1 /* 2 * linux/net/sunrpc/auth.c 3 * 4 * Generic RPC client authentication API. 5 * 6 * Copyright (C) 1996, Olaf Kirch <okir@monad.swb.de> 7 */ 8 9 #include <linux/types.h> 10 #include <linux/sched.h> 11 #include <linux/module.h> 12 #include <linux/slab.h> 13 #include <linux/errno.h> 14 #include <linux/hash.h> 15 #include <linux/sunrpc/clnt.h> 16 #include <linux/spinlock.h> 17 18 #ifdef RPC_DEBUG 19 # define RPCDBG_FACILITY RPCDBG_AUTH 20 #endif 21 22 static DEFINE_SPINLOCK(rpc_authflavor_lock); 23 static const struct rpc_authops *auth_flavors[RPC_AUTH_MAXFLAVOR] = { 24 &authnull_ops, /* AUTH_NULL */ 25 &authunix_ops, /* AUTH_UNIX */ 26 NULL, /* others can be loadable modules */ 27 }; 28 29 static LIST_HEAD(cred_unused); 30 static unsigned long number_cred_unused; 31 32 static u32 33 pseudoflavor_to_flavor(u32 flavor) { 34 if (flavor >= RPC_AUTH_MAXFLAVOR) 35 return RPC_AUTH_GSS; 36 return flavor; 37 } 38 39 int 40 rpcauth_register(const struct rpc_authops *ops) 41 { 42 rpc_authflavor_t flavor; 43 int ret = -EPERM; 44 45 if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR) 46 return -EINVAL; 47 spin_lock(&rpc_authflavor_lock); 48 if (auth_flavors[flavor] == NULL) { 49 auth_flavors[flavor] = ops; 50 ret = 0; 51 } 52 spin_unlock(&rpc_authflavor_lock); 53 return ret; 54 } 55 EXPORT_SYMBOL_GPL(rpcauth_register); 56 57 int 58 rpcauth_unregister(const struct rpc_authops *ops) 59 { 60 rpc_authflavor_t flavor; 61 int ret = -EPERM; 62 63 if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR) 64 return -EINVAL; 65 spin_lock(&rpc_authflavor_lock); 66 if (auth_flavors[flavor] == ops) { 67 auth_flavors[flavor] = NULL; 68 ret = 0; 69 } 70 spin_unlock(&rpc_authflavor_lock); 71 return ret; 72 } 73 EXPORT_SYMBOL_GPL(rpcauth_unregister); 74 75 struct rpc_auth * 76 rpcauth_create(rpc_authflavor_t pseudoflavor, struct rpc_clnt *clnt) 77 { 78 struct rpc_auth *auth; 79 const struct rpc_authops *ops; 80 u32 flavor = pseudoflavor_to_flavor(pseudoflavor); 81 82 auth = ERR_PTR(-EINVAL); 83 if (flavor >= RPC_AUTH_MAXFLAVOR) 84 goto out; 85 86 if ((ops = auth_flavors[flavor]) == NULL) 87 request_module("rpc-auth-%u", flavor); 88 spin_lock(&rpc_authflavor_lock); 89 ops = auth_flavors[flavor]; 90 if (ops == NULL || !try_module_get(ops->owner)) { 91 spin_unlock(&rpc_authflavor_lock); 92 goto out; 93 } 94 spin_unlock(&rpc_authflavor_lock); 95 auth = ops->create(clnt, pseudoflavor); 96 module_put(ops->owner); 97 if (IS_ERR(auth)) 98 return auth; 99 if (clnt->cl_auth) 100 rpcauth_release(clnt->cl_auth); 101 clnt->cl_auth = auth; 102 103 out: 104 return auth; 105 } 106 EXPORT_SYMBOL_GPL(rpcauth_create); 107 108 void 109 rpcauth_release(struct rpc_auth *auth) 110 { 111 if (!atomic_dec_and_test(&auth->au_count)) 112 return; 113 auth->au_ops->destroy(auth); 114 } 115 116 static DEFINE_SPINLOCK(rpc_credcache_lock); 117 118 static void 119 rpcauth_unhash_cred_locked(struct rpc_cred *cred) 120 { 121 hlist_del_rcu(&cred->cr_hash); 122 smp_mb__before_clear_bit(); 123 clear_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags); 124 } 125 126 static void 