1 /* 2 * Neil Brown <neilb@cse.unsw.edu.au> 3 * J. Bruce Fields <bfields@umich.edu> 4 * Andy Adamson <andros@umich.edu> 5 * Dug Song <dugsong@monkey.org> 6 * 7 * RPCSEC_GSS server authentication. 8 * This implements RPCSEC_GSS as defined in rfc2203 (rpcsec_gss) and rfc2078 9 * (gssapi) 10 * 11 * The RPCSEC_GSS involves three stages: 12 * 1/ context creation 13 * 2/ data exchange 14 * 3/ context destruction 15 * 16 * Context creation is handled largely by upcalls to user-space. 17 * In particular, GSS_Accept_sec_context is handled by an upcall 18 * Data exchange is handled entirely within the kernel 19 * In particular, GSS_GetMIC, GSS_VerifyMIC, GSS_Seal, GSS_Unseal are in-kernel. 20 * Context destruction is handled in-kernel 21 * GSS_Delete_sec_context is in-kernel 22 * 23 * Context creation is initiated by a RPCSEC_GSS_INIT request arriving. 24 * The context handle and gss_token are used as a key into the rpcsec_init cache. 25 * The content of this cache includes some of the outputs of GSS_Accept_sec_context, 26 * being major_status, minor_status, context_handle, reply_token. 27 * These are sent back to the client. 28 * Sequence window management is handled by the kernel. The window size if currently 29 * a compile time constant. 30 * 31 * When user-space is happy that a context is established, it places an entry 32 * in the rpcsec_context cache. The key for this cache is the context_handle. 33 * The content includes: 34 * uid/gidlist - for determining access rights 35 * mechanism type 36 * mechanism specific information, such as a key 37 * 38 */ 39 40 #include <linux/types.h> 41 #include <linux/module.h> 42 #include <linux/pagemap.h> 43 44 #include <linux/sunrpc/auth_gss.h> 45 #include <linux/sunrpc/svcauth.h> 46 #include <linux/sunrpc/gss_err.h> 47 #include <linux/sunrpc/svcauth.h> 48 #include <linux/sunrpc/svcauth_gss.h> 49 #include <linux/sunrpc/cache.h> 50 51 #ifdef RPC_DEBUG 52 # define RPCDBG_FACILITY RPCDBG_AUTH 53 #endif 54 55 /* The rpcsec_init cache is used for mapping RPCSEC_GSS_{,CONT_}INIT requests 56 * into replies. 57 * 58 * Key is context handle (\x if empty) and gss_token. 59 * Content is major_status minor_status (integers) context_handle, reply_token. 60 * 61 */ 62 63 static int netobj_equal(struct xdr_netobj *a, struct xdr_netobj *b) 64 { 65 return a->len == b->len && 0 == memcmp(a->data, b->data, a->len); 66 } 67 68 #define RSI_HASHBITS 6 69 #define RSI_HASHMAX (1<<RSI_HASHBITS) 70 #define RSI_HASHMASK (RSI_HASHMAX-1) 71 72 struct rsi { 73 struct cache_head h; 74 struct xdr_netobj in_handle, in_token; 75 struct xdr_netobj out_handle, out_token; 76 int major_status, minor_status; 77 }; 78 79 static struct cache_head *rsi_table[RSI_HASHMAX]; 80 static struct cache_detail rsi_cache; 81 static struct rsi *rsi_lookup(struct rsi *item, int set); 82 83 static void rsi_free(struct rsi *rsii) 84 { 85 kfree(rsii->in_handle.data); 86 kfree(rsii->in_token.data); 87 kfree(rsii->out_handle.data); 88 kfree(rsii->out_token.data); 89 } 90 91 static void rsi_put(struct cache_head *item, struct cache_detail *cd) 92 { 93 struct rsi *rsii = container_of(item, struct rsi, h); 94 if (cache_put(item, cd)) { 95 rsi_free(rsii); 96 kfree(rsii); 97 } 98 } 99 100 static inline int rsi_hash(struct rsi *item) 101 { 102 return hash_mem(item->in_handle.data, item->in_handle.len, RSI_HASHBITS) 103 ^ hash_mem(item->in_token.data, item->in_token.len, RSI_HASHBITS); 104 } 105 106 static inline int rsi_match(struct rsi *item, struct rsi *tmp) 107 { 108 return netobj_equal(&item->in_handle, &tmp->in_handle) 109 && netobj_equal(&item->in_token, &tmp->in_token); 110 } 111 112 static int dup_to_netobj(struct xdr_netobj *dst, char *src, int len) 113 { 114 dst->len = len; 115 dst->data = (len ? kmalloc(len, GFP_KERNEL) : NULL); 116 if (dst->data) 117 memcpy(dst->data, src, len); 118 if (len && !dst->data) 