1// SPDX-License-Identifier: BSD-3-Clause
2/*
3 * linux/net/sunrpc/auth_gss/auth_gss.c
4 *
5 * RPCSEC_GSS client authentication.
6 *
7 * Copyright (c) 2000 The Regents of the University of Michigan.
8 * All rights reserved.
9 *
10 * Dug Song <dugsong@monkey.org>
11 * Andy Adamson <andros@umich.edu>
12 */
13
14#include <linux/module.h>
15#include <linux/init.h>
16#include <linux/types.h>
17#include <linux/slab.h>
18#include <linux/sched.h>
19#include <linux/pagemap.h>
20#include <linux/sunrpc/clnt.h>
21#include <linux/sunrpc/auth.h>
22#include <linux/sunrpc/auth_gss.h>
23#include <linux/sunrpc/gss_krb5.h>
24#include <linux/sunrpc/svcauth_gss.h>
25#include <linux/sunrpc/gss_err.h>
26#include <linux/workqueue.h>
27#include <linux/sunrpc/rpc_pipe_fs.h>
28#include <linux/sunrpc/gss_api.h>
29#include <linux/uaccess.h>
30#include <linux/hashtable.h>
31
32#include "auth_gss_internal.h"
33#include "../netns.h"
34
35#include <trace/events/rpcgss.h>
36
37static const struct rpc_authops authgss_ops;
38
39static const struct rpc_credops gss_credops;
40static const struct rpc_credops gss_nullops;
41
42#define GSS_RETRY_EXPIRED 5
43static unsigned int gss_expired_cred_retry_delay = GSS_RETRY_EXPIRED;
44
45#define GSS_KEY_EXPIRE_TIMEO 240
46static unsigned int gss_key_expire_timeo = GSS_KEY_EXPIRE_TIMEO;
47
48#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
49# define RPCDBG_FACILITY RPCDBG_AUTH
50#endif
51
52/*
53 * This compile-time check verifies that we will not exceed the
54 * slack space allotted by the client and server auth_gss code
55 * before they call gss_wrap().
56 */
57#define GSS_KRB5_MAX_SLACK_NEEDED \
58 (GSS_KRB5_TOK_HDR_LEN /* gss token header */ \
59 + GSS_KRB5_MAX_CKSUM_LEN /* gss token checksum */ \
60 + GSS_KRB5_MAX_BLOCKSIZE /* confounder */ \
61 + GSS_KRB5_MAX_BLOCKSIZE /* possible padding */ \
62 + GSS_KRB5_TOK_HDR_LEN /* encrypted hdr in v2 token */ \
63 + GSS_KRB5_MAX_CKSUM_LEN /* encryption hmac */ \
64 + XDR_UNIT * 2 /* RPC verifier */ \
65 + GSS_KRB5_TOK_HDR_LEN \
66 + GSS_KRB5_MAX_CKSUM_LEN)
67
68#define GSS_CRED_SLACK (RPC_MAX_AUTH_SIZE * 2)
69/* length of a krb5 verifier (48), plus data added before arguments when
70 * using integrity (two 4-byte integers): */
71#define GSS_VERF_SLACK 100
72
73static DEFINE_HASHTABLE(gss_auth_hash_table, 4);
74static DEFINE_SPINLOCK(gss_auth_hash_lock);
75
76struct gss_pipe {
77 struct rpc_pipe_dir_object pdo;
78 struct rpc_pipe *pipe;
79 struct rpc_clnt *clnt;
80 const char *name;
81 struct kref kref;
82};
83
84struct gss_auth {
85 struct kref kref;
86 struct hlist_node hash;
87 struct rpc_auth rpc_auth;
88 struct gss_api_mech *mech;
89 enum rpc_gss_svc service;
90 struct rpc_clnt *client;
91 struct net *net;
92 netns_tracker ns_tracker;
93 /*
94 * There are two upcall pipes; dentry[1], named "gssd", is used
95 * for the new text-based upcall; dentry[0] is named after the
96 * mechanism (for example, "krb5") and exists for
97 * backwards-compatibility with older gssd's.
98 */
99 struct gss_pipe *gss_pipe[2];
100 const char *target_name;
101};
102
103/* pipe_version >= 0 if and only if someone has a pipe open. */
104static DEFINE_SPINLOCK(pipe_version_lock);
105static struct rpc_wait_queue pipe_version_rpc_waitqueue;
106static DECLARE_WAIT_QUEUE_HEAD(pipe_version_waitqueue);
107static void gss_put_auth(struct gss_auth *gss_auth);
108
109static void gss_free_ctx(struct gss_cl_ctx *);
110static const struct rpc_pipe_ops gss_upcall_ops_v0;
111static const struct rpc_pipe_ops gss_upcall_ops_v1;
112
113static inline struct gss_cl_ctx *
114gss_get_ctx(struct gss_cl_ctx *ctx)
115{
116 refcount_inc(r: &ctx->count);
117 return ctx;
118}
119
120static inline void
121gss_put_ctx(struct gss_cl_ctx *ctx)
122{
123 if (refcount_dec_and_test(r: &ctx->count))
124 gss_free_ctx(ctx);
125}
126
127/* gss_cred_set_ctx:
128 * called by gss_upcall_callback and gss_create_upcall in order
129 * to set the gss context. The actual exchange of an old context
130 * and a new one is protected by the pipe->lock.
131 */
132static void
133gss_cred_set_ctx(struct rpc_cred *cred, struct gss_cl_ctx *ctx)
134{
135 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
136
137 if (!test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags))
138 return;
139 gss_get_ctx(ctx);
140 rcu_assign_pointer(gss_cred->gc_ctx, ctx);
141 set_bit(RPCAUTH_CRED_UPTODATE, addr: &cred->cr_flags);
142 smp_mb__before_atomic();
143 clear_bit(RPCAUTH_CRED_NEW, addr: &cred->cr_flags);
144}
145
146static struct gss_cl_ctx *
147gss_cred_get_ctx(struct rpc_cred *cred)
148{
149 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
150 struct gss_cl_ctx *ctx = NULL;
151
152 rcu_read_lock();
153 ctx = rcu_dereference(gss_cred->gc_ctx);
154 if (ctx)
155 gss_get_ctx(ctx);
156 rcu_read_unlock();
157 return ctx;
158}
159
160static struct gss_cl_ctx *
161gss_alloc_context(void)
162{
163 struct gss_cl_ctx *ctx;
164
165 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
166 if (ctx != NULL) {
167 ctx->gc_proc = RPC_GSS_PROC_DATA;
168 ctx->gc_seq = 1; /* NetApp 6.4R1 doesn't accept seq. no. 0 */
169 spin_lock_init(&ctx->gc_seq_lock);
170 refcount_set(r: &ctx->count,n: 1);
171 }
172 return ctx;
173}
174
175#define GSSD_MIN_TIMEOUT (60 * 60)
176static const void *
177gss_fill_context(const void *p, const void *end, struct gss_cl_ctx *ctx, struct gss_api_mech *gm)
178{
179 const void *q;
180 unsigned int seclen;
181 unsigned int timeout;
182 unsigned long now = jiffies;
183 u32 window_size;
184 int ret;
185
186 /* First unsigned int gives the remaining lifetime in seconds of the
187 * credential - e.g. the remaining TGT lifetime for Kerberos or
188 * the -t value passed to GSSD.
189 */
190 p = simple_get_bytes(p, end, res: &timeout, len: sizeof(timeout));
191 if (IS_ERR(ptr: p))
192 goto err;
193 if (timeout == 0)
194 timeout = GSSD_MIN_TIMEOUT;
195 ctx->gc_expiry = now + ((unsigned long)timeout * HZ);
196 /* Sequence number window. Determines the maximum number of
197 * simultaneous requests
198 */
199 p = simple_get_bytes(p, end, res: &window_size, len: sizeof(window_size));
200 if (IS_ERR(ptr: p))
201 goto err;
202 ctx->gc_win = window_size;
203 /* gssd signals an error by passing ctx->gc_win = 0: */
204 if (ctx->gc_win == 0) {
205 /*
206 * in which case, p points to an error code. Anything other
207 * than -EKEYEXPIRED gets converted to -EACCES.
208 */
209 p = simple_get_bytes(p, end, res: &ret, len: sizeof(ret));
210 if (!IS_ERR(ptr: p))
211 p = (ret == -EKEYEXPIRED) ? ERR_PTR(error: -EKEYEXPIRED) :
212 ERR_PTR(error: -EACCES);
213 goto err;
214 }
215 /* copy the opaque wire context */
216 p = simple_get_netobj(p, end, &ctx->gc_wire_ctx);
217 if (IS_ERR(ptr: p))
218 goto err;
219 /* import the opaque security context */
220 p = simple_get_bytes(p, end, res: &seclen, len: sizeof(seclen));
221 if (IS_ERR(ptr: p))
222 goto err;
223 q = (const void *)((const char *)p + seclen);
224 if (unlikely(q > end || q < p)) {
225 p = ERR_PTR(error: -EFAULT);
226 goto err;
227 }
228 ret = gss_import_sec_context(input_token: p, bufsize: seclen, mech: gm, ctx_id: &ctx->gc_gss_ctx, NULL, GFP_KERNEL);
229 if (ret < 0) {
230 trace_rpcgss_import_ctx(status: ret);
231 p = ERR_PTR(error: ret);
232 goto err;
233 }
234
235 /* is there any trailing data? */
236 if (q == end) {
237 p = q;
238 goto done;
239 }
240
241 /* pull in acceptor name (if there is one) */
242 p = simple_get_netobj(q, end, &ctx->gc_acceptor);
243 if (IS_ERR(ptr: p))
244 goto err;
245done:
246 trace_rpcgss_context(window_size, expiry: ctx->gc_expiry, now, timeout,
247 len: ctx->gc_acceptor.len, data: ctx->gc_acceptor.data);
248err:
249 return p;
250}
251
252/* XXX: Need some documentation about why UPCALL_BUF_LEN is so small.
253 * Is user space expecting no more than UPCALL_BUF_LEN bytes?
254 * Note that there are now _two_ NI_MAXHOST sized data items
255 * being passed in this string.
