1 // SPDX-License-Identifier: BSD-3-Clause 2 /* 3 * linux/net/sunrpc/auth_gss/auth_gss.c 4 * 5 * RPCSEC_GSS client authentication. 6 * 7 * Copyright (c) 2000 The Regents of the University of Michigan. 8 * All rights reserved. 9 * 10 * Dug Song <dugsong@monkey.org> 11 * Andy Adamson <andros@umich.edu> 12 */ 13 14 #include <linux/module.h> 15 #include <linux/init.h> 16 #include <linux/types.h> 17 #include <linux/slab.h> 18 #include <linux/sched.h> 19 #include <linux/pagemap.h> 20 #include <linux/sunrpc/clnt.h> 21 #include <linux/sunrpc/auth.h> 22 #include <linux/sunrpc/auth_gss.h> 23 #include <linux/sunrpc/gss_krb5.h> 24 #include <linux/sunrpc/svcauth_gss.h> 25 #include <linux/sunrpc/gss_err.h> 26 #include <linux/workqueue.h> 27 #include <linux/sunrpc/rpc_pipe_fs.h> 28 #include <linux/sunrpc/gss_api.h> 29 #include <linux/uaccess.h> 30 #include <linux/hashtable.h> 31 32 #include "auth_gss_internal.h" 33 #include "../netns.h" 34 35 #include <trace/events/rpcgss.h> 36 37 static const struct rpc_authops authgss_ops; 38 39 static const struct rpc_credops gss_credops; 40 static const struct rpc_credops gss_nullops; 41 42 #define GSS_RETRY_EXPIRED 5 43 static unsigned int gss_expired_cred_retry_delay = GSS_RETRY_EXPIRED; 44 45 #define GSS_KEY_EXPIRE_TIMEO 240 46 static unsigned int gss_key_expire_timeo = GSS_KEY_EXPIRE_TIMEO; 47 48 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG) 49 # define RPCDBG_FACILITY RPCDBG_AUTH 50 #endif 51 52 #define GSS_CRED_SLACK (RPC_MAX_AUTH_SIZE * 2) 53 /* length of a krb5 verifier (48), plus data added before arguments when 54 * using integrity (two 4-byte integers): */ 55 #define GSS_VERF_SLACK 100 56 57 static DEFINE_HASHTABLE(gss_auth_hash_table, 4); 58 static DEFINE_SPINLOCK(gss_auth_hash_lock); 59 60 struct gss_pipe { 61 struct rpc_pipe_dir_object pdo; 62 struct rpc_pipe *pipe; 63 struct rpc_clnt *clnt; 64 const char *name; 65 struct kref kref; 66 }; 67 68 struct gss_auth { 69 struct kref kref; 70 struct hlist_node hash; 71 struct rpc_auth rpc_auth; 72 struct gss_api_mech *mech; 73 enum rpc_gss_svc service; 74 struct rpc_clnt *client; 75 struct net *net; 76 netns_tracker ns_tracker; 77 /* 78 * There are two upcall pipes; dentry[1], named "gssd", is used 79 * for the new text-based upcall; dentry[0] is named after the 80 * mechanism (for example, "krb5") and exists for 81 * backwards-compatibility with older gssd's. 82 */ 83 struct gss_pipe *gss_pipe[2]; 84 const char *target_name; 85 }; 86 87 /* pipe_version >= 0 if and only if someone has a pipe open. */ 88 static DEFINE_SPINLOCK(pipe_version_lock); 89 static struct rpc_wait_queue pipe_version_rpc_waitqueue; 90 static DECLARE_WAIT_QUEUE_HEAD(pipe_version_waitqueue); 91 static void gss_put_auth(struct gss_auth *gss_auth); 92 93 static void gss_free_ctx(struct gss_cl_ctx *); 94 static const struct rpc_pipe_ops gss_upcall_ops_v0; 95 static const struct rpc_pipe_ops gss_upcall_ops_v1; 96 97 static inline struct gss_cl_ctx * 98 gss_get_ctx(struct gss_cl_ctx *ctx) 99 { 100 refcount_inc(&ctx->count); 101 return ctx; 102 } 103 104 static inline void 105 gss_put_ctx(struct gss_cl_ctx *ctx) 106 { 107 if (refcount_dec_and_test(&ctx->count)) 108 gss_free_ctx(ctx); 109 } 110 111 /* gss_cred_set_ctx: 112 * called by gss_upcall_callback and gss_create_upcall in order 113 * to set the gss context. The actual exchange of an old context 114 * and a new one is protected by the pipe->lock. 115 */ 116 static void 117 gss_cred_set_ctx(struct rpc_cred *cred, struct gss_cl_ctx *ctx) 118 { 119 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base); 120 121 if (!test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags)) 122 return; 123 gss_get_ctx(ctx); 124 rcu_assign_pointer(gss_cred->gc_ctx, ctx); 125 set_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags); 126 smp_mb__before_atomic(); 127 clear_bit(RPCAUTH_CRED_NEW, &cred->cr_flags); 128 } 129 130 static struct gss_cl_ctx * 131 gss_cred_get_ctx(struct rpc_cred *cred) 132 { 133 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base); 134 struct gss_cl_ctx *ctx = NULL; 135 136 rcu_read_lock(); 137 ctx = rcu_dereference(gss_cred->gc_ctx); 138 if (ctx) 139 gss_get_ctx(ctx); 140 rcu_read_unlock(); 141 return ctx; 142 } 143 144 static struct gss_cl_ctx * 145 gss_alloc_context(void) 146 { 147 struct gss_cl_ctx *ctx; 148 149 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); 150 if (ctx != NULL) { 151 ctx->gc_proc = RPC_GSS_PROC_DATA; 152 ctx->gc_seq = 1; /* NetApp 6.4R1 doesn't accept seq. no. 0 */ 153 spin_lock_init(&ctx->gc_seq_lock); 154 refcount_set(&ctx->count,1); 155 } 156 return ctx; 157 } 158 159 #define GSSD_MIN_TIMEOUT (60 * 60) 160 static const void * 161 gss_fill_context(const void *p, const void *end, struct gss_cl_ctx *ctx, struct gss_api_mech *gm) 162 { 163 const void *q; 164 unsigned int seclen; 165 unsigned int timeout; 166 unsigned long now = jiffies; 167 u32 window_size; 168 int ret; 169 170 /* First unsigned int gives the remaining lifetime in seconds of the 171 * credential - e.g. the remaining TGT lifetime for Kerberos or 172 * the -t value passed to GSSD. 173 */ 174 p = simple_get_bytes(p, end, &timeout, sizeof(timeout)); 175 if (IS_ERR(p)) 176 goto err; 177 if (timeout == 0) 178 timeout = GSSD_MIN_TIMEOUT; 179 ctx->gc_expiry = now + ((unsigned long)timeout * HZ); 180 /* Sequence number window. Determines the maximum number of 181 * simultaneous requests 182 */ 183 p = simple_get_bytes(p, end, &window_size, sizeof(window_size)); 184 if (IS_ERR(p)) 185 goto err; 186 ctx->gc_win = window_size; 187 /* gssd signals an error by passing ctx->gc_win = 0: */ 188 if (ctx->gc_win == 0) { 189 /* 190 * in which case, p points to an error code. Anything other 191 * than -EKEYEXPIRED gets converted to -EACCES. 192 */ 193 p = simple_get_bytes(p, end, &ret, sizeof(ret)); 194 if (!IS_ERR(p)) 195 p = (ret == -EKEYEXPIRED) ? ERR_PTR(-EKEYEXPIRED) : 196 ERR_PTR(-EACCES); 197 goto err; 198 } 199 /* copy the opaque wire context */ 200 p = simple_get_netobj(p, end, &ctx->gc_wire_ctx); 201 if (IS_ERR(p)) 202 goto err; 203 /* import the opaque security context */ 204 p = simple_get_bytes(p, end, &seclen, sizeof(seclen)); 205 if (IS_ERR(p)) 206 goto err; 207 q = (const void *)((const char *)p + seclen); 208 if (unlikely(q > end || q < p)) { 209 p = ERR_PTR(-EFAULT); 210 goto err; 211 } 212 ret = gss_import_sec_context(p, seclen, gm, &ctx->gc_gss_ctx, NULL, GFP_KERNEL); 213 if (ret < 0) { 214 trace_rpcgss_import_ctx(ret); 215 p = ERR_PTR(ret); 216 goto err; 217 } 218 219 /* is there any trailing data? */ 220 if (q == end) { 221 p = q; 222 goto done; 223 } 224 225 /* pull in acceptor name (if there is one) */ 226 p = simple_get_netobj(q, end, &ctx->gc_acceptor); 227 if (IS_ERR(p)) 228 goto err; 229 done: 230 trace_rpcgss_context(window_size, ctx->gc_expiry, now, timeout, 231 ctx->gc_acceptor.len, ctx->gc_acceptor.data); 232 err: 233 return p; 234 } 235 236 /* XXX: Need some documentation about why UPCALL_BUF_LEN is so small. 237 * Is user space expecting no more than UPCALL_BUF_LEN bytes? 238 * Note that there are now _two_ NI_MAXHOST sized data items 239 * being passed in this string. 240 */ 241 #define UPCALL_BUF_LEN 256 242 243 struct gss_upcall_msg { 244 refcount_t count; 245 kuid_t uid; 246 const char *service_name; 247 struct rpc_pipe_msg msg; 248 struct list_head list; 249 struct gss_auth *auth; 250 struct rpc_pipe *pipe; 251 struct rpc_wait_queue rpc_waitqueue; 252 wait_queue_head_t waitqueue; 253 struct gss_cl_ctx *ctx; 254 char databuf[UPCALL_BUF_LEN]; 255 }; 256 257 static int get_pipe_version(struct net *net) 258 { 259 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id); 260 int ret; 261 262 spin_lock(&pipe_version_lock); 263 if (sn->pipe_version >= 0) { 264 atomic_inc(&sn->pipe_users); 265 ret = sn->pipe_version; 266 } else 267 ret = -EAGAIN; 268 spin_unlock(&pipe_version_lock); 269 return ret; 270 } 271 272 static void put_pipe_version(struct net *net) 273 { 274 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id); 275 276 if (atomic_dec_and_lock(&sn->pipe_users, &pipe_version_lock)) { 277 sn->pipe_version = -1; 278 spin_unlock(&pipe_version_lock); 279 } 280 } 281 282 static void 283 gss_release_msg(struct gss_upcall_msg *gss_msg) 284 { 285 struct net *net = gss_msg->auth->net; 286 if (!refcount_dec_and_test(&gss_msg->count)) 287 return; 288 put_pipe_version(net); 289 BUG_ON(!list_empty(&gss_msg->list)); 290 if (gss_msg->ctx != NULL) 291 gss_put_ctx(gss_msg->ctx); 292 rpc_destroy_wait_queue(&gss_msg->rpc_waitqueue); 293 gss_put_auth(gss_msg->auth); 294 kfree_const(gss_msg->service_name); 295 kfree(gss_msg); 296 } 297 298 static struct gss_upcall_msg * 299 __gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid, const struct gss_auth *auth) 300 { 301 struct gss_upcall_msg *pos; 302 list_for_each_entry(pos, &pipe->in_downcall, list) { 303 if (!uid_eq(pos->uid, uid)) 304 continue; 305 if (pos->auth->service != auth->service) 306 continue; 307 refcount_inc(&pos->count); 308 return pos; 309 } 310 return NULL; 311 } 312 313 /* Try to add an upcall to the pipefs queue. 