119 return -ENOMEM; 120 return 0; 121 } 122 123 static inline int dup_netobj(struct xdr_netobj *dst, struct xdr_netobj *src) 124 { 125 return dup_to_netobj(dst, src->data, src->len); 126 } 127 128 static inline void rsi_init(struct rsi *new, struct rsi *item) 129 { 130 new->out_handle.data = NULL; 131 new->out_handle.len = 0; 132 new->out_token.data = NULL; 133 new->out_token.len = 0; 134 new->in_handle.len = item->in_handle.len; 135 item->in_handle.len = 0; 136 new->in_token.len = item->in_token.len; 137 item->in_token.len = 0; 138 new->in_handle.data = item->in_handle.data; 139 item->in_handle.data = NULL; 140 new->in_token.data = item->in_token.data; 141 item->in_token.data = NULL; 142 } 143 144 static inline void rsi_update(struct rsi *new, struct rsi *item) 145 { 146 BUG_ON(new->out_handle.data || new->out_token.data); 147 new->out_handle.len = item->out_handle.len; 148 item->out_handle.len = 0; 149 new->out_token.len = item->out_token.len; 150 item->out_token.len = 0; 151 new->out_handle.data = item->out_handle.data; 152 item->out_handle.data = NULL; 153 new->out_token.data = item->out_token.data; 154 item->out_token.data = NULL; 155 156 new->major_status = item->major_status; 157 new->minor_status = item->minor_status; 158 } 159 160 static void rsi_request(struct cache_detail *cd, 161 struct cache_head *h, 162 char **bpp, int *blen) 163 { 164 struct rsi *rsii = container_of(h, struct rsi, h); 165 166 qword_addhex(bpp, blen, rsii->in_handle.data, rsii->in_handle.len); 167 qword_addhex(bpp, blen, rsii->in_token.data, rsii->in_token.len); 168 (*bpp)[-1] = '\n'; 169 } 170 171 172 static int rsi_parse(struct cache_detail *cd, 173 char *mesg, int mlen) 174 { 175 /* context token expiry major minor context token */ 176 char *buf = mesg; 177 char *ep; 178 int len; 179 struct rsi rsii, *rsip = NULL; 180 time_t expiry; 181 int status = -EINVAL; 182 183 memset(&rsii, 0, sizeof(rsii)); 184 /* handle */ 185 len = qword_get(&mesg, buf, mlen); 186 if (len < 0) 187 goto out; 188 status = -ENOMEM; 189 if (dup_to_netobj(&rsii.in_handle, buf, len)) 190 goto out; 191 192 /* token */ 193 len = qword_get(&mesg, buf, mlen); 194 status = -EINVAL; 195 if (len < 0) 196 goto out; 197 status = -ENOMEM; 198 if (dup_to_netobj(&rsii.in_token, buf, len)) 199 goto out; 200 201 rsii.h.flags = 0; 202 /* expiry */ 203 expiry = get_expiry(&mesg); 204 status = -EINVAL; 205 if (expiry == 0) 206 goto out; 207 208 /* major/minor */ 209 len = qword_get(&mesg, buf, mlen); 210 if (len < 0) 211 goto out; 212 if (len == 0) { 213 goto out; 214 } else { 215 rsii.major_status = simple_strtoul(buf, &ep, 10); 216 if (*ep) 217 goto out; 218 len = qword_get(&mesg, buf, mlen); 219 if (len <= 0) 220 goto out; 221 rsii.minor_status = simple_strtoul(buf, &ep, 10); 222 if (*ep) 223 goto out; 224 225 /* out_handle */ 226 len = qword_get(&mesg, buf, mlen); 227 if (len < 0) 228 goto out; 229 status = -ENOMEM; 230 if (dup_to_netobj(&rsii.out_handle, buf, len)) 231 goto out; 232 233 /* out_token */ 234 len = qword_get(&mesg, buf, mlen); 235 status = -EINVAL; 236 if (len < 0) 237 goto out; 238 status = -ENOMEM; 239 if (dup_to_netobj(&rsii.out_token, buf, len)) 240 goto out; 241 } 242 rsii.h.expiry_time = expiry; 243 rsip = rsi_lookup(&rsii, 1); 244 status = 0; 245 out: 246 rsi_free(&rsii); 247 if (rsip) 248 rsi_put(&rsip->h, &rsi_cache); 249 return status; 250 } 251 252 static struct cache_detail rsi_cache = { 253 .owner = THIS_MODULE, 254 .hash_size = RSI_HASHMAX, 255 .hash_table = rsi_table, 256 .name = "auth.rpcsec.init", 257 .cache_put = rsi_put, 258 .cache_request = rsi_request, 259 .cache_parse = rsi_parse, 260 }; 261 262 static DefineSimpleCacheLookup(rsi, rsi) 263 264 /* 265 * The rpcsec_context cache is used to store a context that is 266 * used in data exchange. 