1 // SPDX-License-Identifier: GPL-2.0-only 2 #include <linux/types.h> 3 #include <linux/sched.h> 4 #include <linux/module.h> 5 #include <linux/sunrpc/types.h> 6 #include <linux/sunrpc/xdr.h> 7 #include <linux/sunrpc/svcsock.h> 8 #include <linux/sunrpc/svcauth.h> 9 #include <linux/sunrpc/gss_api.h> 10 #include <linux/sunrpc/addr.h> 11 #include <linux/err.h> 12 #include <linux/seq_file.h> 13 #include <linux/hash.h> 14 #include <linux/string.h> 15 #include <linux/slab.h> 16 #include <net/sock.h> 17 #include <net/ipv6.h> 18 #include <linux/kernel.h> 19 #include <linux/user_namespace.h> 20 #define RPCDBG_FACILITY RPCDBG_AUTH 21 22 23 #include "netns.h" 24 25 /* 26 * AUTHUNIX and AUTHNULL credentials are both handled here. 27 * AUTHNULL is treated just like AUTHUNIX except that the uid/gid 28 * are always nobody (-2). i.e. we do the same IP address checks for 29 * AUTHNULL as for AUTHUNIX, and that is done here. 30 */ 31 32 33 struct unix_domain { 34 struct auth_domain h; 35 /* other stuff later */ 36 }; 37 38 extern struct auth_ops svcauth_null; 39 extern struct auth_ops svcauth_unix; 40 extern struct auth_ops svcauth_tls; 41 42 static void svcauth_unix_domain_release_rcu(struct rcu_head *head) 43 { 44 struct auth_domain *dom = container_of(head, struct auth_domain, rcu_head); 45 struct unix_domain *ud = container_of(dom, struct unix_domain, h); 46 47 kfree(dom->name); 48 kfree(ud); 49 } 50 51 static void svcauth_unix_domain_release(struct auth_domain *dom) 52 { 53 call_rcu(&dom->rcu_head, svcauth_unix_domain_release_rcu); 54 } 55 56 struct auth_domain *unix_domain_find(char *name) 57 { 58 struct auth_domain *rv; 59 struct unix_domain *new = NULL; 60 61 rv = auth_domain_find(name); 62 while(1) { 63 if (rv) { 64 if (new && rv != &new->h) 65 svcauth_unix_domain_release(&new->h); 66 67 if (rv->flavour != &svcauth_unix) { 68 auth_domain_put(rv); 69 return NULL; 70 } 71 return rv; 72 } 73 74 new = kmalloc(sizeof(*new), GFP_KERNEL); 75 if (new == NULL) 76 return NULL; 77 kref_init(&new->h.ref); 78 new->h.name = kstrdup(name, GFP_KERNEL); 79 if (new->h.name == NULL) { 80 kfree(new); 81 return NULL; 82 } 83 new->h.flavour = &svcauth_unix; 84 rv = auth_domain_lookup(name, &new->h); 85 } 86 } 87 EXPORT_SYMBOL_GPL(unix_domain_find); 88 89 90 /************************************************** 91 * cache for IP address to unix_domain 92 * as needed by AUTH_UNIX 93 */ 94 #define IP_HASHBITS 8 95 #define IP_HASHMAX (1<<IP_HASHBITS) 96 97 struct ip_map { 98 struct cache_head h; 99 char m_class[8]; /* e.g. "nfsd" */ 100 struct in6_addr m_addr; 101 struct unix_domain *m_client; 102 struct rcu_head m_rcu; 103 }; 104 105 static void ip_map_put(struct kref *kref) 106 { 107 struct cache_head *item = container_of(kref, struct cache_head, ref); 108 struct ip_map *im = container_of(item, struct ip_map,h); 109 110 if (test_bit(CACHE_VALID, &item->flags) && 111 !test_bit(CACHE_NEGATIVE, &item->flags)) 112 auth_domain_put(&im->m_client->h); 113 kfree_rcu(im, m_rcu); 114 } 115 116 static inline int hash_ip6(const struct in6_addr *ip) 117 { 118 return hash_32(ipv6_addr_hash(ip), IP_HASHBITS); 119 } 120 static int ip_map_match(struct cache_head *corig, struct cache_head *cnew) 121 { 122 struct ip_map *orig = container_of(corig, struct ip_map, h); 123 struct ip_map *new = container_of(cnew, struct ip_map, h); 124 return strcmp(orig->m_class, new->m_class) == 0 && 125 ipv6_addr_equal(&orig->m_addr, &new->m_addr); 126 } 127 static void ip_map_init(struct cache_head *cnew, struct