1 /* 2 * linux/net/sunrpc/auth.c 3 * 4 * Generic RPC client authentication API. 5 * 6 * Copyright (C) 1996, Olaf Kirch <okir@monad.swb.de> 7 */ 8 9 #include <linux/types.h> 10 #include <linux/sched.h> 11 #include <linux/module.h> 12 #include <linux/slab.h> 13 #include <linux/errno.h> 14 #include <linux/hash.h> 15 #include <linux/sunrpc/clnt.h> 16 #include <linux/spinlock.h> 17 18 #ifdef RPC_DEBUG 19 # define RPCDBG_FACILITY RPCDBG_AUTH 20 #endif 21 22 static DEFINE_SPINLOCK(rpc_authflavor_lock); 23 static const struct rpc_authops *auth_flavors[RPC_AUTH_MAXFLAVOR] = { 24 &authnull_ops, /* AUTH_NULL */ 25 &authunix_ops, /* AUTH_UNIX */ 26 NULL, /* others can be loadable modules */ 27 }; 28 29 static LIST_HEAD(cred_unused); 30 static unsigned long number_cred_unused; 31 32 static u32 33 pseudoflavor_to_flavor(u32 flavor) { 34 if (flavor >= RPC_AUTH_MAXFLAVOR) 35 return RPC_AUTH_GSS; 36 return flavor; 37 } 38 39 int 40 rpcauth_register(const struct rpc_authops *ops) 41 { 42 rpc_authflavor_t flavor; 43 int ret = -EPERM; 44 45 if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR) 46 return -EINVAL; 47 spin_lock(&rpc_authflavor_lock); 48 if (auth_flavors[flavor] == NULL) { 49 auth_flavors[flavor] = ops; 50 ret = 0; 51 } 52 spin_unlock(&rpc_authflavor_lock); 53 return ret; 54 } 55 EXPORT_SYMBOL_GPL(rpcauth_register); 56 57 int 58 rpcauth_unregister(const struct rpc_authops *ops) 59 { 60 rpc_authflavor_t flavor; 61 int ret = -EPERM; 62 63 if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR) 64 return -EINVAL; 65 spin_lock(&rpc_authflavor_lock); 66 if (auth_flavors[flavor] == ops) { 67 auth_flavors[flavor] = NULL; 68 ret = 0; 69 } 70 spin_unlock(&rpc_authflavor_lock); 71 return ret; 72 } 73 EXPORT_SYMBOL_GPL(rpcauth_unregister); 74 75 struct rpc_auth * 76 rpcauth_create(rpc_authflavor_t pseudoflavor, struct rpc_clnt *clnt) 77 { 78 struct rpc_auth *auth; 79 const struct rpc_authops *ops; 80 u32 flavor = pseudoflavor_to_flavor(pseudoflavor); 81 82 auth = ERR_PTR(-EINVAL); 83 if (flavor >= RPC_AUTH_MAXFLAVOR) 84 goto out; 85 86 #ifdef CONFIG_KMOD 87 if ((ops = auth_flavors[flavor]) == NULL) 88 request_module("rpc-auth-%u", flavor); 89 #endif 90 spin_lock(&rpc_authflavor_lock); 91 ops = auth_flavors[flavor]; 92 if (ops == NULL || !try_module_get(ops->owner)) { 93 spin_unlock(&rpc_authflavor_lock); 94 goto out; 95 } 96 spin_unlock(&rpc_authflavor_lock); 97 auth = ops->create(clnt, pseudoflavor); 98 module_put(ops->owner); 99 if (IS_ERR(auth)) 100 return auth; 101 if (clnt->cl_auth) 102 rpcauth_release(clnt->cl_auth); 103 clnt->cl_auth = auth; 104 105 out: 106 return auth; 107 } 108 EXPORT_SYMBOL_GPL(rpcauth_create); 109 110 void 111 rpcauth_release(struct rpc_auth *auth) 112 { 113 if (!atomic_dec_and_test(&auth->au_count)) 114 return; 115 auth->au_ops->destroy(auth); 116 } 117 118 static DEFINE_SPINLOCK(rpc_credcache_lock); 119 120 static void 121 rpcauth_unhash_cred_locked(struct rpc_cred *cred) 122 { 123 hlist_del_rcu(&cred->cr_hash); 124 smp_mb__before_clear_bit(); 125 clear_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags); 