267 * The key is a context handle. The content is: 268 * uid, gidlist, mechanism, service-set, mech-specific-data 269 */ 270 271 #define RSC_HASHBITS 10 272 #define RSC_HASHMAX (1<<RSC_HASHBITS) 273 #define RSC_HASHMASK (RSC_HASHMAX-1) 274 275 #define GSS_SEQ_WIN 128 276 277 struct gss_svc_seq_data { 278 /* highest seq number seen so far: */ 279 int sd_max; 280 /* for i such that sd_max-GSS_SEQ_WIN < i <= sd_max, the i-th bit of 281 * sd_win is nonzero iff sequence number i has been seen already: */ 282 unsigned long sd_win[GSS_SEQ_WIN/BITS_PER_LONG]; 283 spinlock_t sd_lock; 284 }; 285 286 struct rsc { 287 struct cache_head h; 288 struct xdr_netobj handle; 289 struct svc_cred cred; 290 struct gss_svc_seq_data seqdata; 291 struct gss_ctx *mechctx; 292 }; 293 294 static struct cache_head *rsc_table[RSC_HASHMAX]; 295 static struct cache_detail rsc_cache; 296 static struct rsc *rsc_lookup(struct rsc *item, int set); 297 298 static void rsc_free(struct rsc *rsci) 299 { 300 kfree(rsci->handle.data); 301 if (rsci->mechctx) 302 gss_delete_sec_context(&rsci->mechctx); 303 if (rsci->cred.cr_group_info) 304 put_group_info(rsci->cred.cr_group_info); 305 } 306 307 static void rsc_put(struct cache_head *item, struct cache_detail *cd) 308 { 309 struct rsc *rsci = container_of(item, struct rsc, h); 310 311 if (cache_put(item, cd)) { 312 rsc_free(rsci); 313 kfree(rsci); 314 } 315 } 316 317 static inline int 318 rsc_hash(struct rsc *rsci) 319 { 320 return hash_mem(rsci->handle.data, rsci->handle.len, RSC_HASHBITS); 321 } 322 323 static inline int 324 rsc_match(struct rsc *new, struct rsc *tmp) 325 { 326 return netobj_equal(&new->handle, &tmp->handle); 327 } 328 329 static inline void 330 rsc_init(struct rsc *new, struct rsc *tmp) 331 { 332 new->handle.len = tmp->handle.len; 333 tmp->handle.len = 0; 334 new->handle.data = tmp->handle.data; 335 tmp->handle.data = NULL; 336 new->mechctx = NULL; 337 new->cred.cr_group_info = NULL; 338 } 339 340 static inline void 341 rsc_update(struct rsc *new, struct rsc *tmp) 342 { 343 new->mechctx = tmp->mechctx; 344 tmp->mechctx = NULL; 345 memset(&new->seqdata, 0, sizeof(new->seqdata)); 346 spin_lock_init(&new->seqdata.sd_lock); 347 new->cred = tmp->cred; 348 tmp->cred.cr_group_info = NULL; 349 } 350 351 static int rsc_parse(struct cache_detail *cd, 352 char *mesg, int mlen) 353 { 354 /* contexthandle expiry [ uid gid N <n gids> mechname ...mechdata... ] */ 355 char *buf = mesg; 356 int len, rv; 357 struct rsc rsci, *rscp = NULL; 358 time_t expiry; 359 int status = -EINVAL; 360 361 memset(&rsci, 0, sizeof(rsci)); 362 /* context handle */ 363 len = qword_get(&mesg, buf, mlen); 364 if (len < 0) goto out; 365 status = -ENOMEM; 366 if (dup_to_netobj(&rsci.handle, buf, len)) 367 goto out; 368 369 rsci.h.flags = 0; 370 /* expiry */ 371 expiry = get_expiry(&mesg); 372 status = -EINVAL; 373 if (expiry == 0) 374 goto out; 375 376 /* uid, or NEGATIVE */ 377 rv = get_int(&mesg, &rsci.cred.cr_uid); 378 if (rv == -EINVAL) 379 goto out; 380 if (rv == -ENOENT) 381 set_bit(CACHE_NEGATIVE, &rsci.h.flags); 382 else { 383 int N, i; 384 struct gss_api_mech *gm; 385 386 /* gid */ 387 if (get_int(&mesg, &rsci.cred.cr_gid)) 388 goto out; 389 390 /* number of additional gid's */ 391 if (get_int(&mesg, &N)) 392 goto out; 393 status = -ENOMEM; 394 rsci.cred.cr_group_info = groups_alloc(N); 395 if (rsci.cred.cr_group_info == NULL) 396 goto out; 397 398 /* gid's */ 399 status = -EINVAL; 400 for (i=0; i<N; i++) { 401 gid_t gid; 402 if (get_int(&mesg, &gid)) 403 goto out; 404 GROUP_AT(rsci.cred.cr_group_info, i) = gid; 405 } 406 407 /* mech name */ 408 len = qword_get(&mesg, buf, mlen); 409 if (len < 0) 410 goto out; 411 gm = gss_mech_get_by_name(buf); 412 status = -EOPNOTSUPP; 413 if (!gm) 414 goto out; 415 416 status = -EINVAL; 417 /* mech-specific data: */ 418 len = qword_get(&mesg, buf, mlen); 419 if (len < 0) { 420 gss_mech_put(gm); 421 goto out; 422 } 423 status = gss_import_sec_context(buf, len, gm, &rsci.mechctx); 424 if (status) { 425 gss_mech_put(gm); 426 goto out; 427 } 428 gss_mech_put(gm); 429 } 430 rsci.h.expiry_time = expiry; 431 rscp = rsc_lookup(&rsci, 1); 432 status = 0; 433 out: 434 rsc_free(&rsci); 435 if (rscp) 436 rsc_put(&rscp->h, &rsc_cache); 437 return status; 438 } 439 440 static struct cache_detail rsc_cache = { 441 .owner = THIS_MODULE, 442 .hash_size = RSC_HASHMAX, 443 .hash_table = rsc_table, 444 .name = "auth.rpcsec.context", 445 .cache_put = rsc_put, 446 .cache_parse = rsc_parse, 447 }; 448 449 static DefineSimpleCacheLookup(rsc, rsc); 450 451 static struct rsc * 452 gss_svc_searchbyctx(struct xdr_netobj *handle) 453 { 454 struct rsc rsci; 455 struct rsc *found; 456 457 memset(&rsci, 0, sizeof(rsci)); 458 if (dup_to_netobj(&rsci.handle, handle->data, handle->len)) 459 return NULL; 460 found = rsc_lookup(&rsci, 0); 461 rsc_free(&rsci); 462 if (!found) 463 return NULL; 464 if (cache_check(&rsc_cache, &found->h, NULL)) 465 return NULL; 466 return found; 467 } 468 469 /* Implements sequence number algorithm as specified in RFC 2203. */ 470 static int 471 gss_check_seq_num(struct rsc *rsci, int seq_num) 472 { 473 struct gss_svc_seq_data *sd = &rsci->seqdata; 474 475 spin_lock(&sd->sd_lock); 476 if (seq_num > sd->sd_max) { 477 if (seq_num >= sd->sd_max + GSS_SEQ_WIN) { 478 memset(sd->sd_win,0,sizeof(sd->sd_win)); 479 sd->sd_max = seq_num; 480 } else while (sd->sd_max < seq_num) { 481 sd->sd_max++; 482 __clear_bit(sd->sd_max % GSS_SEQ_WIN, sd->sd_win); 483 } 484 __set_bit(seq_num % GSS_SEQ_WIN, sd->sd_win); 485 goto ok; 486 } else if (seq_num <= sd->sd_max - GSS_SEQ_WIN) { 487 goto drop; 488 } 489 /* sd_max - GSS_SEQ_WIN < seq_num <= sd_max */ 490 if (__test_and_set_bit(seq_num % GSS_SEQ_WIN, sd->sd_win)) 491 goto drop; 492 ok: 493 spin_unlock(&sd->sd_lock); 494 return 1; 495 drop: 496 spin_unlock(&sd->sd_lock); 497 return 0; 498 } 499 500 static inline u32 round_up_to_quad(u32 i) 501 { 502 return (i + 3 ) & ~3; 503 } 504 505 static inline int 506 svc_safe_getnetobj(struct kvec *argv, struct xdr_netobj *o) 507 { 508 int l; 509 510 if (argv->iov_len < 4) 511 return -1; 512 o->len = ntohl(svc_getu32(argv)); 513 l = round_up_to_quad(o->len); 514 if (argv->iov_len < l) 515 return -1; 516 o->data = argv->iov_base; 517 argv->iov_base += l; 518 argv->iov_len -= l; 519 return 0; 520 } 521 522 static inline int 523 svc_safe_putnetobj(struct kvec *resv, struct xdr_netobj *o) 524 { 525 u32 *p; 526 527 if (resv->iov_len + 4 > PAGE_SIZE) 528 return -1; 529 svc_putu32(resv, htonl(o->len)); 530 p = resv->iov_base + resv->iov_len; 531 resv->iov_len += round_up_to_quad(o->len); 532 if (resv->iov_len > PAGE_SIZE) 533 return -1; 534 memcpy(p, o->data, o->len); 535 memset((u8 *)p + o->len, 0, round_up_to_quad(o->len) - o->len); 536 return 0; 537 } 538 539 /* Verify the checksum on the header and return SVC_OK on success. 540 * Otherwise, return SVC_DROP (in the case of a bad sequence number) 541 * or return SVC_DENIED and indicate error in authp. 542 */ 543 static int 544 gss_verify_header(struct svc_rqst *rqstp, struct rsc *rsci, 545 u32 *rpcstart, struct rpc_gss_wire_cred *gc, u32 *authp) 546 { 547 struct gss_ctx *ctx_id = rsci->mechctx; 548 struct xdr_buf rpchdr; 549 struct xdr_netobj checksum; 550 u32 flavor = 0; 551 struct kvec *argv = &rqstp->rq_arg.head[0]; 552 struct kvec iov; 553 554 /* data to compute the checksum over: */ 555 iov.iov_base = rpcstart; 556 iov.iov_len = (u8 *)argv->iov_base - (u8 *)rpcstart; 557 xdr_buf_from_iov(&iov, &rpchdr); 558 559 *authp = rpc_autherr_badverf; 560 if (argv->iov_len < 4) 561 return SVC_DENIED; 562 flavor = ntohl(svc_getu32(argv)); 563 if (flavor != RPC_AUTH_GSS) 564 return SVC_DENIED; 565 if (svc_safe_getnetobj(argv, &checksum)) 566 return SVC_DENIED; 567 568 if (rqstp->rq_deferred) /* skip verification