1 /* 2 * linux/net/sunrpc/auth.c 3 * 4 * Generic RPC client authentication API. 5 * 6 * Copyright (C) 1996, Olaf Kirch <okir@monad.swb.de> 7 */ 8 9 #include <linux/types.h> 10 #include <linux/sched.h> 11 #include <linux/cred.h> 12 #include <linux/module.h> 13 #include <linux/slab.h> 14 #include <linux/errno.h> 15 #include <linux/hash.h> 16 #include <linux/sunrpc/clnt.h> 17 #include <linux/sunrpc/gss_api.h> 18 #include <linux/spinlock.h> 19 20 #include <trace/events/sunrpc.h> 21 22 #define RPC_CREDCACHE_DEFAULT_HASHBITS (4) 23 struct rpc_cred_cache { 24 struct hlist_head *hashtable; 25 unsigned int hashbits; 26 spinlock_t lock; 27 }; 28 29 static unsigned int auth_hashbits = RPC_CREDCACHE_DEFAULT_HASHBITS; 30 31 static const struct rpc_authops __rcu *auth_flavors[RPC_AUTH_MAXFLAVOR] = { 32 [RPC_AUTH_NULL] = (const struct rpc_authops __force __rcu *)&authnull_ops, 33 [RPC_AUTH_UNIX] = (const struct rpc_authops __force __rcu *)&authunix_ops, 34 NULL, /* others can be loadable modules */ 35 }; 36 37 static LIST_HEAD(cred_unused); 38 static unsigned long number_cred_unused; 39 40 static struct cred machine_cred = { 41 .usage = ATOMIC_INIT(1), 42 #ifdef CONFIG_DEBUG_CREDENTIALS 43 .magic = CRED_MAGIC, 44 #endif 45 }; 46 47 /* 48 * Return the machine_cred pointer to be used whenever 49 * the a generic machine credential is needed. 50 */ 51 const struct cred *rpc_machine_cred(void) 52 { 53 return &machine_cred; 54 } 55 EXPORT_SYMBOL_GPL(rpc_machine_cred); 56 57 #define MAX_HASHTABLE_BITS (14) 58 static int param_set_hashtbl_sz(const char *val, const struct kernel_param *kp) 59 { 60 unsigned long num; 61 unsigned int nbits; 62 int ret; 63 64 if (!val) 65 goto out_inval; 66 ret = kstrtoul(val, 0, &num); 67 if (ret) 68 goto out_inval; 69 nbits = fls(num - 1); 70 if (nbits > MAX_HASHTABLE_BITS || nbits < 2) 71 goto out_inval; 72 *(unsigned int *)kp->arg = nbits; 73 return 0; 74 out_inval: 75 return -EINVAL; 76 } 77 78 static int param_get_hashtbl_sz(char *buffer, const struct kernel_param *kp) 79 { 80 unsigned int nbits; 81 82 nbits = *(unsigned int *)kp->arg; 83 return sprintf(buffer, "%u", 1U << nbits); 84 } 85 86 #define param_check_hashtbl_sz(name, p) __param_check(name, p, unsigned int); 87 88 static const struct kernel_param_ops param_ops_hashtbl_sz = { 89 .set = param_set_hashtbl_sz, 90 .get = param_get_hashtbl_sz, 91 }; 92 93 module_param_named(auth_hashtable_size, auth_hashbits, hashtbl_sz, 0644); 94 MODULE_PARM_DESC(auth_hashtable_size, "RPC credential cache hashtable size"); 95 96 static unsigned long auth_max_cred_cachesize = ULONG_MAX; 97 module_param(auth_max_cred_cachesize, ulong, 0644); 98 MODULE_PARM_DESC(auth_max_cred_cachesize, "RPC credential maximum total cache size"); 99 100 static u32 101 pseudoflavor_to_flavor(u32 flavor) { 102 if (flavor > RPC_AUTH_MAXFLAVOR) 103 return RPC_AUTH_GSS; 104 return flavor; 105 } 106 107 int 108 rpcauth_register(const struct rpc_authops *ops) 109 { 110 const struct rpc_authops *old; 111 rpc_authflavor_t flavor; 112 113 if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR) 114 return -EINVAL; 115 old = cmpxchg((const struct rpc_authops ** __force)&auth_flavors[flavor], NULL, ops); 116 if (old == NULL || old == ops) 117 return 0; 118 return -EPERM; 119 } 120 EXPORT_SYMBOL_GPL(rpcauth_register); 121 122 int 123 rpcauth_unregister(const struct rpc_authops *ops) 124 { 125 const struct rpc_authops *old; 126 rpc_authflavor_t flavor; 127 128 if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR) 129 return -EINVAL; 130 131 old = cmpxchg((const struct rpc_authops ** __force)&auth_flavors[flavor], ops, NULL); 132 if (old == ops || old == NULL) 133 return 0; 134 return -EPERM; 135 } 136 EXPORT_SYMBOL_GPL(rpcauth_unregister); 137 138 static const struct rpc_authops * 139 rpcauth_get_authops(rpc_authflavor_t flavor) 140 { 141 const struct rpc_authops *ops; 142 143 if (flavor >= RPC_AUTH_MAXFLAVOR) 144 return NULL; 145 146 rcu_read_lock(); 147 ops = rcu_dereference(auth_flavors[flavor]); 148 if (ops == NULL) { 149 rcu_read_unlock(); 150 request_module("rpc-auth-%u", flavor); 151 rcu_read_lock(); 152 ops = rcu_dereference(auth_flavors[flavor]); 153 if (ops == NULL) 154 goto out; 155 } 156 if (!try_module_get(ops->owner)) 157 ops = NULL; 158 out: 159 rcu_read_unlock(); 160 return ops; 161 } 162 163 static void 164 rpcauth_put_authops(const struct rpc_authops *ops) 165 { 166 module_put(ops->owner); 167 } 168 169 /** 170 * rpcauth_get_pseudoflavor - check if security flavor is supported 171 * @flavor: a security flavor 172 * @info: a GSS mech OID, quality of protection, and service value 173 * 174 * Verifies that an appropriate kernel module is available or already loaded. 175 * Returns an equivalent pseudoflavor, or RPC_AUTH_MAXFLAVOR if "flavor" is 176 * not supported locally. 177 */ 178 rpc_authflavor_t 179 rpcauth_get_pseudoflavor(rpc_authflavor_t flavor, struct rpcsec_gss_info *info) 180 { 181 const struct rpc_authops *ops = rpcauth_get_authops(flavor); 182 rpc_authflavor_t pseudoflavor; 183 184 if (!ops) 185 return RPC_AUTH_MAXFLAVOR; 186 pseudoflavor = flavor; 187 if (ops->info2flavor != NULL) 188 pseudoflavor = ops->info2flavor(info); 189 190 rpcauth_put_authops(ops); 191 return pseudoflavor; 192 } 193 EXPORT_SYMBOL_GPL(rpcauth_get_pseudoflavor); 194 195 /** 196 * rpcauth_get_gssinfo - find GSS tuple matching a GSS pseudoflavor 197 * @pseudoflavor: GSS pseudoflavor to match 198 * @info: rpcsec_gss_info structure to fill in 199 * 200 * Returns zero and fills in "info" if pseudoflavor matches a 201 * supported mechanism. 202 */ 203 int 204 rpcauth_get_gssinfo(rpc_authflavor_t pseudoflavor, struct rpcsec_gss_info *info) 205 { 206 rpc_authflavor_t flavor = pseudoflavor_to_flavor(pseudoflavor); 207 const struct rpc_authops *ops; 208 int result; 209 210 ops = rpcauth_get_authops(flavor); 211 if (ops == NULL) 212 return -ENOENT; 213 214 result = -ENOENT; 215 if (ops->flavor2info != NULL) 216 result = ops->flavor2info(pseudoflavor, info); 217 218 rpcauth_put_authops(ops); 219 return result; 220 } 221 EXPORT_SYMBOL_GPL(rpcauth_get_gssinfo); 222 223 /** 224 * rpcauth_list_flavors - discover registered flavors and pseudoflavors 225 * @array: array to fill in 226 * @size: size of "array" 227 * 228 * Returns the number of array items filled in, or a negative errno. 