1 /* 2 * linux/net/sunrpc/auth.c 3 * 4 * Generic RPC client authentication API. 5 * 6 * Copyright (C) 1996, Olaf Kirch <okir@monad.swb.de> 7 */ 8 9 #include <linux/types.h> 10 #include <linux/sched.h> 11 #include <linux/module.h> 12 #include <linux/slab.h> 13 #include <linux/errno.h> 14 #include <linux/sunrpc/clnt.h> 15 #include <linux/spinlock.h> 16 #include <linux/smp_lock.h> 17 18 #ifdef RPC_DEBUG 19 # define RPCDBG_FACILITY RPCDBG_AUTH 20 #endif 21 22 static DEFINE_SPINLOCK(rpc_authflavor_lock); 23 static const struct rpc_authops *auth_flavors[RPC_AUTH_MAXFLAVOR] = { 24 &authnull_ops, /* AUTH_NULL */ 25 &authunix_ops, /* AUTH_UNIX */ 26 NULL, /* others can be loadable modules */ 27 }; 28 29 static LIST_HEAD(cred_unused); 30 static unsigned long number_cred_unused; 31 32 static u32 33 pseudoflavor_to_flavor(u32 flavor) { 34 if (flavor >= RPC_AUTH_MAXFLAVOR) 35 return RPC_AUTH_GSS; 36 return flavor; 37 } 38 39 int 40 rpcauth_register(const struct rpc_authops *ops) 41 { 42 rpc_authflavor_t flavor; 43 int ret = -EPERM; 44 45 if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR) 46 return -EINVAL; 47 spin_lock(&rpc_authflavor_lock); 48 if (auth_flavors[flavor] == NULL) { 49 auth_flavors[flavor] = ops; 50 ret = 0; 51 } 52 spin_unlock(&rpc_authflavor_lock); 53 return ret; 54 } 55 56 int 57 rpcauth_unregister(const struct rpc_authops *ops) 58 { 59 rpc_authflavor_t flavor; 60 int ret = -EPERM; 61 62 if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR) 63 return -EINVAL; 64 spin_lock(&rpc_authflavor_lock); 65 if (auth_flavors[flavor] == ops) { 66 auth_flavors[flavor] = NULL; 67 ret = 0; 68 } 69 spin_unlock(&rpc_authflavor_lock); 70 return ret; 71 } 72 73 struct rpc_auth * 74 rpcauth_create(rpc_authflavor_t pseudoflavor, struct rpc_clnt *clnt) 75 { 76 struct rpc_auth *auth; 77 const struct rpc_authops *ops; 78 u32 flavor = pseudoflavor_to_flavor(pseudoflavor); 79 80 auth = ERR_PTR(-EINVAL); 81 if (flavor >= RPC_AUTH_MAXFLAVOR) 82 goto out; 83 84 #ifdef CONFIG_KMOD 85 if ((ops = auth_flavors[flavor]) == NULL) 86 request_module("rpc-auth-%u", flavor); 87 #endif 88 spin_lock(&rpc_authflavor_lock); 89 ops = auth_flavors[flavor]; 90 if (ops == NULL || !try_module_get(ops->owner)) { 91 spin_unlock(&rpc_authflavor_lock); 92 goto out; 93 } 94 spin_unlock(&rpc_authflavor_lock); 95 auth = ops->create(clnt, pseudoflavor); 96 module_put(ops->owner); 97 if (IS_ERR(auth)) 98 return auth; 99 if (clnt->cl_auth) 100 rpcauth_release(clnt->cl_auth); 101 clnt->cl_auth = auth; 102 103 out: 104 return auth; 105 } 106 107 void 108 rpcauth_release(struct rpc_auth *auth) 109 { 110 if (!atomic_dec_and_test(&auth->au_count)) 111 return; 112 auth->au_ops->destroy(auth); 113 } 114 115 static DEFINE_SPINLOCK(rpc_credcache_lock); 116 117 static void 118 rpcauth_unhash_cred_locked(struct rpc_cred *cred) 119 { 120 hlist_del_rcu(&cred->cr_hash); 121 smp_mb__before_clear_bit(); 