auth.c 9.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417
  1. /*
  2. * linux/net/sunrpc/auth.c
  3. *
  4. * Generic RPC client authentication API.
  5. *
  6. * Copyright (C) 1996, Olaf Kirch <okir@monad.swb.de>
  7. */
  8. #include <linux/types.h>
  9. #include <linux/sched.h>
  10. #include <linux/module.h>
  11. #include <linux/slab.h>
  12. #include <linux/errno.h>
  13. #include <linux/sunrpc/clnt.h>
  14. #include <linux/spinlock.h>
  15. #ifdef RPC_DEBUG
  16. # define RPCDBG_FACILITY RPCDBG_AUTH
  17. #endif
  18. static struct rpc_authops * auth_flavors[RPC_AUTH_MAXFLAVOR] = {
  19. &authnull_ops, /* AUTH_NULL */
  20. &authunix_ops, /* AUTH_UNIX */
  21. NULL, /* others can be loadable modules */
  22. };
  23. static u32
  24. pseudoflavor_to_flavor(u32 flavor) {
  25. if (flavor >= RPC_AUTH_MAXFLAVOR)
  26. return RPC_AUTH_GSS;
  27. return flavor;
  28. }
  29. int
  30. rpcauth_register(struct rpc_authops *ops)
  31. {
  32. rpc_authflavor_t flavor;
  33. if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR)
  34. return -EINVAL;
  35. if (auth_flavors[flavor] != NULL)
  36. return -EPERM; /* what else? */
  37. auth_flavors[flavor] = ops;
  38. return 0;
  39. }
  40. int
  41. rpcauth_unregister(struct rpc_authops *ops)
  42. {
  43. rpc_authflavor_t flavor;
  44. if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR)
  45. return -EINVAL;
  46. if (auth_flavors[flavor] != ops)
  47. return -EPERM; /* what else? */
  48. auth_flavors[flavor] = NULL;
  49. return 0;
  50. }
  51. struct rpc_auth *
  52. rpcauth_create(rpc_authflavor_t pseudoflavor, struct rpc_clnt *clnt)
  53. {
  54. struct rpc_auth *auth;
  55. struct rpc_authops *ops;
  56. u32 flavor = pseudoflavor_to_flavor(pseudoflavor);
  57. auth = ERR_PTR(-EINVAL);
  58. if (flavor >= RPC_AUTH_MAXFLAVOR)
  59. goto out;
  60. /* FIXME - auth_flavors[] really needs an rw lock,
  61. * and module refcounting. */
  62. #ifdef CONFIG_KMOD
  63. if ((ops = auth_flavors[flavor]) == NULL)
  64. request_module("rpc-auth-%u", flavor);
  65. #endif
  66. if ((ops = auth_flavors[flavor]) == NULL)
  67. goto out;
  68. auth = ops->create(clnt, pseudoflavor);
  69. if (IS_ERR(auth))
  70. return auth;
  71. if (clnt->cl_auth)
  72. rpcauth_destroy(clnt->cl_auth);
  73. clnt->cl_auth = auth;
  74. out:
  75. return auth;
  76. }
  77. void
  78. rpcauth_destroy(struct rpc_auth *auth)
  79. {
  80. if (!atomic_dec_and_test(&auth->au_count))
  81. return;
  82. auth->au_ops->destroy(auth);
  83. }
  84. static DEFINE_SPINLOCK(rpc_credcache_lock);
  85. /*
  86. * Initialize RPC credential cache
  87. */
  88. int
  89. rpcauth_init_credcache(struct rpc_auth *auth, unsigned long expire)
  90. {
  91. struct rpc_cred_cache *new;
  92. int i;
  93. new = kmalloc(sizeof(*new), GFP_KERNEL);
  94. if (!new)
  95. return -ENOMEM;
  96. for (i = 0; i < RPC_CREDCACHE_NR; i++)
  97. INIT_HLIST_HEAD(&new->hashtable[i]);
  98. new->expire = expire;
  99. new->nextgc = jiffies + (expire >> 1);
  100. auth->au_credcache = new;
  101. return 0;
  102. }
  103. /*
  104. * Destroy a list of credentials
  105. */
  106. static inline
  107. void rpcauth_destroy_credlist(struct hlist_head *head)
  108. {
  109. struct rpc_cred *cred;
  110. while (!hlist_empty(head)) {
  111. cred = hlist_entry(head->first, struct rpc_cred, cr_hash);
  112. hlist_del_init(&cred->cr_hash);
  113. put_rpccred(cred);
  114. }
  115. }
  116. /*
  117. * Clear the RPC credential cache, and delete those credentials
  118. * that are not referenced.