126 } 127 128 static void 129 rpcauth_unhash_cred(struct rpc_cred *cred) 130 { 131 spinlock_t *cache_lock; 132 133 cache_lock = &cred->cr_auth->au_credcache->lock; 134 spin_lock(cache_lock); 135 if (atomic_read(&cred->cr_count) == 0) 136 rpcauth_unhash_cred_locked(cred); 137 spin_unlock(cache_lock); 138 } 139 140 /* 141 * Initialize RPC credential cache 142 */ 143 int 144 rpcauth_init_credcache(struct rpc_auth *auth) 145 { 146 struct rpc_cred_cache *new; 147 int i; 148 149 new = kmalloc(sizeof(*new), GFP_KERNEL); 150 if (!new) 151 return -ENOMEM; 152 for (i = 0; i < RPC_CREDCACHE_NR; i++) 153 INIT_HLIST_HEAD(&new->hashtable[i]); 154 spin_lock_init(&new->lock); 155 auth->au_credcache = new; 156 return 0; 157 } 158 EXPORT_SYMBOL_GPL(rpcauth_init_credcache); 159 160 /* 161 * Destroy a list of credentials 162 */ 163 static inline 164 void rpcauth_destroy_credlist(struct list_head *head) 165 { 166 struct rpc_cred *cred; 167 168 while (!list_empty(head)) { 169 cred = list_entry(head->next, struct rpc_cred, cr_lru); 170 list_del_init(&cred->cr_lru); 171 put_rpccred(cred); 172 } 173 } 174 175 /* 176 * Clear the RPC credential cache, and delete those credentials 177 * that are not referenced. 178 */ 179 void 180 rpcauth_clear_credcache(struct rpc_cred_cache *cache) 181 { 182 LIST_HEAD(free); 183 struct hlist_head *head; 184 struct rpc_cred *cred; 185 int i; 186 187 spin_lock(&rpc_credcache_lock); 188 spin_lock(&cache->lock); 189 for (i = 0; i < RPC_CREDCACHE_NR; i++) { 190 head = &cache->hashtable[i]; 191 while (!hlist_empty(head)) { 192 cred = hlist_entry(head->first, struct rpc_cred, cr_hash); 193 get_rpccred(cred); 194 if (!list_empty(&cred->cr_lru)) { 195 list_del(&cred->cr_lru); 196 number_cred_unused--; 197 } 198 list_add_tail(&cred->cr_lru, &free); 199 rpcauth_unhash_cred_locked(cred); 200 } 201 } 202 spin_unlock(&cache->lock); 203 spin_unlock(&rpc_credcache_lock); 204 rpcauth_destroy_credlist(&free); 205 } 206 207 /* 208 * Destroy the RPC credential cache 209 */ 210 void 211 rpcauth_destroy_credcache(struct rpc_auth *auth) 212 { 213 struct rpc_cred_cache *cache = auth->au_credcache; 214 215 if (cache) { 216 auth->au_credcache = NULL; 217 rpcauth_clear_credcache(cache); 218 kfree(cache); 219 } 220 } 221 EXPORT_SYMBOL_GPL(rpcauth_destroy_credcache); 222 223 224 #define RPC_AUTH_EXPIRY_MORATORIUM (60 * HZ) 225 226 /* 227 * Remove stale credentials. Avoid sleeping inside the loop. 228 */ 229 static int 230 rpcauth_prune_expired(struct list_head *free, int nr_to_scan) 231 { 232 spinlock_t *cache_lock; 233 struct rpc_cred *cred; 234 unsigned long expired = jiffies - RPC_AUTH_EXPIRY_MORATORIUM; 235 236 while (!list_empty(&cred_unused)) { 237 cred = list_entry(cred_unused.next, struct rpc_cred, cr_lru); 238 list_del_init(&cred->cr_lru); 239 number_cred_unused--; 240 if (atomic_read(&cred->cr_count) != 0) 241 continue; 242 /* Enforce a 5 second garbage collection moratorium */ 243 if (time_in_range(cred->cr_expire, expired, jiffies) && 244 test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0) 245 continue; 246 cache_lock = &cred->cr_auth->au_credcache->lock; 247 spin_lock(cache_lock); 248 if (atomic_read(&cred->cr_count) == 0) { 249 get_rpccred(cred); 250 list_add_tail(&cred->cr_lru, free); 251 rpcauth_unhash_cred_locked(cred); 252 nr_to_scan--; 253 } 254 spin_unlock(cache_lock); 255 if (nr_to_scan == 0) 256 break; 257 } 258 return nr_to_scan; 259 } 260 261 /* 262 * Run memory cache shrinker. 