256 */
257#define UPCALL_BUF_LEN 256
258
259struct gss_upcall_msg {
260 refcount_t count;
261 kuid_t uid;
262 const char *service_name;
263 struct rpc_pipe_msg msg;
264 struct list_head list;
265 struct gss_auth *auth;
266 struct rpc_pipe *pipe;
267 struct rpc_wait_queue rpc_waitqueue;
268 wait_queue_head_t waitqueue;
269 struct gss_cl_ctx *ctx;
270 char databuf[UPCALL_BUF_LEN];
271};
272
273static int get_pipe_version(struct net *net)
274{
275 struct sunrpc_net *sn = net_generic(net, id: sunrpc_net_id);
276 int ret;
277
278 spin_lock(lock: &pipe_version_lock);
279 if (sn->pipe_version >= 0) {
280 atomic_inc(v: &sn->pipe_users);
281 ret = sn->pipe_version;
282 } else
283 ret = -EAGAIN;
284 spin_unlock(lock: &pipe_version_lock);
285 return ret;
286}
287
288static void put_pipe_version(struct net *net)
289{
290 struct sunrpc_net *sn = net_generic(net, id: sunrpc_net_id);
291
292 if (atomic_dec_and_lock(&sn->pipe_users, &pipe_version_lock)) {
293 sn->pipe_version = -1;
294 spin_unlock(lock: &pipe_version_lock);
295 }
296}
297
298static void
299gss_release_msg(struct gss_upcall_msg *gss_msg)
300{
301 struct net *net = gss_msg->auth->net;
302 if (!refcount_dec_and_test(r: &gss_msg->count))
303 return;
304 put_pipe_version(net);
305 BUG_ON(!list_empty(&gss_msg->list));
306 if (gss_msg->ctx != NULL)
307 gss_put_ctx(ctx: gss_msg->ctx);
308 rpc_destroy_wait_queue(&gss_msg->rpc_waitqueue);
309 gss_put_auth(gss_auth: gss_msg->auth);
310 kfree_const(x: gss_msg->service_name);
311 kfree(objp: gss_msg);
312}
313
314static struct gss_upcall_msg *
315__gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid, const struct gss_auth *auth)
316{
317 struct gss_upcall_msg *pos;
318 list_for_each_entry(pos, &pipe->in_downcall, list) {
319 if (!uid_eq(left: pos->uid, right: uid))
320 continue;
321 if (pos->auth->service != auth->service)
322 continue;
323 refcount_inc(r: &pos->count);
324 return pos;
325 }
326 return NULL;
327}
328
329/* Try to add an upcall to the pipefs queue.
330 * If an upcall owned by our uid already exists, then we return a reference
331 * to that upcall instead of adding the new upcall.
332 */
333static inline struct gss_upcall_msg *
334gss_add_msg(struct gss_upcall_msg *gss_msg)
335{
336 struct rpc_pipe *pipe = gss_msg->pipe;
337 struct gss_upcall_msg *old;
338
339 spin_lock(lock: &pipe->lock);
340 old = __gss_find_upcall(pipe, uid: gss_msg->uid, auth: gss_msg->auth);
341 if (old == NULL) {
342 refcount_inc(r: &gss_msg->count);
343 list_add(new: &gss_msg->list, head: &pipe->in_downcall);
344 } else
345 gss_msg = old;
346 spin_unlock(lock: &pipe->lock);
347 return gss_msg;
348}
349
350static void
351__gss_unhash_msg(struct gss_upcall_msg *gss_msg)
352{
353 list_del_init(entry: &gss_msg->list);
354 rpc_wake_up_status(&gss_msg->rpc_waitqueue, gss_msg->msg.errno);
355 wake_up_all(&gss_msg->waitqueue);
356 refcount_dec(r: &gss_msg->count);
357}
358
359static void
360gss_unhash_msg(struct gss_upcall_msg *gss_msg)
361{
362 struct rpc_pipe *pipe = gss_msg->pipe;
363
364 if (list_empty(head: &gss_msg->list))
365 return;
366 spin_lock(lock: &pipe->lock);
367 if (!list_empty(head: &gss_msg->list))
368 __gss_unhash_msg(gss_msg);
369 spin_unlock(lock: &pipe->lock);
370}
371
372static void
373gss_handle_downcall_result(struct gss_cred *gss_cred, struct gss_upcall_msg *gss_msg)
374{
375 switch (gss_msg->msg.errno) {
376 case 0:
377 if (gss_msg->ctx == NULL)
378 break;
379 clear_bit(RPCAUTH_CRED_NEGATIVE, addr: &gss_cred->gc_base.cr_flags);
380 gss_cred_set_ctx(cred: &gss_cred->gc_base, ctx: gss_msg->ctx);
381 break;
382 case -EKEYEXPIRED:
383 set_bit(RPCAUTH_CRED_NEGATIVE, addr: &gss_cred->gc_base.cr_flags);
384 }
385 gss_cred->gc_upcall_timestamp = jiffies;
386 gss_cred->gc_upcall = NULL;
387 rpc_wake_up_status(&gss_msg->rpc_waitqueue, gss_msg->msg.errno);
388}
389
390static void
391gss_upcall_callback(struct rpc_task *task)
392{
393 struct gss_cred *gss_cred = container_of(task->tk_rqstp->rq_cred,
394 struct gss_cred, gc_base);
395 struct gss_upcall_msg *gss_msg = gss_cred->gc_upcall;
396 struct rpc_pipe *pipe = gss_msg->pipe;
397
398 spin_lock(lock: &pipe->lock);
399 gss_handle_downcall_result(gss_cred, gss_msg);
400 spin_unlock(lock: &pipe->lock);
401 task->tk_status = gss_msg->msg.errno;
402 gss_release_msg(gss_msg);
403}
404
405static void gss_encode_v0_msg(struct gss_upcall_msg *gss_msg,
406 const struct cred *cred)
407{
408 struct user_namespace *userns = cred->user_ns;
409
410 uid_t uid = from_kuid_munged(to: userns, kuid: gss_msg->uid);
411 memcpy(to: gss_msg->databuf, from: &uid, len: sizeof(uid));
412 gss_msg->msg.data = gss_msg->databuf;
413 gss_msg->msg.len = sizeof(uid);
414
415 BUILD_BUG_ON(sizeof(uid) > sizeof(gss_msg->databuf));
416}
417
418static ssize_t
419gss_v0_upcall(struct file *file, struct rpc_pipe_msg *msg,
420 char __user *buf, size_t buflen)
421{
422 struct gss_upcall_msg *gss_msg = container_of(msg,
423 struct gss_upcall_msg,
424 msg);
425 if (msg->copied == 0)
426 gss_encode_v0_msg(gss_msg, cred: file->f_cred);
427 return rpc_pipe_generic_upcall(file, msg, buf, buflen);
428}
429
430static int gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
431 const char *service_name,
432 const char *target_name,
433 const struct cred *cred)
434{
435 struct user_namespace *userns = cred->user_ns;
436 struct gss_api_mech *mech = gss_msg->auth->mech;
437 char *p = gss_msg->databuf;
438 size_t buflen = sizeof(gss_msg->databuf);
439 int len;
440
441 len = scnprintf(buf: p, size: buflen, fmt: "mech=%s uid=%d", mech->gm_name,
442 from_kuid_munged(to: userns, kuid: gss_msg->uid));
443 buflen -= len;
444 p += len;
445 gss_msg->msg.len = len;
446
447 /*
448 * target= is a full service principal that names the remote
449 * identity that we are authenticating to.
450 */
451 if (target_name) {
452 len = scnprintf(buf: p, size: buflen, fmt: " target=%s", target_name);
453 buflen -= len;
454 p += len;
455 gss_msg->msg.len += len;
456 }
457
458 /*
459 * gssd uses service= and srchost= to select a matching key from
460 * the system's keytab to use as the source principal.
461 *
462 * service= is the service name part of the source principal,
463 * or "*" (meaning choose any).
464 *
465 * srchost= is the hostname part of the source principal. When
466 * not provided, gssd uses the local hostname.
467 */
468 if (service_name) {
469 char *c = strchr(service_name, '@');
470
471 if (!c)
472 len = scnprintf(buf: p, size: buflen, fmt: " service=%s",
473 service_name);
474 else
475 len = scnprintf(buf: p, size: buflen,
476 fmt: " service=%.*s srchost=%s",
477 (int)(c - service_name),
478 service_name, c + 1);
479 buflen -= len;
480 p += len;
481 gss_msg->msg.len += len;
482 }
483
484 if (mech->gm_upcall_enctypes) {
485 len = scnprintf(buf: p, size: buflen, fmt: " enctypes=%s",
486 mech->gm_upcall_enctypes);
487 buflen -= len;
488 p += len;
489 gss_msg->msg.len += len;
490 }
491 trace_rpcgss_upcall_msg(buf: gss_msg->databuf);
492 len = scnprintf(buf: p, size: buflen, fmt: "\n");
493 if (len == 0)
494 goto out_overflow;
495 gss_msg->msg.len += len;
496 gss_msg->msg.data = gss_msg->databuf;
497 return 0;
498out_overflow:
499 WARN_ON_ONCE(1);
500 return -ENOMEM;
501}
502
503static ssize_t
504gss_v1_upcall(struct file *file, struct rpc_pipe_msg *msg,
505 char __user *buf, size_t buflen)
506{
507 struct gss_upcall_msg *gss_msg = container_of(msg,
508 struct gss_upcall_msg,
509 msg);
510 int err;
511 if (msg->copied == 0) {
512 err = gss_encode_v1_msg(gss_msg,
513 service_name: gss_msg->service_name,
514 target_name: gss_msg->auth->target_name,
515 cred: file->f_cred);
516 if (err)
517 return err;
518 }
519 return rpc_pipe_generic_upcall(file, msg, buf, buflen);
520}
521
522static struct gss_upcall_msg *
523gss_alloc_msg(struct gss_auth *gss_auth,
524 kuid_t uid, const char *service_name)
525{
526 struct gss_upcall_msg *gss_msg;
527 int vers;
528 int err = -ENOMEM;
529
530 gss_msg = kzalloc(sizeof(*gss_msg), GFP_KERNEL);
531 if (gss_msg == NULL)
532 goto err;
533 vers = get_pipe_version(net: gss_auth->net);
534 err = vers;
535 if (err < 0)
536 goto err_free_msg;
537 gss_msg->pipe = gss_auth->gss_pipe[vers]->pipe;
538 INIT_LIST_HEAD(list: &gss_msg->list);
539 rpc_init_wait_queue(&gss_msg->rpc_waitqueue, "RPCSEC_GSS upcall waitq");
540 init_waitqueue_head(&gss_msg->waitqueue);
541 refcount_set(r: &gss_msg->count, n: 1);
542 gss_msg->uid = uid;
543 gss_msg->auth = gss_auth;
544 kref_get(kref: &gss_auth->kref);
545 if (service_name) {
546 gss_msg->service_name = kstrdup_const(s: service_name, GFP_KERNEL);
547 if (!gss_msg->service_name) {
548 err = -ENOMEM;
549 goto err_put_pipe_version;
550 }
551 }
552 return gss_msg;