314 * If an upcall owned by our uid already exists, then we return a reference 315 * to that upcall instead of adding the new upcall. 316 */ 317 static inline struct gss_upcall_msg * 318 gss_add_msg(struct gss_upcall_msg *gss_msg) 319 { 320 struct rpc_pipe *pipe = gss_msg->pipe; 321 struct gss_upcall_msg *old; 322 323 spin_lock(&pipe->lock); 324 old = __gss_find_upcall(pipe, gss_msg->uid, gss_msg->auth); 325 if (old == NULL) { 326 refcount_inc(&gss_msg->count); 327 list_add(&gss_msg->list, &pipe->in_downcall); 328 } else 329 gss_msg = old; 330 spin_unlock(&pipe->lock); 331 return gss_msg; 332 } 333 334 static void 335 __gss_unhash_msg(struct gss_upcall_msg *gss_msg) 336 { 337 list_del_init(&gss_msg->list); 338 rpc_wake_up_status(&gss_msg->rpc_waitqueue, gss_msg->msg.errno); 339 wake_up_all(&gss_msg->waitqueue); 340 refcount_dec(&gss_msg->count); 341 } 342 343 static void 344 gss_unhash_msg(struct gss_upcall_msg *gss_msg) 345 { 346 struct rpc_pipe *pipe = gss_msg->pipe; 347 348 if (list_empty(&gss_msg->list)) 349 return; 350 spin_lock(&pipe->lock); 351 if (!list_empty(&gss_msg->list)) 352 __gss_unhash_msg(gss_msg); 353 spin_unlock(&pipe->lock); 354 } 355 356 static void 357 gss_handle_downcall_result(struct gss_cred *gss_cred, struct gss_upcall_msg *gss_msg) 358 { 359 switch (gss_msg->msg.errno) { 360 case 0: 361 if (gss_msg->ctx == NULL) 362 break; 363 clear_bit(RPCAUTH_CRED_NEGATIVE, &gss_cred->gc_base.cr_flags); 364 gss_cred_set_ctx(&gss_cred->gc_base, gss_msg->ctx); 365 break; 366 case -EKEYEXPIRED: 367 set_bit(RPCAUTH_CRED_NEGATIVE, &gss_cred->gc_base.cr_flags); 368 } 369 gss_cred->gc_upcall_timestamp = jiffies; 370 gss_cred->gc_upcall = NULL; 371 rpc_wake_up_status(&gss_msg->rpc_waitqueue, gss_msg->msg.errno); 372 } 373 374 static void 375 gss_upcall_callback(struct rpc_task *task) 376 { 377 struct gss_cred *gss_cred = container_of(task->tk_rqstp->rq_cred, 378 struct gss_cred, gc_base); 379 struct gss_upcall_msg *gss_msg = gss_cred->gc_upcall; 380 struct rpc_pipe *pipe = gss_msg->pipe; 381 382 spin_lock(&pipe->lock); 383 gss_handle_downcall_result(gss_cred, gss_msg); 384 spin_unlock(&pipe->lock); 385 task->tk_status = gss_msg->msg.errno; 386 gss_release_msg(gss_msg); 387 } 388 389 static void gss_encode_v0_msg(struct gss_upcall_msg *gss_msg, 390 const struct cred *cred) 391 { 392 struct user_namespace *userns = cred->user_ns; 393 394 uid_t uid = from_kuid_munged(userns, gss_msg->uid); 395 memcpy(gss_msg->databuf, &uid, sizeof(uid)); 396 gss_msg->msg.data = gss_msg->databuf; 397 gss_msg->msg.len = sizeof(uid); 398 399 BUILD_BUG_ON(sizeof(uid) > sizeof(gss_msg->databuf)); 400 } 401 402 static ssize_t 403 gss_v0_upcall(struct file *file, struct rpc_pipe_msg *msg, 404 char __user *buf, size_t buflen) 405 { 406 struct gss_upcall_msg *gss_msg = container_of(msg, 407 struct gss_upcall_msg, 408 msg); 409 if (msg->copied == 0) 410 gss_encode_v0_msg(gss_msg, file->f_cred); 411 return rpc_pipe_generic_upcall(file, msg, buf, buflen); 412 } 413 414 static int gss_encode_v1_msg(struct gss_upcall_msg *gss_msg, 415 const char *service_name, 416 const char *target_name, 417 const struct cred *cred) 418 { 419 struct user_namespace *userns = cred->user_ns; 420 struct gss_api_mech *mech = gss_msg->auth->mech; 421 char *p = gss_msg->databuf; 422 size_t buflen = sizeof(gss_msg->databuf); 423 int len; 424 425 len = scnprintf(p, buflen, "mech=%s uid=%d", mech->gm_name, 426 from_kuid_munged(userns, gss_msg->uid)); 427 buflen -= len; 428 p += len; 429 gss_msg->msg.len = len; 430 431 /* 432 * target= is a full service principal that names the remote 433 * identity that we are authenticating to. 434 */ 435 if (target_name) { 436 len = scnprintf(p, buflen, " target=%s", target_name); 437 buflen -= len; 438 p += len; 439 gss_msg->msg.len += len; 440 } 441 442 /* 443 * gssd uses service= and srchost= to select a matching key from 444 * the system's keytab to use as the source principal. 445 * 446 * service= is the service name part of the source principal, 447 * or "*" (meaning choose any). 448 * 449 * srchost= is the hostname part of the source principal. When 450 * not provided, gssd uses the local hostname. 451 */ 452 if (service_name) { 453 char *c = strchr(service_name, '@'); 454 455 if (!c) 456 len = scnprintf(p, buflen, " service=%s", 457 service_name); 458 else 459 len = scnprintf(p, buflen, 460 " service=%.*s srchost=%s", 461 (int)(c - service_name), 462 service_name, c + 1); 463 buflen -= len; 464 p += len; 465 gss_msg->msg.len += len; 466 } 467 468 if (mech->gm_upcall_enctypes) { 469 len = scnprintf(p, buflen, " enctypes=%s", 470 mech->gm_upcall_enctypes); 471 buflen -= len; 472 p += len; 473 gss_msg->msg.len += len; 474 } 475 trace_rpcgss_upcall_msg(gss_msg->databuf); 476 len = scnprintf(p, buflen, "\n"); 477 if (len == 0) 478 goto out_overflow; 479 gss_msg->msg.len += len; 480 gss_msg->msg.data = gss_msg->databuf; 481 return 0; 482 out_overflow: 483 WARN_ON_ONCE(1); 484 return -ENOMEM; 485 } 486 487 static ssize_t 488 gss_v1_upcall(struct file *file, struct rpc_pipe_msg *msg, 489 char __user *buf, size_t buflen) 490 { 491 struct gss_upcall_msg *gss_msg = container_of(msg, 492 struct gss_upcall_msg, 493 msg); 494 int err; 495 if (msg->copied == 0) { 496 err = gss_encode_v1_msg(gss_msg, 497 gss_msg->service_name, 498 gss_msg->auth->target_name, 499 file->f_cred); 500 if (err) 501 return err; 502 } 503 return rpc_pipe_generic_upcall(file, msg, buf, buflen); 504 } 505 506 static struct gss_upcall_msg * 507 gss_alloc_msg(struct gss_auth *gss_auth, 508 kuid_t uid, const char *service_name) 509 { 510 struct gss_upcall_msg *gss_msg; 511 int vers; 512 int err = -ENOMEM; 513 514 gss_msg = kzalloc(sizeof(*gss_msg), GFP_KERNEL); 515 if (gss_msg == NULL) 516 goto err; 517 vers = get_pipe_version(gss_auth->net); 518 err = vers; 519 if (err < 0) 520 goto err_free_msg; 521 gss_msg->pipe = gss_auth->gss_pipe[vers]->pipe; 522 INIT_LIST_HEAD(&gss_msg->list); 523 rpc_init_wait_queue(&gss_msg->rpc_waitqueue, "RPCSEC_GSS upcall waitq"); 524 init_waitqueue_head(&gss_msg->waitqueue); 525 refcount_set(&gss_msg->count, 1); 526 gss_msg->uid = uid; 527 gss_msg->auth = gss_auth; 528 kref_get(&gss_auth->kref); 529 if (service_name) { 530 gss_msg->service_name = kstrdup_const(service_name, GFP_KERNEL); 531 if (!gss_msg->service_name) { 532 err = -ENOMEM; 533 goto err_put_pipe_version; 534 } 535 } 536 return gss_msg; 537 err_put_pipe_version: 538 put_pipe_version(gss_auth->net); 539 err_free_msg: 540 kfree(gss_msg); 541 err: 542 return ERR_PTR(err); 543 } 544 545 static struct gss_upcall_msg * 546 gss_setup_upcall(struct gss_auth *gss_auth, struct rpc_cred *cred) 547 { 548 struct gss_cred *gss_cred = container_of(cred, 549 struct gss_cred, gc_base); 550 struct gss_upcall_msg *gss_new, *gss_msg; 551 kuid_t uid = cred->cr_cred->fsuid; 552 553 gss_new = gss_alloc_msg(gss_auth, uid, gss_cred->gc_principal); 554 if (IS_ERR(gss_new)) 555 return gss_new; 556 gss_msg = gss_add_msg(gss_new); 557 if (gss_msg == gss_new) { 558 int res; 559 refcount_inc(&gss_msg->count); 560 res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg); 561 if (res) { 562 gss_unhash_msg(gss_new); 563 refcount_dec(&gss_msg->count); 564 gss_release_msg(gss_new); 565 gss_msg = ERR_PTR(res); 566 } 567 } else 568 gss_release_msg(gss_new); 569 return gss_msg; 570 } 571 572 static void warn_gssd(void) 573 { 574 dprintk("AUTH_GSS upcall failed. Please check user daemon is running.