229 * 230 * The returned array is not sorted by any policy. Callers should not 231 * rely on the order of the items in the returned array. 232 */ 233 int 234 rpcauth_list_flavors(rpc_authflavor_t *array, int size) 235 { 236 const struct rpc_authops *ops; 237 rpc_authflavor_t flavor, pseudos[4]; 238 int i, len, result = 0; 239 240 rcu_read_lock(); 241 for (flavor = 0; flavor < RPC_AUTH_MAXFLAVOR; flavor++) { 242 ops = rcu_dereference(auth_flavors[flavor]); 243 if (result >= size) { 244 result = -ENOMEM; 245 break; 246 } 247 248 if (ops == NULL) 249 continue; 250 if (ops->list_pseudoflavors == NULL) { 251 array[result++] = ops->au_flavor; 252 continue; 253 } 254 len = ops->list_pseudoflavors(pseudos, ARRAY_SIZE(pseudos)); 255 if (len < 0) { 256 result = len; 257 break; 258 } 259 for (i = 0; i < len; i++) { 260 if (result >= size) { 261 result = -ENOMEM; 262 break; 263 } 264 array[result++] = pseudos[i]; 265 } 266 } 267 rcu_read_unlock(); 268 return result; 269 } 270 EXPORT_SYMBOL_GPL(rpcauth_list_flavors); 271 272 struct rpc_auth * 273 rpcauth_create(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt) 274 { 275 struct rpc_auth *auth = ERR_PTR(-EINVAL); 276 const struct rpc_authops *ops; 277 u32 flavor = pseudoflavor_to_flavor(args->pseudoflavor); 278 279 ops = rpcauth_get_authops(flavor); 280 if (ops == NULL) 281 goto out; 282 283 auth = ops->create(args, clnt); 284 285 rpcauth_put_authops(ops); 286 if (IS_ERR(auth)) 287 return auth; 288 if (clnt->cl_auth) 289 rpcauth_release(clnt->cl_auth); 290 clnt->cl_auth = auth; 291 292 out: 293 return auth; 294 } 295 EXPORT_SYMBOL_GPL(rpcauth_create); 296 297 void 298 rpcauth_release(struct rpc_auth *auth) 299 { 300 if (!refcount_dec_and_test(&auth->au_count)) 301 return; 302 auth->au_ops->destroy(auth); 303 } 304 305 static DEFINE_SPINLOCK(rpc_credcache_lock); 306 307 /* 308 * On success, the caller is responsible for freeing the reference 309 * held by the hashtable 310 */ 311 static bool 312 rpcauth_unhash_cred_locked(struct rpc_cred *cred) 313 { 314 if (!test_and_clear_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags)) 315 return false; 316 hlist_del_rcu(&cred->cr_hash); 317 return true; 318 } 319 320 static bool 321 rpcauth_unhash_cred(struct rpc_cred *cred) 322 { 323 spinlock_t *cache_lock; 324 bool ret; 325 326 if (!test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags)) 327 return false; 328 cache_lock = &cred->cr_auth->au_credcache->lock; 329 spin_lock(cache_lock); 330 ret = rpcauth_unhash_cred_locked(cred); 331 spin_unlock(cache_lock); 332 return ret; 333 } 334 335 /* 336 * Initialize RPC credential cache 337 */ 338 int 339 rpcauth_init_credcache(struct rpc_auth *auth) 340 { 341 struct rpc_cred_cache *new; 342 unsigned int hashsize; 343 344 new = kmalloc(sizeof(*new), GFP_KERNEL); 345 if (!new) 346 goto out_nocache; 347 new->hashbits = auth_hashbits; 348 hashsize = 1U << new->hashbits; 349 new->hashtable = kcalloc(hashsize, sizeof(new->hashtable[0]), GFP_KERNEL); 350 if (!new->hashtable) 351 goto out_nohashtbl; 352 spin_lock_init(&new->lock); 353 auth->au_credcache = new; 354 return 