  119. */
  120. void
  121. rpcauth_free_credcache(struct rpc_auth *auth)
  122. {
  123. struct rpc_cred_cache *cache = auth->au_credcache;
  124. HLIST_HEAD(free);
  125. struct hlist_node *pos, *next;
  126. struct rpc_cred *cred;
  127. int i;
  128. spin_lock(&rpc_credcache_lock);
  129. for (i = 0; i < RPC_CREDCACHE_NR; i++) {
  130. hlist_for_each_safe(pos, next, &cache->hashtable[i]) {
  131. cred = hlist_entry(pos, struct rpc_cred, cr_hash);
  132. __hlist_del(&cred->cr_hash);
  133. hlist_add_head(&cred->cr_hash, &free);
  134. }
  135. }
  136. spin_unlock(&rpc_credcache_lock);
  137. rpcauth_destroy_credlist(&free);
  138. }
  139. static void
  140. rpcauth_prune_expired(struct rpc_auth *auth, struct rpc_cred *cred, struct hlist_head *free)
  141. {
  142. if (atomic_read(&cred->cr_count) != 1)
  143. return;
  144. if (time_after(jiffies, cred->cr_expire + auth->au_credcache->expire))
  145. cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;
  146. if (!(cred->cr_flags & RPCAUTH_CRED_UPTODATE)) {
  147. __hlist_del(&cred->cr_hash);
  148. hlist_add_head(&cred->cr_hash, free);
  149. }
  150. }
  151. /*
  152. * Remove stale credentials. Avoid sleeping inside the loop.
  153. */
  154. static void
  155. rpcauth_gc_credcache(struct rpc_auth *auth, struct hlist_head *free)
  156. {
  157. struct rpc_cred_cache *cache = auth->au_credcache;
  158. struct hlist_node *pos, *next;
  159. struct rpc_cred *cred;
  160. int i;
  161. dprintk("RPC: gc'ing RPC credentials for auth %p\n", auth);
  162. for (i = 0; i < RPC_CREDCACHE_NR; i++) {
  163. hlist_for_each_safe(pos, next, &cache->hashtable[i]) {
  164. cred = hlist_entry(pos, struct rpc_cred, cr_hash);
  165. rpcauth_prune_expired(auth, cred, free);
  166. }
  167. }
  168. cache->nextgc = jiffies + cache->expire;
  169. }
  170. /*
  171. * Look up a process' credentials in the authentication cache
  172. */
  173. struct rpc_cred *
  174. rpcauth_lookup_credcache(struct rpc_auth *auth, struct auth_cred * acred,
  175. int flags)
  176. {
  177. struct rpc_cred_cache *cache = auth->au_credcache;
  178. HLIST_HEAD(free);
  179. struct hlist_node *pos, *next;
  180. struct rpc_cred *new = NULL,
  181. *cred = NULL;
  182. int nr = 0;
  183. if (!(flags & RPCAUTH_LOOKUP_ROOTCREDS))
  184. nr = acred->uid & RPC_CREDCACHE_MASK;
  185. retry:
  186. spin_lock(&rpc_credcache_lock);
  187. if (time_before(cache->nextgc, jiffies))
  188. rpcauth_gc_credcache(auth, &free);
  189. hlist_for_each_safe(pos, next, &cache->hashtable[nr]) {
  190. struct rpc_cred *entry;
  191. entry = hlist_entry(pos, struct rpc_cred, cr_hash);
  192. if (entry->cr_ops->crmatch(acred, entry, flags)) {
  193. hlist_del(&entry->cr_hash);
  194. cred = entry;
  195. break;
  196. }
  197. rpcauth_prune_expired(auth, entry, &free);