\n"); 575 } 576 577 static inline int 578 gss_refresh_upcall(struct rpc_task *task) 579 { 580 struct rpc_cred *cred = task->tk_rqstp->rq_cred; 581 struct gss_auth *gss_auth = container_of(cred->cr_auth, 582 struct gss_auth, rpc_auth); 583 struct gss_cred *gss_cred = container_of(cred, 584 struct gss_cred, gc_base); 585 struct gss_upcall_msg *gss_msg; 586 struct rpc_pipe *pipe; 587 int err = 0; 588 589 gss_msg = gss_setup_upcall(gss_auth, cred); 590 if (PTR_ERR(gss_msg) == -EAGAIN) { 591 /* XXX: warning on the first, under the assumption we 592 * shouldn't normally hit this case on a refresh. */ 593 warn_gssd(); 594 rpc_sleep_on_timeout(&pipe_version_rpc_waitqueue, 595 task, NULL, jiffies + (15 * HZ)); 596 err = -EAGAIN; 597 goto out; 598 } 599 if (IS_ERR(gss_msg)) { 600 err = PTR_ERR(gss_msg); 601 goto out; 602 } 603 pipe = gss_msg->pipe; 604 spin_lock(&pipe->lock); 605 if (gss_cred->gc_upcall != NULL) 606 rpc_sleep_on(&gss_cred->gc_upcall->rpc_waitqueue, task, NULL); 607 else if (gss_msg->ctx == NULL && gss_msg->msg.errno >= 0) { 608 gss_cred->gc_upcall = gss_msg; 609 /* gss_upcall_callback will release the reference to gss_upcall_msg */ 610 refcount_inc(&gss_msg->count); 611 rpc_sleep_on(&gss_msg->rpc_waitqueue, task, gss_upcall_callback); 612 } else { 613 gss_handle_downcall_result(gss_cred, gss_msg); 614 err = gss_msg->msg.errno; 615 } 616 spin_unlock(&pipe->lock); 617 gss_release_msg(gss_msg); 618 out: 619 trace_rpcgss_upcall_result(from_kuid(&init_user_ns, 620 cred->cr_cred->fsuid), err); 621 return err; 622 } 623 624 static inline int 625 gss_create_upcall(struct gss_auth *gss_auth, struct gss_cred *gss_cred) 626 { 627 struct net *net = gss_auth->net; 628 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id); 629 struct rpc_pipe *pipe; 630 struct rpc_cred *cred = &gss_cred->gc_base; 631 struct gss_upcall_msg *gss_msg; 632 DEFINE_WAIT(wait); 633 int err; 634 635 retry: 636 err = 0; 637 /* if gssd is down, just skip upcalling altogether */ 638 if (!gssd_running(net)) { 639 warn_gssd(); 640 err = -EACCES; 641 goto out; 642 } 643 gss_msg = gss_setup_upcall(gss_auth, cred); 644 if (PTR_ERR(gss_msg) == -EAGAIN) { 645 err = wait_event_interruptible_timeout(pipe_version_waitqueue, 646 sn->pipe_version >= 0, 15 * HZ); 647 if (sn->pipe_version < 0) { 648 warn_gssd(); 649 err = -EACCES; 650 } 651 if (err < 0) 652 goto out; 653 goto retry; 654 } 655 if (IS_ERR(gss_msg)) { 656 err = PTR_ERR(gss_msg); 657 goto out; 658 } 659 pipe = gss_msg->pipe; 660 for (;;) { 661 prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_KILLABLE); 662 spin_lock(&pipe->lock); 663 if (gss_msg->ctx != NULL || gss_msg->msg.errno < 0) { 664 break; 665 } 666 spin_unlock(&pipe->lock); 667 if (fatal_signal_pending(current)) { 668 err = -ERESTARTSYS; 669 goto out_intr; 670 } 671 schedule(); 672 } 673 if (gss_msg->ctx) { 674 trace_rpcgss_ctx_init(gss_cred); 675 gss_cred_set_ctx(cred, gss_msg->ctx); 676 } else { 677 err = gss_msg->msg.errno; 678 } 679 spin_unlock(&pipe->lock); 680 out_intr: 681 finish_wait(&gss_msg->waitqueue, &wait); 682 gss_release_msg(gss_msg); 683 out: 684 trace_rpcgss_upcall_result(from_kuid(&init_user_ns, 685 cred->cr_cred->fsuid), err); 686 return err; 687 } 688 689 static struct gss_upcall_msg * 690 gss_find_downcall(struct rpc_pipe *pipe, kuid_t uid) 691 { 692 struct gss_upcall_msg *pos; 693 list_for_each_entry(pos, &pipe->in_downcall, list) { 694 if (!uid_eq(pos->uid, uid)) 695 continue; 696 if (!rpc_msg_is_inflight(&pos->msg)) 697 continue; 698 refcount_inc(&pos->count); 699 return pos; 700 } 701 return NULL; 702 } 703 704 #define MSG_BUF_MAXSIZE 1024 705 706 static ssize_t 707 gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) 708 { 709 const void *p, *end; 710 void *buf; 711 struct gss_upcall_msg *gss_msg; 712 struct rpc_pipe *pipe = RPC_I(file_inode(filp))->pipe; 713 struct gss_cl_ctx *ctx; 714 uid_t id; 715 kuid_t uid; 716 ssize_t err = -EFBIG; 717 718 if (mlen > MSG_BUF_MAXSIZE) 719 goto out; 720 err = -ENOMEM; 721 buf = kmalloc(mlen, GFP_KERNEL); 722 if (!buf) 723 goto out; 724 725 err = -EFAULT; 726 if (copy_from_user(buf, src, mlen)) 727 goto err; 728 729 end = (const void *)((char *)buf + mlen); 730 p = simple_get_bytes(buf, end, &id, sizeof(id)); 731 if (IS_ERR(p)) { 732 err = PTR_ERR(p); 733 goto err; 734 } 735 736 uid = make_kuid(current_user_ns(), id); 737 if (!uid_valid(uid)) { 738 err = -EINVAL; 739 goto err; 740 } 741 742 err = -ENOMEM; 743 ctx = gss_alloc_context(); 744 if (ctx == NULL) 745 goto err; 746 747 err = -ENOENT; 748 /* Find a matching upcall */ 749 spin_lock(&pipe->lock); 750 gss_msg = gss_find_downcall(pipe, uid); 751 if (gss_msg == NULL) { 752 spin_unlock(&pipe->lock); 753 goto err_put_ctx; 754 } 755 list_del_init(&gss_msg->list); 756 spin_unlock(&pipe->lock); 757 758 p = gss_fill_context(p, end, ctx, gss_msg->auth->mech); 759 if (IS_ERR(p)) { 760 err = PTR_ERR(p); 761 switch (err) { 762 case -EACCES: 763 case -EKEYEXPIRED: 764 gss_msg->msg.errno = err; 765 err = mlen; 766 break; 767 case -EFAULT: 768 case -ENOMEM: 769 case -EINVAL: 770 case -ENOSYS: 771 gss_msg->msg.errno = -EAGAIN; 772 break; 773 default: 774 printk(KERN_CRIT "%s: bad return from " 775 "gss_fill_context: %zd\n", __func__, err); 776 gss_msg->msg.errno = -EIO; 777 } 778 goto err_release_msg; 779 } 780 gss_msg->ctx = gss_get_ctx(ctx); 781 err = mlen; 782 783 err_release_msg: 784 spin_lock(&pipe->lock); 785 __gss_unhash_msg(gss_msg); 786 spin_unlock(&pipe->lock); 787 gss_release_msg(gss_msg); 788 err_put_ctx: 789 gss_put_ctx(ctx); 790 err: 791 kfree(buf); 792 out: 793 return err; 794 } 795 796 static int gss_pipe_open(struct inode *inode, int new_version) 797 { 798 struct net *net = inode->i_sb->s_fs_info; 799 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id); 800 int ret = 0; 801 802 spin_lock(&pipe_version_lock); 803 if (sn->pipe_version < 0) { 804 /* First open of any gss pipe determines the version: */ 805 sn->pipe_version = new_version; 806 rpc_wake_up(&pipe_version_rpc_waitqueue); 807 wake_up(&pipe_version_waitqueue); 808 } else if (sn->pipe_version != new_version) { 809 /* Trying to open a pipe of a different version */ 810 ret = -EBUSY; 811 goto out; 812 } 813 atomic_inc(&sn->pipe_users); 814 out: 815 spin_unlock(&pipe_version_lock); 816 return ret; 817 818 } 819 820 static int gss_pipe_open_v0(struct inode *inode) 821 { 822 return gss_pipe_open(inode, 0); 823 } 824 825 static int gss_pipe_open_v1(struct inode *inode) 826 { 827 return gss_pipe_open(inode, 1); 828 } 829 830 static void 831 gss_pipe_release(struct inode *inode) 832 { 833 struct net *net = inode->i_sb->s_fs_info; 834 struct rpc_pipe *pipe = RPC_I(inode)->pipe; 835 struct gss_upcall_msg *gss_msg; 836 837 restart: 838 spin_lock(&pipe->lock); 839 list_for_each_entry(gss_msg, &pipe->in_downcall, list) { 840 841 if (!list_empty(&gss_msg->msg.list)) 842 continue; 843 gss_msg->msg.errno = -EPIPE; 844 refcount_inc(&gss_msg->count); 845 __gss_unhash_msg(gss_msg); 846 spin_unlock(&pipe->lock); 847 gss_release_msg(gss_msg); 848 goto restart; 849 } 850 spin_unlock(&pipe->lock); 851 852 put_pipe_version(net); 853 } 854 855 static void 856 gss_pipe_destroy_msg(struct rpc_pipe_msg *msg) 857 { 858 struct gss_upcall_msg *gss_msg = container_of(msg, struct gss_upcall_msg, msg); 859 860 if (msg->errno < 0) { 861 refcount_inc(&gss_msg->count); 862 gss_unhash_msg(gss_msg); 863 if (msg->errno == -ETIMEDOUT) 864 warn_gssd(); 865 gss_release_msg(gss_msg); 866 } 867 gss_release_msg(gss_msg); 868 } 869 870 static void gss_pipe_dentry_destroy(struct dentry *dir, 871 struct rpc_pipe_dir_object *pdo) 872 { 873 struct gss_pipe *gss_pipe = pdo->pdo_data; 874 struct rpc_pipe *pipe = gss_pipe->pipe; 875 876 if (pipe->dentry != NULL) { 877 rpc_unlink(pipe->dentry); 878 pipe->dentry = NULL; 879 } 880 } 881 882 static int gss_pipe_dentry_create(struct dentry *dir, 883 struct rpc_pipe_dir_object *pdo) 884 { 885 struct gss_pipe *p = pdo->pdo_data; 886 struct dentry *dentry; 887 888 dentry = rpc_mkpipe_dentry(dir, p->name, p->clnt, p->pipe); 