553err_put_pipe_version:
554 put_pipe_version(net: gss_auth->net);
555err_free_msg:
556 kfree(objp: gss_msg);
557err:
558 return ERR_PTR(error: err);
559}
560
561static struct gss_upcall_msg *
562gss_setup_upcall(struct gss_auth *gss_auth, struct rpc_cred *cred)
563{
564 struct gss_cred *gss_cred = container_of(cred,
565 struct gss_cred, gc_base);
566 struct gss_upcall_msg *gss_new, *gss_msg;
567 kuid_t uid = cred->cr_cred->fsuid;
568
569 gss_new = gss_alloc_msg(gss_auth, uid, service_name: gss_cred->gc_principal);
570 if (IS_ERR(ptr: gss_new))
571 return gss_new;
572 gss_msg = gss_add_msg(gss_msg: gss_new);
573 if (gss_msg == gss_new) {
574 int res;
575 refcount_inc(r: &gss_msg->count);
576 res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg);
577 if (res) {
578 gss_unhash_msg(gss_msg: gss_new);
579 refcount_dec(r: &gss_msg->count);
580 gss_release_msg(gss_msg: gss_new);
581 gss_msg = ERR_PTR(error: res);
582 }
583 } else
584 gss_release_msg(gss_msg: gss_new);
585 return gss_msg;
586}
587
588static void warn_gssd(void)
589{
590 dprintk("AUTH_GSS upcall failed. Please check user daemon is running.\n");
591}
592
593static inline int
594gss_refresh_upcall(struct rpc_task *task)
595{
596 struct rpc_cred *cred = task->tk_rqstp->rq_cred;
597 struct gss_auth *gss_auth = container_of(cred->cr_auth,
598 struct gss_auth, rpc_auth);
599 struct gss_cred *gss_cred = container_of(cred,
600 struct gss_cred, gc_base);
601 struct gss_upcall_msg *gss_msg;
602 struct rpc_pipe *pipe;
603 int err = 0;
604
605 gss_msg = gss_setup_upcall(gss_auth, cred);
606 if (PTR_ERR(ptr: gss_msg) == -EAGAIN) {
607 /* XXX: warning on the first, under the assumption we
608 * shouldn't normally hit this case on a refresh. */
609 warn_gssd();
610 rpc_sleep_on_timeout(queue: &pipe_version_rpc_waitqueue,
611 task, NULL, timeout: jiffies + (15 * HZ));
612 err = -EAGAIN;
613 goto out;
614 }
615 if (IS_ERR(ptr: gss_msg)) {
616 err = PTR_ERR(ptr: gss_msg);
617 goto out;
618 }
619 pipe = gss_msg->pipe;
620 spin_lock(lock: &pipe->lock);
621 if (gss_cred->gc_upcall != NULL)
622 rpc_sleep_on(&gss_cred->gc_upcall->rpc_waitqueue, task, NULL);
623 else if (gss_msg->ctx == NULL && gss_msg->msg.errno >= 0) {
624 gss_cred->gc_upcall = gss_msg;
625 /* gss_upcall_callback will release the reference to gss_upcall_msg */
626 refcount_inc(r: &gss_msg->count);
627 rpc_sleep_on(&gss_msg->rpc_waitqueue, task, action: gss_upcall_callback);
628 } else {
629 gss_handle_downcall_result(gss_cred, gss_msg);
630 err = gss_msg->msg.errno;
631 }
632 spin_unlock(lock: &pipe->lock);
633 gss_release_msg(gss_msg);
634out:
635 trace_rpcgss_upcall_result(uid: from_kuid(to: &init_user_ns,
636 kuid: cred->cr_cred->fsuid), result: err);
637 return err;
638}
639
640static inline int
641gss_create_upcall(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
642{
643 struct net *net = gss_auth->net;
644 struct sunrpc_net *sn = net_generic(net, id: sunrpc_net_id);
645 struct rpc_pipe *pipe;
646 struct rpc_cred *cred = &gss_cred->gc_base;
647 struct gss_upcall_msg *gss_msg;
648 DEFINE_WAIT(wait);
649 int err;
650
651retry:
652 err = 0;
653 /* if gssd is down, just skip upcalling altogether */
654 if (!gssd_running(net)) {
655 warn_gssd();
656 err = -EACCES;
657 goto out;
658 }
659 gss_msg = gss_setup_upcall(gss_auth, cred);
660 if (PTR_ERR(ptr: gss_msg) == -EAGAIN) {
661 err = wait_event_interruptible_timeout(pipe_version_waitqueue,
662 sn->pipe_version >= 0, 15 * HZ);
663 if (sn->pipe_version < 0) {
664 warn_gssd();
665 err = -EACCES;
666 }
667 if (err < 0)
668 goto out;
669 goto retry;
670 }
671 if (IS_ERR(ptr: gss_msg)) {
672 err = PTR_ERR(ptr: gss_msg);
673 goto out;
674 }
675 pipe = gss_msg->pipe;
676 for (;;) {
677 prepare_to_wait(wq_head: &gss_msg->waitqueue, wq_entry: &wait, TASK_KILLABLE);
678 spin_lock(lock: &pipe->lock);
679 if (gss_msg->ctx != NULL || gss_msg->msg.errno < 0) {
680 break;
681 }
682 spin_unlock(lock: &pipe->lock);
683 if (fatal_signal_pending(current)) {
684 err = -ERESTARTSYS;
685 goto out_intr;
686 }
687 schedule();
688 }
689 if (gss_msg->ctx) {
690 trace_rpcgss_ctx_init(gc: gss_cred);
691 gss_cred_set_ctx(cred, ctx: gss_msg->ctx);
692 } else {
693 err = gss_msg->msg.errno;
694 }
695 spin_unlock(lock: &pipe->lock);
696out_intr:
697 finish_wait(wq_head: &gss_msg->waitqueue, wq_entry: &wait);
698 gss_release_msg(gss_msg);
699out:
700 trace_rpcgss_upcall_result(uid: from_kuid(to: &init_user_ns,
701 kuid: cred->cr_cred->fsuid), result: err);
702 return err;
703}
704
705static struct gss_upcall_msg *
706gss_find_downcall(struct rpc_pipe *pipe, kuid_t uid)
707{
708 struct gss_upcall_msg *pos;
709 list_for_each_entry(pos, &pipe->in_downcall, list) {
710 if (!uid_eq(left: pos->uid, right: uid))
711 continue;
712 if (!rpc_msg_is_inflight(msg: &pos->msg))
713 continue;
714 refcount_inc(r: &pos->count);
715 return pos;
716 }
717 return NULL;
718}
719
720#define MSG_BUF_MAXSIZE 1024
721
722static ssize_t
723gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
724{
725 const void *p, *end;
726 void *buf;
727 struct gss_upcall_msg *gss_msg;
728 struct rpc_pipe *pipe = RPC_I(inode: file_inode(f: filp))->pipe;
729 struct gss_cl_ctx *ctx;
730 uid_t id;
731 kuid_t uid;
732 ssize_t err = -EFBIG;
733
734 if (mlen > MSG_BUF_MAXSIZE)
735 goto out;
736 err = -ENOMEM;
737 buf = kmalloc(mlen, GFP_KERNEL);
738 if (!buf)
739 goto out;
740
741 err = -EFAULT;
742 if (copy_from_user(to: buf, from: src, n: mlen))
743 goto err;
744
745 end = (const void *)((char *)buf + mlen);
746 p = simple_get_bytes(p: buf, end, res: &id, len: sizeof(id));
747 if (IS_ERR(ptr: p)) {
748 err = PTR_ERR(ptr: p);
749 goto err;
750 }
751
752 uid = make_kuid(from: current_user_ns(), uid: id);
753 if (!uid_valid(uid)) {
754 err = -EINVAL;
755 goto err;
756 }
757
758 err = -ENOMEM;
759 ctx = gss_alloc_context();
760 if (ctx == NULL)
761 goto err;
762
763 err = -ENOENT;
764 /* Find a matching upcall */
765 spin_lock(lock: &pipe->lock);
766 gss_msg = gss_find_downcall(pipe, uid);
767 if (gss_msg == NULL) {
768 spin_unlock(lock: &pipe->lock);
769 goto err_put_ctx;
770 }
771 list_del_init(entry: &gss_msg->list);
772 spin_unlock(lock: &pipe->lock);
773
774 p = gss_fill_context(p, end, ctx, gm: gss_msg->auth->mech);
775 if (IS_ERR(ptr: p)) {
776 err = PTR_ERR(ptr: p);
777 switch (err) {
778 case -EACCES:
779 case -EKEYEXPIRED:
780 gss_msg->msg.errno = err;
781 err = mlen;
782 break;
783 case -EFAULT:
784 case -ENOMEM:
785 case -EINVAL:
786 case -ENOSYS:
787 gss_msg->msg.errno = -EAGAIN;
788 break;
789 default:
790 printk(KERN_CRIT "%s: bad return from "
791 "gss_fill_context: %zd\n", __func__, err);
792 gss_msg->msg.errno = -EIO;
793 }
794 goto err_release_msg;
795 }
796 gss_msg->ctx = gss_get_ctx(ctx);
797 err = mlen;
798
799err_release_msg:
800 spin_lock(lock: &pipe->lock);
801 __gss_unhash_msg(gss_msg);
802 spin_unlock(lock: &pipe->lock);
803 gss_release_msg(gss_msg);
804err_put_ctx:
805 gss_put_ctx(ctx);
806err:
807 kfree(objp: buf);
808out:
809 return err;
810}
811
812static int gss_pipe_open(struct inode *inode, int new_version)
813{
814 struct net *net = inode->i_sb->s_fs_info;
815 struct sunrpc_net *sn = net_generic(net, id: sunrpc_net_id);
816 int ret = 0;
817
818 spin_lock(lock: &pipe_version_lock);
819 if (sn->pipe_version < 0) {
820 /* First open of any gss pipe determines the version: */
821 sn->pipe_version = new_version;
822 rpc_wake_up(&pipe_version_rpc_waitqueue);
823 wake_up(&pipe_version_waitqueue);
824 } else if (sn->pipe_version != new_version) {
825 /* Trying to open a pipe of a different version */
826 ret = -EBUSY;
827 goto out;
828 }
829 atomic_inc(v: &sn->pipe_users);
830out:
831 spin_unlock(lock: &pipe_version_lock);
832 return ret;
833
834}
835
836static int gss_pipe_open_v0(struct inode *inode)
837{
838 return gss_pipe_open(inode, new_version: 0);
839}
840
841static int gss_pipe_open_v1(struct inode *inode)
842{
843 return gss_pipe_open(inode, new_version: 1);
844}
845
846static void
847gss_pipe_release(struct inode *inode)
848{
849 struct net *net = inode->i_sb->s_fs_info;
850 struct rpc_pipe *pipe = RPC_I(inode)->pipe;
851 struct gss_upcall_msg *gss_msg;
852
853restart:
854 spin_lock(lock: &pipe->lock);
855 list_for_each_entry(gss_msg, &pipe->in_downcall, list) {
856
857 if (!list_empty(head: &gss_msg->msg.list))
858 continue;
859 gss_msg->msg.errno = -EPIPE;
860 refcount_inc(r: &gss_msg->count);
861 __gss_unhash_msg(gss_msg);
862 spin_unlock(lock: &pipe->lock);
863 gss_release_msg(gss_msg);
864 goto restart;
865 }
866 spin_unlock(lock: &pipe->lock);
867
868 put_pipe_version(net);
869}
870
871static void
872gss_pipe_destroy_msg(struct rpc_pipe_msg *msg)