of revisited request */ 569 return SVC_OK; 570 if (gss_verify_mic(ctx_id, &rpchdr, &checksum) != GSS_S_COMPLETE) { 571 *authp = rpcsec_gsserr_credproblem; 572 return SVC_DENIED; 573 } 574 575 if (gc->gc_seq > MAXSEQ) { 576 dprintk("RPC: svcauth_gss: discarding request with large sequence number %d\n", 577 gc->gc_seq); 578 *authp = rpcsec_gsserr_ctxproblem; 579 return SVC_DENIED; 580 } 581 if (!gss_check_seq_num(rsci, gc->gc_seq)) { 582 dprintk("RPC: svcauth_gss: discarding request with old sequence number %d\n", 583 gc->gc_seq); 584 return SVC_DROP; 585 } 586 return SVC_OK; 587 } 588 589 static int 590 gss_write_null_verf(struct svc_rqst *rqstp) 591 { 592 u32 *p; 593 594 svc_putu32(rqstp->rq_res.head, htonl(RPC_AUTH_NULL)); 595 p = rqstp->rq_res.head->iov_base + rqstp->rq_res.head->iov_len; 596 /* don't really need to check if head->iov_len > PAGE_SIZE ... */ 597 *p++ = 0; 598 if (!xdr_ressize_check(rqstp, p)) 599 return -1; 600 return 0; 601 } 602 603 static int 604 gss_write_verf(struct svc_rqst *rqstp, struct gss_ctx *ctx_id, u32 seq) 605 { 606 u32 xdr_seq; 607 u32 maj_stat; 608 struct xdr_buf verf_data; 609 struct xdr_netobj mic; 610 u32 *p; 611 struct kvec iov; 612 613 svc_putu32(rqstp->rq_res.head, htonl(RPC_AUTH_GSS)); 614 xdr_seq = htonl(seq); 615 616 iov.iov_base = &xdr_seq; 617 iov.iov_len = sizeof(xdr_seq); 618 xdr_buf_from_iov(&iov, &verf_data); 619 p = rqstp->rq_res.head->iov_base + rqstp->rq_res.head->iov_len; 620 mic.data = (u8 *)(p + 1); 621 maj_stat = gss_get_mic(ctx_id, &verf_data, &mic); 622 if (maj_stat != GSS_S_COMPLETE) 623 return -1; 624 *p++ = htonl(mic.len); 625 memset((u8 *)p + mic.len, 0, round_up_to_quad(mic.len) - mic.len); 626 p += XDR_QUADLEN(mic.len); 627 if (!xdr_ressize_check(rqstp, p)) 628 return -1; 629 return 0; 630 } 631 632 struct gss_domain { 633 struct auth_domain h; 634 u32 pseudoflavor; 635 }; 636 637 static struct auth_domain * 638 find_gss_auth_domain(struct gss_ctx *ctx, u32 svc) 639 { 640 char *name; 641 642 name = gss_service_to_auth_domain_name(ctx->mech_type, svc); 643 if (!name) 644 return NULL; 645 return auth_domain_find(name); 646 } 647 648 static struct auth_ops svcauthops_gss; 649 650 int 651 svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name) 652 { 653 struct gss_domain *new; 654 struct auth_domain *test; 655 int stat = -ENOMEM; 656 657 new = kmalloc(sizeof(*new), GFP_KERNEL); 658 if (!new) 659 goto out; 660 kref_init(&new->h.ref); 661 new->h.name = kmalloc(strlen(name) + 1, GFP_KERNEL); 662 if (!new->h.name) 663 goto out_free_dom; 664 strcpy(new->h.name, name); 665 new->h.flavour = &svcauthops_gss; 666 new->pseudoflavor = pseudoflavor; 667 668 test = auth_domain_lookup(name, &new->h); 669 if (test != &new->h) { /* XXX Duplicate registration? */ 670 auth_domain_put(&new->h); 671 /* dangling ref-count... */ 672 goto out; 673 } 674 return 0; 675 676 out_free_dom: 677 kfree(new); 678 out: 679 return stat; 680 } 681 682 EXPORT_SYMBOL(svcauth_gss_register_pseudoflavor); 683 684 static inline int 685 read_u32_from_xdr_buf(struct xdr_buf *buf, int base, u32 *obj) 686 { 687 u32 raw; 688 int status; 689 690 status = read_bytes_from_xdr_buf(buf, base, &raw, sizeof(*obj)); 691 if (status) 692 return status; 693 *obj = ntohl(raw); 694 return 0; 695 } 696 697 /* It would be nice if this bit of code could be shared with the client. 698 * Obstacles: 699 * The client shouldn't malloc(), would have to pass in own memory. 