This source file includes following definitions.
- netobj_equal
- rsi_free
- rsi_free_rcu
- rsi_put
- rsi_hash
- rsi_match
- dup_to_netobj
- dup_netobj
- rsi_init
- update_rsi
- rsi_alloc
- rsi_request
- rsi_parse
- rsi_lookup
- rsi_update
- rsc_free
- rsc_free_rcu
- rsc_put
- rsc_hash
- rsc_match
- rsc_init
- update_rsc
- rsc_alloc
- rsc_parse
- rsc_lookup
- rsc_update
- gss_svc_searchbyctx
- gss_check_seq_num
- round_up_to_quad
- svc_safe_getnetobj
- svc_safe_putnetobj
- gss_verify_header
- gss_write_null_verf
- gss_write_verf
- find_gss_auth_domain
- svcauth_gss_flavor
- svcauth_gss_register_pseudoflavor
- read_u32_from_xdr_buf
- unwrap_integ_data
- total_buf_len
- fix_priv_head
- unwrap_priv_data
- svcauth_gss_set_client
- gss_write_init_verf
- gss_read_common_verf
- gss_read_verf
- gss_free_in_token_pages
- gss_read_proxy_verf
- gss_write_resv
- svcauth_gss_legacy_init
- gss_proxy_save_rsc
- svcauth_gss_proxy_init
- set_gss_proxy
- use_gss_proxy
- write_gssp
- read_gssp
- create_use_gss_proxy_proc_entry
- destroy_use_gss_proxy_proc_entry
- create_use_gss_proxy_proc_entry
- destroy_use_gss_proxy_proc_entry
- svcauth_gss_accept
- svcauth_gss_prepare_to_wrap
- svcauth_gss_wrap_resp_integ
- svcauth_gss_wrap_resp_priv
- svcauth_gss_release
- svcauth_gss_domain_release_rcu
- svcauth_gss_domain_release
- rsi_cache_create_net
- rsi_cache_destroy_net
- rsc_cache_create_net
- rsc_cache_destroy_net
- gss_svc_init_net
- gss_svc_shutdown_net
- gss_svc_init
- gss_svc_shutdown
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41 #include <linux/slab.h>
42 #include <linux/types.h>
43 #include <linux/module.h>
44 #include <linux/pagemap.h>
45 #include <linux/user_namespace.h>
46
47 #include <linux/sunrpc/auth_gss.h>
48 #include <linux/sunrpc/gss_err.h>
49 #include <linux/sunrpc/svcauth.h>
50 #include <linux/sunrpc/svcauth_gss.h>
51 #include <linux/sunrpc/cache.h>
52 #include "gss_rpc_upcall.h"
53
54
55 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
56 # define RPCDBG_FACILITY RPCDBG_AUTH
57 #endif
58
59
60
61
62
63
64
65
66
67 static int netobj_equal(struct xdr_netobj *a, struct xdr_netobj *b)
68 {
69 return a->len == b->len && 0 == memcmp(a->data, b->data, a->len);
70 }
71
72 #define RSI_HASHBITS 6
73 #define RSI_HASHMAX (1<<RSI_HASHBITS)
74
75 struct rsi {
76 struct cache_head h;
77 struct xdr_netobj in_handle, in_token;
78 struct xdr_netobj out_handle, out_token;
79 int major_status, minor_status;
80 struct rcu_head rcu_head;
81 };
82
83 static struct rsi *rsi_update(struct cache_detail *cd, struct rsi *new, struct rsi *old);
84 static struct rsi *rsi_lookup(struct cache_detail *cd, struct rsi *item);
85
86 static void rsi_free(struct rsi *rsii)
87 {
88 kfree(rsii->in_handle.data);
89 kfree(rsii->in_token.data);
90 kfree(rsii->out_handle.data);
91 kfree(rsii->out_token.data);
92 }
93
94 static void rsi_free_rcu(struct rcu_head *head)
95 {
96 struct rsi *rsii = container_of(head, struct rsi, rcu_head);
97
98 rsi_free(rsii);
99 kfree(rsii);
100 }
101
102 static void rsi_put(struct kref *ref)
103 {
104 struct rsi *rsii = container_of(ref, struct rsi, h.ref);
105
106 call_rcu(&rsii->rcu_head, rsi_free_rcu);
107 }
108
109 static inline int rsi_hash(struct rsi *item)
110 {
111 return hash_mem(item->in_handle.data, item->in_handle.len, RSI_HASHBITS)
112 ^ hash_mem(item->in_token.data, item->in_token.len, RSI_HASHBITS);
113 }
114
115 static int rsi_match(struct cache_head *a, struct cache_head *b)