873{
874 struct gss_upcall_msg *gss_msg = container_of(msg, struct gss_upcall_msg, msg);
875
876 if (msg->errno < 0) {
877 refcount_inc(r: &gss_msg->count);
878 gss_unhash_msg(gss_msg);
879 if (msg->errno == -ETIMEDOUT)
880 warn_gssd();
881 gss_release_msg(gss_msg);
882 }
883 gss_release_msg(gss_msg);
884}
885
886static void gss_pipe_dentry_destroy(struct dentry *dir,
887 struct rpc_pipe_dir_object *pdo)
888{
889 struct gss_pipe *gss_pipe = pdo->pdo_data;
890
891 rpc_unlink(gss_pipe->pipe);
892}
893
894static int gss_pipe_dentry_create(struct dentry *dir,
895 struct rpc_pipe_dir_object *pdo)
896{
897 struct gss_pipe *p = pdo->pdo_data;
898
899 return rpc_mkpipe_dentry(dir, p->name, p->clnt, p->pipe);
900}
901
902static const struct rpc_pipe_dir_object_ops gss_pipe_dir_object_ops = {
903 .create = gss_pipe_dentry_create,
904 .destroy = gss_pipe_dentry_destroy,
905};
906
907static struct gss_pipe *gss_pipe_alloc(struct rpc_clnt *clnt,
908 const char *name,
909 const struct rpc_pipe_ops *upcall_ops)
910{
911 struct gss_pipe *p;
912 int err = -ENOMEM;
913
914 p = kmalloc(sizeof(*p), GFP_KERNEL);
915 if (p == NULL)
916 goto err;
917 p->pipe = rpc_mkpipe_data(ops: upcall_ops, RPC_PIPE_WAIT_FOR_OPEN);
918 if (IS_ERR(ptr: p->pipe)) {
919 err = PTR_ERR(ptr: p->pipe);
920 goto err_free_gss_pipe;
921 }
922 p->name = name;
923 p->clnt = clnt;
924 kref_init(kref: &p->kref);
925 rpc_init_pipe_dir_object(pdo: &p->pdo,
926 pdo_ops: &gss_pipe_dir_object_ops,
927 pdo_data: p);
928 return p;
929err_free_gss_pipe:
930 kfree(objp: p);
931err:
932 return ERR_PTR(error: err);
933}
934
935struct gss_alloc_pdo {
936 struct rpc_clnt *clnt;
937 const char *name;
938 const struct rpc_pipe_ops *upcall_ops;
939};
940
941static int gss_pipe_match_pdo(struct rpc_pipe_dir_object *pdo, void *data)
942{
943 struct gss_pipe *gss_pipe;
944 struct gss_alloc_pdo *args = data;
945
946 if (pdo->pdo_ops != &gss_pipe_dir_object_ops)
947 return 0;
948 gss_pipe = container_of(pdo, struct gss_pipe, pdo);
949 if (strcmp(gss_pipe->name, args->name) != 0)
950 return 0;
951 if (!kref_get_unless_zero(kref: &gss_pipe->kref))
952 return 0;
953 return 1;
954}
955
956static struct rpc_pipe_dir_object *gss_pipe_alloc_pdo(void *data)
957{
958 struct gss_pipe *gss_pipe;
959 struct gss_alloc_pdo *args = data;
960
961 gss_pipe = gss_pipe_alloc(clnt: args->clnt, name: args->name, upcall_ops: args->upcall_ops);
962 if (!IS_ERR(ptr: gss_pipe))
963 return &gss_pipe->pdo;
964 return NULL;
965}
966
967static struct gss_pipe *gss_pipe_get(struct rpc_clnt *clnt,
968 const char *name,
969 const struct rpc_pipe_ops *upcall_ops)
970{
971 struct net *net = rpc_net_ns(clnt);
972 struct rpc_pipe_dir_object *pdo;
973 struct gss_alloc_pdo args = {
974 .clnt = clnt,
975 .name = name,
976 .upcall_ops = upcall_ops,
977 };
978
979 pdo = rpc_find_or_alloc_pipe_dir_object(net,
980 pdh: &clnt->cl_pipedir_objects,
981 match: gss_pipe_match_pdo,
982 alloc: gss_pipe_alloc_pdo,
983 data: &args);
984 if (pdo != NULL)
985 return container_of(pdo, struct gss_pipe, pdo);
986 return ERR_PTR(error: -ENOMEM);
987}
988
989static void __gss_pipe_free(struct gss_pipe *p)
990{
991 struct rpc_clnt *clnt = p->clnt;
992 struct net *net = rpc_net_ns(clnt);
993
994 rpc_remove_pipe_dir_object(net,
995 pdh: &clnt->cl_pipedir_objects,
996 pdo: &p->pdo);
997 rpc_destroy_pipe_data(pipe: p->pipe);
998 kfree(objp: p);
999}
1000
1001static void __gss_pipe_release(struct kref *kref)
1002{
1003 struct gss_pipe *p = container_of(kref, struct gss_pipe, kref);
1004
1005 __gss_pipe_free(p);
1006}
1007
1008static void gss_pipe_free(struct gss_pipe *p)
1009{
1010 if (p != NULL)
1011 kref_put(kref: &p->kref, release: __gss_pipe_release);
1012}
1013
1014/*
1015 * NOTE: we have the opportunity to use different
1016 * parameters based on the input flavor (which must be a pseudoflavor)
1017 */
1018static struct gss_auth *
1019gss_create_new(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
1020{
1021 rpc_authflavor_t flavor = args->pseudoflavor;
1022 struct gss_auth *gss_auth;
1023 struct gss_pipe *gss_pipe;
1024 struct rpc_auth * auth;
1025 int err = -ENOMEM; /* XXX? */
1026
1027 if (!try_module_get(THIS_MODULE))
1028 return ERR_PTR(error: err);
1029 if (!(gss_auth = kmalloc(sizeof(*gss_auth), GFP_KERNEL)))
1030 goto out_dec;
1031 INIT_HLIST_NODE(h: &gss_auth->hash);
1032 gss_auth->target_name = NULL;
1033 if (args->target_name) {
1034 gss_auth->target_name = kstrdup(s: args->target_name, GFP_KERNEL);
1035 if (gss_auth->target_name == NULL)
1036 goto err_free;
1037 }
1038 gss_auth->client = clnt;
1039 gss_auth->net = get_net_track(net: rpc_net_ns(clnt), tracker: &gss_auth->ns_tracker,
1040 GFP_KERNEL);
1041 err = -EINVAL;
1042 gss_auth->mech = gss_mech_get_by_pseudoflavor(flavor);
1043 if (!gss_auth->mech)
1044 goto err_put_net;
1045 gss_auth->service = gss_pseudoflavor_to_service(gss_auth->mech, pseudoflavor: flavor);
1046 if (gss_auth->service == 0)
1047 goto err_put_mech;
1048 if (!gssd_running(net: gss_auth->net))
1049 goto err_put_mech;
1050 auth = &gss_auth->rpc_auth;
1051 auth->au_cslack = GSS_CRED_SLACK >> 2;
1052 BUILD_BUG_ON(GSS_KRB5_MAX_SLACK_NEEDED > RPC_MAX_AUTH_SIZE);
1053 auth->au_rslack = GSS_KRB5_MAX_SLACK_NEEDED >> 2;
1054 auth->au_verfsize = GSS_VERF_SLACK >> 2;
1055 auth->au_ralign = GSS_VERF_SLACK >> 2;
1056 __set_bit(RPCAUTH_AUTH_UPDATE_SLACK, &auth->au_flags);
1057 auth->au_ops = &authgss_ops;
1058 auth->au_flavor = flavor;
1059 if (gss_pseudoflavor_to_datatouch(gss_auth->mech, pseudoflavor: flavor))
1060 __set_bit(RPCAUTH_AUTH_DATATOUCH, &auth->au_flags);
1061 refcount_set(r: &auth->au_count, n: 1);
1062 kref_init(kref: &gss_auth->kref);
1063
1064 err = rpcauth_init_credcache(auth);
1065 if (err)
1066 goto err_put_mech;
1067 /*
1068 * Note: if we created the old pipe first, then someone who
1069 * examined the directory at the right moment might conclude
1070 * that we supported only the old pipe. So we instead create
1071 * the new pipe first.
1072 */
1073 gss_pipe = gss_pipe_get(clnt, name: "gssd", upcall_ops: &gss_upcall_ops_v1);
1074 if (IS_ERR(ptr: gss_pipe)) {
1075 err = PTR_ERR(ptr: gss_pipe);
1076 goto err_destroy_credcache;
1077 }
1078 gss_auth->gss_pipe[1] = gss_pipe;
1079
1080 gss_pipe = gss_pipe_get(clnt, name: gss_auth->mech->gm_name,
1081 upcall_ops: &gss_upcall_ops_v0);
1082 if (IS_ERR(ptr: gss_pipe)) {
1083 err = PTR_ERR(ptr: gss_pipe);
1084 goto err_destroy_pipe_1;
1085 }
1086 gss_auth->gss_pipe[0] = gss_pipe;
1087
1088 return gss_auth;
1089err_destroy_pipe_1:
1090 gss_pipe_free(p: gss_auth->gss_pipe[1]);
1091err_destroy_credcache:
1092 rpcauth_destroy_credcache(auth);
1093err_put_mech:
1094 gss_mech_put(gss_auth->mech);
1095err_put_net:
1096 put_net_track(net: gss_auth->net, tracker: &gss_auth->ns_tracker);
1097err_free:
1098 kfree(objp: gss_auth->target_name);
1099 kfree(objp: gss_auth);
1100out_dec:
1101 module_put(THIS_MODULE);
1102 trace_rpcgss_createauth(flavor, error: err);
1103 return ERR_PTR(error: err);
1104}
1105
1106static void
1107gss_free(struct gss_auth *gss_auth)
1108{
1109 gss_pipe_free(p: gss_auth->gss_pipe[0]);
1110 gss_pipe_free(p: gss_auth->gss_pipe[1]);
1111 gss_mech_put(gss_auth->mech);
1112 put_net_track(net: gss_auth->net, tracker: &gss_auth->ns_tracker);
1113 kfree(objp: gss_auth->target_name);
1114
1115 kfree(objp: gss_auth);
1116 module_put(THIS_MODULE);
1117}
1118
1119static void
1120gss_free_callback(struct kref *kref)
1121{
1122 struct gss_auth *gss_auth = container_of(kref, struct gss_auth, kref);
1123
1124 gss_free(gss_auth);
1125}
1126
1127static void
1128gss_put_auth(struct gss_auth *gss_auth)
1129{
1130 kref_put(kref: &gss_auth->kref, release: gss_free_callback);
1131}
1132
1133static void
1134gss_destroy(struct rpc_auth *auth)
1135{
1136 struct gss_auth *gss_auth = container_of(auth,
1137 struct gss_auth, rpc_auth);
1138
1139 if (hash_hashed(node: &gss_auth->hash)) {
1140 spin_lock(lock: &gss_auth_hash_lock);
1141 hash_del(node: &gss_auth->hash);
1142 spin_unlock(lock: &gss_auth_hash_lock);
1143 }
1144
1145 gss_pipe_free(p: gss_auth->gss_pipe[0]);
1146 gss_auth->gss_pipe[0] = NULL;
1147 gss_pipe_free(p: gss_auth->gss_pipe[1]);
1148 gss_auth->gss_pipe[1] = NULL;
1149 rpcauth_destroy_credcache(auth);
1150
1151 gss_put_auth(gss_auth);
1152}
1153
1154/*
1155 * Auths may be shared between rpc clients that were cloned from a
1156 * common client with the same xprt, if they also share the flavor and
1157 * target_name.
1158 *
1159 * The auth is looked up from the oldest parent sharing the same
1160 * cl_xprt, and the auth itself references only that common parent
1161 * (which is guaranteed to last as long as any of its descendants).