  198. }
  199. if (new) {
  200. if (cred)
  201. hlist_add_head(&new->cr_hash, &free);
  202. else
  203. cred = new;
  204. }
  205. if (cred) {
  206. hlist_add_head(&cred->cr_hash, &cache->hashtable[nr]);
  207. get_rpccred(cred);
  208. }
  209. spin_unlock(&rpc_credcache_lock);
  210. rpcauth_destroy_credlist(&free);
  211. if (!cred) {
  212. new = auth->au_ops->crcreate(auth, acred, flags);
  213. if (!IS_ERR(new)) {
  214. #ifdef RPC_DEBUG
  215. new->cr_magic = RPCAUTH_CRED_MAGIC;
  216. #endif
  217. goto retry;
  218. } else
  219. cred = new;
  220. } else if ((cred->cr_flags & RPCAUTH_CRED_NEW)
  221. && cred->cr_ops->cr_init != NULL
  222. && !(flags & RPCAUTH_LOOKUP_NEW)) {
  223. int res = cred->cr_ops->cr_init(auth, cred);
  224. if (res < 0) {
  225. put_rpccred(cred);
  226. cred = ERR_PTR(res);
  227. }
  228. }
  229. return (struct rpc_cred *) cred;
  230. }
  231. struct rpc_cred *
  232. rpcauth_lookupcred(struct rpc_auth *auth, int flags)
  233. {
  234. struct auth_cred acred = {
  235. .uid = current->fsuid,
  236. .gid = current->fsgid,
  237. .group_info = current->group_info,
  238. };
  239. struct rpc_cred *ret;
  240. dprintk("RPC: looking up %s cred\n",
  241. auth->au_ops->au_name);
  242. get_group_info(acred.group_info);
  243. ret = auth->au_ops->lookup_cred(auth, &acred, flags);
  244. put_group_info(acred.group_info);
  245. return ret;
  246. }
  247. struct rpc_cred *
  248. rpcauth_bindcred(struct rpc_task *task)
  249. {
  250. struct rpc_auth *auth = task->tk_auth;
  251. struct auth_cred acred = {
  252. .uid = current->fsuid,
  253. .gid = current->fsgid,
  254. .group_info = current->group_info,
  255. };
  256. struct rpc_cred *ret;
  257. int flags = 0;
  258. dprintk("RPC: %5u looking up %s cred\n",
  259. task->tk_pid, task->tk_auth->au_ops->au_name);
  260. get_group_info(acred.group_info);
  261. if (task->tk_flags & RPC_TASK_ROOTCREDS)
  262. flags |= RPCAUTH_LOOKUP_ROOTCREDS;
  263. ret = auth->au_ops->lookup_cred(auth, &acred, flags);
  264. if (!IS_ERR(ret))
  265. task->tk_msg.rpc_cred = ret;
  266. else
  267. task->tk_status = PTR_ERR(ret);
  268. put_group_info(acred.group_info);
  269. return ret;
  270. }
  271. void
  272. rpcauth_holdcred(struct rpc_task *task)
  273. {
  274. dprintk("RPC: %5u holding %s cred %p\n",
  275. task->tk_pid, task->tk_auth->au_ops->au_name,
  276. task->tk_msg.rpc_cred);
  277. if (task->tk_msg.rpc_cred)
  278. get_rpccred(task->tk_msg.rpc_cred);
  279. }
  280. void
  281. put_rpccred(struct rpc_cred *cred)
  282. {
  283. cred->cr_expire = jiffies;
  284. if (!atomic_dec_and_test(&cred->cr_count))
  285. return;
  286. cred->cr_ops->crdestroy(cred);
  287. }
  288. void
  289. rpcauth_unbindcred(struct rpc_task *task)
  290. {
  291. struct rpc_cred *cred = task->tk_msg.rpc_cred;