889 if (IS_ERR(dentry)) 890 return PTR_ERR(dentry); 891 p->pipe->dentry = dentry; 892 return 0; 893 } 894 895 static const struct rpc_pipe_dir_object_ops gss_pipe_dir_object_ops = { 896 .create = gss_pipe_dentry_create, 897 .destroy = gss_pipe_dentry_destroy, 898 }; 899 900 static struct gss_pipe *gss_pipe_alloc(struct rpc_clnt *clnt, 901 const char *name, 902 const struct rpc_pipe_ops *upcall_ops) 903 { 904 struct gss_pipe *p; 905 int err = -ENOMEM; 906 907 p = kmalloc(sizeof(*p), GFP_KERNEL); 908 if (p == NULL) 909 goto err; 910 p->pipe = rpc_mkpipe_data(upcall_ops, RPC_PIPE_WAIT_FOR_OPEN); 911 if (IS_ERR(p->pipe)) { 912 err = PTR_ERR(p->pipe); 913 goto err_free_gss_pipe; 914 } 915 p->name = name; 916 p->clnt = clnt; 917 kref_init(&p->kref); 918 rpc_init_pipe_dir_object(&p->pdo, 919 &gss_pipe_dir_object_ops, 920 p); 921 return p; 922 err_free_gss_pipe: 923 kfree(p); 924 err: 925 return ERR_PTR(err); 926 } 927 928 struct gss_alloc_pdo { 929 struct rpc_clnt *clnt; 930 const char *name; 931 const struct rpc_pipe_ops *upcall_ops; 932 }; 933 934 static int gss_pipe_match_pdo(struct rpc_pipe_dir_object *pdo, void *data) 935 { 936 struct gss_pipe *gss_pipe; 937 struct gss_alloc_pdo *args = data; 938 939 if (pdo->pdo_ops != &gss_pipe_dir_object_ops) 940 return 0; 941 gss_pipe = container_of(pdo, struct gss_pipe, pdo); 942 if (strcmp(gss_pipe->name, args->name) != 0) 943 return 0; 944 if (!kref_get_unless_zero(&gss_pipe->kref)) 945 return 0; 946 return 1; 947 } 948 949 static struct rpc_pipe_dir_object *gss_pipe_alloc_pdo(void *data) 950 { 951 struct gss_pipe *gss_pipe; 952 struct gss_alloc_pdo *args = data; 953 954 gss_pipe = gss_pipe_alloc(args->clnt, args->name, args->upcall_ops); 955 if (!IS_ERR(gss_pipe)) 956 return &gss_pipe->pdo; 957 return NULL; 958 } 959 960 static struct gss_pipe *gss_pipe_get(struct rpc_clnt *clnt, 961 const char *name, 962 const struct rpc_pipe_ops *upcall_ops) 963 { 964 struct net *net = rpc_net_ns(clnt); 965 struct rpc_pipe_dir_object *pdo; 966 struct gss_alloc_pdo args = { 967 .clnt = clnt, 968 .name = name, 969 .upcall_ops = upcall_ops, 970 }; 971 972 pdo = rpc_find_or_alloc_pipe_dir_object(net, 973 &clnt->cl_pipedir_objects, 974 gss_pipe_match_pdo, 975 gss_pipe_alloc_pdo, 976 &args); 977 if (pdo != NULL) 978 return container_of(pdo, struct gss_pipe, pdo); 979 return ERR_PTR(-ENOMEM); 980 } 981 982 static void __gss_pipe_free(struct gss_pipe *p) 983 { 984 struct rpc_clnt *clnt = p->clnt; 985 struct net *net = rpc_net_ns(clnt); 986 987 rpc_remove_pipe_dir_object(net, 988 &clnt->cl_pipedir_objects, 989 &p->pdo); 990 rpc_destroy_pipe_data(p->pipe); 991 kfree(p); 992 } 993 994 static void __gss_pipe_release(struct kref *kref) 995 { 996 struct gss_pipe *p = container_of(kref, struct gss_pipe, kref); 997 998 __gss_pipe_free(p); 999 } 1000 1001 static void gss_pipe_free(struct gss_pipe *p) 1002 { 1003 if (p != NULL) 1004 kref_put(&p->kref, __gss_pipe_release); 1005 } 1006 1007 /* 1008 * NOTE: we have the opportunity to use different 1009 * parameters based on the input flavor (which must be a pseudoflavor) 1010 */ 1011 static struct gss_auth * 1012 gss_create_new(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt) 1013 { 1014 rpc_authflavor_t flavor = args->pseudoflavor; 1015 struct gss_auth *gss_auth; 1016 struct gss_pipe *gss_pipe; 1017 struct rpc_auth * auth; 1018 int err = -ENOMEM; /* XXX? */ 1019 1020 if (!try_module_get(THIS_MODULE)) 1021 return ERR_PTR(err); 1022 if (!(gss_auth = kmalloc(sizeof(*gss_auth), GFP_KERNEL))) 1023 goto out_dec; 1024 INIT_HLIST_NODE(&gss_auth->hash); 1025 gss_auth->target_name = NULL; 1026 if (args->target_name) { 1027 gss_auth->target_name = kstrdup(args->target_name, GFP_KERNEL); 1028 if (gss_auth->target_name == NULL) 1029 goto err_free; 1030 } 1031 gss_auth->client = clnt; 1032 gss_auth->net = get_net_track(rpc_net_ns(clnt), &gss_auth->ns_tracker, 1033 GFP_KERNEL); 1034 err = -EINVAL; 1035 gss_auth->mech = gss_mech_get_by_pseudoflavor(flavor); 1036 if (!gss_auth->mech) 1037 goto err_put_net; 1038 gss_auth->service = gss_pseudoflavor_to_service(gss_auth->mech, flavor); 1039 if (gss_auth->service == 0) 1040 goto err_put_mech; 1041 if (!gssd_running(gss_auth->net)) 1042 goto err_put_mech; 1043 auth = &gss_auth->rpc_auth; 1044 auth->au_cslack = GSS_CRED_SLACK >> 2; 1045 auth->au_rslack = GSS_KRB5_MAX_SLACK_NEEDED >> 2; 1046 auth->au_verfsize = GSS_VERF_SLACK >> 2; 1047 auth->au_ralign = GSS_VERF_SLACK >> 2; 1048 __set_bit(RPCAUTH_AUTH_UPDATE_SLACK, &auth->au_flags); 1049 auth->au_ops = &authgss_ops; 1050 auth->au_flavor = flavor; 1051 if (gss_pseudoflavor_to_datatouch(gss_auth->mech, flavor)) 1052 __set_bit(RPCAUTH_AUTH_DATATOUCH, &auth->au_flags); 1053 refcount_set(&auth->au_count, 1); 1054 kref_init(&gss_auth->kref); 1055 1056 err = rpcauth_init_credcache(auth); 1057 if (err) 1058 goto err_put_mech; 1059 /* 1060 * Note: if we created the old pipe first, then someone who 1061 * examined the directory at the right moment might conclude 1062 * that we supported only the old pipe. So we instead create 1063 * the new pipe first. 1064 */ 1065 gss_pipe = gss_pipe_get(clnt, "gssd", &gss_upcall_ops_v1); 1066 if (IS_ERR(gss_pipe)) { 1067 err = PTR_ERR(gss_pipe); 1068 goto err_destroy_credcache; 1069 } 1070 gss_auth->gss_pipe[1] = gss_pipe; 1071 1072 gss_pipe = gss_pipe_get(clnt, gss_auth->mech->gm_name, 1073 &gss_upcall_ops_v0); 1074 if (IS_ERR(gss_pipe)) { 1075 err = PTR_ERR(gss_pipe); 1076 goto err_destroy_pipe_1; 1077 } 1078 gss_auth->gss_pipe[0] = gss_pipe; 1079 1080 return gss_auth; 1081 err_destroy_pipe_1: 1082 gss_pipe_free(gss_auth->gss_pipe[1]); 1083 err_destroy_credcache: 1084 rpcauth_destroy_credcache(auth); 1085 err_put_mech: 1086 gss_mech_put(gss_auth->mech); 1087 err_put_net: 1088 put_net_track(gss_auth->net, &gss_auth->ns_tracker); 1089 err_free: 1090 kfree(gss_auth->target_name); 1091 kfree(gss_auth); 1092 out_dec: 1093 module_put(THIS_MODULE); 1094 trace_rpcgss_createauth(flavor, err); 1095 return ERR_PTR(err); 1096 } 1097 1098 static void 1099 gss_free(struct gss_auth *gss_auth) 1100 { 1101 gss_pipe_free(gss_auth->gss_pipe[0]); 1102 gss_pipe_free(gss_auth->gss_pipe[1]); 1103 gss_mech_put(gss_auth->mech); 1104 put_net_track(gss_auth->net, &gss_auth->ns_tracker); 1105 kfree(gss_auth->target_name); 1106 1107 kfree(gss_auth); 1108 module_put(THIS_MODULE); 1109 } 1110 1111 static void 1112 gss_free_callback(struct kref *kref) 1113 { 1114 struct gss_auth *gss_auth = container_of(kref, struct gss_auth, kref); 1115 1116 gss_free(gss_auth); 1117 } 1118 1119 static void 1120 gss_put_auth(struct gss_auth *gss_auth) 1121 { 1122 kref_put(&gss_auth->kref, gss_free_callback); 1123 } 1124 1125 static void 1126 gss_destroy(struct rpc_auth *auth) 1127 { 1128 struct gss_auth *gss_auth = container_of(auth, 1129 struct gss_auth, rpc_auth); 1130 1131 if (hash_hashed(&gss_auth->hash)) { 1132 spin_lock(&gss_auth_hash_lock); 1133 hash_del(&gss_auth->hash); 1134 spin_unlock(&gss_auth_hash_lock); 1135 } 1136 1137 gss_pipe_free(gss_auth->gss_pipe[0]); 1138 gss_auth->gss_pipe[0] = NULL; 1139 gss_pipe_free(gss_auth->gss_pipe[1]); 1140 gss_auth->gss_pipe[1] = NULL; 1141 rpcauth_destroy_credcache(auth); 1142 1143 gss_put_auth(gss_auth); 1144 } 1145 1146 /* 1147 * Auths may be shared between rpc clients that were cloned from a 1148 * common client with the same xprt, if they also share the flavor and 1149 * target_name. 1150 * 1151 * The auth is looked up from the oldest parent sharing the same 1152 * cl_xprt, and the auth itself references only that common parent 1153 * (which is guaranteed to last as long as any of its descendants). 