cache_head *citem) 128 { 129 struct ip_map *new = container_of(cnew, struct ip_map, h); 130 struct ip_map *item = container_of(citem, struct ip_map, h); 131 132 strcpy(new->m_class, item->m_class); 133 new->m_addr = item->m_addr; 134 } 135 static void update(struct cache_head *cnew, struct cache_head *citem) 136 { 137 struct ip_map *new = container_of(cnew, struct ip_map, h); 138 struct ip_map *item = container_of(citem, struct ip_map, h); 139 140 kref_get(&item->m_client->h.ref); 141 new->m_client = item->m_client; 142 } 143 static struct cache_head *ip_map_alloc(void) 144 { 145 struct ip_map *i = kmalloc(sizeof(*i), GFP_KERNEL); 146 if (i) 147 return &i->h; 148 else 149 return NULL; 150 } 151 152 static int ip_map_upcall(struct cache_detail *cd, struct cache_head *h) 153 { 154 return sunrpc_cache_pipe_upcall(cd, h); 155 } 156 157 static void ip_map_request(struct cache_detail *cd, 158 struct cache_head *h, 159 char **bpp, int *blen) 160 { 161 char text_addr[40]; 162 struct ip_map *im = container_of(h, struct ip_map, h); 163 164 if (ipv6_addr_v4mapped(&(im->m_addr))) { 165 snprintf(text_addr, 20, "%pI4", &im->m_addr.s6_addr32[3]); 166 } else { 167 snprintf(text_addr, 40, "%pI6", &im->m_addr); 168 } 169 qword_add(bpp, blen, im->m_class); 170 qword_add(bpp, blen, text_addr); 171 (*bpp)[-1] = '\n'; 172 } 173 174 static struct ip_map *__ip_map_lookup(struct cache_detail *cd, char *class, struct in6_addr *addr); 175 static int __ip_map_update(struct cache_detail *cd, struct ip_map *ipm, struct unix_domain *udom, time64_t expiry); 176 177 static int ip_map_parse(struct cache_detail *cd, 178 char *mesg, int mlen) 179 { 180 /* class ipaddress [domainname] */ 181 /* should be safe just to use the start of the input buffer 182 * for scratch: */ 183 char *buf = mesg; 184 int len; 185 char class[8]; 186 union { 187 struct sockaddr sa; 188 struct sockaddr_in s4; 189 struct sockaddr_in6 s6; 190 } address; 191 struct sockaddr_in6 sin6; 192 int err; 193 194 struct ip_map *ipmp; 195 struct auth_domain *dom; 196 time64_t expiry; 197 198 if (mesg[mlen-1] != '\n') 199 return -EINVAL; 200 mesg[mlen-1] = 0; 201 202 /* class */ 203 len = qword_get(&mesg, class, sizeof(class)); 204 if (len <= 0) return -EINVAL; 205 206 /* ip address */ 207 len = qword_get(&mesg, buf, mlen); 208 if (len <= 0) return -EINVAL; 209 210 if (rpc_pton(cd->net, buf, len, &address.sa, sizeof(address)) == 0) 211 return -EINVAL; 212 switch (address.sa.sa_family) { 213 case AF_INET: 214 /* Form a mapped IPv4 address in sin6 */ 215 sin6.sin6_family = AF_INET6; 216 ipv6_addr_set_v4mapped(address.s4.sin_addr.s_addr, 217 &sin6.sin6_addr); 218 break; 219 #if IS_ENABLED(CONFIG_IPV6) 220 case AF_INET6: 221 memcpy(&sin6, &address.s6, sizeof(sin6)); 222 break; 223 #endif 224 default: 225 return -EINVAL; 226 } 227 228 expiry = get_expiry(&mesg); 229 if (expiry ==0) 230 return -EINVAL; 231 232 /* domainname, or empty for NEGATIVE */ 233 len = qword_get(&mesg, buf, mlen); 234 if (len < 0) return -EINVAL; 235 236 if (len) { 237 dom = unix_domain_find(buf); 238 if (dom == NULL) 239 return -ENOENT; 240 } else 241 dom = NULL; 242 243 /* IPv6 scope IDs are ignored for now */ 244 ipmp = __ip_map_lookup(cd, class, &sin6.sin6_addr); 245 if (ipmp) { 246 err = __ip_map_update(cd, ipmp, 247 container_of(dom, struct unix_domain, h), 248 expiry); 249 } else 250 err = -ENOMEM; 251 252 if (dom) 253 auth_domain_put(dom); 254 255 cache_flush(); 256 return err; 257 } 258 259 static int ip_map_show(struct seq_file *m, 260 struct cache_detail *cd, 261 struct cache_head *h) 262 { 263 struct ip_map *im; 264 struct in6_addr addr; 265 char *dom = "-no-domain-"; 266 267 if (h == NULL) { 268 seq_puts(m, "#class IP domain\n"); 269 return 0; 270 } 271 im = container_of(h, struct ip_map, h); 272 /* class addr domain */ 273 addr = im->m_addr; 274 275 if (test_bit(CACHE_VALID, &h->flags) && 276 !test_bit(CACHE_NEGATIVE, &h->flags)) 277 dom = im->m_client->h.name; 278 279 if (ipv6_addr_v4mapped(&addr)) { 280 seq_printf(m, "%s %pI4 %s\n", 281 im->m_class, &addr.s6_addr32[3], dom); 282 } else { 283 seq_printf(m, "%s %pI6 %s\n", im->m_class, &addr, dom); 284 } 285 return 0; 286 } 287 288 289 static struct ip_map *__ip_map_lookup(struct cache_detail *cd, char *class, 290 struct in6_addr *addr) 291 { 292 struct ip_map ip; 293 struct cache_head *ch; 294 295 strcpy(ip.m_class, class); 296 ip.m_addr = *addr; 297 ch = sunrpc_cache_lookup_rcu(cd, &ip.h, 298 hash_str(class, IP_HASHBITS) ^ 299 hash_ip6(addr)); 300 301 if (ch) 302 return container_of(ch, struct ip_map, h); 303 else 304 return NULL; 305 } 306 307 static int __ip_map_update(struct cache_detail *cd, struct ip_map *ipm, 308 struct unix_domain *udom, time64_t expiry) 309 { 310 struct ip_map ip; 311 struct cache_head *ch; 312 313 ip.m_client = udom; 314 ip.h.flags = 0; 315 if (!udom) 316 set_bit(CACHE_NEGATIVE, &ip.h.flags); 317 ip.h.expiry_time = expiry; 318 ch = sunrpc_cache_update(cd, &ip.h, &ipm->h, 319 hash_str(ipm->m_class, IP_HASHBITS) ^ 320 hash_ip6(&ipm->m_addr)); 321 if (!ch) 322 return -ENOMEM; 323 cache_put(ch, cd); 324 return 0; 325 } 326 327 void svcauth_unix_purge(struct net *net) 328 { 329 struct sunrpc_net *sn; 330 331 sn = net_generic(net, sunrpc_net_id); 332 cache_purge(sn->ip_map_cache); 333 } 334 EXPORT_SYMBOL_GPL(svcauth_unix_purge); 335 336 static inline struct ip_map * 337 ip_map_cached_get(struct svc_xprt *xprt) 338 { 339 struct ip_map *ipm = NULL; 340 struct sunrpc_net *sn; 341 342 if (test_bit(XPT_CACHE_AUTH, &xprt->xpt_flags)) { 343 spin_lock(&xprt->xpt_lock); 344 ipm = xprt->xpt_auth_cache; 345 if (ipm != NULL) { 346 sn = net_generic(xprt->xpt_net, sunrpc_net_id); 347 if (cache_is_expired(sn->ip_map_cache, &ipm->h)) { 348 /* 349 * The entry has been invalidated since it was 350 * remembered, e.g. by a second mount from the 351 * same IP address. 352 */ 353 xprt->xpt_auth_cache = NULL; 354 spin_unlock(&xprt->xpt_lock); 355 cache_put(&ipm->h, sn->ip_map_cache); 356 return NULL; 357 } 358 cache_get(&ipm->h); 359 } 360 spin_unlock(&xprt->xpt_lock); 361 } 362 return ipm; 363 } 364 365 static inline void 366 ip_map_cached_put(struct svc_xprt *xprt, struct ip_map *ipm) 367 { 368 if (test_bit(XPT_CACHE_AUTH, &xprt->xpt_flags)) { 369 spin_lock(&xprt->xpt_lock); 370 if (xprt->xpt_auth_cache == NULL) { 371 /* newly cached, keep the reference */ 372 xprt->xpt_auth_cache = ipm; 373 ipm = NULL; 374 } 375 spin_unlock(&xprt->xpt_lock); 376 } 377 if (ipm) { 378 struct sunrpc_net *sn; 379 380 sn = net_generic(xprt->xpt_net, sunrpc_net_id); 381 cache_put(&ipm->h, sn->ip_map_cache); 382 } 383 } 384 385 void 386 svcauth_unix_info_release(struct svc_xprt *xpt) 387 { 388 struct ip_map *ipm; 389 390 ipm = xpt->xpt_auth_cache; 391 if (ipm != NULL) { 392 struct sunrpc_net *sn; 393 394 sn = net_generic(xpt->xpt_net, sunrpc_net_id); 395 cache_put(&ipm->h, sn->ip_map_cache); 396 } 397 } 398 399 /**************************************************************************** 400 * auth.unix.gid cache 401 * simple