0; 355 out_nohashtbl: 356 kfree(new); 357 out_nocache: 358 return -ENOMEM; 359 } 360 EXPORT_SYMBOL_GPL(rpcauth_init_credcache); 361 362 char * 363 rpcauth_stringify_acceptor(struct rpc_cred *cred) 364 { 365 if (!cred->cr_ops->crstringify_acceptor) 366 return NULL; 367 return cred->cr_ops->crstringify_acceptor(cred); 368 } 369 EXPORT_SYMBOL_GPL(rpcauth_stringify_acceptor); 370 371 /* 372 * Destroy a list of credentials 373 */ 374 static inline 375 void rpcauth_destroy_credlist(struct list_head *head) 376 { 377 struct rpc_cred *cred; 378 379 while (!list_empty(head)) { 380 cred = list_entry(head->next, struct rpc_cred, cr_lru); 381 list_del_init(&cred->cr_lru); 382 put_rpccred(cred); 383 } 384 } 385 386 static void 387 rpcauth_lru_add_locked(struct rpc_cred *cred) 388 { 389 if (!list_empty(&cred->cr_lru)) 390 return; 391 number_cred_unused++; 392 list_add_tail(&cred->cr_lru, &cred_unused); 393 } 394 395 static void 396 rpcauth_lru_add(struct rpc_cred *cred) 397 { 398 if (!list_empty(&cred->cr_lru)) 399 return; 400 spin_lock(&rpc_credcache_lock); 401 rpcauth_lru_add_locked(cred); 402 spin_unlock(&rpc_credcache_lock); 403 } 404 405 static void 406 rpcauth_lru_remove_locked(struct rpc_cred *cred) 407 { 408 if (list_empty(&cred->cr_lru)) 409 return; 410 number_cred_unused--; 411 list_del_init(&cred->cr_lru); 412 } 413 414 static void 415 rpcauth_lru_remove(struct rpc_cred *cred) 416 { 417 if (list_empty(&cred->cr_lru)) 418 return; 419 spin_lock(&rpc_credcache_lock); 420 rpcauth_lru_remove_locked(cred); 421 spin_unlock(&rpc_credcache_lock); 422 } 423 424 /* 425 * Clear the RPC credential cache, and delete those credentials 426 * that are not referenced. 427 */ 428 void 429 rpcauth_clear_credcache(struct rpc_cred_cache *cache) 430 { 431 LIST_HEAD(free); 432 struct hlist_head *head; 433 struct rpc_cred *cred; 434 unsigned int hashsize = 1U << cache->hashbits; 435 int i; 436 437 spin_lock(&rpc_credcache_lock); 438 spin_lock(&cache->lock); 439 for (i = 0; i < hashsize; i++) { 440 head = &cache->hashtable[i]; 441 while (!hlist_empty(head)) { 442 cred = hlist_entry(head->first, struct rpc_cred, cr_hash); 443 rpcauth_unhash_cred_locked(cred); 444 /* Note: We now hold a reference to cred */ 445 rpcauth_lru_remove_locked(cred); 446 list_add_tail(&cred->cr_lru, &free); 447 } 448 } 449 spin_unlock(&cache->lock); 450 spin_unlock(&rpc_credcache_lock); 451 rpcauth_destroy_credlist(&free); 452 } 453 454 /* 455 * Destroy the RPC credential cache 456 */ 457 void 458 rpcauth_destroy_credcache(struct rpc_auth *auth) 459 { 460 struct rpc_cred_cache *cache = auth->au_credcache; 461 462 if (cache) { 463 auth->au_credcache = NULL; 464 rpcauth_clear_credcache(cache); 465 kfree(cache->hashtable); 466 kfree(cache); 467 } 468 } 469 EXPORT_SYMBOL_GPL(rpcauth_destroy_credcache); 470 471 472 #define RPC_AUTH_EXPIRY_MORATORIUM (60 * HZ) 473 474 /* 475 * Remove stale credentials. Avoid sleeping inside the loop. 476 */ 477 static long 478 rpcauth_prune_expired(struct list_head *free, int nr_to_scan) 479 { 480 struct rpc_cred *cred, *next; 481 unsigned long expired = jiffies - RPC_AUTH_EXPIRY_MORATORIUM; 482 long freed = 0; 483 484 list_for_each_entry_safe(cred, next, &cred_unused, cr_lru) { 485 486 if (nr_to_scan-- == 0) 487 break; 488 if (refcount_read(&cred->cr_count) > 1) { 489 rpcauth_lru_remove_locked(cred); 490 continue; 491 } 492 /* 493 * Enforce a 60 second garbage collection moratorium 494 * Note that the cred_unused list must be time-ordered. 