700 * The server uses base of head iovec as read pointer, while the 701 * client uses separate pointer. */ 702 static int 703 unwrap_integ_data(struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx) 704 { 705 int stat = -EINVAL; 706 u32 integ_len, maj_stat; 707 struct xdr_netobj mic; 708 struct xdr_buf integ_buf; 709 710 integ_len = ntohl(svc_getu32(&buf->head[0])); 711 if (integ_len & 3) 712 goto out; 713 if (integ_len > buf->len) 714 goto out; 715 if (xdr_buf_subsegment(buf, &integ_buf, 0, integ_len)) 716 BUG(); 717 /* copy out mic... */ 718 if (read_u32_from_xdr_buf(buf, integ_len, &mic.len)) 719 BUG(); 720 if (mic.len > RPC_MAX_AUTH_SIZE) 721 goto out; 722 mic.data = kmalloc(mic.len, GFP_KERNEL); 723 if (!mic.data) 724 goto out; 725 if (read_bytes_from_xdr_buf(buf, integ_len + 4, mic.data, mic.len)) 726 goto out; 727 maj_stat = gss_verify_mic(ctx, &integ_buf, &mic); 728 if (maj_stat != GSS_S_COMPLETE) 729 goto out; 730 if (ntohl(svc_getu32(&buf->head[0])) != seq) 731 goto out; 732 stat = 0; 733 out: 734 return stat; 735 } 736 737 struct gss_svc_data { 738 /* decoded gss client cred: */ 739 struct rpc_gss_wire_cred clcred; 740 /* pointer to the beginning of the procedure-specific results, 741 * which may be encrypted/checksummed in svcauth_gss_release: */ 742 u32 *body_start; 743 struct rsc *rsci; 744 }; 745 746 static int 747 svcauth_gss_set_client(struct svc_rqst *rqstp) 748 { 749 struct gss_svc_data *svcdata = rqstp->rq_auth_data; 750 struct rsc *rsci = svcdata->rsci; 751 struct rpc_gss_wire_cred *gc = &svcdata->clcred; 752 753 rqstp->rq_client = find_gss_auth_domain(rsci->mechctx, gc->gc_svc); 754 if (rqstp->rq_client == NULL) 755 return SVC_DENIED; 756 return SVC_OK; 757 } 758 759 static inline int 760 gss_write_init_verf(struct svc_rqst *rqstp, struct rsi *rsip) 761 { 762 struct rsc *rsci; 763 764 if (rsip->major_status != GSS_S_COMPLETE) 765 return gss_write_null_verf(rqstp); 766 rsci = gss_svc_searchbyctx(&rsip->out_handle); 767 if (rsci == NULL) { 768 rsip->major_status = GSS_S_NO_CONTEXT; 769 return gss_write_null_verf(rqstp); 770 } 771 return gss_write_verf(rqstp, rsci->mechctx, GSS_SEQ_WIN); 772 } 773 774 /* 775 * Accept an rpcsec packet. 776 * If context establishment, punt to user space 777 * If data exchange, verify/decrypt 778 * If context destruction, handle here 779 * In the context establishment and destruction case we encode 780 * response here and return SVC_COMPLETE. 781 */ 782 static int 783 svcauth_gss_accept(struct svc_rqst *rqstp, u32 *authp) 784 { 785 struct kvec *argv = &rqstp->rq_arg.head[0]; 786 struct kvec *resv = &rqstp->rq_res.head[0]; 787 u32 crlen; 788 struct xdr_netobj tmpobj; 789 struct gss_svc_data *svcdata = rqstp->rq_auth_data; 790 struct rpc_gss_wire_cred *gc; 791 struct rsc *rsci = NULL; 792 struct rsi *rsip, rsikey; 793 u32 *rpcstart; 794 u32 *reject_stat = resv->iov_base + resv->iov_len; 795 int ret; 796 797 dprintk("RPC: svcauth_gss: argv->iov_len = %zd\n",argv->iov_len); 798 799 *authp = rpc_autherr_badcred; 800 if (!svcdata) 801 svcdata = kmalloc(sizeof(*svcdata), GFP_KERNEL); 802 if (!svcdata) 803 goto auth_err; 804 rqstp->rq_auth_data = svcdata; 805 svcdata->body_start = NULL; 806 svcdata->rsci = NULL; 807 gc = &svcdata->clcred; 808 809 /* start of rpc packet is 7 u32's back from here: 810 * xid direction rpcversion prog vers proc flavour 811 */ 812 rpcstart = argv->iov_base; 813 rpcstart -= 7; 814 815 /* credential is: 816 * version(==1), proc(0,1,2,3), seq, service (1,2,3), handle 817 * at least 5 u32s, and is preceeded by length, so that makes 6. 818 */ 819 820 if (argv->iov_len < 5 * 4) 821 goto auth_err; 822 crlen = ntohl(svc_getu32(argv)); 823 if (ntohl(svc_getu32(argv)) != RPC_GSS_VERSION) 824 goto auth_err; 825 gc->gc_proc = ntohl(svc_getu32(argv)); 826 gc->gc_seq = ntohl(svc_getu32(argv)); 827 gc->gc_svc = ntohl(svc_getu32(argv)); 828 if (svc_safe_getnetobj(argv, &gc->gc_ctx)) 829 goto auth_err; 830 if (crlen != round_up_to_quad(gc->gc_ctx.len) + 5 * 4) 831 goto auth_err; 832 833 if ((gc->gc_proc != RPC_GSS_PROC_DATA) && (rqstp->rq_proc != 0)) 834 goto auth_err; 835 836 /* 837 * We've successfully parsed the credential. Let's check out the 838 * verifier. An AUTH_NULL verifier is allowed (and required) for 839 * INIT and CONTINUE_INIT requests. AUTH_RPCSEC_GSS is required for 840 * PROC_DATA and PROC_DESTROY. 