cache to map a UID to a list of GIDs 402 * because AUTH_UNIX aka AUTH_SYS has a max of UNX_NGROUPS 403 */ 404 #define GID_HASHBITS 8 405 #define GID_HASHMAX (1<<GID_HASHBITS) 406 407 struct unix_gid { 408 struct cache_head h; 409 kuid_t uid; 410 struct group_info *gi; 411 struct rcu_head rcu; 412 }; 413 414 static int unix_gid_hash(kuid_t uid) 415 { 416 return hash_long(from_kuid(&init_user_ns, uid), GID_HASHBITS); 417 } 418 419 static void unix_gid_put(struct kref *kref) 420 { 421 struct cache_head *item = container_of(kref, struct cache_head, ref); 422 struct unix_gid *ug = container_of(item, struct unix_gid, h); 423 if (test_bit(CACHE_VALID, &item->flags) && 424 !test_bit(CACHE_NEGATIVE, &item->flags)) 425 put_group_info(ug->gi); 426 kfree_rcu(ug, rcu); 427 } 428 429 static int unix_gid_match(struct cache_head *corig, struct cache_head *cnew) 430 { 431 struct unix_gid *orig = container_of(corig, struct unix_gid, h); 432 struct unix_gid *new = container_of(cnew, struct unix_gid, h); 433 return uid_eq(orig->uid, new->uid); 434 } 435 static void unix_gid_init(struct cache_head *cnew, struct cache_head *citem) 436 { 437 struct unix_gid *new = container_of(cnew, struct unix_gid, h); 438 struct unix_gid *item = container_of(citem, struct unix_gid, h); 439 new->uid = item->uid; 440 } 441 static void unix_gid_update(struct cache_head *cnew, struct cache_head *citem) 442 { 443 struct unix_gid *new = container_of(cnew, struct unix_gid, h); 444 struct unix_gid *item = container_of(citem, struct unix_gid, h); 445 446 get_group_info(item->gi); 447 new->gi = item->gi; 448 } 449 static struct cache_head *unix_gid_alloc(void) 450 { 451 struct unix_gid *g = kmalloc(sizeof(*g), GFP_KERNEL); 452 if (g) 453 return &g->h; 454 else 455 return NULL; 456 } 457 458 static int unix_gid_upcall(struct cache_detail *cd, struct cache_head *h) 459 { 460 return sunrpc_cache_pipe_upcall_timeout(cd, h); 461 } 462 463 static void unix_gid_request(struct cache_detail *cd, 464 struct cache_head *h, 465 char **bpp, int *blen) 466 { 467 char tuid[20]; 468 struct unix_gid *ug = container_of(h, struct unix_gid, h); 469 470 snprintf(tuid, 20, "%u", from_kuid(&init_user_ns, ug->uid)); 471 qword_add(bpp, blen, tuid); 472 (*bpp)[-1] = '\n'; 473 } 474 475 static struct unix_gid *unix_gid_lookup(struct cache_detail *cd, kuid_t uid); 476 477 static int unix_gid_parse(struct cache_detail *cd, 478 char *mesg, int mlen) 479 { 480 /* uid expiry Ngid gid0 gid1 ... gidN-1 */ 481 int id; 482 kuid_t uid; 483 int gids; 484 int rv; 485 int i; 486 int err; 487 time64_t expiry; 488 struct unix_gid ug, *ugp; 489 490 if (mesg[mlen - 1] != '\n') 491 return -EINVAL; 492 mesg[mlen-1] = 0; 493 494 rv = get_int(&mesg, &id); 495 if (rv) 496 return -EINVAL; 497 uid = make_kuid(current_user_ns(), id); 498 ug.uid = uid; 499 500 expiry = get_expiry(&mesg); 501 if (expiry == 0) 502 return -EINVAL; 503 504 rv = get_int(&mesg, &gids); 505 if (rv || gids < 0 || gids > 8192) 506 return -EINVAL; 507 508 ug.gi = groups_alloc(gids); 509 if (!ug.gi) 510 return -ENOMEM; 511 512 for (i = 0 ; i < gids ; i++) { 513 int gid; 514 kgid_t kgid; 515 rv = get_int(&mesg, &gid); 516 err = -EINVAL; 517 if (rv) 518 goto out; 519 kgid = make_kgid(current_user_ns(), gid); 520 if (!gid_valid(kgid)) 521 goto out; 522 ug.gi->gid[i] = kgid; 523 } 524 525 groups_sort(ug.gi); 526 ugp = unix_gid_lookup(cd, uid); 527 if (ugp) { 528 struct cache_head *ch; 529 ug.h.flags = 0; 530 ug.h.expiry_time = expiry; 531 ch = sunrpc_cache_update(cd, 532 &ug.h, &ugp->h, 533 unix_gid_hash(uid)); 534 if (!ch) 535 err = -ENOMEM; 536 else { 537 err = 0; 538 cache_put(ch, cd); 539 } 540 } else 541 err = -ENOMEM; 542 out: 543 if (ug.gi) 544 put_group_info(ug.gi); 545 return err; 546 } 547 548 static int unix_gid_show(struct seq_file *m, 549 struct cache_detail *cd, 550 struct cache_head *h) 551 { 552 struct user_namespace *user_ns = m->file->f_cred->user_ns; 553 struct unix_gid *ug; 554 int i; 555 int glen; 556 557 if (h == NULL) { 558 seq_puts(m, "#uid cnt: gids...