1 /*
2 * linux/net/sunrpc/auth.c
3 *
4 * Generic RPC client authentication API.
5 *
6 * Copyright (C) 1996, Olaf Kirch <okir@monad.swb.de>
7 */
8
9 #include <linux/types.h>
10 #include <linux/sched.h>
11 #include <linux/module.h>
12 #include <linux/slab.h>
13 #include <linux/errno.h>
14 #include <linux/socket.h>
15 #include <linux/sunrpc/clnt.h>
16 #include <linux/spinlock.h>
17
18 #ifdef RPC_DEBUG
19 # define RPCDBG_FACILITY RPCDBG_AUTH
20 #endif
21
22 static struct rpc_authops * auth_flavors[RPC_AUTH_MAXFLAVOR] = {
23 &authnull_ops, /* AUTH_NULL */
24 &authunix_ops, /* AUTH_UNIX */
25 NULL, /* others can be loadable modules */
26 };
27
28 static u32
29 pseudoflavor_to_flavor(u32 flavor) {
30 if (flavor >= RPC_AUTH_MAXFLAVOR)
31 return RPC_AUTH_GSS;
32 return flavor;
33 }
34
35 int
36 rpcauth_register(struct rpc_authops *ops)
37 {
38 rpc_authflavor_t flavor;
39
40 if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR)
41 return -EINVAL;
42 if (auth_flavors[flavor] != NULL)
43 return -EPERM; /* what else? */
44 auth_flavors[flavor] = ops;
45 return 0;
46 }
47
48 int
49 rpcauth_unregister(struct rpc_authops *ops)
50 {
51 rpc_authflavor_t flavor;
52
53 if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR)
54 return -EINVAL;
55 if (auth_flavors[flavor] != ops)
56 return -EPERM; /* what else? */
57 auth_flavors[flavor] = NULL;
58 return 0;
59 }
60
61 struct rpc_auth *
62 rpcauth_create(rpc_authflavor_t pseudoflavor, struct rpc_clnt *clnt)
63 {
64 struct rpc_auth *auth;
65 struct rpc_authops *ops;
66 u32 flavor = pseudoflavor_to_flavor(pseudoflavor);
67
68 if (flavor >= RPC_AUTH_MAXFLAVOR || !(ops = auth_flavors[flavor]))
69 return NULL;
70 if (!try_module_get(ops->owner))
71 return NULL;
72 auth = ops->create(clnt, pseudoflavor);
73 if (!auth)
74 return NULL;
75 atomic_set(&auth->au_count, 1);
76 if (clnt->cl_auth)
77 rpcauth_destroy(clnt->cl_auth);
78 clnt->cl_auth = auth;
79 return auth;
80 }
81
82 void
83 rpcauth_destroy(struct rpc_auth *auth)
84 {
85 if (!atomic_dec_and_test(&auth->au_count))
86 return;
87 auth->au_ops->destroy(auth);
88 module_put(auth->au_ops->owner);
89 kfree(auth);
90 }
91
92 static DEFINE_SPINLOCK(rpc_credcache_lock);
93
94 /*
95 * Initialize RPC credential cache
96 */
97 void
98 rpcauth_init_credcache(struct rpc_auth *auth)
99 {
100 int i;
101 for (i = 0; i < RPC_CREDCACHE_NR; i++)
102 INIT_LIST_HEAD(&auth->au_credcache[i]);
103 auth->au_nextgc = jiffies + (auth->au_expire >> 1);
104 }
105
106 /*
107 * Destroy an unreferenced credential
108 */
109 static inline void
110 rpcauth_crdestroy(struct rpc_cred *cred)
111 {
112 #ifdef RPC_DEBUG
113 BUG_ON(cred->cr_magic != RPCAUTH_CRED_MAGIC ||
114 atomic_read(&cred->cr_count) ||
115 !list_empty(&cred->cr_hash));
116 cred->cr_magic = 0;
117 #endif
118 cred->cr_ops->crdestroy(cred);
119 }
120
121 /*
122 * Destroy a list of credentials
123 */
124 static inline
125 void rpcauth_destroy_credlist(struct list_head *head)
126 {
127 struct rpc_cred *cred;
128
129 while (!list_empty(head)) {
130 cred = list_entry(head->next, struct rpc_cred, cr_hash);
131 list_del_init(&cred->cr_hash);
132 rpcauth_crdestroy(cred);
133 }
134 }
135
136 /*
137 * Clear the RPC credential cache, and delete those credentials
138 * that are not referenced.