495 */ 496 if (!time_in_range(cred->cr_expire, expired, jiffies)) 497 continue; 498 if (!rpcauth_unhash_cred(cred)) 499 continue; 500 501 rpcauth_lru_remove_locked(cred); 502 freed++; 503 list_add_tail(&cred->cr_lru, free); 504 } 505 return freed ? freed : SHRINK_STOP; 506 } 507 508 static unsigned long 509 rpcauth_cache_do_shrink(int nr_to_scan) 510 { 511 LIST_HEAD(free); 512 unsigned long freed; 513 514 spin_lock(&rpc_credcache_lock); 515 freed = rpcauth_prune_expired(&free, nr_to_scan); 516 spin_unlock(&rpc_credcache_lock); 517 rpcauth_destroy_credlist(&free); 518 519 return freed; 520 } 521 522 /* 523 * Run memory cache shrinker. 524 */ 525 static unsigned long 526 rpcauth_cache_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) 527 528 { 529 if ((sc->gfp_mask & GFP_KERNEL) != GFP_KERNEL) 530 return SHRINK_STOP; 531 532 /* nothing left, don't come back */ 533 if (list_empty(&cred_unused)) 534 return SHRINK_STOP; 535 536 return rpcauth_cache_do_shrink(sc->nr_to_scan); 537 } 538 539 static unsigned long 540 rpcauth_cache_shrink_count(struct shrinker *shrink, struct shrink_control *sc) 541 542 { 543 return number_cred_unused * sysctl_vfs_cache_pressure / 100; 544 } 545 546 static void 547 rpcauth_cache_enforce_limit(void) 548 { 549 unsigned long diff; 550 unsigned int nr_to_scan; 551 552 if (number_cred_unused <= auth_max_cred_cachesize) 553 return; 554 diff = number_cred_unused - auth_max_cred_cachesize; 555 nr_to_scan = 100; 556 if (diff < nr_to_scan) 557 nr_to_scan = diff; 558 rpcauth_cache_do_shrink(nr_to_scan); 559 } 560 561 /* 562 * Look up a process' credentials in the authentication cache 563 */ 564 struct rpc_cred * 565 rpcauth_lookup_credcache(struct rpc_auth *auth, struct auth_cred * acred, 566 int flags, gfp_t gfp) 567 { 568 LIST_HEAD(free); 569 struct rpc_cred_cache *cache = auth->au_credcache; 570 struct rpc_cred *cred = NULL, 571 *entry, *new; 572 unsigned int nr; 573 574 nr = auth->au_ops->hash_cred(acred, cache->hashbits); 575 576 rcu_read_lock(); 577 hlist_for_each_entry_rcu(entry, &cache->hashtable[nr], cr_hash) { 578 if (!entry->cr_ops->crmatch(acred, entry, flags)) 579 continue; 580 cred = get_rpccred(entry); 581 if (cred) 582 break; 583 } 584 rcu_read_unlock(); 585 586 if (cred != NULL) 587 goto found; 588 589 new = auth->au_ops->crcreate(auth, acred, flags, gfp); 590 if (IS_ERR(new)) { 591 cred = new; 592 goto out; 593 } 594 595 spin_lock(&cache->lock); 596 hlist_for_each_entry(entry, &cache->hashtable[nr], cr_hash) { 597 if (!entry->cr_ops->crmatch(acred, entry, flags)) 598 continue; 599 cred = get_rpccred(entry); 600 if (cred) 601 break; 602 } 603 if (cred == NULL) { 604 cred = new; 605 set_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags); 606 refcount_inc(&cred->cr_count); 607 hlist_add_head_rcu(&cred->cr_hash, &cache->hashtable[nr]); 608 } else 609 list_add_tail(&new->cr_lru, &free); 610 spin_unlock(&cache->lock); 611 rpcauth_cache_enforce_limit(); 612 found: 613 if (test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags) && 614 cred->cr_ops->cr_init != NULL && 615 !