\n"); 559 return 0; 560 } 561 ug = container_of(h, struct unix_gid, h); 562 if (test_bit(CACHE_VALID, &h->flags) && 563 !test_bit(CACHE_NEGATIVE, &h->flags)) 564 glen = ug->gi->ngroups; 565 else 566 glen = 0; 567 568 seq_printf(m, "%u %d:", from_kuid_munged(user_ns, ug->uid), glen); 569 for (i = 0; i < glen; i++) 570 seq_printf(m, " %d", from_kgid_munged(user_ns, ug->gi->gid[i])); 571 seq_printf(m, "\n"); 572 return 0; 573 } 574 575 static const struct cache_detail unix_gid_cache_template = { 576 .owner = THIS_MODULE, 577 .hash_size = GID_HASHMAX, 578 .name = "auth.unix.gid", 579 .cache_put = unix_gid_put, 580 .cache_upcall = unix_gid_upcall, 581 .cache_request = unix_gid_request, 582 .cache_parse = unix_gid_parse, 583 .cache_show = unix_gid_show, 584 .match = unix_gid_match, 585 .init = unix_gid_init, 586 .update = unix_gid_update, 587 .alloc = unix_gid_alloc, 588 }; 589 590 int unix_gid_cache_create(struct net *net) 591 { 592 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id); 593 struct cache_detail *cd; 594 int err; 595 596 cd = cache_create_net(&unix_gid_cache_template, net); 597 if (IS_ERR(cd)) 598 return PTR_ERR(cd); 599 err = cache_register_net(cd, net); 600 if (err) { 601 cache_destroy_net(cd, net); 602 return err; 603 } 604 sn->unix_gid_cache = cd; 605 return 0; 606 } 607 608 void unix_gid_cache_destroy(struct net *net) 609 { 610 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id); 611 struct cache_detail *cd = sn->unix_gid_cache; 612 613 sn->unix_gid_cache = NULL; 614 cache_purge(cd); 615 cache_unregister_net(cd, net); 616 cache_destroy_net(cd, net); 617 } 618 619 static struct unix_gid *unix_gid_lookup(struct cache_detail *cd, kuid_t uid) 620 { 621 struct unix_gid ug; 622 struct cache_head *ch; 623 624 ug.uid = uid; 625 ch = sunrpc_cache_lookup_rcu(cd, &ug.h, unix_gid_hash(uid)); 626 if (ch) 627 return container_of(ch, struct unix_gid, h); 628 else 629 return NULL; 630 } 631 632 static struct group_info *unix_gid_find(kuid_t uid, struct svc_rqst *rqstp) 633 { 634 struct unix_gid *ug; 635 struct group_info *gi; 636 int ret; 637 struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, 638 sunrpc_net_id); 639 640 ug = unix_gid_lookup(sn->unix_gid_cache, uid); 641 if (!ug) 642 return ERR_PTR(-EAGAIN); 643 ret = cache_check(sn->unix_gid_cache, &ug->h, &rqstp->rq_chandle); 644 switch (ret) { 645 case -ENOENT: 646 return ERR_PTR(-ENOENT); 647 case -ETIMEDOUT: 648 return ERR_PTR(-ESHUTDOWN); 649 case 0: 650 gi = get_group_info(ug->gi); 651 cache_put(&ug->h, sn->unix_gid_cache); 652 return gi; 653 default: 654 return ERR_PTR(-EAGAIN); 655 } 656 } 657 658 int 659 svcauth_unix_set_client(struct svc_rqst *rqstp) 660 { 661 struct sockaddr_in *sin; 662 struct sockaddr_in6 *sin6, sin6_storage; 663 struct ip_map *ipm; 664 struct group_info *gi; 665 struct svc_cred *cred = &rqstp->rq_cred; 666 struct svc_xprt *xprt = rqstp->rq_xprt; 667 struct net *net = xprt->xpt_net; 668 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id); 