263 */ 264 static int 265 rpcauth_cache_shrinker(int nr_to_scan, gfp_t gfp_mask) 266 { 267 LIST_HEAD(free); 268 int res; 269 270 if (list_empty(&cred_unused)) 271 return 0; 272 spin_lock(&rpc_credcache_lock); 273 nr_to_scan = rpcauth_prune_expired(&free, nr_to_scan); 274 res = (number_cred_unused / 100) * sysctl_vfs_cache_pressure; 275 spin_unlock(&rpc_credcache_lock); 276 rpcauth_destroy_credlist(&free); 277 return res; 278 } 279 280 /* 281 * Look up a process' credentials in the authentication cache 282 */ 283 struct rpc_cred * 284 rpcauth_lookup_credcache(struct rpc_auth *auth, struct auth_cred * acred, 285 int flags) 286 { 287 LIST_HEAD(free); 288 struct rpc_cred_cache *cache = auth->au_credcache; 289 struct hlist_node *pos; 290 struct rpc_cred *cred = NULL, 291 *entry, *new; 292 unsigned int nr; 293 294 nr = hash_long(acred->uid, RPC_CREDCACHE_HASHBITS); 295 296 rcu_read_lock(); 297 hlist_for_each_entry_rcu(entry, pos, &cache->hashtable[nr], cr_hash) { 298 if (!entry->cr_ops->crmatch(acred, entry, flags)) 299 continue; 300 spin_lock(&cache->lock); 301 if (test_bit(RPCAUTH_CRED_HASHED, &entry->cr_flags) == 0) { 302 spin_unlock(&cache->lock); 303 continue; 304 } 305 cred = get_rpccred(entry); 306 spin_unlock(&cache->lock); 307 break; 308 } 309 rcu_read_unlock(); 310 311 if (cred != NULL) 312 goto found; 313 314 new = auth->au_ops->crcreate(auth, acred, flags); 315 if (IS_ERR(new)) { 316 cred = new; 317 goto out; 318 } 319 320 spin_lock(&cache->lock); 321 hlist_for_each_entry(entry, pos, &cache->hashtable[nr], cr_hash) { 322 if (!entry->cr_ops->crmatch(acred, entry, flags)) 323 continue; 324 cred = get_rpccred(entry); 325 break; 326 } 327 if (cred == NULL) { 328 cred = new; 329 set_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags); 330 hlist_add_head_rcu(&cred->cr_hash, &cache->hashtable[nr]); 331 } else 332 list_add_tail(&new->cr_lru, &free); 333 spin_unlock(&cache->lock); 334 found: 335 if (test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags) 336 && cred->cr_ops->cr_init != NULL 337 && !(flags & RPCAUTH_LOOKUP_NEW)) { 338 int res = cred->cr_ops->cr_init(auth, cred); 339 if (res < 0) { 340 put_rpccred(cred); 341 cred = ERR_PTR(res); 342 } 343 } 344 rpcauth_destroy_credlist(&free); 345 out: 346 return cred; 347 } 348 EXPORT_SYMBOL_GPL(rpcauth_lookup_credcache); 349 350 struct rpc_cred * 351 rpcauth_lookupcred(struct rpc_auth *auth, int flags) 352 { 353 struct auth_cred acred = { 354 .uid = current->fsuid, 355 .gid = current->fsgid, 356 .group_info = current->group_info, 357 }; 358 struct rpc_cred *ret; 359 360 dprintk("RPC: looking up %s cred\n", 361 auth->au_ops->au_name); 362 get_group_info(acred.group_info); 363 ret = auth->au_ops->lookup_cred(auth, &acred, flags); 