1162 */
1163static struct gss_auth *
1164gss_auth_find_or_add_hashed(const struct rpc_auth_create_args *args,
1165 struct rpc_clnt *clnt,
1166 struct gss_auth *new)
1167{
1168 struct gss_auth *gss_auth;
1169 unsigned long hashval = (unsigned long)clnt;
1170
1171 spin_lock(lock: &gss_auth_hash_lock);
1172 hash_for_each_possible(gss_auth_hash_table,
1173 gss_auth,
1174 hash,
1175 hashval) {
1176 if (gss_auth->client != clnt)
1177 continue;
1178 if (gss_auth->rpc_auth.au_flavor != args->pseudoflavor)
1179 continue;
1180 if (gss_auth->target_name != args->target_name) {
1181 if (gss_auth->target_name == NULL)
1182 continue;
1183 if (args->target_name == NULL)
1184 continue;
1185 if (strcmp(gss_auth->target_name, args->target_name))
1186 continue;
1187 }
1188 if (!refcount_inc_not_zero(r: &gss_auth->rpc_auth.au_count))
1189 continue;
1190 goto out;
1191 }
1192 if (new)
1193 hash_add(gss_auth_hash_table, &new->hash, hashval);
1194 gss_auth = new;
1195out:
1196 spin_unlock(lock: &gss_auth_hash_lock);
1197 return gss_auth;
1198}
1199
1200static struct gss_auth *
1201gss_create_hashed(const struct rpc_auth_create_args *args,
1202 struct rpc_clnt *clnt)
1203{
1204 struct gss_auth *gss_auth;
1205 struct gss_auth *new;
1206
1207 gss_auth = gss_auth_find_or_add_hashed(args, clnt, NULL);
1208 if (gss_auth != NULL)
1209 goto out;
1210 new = gss_create_new(args, clnt);
1211 if (IS_ERR(ptr: new))
1212 return new;
1213 gss_auth = gss_auth_find_or_add_hashed(args, clnt, new);
1214 if (gss_auth != new)
1215 gss_destroy(auth: &new->rpc_auth);
1216out:
1217 return gss_auth;
1218}
1219
1220static struct rpc_auth *
1221gss_create(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
1222{
1223 struct gss_auth *gss_auth;
1224 struct rpc_xprt_switch *xps = rcu_access_pointer(clnt->cl_xpi.xpi_xpswitch);
1225
1226 while (clnt != clnt->cl_parent) {
1227 struct rpc_clnt *parent = clnt->cl_parent;
1228 /* Find the original parent for this transport */
1229 if (rcu_access_pointer(parent->cl_xpi.xpi_xpswitch) != xps)
1230 break;
1231 clnt = parent;
1232 }
1233
1234 gss_auth = gss_create_hashed(args, clnt);
1235 if (IS_ERR(ptr: gss_auth))
1236 return ERR_CAST(ptr: gss_auth);
1237 return &gss_auth->rpc_auth;
1238}
1239
1240static struct gss_cred *
1241gss_dup_cred(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
1242{
1243 struct gss_cred *new;
1244
1245 /* Make a copy of the cred so that we can reference count it */
1246 new = kzalloc(sizeof(*gss_cred), GFP_KERNEL);
1247 if (new) {
1248 struct auth_cred acred = {
1249 .cred = gss_cred->gc_base.cr_cred,
1250 };
1251 struct gss_cl_ctx *ctx =
1252 rcu_dereference_protected(gss_cred->gc_ctx, 1);
1253
1254 rpcauth_init_cred(&new->gc_base, &acred,
1255 &gss_auth->rpc_auth,
1256 &gss_nullops);
1257 new->gc_base.cr_flags = 1UL << RPCAUTH_CRED_UPTODATE;
1258 new->gc_service = gss_cred->gc_service;
1259 new->gc_principal = gss_cred->gc_principal;
1260 kref_get(kref: &gss_auth->kref);
1261 rcu_assign_pointer(new->gc_ctx, ctx);
1262 gss_get_ctx(ctx);
1263 }
1264 return new;
1265}
1266
1267/*
1268 * gss_send_destroy_context will cause the RPCSEC_GSS to send a NULL RPC call
1269 * to the server with the GSS control procedure field set to
1270 * RPC_GSS_PROC_DESTROY. This should normally cause the server to release
1271 * all RPCSEC_GSS state associated with that context.
1272 */
1273static void
1274gss_send_destroy_context(struct rpc_cred *cred)
1275{
1276 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1277 struct gss_auth *gss_auth = container_of(cred->cr_auth, struct gss_auth, rpc_auth);
1278 struct gss_cl_ctx *ctx = rcu_dereference_protected(gss_cred->gc_ctx, 1);
1279 struct gss_cred *new;
1280 struct rpc_task *task;
1281
1282 new = gss_dup_cred(gss_auth, gss_cred);
1283 if (new) {
1284 ctx->gc_proc = RPC_GSS_PROC_DESTROY;
1285
1286 trace_rpcgss_ctx_destroy(gc: gss_cred);
1287 task = rpc_call_null(clnt: gss_auth->client, cred: &new->gc_base,
1288 RPC_TASK_ASYNC);
1289 if (!IS_ERR(ptr: task))
1290 rpc_put_task(task);
1291
1292 put_rpccred(&new->gc_base);
1293 }
1294}
1295
1296/* gss_destroy_cred (and gss_free_ctx) are used to clean up after failure
1297 * to create a new cred or context, so they check that things have been
1298 * allocated before freeing them. */
1299static void
1300gss_do_free_ctx(struct gss_cl_ctx *ctx)
1301{
1302 gss_delete_sec_context(ctx_id: &ctx->gc_gss_ctx);
1303 kfree(objp: ctx->gc_wire_ctx.data);
1304 kfree(objp: ctx->gc_acceptor.data);
1305 kfree(objp: ctx);
1306}
1307
1308static void
1309gss_free_ctx_callback(struct rcu_head *head)
1310{
1311 struct gss_cl_ctx *ctx = container_of(head, struct gss_cl_ctx, gc_rcu);
1312 gss_do_free_ctx(ctx);
1313}
1314
1315static void
1316gss_free_ctx(struct gss_cl_ctx *ctx)
1317{
1318 call_rcu(head: &ctx->gc_rcu, func: gss_free_ctx_callback);
1319}
1320
1321static void
1322gss_free_cred(struct gss_cred *gss_cred)
1323{
1324 kfree(objp: gss_cred);
1325}
1326
1327static void
1328gss_free_cred_callback(struct rcu_head *head)
1329{
1330 struct gss_cred *gss_cred = container_of(head, struct gss_cred, gc_base.cr_rcu);
1331 gss_free_cred(gss_cred);
1332}
1333
1334static void
1335gss_destroy_nullcred(struct rpc_cred *cred)
1336{
1337 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1338 struct gss_auth *gss_auth = container_of(cred->cr_auth, struct gss_auth, rpc_auth);
1339 struct gss_cl_ctx *ctx = rcu_dereference_protected(gss_cred->gc_ctx, 1);
1340
1341 RCU_INIT_POINTER(gss_cred->gc_ctx, NULL);
1342 put_cred(cred: cred->cr_cred);
1343 call_rcu(head: &cred->cr_rcu, func: gss_free_cred_callback);
1344 if (ctx)
1345 gss_put_ctx(ctx);
1346 gss_put_auth(gss_auth);
1347}
1348
1349static void
1350gss_destroy_cred(struct rpc_cred *cred)
1351{
1352 if (test_and_clear_bit(RPCAUTH_CRED_UPTODATE, addr: &cred->cr_flags) != 0)
1353 gss_send_destroy_context(cred);
1354 gss_destroy_nullcred(cred);
1355}
1356
1357static int
1358gss_hash_cred(struct auth_cred *acred, unsigned int hashbits)
1359{
1360 return hash_64(val: from_kuid(to: &init_user_ns, kuid: acred->cred->fsuid), bits: hashbits);
1361}
1362
1363/*
1364 * Lookup RPCSEC_GSS cred for the current process
1365 */
1366static struct rpc_cred *gss_lookup_cred(struct rpc_auth *auth,
1367 struct auth_cred *acred, int flags)
1368{
1369 return rpcauth_lookup_credcache(auth, acred, flags,
1370 rpc_task_gfp_mask());
1371}
1372
1373static struct rpc_cred *
1374gss_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags, gfp_t gfp)
1375{
1376 struct gss_auth *gss_auth = container_of(auth, struct gss_auth, rpc_auth);
1377 struct gss_cred *cred = NULL;
1378 int err = -ENOMEM;
1379
1380 if (!(cred = kzalloc(sizeof(*cred), gfp)))
1381 goto out_err;
1382
1383 rpcauth_init_cred(&cred->gc_base, acred, auth, &gss_credops);
1384 /*
1385 * Note: in order to force a call to call_refresh(), we deliberately
1386 * fail to flag the credential as RPCAUTH_CRED_UPTODATE.
1387 */
1388 cred->gc_base.cr_flags = 1UL << RPCAUTH_CRED_NEW;
1389 cred->gc_service = gss_auth->service;
1390 cred->gc_principal = acred->principal;
1391 kref_get(kref: &gss_auth->kref);
1392 return &cred->gc_base;
1393
1394out_err:
1395 return ERR_PTR(error: err);
1396}
1397
1398static int
1399gss_cred_init(struct rpc_auth *auth, struct rpc_cred *cred)
1400{
1401 struct gss_auth *gss_auth = container_of(auth, struct gss_auth, rpc_auth);
1402 struct gss_cred *gss_cred = container_of(cred,struct gss_cred, gc_base);
1403 int err;
1404
1405 do {
1406 err = gss_create_upcall(gss_auth, gss_cred);
1407 } while (err == -EAGAIN);
1408 return err;
1409}
1410
1411static char *
1412gss_stringify_acceptor(struct rpc_cred *cred)
1413{
1414 char *string = NULL;
1415 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1416 struct gss_cl_ctx *ctx;
1417 unsigned int len;
1418 struct xdr_netobj *acceptor;
1419
1420 rcu_read_lock();
1421 ctx = rcu_dereference(gss_cred->gc_ctx);
1422 if (!ctx)
1423 goto out;
1424
1425 len = ctx->gc_acceptor.len;
1426 rcu_read_unlock();
1427
1428 /* no point if there's no string */
1429 if (!len)
1430 return NULL;
1431realloc:
1432 string = kmalloc(len + 1, GFP_KERNEL);
1433 if (!string)
1434 return NULL;
1435
1436 rcu_read_lock();
1437 ctx = rcu_dereference(gss_cred->gc_ctx);
1438
1439 /* did the ctx disappear or was it replaced by one with no acceptor? */
1440 if (!ctx || !ctx->gc_acceptor.len) {
1441 kfree(objp: string);
1442 string = NULL;
1443 goto out;
1444 }
1445
1446 acceptor = &ctx->gc_acceptor;
1447
1448 /*
1449 * Did we find a new acceptor that's longer than the original? Allocate
1450 * a longer buffer and try again.