116 {
117 struct rsi *item = container_of(a, struct rsi, h);
118 struct rsi *tmp = container_of(b, struct rsi, h);
119 return netobj_equal(&item->in_handle, &tmp->in_handle) &&
120 netobj_equal(&item->in_token, &tmp->in_token);
121 }
122
123 static int dup_to_netobj(struct xdr_netobj *dst, char *src, int len)
124 {
125 dst->len = len;
126 dst->data = (len ? kmemdup(src, len, GFP_KERNEL) : NULL);
127 if (len && !dst->data)
128 return -ENOMEM;
129 return 0;
130 }
131
132 static inline int dup_netobj(struct xdr_netobj *dst, struct xdr_netobj *src)
133 {
134 return dup_to_netobj(dst, src->data, src->len);
135 }
136
137 static void rsi_init(struct cache_head *cnew, struct cache_head *citem)
138 {
139 struct rsi *new = container_of(cnew, struct rsi, h);
140 struct rsi *item = container_of(citem, struct rsi, h);
141
142 new->out_handle.data = NULL;
143 new->out_handle.len = 0;
144 new->out_token.data = NULL;
145 new->out_token.len = 0;
146 new->in_handle.len = item->in_handle.len;
147 item->in_handle.len = 0;
148 new->in_token.len = item->in_token.len;
149 item->in_token.len = 0;
150 new->in_handle.data = item->in_handle.data;
151 item->in_handle.data = NULL;
152 new->in_token.data = item->in_token.data;
153 item->in_token.data = NULL;
154 }
155
156 static void update_rsi(struct cache_head *cnew, struct cache_head *citem)
157 {
158 struct rsi *new = container_of(cnew, struct rsi, h);
159 struct rsi *item = container_of(citem, struct rsi, h);
160
161 BUG_ON(new->out_handle.data || new->out_token.data);
162 new->out_handle.len = item->out_handle.len;
163 item->out_handle.len = 0;
164 new->out_token.len = item->out_token.len;
165 item->out_token.len = 0;
166 new->out_handle.data = item->out_handle.data;
167 item->out_handle.data = NULL;
168 new->out_token.data = item->out_token.data;
169 item->out_token.data = NULL;
170
171 new->major_status = item->major_status;
172 new->minor_status = item->minor_status;
173 }
174
175 static struct cache_head *rsi_alloc(void)
176 {
177 struct rsi *rsii = kmalloc(sizeof(*rsii), GFP_KERNEL);
178 if (rsii)
179 return &rsii->h;
180 else
181 return NULL;
182 }
183
184 static void rsi_request(struct cache_detail *cd,
185 struct cache_head *h,
186 char **bpp, int *blen)
187 {
188 struct rsi *rsii = container_of(h, struct rsi, h);
189
190 qword_addhex(bpp, blen, rsii->in_handle.data, rsii->in_handle.len);
191 qword_addhex(bpp, blen, rsii->in_token.data, rsii->in_token.len);
192 (*bpp)[-1] = '\n';
193 }
194
195 static int rsi_parse(struct cache_detail *cd,
196 char *mesg, int mlen)
197 {
198
199 char *buf = mesg;
200 char *ep;
201 int len;
202 struct rsi rsii, *rsip = NULL;
203 time_t expiry;
204 int status = -EINVAL;
205
206 memset(&rsii, 0, sizeof(rsii));
207
208 len = qword_get(&mesg, buf, mlen);
209 if (len < 0)
210 goto out;
211 status = -ENOMEM;
212 if (dup_to_netobj(&rsii.in_handle, buf, len))
213 goto out;
214
215
216 len = qword_get(&mesg, buf, mlen);
217 status = -EINVAL;
218 if (len < 0)
219 goto out;
220 status = -ENOMEM;
221 if (dup_to_netobj(&rsii.in_token, buf, len))
222 goto out;
223
224 rsip = rsi_lookup(cd, &rsii);
225 if (!rsip)
226 goto out;
227
228 rsii.h.flags = 0;
229
230 expiry = get_expiry(&mesg);
231 status = -EINVAL;
232 if (expiry == 0)
233 goto out;
234
235
236 len = qword_get(&mesg, buf, mlen);
237 if (len <= 0)
238 goto out;
239 rsii.major_status = simple_strtoul(buf, &ep, 10);
240 if (*ep)
241 goto out;