(flags & RPCAUTH_LOOKUP_NEW)) { 616 int res = cred->cr_ops->cr_init(auth, cred); 617 if (res < 0) { 618 put_rpccred(cred); 619 cred = ERR_PTR(res); 620 } 621 } 622 rpcauth_destroy_credlist(&free); 623 out: 624 return cred; 625 } 626 EXPORT_SYMBOL_GPL(rpcauth_lookup_credcache); 627 628 struct rpc_cred * 629 rpcauth_lookupcred(struct rpc_auth *auth, int flags) 630 { 631 struct auth_cred acred; 632 struct rpc_cred *ret; 633 const struct cred *cred = current_cred(); 634 635 memset(&acred, 0, sizeof(acred)); 636 acred.cred = cred; 637 ret = auth->au_ops->lookup_cred(auth, &acred, flags); 638 return ret; 639 } 640 EXPORT_SYMBOL_GPL(rpcauth_lookupcred); 641 642 void 643 rpcauth_init_cred(struct rpc_cred *cred, const struct auth_cred *acred, 644 struct rpc_auth *auth, const struct rpc_credops *ops) 645 { 646 INIT_HLIST_NODE(&cred->cr_hash); 647 INIT_LIST_HEAD(&cred->cr_lru); 648 refcount_set(&cred->cr_count, 1); 649 cred->cr_auth = auth; 650 cred->cr_flags = 0; 651 cred->cr_ops = ops; 652 cred->cr_expire = jiffies; 653 cred->cr_cred = get_cred(acred->cred); 654 } 655 EXPORT_SYMBOL_GPL(rpcauth_init_cred); 656 657 static struct rpc_cred * 658 rpcauth_bind_root_cred(struct rpc_task *task, int lookupflags) 659 { 660 struct rpc_auth *auth = task->tk_client->cl_auth; 661 struct auth_cred acred = { 662 .cred = get_task_cred(&init_task), 663 }; 664 struct rpc_cred *ret; 665 666 ret = auth->au_ops->lookup_cred(auth, &acred, lookupflags); 667 put_cred(acred.cred); 668 return ret; 669 } 670 671 static struct rpc_cred * 672 rpcauth_bind_machine_cred(struct rpc_task *task, int lookupflags) 673 { 674 struct rpc_auth *auth = task->tk_client->cl_auth; 675 struct auth_cred acred = { 676 .principal = task->tk_client->cl_principal, 677 .cred = init_task.cred, 678 }; 679 680 if (!acred.principal) 681 return NULL; 682 return auth->au_ops->lookup_cred(auth, &acred, lookupflags); 683 } 684 685 static struct rpc_cred * 686 rpcauth_bind_new_cred(struct rpc_task *task, int lookupflags) 687 { 688 struct rpc_auth *auth = task->tk_client->cl_auth; 689 690 return rpcauth_lookupcred(auth, lookupflags); 691 } 692 693 static int 694 rpcauth_bindcred(struct rpc_task *task, const struct cred *cred, int flags) 695 { 696 struct rpc_rqst *req = task->tk_rqstp; 697 struct rpc_cred *new = NULL; 698 int lookupflags = 0; 699 struct rpc_auth *auth = task->tk_client->cl_auth; 700 struct auth_cred acred = { 701 .cred = cred, 702 }; 703 704 if (flags & RPC_TASK_ASYNC) 705 lookupflags |= RPCAUTH_LOOKUP_NEW; 706 if (task->tk_op_cred) 707 /* Task must use exactly this rpc_cred */ 708 new = get_rpccred(task->tk_op_cred); 709 else if (cred != NULL && cred != &machine_cred) 710 new = auth->au_ops->lookup_cred(auth, &acred, lookupflags); 711 else if (cred == &machine_cred) 712 new = rpcauth_bind_machine_cred(task, lookupflags); 713 714 /* If machine cred couldn't be bound, try