122 clear_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags); 123 } 124 125 static void 126 rpcauth_unhash_cred(struct rpc_cred *cred) 127 { 128 spinlock_t *cache_lock; 129 130 cache_lock = &cred->cr_auth->au_credcache->lock; 131 spin_lock(cache_lock); 132 if (atomic_read(&cred->cr_count) == 0) 133 rpcauth_unhash_cred_locked(cred); 134 spin_unlock(cache_lock); 135 } 136 137 /* 138 * Initialize RPC credential cache 139 */ 140 int 141 rpcauth_init_credcache(struct rpc_auth *auth) 142 { 143 struct rpc_cred_cache *new; 144 int i; 145 146 new = kmalloc(sizeof(*new), GFP_KERNEL); 147 if (!new) 148 return -ENOMEM; 149 for (i = 0; i < RPC_CREDCACHE_NR; i++) 150 INIT_HLIST_HEAD(&new->hashtable[i]); 151 spin_lock_init(&new->lock); 152 auth->au_credcache = new; 153 return 0; 154 } 155 156 /* 157 * Destroy a list of credentials 158 */ 159 static inline 160 void rpcauth_destroy_credlist(struct list_head *head) 161 { 162 struct rpc_cred *cred; 163 164 while (!list_empty(head)) { 165 cred = list_entry(head->next, struct rpc_cred, cr_lru); 166 list_del_init(&cred->cr_lru); 167 put_rpccred(cred); 168 } 169 } 170 171 /* 172 * Clear the RPC credential cache, and delete those credentials 173 * that are not referenced. 174 */ 175 void 176 rpcauth_clear_credcache(struct rpc_cred_cache *cache) 177 { 178 LIST_HEAD(free); 179 struct hlist_head *head; 180 struct rpc_cred *cred; 181 int i; 182 183 spin_lock(&rpc_credcache_lock); 184 spin_lock(&cache->lock); 185 for (i = 0; i < RPC_CREDCACHE_NR; i++) { 186 head = &cache->hashtable[i]; 187 while (!hlist_empty(head)) { 188 cred = hlist_entry(head->first, struct rpc_cred, cr_hash); 189 get_rpccred(cred); 190 if (!list_empty(&cred->cr_lru)) { 191 list_del(&cred->cr_lru); 192 number_cred_unused--; 193 } 194 list_add_tail(&cred->cr_lru, &free); 195 rpcauth_unhash_cred_locked(cred); 196 } 197 } 198 spin_unlock(&cache->lock); 199 spin_unlock(&rpc_credcache_lock); 200 rpcauth_destroy_credlist(&free); 201 } 202 203 /* 204 * Destroy the RPC credential cache 205 */ 206 void 207 rpcauth_destroy_credcache(struct rpc_auth *auth) 208 { 209 struct rpc_cred_cache *cache = auth->au_credcache; 210 211 if (cache) { 212 auth->au_credcache = NULL; 213 rpcauth_clear_credcache(cache); 214 kfree(cache); 215 } 216 } 217 218 /* 219 * Remove stale credentials. Avoid sleeping inside the loop. 220 */ 221 static int 222 rpcauth_prune_expired(struct list_head *free, int nr_to_scan) 223 { 224 spinlock_t *cache_lock; 225 struct rpc_cred *cred; 226 227 while (!list_empty(&cred_unused)) { 228 cred = list_entry(cred_unused.next, struct rpc_cred, cr_lru); 229 list_del_init(&cred->cr_lru); 230 number_cred_unused--; 231 if (atomic_read(&cred->cr_count) != 0) 232 continue; 233 cache_lock = &cred->cr_auth->au_credcache->lock; 234 spin_lock(cache_lock); 235 if (atomic_read(&cred->cr_count) == 0) { 236 get_rpccred(cred); 237 list_add_tail(&cred->cr_lru, free); 238 rpcauth_unhash_cred_locked(cred); 239 nr_to_scan--; 240 } 241 spin_unlock(cache_lock); 242 if (nr_to_scan == 0) 243 break; 244 } 245 return nr_to_scan; 246 } 247 248 /* 249 * Run memory cache shrinker. 