2266MODULE_LICENSE("GPL");
2267module_param_named(expired_cred_retry_delay,
2268		   gss_expired_cred_retry_delay,
2269		   uint, 0644);
2270MODULE_PARM_DESC(expired_cred_retry_delay, "Timeout (in seconds) until "
2271		"the RPC engine retries an expired credential");
2272
2273module_param_named(key_expire_timeo,
2274		   gss_key_expire_timeo,
2275		   uint, 0644);
2276MODULE_PARM_DESC(key_expire_timeo, "Time (in seconds) at the end of a "
2277		"credential keys lifetime where the NFS layer cleans up "
2278		"prior to key expiration");
2279
2280module_init(init_rpcsec_gss)
2281module_exit(exit_rpcsec_gss)