139 */
140 void
141 rpcauth_free_credcache(struct rpc_auth *auth)
142 {
143 LIST_HEAD(free);
144 struct list_head *pos, *next;
145 struct rpc_cred *cred;
146 int i;
147
148 spin_lock(&rpc_credcache_lock);
149 for (i = 0; i < RPC_CREDCACHE_NR; i++) {
150 list_for_each_safe(pos, next, &auth->au_credcache[i]) {
151 cred = list_entry(pos, struct rpc_cred, cr_hash);
152 cred->cr_auth = NULL;
153 list_del_init(&cred->cr_hash);
154 if (atomic_read(&cred->cr_count) == 0)
155 list_add(&cred->cr_hash, &free);
156 }
157 }
158 spin_unlock(&rpc_credcache_lock);
159 rpcauth_destroy_credlist(&free);
160 }
161
162 static inline int
163 rpcauth_prune_expired(struct rpc_cred *cred, struct list_head *free)
164 {
165 if (atomic_read(&cred->cr_count) != 0)
166 return 0;
167 if (time_before(jiffies, cred->cr_expire))
168 return 0;
169 cred->cr_auth = NULL;
170 list_del(&cred->cr_hash);
171 list_add(&cred->cr_hash, free);
172 return 1;
173 }
174
175 /*
176 * Remove stale credentials. Avoid sleeping inside the loop.
177 */
178 static void
179 rpcauth_gc_credcache(struct rpc_auth *auth, struct list_head *free)
180 {
181 struct list_head *pos, *next;
182 struct rpc_cred *cred;
183 int i;
184
185 dprintk("RPC: gc'ing RPC credentials for auth %p\n", auth);
186 for (i = 0; i < RPC_CREDCACHE_NR; i++) {
187 list_for_each_safe(pos, next, &auth->au_credcache[i]) {
188 cred = list_entry(pos, struct rpc_cred, cr_hash);
189 rpcauth_prune_expired(cred, free);
190 }
191 }
192 auth->au_nextgc = jiffies + auth->au_expire;
193 }
194
195 /*
196 * Look up a process' credentials in the authentication cache
197 */
198 struct rpc_cred *
199 rpcauth_lookup_credcache(struct rpc_auth *auth, struct auth_cred * acred,
200 int taskflags)
201 {
202 LIST_HEAD(free);
203 struct list_head *pos, *next;
204 struct rpc_cred *new = NULL,
205 *cred = NULL;
206 int nr = 0;
207
208 if (!(taskflags & RPC_TASK_ROOTCREDS))
209 nr = acred->uid & RPC_CREDCACHE_MASK;
210 retry:
211 spin_lock(&rpc_credcache_lock);
212 if (time_before(auth->au_nextgc, jiffies))
213 rpcauth_gc_credcache(auth, &free);
214 list_for_each_safe(pos, next, &auth->au_credcache[nr]) {
215 struct rpc_cred *entry;
216 entry = list_entry(pos, struct rpc_cred, cr_hash);
217 if (rpcauth_prune_expired(entry, &free))
218 continue;
219 if (entry->cr_ops->crmatch(acred, entry, taskflags)) {
220 list_del(&entry->cr_hash);
221 cred = entry;
222 break;
223 }
224 }
225 if (new) {
226 if (cred)
227 list_add(&new->cr_hash, &free);
228 else
229 cred = new;
230 }
231 if (cred) {
232 list_add(&cred->cr_hash, &auth->au_credcache[nr]);
233 cred->cr_auth = auth;
234 get_rpccred(cred);
235 }
236 spin_unlock(&rpc_credcache_lock);
237
238 rpcauth_destroy_credlist(&free);
239
240 if (!cred) {
241 new = auth->au_ops->crcreate(auth, acred, taskflags);
242 if (new) {
243 #ifdef RPC_DEBUG
244 new->cr_magic = RPCAUTH_CRED_MAGIC;
245 #endif
246 goto retry;
247 }
248 }
249
250 return (struct rpc_cred *) cred;
251 }
252
253 struct rpc_cred *
254 rpcauth_lookupcred(struct rpc_auth *auth, int taskflags)
255 {
256 struct auth_cred acred;
257 struct rpc_cred *ret;
258
259 get_group_info(current->group_info);
260 acred.uid = current->fsuid;
261 acred.gid = current->fsgid;
262 acred.group_info = current->group_info;
263
264 dprintk("RPC: looking up %s cred\n",
265 auth->au_ops->au_name);
266 ret = rpcauth_lookup_credcache(auth, &acred, taskflags);
267 put_group_info(current->group_info);
268 return ret;
269 }
270
271 struct rpc_cred *
272 rpcauth_bindcred(struct rpc_task *task)
273 {
274 struct rpc_auth *auth = task->tk_auth;
275 struct auth_cred acred;
276 struct rpc_cred *ret;
277
278 get_group_info(current->group_info);
279 acred.uid = current->fsuid;
280 acred.gid = current->fsgid;
281 acred.group_info = current->group_info;
282
283 dprintk("RPC: %4d looking up %s cred\n",
284 task->tk_pid, task->tk_auth->au_ops->au_name);