a root cred */ 715 if (new) 716 ; 717 else if (cred == &machine_cred || (flags & RPC_TASK_ROOTCREDS)) 718 new = rpcauth_bind_root_cred(task, lookupflags); 719 else if (flags & RPC_TASK_NULLCREDS) 720 new = authnull_ops.lookup_cred(NULL, NULL, 0); 721 else 722 new = rpcauth_bind_new_cred(task, lookupflags); 723 if (IS_ERR(new)) 724 return PTR_ERR(new); 725 put_rpccred(req->rq_cred); 726 req->rq_cred = new; 727 return 0; 728 } 729 730 void 731 put_rpccred(struct rpc_cred *cred) 732 { 733 if (cred == NULL) 734 return; 735 rcu_read_lock(); 736 if (refcount_dec_and_test(&cred->cr_count)) 737 goto destroy; 738 if (refcount_read(&cred->cr_count) != 1 || 739 !test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags)) 740 goto out; 741 if (test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0) { 742 cred->cr_expire = jiffies; 743 rpcauth_lru_add(cred); 744 /* Race breaker */ 745 if (unlikely(!test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags))) 746 rpcauth_lru_remove(cred); 747 } else if (rpcauth_unhash_cred(cred)) { 748 rpcauth_lru_remove(cred); 749 if (refcount_dec_and_test(&cred->cr_count)) 750 goto destroy; 751 } 752 out: 753 rcu_read_unlock(); 754 return; 755 destroy: 756 rcu_read_unlock(); 757 cred->cr_ops->crdestroy(cred); 758 } 759 EXPORT_SYMBOL_GPL(put_rpccred); 760 761 /** 762 * rpcauth_marshcred - Append RPC credential to end of @xdr 763 * @task: controlling RPC task 764 * @xdr: xdr_stream containing initial portion of RPC Call header 765 * 766 * On success, an appropriate verifier is added to @xdr, @xdr is 767 * updated to point past the verifier, and zero is returned. 768 * Otherwise, @xdr is in an undefined state and a negative errno 769 * is returned. 770 */ 771 int rpcauth_marshcred(struct rpc_task *task, struct xdr_stream *xdr) 772 { 773 const struct rpc_credops *ops = task->tk_rqstp->rq_cred->cr_ops; 774 775 return ops->crmarshal(task, xdr); 776 } 777 778 /** 779 * rpcauth_wrap_req_encode - XDR encode the RPC procedure 780 * @task: controlling RPC task 781 * @xdr: stream where on-the-wire bytes are to be marshalled 782 * 783 * On success, @xdr contains the encoded and wrapped message. 784 * Otherwise, @xdr is in an undefined state. 785 */ 786 int rpcauth_wrap_req_encode(struct rpc_task *task, struct xdr_stream *xdr) 787 { 788 kxdreproc_t encode = task->tk_msg.rpc_proc->p_encode; 789 790 encode(task->tk_rqstp, xdr, task->tk_msg.rpc_argp); 791 return 0; 792 } 793 EXPORT_SYMBOL_GPL(rpcauth_wrap_req_encode); 794 795 /** 796 * rpcauth_wrap_req - XDR encode and wrap the RPC procedure 797 * @task: controlling RPC task 798 * @xdr: stream where on-the-wire bytes are to be marshalled 799 * 800 * On success, @xdr contains the encoded and wrapped message, 801 * and zero is returned. Otherwise, @xdr is in an undefined 802 * state and a negative errno is returned. 803 */ 804 int rpcauth_wrap_req(struct rpc_task *task, struct xdr_stream *xdr) 805 { 806 const struct rpc_credops *ops = task->tk_rqstp->rq_cred->cr_ops; 807 808 return ops->crwrap_req(task, xdr); 809 } 810 811 /** 812 * rpcauth_checkverf - Validate verifier in RPC Reply header 813 * @task: controlling RPC task 814 * @xdr: xdr_stream containing RPC Reply header 815 * 816 * On success, @xdr is updated to point past the verifier and 817 * zero is returned. Otherwise, @xdr is in an undefined state 818 * and a negative errno is returned. 