127 rpcauth_unhash_cred(struct rpc_cred *cred) 128 { 129 spinlock_t *cache_lock; 130 131 cache_lock = &cred->cr_auth->au_credcache->lock; 132 spin_lock(cache_lock); 133 if (atomic_read(&cred->cr_count) == 0) 134 rpcauth_unhash_cred_locked(cred); 135 spin_unlock(cache_lock); 136 } 137 138 /* 139 * Initialize RPC credential cache 140 */ 141 int 142 rpcauth_init_credcache(struct rpc_auth *auth) 143 { 144 struct rpc_cred_cache *new; 145 int i; 146 147 new = kmalloc(sizeof(*new), GFP_KERNEL); 148 if (!new) 149 return -ENOMEM; 150 for (i = 0; i < RPC_CREDCACHE_NR; i++) 151 INIT_HLIST_HEAD(&new->hashtable[i]); 152 spin_lock_init(&new->lock); 153 auth->au_credcache = new; 154 return 0; 155 } 156 EXPORT_SYMBOL_GPL(rpcauth_init_credcache); 157 158 /* 159 * Destroy a list of credentials 160 */ 161 static inline 162 void rpcauth_destroy_credlist(struct list_head *head) 163 { 164 struct rpc_cred *cred; 165 166 while (!list_empty(head)) { 167 cred = list_entry(head->next, struct rpc_cred, cr_lru); 168 list_del_init(&cred->cr_lru); 169 put_rpccred(cred); 170 } 171 } 172 173 /* 174 * Clear the RPC credential cache, and delete those credentials 175 * that are not referenced. 176 */ 177 void 178 rpcauth_clear_credcache(struct rpc_cred_cache *cache) 179 { 180 LIST_HEAD(free); 181 struct hlist_head *head; 182 struct rpc_cred *cred; 183 int i; 184 185 spin_lock(&rpc_credcache_lock); 186 spin_lock(&cache->lock); 187 for (i = 0; i < RPC_CREDCACHE_NR; i++) { 188 head = &cache->hashtable[i]; 189 while (!hlist_empty(head)) { 190 cred = hlist_entry(head->first, struct rpc_cred, cr_hash); 191 get_rpccred(cred); 192 if (!list_empty(&cred->cr_lru)) { 193 list_del(&cred->cr_lru); 194 number_cred_unused--; 195 } 196 list_add_tail(&cred->cr_lru, &free); 197 rpcauth_unhash_cred_locked(cred); 198 } 199 } 200 spin_unlock(&cache->lock); 201 spin_unlock(&rpc_credcache_lock); 202 rpcauth_destroy_credlist(&free); 203 } 204 205 /* 206 * Destroy the RPC credential cache 207 */ 208 void 209 rpcauth_destroy_credcache(struct rpc_auth *auth) 210 { 211 struct rpc_cred_cache *cache = auth->au_credcache; 212 213 if (cache) { 214 auth->au_credcache = NULL; 215 rpcauth_clear_credcache(cache); 216 kfree(cache); 217 } 218 } 219 EXPORT_SYMBOL_GPL(rpcauth_destroy_credcache); 220 221 222 #define RPC_AUTH_EXPIRY_MORATORIUM (60 * HZ) 223 224 /* 225 * Remove stale credentials. Avoid sleeping inside the loop. 226 */ 227 static int 228 rpcauth_prune_expired(struct list_head *free, int nr_to_scan) 229 { 230 spinlock_t *cache_lock; 231 struct rpc_cred *cred; 232 unsigned long expired = jiffies - RPC_AUTH_EXPIRY_MORATORIUM; 233 234 while (!list_empty(&cred_unused)) { 235 cred = list_entry(cred_unused.next, struct rpc_cred, cr_lru); 236 list_del_init(&cred->cr_lru); 237 number_cred_unused--; 238 if (atomic_read(&cred->cr_count) != 0) 239 continue; 240 /* Enforce a 5 second garbage collection moratorium */ 241 if (time_in_range(cred->cr_expire, expired, jiffies) && 242 test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0) 243 continue; 244 cache_lock = &cred->cr_auth->au_credcache->lock; 245 spin_lock(cache_lock); 246 if (atomic_read(&cred->cr_count) == 0) { 247 get_rpccred(cred); 248 list_add_tail(&cred->cr_lru, free); 249 rpcauth_unhash_cred_locked(cred); 250 nr_to_scan--; 251 } 252 spin_unlock(cache_lock); 253 if (nr_to_scan == 0) 254 break; 255 } 256 return nr_to_scan; 257 } 258 259 /* 260 * Run memory cache shrinker. 