669 670 switch (rqstp->rq_addr.ss_family) { 671 case AF_INET: 672 sin = svc_addr_in(rqstp); 673 sin6 = &sin6_storage; 674 ipv6_addr_set_v4mapped(sin->sin_addr.s_addr, &sin6->sin6_addr); 675 break; 676 case AF_INET6: 677 sin6 = svc_addr_in6(rqstp); 678 break; 679 default: 680 BUG(); 681 } 682 683 rqstp->rq_client = NULL; 684 if (rqstp->rq_proc == 0) 685 goto out; 686 687 rqstp->rq_auth_stat = rpc_autherr_badcred; 688 ipm = ip_map_cached_get(xprt); 689 if (ipm == NULL) 690 ipm = __ip_map_lookup(sn->ip_map_cache, rqstp->rq_server->sv_program->pg_class, 691 &sin6->sin6_addr); 692 693 if (ipm == NULL) 694 return SVC_DENIED; 695 696 switch (cache_check(sn->ip_map_cache, &ipm->h, &rqstp->rq_chandle)) { 697 default: 698 BUG(); 699 case -ETIMEDOUT: 700 return SVC_CLOSE; 701 case -EAGAIN: 702 return SVC_DROP; 703 case -ENOENT: 704 return SVC_DENIED; 705 case 0: 706 rqstp->rq_client = &ipm->m_client->h; 707 kref_get(&rqstp->rq_client->ref); 708 ip_map_cached_put(xprt, ipm); 709 break; 710 } 711 712 gi = unix_gid_find(cred->cr_uid, rqstp); 713 switch (PTR_ERR(gi)) { 714 case -EAGAIN: 715 return SVC_DROP; 716 case -ESHUTDOWN: 717 return SVC_CLOSE; 718 case -ENOENT: 719 break; 720 default: 721 put_group_info(cred->cr_group_info); 722 cred->cr_group_info = gi; 723 } 724 725 out: 726 rqstp->rq_auth_stat = rpc_auth_ok; 727 return SVC_OK; 728 } 729 730 EXPORT_SYMBOL_GPL(svcauth_unix_set_client); 731 732 /** 733 * svcauth_null_accept - Decode and validate incoming RPC_AUTH_NULL credential 734 * @rqstp: RPC transaction 735 * 736 * Return values: 737 * %SVC_OK: Both credential and verifier are valid 738 * %SVC_DENIED: Credential or verifier is not valid 739 * %SVC_GARBAGE: Failed to decode credential or verifier 740 * %SVC_CLOSE: Temporary failure 741 * 742 * rqstp->rq_auth_stat is set as mandated by RFC 5531. 743 */ 744 static int 745 svcauth_null_accept(struct svc_rqst *rqstp) 746 { 747 struct xdr_stream *xdr = &rqstp->rq_arg_stream; 748 struct svc_cred *cred = &rqstp->rq_cred; 749 u32 flavor, len; 750 void *body; 751 752 /* Length of Call's credential body field: */ 753 if (xdr_stream_decode_u32(xdr, &len) < 0) 754 return SVC_GARBAGE; 755 if (len != 0) { 756 rqstp->rq_auth_stat = rpc_autherr_badcred; 757 return SVC_DENIED; 758 } 759 760 /* Call's verf field: */ 761 if (xdr_stream_decode_opaque_auth(xdr, &flavor, &body, &len) < 0) 762 return SVC_GARBAGE; 763 if (flavor != RPC_AUTH_NULL || len != 0) { 764 rqstp->rq_auth_stat = rpc_autherr_badverf; 765 return SVC_DENIED; 766 } 767 768 /* Signal that mapping to nobody uid/gid is required */ 769 cred->cr_uid = INVALID_UID; 770 cred->cr_gid = INVALID_GID; 771 cred->cr_group_info = groups_alloc(0); 772 if (cred->cr_group_info == NULL) 773 return SVC_CLOSE; /* kmalloc failure - client must retry */ 774 775 if (xdr_stream_encode_opaque_auth(&rqstp->rq_res_stream, 776 RPC_AUTH_NULL, NULL, 0) < 0) 777 return SVC_CLOSE; 778 if (!svcxdr_set_accept_stat(rqstp)) 779 return SVC_CLOSE; 780 781 rqstp->rq_cred.cr_flavor = RPC_AUTH_NULL; 782 return SVC_OK; 783 } 784 785 static int 786 svcauth_null_release(struct svc_rqst *rqstp) 787 { 788 if (rqstp->rq_client) 789 auth_domain_put(rqstp->rq_client); 790 rqstp->rq_client = NULL; 791 if (rqstp->rq_cred.cr_group_info) 792 put_group_info(rqstp->rq_cred.cr_group_info); 793 rqstp->rq_cred.cr_group_info = NULL; 794 795 return 0; /* don't drop */ 796 } 797 798 799 struct auth_ops svcauth_null = { 800 .name = "null", 801 .owner = THIS_MODULE, 802 .flavour = RPC_AUTH_NULL, 803 .accept = svcauth_null_accept, 804 .release = svcauth_null_release, 805 .set_client = svcauth_unix_set_client, 806 }; 807 808 809 /** 810 * svcauth_tls_accept - Decode and validate incoming RPC_AUTH_TLS credential 811 * @rqstp: RPC transaction 812 * 813 * Return values: 814 * %SVC_OK: Both credential and verifier are valid 815 * %SVC_DENIED: Credential or verifier is not valid 816 * %SVC_GARBAGE: Failed to decode credential or verifier 817 * %SVC_CLOSE: Temporary failure 818 * 819 * rqstp->rq_auth_stat is set as mandated by RFC 5531. 820 */ 821 static int 822 svcauth_tls_accept(struct svc_rqst *rqstp) 823 { 824 struct xdr_stream *xdr = &rqstp->rq_arg_stream; 825 struct svc_cred *cred = &rqstp->rq_cred; 826 u32 flavor, len; 827 void *body; 828 __be32 *p; 829 830 /* Length of Call's credential body field: */ 831 if (xdr_stream_decode_u32(xdr, &len) < 0) 832 return SVC_GARBAGE; 833 if (len != 0) { 834 rqstp->rq_auth_stat = rpc_autherr_badcred; 835 return SVC_DENIED; 836 } 837 838 /* Call's verf field: */ 839 if (xdr_stream_decode_opaque_auth(xdr, &flavor, &body, &len) < 0) 840 return SVC_GARBAGE; 841 if (flavor != RPC_AUTH_NULL || len != 0) { 842 rqstp->rq_auth_stat = rpc_autherr_badverf; 843 return SVC_DENIED; 844 } 845 846 /* AUTH_TLS is not valid on non-NULL procedures */ 847 if (rqstp->rq_proc != 0) { 848 rqstp->rq_auth_stat = rpc_autherr_badcred; 849 return SVC_DENIED; 850 } 851 852 /* Signal that mapping to nobody uid/gid is required */ 853 cred->cr_uid = INVALID_UID; 854 cred->cr_gid = INVALID_GID; 855 cred->cr_group_info = groups_alloc(0); 856 if (cred->cr_group_info == NULL) 857 return SVC_CLOSE; 858 859 if (rqstp->rq_xprt->xpt_ops->xpo_start_tls) { 860 p = xdr_reserve_space(&rqstp->rq_res_stream, XDR_UNIT * 2 + 8); 861 if (!p) 862 return SVC_CLOSE; 863 *p++ = rpc_auth_null; 864 *p++ = cpu_to_be32(8); 865 memcpy(p, "STARTTLS", 8); 866 } else { 867 if (xdr_stream_encode_opaque_auth(&rqstp->rq_res_stream, 868 RPC_AUTH_NULL, NULL, 0) < 0) 869 return SVC_CLOSE; 870 } 871 if (!svcxdr_set_accept_stat(rqstp)) 872 return SVC_CLOSE; 873 874 rqstp->rq_cred.cr_flavor = RPC_AUTH_TLS; 875 return SVC_OK; 876 } 877 878 struct auth_ops svcauth_tls = { 879 .name = "tls", 880 .owner = THIS_MODULE, 881 .flavour = RPC_AUTH_TLS, 882 .accept = svcauth_tls_accept, 883 .release = svcauth_null_release, 884 .set_client = svcauth_unix_set_client, 885 }; 886 887 888 /** 889 * svcauth_unix_accept - Decode and validate incoming RPC_AUTH_SYS credential 890 * @rqstp: RPC transaction 891 * 892 * Return values: 893 * %SVC_OK: Both credential and verifier are valid 894 * %SVC_DENIED: Credential or verifier is not valid 895 * %SVC_GARBAGE: Failed to decode credential or verifier 896 * %SVC_CLOSE: Temporary failure 897 * 898 * rqstp->rq_auth_stat is set as mandated by RFC 5531. 899 */ 900 static int 901 svcauth_unix_accept(struct svc_rqst *rqstp) 902 { 903 struct xdr_stream *xdr = &rqstp->rq_arg_stream; 904 struct svc_cred *cred = &rqstp->rq_cred; 905 struct user_namespace *userns; 906 u32 flavor, len, i; 907 void *body; 908 __be32 *p; 909 910 /* 911 * This implementation ignores the length of the Call's 912 * credential body field and the timestamp and machinename 913 * fields. 914 */ 915 p = xdr_inline_decode(xdr, XDR_UNIT * 3); 916 if (!p) 917 return SVC_GARBAGE; 918 len = be32_to_cpup(p + 2); 919 if (len > RPC_MAX_MACHINENAME) 920 return SVC_GARBAGE; 921 if (!xdr_inline_decode(xdr, len)) 922 return SVC_GARBAGE; 923 924 /* 925 * Note: we skip uid_valid()/gid_valid() checks here for 926 * backwards compatibility with clients that use -1 id's. 927 * Instead, -1 uid or gid is later mapped to the 928 * (export-specific) anonymous id by nfsd_setuser. 