364 put_group_info(acred.group_info); 365 return ret; 366 } 367 368 void 369 rpcauth_init_cred(struct rpc_cred *cred, const struct auth_cred *acred, 370 struct rpc_auth *auth, const struct rpc_credops *ops) 371 { 372 INIT_HLIST_NODE(&cred->cr_hash); 373 INIT_LIST_HEAD(&cred->cr_lru); 374 atomic_set(&cred->cr_count, 1); 375 cred->cr_auth = auth; 376 cred->cr_ops = ops; 377 cred->cr_expire = jiffies; 378 #ifdef RPC_DEBUG 379 cred->cr_magic = RPCAUTH_CRED_MAGIC; 380 #endif 381 cred->cr_uid = acred->uid; 382 } 383 EXPORT_SYMBOL_GPL(rpcauth_init_cred); 384 385 void 386 rpcauth_generic_bind_cred(struct rpc_task *task, struct rpc_cred *cred) 387 { 388 task->tk_msg.rpc_cred = get_rpccred(cred); 389 dprintk("RPC: %5u holding %s cred %p\n", task->tk_pid, 390 cred->cr_auth->au_ops->au_name, cred); 391 } 392 EXPORT_SYMBOL_GPL(rpcauth_generic_bind_cred); 393 394 static void 395 rpcauth_bind_root_cred(struct rpc_task *task) 396 { 397 struct rpc_auth *auth = task->tk_client->cl_auth; 398 struct auth_cred acred = { 399 .uid = 0, 400 .gid = 0, 401 }; 402 struct rpc_cred *ret; 403 404 dprintk("RPC: %5u looking up %s cred\n", 405 task->tk_pid, task->tk_client->cl_auth->au_ops->au_name); 406 ret = auth->au_ops->lookup_cred(auth, &acred, 0); 407 if (!IS_ERR(ret)) 408 task->tk_msg.rpc_cred = ret; 409 else 410 task->tk_status = PTR_ERR(ret); 411 } 412 413 static void 414 rpcauth_bind_new_cred(struct rpc_task *task) 415 { 416 struct rpc_auth *auth = task->tk_client->cl_auth; 417 struct rpc_cred *ret; 418 419 dprintk("RPC: %5u looking up %s cred\n", 420 task->tk_pid, auth->au_ops->au_name); 421 ret = rpcauth_lookupcred(auth, 0); 422 if (!IS_ERR(ret)) 423 task->tk_msg.rpc_cred = ret; 424 else 425 task->tk_status = PTR_ERR(ret); 426 } 427 428 void 429 rpcauth_bindcred(struct rpc_task *task, struct rpc_cred *cred, int flags) 430 { 431 if (cred != NULL) 432 cred->cr_ops->crbind(task, cred); 433 else if (flags & RPC_TASK_ROOTCREDS) 434 rpcauth_bind_root_cred(task); 435 else 436 rpcauth_bind_new_cred(task); 437 } 438 439 void 440 put_rpccred(struct rpc_cred *cred) 441 { 442 /* Fast path for unhashed credentials */ 443 if (test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) != 0) 444 goto need_lock; 445 446 if (!atomic_dec_and_test(&cred->cr_count)) 447 return; 448 goto out_destroy; 449 need_lock: 450 if (!atomic_dec_and_lock(&cred->cr_count, &rpc_credcache_lock)) 451 return; 452 if (!list_empty(&cred->cr_lru)) { 453 number_cred_unused--; 454 list_del_init(&cred->cr_lru); 455 } 456 if (test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) == 0) 457 rpcauth_unhash_cred(cred); 458 else if (test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) != 0) { 459 cred->cr_expire = jiffies; 460 list_add_tail(&cred->cr_lru, &cred_unused); 461 number_cred_unused++; 462 spin_unlock(&rpc_credcache_lock); 463 return; 464 } 465 spin_unlock(&rpc_credcache_lock); 466 out_destroy: 467 cred->cr_ops->crdestroy(cred); 468 } 469 EXPORT_SYMBOL_GPL(put_rpccred); 470 471 void 472 rpcauth_unbindcred(struct rpc_task *task) 473 { 474 struct rpc_cred *cred = task->tk_msg.rpc_cred; 475 476 dprintk("RPC: %5u releasing %s cred %p\n", 477 task->tk_pid, cred->cr_auth->au_ops->au_name, cred); 478 479 put_rpccred(cred); 480 task->tk_msg.rpc_cred = NULL; 481 } 482 483 __be32 * 484 rpcauth_marshcred(struct rpc_task *task, __be32 *p) 485 { 486 struct rpc_cred *cred = task->tk_msg.rpc_cred; 487 488 dprintk("RPC: %5u marshaling %s cred %p\n", 489 task->tk_pid, cred->cr_auth->au_ops->au_name, cred); 490 491 return cred->cr_ops->crmarshal(task, p); 492 } 493 494 __be32 * 495 rpcauth_checkverf(struct rpc_task *task, __be32 *p) 496 { 497 struct rpc_cred *cred = task->tk_msg.rpc_cred; 498 499 dprintk("RPC: %5u validating %s cred %p\n", 500 task->tk_pid, cred->cr_auth->au_ops->au_name, cred); 501 502 return cred->cr_ops->crvalidate(task, p); 503 } 504 505 int 506 rpcauth_wrap_req(struct rpc_task *task, kxdrproc_t encode, void *rqstp, 507 __be32 *data, void *obj) 508 { 509 struct rpc_cred *cred = task->tk_msg.rpc_cred; 510 511 dprintk("RPC: %5u using %s cred %p to wrap rpc data\n", 512 task->tk_pid, cred->cr_ops->cr_name, cred); 513 if (cred->cr_ops->crwrap_req) 514 return cred->cr_ops->crwrap_req(task, encode, rqstp, data, obj); 515 /* By default, we encode the arguments normally. */ 516 return rpc_call_xdrproc(encode, rqstp, data, obj); 517 } 518 519 int 520 rpcauth_unwrap_resp(struct rpc_task *task, kxdrproc_t decode, void *rqstp, 521 __be32 *data, void *obj) 522 { 523 struct rpc_cred *cred = task->tk_msg.rpc_cred; 524 525 dprintk("RPC: %5u using %s cred %p to unwrap rpc data\n", 526 task->tk_pid, cred->cr_ops->cr_name, cred); 527 if (cred->cr_ops->crunwrap_resp) 528 return cred->cr_ops->crunwrap_resp(task, decode, rqstp, 529 data, obj); 530 /* By default, we decode the arguments normally. */ 531 return rpc_call_xdrproc(decode, rqstp, data, obj); 532 } 533 534 int 535 rpcauth_refreshcred(struct rpc_task *task) 536 { 537 struct rpc_cred *cred = task->tk_msg.rpc_cred; 538 int err; 539 540 dprintk("RPC: %5u refreshing %s cred %p\n", 541 task->tk_pid, cred->cr_auth->au_ops->au_name, cred); 542 543 err = cred->cr_ops->crrefresh(task); 544 if (err < 0) 545 task->tk_status = err; 546 return err; 547 } 548 549 void 550 rpcauth_invalcred(struct rpc_task *task) 551 { 552 struct rpc_cred *cred = task->tk_msg.rpc_cred; 553 554 dprintk("RPC: %5u invalidating %s cred %p\n", 555 task->tk_pid, cred->cr_auth->au_ops->au_name, cred); 556 if (cred) 557 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags); 558 } 559 560 int 561 rpcauth_uptodatecred(struct rpc_task *task) 562 { 563 struct rpc_cred *cred = task->tk_msg.rpc_cred; 564 565 return cred == NULL || 566 test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0; 567 } 568 569 static struct shrinker rpc_cred_shrinker = { 570 .shrink = rpcauth_cache_shrinker, 571 .seeks = DEFAULT_SEEKS, 572 }; 573 574 void __init rpcauth_init_module(void) 575 { 576 rpc_init_authunix(); 577 rpc_init_generic_auth(); 578 register_shrinker(&rpc_cred_shrinker); 579 } 580 581 void __exit rpcauth_remove_module(void) 582 { 583 unregister_shrinker(&rpc_cred_shrinker); 584 } 585