261 */ 262 static int 263 rpcauth_cache_shrinker(int nr_to_scan, gfp_t gfp_mask) 264 { 265 LIST_HEAD(free); 266 int res; 267 268 if (list_empty(&cred_unused)) 269 return 0; 270 spin_lock(&rpc_credcache_lock); 271 nr_to_scan = rpcauth_prune_expired(&free, nr_to_scan); 272 res = (number_cred_unused / 100) * sysctl_vfs_cache_pressure; 273 spin_unlock(&rpc_credcache_lock); 274 rpcauth_destroy_credlist(&free); 275 return res; 276 } 277 278 /* 279 * Look up a process' credentials in the authentication cache 280 */ 281 struct rpc_cred * 282 rpcauth_lookup_credcache(struct rpc_auth *auth, struct auth_cred * acred, 283 int flags) 284 { 285 LIST_HEAD(free); 286 struct rpc_cred_cache *cache = auth->au_credcache; 287 struct hlist_node *pos; 288 struct rpc_cred *cred = NULL, 289 *entry, *new; 290 unsigned int nr; 291 292 nr = hash_long(acred->uid, RPC_CREDCACHE_HASHBITS); 293 294 rcu_read_lock(); 295 hlist_for_each_entry_rcu(entry, pos, &cache->hashtable[nr], cr_hash) { 296 if (!entry->cr_ops->crmatch(acred, entry, flags)) 297 continue; 298 spin_lock(&cache->lock); 299 if (test_bit(RPCAUTH_CRED_HASHED, &entry->cr_flags) == 0) { 300 spin_unlock(&cache->lock); 301 continue; 302 } 303 cred = get_rpccred(entry); 304 spin_unlock(&cache->lock); 305 break; 306 } 307 rcu_read_unlock(); 308 309 if (cred != NULL) 310 goto found; 311 312 new = auth->au_ops->crcreate(auth, acred, flags); 313 if (IS_ERR(new)) { 314 cred = new; 315 goto out; 316 } 317 318 spin_lock(&cache->lock); 319 hlist_for_each_entry(entry, pos, &cache->hashtable[nr], cr_hash) { 320 if (!entry->cr_ops->crmatch(acred, entry, flags)) 321 continue; 322 cred = get_rpccred(entry); 323 break; 324 } 325 if (cred == NULL) { 326 cred = new; 327 set_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags); 328 hlist_add_head_rcu(&cred->cr_hash, &cache->hashtable[nr]); 329 } else 330 list_add_tail(&new->cr_lru, &free); 331 spin_unlock(&cache->lock); 332 found: 333 if (test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags) 334 && cred->cr_ops->cr_init != NULL 335 && !(flags & RPCAUTH_LOOKUP_NEW)) { 336 int res = cred->cr_ops->cr_init(auth, cred); 337 if (res < 0) { 338 put_rpccred(cred); 339 cred = ERR_PTR(res); 340 } 341 } 342 rpcauth_destroy_credlist(&free); 343 out: 344 return cred; 345 } 346 EXPORT_SYMBOL_GPL(rpcauth_lookup_credcache); 347 348 struct rpc_cred * 349 rpcauth_lookupcred(struct rpc_auth *auth, int flags) 350 { 351 struct auth_cred acred = { 352 .uid = current->fsuid, 353 .gid = current->fsgid, 354 .group_info = current->group_info, 355 }; 356 struct rpc_cred *ret; 357 358 dprintk("RPC: looking up %s cred\n", 359 auth->au_ops->au_name); 360 get_group_info(acred.group_info); 361 ret = auth->au_ops->lookup_cred(auth, &acred, flags); 