1451 */
1452 if (len < acceptor->len) {
1453 len = acceptor->len;
1454 rcu_read_unlock();
1455 kfree(objp: string);
1456 goto realloc;
1457 }
1458
1459 memcpy(to: string, from: acceptor->data, len: acceptor->len);
1460 string[acceptor->len] = '\0';
1461out:
1462 rcu_read_unlock();
1463 return string;
1464}
1465
1466/*
1467 * Returns -EACCES if GSS context is NULL or will expire within the
1468 * timeout (miliseconds)
1469 */
1470static int
1471gss_key_timeout(struct rpc_cred *rc)
1472{
1473 struct gss_cred *gss_cred = container_of(rc, struct gss_cred, gc_base);
1474 struct gss_cl_ctx *ctx;
1475 unsigned long timeout = jiffies + (gss_key_expire_timeo * HZ);
1476 int ret = 0;
1477
1478 rcu_read_lock();
1479 ctx = rcu_dereference(gss_cred->gc_ctx);
1480 if (!ctx || time_after(timeout, ctx->gc_expiry))
1481 ret = -EACCES;
1482 rcu_read_unlock();
1483
1484 return ret;
1485}
1486
1487static int
1488gss_match(struct auth_cred *acred, struct rpc_cred *rc, int flags)
1489{
1490 struct gss_cred *gss_cred = container_of(rc, struct gss_cred, gc_base);
1491 struct gss_cl_ctx *ctx;
1492 int ret;
1493
1494 if (test_bit(RPCAUTH_CRED_NEW, &rc->cr_flags))
1495 goto out;
1496 /* Don't match with creds that have expired. */
1497 rcu_read_lock();
1498 ctx = rcu_dereference(gss_cred->gc_ctx);
1499 if (!ctx || time_after(jiffies, ctx->gc_expiry)) {
1500 rcu_read_unlock();
1501 return 0;
1502 }
1503 rcu_read_unlock();
1504 if (!test_bit(RPCAUTH_CRED_UPTODATE, &rc->cr_flags))
1505 return 0;
1506out:
1507 if (acred->principal != NULL) {
1508 if (gss_cred->gc_principal == NULL)
1509 return 0;
1510 ret = strcmp(acred->principal, gss_cred->gc_principal) == 0;
1511 } else {
1512 if (gss_cred->gc_principal != NULL)
1513 return 0;
1514 ret = uid_eq(left: rc->cr_cred->fsuid, right: acred->cred->fsuid);
1515 }
1516 return ret;
1517}
1518
1519/*
1520 * Marshal credentials.
1521 *
1522 * The expensive part is computing the verifier. We can't cache a
1523 * pre-computed version of the verifier because the seqno, which
1524 * is different every time, is included in the MIC.
1525 */
1526static int gss_marshal(struct rpc_task *task, struct xdr_stream *xdr)
1527{
1528 struct rpc_rqst *req = task->tk_rqstp;
1529 struct rpc_cred *cred = req->rq_cred;
1530 struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
1531 gc_base);
1532 struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
1533 __be32 *p, *cred_len;
1534 u32 maj_stat = 0;
1535 struct xdr_netobj mic;
1536 struct kvec iov;
1537 struct xdr_buf verf_buf;
1538 int status;
1539 u32 seqno;
1540
1541 /* Credential */
1542
1543 p = xdr_reserve_space(xdr, nbytes: 7 * sizeof(*p) +
1544 ctx->gc_wire_ctx.len);
1545 if (!p)
1546 goto marshal_failed;
1547 *p++ = rpc_auth_gss;
1548 cred_len = p++;
1549
1550 spin_lock(lock: &ctx->gc_seq_lock);
1551 seqno = (ctx->gc_seq < MAXSEQ) ? ctx->gc_seq++ : MAXSEQ;
1552 xprt_rqst_add_seqno(req, seqno);
1553 spin_unlock(lock: &ctx->gc_seq_lock);
1554 if (*req->rq_seqnos == MAXSEQ)
1555 goto expired;
1556 trace_rpcgss_seqno(task);
1557
1558 *p++ = cpu_to_be32(RPC_GSS_VERSION);
1559 *p++ = cpu_to_be32(ctx->gc_proc);
1560 *p++ = cpu_to_be32(*req->rq_seqnos);
1561 *p++ = cpu_to_be32(gss_cred->gc_service);
1562 p = xdr_encode_netobj(p, &ctx->gc_wire_ctx);
1563 *cred_len = cpu_to_be32((p - (cred_len + 1)) << 2);
1564
1565 /* Verifier */
1566
1567 /* We compute the checksum for the verifier over the xdr-encoded bytes
1568 * starting with the xid and ending at the end of the credential: */
1569 iov.iov_base = req->rq_snd_buf.head[0].iov_base;
1570 iov.iov_len = (u8 *)p - (u8 *)iov.iov_base;
1571 xdr_buf_from_iov(&iov, &verf_buf);
1572
1573 p = xdr_reserve_space(xdr, nbytes: sizeof(*p));
1574 if (!p)
1575 goto marshal_failed;
1576 *p++ = rpc_auth_gss;
1577 mic.data = (u8 *)(p + 1);
1578 maj_stat = gss_get_mic(ctx_id: ctx->gc_gss_ctx, message: &verf_buf, mic_token: &mic);
1579 if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1580 goto expired;
1581 else if (maj_stat != 0)
1582 goto bad_mic;
1583 if (xdr_stream_encode_opaque_inline(xdr, ptr: (void **)&p, len: mic.len) < 0)
1584 goto marshal_failed;
1585 status = 0;
1586out:
1587 gss_put_ctx(ctx);
1588 return status;
1589expired:
1590 clear_bit(RPCAUTH_CRED_UPTODATE, addr: &cred->cr_flags);
1591 status = -EKEYEXPIRED;
1592 goto out;
1593marshal_failed:
1594 status = -EMSGSIZE;
1595 goto out;
1596bad_mic:
1597 trace_rpcgss_get_mic(task, maj_stat);
1598 status = -EIO;
1599 goto out;
1600}
1601
1602static int gss_renew_cred(struct rpc_task *task)
1603{
1604 struct rpc_cred *oldcred = task->tk_rqstp->rq_cred;
1605 struct gss_cred *gss_cred = container_of(oldcred,
1606 struct gss_cred,
1607 gc_base);
1608 struct rpc_auth *auth = oldcred->cr_auth;
1609 struct auth_cred acred = {
1610 .cred = oldcred->cr_cred,
1611 .principal = gss_cred->gc_principal,
1612 };
1613 struct rpc_cred *new;
1614
1615 new = gss_lookup_cred(auth, acred: &acred, RPCAUTH_LOOKUP_NEW);
1616 if (IS_ERR(ptr: new))
1617 return PTR_ERR(ptr: new);
1618
1619 task->tk_rqstp->rq_cred = new;
1620 put_rpccred(oldcred);
1621 return 0;
1622}
1623
1624static int gss_cred_is_negative_entry(struct rpc_cred *cred)
1625{
1626 if (test_bit(RPCAUTH_CRED_NEGATIVE, &cred->cr_flags)) {
1627 unsigned long now = jiffies;
1628 unsigned long begin, expire;
1629 struct gss_cred *gss_cred;
1630
1631 gss_cred = container_of(cred, struct gss_cred, gc_base);
1632 begin = gss_cred->gc_upcall_timestamp;
1633 expire = begin + gss_expired_cred_retry_delay * HZ;
1634
1635 if (time_in_range_open(now, begin, expire))
1636 return 1;
1637 }
1638 return 0;
1639}
1640
1641/*
1642* Refresh credentials. XXX - finish
1643*/
1644static int
1645gss_refresh(struct rpc_task *task)
1646{
1647 struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1648 int ret = 0;
1649
1650 if (gss_cred_is_negative_entry(cred))
1651 return -EKEYEXPIRED;
1652
1653 if (!test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags) &&
1654 !test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags)) {
1655 ret = gss_renew_cred(task);
1656 if (ret < 0)
1657 goto out;
1658 cred = task->tk_rqstp->rq_cred;
1659 }
1660
1661 if (test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags))
1662 ret = gss_refresh_upcall(task);
1663out:
1664 return ret;
1665}
1666
1667/* Dummy refresh routine: used only when destroying the context */
1668static int
1669gss_refresh_null(struct rpc_task *task)
1670{
1671 return 0;
1672}
1673
1674static u32
1675gss_validate_seqno_mic(struct gss_cl_ctx *ctx, u32 seqno, __be32 *seq, __be32 *p, u32 len)
1676{
1677 struct kvec iov;
1678 struct xdr_buf verf_buf;
1679 struct xdr_netobj mic;
1680
1681 *seq = cpu_to_be32(seqno);
1682 iov.iov_base = seq;
1683 iov.iov_len = 4;
1684 xdr_buf_from_iov(&iov, &verf_buf);
1685 mic.data = (u8 *)p;
1686 mic.len = len;
1687 return gss_verify_mic(ctx_id: ctx->gc_gss_ctx, message: &verf_buf, mic_token: &mic);
1688}
1689
1690static int
1691gss_validate(struct rpc_task *task, struct xdr_stream *xdr)
1692{
1693 struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1694 struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
1695 __be32 *p, *seq = NULL;
1696 u32 len, maj_stat;
1697 int status;
1698 int i = 1; /* don't recheck the first item */
1699
1700 p = xdr_inline_decode(xdr, nbytes: 2 * sizeof(*p));
1701 if (!p)
1702 goto validate_failed;
1703 if (*p++ != rpc_auth_gss)
1704 goto validate_failed;
1705 len = be32_to_cpup(p);
1706 if (len > RPC_MAX_AUTH_SIZE)
1707 goto validate_failed;
1708 p = xdr_inline_decode(xdr, nbytes: len);
1709 if (!p)
1710 goto validate_failed;
1711
1712 seq = kmalloc(4, GFP_KERNEL);
1713 if (!seq)
1714 goto validate_failed;
1715 maj_stat = gss_validate_seqno_mic(ctx, seqno: task->tk_rqstp->rq_seqnos[0], seq, p, len);
1716 /* RFC 2203 5.3.3.1 - compute the checksum of each sequence number in the cache */
1717 while (unlikely(maj_stat == GSS_S_BAD_SIG && i < task->tk_rqstp->rq_seqno_count))
1718 maj_stat = gss_validate_seqno_mic(ctx, seqno: task->tk_rqstp->rq_seqnos[i++], seq, p, len);
1719 if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1720 clear_bit(RPCAUTH_CRED_UPTODATE, addr: &cred->cr_flags);
1721 if (maj_stat)
1722 goto bad_mic;
1723
1724 /* We leave it to unwrap to calculate au_rslack. For now we just
1725 * calculate the length of the verifier: */
1726 if (test_bit(RPCAUTH_AUTH_UPDATE_SLACK, &cred->cr_auth->au_flags))
1727 cred->cr_auth->au_verfsize = XDR_QUADLEN(len) + 2;
1728 status = 0;
1729out:
1730 gss_put_ctx(ctx);
1731 kfree(objp: seq);
1732 return status;
1733
1734validate_failed:
1735 status = -EIO;
1736 goto out;
1737bad_mic:
1738 trace_rpcgss_verify_mic(task, maj_stat);
1739 status = -EACCES;
1740 goto out;
1741}
1742