819 */ 820 int 821 rpcauth_checkverf(struct rpc_task *task, struct xdr_stream *xdr) 822 { 823 const struct rpc_credops *ops = task->tk_rqstp->rq_cred->cr_ops; 824 825 return ops->crvalidate(task, xdr); 826 } 827 828 /** 829 * rpcauth_unwrap_resp_decode - Invoke XDR decode function 830 * @task: controlling RPC task 831 * @xdr: stream where the Reply message resides 832 * 833 * Returns zero on success; otherwise a negative errno is returned. 834 */ 835 int 836 rpcauth_unwrap_resp_decode(struct rpc_task *task, struct xdr_stream *xdr) 837 { 838 kxdrdproc_t decode = task->tk_msg.rpc_proc->p_decode; 839 840 return decode(task->tk_rqstp, xdr, task->tk_msg.rpc_resp); 841 } 842 EXPORT_SYMBOL_GPL(rpcauth_unwrap_resp_decode); 843 844 /** 845 * rpcauth_unwrap_resp - Invoke unwrap and decode function for the cred 846 * @task: controlling RPC task 847 * @xdr: stream where the Reply message resides 848 * 849 * Returns zero on success; otherwise a negative errno is returned. 850 */ 851 int 852 rpcauth_unwrap_resp(struct rpc_task *task, struct xdr_stream *xdr) 853 { 854 const struct rpc_credops *ops = task->tk_rqstp->rq_cred->cr_ops; 855 856 return ops->crunwrap_resp(task, xdr); 857 } 858 859 bool 860 rpcauth_xmit_need_reencode(struct rpc_task *task) 861 { 862 struct rpc_cred *cred = task->tk_rqstp->rq_cred; 863 864 if (!cred || !cred->cr_ops->crneed_reencode) 865 return false; 866 return cred->cr_ops->crneed_reencode(task); 867 } 868 869 int 870 rpcauth_refreshcred(struct rpc_task *task) 871 { 872 struct rpc_cred *cred; 873 int err; 874 875 cred = task->tk_rqstp->rq_cred; 876 if (cred == NULL) { 877 err = rpcauth_bindcred(task, task->tk_msg.rpc_cred, task->tk_flags); 878 if (err < 0) 879 goto out; 880 cred = task->tk_rqstp->rq_cred; 881 } 882 883 err = cred->cr_ops->crrefresh(task); 884 out: 885 if (err < 0) 886 task->tk_status = err; 887 return err; 888 } 889 890 void 891 rpcauth_invalcred(struct rpc_task *task) 892 { 893 struct rpc_cred *cred = task->tk_rqstp->rq_cred; 894 895 if (cred) 896 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags); 897 } 898 899 int 900 rpcauth_uptodatecred(struct rpc_task *task) 901 { 902 struct rpc_cred *cred = task->tk_rqstp->rq_cred; 903 904 return cred == NULL || 905 test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0; 906 } 907 908 static struct shrinker rpc_cred_shrinker = { 909 .count_objects = rpcauth_cache_shrink_count, 910 .scan_objects = rpcauth_cache_shrink_scan, 911 .seeks = DEFAULT_SEEKS, 912 }; 913 914 int __init rpcauth_init_module(void) 915 { 916 int err; 917 918 err = rpc_init_authunix(); 919 if (err < 0) 920 goto out1; 921 err = register_shrinker(&rpc_cred_shrinker); 922 if (err < 0) 923 goto out2; 924 return 0; 925 out2: 926 rpc_destroy_authunix(); 927 out1: 928 return err; 929 } 930 931 void rpcauth_remove_module(void) 932 { 933 rpc_destroy_authunix(); 934 unregister_shrinker(&rpc_cred_shrinker); 935 } 936