1154 */ 1155 static struct gss_auth * 1156 gss_auth_find_or_add_hashed(const struct rpc_auth_create_args *args, 1157 struct rpc_clnt *clnt, 1158 struct gss_auth *new) 1159 { 1160 struct gss_auth *gss_auth; 1161 unsigned long hashval = (unsigned long)clnt; 1162 1163 spin_lock(&gss_auth_hash_lock); 1164 hash_for_each_possible(gss_auth_hash_table, 1165 gss_auth, 1166 hash, 1167 hashval) { 1168 if (gss_auth->client != clnt) 1169 continue; 1170 if (gss_auth->rpc_auth.au_flavor != args->pseudoflavor) 1171 continue; 1172 if (gss_auth->target_name != args->target_name) { 1173 if (gss_auth->target_name == NULL) 1174 continue; 1175 if (args->target_name == NULL) 1176 continue; 1177 if (strcmp(gss_auth->target_name, args->target_name)) 1178 continue; 1179 } 1180 if (!refcount_inc_not_zero(&gss_auth->rpc_auth.au_count)) 1181 continue; 1182 goto out; 1183 } 1184 if (new) 1185 hash_add(gss_auth_hash_table, &new->hash, hashval); 1186 gss_auth = new; 1187 out: 1188 spin_unlock(&gss_auth_hash_lock); 1189 return gss_auth; 1190 } 1191 1192 static struct gss_auth * 1193 gss_create_hashed(const struct rpc_auth_create_args *args, 1194 struct rpc_clnt *clnt) 1195 { 1196 struct gss_auth *gss_auth; 1197 struct gss_auth *new; 1198 1199 gss_auth = gss_auth_find_or_add_hashed(args, clnt, NULL); 1200 if (gss_auth != NULL) 1201 goto out; 1202 new = gss_create_new(args, clnt); 1203 if (IS_ERR(new)) 1204 return new; 1205 gss_auth = gss_auth_find_or_add_hashed(args, clnt, new); 1206 if (gss_auth != new) 1207 gss_destroy(&new->rpc_auth); 1208 out: 1209 return gss_auth; 1210 } 1211 1212 static struct rpc_auth * 1213 gss_create(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt) 1214 { 1215 struct gss_auth *gss_auth; 1216 struct rpc_xprt_switch *xps = rcu_access_pointer(clnt->cl_xpi.xpi_xpswitch); 1217 1218 while (clnt != clnt->cl_parent) { 1219 struct rpc_clnt *parent = clnt->cl_parent; 1220 /* Find the original parent for this transport */ 1221 if (rcu_access_pointer(parent->cl_xpi.xpi_xpswitch) != xps) 1222 break; 1223 clnt = parent; 1224 } 1225 1226 gss_auth = gss_create_hashed(args, clnt); 1227 if (IS_ERR(gss_auth)) 1228 return ERR_CAST(gss_auth); 1229 return &gss_auth->rpc_auth; 1230 } 1231 1232 static struct gss_cred * 1233 gss_dup_cred(struct gss_auth *gss_auth, struct gss_cred *gss_cred) 1234 { 1235 struct gss_cred *new; 1236 1237 /* Make a copy of the cred so that we can reference count it */ 1238 new = kzalloc(sizeof(*gss_cred), GFP_KERNEL); 1239 if (new) { 1240 struct auth_cred acred = { 1241 .cred = gss_cred->gc_base.cr_cred, 1242 }; 1243 struct gss_cl_ctx *ctx = 1244 rcu_dereference_protected(gss_cred->gc_ctx, 1); 1245 1246 rpcauth_init_cred(&new->gc_base, &acred, 1247 &gss_auth->rpc_auth, 1248 &gss_nullops); 1249 new->gc_base.cr_flags = 1UL << RPCAUTH_CRED_UPTODATE; 1250 new->gc_service = gss_cred->gc_service; 1251 new->gc_principal = gss_cred->gc_principal; 1252 kref_get(&gss_auth->kref); 1253 rcu_assign_pointer(new->gc_ctx, ctx); 1254 gss_get_ctx(ctx); 1255 } 1256 return new; 1257 } 1258 1259 /* 1260 * gss_send_destroy_context will cause the RPCSEC_GSS to send a NULL RPC call 1261 * to the server with the GSS control procedure field set to 1262 * RPC_GSS_PROC_DESTROY. This should normally cause the server to release 1263 * all RPCSEC_GSS state associated with that context. 1264 */ 1265 static void 1266 gss_send_destroy_context(struct rpc_cred *cred) 1267 { 1268 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base); 1269 struct gss_auth *gss_auth = container_of(cred->cr_auth, struct gss_auth, rpc_auth); 1270 struct gss_cl_ctx *ctx = rcu_dereference_protected(gss_cred->gc_ctx, 1); 1271 struct gss_cred *new; 1272 struct rpc_task *task; 1273 1274 new = gss_dup_cred(gss_auth, gss_cred); 1275 if (new) { 1276 ctx->gc_proc = RPC_GSS_PROC_DESTROY; 1277 1278 trace_rpcgss_ctx_destroy(gss_cred); 1279 task = rpc_call_null(gss_auth->client, &new->gc_base, 1280 RPC_TASK_ASYNC); 1281 if (!IS_ERR(task)) 1282 rpc_put_task(task); 1283 1284 put_rpccred(&new->gc_base); 1285 } 1286 } 1287 1288 /* gss_destroy_cred (and gss_free_ctx) are used to clean up after failure 1289 * to create a new cred or context, so they check that things have been 1290 * allocated before freeing them. */ 1291 static void 1292 gss_do_free_ctx(struct gss_cl_ctx *ctx) 1293 { 1294 gss_delete_sec_context(&ctx->gc_gss_ctx); 1295 kfree(ctx->gc_wire_ctx.data); 1296 kfree(ctx->gc_acceptor.data); 1297 kfree(ctx); 1298 } 1299 1300 static void 1301 gss_free_ctx_callback(struct rcu_head *head) 1302 { 1303 struct gss_cl_ctx *ctx = container_of(head, struct gss_cl_ctx, gc_rcu); 1304 gss_do_free_ctx(ctx); 1305 } 1306 1307 static void 1308 gss_free_ctx(struct gss_cl_ctx *ctx) 1309 { 1310 call_rcu(&ctx->gc_rcu, gss_free_ctx_callback); 1311 } 1312 1313 static void 1314 gss_free_cred(struct gss_cred *gss_cred) 1315 { 1316 kfree(gss_cred); 1317 } 1318 1319 static void 1320 gss_free_cred_callback(struct rcu_head *head) 1321 { 1322 struct gss_cred *gss_cred = container_of(head, struct gss_cred, gc_base.cr_rcu); 1323 gss_free_cred(gss_cred); 1324 } 1325 1326 static void 1327 gss_destroy_nullcred(struct rpc_cred *cred) 1328 { 1329 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base); 1330 struct gss_auth *gss_auth = container_of(cred->cr_auth, struct gss_auth, rpc_auth); 1331 struct gss_cl_ctx *ctx = rcu_dereference_protected(gss_cred->gc_ctx, 1); 1332 1333 RCU_INIT_POINTER(gss_cred->gc_ctx, NULL); 1334 put_cred(cred->cr_cred); 1335 call_rcu(&cred->cr_rcu, gss_free_cred_callback); 1336 if (ctx) 1337 gss_put_ctx(ctx); 1338 gss_put_auth(gss_auth); 1339 } 1340 1341 static void 1342 gss_destroy_cred(struct rpc_cred *cred) 1343 { 1344 if (test_and_clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0) 1345 gss_send_destroy_context(cred); 1346 gss_destroy_nullcred(cred); 1347 } 1348 1349 static int 1350 gss_hash_cred(struct auth_cred *acred, unsigned int hashbits) 1351 { 1352 return hash_64(from_kuid(&init_user_ns, acred->cred->fsuid), hashbits); 1353 } 1354 1355 /* 1356 * Lookup RPCSEC_GSS cred for the current process 1357 */ 1358 static struct rpc_cred *gss_lookup_cred(struct rpc_auth *auth, 1359 struct auth_cred *acred, int flags) 1360 { 1361 return rpcauth_lookup_credcache(auth, acred, flags, 1362 rpc_task_gfp_mask()); 1363 } 1364 1365 static struct rpc_cred * 1366 gss_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags, gfp_t gfp) 1367 { 1368 struct gss_auth *gss_auth = container_of(auth, struct gss_auth, rpc_auth); 1369 struct gss_cred *cred = NULL; 1370 int err = -ENOMEM; 1371 1372 if (!(cred = kzalloc(sizeof(*cred), gfp))) 1373 goto out_err; 1374 1375 rpcauth_init_cred(&cred->gc_base, acred, auth, &gss_credops); 1376 /* 1377 * Note: in order to force a call to call_refresh(), we deliberately 1378 * fail to flag the credential as RPCAUTH_CRED_UPTODATE. 1379 */ 1380 cred->gc_base.cr_flags = 1UL << RPCAUTH_CRED_NEW; 1381 cred->gc_service = gss_auth->service; 1382 cred->gc_principal = acred->principal; 1383 kref_get(&gss_auth->kref); 1384 return &cred->gc_base; 1385 1386 out_err: 1387 return ERR_PTR(err); 1388 } 1389 1390 static int 1391 gss_cred_init(struct rpc_auth *auth, struct rpc_cred *cred) 1392 { 1393 struct gss_auth *gss_auth = container_of(auth, struct gss_auth, rpc_auth); 1394 struct gss_cred *gss_cred = container_of(cred,struct gss_cred, gc_base); 1395 int err; 1396 1397 do { 1398 err = gss_create_upcall(gss_auth, gss_cred); 1399 } while (err == -EAGAIN); 1400 return err; 1401 } 1402 1403 static char * 1404 gss_stringify_acceptor(struct rpc_cred *cred) 1405 { 1406 char *string = NULL; 1407 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base); 1408 struct gss_cl_ctx *ctx; 1409 unsigned int len; 1410 struct xdr_netobj *acceptor; 1411 1412 rcu_read_lock(); 1413 ctx = rcu_dereference(gss_cred->gc_ctx); 1414 if (!ctx) 1415 goto out; 1416 1417 len = ctx->gc_acceptor.len; 1418 rcu_read_unlock(); 1419 1420 /* no point if there's no string */ 1421 if (!len) 1422 return NULL; 1423 realloc: 1424 string = kmalloc(len + 1, GFP_KERNEL); 1425 if (!string) 1426 return NULL; 1427 1428 rcu_read_lock(); 1429 ctx = rcu_dereference(gss_cred->gc_ctx); 1430 1431 /* did the ctx disappear or was it replaced by one with no acceptor? */ 1432 if (!ctx || !ctx->gc_acceptor.len) { 1433 kfree(string); 1434 string = NULL; 1435 goto out; 1436 } 1437 1438 acceptor = &ctx->gc_acceptor; 1439 1440 /* 1441 * Did we find a new acceptor that's longer than the original? Allocate 1442 * a longer buffer and try again. 