250 */ 251 static int 252 rpcauth_cache_shrinker(int nr_to_scan, gfp_t gfp_mask) 253 { 254 LIST_HEAD(free); 255 int res; 256 257 if (list_empty(&cred_unused)) 258 return 0; 259 spin_lock(&rpc_credcache_lock); 260 nr_to_scan = rpcauth_prune_expired(&free, nr_to_scan); 261 res = (number_cred_unused / 100) * sysctl_vfs_cache_pressure; 262 spin_unlock(&rpc_credcache_lock); 263 rpcauth_destroy_credlist(&free); 264 return res; 265 } 266 267 /* 268 * Look up a process' credentials in the authentication cache 269 */ 270 struct rpc_cred * 271 rpcauth_lookup_credcache(struct rpc_auth *auth, struct auth_cred * acred, 272 int flags) 273 { 274 LIST_HEAD(free); 275 struct rpc_cred_cache *cache = auth->au_credcache; 276 struct hlist_node *pos; 277 struct rpc_cred *cred = NULL, 278 *entry, *new; 279 int nr = 0; 280 281 if (!(flags & RPCAUTH_LOOKUP_ROOTCREDS)) 282 nr = acred->uid & RPC_CREDCACHE_MASK; 283 284 rcu_read_lock(); 285 hlist_for_each_entry_rcu(entry, pos, &cache->hashtable[nr], cr_hash) { 286 if (!entry->cr_ops->crmatch(acred, entry, flags)) 287 continue; 288 spin_lock(&cache->lock); 289 if (test_bit(RPCAUTH_CRED_HASHED, &entry->cr_flags) == 0) { 290 spin_unlock(&cache->lock); 291 continue; 292 } 293 cred = get_rpccred(entry); 294 spin_unlock(&cache->lock); 295 break; 296 } 297 rcu_read_unlock(); 298 299 if (cred != NULL) 300 goto found; 301 302 new = auth->au_ops->crcreate(auth, acred, flags); 303 if (IS_ERR(new)) { 304 cred = new; 305 goto out; 306 } 307 308 spin_lock(&cache->lock); 309 hlist_for_each_entry(entry, pos, &cache->hashtable[nr], cr_hash) { 310 if (!entry->cr_ops->crmatch(acred, entry, flags)) 311 continue; 312 cred = get_rpccred(entry); 313 break; 314 } 315 if (cred == NULL) { 316 cred = new; 317 set_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags); 318 hlist_add_head_rcu(&cred->cr_hash, &cache->hashtable[nr]); 319 } else 320 list_add_tail(&new->cr_lru, &free); 321 spin_unlock(&cache->lock); 322 found: 323 if (test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags) 324 && cred->cr_ops->cr_init != NULL 325 && !(flags & RPCAUTH_LOOKUP_NEW)) { 326 int res = cred->cr_ops->cr_init(auth, cred); 327 if (res < 0) { 328 put_rpccred(cred); 329 cred = ERR_PTR(res); 330 } 331 } 332 rpcauth_destroy_credlist(&free); 333 out: 334 return cred; 335 } 336 337 struct rpc_cred * 338 rpcauth_lookupcred(struct rpc_auth *auth, int flags) 339 { 340 struct auth_cred acred = { 341 .uid = current->fsuid, 342 .gid = current->fsgid, 343 .group_info = current->group_info, 344 }; 345 struct rpc_cred *ret; 346 347 dprintk("RPC: looking up %s cred\n", 348 auth->au_ops->au_name); 349 get_group_info(acred.group_info); 350 ret = auth->au_ops->lookup_cred(auth, &acred, flags); 351 put_group_info(acred.group_info); 352 return ret; 353 } 354 355 void 356 rpcauth_init_cred(struct rpc_cred *cred, const struct auth_cred *acred, 357 struct rpc_auth *auth, const struct rpc_credops *ops) 358 { 359 INIT_HLIST_NODE(&cred->cr_hash); 360 INIT_LIST_HEAD(&cred->cr_lru); 361 atomic_set(&cred->cr_count, 1); 362 cred->cr_auth = auth; 363 cred->cr_ops = ops; 364 cred->cr_expire = jiffies; 365 #ifdef RPC_DEBUG 366 cred->cr_magic = RPCAUTH_CRED_MAGIC; 367 #endif 368 cred->cr_uid = acred->uid; 369 } 370 EXPORT_SYMBOL(rpcauth_init_cred); 371 372 struct rpc_cred * 373 rpcauth_bindcred(struct rpc_task *task) 374 { 375 struct rpc_auth *auth = task->tk_client->cl_auth; 376 struct auth_cred acred = { 377 .uid = current->fsuid, 378 .gid = current->fsgid, 379 .group_info = current->group_info, 380 }; 381 struct rpc_cred *ret; 382 int flags = 0; 383 384 dprintk("RPC: %5u looking up %s cred\n", 385 task->tk_pid, task->tk_client->cl_auth->au_ops->au_name); 386 get_group_info(acred.group_info); 387 if (task->tk_flags & RPC_TASK_ROOTCREDS) 388 flags |= RPCAUTH_LOOKUP_ROOTCREDS; 389 ret = auth->au_ops->lookup_cred(auth, &acred, flags); 390 if (!IS_ERR(ret)) 391 task->tk_msg.rpc_cred = ret; 392 else 393 task->tk_status = PTR_ERR(ret); 394 put_group_info(acred.group_info); 395 return ret; 396 } 397 398 void 399 rpcauth_holdcred(struct rpc_task *task) 400 { 401 struct rpc_cred *cred = task->tk_msg.rpc_cred; 402 if (cred != NULL) { 403 get_rpccred(cred); 404 dprintk("RPC: %5u holding %s cred %p\n", task->tk_pid, 405 cred->cr_auth->au_ops->au_name, cred); 406 } 407 } 408 409 void 410 put_rpccred(struct rpc_cred *cred) 411 { 412 /* Fast path for unhashed credentials */ 413 if (test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) != 0) 414 goto need_lock; 415 416 if (!atomic_dec_and_test(&cred->cr_count)) 417 return; 418 goto out_destroy; 419 need_lock: 420 if (!atomic_dec_and_lock(&cred->cr_count, &rpc_credcache_lock)) 421 return; 422 if (!list_empty(&cred->cr_lru)) { 423 number_cred_unused--; 424 list_del_init(&cred->cr_lru); 425 } 426 if (test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) == 0) 427 rpcauth_unhash_cred(cred); 428 else if (test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) != 0) { 429 cred->cr_expire = jiffies; 430 list_add_tail(&cred->cr_lru, &cred_unused); 431 number_cred_unused++; 432 spin_unlock(&rpc_credcache_lock); 433 return; 434 } 435 spin_unlock(&rpc_credcache_lock); 436 out_destroy: 437 cred->cr_ops->crdestroy(cred); 438 } 439 440 void 441 rpcauth_unbindcred(struct rpc_task *task) 442 { 443 struct rpc_cred *cred = task->tk_msg.rpc_cred; 444 445 dprintk("RPC: %5u releasing %s cred %p\n", 446 task->tk_pid, cred->cr_auth->au_ops->au_name, cred); 447 448 put_rpccred(cred); 449 task->tk_msg.rpc_cred = NULL; 450 } 451 452 __be32 * 453 rpcauth_marshcred(struct rpc_task *task, __be32 *p) 454 { 455 struct rpc_cred *cred = task->tk_msg.rpc_cred; 456 457 dprintk("RPC: %5u marshaling %s cred %p\n", 458 task->tk_pid, cred->cr_auth->au_ops->au_name, cred); 459 460 return cred->cr_ops->crmarshal(task, p); 461 } 462 463 __be32 * 464 rpcauth_checkverf(struct rpc_task *task, __be32 *p) 465 { 466 struct rpc_cred *cred = task->tk_msg.rpc_cred; 467 468 dprintk("RPC: %5u validating %s cred %p\n", 469 task->tk_pid, cred->cr_auth->au_ops->au_name, cred); 470 471 return cred->cr_ops->crvalidate(task, p); 472 } 473 474 int 475 rpcauth_wrap_req(struct rpc_task *task, kxdrproc_t encode, void *rqstp, 476 __be32 *data, void *obj) 477 { 478 struct rpc_cred *cred = task->tk_msg.rpc_cred; 479 int ret; 480 481 dprintk("RPC: %5u using %s cred %p to wrap rpc data\n", 482 task->tk_pid, cred->cr_ops->cr_name, cred); 483 if (cred->cr_ops->crwrap_req) 484 return cred->cr_ops->crwrap_req(task, encode, rqstp, data, obj); 485 /* By default, we encode the arguments normally. */ 486 lock_kernel(); 487 ret = encode(rqstp, data, obj); 488 unlock_kernel(); 489 return ret; 490 } 491 492 int 493 rpcauth_unwrap_resp(struct rpc_task *task, kxdrproc_t decode, void *rqstp, 494 __be32 *data, void *obj) 495 { 496 struct rpc_cred *cred = task->tk_msg.rpc_cred; 497 int ret; 498 499 dprintk("RPC: %5u using %s cred %p to unwrap rpc data\n", 500 task->tk_pid, cred->cr_ops->cr_name, cred); 501 if (cred->cr_ops->crunwrap_resp) 502 return cred->cr_ops->crunwrap_resp(task, decode, rqstp, 503 data, obj); 504 /* By default, we decode the arguments normally. */ 505 lock_kernel(); 506 ret = decode(rqstp, data, obj); 507 unlock_kernel(); 508 return ret; 509 } 510 511 int 512 rpcauth_refreshcred(struct rpc_task *task) 513 { 514 struct rpc_cred *cred = task->tk_msg.rpc_cred; 515 int err; 516 517 dprintk("RPC: %5u refreshing %s cred %p\n", 518 task->tk_pid, cred->cr_auth->au_ops->au_name, cred); 519 520 err = cred->cr_ops->crrefresh(task); 521 if (err < 0) 522 task->tk_status = err; 523 return err; 524 } 525 526 void 527 rpcauth_invalcred(struct rpc_task *task) 528 { 529 struct rpc_cred *cred = task->tk_msg.rpc_cred; 530 531 dprintk("RPC: %5u invalidating %s cred %p\n", 532 task->tk_pid, cred->cr_auth->au_ops->au_name, cred); 533 if (cred) 534 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags); 535 } 536 537 int 538 rpcauth_uptodatecred(struct rpc_task *task) 539 { 540 struct rpc_cred *cred = task->tk_msg.rpc_cred; 541 542 return cred == NULL || 543 test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0; 544 } 545 546 static struct shrinker rpc_cred_shrinker = { 547 .shrink = rpcauth_cache_shrinker, 548 .seeks = DEFAULT_SEEKS, 549 }; 550 551 void __init rpcauth_init_module(void) 552 { 553 rpc_init_authunix(); 554 register_shrinker(&rpc_cred_shrinker); 555 } 556 557 void __exit rpcauth_remove_module(void) 558 { 559 unregister_shrinker(&rpc_cred_shrinker); 560 } 561