1743static noinline_for_stack int
1744gss_wrap_req_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
1745 struct rpc_task *task, struct xdr_stream *xdr)
1746{
1747 struct rpc_rqst *rqstp = task->tk_rqstp;
1748 struct xdr_buf integ_buf, *snd_buf = &rqstp->rq_snd_buf;
1749 struct xdr_netobj mic;
1750 __be32 *p, *integ_len;
1751 u32 offset, maj_stat;
1752
1753 p = xdr_reserve_space(xdr, nbytes: 2 * sizeof(*p));
1754 if (!p)
1755 goto wrap_failed;
1756 integ_len = p++;
1757 *p = cpu_to_be32(*rqstp->rq_seqnos);
1758
1759 if (rpcauth_wrap_req_encode(task, xdr))
1760 goto wrap_failed;
1761
1762 offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base;
1763 if (xdr_buf_subsegment(snd_buf, &integ_buf,
1764 offset, snd_buf->len - offset))
1765 goto wrap_failed;
1766 *integ_len = cpu_to_be32(integ_buf.len);
1767
1768 p = xdr_reserve_space(xdr, nbytes: 0);
1769 if (!p)
1770 goto wrap_failed;
1771 mic.data = (u8 *)(p + 1);
1772 maj_stat = gss_get_mic(ctx_id: ctx->gc_gss_ctx, message: &integ_buf, mic_token: &mic);
1773 if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1774 clear_bit(RPCAUTH_CRED_UPTODATE, addr: &cred->cr_flags);
1775 else if (maj_stat)
1776 goto bad_mic;
1777 /* Check that the trailing MIC fit in the buffer, after the fact */
1778 if (xdr_stream_encode_opaque_inline(xdr, ptr: (void **)&p, len: mic.len) < 0)
1779 goto wrap_failed;
1780 return 0;
1781wrap_failed:
1782 return -EMSGSIZE;
1783bad_mic:
1784 trace_rpcgss_get_mic(task, maj_stat);
1785 return -EIO;
1786}
1787
1788static void
1789priv_release_snd_buf(struct rpc_rqst *rqstp)
1790{
1791 int i;
1792
1793 for (i=0; i < rqstp->rq_enc_pages_num; i++)
1794 __free_page(rqstp->rq_enc_pages[i]);
1795 kfree(objp: rqstp->rq_enc_pages);
1796 rqstp->rq_release_snd_buf = NULL;
1797}
1798
1799static int
1800alloc_enc_pages(struct rpc_rqst *rqstp)
1801{
1802 struct xdr_buf *snd_buf = &rqstp->rq_snd_buf;
1803 int first, last, i;
1804
1805 if (rqstp->rq_release_snd_buf)
1806 rqstp->rq_release_snd_buf(rqstp);
1807
1808 if (snd_buf->page_len == 0) {
1809 rqstp->rq_enc_pages_num = 0;
1810 return 0;
1811 }
1812
1813 first = snd_buf->page_base >> PAGE_SHIFT;
1814 last = (snd_buf->page_base + snd_buf->page_len - 1) >> PAGE_SHIFT;
1815 rqstp->rq_enc_pages_num = last - first + 1 + 1;
1816 rqstp->rq_enc_pages
1817 = kmalloc_array(rqstp->rq_enc_pages_num,
1818 sizeof(struct page *),
1819 GFP_KERNEL);
1820 if (!rqstp->rq_enc_pages)
1821 goto out;
1822 for (i=0; i < rqstp->rq_enc_pages_num; i++) {
1823 rqstp->rq_enc_pages[i] = alloc_page(GFP_KERNEL);
1824 if (rqstp->rq_enc_pages[i] == NULL)
1825 goto out_free;
1826 }
1827 rqstp->rq_release_snd_buf = priv_release_snd_buf;
1828 return 0;
1829out_free:
1830 rqstp->rq_enc_pages_num = i;
1831 priv_release_snd_buf(rqstp);
1832out:
1833 return -EAGAIN;
1834}
1835
1836static noinline_for_stack int
1837gss_wrap_req_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
1838 struct rpc_task *task, struct xdr_stream *xdr)
1839{
1840 struct rpc_rqst *rqstp = task->tk_rqstp;
1841 struct xdr_buf *snd_buf = &rqstp->rq_snd_buf;
1842 u32 pad, offset, maj_stat;
1843 int status;
1844 __be32 *p, *opaque_len;
1845 struct page **inpages;
1846 int first;
1847 struct kvec *iov;
1848
1849 status = -EIO;
1850 p = xdr_reserve_space(xdr, nbytes: 2 * sizeof(*p));
1851 if (!p)
1852 goto wrap_failed;
1853 opaque_len = p++;
1854 *p = cpu_to_be32(*rqstp->rq_seqnos);
1855
1856 if (rpcauth_wrap_req_encode(task, xdr))
1857 goto wrap_failed;
1858
1859 status = alloc_enc_pages(rqstp);
1860 if (unlikely(status))
1861 goto wrap_failed;
1862 first = snd_buf->page_base >> PAGE_SHIFT;
1863 inpages = snd_buf->pages + first;
1864 snd_buf->pages = rqstp->rq_enc_pages;
1865 snd_buf->page_base -= first << PAGE_SHIFT;
1866 /*
1867 * Move the tail into its own page, in case gss_wrap needs
1868 * more space in the head when wrapping.
1869 *
1870 * Still... Why can't gss_wrap just slide the tail down?
1871 */
1872 if (snd_buf->page_len || snd_buf->tail[0].iov_len) {
1873 char *tmp;
1874
1875 tmp = page_address(rqstp->rq_enc_pages[rqstp->rq_enc_pages_num - 1]);
1876 memcpy(to: tmp, from: snd_buf->tail[0].iov_base, len: snd_buf->tail[0].iov_len);
1877 snd_buf->tail[0].iov_base = tmp;
1878 }
1879 offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base;
1880 maj_stat = gss_wrap(ctx_id: ctx->gc_gss_ctx, offset, outbuf: snd_buf, inpages);
1881 /* slack space should prevent this ever happening: */
1882 if (unlikely(snd_buf->len > snd_buf->buflen)) {
1883 status = -EIO;
1884 goto wrap_failed;
1885 }
1886 /* We're assuming that when GSS_S_CONTEXT_EXPIRED, the encryption was
1887 * done anyway, so it's safe to put the request on the wire: */
1888 if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1889 clear_bit(RPCAUTH_CRED_UPTODATE, addr: &cred->cr_flags);
1890 else if (maj_stat)
1891 goto bad_wrap;
1892
1893 *opaque_len = cpu_to_be32(snd_buf->len - offset);
1894 /* guess whether the pad goes into the head or the tail: */
1895 if (snd_buf->page_len || snd_buf->tail[0].iov_len)
1896 iov = snd_buf->tail;
1897 else
1898 iov = snd_buf->head;
1899 p = iov->iov_base + iov->iov_len;
1900 pad = xdr_pad_size(n: snd_buf->len - offset);
1901 memset(s: p, c: 0, n: pad);
1902 iov->iov_len += pad;
1903 snd_buf->len += pad;
1904
1905 return 0;
1906wrap_failed:
1907 return status;
1908bad_wrap:
1909 trace_rpcgss_wrap(task, maj_stat);
1910 return -EIO;
1911}
1912
1913static int gss_wrap_req(struct rpc_task *task, struct xdr_stream *xdr)
1914{
1915 struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1916 struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
1917 gc_base);
1918 struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
1919 int status;
1920
1921 status = -EIO;
1922 if (ctx->gc_proc != RPC_GSS_PROC_DATA) {
1923 /* The spec seems a little ambiguous here, but I think that not
1924 * wrapping context destruction requests makes the most sense.
1925 */
1926 status = rpcauth_wrap_req_encode(task, xdr);
1927 goto out;
1928 }
1929 switch (gss_cred->gc_service) {
1930 case RPC_GSS_SVC_NONE:
1931 status = rpcauth_wrap_req_encode(task, xdr);
1932 break;
1933 case RPC_GSS_SVC_INTEGRITY:
1934 status = gss_wrap_req_integ(cred, ctx, task, xdr);
1935 break;
1936 case RPC_GSS_SVC_PRIVACY:
1937 status = gss_wrap_req_priv(cred, ctx, task, xdr);
1938 break;
1939 default:
1940 status = -EIO;
1941 }
1942out:
1943 gss_put_ctx(ctx);
1944 return status;
1945}
1946
1947/**
1948 * gss_update_rslack - Possibly update RPC receive buffer size estimates
1949 * @task: rpc_task for incoming RPC Reply being unwrapped
1950 * @cred: controlling rpc_cred for @task
1951 * @before: XDR words needed before each RPC Reply message
1952 * @after: XDR words needed following each RPC Reply message
1953 *
1954 */
1955static void gss_update_rslack(struct rpc_task *task, struct rpc_cred *cred,
1956 unsigned int before, unsigned int after)
1957{
1958 struct rpc_auth *auth = cred->cr_auth;
1959
1960 if (test_and_clear_bit(RPCAUTH_AUTH_UPDATE_SLACK, addr: &auth->au_flags)) {
1961 auth->au_ralign = auth->au_verfsize + before;
1962 auth->au_rslack = auth->au_verfsize + after;
1963 trace_rpcgss_update_slack(task, auth);
1964 }
1965}
1966
1967static int
1968gss_unwrap_resp_auth(struct rpc_task *task, struct rpc_cred *cred)
1969{
1970 gss_update_rslack(task, cred, before: 0, after: 0);
1971 return 0;
1972}
1973
1974/*
1975 * RFC 2203, Section 5.3.2.2
1976 *
1977 * struct rpc_gss_integ_data {
1978 * opaque databody_integ<>;
1979 * opaque checksum<>;
1980 * };
1981 *
1982 * struct rpc_gss_data_t {
1983 * unsigned int seq_num;
1984 * proc_req_arg_t arg;
1985 * };
1986 */
1987static noinline_for_stack int
1988gss_unwrap_resp_integ(struct rpc_task *task, struct rpc_cred *cred,
1989 struct gss_cl_ctx *ctx, struct rpc_rqst *rqstp,
1990 struct xdr_stream *xdr)
1991{
1992 struct xdr_buf gss_data, *rcv_buf = &rqstp->rq_rcv_buf;
1993 u32 len, offset, seqno, maj_stat;
1994 struct xdr_netobj mic;
1995 int ret;
1996
1997 ret = -EIO;
1998 mic.data = NULL;
1999
2000 /* opaque databody_integ<>; */
2001 if (xdr_stream_decode_u32(xdr, ptr: &len))
2002 goto unwrap_failed;
2003 if (len & 3)
2004 goto unwrap_failed;
2005 offset = rcv_buf->len - xdr_stream_remaining(xdr);
2006 if (xdr_stream_decode_u32(xdr, ptr: &seqno))
2007 goto unwrap_failed;
2008 if (seqno != *rqstp->rq_seqnos)
2009 goto bad_seqno;
2010 if (xdr_buf_subsegment(rcv_buf, &gss_data, offset, len))
2011 goto unwrap_failed;
2012
2013 /*
2014 * The xdr_stream now points to the beginning of the
2015 * upper layer payload, to be passed below to
2016 * rpcauth_unwrap_resp_decode(). The checksum, which
2017 * follows the upper layer payload in @rcv_buf, is
2018 * located and parsed without updating the xdr_stream.