1443 */ 1444 if (len < acceptor->len) { 1445 len = acceptor->len; 1446 rcu_read_unlock(); 1447 kfree(string); 1448 goto realloc; 1449 } 1450 1451 memcpy(string, acceptor->data, acceptor->len); 1452 string[acceptor->len] = '\0'; 1453 out: 1454 rcu_read_unlock(); 1455 return string; 1456 } 1457 1458 /* 1459 * Returns -EACCES if GSS context is NULL or will expire within the 1460 * timeout (miliseconds) 1461 */ 1462 static int 1463 gss_key_timeout(struct rpc_cred *rc) 1464 { 1465 struct gss_cred *gss_cred = container_of(rc, struct gss_cred, gc_base); 1466 struct gss_cl_ctx *ctx; 1467 unsigned long timeout = jiffies + (gss_key_expire_timeo * HZ); 1468 int ret = 0; 1469 1470 rcu_read_lock(); 1471 ctx = rcu_dereference(gss_cred->gc_ctx); 1472 if (!ctx || time_after(timeout, ctx->gc_expiry)) 1473 ret = -EACCES; 1474 rcu_read_unlock(); 1475 1476 return ret; 1477 } 1478 1479 static int 1480 gss_match(struct auth_cred *acred, struct rpc_cred *rc, int flags) 1481 { 1482 struct gss_cred *gss_cred = container_of(rc, struct gss_cred, gc_base); 1483 struct gss_cl_ctx *ctx; 1484 int ret; 1485 1486 if (test_bit(RPCAUTH_CRED_NEW, &rc->cr_flags)) 1487 goto out; 1488 /* Don't match with creds that have expired. */ 1489 rcu_read_lock(); 1490 ctx = rcu_dereference(gss_cred->gc_ctx); 1491 if (!ctx || time_after(jiffies, ctx->gc_expiry)) { 1492 rcu_read_unlock(); 1493 return 0; 1494 } 1495 rcu_read_unlock(); 1496 if (!test_bit(RPCAUTH_CRED_UPTODATE, &rc->cr_flags)) 1497 return 0; 1498 out: 1499 if (acred->principal != NULL) { 1500 if (gss_cred->gc_principal == NULL) 1501 return 0; 1502 ret = strcmp(acred->principal, gss_cred->gc_principal) == 0; 1503 } else { 1504 if (gss_cred->gc_principal != NULL) 1505 return 0; 1506 ret = uid_eq(rc->cr_cred->fsuid, acred->cred->fsuid); 1507 } 1508 return ret; 1509 } 1510 1511 /* 1512 * Marshal credentials. 1513 * 1514 * The expensive part is computing the verifier. We can't cache a 1515 * pre-computed version of the verifier because the seqno, which 1516 * is different every time, is included in the MIC. 1517 */ 1518 static int gss_marshal(struct rpc_task *task, struct xdr_stream *xdr) 1519 { 1520 struct rpc_rqst *req = task->tk_rqstp; 1521 struct rpc_cred *cred = req->rq_cred; 1522 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, 1523 gc_base); 1524 struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred); 1525 __be32 *p, *cred_len; 1526 u32 maj_stat = 0; 1527 struct xdr_netobj mic; 1528 struct kvec iov; 1529 struct xdr_buf verf_buf; 1530 int status; 1531 1532 /* Credential */ 1533 1534 p = xdr_reserve_space(xdr, 7 * sizeof(*p) + 1535 ctx->gc_wire_ctx.len); 1536 if (!p) 1537 goto marshal_failed; 1538 *p++ = rpc_auth_gss; 1539 cred_len = p++; 1540 1541 spin_lock(&ctx->gc_seq_lock); 1542 req->rq_seqno = (ctx->gc_seq < MAXSEQ) ? ctx->gc_seq++ : MAXSEQ; 1543 spin_unlock(&ctx->gc_seq_lock); 1544 if (req->rq_seqno == MAXSEQ) 1545 goto expired; 1546 trace_rpcgss_seqno(task); 1547 1548 *p++ = cpu_to_be32(RPC_GSS_VERSION); 1549 *p++ = cpu_to_be32(ctx->gc_proc); 1550 *p++ = cpu_to_be32(req->rq_seqno); 1551 *p++ = cpu_to_be32(gss_cred->gc_service); 1552 p = xdr_encode_netobj(p, &ctx->gc_wire_ctx); 1553 *cred_len = cpu_to_be32((p - (cred_len + 1)) << 2); 1554 1555 /* Verifier */ 1556 1557 /* We compute the checksum for the verifier over the xdr-encoded bytes 1558 * starting with the xid and ending at the end of the credential: */ 1559 iov.iov_base = req->rq_snd_buf.head[0].iov_base; 1560 iov.iov_len = (u8 *)p - (u8 *)iov.iov_base; 1561 xdr_buf_from_iov(&iov, &verf_buf); 1562 1563 p = xdr_reserve_space(xdr, sizeof(*p)); 1564 if (!p) 1565 goto marshal_failed; 1566 *p++ = rpc_auth_gss; 1567 mic.data = (u8 *)(p + 1); 1568 maj_stat = gss_get_mic(ctx->gc_gss_ctx, &verf_buf, &mic); 1569 if (maj_stat == GSS_S_CONTEXT_EXPIRED) 1570 goto expired; 1571 else if (maj_stat != 0) 1572 goto bad_mic; 1573 if (xdr_stream_encode_opaque_inline(xdr, (void **)&p, mic.len) < 0) 1574 goto marshal_failed; 1575 status = 0; 1576 out: 1577 gss_put_ctx(ctx); 1578 return status; 1579 expired: 1580 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags); 1581 status = -EKEYEXPIRED; 1582 goto out; 1583 marshal_failed: 1584 status = -EMSGSIZE; 1585 goto out; 1586 bad_mic: 1587 trace_rpcgss_get_mic(task, maj_stat); 1588 status = -EIO; 1589 goto out; 1590 } 1591 1592 static int gss_renew_cred(struct rpc_task *task) 1593 { 1594 struct rpc_cred *oldcred = task->tk_rqstp->rq_cred; 1595 struct gss_cred *gss_cred = container_of(oldcred, 1596 struct gss_cred, 1597 gc_base); 1598 struct rpc_auth *auth = oldcred->cr_auth; 1599 struct auth_cred acred = { 1600 .cred = oldcred->cr_cred, 1601 .principal = gss_cred->gc_principal, 1602 }; 1603 struct rpc_cred *new; 1604 1605 new = gss_lookup_cred(auth, &acred, RPCAUTH_LOOKUP_NEW); 1606 if (IS_ERR(new)) 1607 return PTR_ERR(new); 1608 1609 task->tk_rqstp->rq_cred = new; 1610 put_rpccred(oldcred); 1611 return 0; 1612 } 1613 1614 static int gss_cred_is_negative_entry(struct rpc_cred *cred) 1615 { 1616 if (test_bit(RPCAUTH_CRED_NEGATIVE, &cred->cr_flags)) { 1617 unsigned long now = jiffies; 1618 unsigned long begin, expire; 1619 struct gss_cred *gss_cred; 1620 1621 gss_cred = container_of(cred, struct gss_cred, gc_base); 1622 begin = gss_cred->gc_upcall_timestamp; 1623 expire = begin + gss_expired_cred_retry_delay * HZ; 1624 1625 if (time_in_range_open(now, begin, expire)) 1626 return 1; 1627 } 1628 return 0; 1629 } 1630 1631 /* 1632 * Refresh credentials. XXX - finish 1633 */ 1634 static int 1635 gss_refresh(struct rpc_task *task) 1636 { 1637 struct rpc_cred *cred = task->tk_rqstp->rq_cred; 1638 int ret = 0; 1639 1640 if (gss_cred_is_negative_entry(cred)) 1641 return -EKEYEXPIRED; 1642 1643 if (!test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags) && 1644 !test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags)) { 1645 ret = gss_renew_cred(task); 1646 if (ret < 0) 1647 goto out; 1648 cred = task->tk_rqstp->rq_cred; 1649 } 1650 1651 if (test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags)) 1652 ret = gss_refresh_upcall(task); 1653 out: 1654 return ret; 1655 } 1656 1657 /* Dummy refresh routine: used only when destroying the context */ 1658 static int 1659 gss_refresh_null(struct rpc_task *task) 1660 { 1661 return 0; 1662 } 1663 1664 static int 1665 gss_validate(struct rpc_task *task, struct xdr_stream *xdr) 1666 { 1667 struct rpc_cred *cred = task->tk_rqstp->rq_cred; 1668 struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred); 1669 __be32 *p, *seq = NULL; 1670 struct kvec iov; 1671 struct xdr_buf verf_buf; 1672 struct xdr_netobj mic; 1673 u32 len, maj_stat; 1674 int status; 1675 1676 p = xdr_inline_decode(xdr, 2 * sizeof(*p)); 1677 if (!p) 1678 goto validate_failed; 1679 if (*p++ != rpc_auth_gss) 1680 goto validate_failed; 1681 len = be32_to_cpup(p); 1682 if (len > RPC_MAX_AUTH_SIZE) 1683 goto validate_failed; 1684 p = xdr_inline_decode(xdr, len); 1685 if (!p) 1686 goto validate_failed; 1687 1688 seq = kmalloc(4, GFP_KERNEL); 1689 if (!seq) 1690 goto validate_failed; 1691 *seq = cpu_to_be32(task->tk_rqstp->rq_seqno); 1692 iov.iov_base = seq; 1693 iov.iov_len = 4; 1694 xdr_buf_from_iov(&iov, &verf_buf); 1695 mic.data = (u8 *)p; 1696 mic.len = len; 1697 maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &verf_buf, &mic); 1698 if (maj_stat == GSS_S_CONTEXT_EXPIRED) 1699 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags); 1700 if (maj_stat) 1701 goto bad_mic; 1702 1703 /* We leave it to unwrap to calculate au_rslack. For now we just 1704 * calculate the length of the verifier: */ 1705 if (test_bit(RPCAUTH_AUTH_UPDATE_SLACK, &cred->cr_auth->au_flags)) 1706 cred->cr_auth->au_verfsize = XDR_QUADLEN(len) + 2; 1707 status = 0; 1708 out: 1709 gss_put_ctx(ctx); 1710 kfree(seq); 1711 return status; 1712 1713 validate_failed: 1714 status = -EIO; 1715 goto out; 1716 bad_mic: 1717 trace_rpcgss_verify_mic(task, maj_stat); 1718 status = -EACCES; 1719 goto out; 1720 } 1721 1722 static noinline_for_stack int 1723 gss_wrap_req_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx, 1724 struct rpc_task *task, struct xdr_stream *xdr) 1725 { 1726 struct rpc_rqst *rqstp = task->tk_rqstp; 1727 struct xdr_buf integ_buf, *snd_buf = &rqstp->rq_snd_buf; 1728 struct xdr_netobj mic; 1729 __be32 *p, *integ_len; 1730 u32 offset, maj_stat; 1731 1732 p = xdr_reserve_space(xdr, 2 * sizeof(*p)); 1733 if (!p) 1734 goto wrap_failed; 1735 integ_len = p++; 1736 *p = cpu_to_be32(rqstp->rq_seqno); 1737 1738 if (rpcauth_wrap_req_encode(task, xdr)) 1739 goto wrap_failed; 1740 1741 offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base; 1742 if (xdr_buf_subsegment(snd_buf, &integ_buf, 1743 offset, snd_buf->len - offset)) 1744 goto wrap_failed; 1745 *integ_len = cpu_to_be32(integ_buf.len); 1746 1747 p = xdr_reserve_space(xdr, 0); 1748 if (!p) 1749 goto wrap_failed; 1750 mic.data = (u8 *)(p + 1); 1751 maj_stat = gss_get_mic(ctx->gc_gss_ctx, &integ_buf, &mic); 1752 if (maj_stat == GSS_S_CONTEXT_EXPIRED) 1753 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags); 1754 else if (maj_stat) 1755 goto bad_mic; 1756 /* Check that the trailing MIC fit in the buffer, after the fact */ 1757 if (xdr_stream_encode_opaque_inline(xdr, (void **)&p, mic.len) < 0) 1758 goto wrap_failed; 1759 return 0; 1760 wrap_failed: 1761 return -EMSGSIZE; 1762 bad_mic: 1763 trace_rpcgss_get_mic(task, maj_stat); 1764 return -EIO; 1765 } 1766 1767 static void 1768 priv_release_snd_buf(struct rpc_rqst *rqstp) 1769 { 1770 int i; 1771 1772 for (i=0; i < rqstp->rq_enc_pages_num; i++) 1773 __free_page(rqstp->rq_enc_pages[i]); 1774 kfree(rqstp->rq_enc_pages); 1775 rqstp->rq_release_snd_buf = NULL; 1776 } 1777 1778 static int 1779 alloc_enc_pages(struct rpc_rqst *rqstp) 1780 { 1781 struct xdr_buf *snd_buf = &rqstp->rq_snd_buf; 1782 int first, last, i; 1783 1784 if (rqstp->rq_release_snd_buf) 1785 rqstp->rq_release_snd_buf(rqstp); 1786 1787 if (snd_buf->page_len == 0) { 1788 rqstp->rq_enc_pages_num = 0; 1789 return 0; 1790 } 1791 1792 first = snd_buf->page_base >> PAGE_SHIFT; 1793 last = (snd_buf->page_base + snd_buf->page_len - 1) >> PAGE_SHIFT; 1794 rqstp->rq_enc_pages_num = last - first + 1 + 1; 1795 rqstp->rq_enc_pages 1796 = kmalloc_array(rqstp->rq_enc_pages_num, 1797 sizeof(struct page *), 1798 GFP_KERNEL); 1799 if (!rqstp->rq_enc_pages) 1800 goto out; 1801 for (i=0; i < rqstp->rq_enc_pages_num; i++) { 1802 rqstp->rq_enc_pages[i] = alloc_page(GFP_KERNEL); 1803 if (rqstp->rq_enc_pages[i] == NULL) 1804 goto out_free; 1805 } 1806 rqstp->rq_release_snd_buf = priv_release_snd_buf; 1807 return 0; 1808 out_free: 1809 rqstp->rq_enc_pages_num = i; 1810 priv_release_snd_buf(rqstp); 1811 out: 1812 return -EAGAIN; 1813 } 1814 1815 static noinline_for_stack int 1816 gss_wrap_req_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx, 1817 struct rpc_task *task, struct xdr_stream *xdr) 1818 { 1819 struct rpc_rqst *rqstp = task->tk_rqstp; 1820 struct xdr_buf *snd_buf = &rqstp->rq_snd_buf; 1821 u32 pad, offset, maj_stat; 1822 int status; 1823 __be32 *p, *opaque_len; 1824 struct page **inpages; 1825 int first; 1826 struct kvec *iov; 1827 1828 status = -EIO; 1829 p = xdr_reserve_space(xdr, 2 * sizeof(*p)); 1830 if (!p) 1831 goto wrap_failed; 1832 opaque_len = p++; 1833 *p = cpu_to_be32(rqstp->rq_seqno); 1834 1835 if (rpcauth_wrap_req_encode(task, xdr)) 1836 goto wrap_failed; 1837 1838 status = alloc_enc_pages(rqstp); 1839 if (unlikely(status)) 1840 goto wrap_failed; 1841 first = snd_buf->page_base >> PAGE_SHIFT; 1842 inpages = snd_buf->pages + first; 1843 snd_buf->pages = rqstp->rq_enc_pages; 1844 snd_buf->page_base -= first << PAGE_SHIFT; 1845 /* 1846 * Move the tail into its own page, in case gss_wrap needs 1847 * more space in the head when wrapping. 1848 * 1849 * Still... Why can't gss_wrap just slide the tail down? 1850 */ 1851 if (snd_buf->page_len || snd_buf->tail[0].iov_len) { 1852 char *tmp; 1853 1854 tmp = page_address(rqstp->rq_enc_pages[rqstp->rq_enc_pages_num - 1]); 1855 memcpy(tmp, snd_buf->tail[0].iov_base, snd_buf->tail[0].iov_len); 1856 snd_buf->tail[0].iov_base = tmp; 1857 } 1858 offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base; 1859 maj_stat = gss_wrap(ctx->gc_gss_ctx, offset, snd_buf, inpages); 1860 /* slack space should prevent this ever happening: */ 1861 if (unlikely(snd_buf->len > snd_buf->buflen)) 1862 goto wrap_failed; 1863 /* We're assuming that when GSS_S_CONTEXT_EXPIRED, the encryption was 1864 * done anyway, so it's safe to put the request on the wire: */ 1865 if (maj_stat == GSS_S_CONTEXT_EXPIRED) 1866 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags); 1867 else if (maj_stat) 1868 goto bad_wrap; 1869 1870 *opaque_len = cpu_to_be32(snd_buf->len - offset); 1871 /* guess whether the pad goes into the head or the tail: */ 1872 if (snd_buf->page_len || snd_buf->tail[0].iov_len) 1873 iov = snd_buf->tail; 1874 else 1875 iov = snd_buf->head; 1876 p = iov->iov_base + iov->iov_len; 1877 pad = xdr_pad_size(snd_buf->len - offset); 1878 memset(p, 0, pad); 1879 iov->iov_len += pad; 1880 snd_buf->len += pad; 1881 1882 return 0; 1883 wrap_failed: 1884 return status; 1885 bad_wrap: 1886 trace_rpcgss_wrap(task, maj_stat); 1887 return -EIO; 1888 } 1889 1890 static int gss_wrap_req(struct rpc_task *task, struct xdr_stream *xdr) 1891 { 1892 struct rpc_cred *cred = task->tk_rqstp->rq_cred; 1893 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, 1894 gc_base); 1895 struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred); 1896 int status; 1897 1898 status = -EIO; 1899 if (ctx->gc_proc != RPC_GSS_PROC_DATA) { 1900 /* The spec seems a little ambiguous here, but I think that not 1901 * wrapping context destruction requests makes the most sense. 1902 */ 1903 status = rpcauth_wrap_req_encode(task, xdr); 1904 goto out; 1905 } 1906 switch (gss_cred->gc_service) { 1907 case RPC_GSS_SVC_NONE: 1908 status = rpcauth_wrap_req_encode(task, xdr); 1909 break; 1910 case RPC_GSS_SVC_INTEGRITY: 1911 status = gss_wrap_req_integ(cred, ctx, task, xdr); 1912 break; 1913 case RPC_GSS_SVC_PRIVACY: 1914 status = gss_wrap_req_priv(cred, ctx, task, xdr); 1915 break; 1916 default: 1917 status = -EIO; 1918 } 1919 out: 1920 gss_put_ctx(ctx); 1921 return status; 1922 } 1923 1924 /** 1925 * gss_update_rslack - Possibly update RPC receive buffer size estimates 1926 * @task: rpc_task for incoming RPC Reply being unwrapped 1927 * @cred: controlling rpc_cred for @task 1928 * @before: XDR words needed before each RPC Reply message 1929 * @after: XDR words needed following each RPC Reply message 1930 * 1931 */ 1932 static void gss_update_rslack(struct rpc_task *task, struct rpc_cred *cred, 1933 unsigned int before, unsigned int after) 1934 { 1935 struct rpc_auth *auth = cred->cr_auth; 1936 1937 if (test_and_clear_bit(RPCAUTH_AUTH_UPDATE_SLACK, &auth->au_flags)) { 1938 auth->au_ralign = auth->au_verfsize + before; 1939 auth->au_rslack = auth->au_verfsize + after; 1940 trace_rpcgss_update_slack(task, auth); 1941 } 1942 } 1943 1944 static int 1945 gss_unwrap_resp_auth(struct rpc_task *task, struct rpc_cred *cred) 1946 { 1947 gss_update_rslack(task, cred, 0, 0); 1948 return 0; 1949 } 1950 1951 /* 1952 * RFC 2203, Section 5.3.2.2 1953 * 1954 * struct rpc_gss_integ_data { 1955 * opaque databody_integ<>; 1956 * opaque checksum<>; 1957 * }; 1958 * 1959 * struct rpc_gss_data_t { 1960 * unsigned int seq_num; 1961 * proc_req_arg_t arg; 1962 * }; 1963 */ 1964 static noinline_for_stack int 1965 gss_unwrap_resp_integ(struct rpc_task *task, struct rpc_cred *cred, 1966 struct gss_cl_ctx *ctx, struct rpc_rqst *rqstp, 1967 struct xdr_stream *xdr) 1968 { 1969 struct xdr_buf gss_data, *rcv_buf = &rqstp->rq_rcv_buf; 1970 u32 len, offset, seqno, maj_stat; 1971 struct xdr_netobj mic; 1972 int ret; 1973 1974 ret = -EIO; 1975 mic.data = NULL; 1976 1977 /* opaque databody_integ<>; */ 1978 if (xdr_stream_decode_u32(xdr, &len)) 1979 goto unwrap_failed; 1980 if (len & 3) 1981 goto unwrap_failed; 1982 offset = rcv_buf->len - xdr_stream_remaining(xdr); 1983 if (xdr_stream_decode_u32(xdr, &seqno)) 1984 goto unwrap_failed; 1985 if (seqno != rqstp->rq_seqno) 1986 goto bad_seqno; 1987 if (xdr_buf_subsegment(rcv_buf, &gss_data, offset, len)) 1988 goto unwrap_failed; 1989 1990 /* 1991 * The xdr_stream now points to the beginning of the 1992 * upper layer payload, to be passed below to 1993 * rpcauth_unwrap_resp_decode(). The checksum, which 1994 * follows the upper layer payload in @rcv_buf, is 1995 * located and parsed without updating the xdr_stream. 