929 * Supplementary gid's will be left alone. 930 */ 931 userns = (rqstp->rq_xprt && rqstp->rq_xprt->xpt_cred) ? 932 rqstp->rq_xprt->xpt_cred->user_ns : &init_user_ns; 933 if (xdr_stream_decode_u32(xdr, &i) < 0) 934 return SVC_GARBAGE; 935 cred->cr_uid = make_kuid(userns, i); 936 if (xdr_stream_decode_u32(xdr, &i) < 0) 937 return SVC_GARBAGE; 938 cred->cr_gid = make_kgid(userns, i); 939 940 if (xdr_stream_decode_u32(xdr, &len) < 0) 941 return SVC_GARBAGE; 942 if (len > UNX_NGROUPS) 943 goto badcred; 944 p = xdr_inline_decode(xdr, XDR_UNIT * len); 945 if (!p) 946 return SVC_GARBAGE; 947 cred->cr_group_info = groups_alloc(len); 948 if (cred->cr_group_info == NULL) 949 return SVC_CLOSE; 950 for (i = 0; i < len; i++) { 951 kgid_t kgid = make_kgid(userns, be32_to_cpup(p++)); 952 cred->cr_group_info->gid[i] = kgid; 953 } 954 groups_sort(cred->cr_group_info); 955 956 /* Call's verf field: */ 957 if (xdr_stream_decode_opaque_auth(xdr, &flavor, &body, &len) < 0) 958 return SVC_GARBAGE; 959 if (flavor != RPC_AUTH_NULL || len != 0) { 960 rqstp->rq_auth_stat = rpc_autherr_badverf; 961 return SVC_DENIED; 962 } 963 964 if (xdr_stream_encode_opaque_auth(&rqstp->rq_res_stream, 965 RPC_AUTH_NULL, NULL, 0) < 0) 966 return SVC_CLOSE; 967 if (!svcxdr_set_accept_stat(rqstp)) 968 return SVC_CLOSE; 969 970 rqstp->rq_cred.cr_flavor = RPC_AUTH_UNIX; 971 return SVC_OK; 972 973 badcred: 974 rqstp->rq_auth_stat = rpc_autherr_badcred; 975 return SVC_DENIED; 976 } 977 978 static int 979 svcauth_unix_release(struct svc_rqst *rqstp) 980 { 981 /* Verifier (such as it is) is already in place. 982 */ 983 if (rqstp->rq_client) 984 auth_domain_put(rqstp->rq_client); 985 rqstp->rq_client = NULL; 986 if (rqstp->rq_cred.cr_group_info) 987 put_group_info(rqstp->rq_cred.cr_group_info); 988 rqstp->rq_cred.cr_group_info = NULL; 989 990 return 0; 991 } 992 993 994 struct auth_ops svcauth_unix = { 995 .name = "unix", 996 .owner = THIS_MODULE, 997 .flavour = RPC_AUTH_UNIX, 998 .accept = svcauth_unix_accept, 999 .release = svcauth_unix_release, 1000 .domain_release = svcauth_unix_domain_release, 1001 .set_client = svcauth_unix_set_client, 1002 }; 1003 1004 static const struct cache_detail ip_map_cache_template = { 1005 .owner = THIS_MODULE, 1006 .hash_size = IP_HASHMAX, 1007 .name = "auth.unix.ip", 1008 .cache_put = ip_map_put, 1009 .cache_upcall = ip_map_upcall, 1010 .cache_request = ip_map_request, 1011 .cache_parse = ip_map_parse, 1012 .cache_show = ip_map_show, 1013 .match = ip_map_match, 1014 .init = ip_map_init, 1015 .update = update, 1016 .alloc = ip_map_alloc, 1017 }; 1018 1019 int ip_map_cache_create(struct net *net) 1020 { 1021 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id); 1022 struct cache_detail *cd; 1023 int err; 1024 1025 cd = cache_create_net(&ip_map_cache_template, net); 1026 if (IS_ERR(cd)) 1027 return PTR_ERR(cd); 1028 err = cache_register_net(cd, net); 1029 if (err) { 1030 cache_destroy_net(cd, net); 1031 return err; 1032 } 1033 sn->ip_map_cache = cd; 1034 return 0; 1035 } 1036 1037 void ip_map_cache_destroy(struct net *net) 1038 { 1039 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id); 1040 struct cache_detail *cd = sn->ip_map_cache; 1041 1042 sn->ip_map_cache = NULL; 1043 cache_purge(cd); 1044 cache_unregister_net(cd, net); 1045 cache_destroy_net(cd, net); 1046 } 1047