285 task->tk_msg.rpc_cred = rpcauth_lookup_credcache(auth, &acred, task->tk_flags);
286 if (task->tk_msg.rpc_cred == 0)
287 task->tk_status = -ENOMEM;
288 ret = task->tk_msg.rpc_cred;
289 put_group_info(current->group_info);
290 return ret;
291 }
292
293 void
294 rpcauth_holdcred(struct rpc_task *task)
295 {
296 dprintk("RPC: %4d holding %s cred %p\n",
297 task->tk_pid, task->tk_auth->au_ops->au_name, task->tk_msg.rpc_cred);
298 if (task->tk_msg.rpc_cred)
299 get_rpccred(task->tk_msg.rpc_cred);
300 }
301
302 void
303 put_rpccred(struct rpc_cred *cred)
304 {
305 if (!atomic_dec_and_lock(&cred->cr_count, &rpc_credcache_lock))
306 return;
307
308 if (list_empty(&cred->cr_hash)) {
309 spin_unlock(&rpc_credcache_lock);
310 rpcauth_crdestroy(cred);
311 return;
312 }
313 cred->cr_expire = jiffies + cred->cr_auth->au_expire;
314 spin_unlock(&rpc_credcache_lock);
315 }
316
317 void
318 rpcauth_unbindcred(struct rpc_task *task)
319 {
320 struct rpc_auth *auth = task->tk_auth;
321 struct rpc_cred *cred = task->tk_msg.rpc_cred;
322
323 dprintk("RPC: %4d releasing %s cred %p\n",
324 task->tk_pid, auth->au_ops->au_name, cred);
325
326 put_rpccred(cred);
327 task->tk_msg.rpc_cred = NULL;
328 }
329
330 u32 *
331 rpcauth_marshcred(struct rpc_task *task, u32 *p)
332 {
333 struct rpc_auth *auth = task->tk_auth;
334 struct rpc_cred *cred = task->tk_msg.rpc_cred;
335
336 dprintk("RPC: %4d marshaling %s cred %p\n",
337 task->tk_pid, auth->au_ops->au_name, cred);
338 return cred->cr_ops->crmarshal(task, p,
339 task->tk_flags & RPC_CALL_REALUID);
340 }
341
342 u32 *
343 rpcauth_checkverf(struct rpc_task *task, u32 *p)
344 {
345 struct rpc_auth *auth = task->tk_auth;
346 struct rpc_cred *cred = task->tk_msg.rpc_cred;
347
348 dprintk("RPC: %4d validating %s cred %p\n",
349 task->tk_pid, auth->au_ops->au_name, cred);
350 return cred->cr_ops->crvalidate(task, p);
351 }
352
353 int
354 rpcauth_wrap_req(struct rpc_task *task, kxdrproc_t encode, void *rqstp,
355 u32 *data, void *obj)
356 {
357 struct rpc_cred *cred = task->tk_msg.rpc_cred;
358
359 dprintk("RPC: %4d using %s cred %p to wrap rpc data\n",
360 task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
361 if (cred->cr_ops->crwrap_req)
362 return cred->cr_ops->crwrap_req(task, encode, rqstp, data, obj);
363 /* By default, we encode the arguments normally. */
364 return encode(rqstp, data, obj);
365 }
366
367 int
368 rpcauth_unwrap_resp(struct rpc_task *task, kxdrproc_t decode, void *rqstp,
369 u32 *data, void *obj)
370 {
371 struct rpc_cred *cred = task->tk_msg.rpc_cred;
372
373 dprintk("RPC: %4d using %s cred %p to unwrap rpc data\n",
374 task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
375 if (cred->cr_ops->crunwrap_resp)
376 return cred->cr_ops->crunwrap_resp(task, decode, rqstp,
377 data, obj);
378 /* By default, we decode the arguments normally. */
379 return decode(rqstp, data, obj);
380 }
381
382 int
383 rpcauth_refreshcred(struct rpc_task *task)
384 {
385 struct rpc_auth *auth = task->tk_auth;
386 struct rpc_cred *cred = task->tk_msg.rpc_cred;
387
388 dprintk("RPC: %4d refreshing %s cred %p\n",
389 task->tk_pid, auth->au_ops->au_name, cred);
390 task->tk_status = cred->cr_ops->crrefresh(task);
391 return task->tk_status;
392 }
393
394 void
395 rpcauth_invalcred(struct rpc_task *task)
396 {
397 dprintk("RPC: %4d invalidating %s cred %p\n",
398 task->tk_pid, task->tk_auth->au_ops->au_name, task->tk_msg.rpc_cred);
399 spin_lock(&rpc_credcache_lock);
400 if (task->tk_msg.rpc_cred)
401 task->tk_msg.rpc_cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;
402 spin_unlock(&rpc_credcache_lock);
403 }
404
405 int
406 rpcauth_uptodatecred(struct rpc_task *task)
407 {
408 return !(task->tk_msg.rpc_cred) ||
409 (task->tk_msg.rpc_cred->cr_flags & RPCAUTH_CRED_UPTODATE);
410 }
411
|
This page was automatically generated by the
LXR engine.
|