1996 */ 1997 1998 /* opaque checksum<>; */ 1999 offset += len; 2000 if (xdr_decode_word(rcv_buf, offset, &len)) 2001 goto unwrap_failed; 2002 offset += sizeof(__be32); 2003 if (offset + len > rcv_buf->len) 2004 goto unwrap_failed; 2005 mic.len = len; 2006 mic.data = kmalloc(len, GFP_KERNEL); 2007 if (ZERO_OR_NULL_PTR(mic.data)) 2008 goto unwrap_failed; 2009 if (read_bytes_from_xdr_buf(rcv_buf, offset, mic.data, mic.len)) 2010 goto unwrap_failed; 2011 2012 maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &gss_data, &mic); 2013 if (maj_stat == GSS_S_CONTEXT_EXPIRED) 2014 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags); 2015 if (maj_stat != GSS_S_COMPLETE) 2016 goto bad_mic; 2017 2018 gss_update_rslack(task, cred, 2, 2 + 1 + XDR_QUADLEN(mic.len)); 2019 ret = 0; 2020 2021 out: 2022 kfree(mic.data); 2023 return ret; 2024 2025 unwrap_failed: 2026 trace_rpcgss_unwrap_failed(task); 2027 goto out; 2028 bad_seqno: 2029 trace_rpcgss_bad_seqno(task, rqstp->rq_seqno, seqno); 2030 goto out; 2031 bad_mic: 2032 trace_rpcgss_verify_mic(task, maj_stat); 2033 goto out; 2034 } 2035 2036 static noinline_for_stack int 2037 gss_unwrap_resp_priv(struct rpc_task *task, struct rpc_cred *cred, 2038 struct gss_cl_ctx *ctx, struct rpc_rqst *rqstp, 2039 struct xdr_stream *xdr) 2040 { 2041 struct xdr_buf *rcv_buf = &rqstp->rq_rcv_buf; 2042 struct kvec *head = rqstp->rq_rcv_buf.head; 2043 u32 offset, opaque_len, maj_stat; 2044 __be32 *p; 2045 2046 p = xdr_inline_decode(xdr, 2 * sizeof(*p)); 2047 if (unlikely(!p)) 2048 goto unwrap_failed; 2049 opaque_len = be32_to_cpup(p++); 2050 offset = (u8 *)(p) - (u8 *)head->iov_base; 2051 if (offset + opaque_len > rcv_buf->len) 2052 goto unwrap_failed; 2053 2054 maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset, 2055 offset + opaque_len, rcv_buf); 2056 if (maj_stat == GSS_S_CONTEXT_EXPIRED) 2057 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags); 2058 if (maj_stat != GSS_S_COMPLETE) 2059 goto bad_unwrap; 2060 /* gss_unwrap decrypted the sequence number */ 2061 if (be32_to_cpup(p++) != rqstp->rq_seqno) 2062 goto bad_seqno; 2063 2064 /* gss_unwrap redacts the opaque blob from the head iovec. 2065 * rcv_buf has changed, thus the stream needs to be reset. 2066 */ 2067 xdr_init_decode(xdr, rcv_buf, p, rqstp); 2068 2069 gss_update_rslack(task, cred, 2 + ctx->gc_gss_ctx->align, 2070 2 + ctx->gc_gss_ctx->slack); 2071 2072 return 0; 2073 unwrap_failed: 2074 trace_rpcgss_unwrap_failed(task); 2075 return -EIO; 2076 bad_seqno: 2077 trace_rpcgss_bad_seqno(task, rqstp->rq_seqno, be32_to_cpup(--p)); 2078 return -EIO; 2079 bad_unwrap: 2080 trace_rpcgss_unwrap(task, maj_stat); 2081 return -EIO; 2082 } 2083 2084 static bool 2085 gss_seq_is_newer(u32 new, u32 old) 2086 { 2087 return (s32)(new - old) > 0; 2088 } 2089 2090 static bool 2091 gss_xmit_need_reencode(struct rpc_task *task) 2092 { 2093 struct rpc_rqst *req = task->tk_rqstp; 2094 struct rpc_cred *cred = req->rq_cred; 2095 struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred); 2096 u32 win, seq_xmit = 0; 2097 bool ret = true; 2098 2099 if (!ctx) 2100 goto out; 2101 2102 if (gss_seq_is_newer(req->rq_seqno, READ_ONCE(ctx->gc_seq))) 2103 goto out_ctx; 2104 2105 seq_xmit = READ_ONCE(ctx->gc_seq_xmit); 2106 while (gss_seq_is_newer(req->rq_seqno, seq_xmit)) { 2107 u32 tmp = seq_xmit; 2108 2109 seq_xmit = cmpxchg(&ctx->gc_seq_xmit, tmp, req->rq_seqno); 2110 if (seq_xmit == tmp) { 2111 ret = false; 2112 goto out_ctx; 2113 } 2114 } 2115 2116 win = ctx->gc_win; 2117 if (win > 0) 2118 ret = !gss_seq_is_newer(req->rq_seqno, seq_xmit - win); 2119 2120 out_ctx: 2121 gss_put_ctx(ctx); 2122 out: 2123 trace_rpcgss_need_reencode(task, seq_xmit, ret); 2124 return ret; 2125 } 2126 2127 static int 2128 gss_unwrap_resp(struct rpc_task *task, struct xdr_stream *xdr) 2129 { 2130 struct rpc_rqst *rqstp = task->tk_rqstp; 2131 struct rpc_cred *cred = rqstp->rq_cred; 2132 struct gss_cred *gss_cred = container_of(cred, struct gss_cred, 2133 gc_base); 2134 struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred); 2135 int status = -EIO; 2136 2137 if (ctx->gc_proc != RPC_GSS_PROC_DATA) 2138 goto out_decode; 2139 switch (gss_cred->gc_service) { 2140 case RPC_GSS_SVC_NONE: 2141 status = gss_unwrap_resp_auth(task, cred); 2142 break; 2143 case RPC_GSS_SVC_INTEGRITY: 2144 status = gss_unwrap_resp_integ(task, cred, ctx, rqstp, xdr); 2145 break; 2146 case RPC_GSS_SVC_PRIVACY: 2147 status = gss_unwrap_resp_priv(task, cred, ctx, rqstp, xdr); 2148 break; 2149 } 2150 if (status) 2151 goto out; 2152 2153 out_decode: 2154 status = rpcauth_unwrap_resp_decode(task, xdr); 2155 out: 2156 gss_put_ctx(ctx); 2157 return status; 2158 } 2159 2160 static const struct rpc_authops authgss_ops = { 2161 .owner = THIS_MODULE, 2162 .au_flavor = RPC_AUTH_GSS, 2163 .au_name = "RPCSEC_GSS", 2164 .create = gss_create, 2165 .destroy = gss_destroy, 2166 .hash_cred = gss_hash_cred, 2167 .lookup_cred = gss_lookup_cred, 2168 .crcreate = gss_create_cred, 2169 .info2flavor = gss_mech_info2flavor, 2170 .flavor2info = gss_mech_flavor2info, 2171 }; 2172 2173 static const struct rpc_credops gss_credops = { 2174 .cr_name = "AUTH_GSS", 2175 .crdestroy = gss_destroy_cred, 2176 .cr_init = gss_cred_init, 2177 .crmatch = gss_match, 2178 .crmarshal = gss_marshal, 2179 .crrefresh = gss_refresh, 2180 .crvalidate = gss_validate, 2181 .crwrap_req = gss_wrap_req, 2182 .crunwrap_resp = gss_unwrap_resp, 2183 .crkey_timeout = gss_key_timeout, 2184 .crstringify_acceptor = gss_stringify_acceptor, 2185 .crneed_reencode = gss_xmit_need_reencode, 2186 }; 2187 2188 static const struct rpc_credops gss_nullops = { 2189 .cr_name = "AUTH_GSS", 2190 .crdestroy = gss_destroy_nullcred, 2191 .crmatch = gss_match, 2192 .crmarshal = gss_marshal, 2193 .crrefresh = gss_refresh_null, 2194 .crvalidate = gss_validate, 2195 .crwrap_req = gss_wrap_req, 2196 .crunwrap_resp = gss_unwrap_resp, 2197 .crstringify_acceptor = gss_stringify_acceptor, 2198 }; 2199 2200 static const struct rpc_pipe_ops gss_upcall_ops_v0 = { 2201 .upcall = gss_v0_upcall, 2202 .downcall = gss_pipe_downcall, 2203 .destroy_msg = gss_pipe_destroy_msg, 2204 .open_pipe = gss_pipe_open_v0, 2205 .release_pipe = gss_pipe_release, 2206 }; 2207 2208 static const struct rpc_pipe_ops gss_upcall_ops_v1 = { 2209 .upcall = gss_v1_upcall, 2210 .downcall = gss_pipe_downcall, 2211 .destroy_msg = gss_pipe_destroy_msg, 2212 .open_pipe = gss_pipe_open_v1, 2213 .release_pipe = gss_pipe_release, 2214 }; 2215 2216 static __net_init int rpcsec_gss_init_net(struct net *net) 2217 { 2218 return gss_svc_init_net(net); 2219 } 2220 2221 static __net_exit void rpcsec_gss_exit_net(struct net *net) 2222 { 2223 gss_svc_shutdown_net(net); 2224 } 2225 2226 static struct pernet_operations rpcsec_gss_net_ops = { 2227 .init = rpcsec_gss_init_net, 2228 .exit = rpcsec_gss_exit_net, 2229 }; 2230 2231 /* 2232 * Initialize RPCSEC_GSS module 2233 */ 2234 static int __init init_rpcsec_gss(void) 2235 { 2236 int err = 0; 2237 2238 err = rpcauth_register(&authgss_ops); 2239 if (err) 2240 goto out; 2241 err = gss_svc_init(); 2242 if (err) 2243 goto out_unregister; 2244 err = register_pernet_subsys(&rpcsec_gss_net_ops); 2245 if (err) 2246 goto out_svc_exit; 2247 rpc_init_wait_queue(&pipe_version_rpc_waitqueue, "gss pipe version"); 2248 return 0; 2249 out_svc_exit: 2250 gss_svc_shutdown(); 2251 out_unregister: 2252 rpcauth_unregister(&authgss_ops); 2253 out: 2254 return err; 2255 } 2256 2257 static void __exit exit_rpcsec_gss(void) 2258 { 2259 unregister_pernet_subsys(&rpcsec_gss_net_ops); 2260 gss_svc_shutdown(); 2261 rpcauth_unregister(&authgss_ops); 2262 rcu_barrier(); /* Wait for completion of call_rcu()'s */ 2263 } 2264 2265 MODULE_ALIAS("rpc-auth-6"); 2266 MODULE_LICENSE("GPL"); 2267 module_param_named(expired_cred_retry_delay, 2268 gss_expired_cred_retry_delay, 2269 uint, 0644); 2270 MODULE_PARM_DESC(expired_cred_retry_delay, "Timeout (in seconds) until " 2271 "the RPC engine retries an expired credential"); 2272 2273 module_param_named(key_expire_timeo, 2274 gss_key_expire_timeo, 2275 uint, 0644); 2276 MODULE_PARM_DESC(key_expire_timeo, "Time (in seconds) at the end of a " 2277 "credential keys lifetime where the NFS layer cleans up " 2278 "prior to key expiration"); 2279 2280 module_init(init_rpcsec_gss) 2281 module_exit(exit_rpcsec_gss) 2282