362 put_group_info(acred.group_info); 363 return ret; 364 } 365 366 void 367 rpcauth_init_cred(struct rpc_cred *cred, const struct auth_cred *acred, 368 struct rpc_auth *auth, const struct rpc_credops *ops) 369 { 370 INIT_HLIST_NODE(&cred->cr_hash); 371 INIT_LIST_HEAD(&cred->cr_lru); 372 atomic_set(&cred->cr_count, 1); 373 cred->cr_auth = auth; 374 cred->cr_ops = ops; 375 cred->cr_expire = jiffies; 376 #ifdef RPC_DEBUG 377 cred->cr_magic = RPCAUTH_CRED_MAGIC; 378 #endif 379 cred->cr_uid = acred->uid; 380 } 381 EXPORT_SYMBOL_GPL(rpcauth_init_cred); 382 383 void 384 rpcauth_generic_bind_cred(struct rpc_task *task, struct rpc_cred *cred) 385 { 386 task->tk_msg.rpc_cred = get_rpccred(cred); 387 dprintk("RPC: %5u holding %s cred %p\n", task->tk_pid, 388 cred->cr_auth->au_ops->au_name, cred); 389 } 390 EXPORT_SYMBOL_GPL(rpcauth_generic_bind_cred); 391 392 static void 393 rpcauth_bind_root_cred(struct rpc_task *task) 394 { 395 struct rpc_auth *auth = task->tk_client->cl_auth; 396 struct auth_cred acred = { 397 .uid = 0, 398 .gid = 0, 399 }; 400 struct rpc_cred *ret; 401 402 dprintk("RPC: %5u looking up %s cred\n", 403 task->tk_pid, task->tk_client->cl_auth->au_ops->au_name); 404 ret = auth->au_ops->lookup_cred(auth, &acred, 0); 405 if (!IS_ERR(ret)) 406 task->tk_msg.rpc_cred = ret; 407 else 408 task->tk_status = PTR_ERR(ret); 409 } 410 411 static void 412 rpcauth_bind_new_cred(struct rpc_task *task) 413 { 414 struct rpc_auth *auth = task->tk_client->cl_auth; 415 struct rpc_cred *ret; 416 417 dprintk("RPC: %5u looking up %s cred\n", 418 task->tk_pid, auth->au_ops->au_name); 419 ret = rpcauth_lookupcred(auth, 0); 420 if (!IS_ERR(ret)) 421 task->tk_msg.rpc_cred = ret; 422 else 423 task->tk_status = PTR_ERR(ret); 424 } 425 426 void 427 rpcauth_bindcred(struct rpc_task *task, struct rpc_cred *cred, int flags) 428 { 429 if (cred != NULL) 430 cred->cr_ops->crbind(task, cred); 431 else if (flags & RPC_TASK_ROOTCREDS) 432 rpcauth_bind_root_cred(task); 433 else 434 rpcauth_bind_new_cred(task); 435 } 436 437 void 438 put_rpccred(struct rpc_cred *cred) 439 { 440 /* Fast path for unhashed credentials */ 441 if (test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) != 0) 442 goto need_lock; 443 444 if (!atomic_dec_and_test(&cred->cr_count)) 445 return; 446 goto out_destroy; 447 need_lock: 448 if (!atomic_dec_and_lock(&cred->cr_count, &rpc_credcache_lock)) 449 return; 450 if (!list_empty(&cred->cr_lru)) { 451 number_cred_unused--; 452 list_del_init(&cred->cr_lru); 453 } 454 if (test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) == 0) 455 rpcauth_unhash_cred(cred); 456 else if (test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) != 0) { 457 cred->cr_expire = jiffies; 458 list_add_tail(&cred->cr_lru, &cred_unused); 459 number_cred_unused++; 460 spin_unlock(&rpc_credcache_lock); 461 return; 462 } 463 spin_unlock(&rpc_credcache_lock); 464 out_destroy: 465 cred->cr_ops->crdestroy(cred); 466 } 467 EXPORT_SYMBOL_GPL(put_rpccred); 468 469 void 470 rpcauth_unbindcred(struct rpc_task *task) 471 { 472 struct rpc_cred *cred = task->tk_msg.rpc_cred; 473 474 dprintk("RPC: %5u releasing %s cred %p\n", 475 task->tk_pid, cred->cr_auth->au_ops->au_name, cred); 476 477 put_rpccred(cred); 478 task->tk_msg.rpc_cred = NULL; 479 } 480 481 __be32 * 482 rpcauth_marshcred(struct rpc_task *task, __be32 *p) 483 { 484 struct rpc_cred *cred = task->tk_msg.rpc_cred; 485 486 dprintk("RPC: %5u marshaling %s cred %p\n", 487 task->tk_pid, cred->cr_auth->au_ops->au_name, cred); 488 489 return cred->cr_ops->crmarshal(task, p); 490 } 491 492 __be32 * 493 rpcauth_checkverf(struct rpc_task *task, __be32 *p) 494 { 495 struct rpc_cred *cred = task->tk_msg.rpc_cred; 496 497 dprintk("RPC: %5u validating %s cred %p\n", 498 task->tk_pid, cred->cr_auth->au_ops->au_name, cred); 499 500 return cred->cr_ops->crvalidate(task, p); 501 } 502 503 int 504 rpcauth_wrap_req(struct rpc_task *task, kxdrproc_t encode, void *rqstp, 505 __be32 *data, void *obj) 506 { 507 struct rpc_cred *cred = task->tk_msg.rpc_cred; 508 509 dprintk("RPC: %5u using %s cred %p to wrap rpc data\n", 510 task->tk_pid, cred->cr_ops->cr_name, cred); 511 if (cred->cr_ops->crwrap_req) 512 return cred->cr_ops->crwrap_req(task, encode, rqstp, data, obj); 513 /* By default, we encode the arguments normally. */ 514 return rpc_call_xdrproc(encode, rqstp, data, obj); 515 } 516 517 int 518 rpcauth_unwrap_resp(struct rpc_task *task, kxdrproc_t decode, void *rqstp, 519 __be32 *data, void *obj) 520 { 521 struct rpc_cred *cred = task->tk_msg.rpc_cred; 522 523 dprintk("RPC: %5u using %s cred %p to unwrap rpc data\n", 524 task->tk_pid, cred->cr_ops->cr_name, cred); 525 if (cred->cr_ops->crunwrap_resp) 526 return cred->cr_ops->crunwrap_resp(task, decode, rqstp, 527 data, obj); 528 /* By default, we decode the arguments normally. */ 529 return rpc_call_xdrproc(decode, rqstp, data, obj); 530 } 531 532 int 533 rpcauth_refreshcred(struct rpc_task *task) 534 { 535 struct rpc_cred *cred = task->tk_msg.rpc_cred; 536 int err; 537 538 dprintk("RPC: %5u refreshing %s cred %p\n", 539 task->tk_pid, cred->cr_auth->au_ops->au_name, cred); 540 541 err = cred->cr_ops->crrefresh(task); 542 if (err < 0) 543 task->tk_status = err; 544 return err; 545 } 546 547 void 548 rpcauth_invalcred(struct rpc_task *task) 549 { 550 struct rpc_cred *cred = task->tk_msg.rpc_cred; 551 552 dprintk("RPC: %5u invalidating %s cred %p\n", 553 task->tk_pid, cred->cr_auth->au_ops->au_name, cred); 554 if (cred) 555 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags); 556 } 557 558 int 559 rpcauth_uptodatecred(struct rpc_task *task) 560 { 561 struct rpc_cred *cred = task->tk_msg.rpc_cred; 562 563 return cred == NULL || 564 test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0; 565 } 566 567 static struct shrinker rpc_cred_shrinker = { 568 .shrink = rpcauth_cache_shrinker, 569 .seeks = DEFAULT_SEEKS, 570 }; 571 572 void __init rpcauth_init_module(void) 573 { 574 rpc_init_authunix(); 575 rpc_init_generic_auth(); 576 register_shrinker(&rpc_cred_shrinker); 577 } 578 579 void __exit rpcauth_remove_module(void) 580 { 581 unregister_shrinker(&rpc_cred_shrinker); 582 } 583