2019 */
2020
2021 /* opaque checksum<>; */
2022 offset += len;
2023 if (xdr_decode_word(rcv_buf, offset, &len))
2024 goto unwrap_failed;
2025 offset += sizeof(__be32);
2026 if (offset + len > rcv_buf->len)
2027 goto unwrap_failed;
2028 mic.len = len;
2029 mic.data = kmalloc(len, GFP_KERNEL);
2030 if (ZERO_OR_NULL_PTR(mic.data))
2031 goto unwrap_failed;
2032 if (read_bytes_from_xdr_buf(rcv_buf, offset, mic.data, mic.len))
2033 goto unwrap_failed;
2034
2035 maj_stat = gss_verify_mic(ctx_id: ctx->gc_gss_ctx, message: &gss_data, mic_token: &mic);
2036 if (maj_stat == GSS_S_CONTEXT_EXPIRED)
2037 clear_bit(RPCAUTH_CRED_UPTODATE, addr: &cred->cr_flags);
2038 if (maj_stat != GSS_S_COMPLETE)
2039 goto bad_mic;
2040
2041 gss_update_rslack(task, cred, before: 2, after: 2 + 1 + XDR_QUADLEN(mic.len));
2042 ret = 0;
2043
2044out:
2045 kfree(objp: mic.data);
2046 return ret;
2047
2048unwrap_failed:
2049 trace_rpcgss_unwrap_failed(task);
2050 goto out;
2051bad_seqno:
2052 trace_rpcgss_bad_seqno(task, expected: *rqstp->rq_seqnos, received: seqno);
2053 goto out;
2054bad_mic:
2055 trace_rpcgss_verify_mic(task, maj_stat);
2056 goto out;
2057}
2058
2059static noinline_for_stack int
2060gss_unwrap_resp_priv(struct rpc_task *task, struct rpc_cred *cred,
2061 struct gss_cl_ctx *ctx, struct rpc_rqst *rqstp,
2062 struct xdr_stream *xdr)
2063{
2064 struct xdr_buf *rcv_buf = &rqstp->rq_rcv_buf;
2065 struct kvec *head = rqstp->rq_rcv_buf.head;
2066 u32 offset, opaque_len, maj_stat;
2067 __be32 *p;
2068
2069 p = xdr_inline_decode(xdr, nbytes: 2 * sizeof(*p));
2070 if (unlikely(!p))
2071 goto unwrap_failed;
2072 opaque_len = be32_to_cpup(p: p++);
2073 offset = (u8 *)(p) - (u8 *)head->iov_base;
2074 if (offset + opaque_len > rcv_buf->len)
2075 goto unwrap_failed;
2076
2077 maj_stat = gss_unwrap(ctx_id: ctx->gc_gss_ctx, offset,
2078 len: offset + opaque_len, inbuf: rcv_buf);
2079 if (maj_stat == GSS_S_CONTEXT_EXPIRED)
2080 clear_bit(RPCAUTH_CRED_UPTODATE, addr: &cred->cr_flags);
2081 if (maj_stat != GSS_S_COMPLETE)
2082 goto bad_unwrap;
2083 /* gss_unwrap decrypted the sequence number */
2084 if (be32_to_cpup(p: p++) != *rqstp->rq_seqnos)
2085 goto bad_seqno;
2086
2087 /* gss_unwrap redacts the opaque blob from the head iovec.
2088 * rcv_buf has changed, thus the stream needs to be reset.
2089 */
2090 xdr_init_decode(xdr, buf: rcv_buf, p, rqst: rqstp);
2091
2092 gss_update_rslack(task, cred, before: 2 + ctx->gc_gss_ctx->align,
2093 after: 2 + ctx->gc_gss_ctx->slack);
2094
2095 return 0;
2096unwrap_failed:
2097 trace_rpcgss_unwrap_failed(task);
2098 return -EIO;
2099bad_seqno:
2100 trace_rpcgss_bad_seqno(task, expected: *rqstp->rq_seqnos, be32_to_cpup(p: --p));
2101 return -EIO;
2102bad_unwrap:
2103 trace_rpcgss_unwrap(task, maj_stat);
2104 return -EIO;
2105}
2106
2107static bool
2108gss_seq_is_newer(u32 new, u32 old)
2109{
2110 return (s32)(new - old) > 0;
2111}
2112
2113static bool
2114gss_xmit_need_reencode(struct rpc_task *task)
2115{
2116 struct rpc_rqst *req = task->tk_rqstp;
2117 struct rpc_cred *cred = req->rq_cred;
2118 struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
2119 u32 win, seq_xmit = 0;
2120 bool ret = true;
2121
2122 if (!ctx)
2123 goto out;
2124
2125 if (gss_seq_is_newer(new: *req->rq_seqnos, READ_ONCE(ctx->gc_seq)))
2126 goto out_ctx;
2127
2128 seq_xmit = READ_ONCE(ctx->gc_seq_xmit);
2129 while (gss_seq_is_newer(new: *req->rq_seqnos, old: seq_xmit)) {
2130 u32 tmp = seq_xmit;
2131
2132 seq_xmit = cmpxchg(&ctx->gc_seq_xmit, tmp, *req->rq_seqnos);
2133 if (seq_xmit == tmp) {
2134 ret = false;
2135 goto out_ctx;
2136 }
2137 }
2138
2139 win = ctx->gc_win;
2140 if (win > 0)
2141 ret = !gss_seq_is_newer(new: *req->rq_seqnos, old: seq_xmit - win);
2142
2143out_ctx:
2144 gss_put_ctx(ctx);
2145out:
2146 trace_rpcgss_need_reencode(task, seq_xmit, ret);
2147 return ret;
2148}
2149
2150static int
2151gss_unwrap_resp(struct rpc_task *task, struct xdr_stream *xdr)
2152{
2153 struct rpc_rqst *rqstp = task->tk_rqstp;
2154 struct rpc_cred *cred = rqstp->rq_cred;
2155 struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
2156 gc_base);
2157 struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
2158 int status = -EIO;
2159
2160 if (ctx->gc_proc != RPC_GSS_PROC_DATA)
2161 goto out_decode;
2162 switch (gss_cred->gc_service) {
2163 case RPC_GSS_SVC_NONE:
2164 status = gss_unwrap_resp_auth(task, cred);
2165 break;
2166 case RPC_GSS_SVC_INTEGRITY:
2167 status = gss_unwrap_resp_integ(task, cred, ctx, rqstp, xdr);
2168 break;
2169 case RPC_GSS_SVC_PRIVACY:
2170 status = gss_unwrap_resp_priv(task, cred, ctx, rqstp, xdr);
2171 break;
2172 }
2173 if (status)
2174 goto out;
2175
2176out_decode:
2177 status = rpcauth_unwrap_resp_decode(task, xdr);
2178out:
2179 gss_put_ctx(ctx);
2180 return status;
2181}
2182
2183static const struct rpc_authops authgss_ops = {
2184 .owner = THIS_MODULE,
2185 .au_flavor = RPC_AUTH_GSS,
2186 .au_name = "RPCSEC_GSS",
2187 .create = gss_create,
2188 .destroy = gss_destroy,
2189 .hash_cred = gss_hash_cred,
2190 .lookup_cred = gss_lookup_cred,
2191 .crcreate = gss_create_cred,
2192 .info2flavor = gss_mech_info2flavor,
2193 .flavor2info = gss_mech_flavor2info,
2194};
2195
2196static const struct rpc_credops gss_credops = {
2197 .cr_name = "AUTH_GSS",
2198 .crdestroy = gss_destroy_cred,
2199 .cr_init = gss_cred_init,
2200 .crmatch = gss_match,
2201 .crmarshal = gss_marshal,
2202 .crrefresh = gss_refresh,
2203 .crvalidate = gss_validate,
2204 .crwrap_req = gss_wrap_req,
2205 .crunwrap_resp = gss_unwrap_resp,
2206 .crkey_timeout = gss_key_timeout,
2207 .crstringify_acceptor = gss_stringify_acceptor,
2208 .crneed_reencode = gss_xmit_need_reencode,
2209};
2210
2211static const struct rpc_credops gss_nullops = {
2212 .cr_name = "AUTH_GSS",
2213 .crdestroy = gss_destroy_nullcred,
2214 .crmatch = gss_match,
2215 .crmarshal = gss_marshal,
2216 .crrefresh = gss_refresh_null,
2217 .crvalidate = gss_validate,
2218 .crwrap_req = gss_wrap_req,
2219 .crunwrap_resp = gss_unwrap_resp,
2220 .crstringify_acceptor = gss_stringify_acceptor,
2221};
2222
2223static const struct rpc_pipe_ops gss_upcall_ops_v0 = {
2224 .upcall = gss_v0_upcall,
2225 .downcall = gss_pipe_downcall,
2226 .destroy_msg = gss_pipe_destroy_msg,
2227 .open_pipe = gss_pipe_open_v0,
2228 .release_pipe = gss_pipe_release,
2229};
2230
2231static const struct rpc_pipe_ops gss_upcall_ops_v1 = {
2232 .upcall = gss_v1_upcall,
2233 .downcall = gss_pipe_downcall,
2234 .destroy_msg = gss_pipe_destroy_msg,
2235 .open_pipe = gss_pipe_open_v1,
2236 .release_pipe = gss_pipe_release,
2237};
2238
2239static __net_init int rpcsec_gss_init_net(struct net *net)
2240{
2241 return gss_svc_init_net(net);
2242}
2243
2244static __net_exit void rpcsec_gss_exit_net(struct net *net)
2245{
2246 gss_svc_shutdown_net(net);
2247}
2248
2249static struct pernet_operations rpcsec_gss_net_ops = {
2250 .init = rpcsec_gss_init_net,
2251 .exit = rpcsec_gss_exit_net,
2252};
2253
2254/*
2255 * Initialize RPCSEC_GSS module
2256 */
2257static int __init init_rpcsec_gss(void)
2258{
2259 int err = 0;
2260
2261 err = rpcauth_register(&authgss_ops);
2262 if (err)
2263 goto out;
2264 err = gss_svc_init();
2265 if (err)
2266 goto out_unregister;
2267 err = register_pernet_subsys(&rpcsec_gss_net_ops);
2268 if (err)
2269 goto out_svc_exit;
2270 rpc_init_wait_queue(&pipe_version_rpc_waitqueue, "gss pipe version");
2271 return 0;
2272out_svc_exit:
2273 gss_svc_shutdown();
2274out_unregister:
2275 rpcauth_unregister(&authgss_ops);
2276out:
2277 return err;
2278}
2279
2280static void __exit exit_rpcsec_gss(void)
2281{
2282 unregister_pernet_subsys(&rpcsec_gss_net_ops);
2283 gss_svc_shutdown();
2284 rpcauth_unregister(&authgss_ops);
2285 rcu_barrier(); /* Wait for completion of call_rcu()'s */
2286}
2287
2288MODULE_ALIAS("rpc-auth-6");
2289MODULE_DESCRIPTION("Sun RPC Kerberos RPCSEC_GSS client authentication");
2290MODULE_LICENSE("GPL");
2291module_param_named(expired_cred_retry_delay,
2292 gss_expired_cred_retry_delay,
2293 uint, 0644);
2294MODULE_PARM_DESC(expired_cred_retry_delay, "Timeout (in seconds) until "
2295 "the RPC engine retries an expired credential");
2296
2297module_param_named(key_expire_timeo,
2298 gss_key_expire_timeo,
2299 uint, 0644);
2300MODULE_PARM_DESC(key_expire_timeo, "Time (in seconds) at the end of a "
2301 "credential keys lifetime where the NFS layer cleans up "
2302 "prior to key expiration");
2303
2304module_init(init_rpcsec_gss)
2305module_exit(exit_rpcsec_gss)
2306