841 * 842 * AUTH_NULL verifier is 0 (AUTH_NULL), 0 (length). 843 * AUTH_RPCSEC_GSS verifier is: 844 * 6 (AUTH_RPCSEC_GSS), length, checksum. 845 * checksum is calculated over rpcheader from xid up to here. 846 */ 847 *authp = rpc_autherr_badverf; 848 switch (gc->gc_proc) { 849 case RPC_GSS_PROC_INIT: 850 case RPC_GSS_PROC_CONTINUE_INIT: 851 if (argv->iov_len < 2 * 4) 852 goto auth_err; 853 if (ntohl(svc_getu32(argv)) != RPC_AUTH_NULL) 854 goto auth_err; 855 if (ntohl(svc_getu32(argv)) != 0) 856 goto auth_err; 857 break; 858 case RPC_GSS_PROC_DATA: 859 case RPC_GSS_PROC_DESTROY: 860 *authp = rpcsec_gsserr_credproblem; 861 rsci = gss_svc_searchbyctx(&gc->gc_ctx); 862 if (!rsci) 863 goto auth_err; 864 switch (gss_verify_header(rqstp, rsci, rpcstart, gc, authp)) { 865 case SVC_OK: 866 break; 867 case SVC_DENIED: 868 goto auth_err; 869 case SVC_DROP: 870 goto drop; 871 } 872 break; 873 default: 874 *authp = rpc_autherr_rejectedcred; 875 goto auth_err; 876 } 877 878 /* now act upon the command: */ 879 switch (gc->gc_proc) { 880 case RPC_GSS_PROC_INIT: 881 case RPC_GSS_PROC_CONTINUE_INIT: 882 *authp = rpc_autherr_badcred; 883 if (gc->gc_proc == RPC_GSS_PROC_INIT && gc->gc_ctx.len != 0) 884 goto auth_err; 885 memset(&rsikey, 0, sizeof(rsikey)); 886 if (dup_netobj(&rsikey.in_handle, &gc->gc_ctx)) 887 goto drop; 888 *authp = rpc_autherr_badverf; 889 if (svc_safe_getnetobj(argv, &tmpobj)) { 890 kfree(rsikey.in_handle.data); 891 goto auth_err; 892 } 893 if (dup_netobj(&rsikey.in_token, &tmpobj)) { 894 kfree(rsikey.in_handle.data); 895 goto drop; 896 } 897 898 rsip = rsi_lookup(&rsikey, 0); 899 rsi_free(&rsikey); 900 if (!rsip) { 901 goto drop; 902 } 903 switch(cache_check(&rsi_cache, &rsip->h, &rqstp->rq_chandle)) { 904 case -EAGAIN: 905 goto drop; 906 case -ENOENT: 907 goto drop; 908 case 0: 909 if (gss_write_init_verf(rqstp, rsip)) 910 goto drop; 911 if (resv->iov_len + 4 > PAGE_SIZE) 912 goto drop; 913 svc_putu32(resv, rpc_success); 914 if (svc_safe_putnetobj(resv, &rsip->out_handle)) 915 goto drop; 916 if (resv->iov_len + 3 * 4 > PAGE_SIZE) 917 goto drop; 918 svc_putu32(resv, htonl(rsip->major_status)); 919 svc_putu32(resv, htonl(rsip->minor_status)); 920 svc_putu32(resv, htonl(GSS_SEQ_WIN)); 921 if (svc_safe_putnetobj(resv, &rsip->out_token)) 922 goto drop; 923 rqstp->rq_client = NULL; 924 } 925 goto complete; 926 case RPC_GSS_PROC_DESTROY: 927 set_bit(CACHE_NEGATIVE, &rsci->h.flags); 928 if (resv->iov_len + 4 > PAGE_SIZE) 929 goto drop; 930 svc_putu32(resv, rpc_success); 931 goto complete; 932 case RPC_GSS_PROC_DATA: 933 *authp = rpcsec_gsserr_ctxproblem; 934 if (gss_write_verf(rqstp, rsci->mechctx, gc->gc_seq)) 935 goto auth_err; 936 rqstp->rq_cred = rsci->cred; 937 get_group_info(rsci->cred.cr_group_info); 938 *authp = rpc_autherr_badcred; 939 switch (gc->gc_svc) { 940 case RPC_GSS_SVC_NONE: 941 break; 942 case RPC_GSS_SVC_INTEGRITY: 943 if (unwrap_integ_data(&rqstp->rq_arg, 944 gc->gc_seq, rsci->mechctx)) 945 goto auth_err; 946 /* placeholders for length and seq. number: */ 947 svcdata->body_start = resv->iov_base + resv->iov_len; 948 svc_putu32(resv, 0); 949 svc_putu32(resv, 0); 950 break; 951 case RPC_GSS_SVC_PRIVACY: 952 /* currently unsupported */ 953 default: 954 goto auth_err; 955 } 956 svcdata->rsci = rsci; 957 cache_get(&rsci->h); 958 ret = SVC_OK; 959 goto out; 960 } 961 auth_err: 962 /* Restore write pointer to original value: */ 963 xdr_ressize_check(rqstp, reject_stat); 964 ret = SVC_DENIED; 965 goto out; 966 complete: 967 ret = SVC_COMPLETE; 968 goto out; 969 drop: 970 ret = SVC_DROP; 971 out: 972 if (rsci) 973 rsc_put(&rsci->h, &rsc_cache); 974 return ret; 975 } 976 977 static int 978 svcauth_gss_release(struct svc_rqst *rqstp) 979 { 980 struct gss_svc_data *gsd = (struct gss_svc_data *)rqstp->rq_auth_data; 