  292. dprintk("RPC: %5u releasing %s cred %p\n",
  293. task->tk_pid, task->tk_auth->au_ops->au_name, cred);
  294. put_rpccred(cred);
  295. task->tk_msg.rpc_cred = NULL;
  296. }
  297. __be32 *
  298. rpcauth_marshcred(struct rpc_task *task, __be32 *p)
  299. {
  300. struct rpc_cred *cred = task->tk_msg.rpc_cred;
  301. dprintk("RPC: %5u marshaling %s cred %p\n",
  302. task->tk_pid, task->tk_auth->au_ops->au_name, cred);
  303. return cred->cr_ops->crmarshal(task, p);
  304. }
  305. __be32 *
  306. rpcauth_checkverf(struct rpc_task *task, __be32 *p)
  307. {
  308. struct rpc_cred *cred = task->tk_msg.rpc_cred;
  309. dprintk("RPC: %5u validating %s cred %p\n",
  310. task->tk_pid, task->tk_auth->au_ops->au_name, cred);
  311. return cred->cr_ops->crvalidate(task, p);
  312. }
  313. int
  314. rpcauth_wrap_req(struct rpc_task *task, kxdrproc_t encode, void *rqstp,
  315. __be32 *data, void *obj)
  316. {
  317. struct rpc_cred *cred = task->tk_msg.rpc_cred;
  318. dprintk("RPC: %5u using %s cred %p to wrap rpc data\n",
  319. task->tk_pid, cred->cr_ops->cr_name, cred);
  320. if (cred->cr_ops->crwrap_req)
  321. return cred->cr_ops->crwrap_req(task, encode, rqstp, data, obj);
  322. /* By default, we encode the arguments normally. */
  323. return encode(rqstp, data, obj);
  324. }
  325. int
  326. rpcauth_unwrap_resp(struct rpc_task *task, kxdrproc_t decode, void *rqstp,
  327. __be32 *data, void *obj)
  328. {
  329. struct rpc_cred *cred = task->tk_msg.rpc_cred;
  330. dprintk("RPC: %5u using %s cred %p to unwrap rpc data\n",
  331. task->tk_pid, cred->cr_ops->cr_name, cred);
  332. if (cred->cr_ops->crunwrap_resp)
  333. return cred->cr_ops->crunwrap_resp(task, decode, rqstp,
  334. data, obj);
  335. /* By default, we decode the arguments normally. */
  336. return decode(rqstp, data, obj);
  337. }
  338. int
  339. rpcauth_refreshcred(struct rpc_task *task)
  340. {
  341. struct rpc_cred *cred = task->tk_msg.rpc_cred;
  342. int err;
  343. dprintk("RPC: %5u refreshing %s cred %p\n",
  344. task->tk_pid, task->tk_auth->au_ops->au_name, cred);
  345. err = cred->cr_ops->crrefresh(task);
  346. if (err < 0)
  347. task->tk_status = err;
  348. return err;
  349. }
  350. void
  351. rpcauth_invalcred(struct rpc_task *task)
  352. {
  353. dprintk("RPC: %5u invalidating %s cred %p\n",
  354. task->tk_pid, task->tk_auth->au_ops->au_name, task->tk_msg.rpc_cred);
  355. spin_lock(&rpc_credcache_lock);
  356. if (task->tk_msg.rpc_cred)
  357. task->tk_msg.rpc_cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;
  358. spin_unlock(&rpc_credcache_lock);
  359. }
  360. int
  361. rpcauth_uptodatecred(struct rpc_task *task)
  362. {
  363. return !(task->tk_msg.rpc_cred) ||
  364. (task->tk_msg.rpc_cred->cr_flags & RPCAUTH_CRED_UPTODATE);
  365. }