981 struct rpc_gss_wire_cred *gc = &gsd->clcred; 982 struct xdr_buf *resbuf = &rqstp->rq_res; 983 struct xdr_buf integ_buf; 984 struct xdr_netobj mic; 985 struct kvec *resv; 986 u32 *p; 987 int integ_offset, integ_len; 988 int stat = -EINVAL; 989 990 if (gc->gc_proc != RPC_GSS_PROC_DATA) 991 goto out; 992 /* Release can be called twice, but we only wrap once. */ 993 if (gsd->body_start == NULL) 994 goto out; 995 /* normally not set till svc_send, but we need it here: */ 996 resbuf->len = resbuf->head[0].iov_len 997 + resbuf->page_len + resbuf->tail[0].iov_len; 998 switch (gc->gc_svc) { 999 case RPC_GSS_SVC_NONE: 1000 break; 1001 case RPC_GSS_SVC_INTEGRITY: 1002 p = gsd->body_start; 1003 gsd->body_start = NULL; 1004 /* move accept_stat to right place: */ 1005 memcpy(p, p + 2, 4); 1006 /* don't wrap in failure case: */ 1007 /* Note: counting on not getting here if call was not even 1008 * accepted! */ 1009 if (*p != rpc_success) { 1010 resbuf->head[0].iov_len -= 2 * 4; 1011 goto out; 1012 } 1013 p++; 1014 integ_offset = (u8 *)(p + 1) - (u8 *)resbuf->head[0].iov_base; 1015 integ_len = resbuf->len - integ_offset; 1016 BUG_ON(integ_len % 4); 1017 *p++ = htonl(integ_len); 1018 *p++ = htonl(gc->gc_seq); 1019 if (xdr_buf_subsegment(resbuf, &integ_buf, integ_offset, 1020 integ_len)) 1021 BUG(); 1022 if (resbuf->page_len == 0 1023 && resbuf->tail[0].iov_len + RPC_MAX_AUTH_SIZE 1024 < PAGE_SIZE) { 1025 BUG_ON(resbuf->tail[0].iov_len); 1026 /* Use head for everything */ 1027 resv = &resbuf->head[0]; 1028 } else if (resbuf->tail[0].iov_base == NULL) { 1029 /* copied from nfsd4_encode_read */ 1030 svc_take_page(rqstp); 1031 resbuf->tail[0].iov_base = page_address(rqstp 1032 ->rq_respages[rqstp->rq_resused-1]); 1033 rqstp->rq_restailpage = rqstp->rq_resused-1; 1034 resbuf->tail[0].iov_len = 0; 1035 resv = &resbuf->tail[0]; 1036 } else { 1037 resv = &resbuf->tail[0]; 1038 } 1039 mic.data = (u8 *)resv->iov_base + resv->iov_len + 4; 1040 if (gss_get_mic(gsd->rsci->mechctx, &integ_buf, &mic)) 1041 goto out_err; 1042 svc_putu32(resv, htonl(mic.len)); 1043 memset(mic.data + mic.len, 0, 1044 round_up_to_quad(mic.len) - mic.len); 1045 resv->iov_len += XDR_QUADLEN(mic.len) << 2; 1046 /* not strictly required: */ 1047 resbuf->len += XDR_QUADLEN(mic.len) << 2; 1048 BUG_ON(resv->iov_len > PAGE_SIZE); 1049 break; 1050 case RPC_GSS_SVC_PRIVACY: 1051 default: 1052 goto out_err; 1053 } 1054 1055 out: 1056 stat = 0; 1057 out_err: 1058 if (rqstp->rq_client) 1059 auth_domain_put(rqstp->rq_client); 1060 rqstp->rq_client = NULL; 1061 if (rqstp->rq_cred.cr_group_info) 1062 put_group_info(rqstp->rq_cred.cr_group_info); 1063 rqstp->rq_cred.cr_group_info = NULL; 1064 if (gsd->rsci) 1065 rsc_put(&gsd->rsci->h, &rsc_cache); 1066 gsd->rsci = NULL; 1067 1068 return stat; 1069 } 1070 1071 static void 1072 svcauth_gss_domain_release(struct auth_domain *dom) 1073 { 1074 struct gss_domain *gd = container_of(dom, struct gss_domain, h); 1075 1076 kfree(dom->name); 1077 kfree(gd); 1078 } 1079 1080 static struct auth_ops svcauthops_gss = { 1081 .name = "rpcsec_gss", 1082 .owner = THIS_MODULE, 1083 .flavour = RPC_AUTH_GSS, 1084 .accept = svcauth_gss_accept, 1085 .release = svcauth_gss_release, 1086 .domain_release = svcauth_gss_domain_release, 1087 .set_client = svcauth_gss_set_client, 1088 }; 1089 1090 int 1091 gss_svc_init(void) 1092 { 1093 int rv = svc_auth_register(RPC_AUTH_GSS, &svcauthops_gss); 1094 if (rv == 0) { 1095 cache_register(&rsc_cache); 1096 cache_register(&rsi_cache); 1097 } 1098 return rv; 1099 } 1100 1101 void 1102 gss_svc_shutdown(void) 1103 { 1104 if (cache_unregister(&rsc_cache)) 1105 printk(KERN_ERR "auth_rpcgss: failed to unregister rsc cache\n"); 1106 if (cache_unregister(&rsi_cache)) 1107 printk(KERN_ERR "auth_rpcgss: failed to unregister rsi cache\n"); 1108 svc_auth_unregister(RPC_AUTH_GSS); 1109 } 1110