242 len = qword_get(&mesg, buf, mlen);
243 if (len <= 0)
244 goto out;
245 rsii.minor_status = simple_strtoul(buf, &ep, 10);
246 if (*ep)
247 goto out;
248
249
250 len = qword_get(&mesg, buf, mlen);
251 if (len < 0)
252 goto out;
253 status = -ENOMEM;
254 if (dup_to_netobj(&rsii.out_handle, buf, len))
255 goto out;
256
257
258 len = qword_get(&mesg, buf, mlen);
259 status = -EINVAL;
260 if (len < 0)
261 goto out;
262 status = -ENOMEM;
263 if (dup_to_netobj(&rsii.out_token, buf, len))
264 goto out;
265 rsii.h.expiry_time = expiry;
266 rsip = rsi_update(cd, &rsii, rsip);
267 status = 0;
268 out:
269 rsi_free(&rsii);
270 if (rsip)
271 cache_put(&rsip->h, cd);
272 else
273 status = -ENOMEM;
274 return status;
275 }
276
277 static const struct cache_detail rsi_cache_template = {
278 .owner = THIS_MODULE,
279 .hash_size = RSI_HASHMAX,
280 .name = "auth.rpcsec.init",
281 .cache_put = rsi_put,
282 .cache_request = rsi_request,
283 .cache_parse = rsi_parse,
284 .match = rsi_match,
285 .init = rsi_init,
286 .update = update_rsi,
287 .alloc = rsi_alloc,
288 };
289
290 static struct rsi *rsi_lookup(struct cache_detail *cd, struct rsi *item)
291 {
292 struct cache_head *ch;
293 int hash = rsi_hash(item);
294
295 ch = sunrpc_cache_lookup_rcu(cd, &item->h, hash);
296 if (ch)
297 return container_of(ch, struct rsi, h);
298 else
299 return NULL;
300 }
301
302 static struct rsi *rsi_update(struct cache_detail *cd, struct rsi *new, struct rsi *old)
303 {
304 struct cache_head *ch;
305 int hash = rsi_hash(new);
306
307 ch = sunrpc_cache_update(cd, &new->h,
308 &old->h, hash);
309 if (ch)
310 return container_of(ch, struct rsi, h);
311 else
312 return NULL;
313 }
314
315
316
317
318
319
320
321
322
323 #define RSC_HASHBITS 10
324 #define RSC_HASHMAX (1<<RSC_HASHBITS)
325
326 #define GSS_SEQ_WIN 128
327
328 struct gss_svc_seq_data {
329
330 int sd_max;
331
332
333 unsigned long sd_win[GSS_SEQ_WIN/BITS_PER_LONG];
334 spinlock_t sd_lock;
335 };
336
337 struct rsc {
338 struct cache_head h;
339 struct xdr_netobj handle;
340 struct svc_cred cred;
341 struct gss_svc_seq_data seqdata;
342 struct gss_ctx *mechctx;
343 struct rcu_head rcu_head;
344 };
345
346 static struct rsc *rsc_update(struct cache_detail *cd, struct rsc *new, struct rsc *old);
347 static struct rsc *rsc_lookup(struct cache_detail *cd, struct rsc *item);
348
349 static void rsc_free(struct rsc *rsci)
350 {
351 kfree(rsci->handle.data);
352 if (rsci->mechctx)
353 gss_delete_sec_context(&rsci->mechctx);
354 free_svc_cred(&rsci->cred);
355 }
356
357 static void rsc_free_rcu(struct rcu_head *head)
358 {
359 struct rsc *rsci = container_of(head, struct rsc, rcu_head);
360
361 kfree(rsci->handle.data);
362 kfree(rsci);
363 }
364
365 static void rsc_put(struct kref *ref)
366 {
367 struct rsc *rsci = container_of(ref, struct rsc, h.ref);
368
369 if (rsci->mechctx)
370 gss_delete_sec_context(&rsci->mechctx);
371 free_svc_cred(&rsci->cred);
372 call_rcu(&rsci->rcu_head, rsc_free_rcu);
373 }
374
375 static inline int
376 rsc_hash(struct rsc *rsci)
377 {
378 return hash_mem(rsci->handle.data, rsci->handle.len, RSC_HASHBITS);
379 }
380
381 static int
382 rsc_match(struct cache_head *a, struct cache_head *b)
383 {
384 struct rsc *new = container_of(a, struct rsc, h);
385 struct rsc *tmp = container_of(b, struct rsc, h);
386
387 return netobj_equal(&new->handle, &tmp->handle);
388 }
389
390 static void
391 rsc_init(struct cache_head *cnew, struct cache_head *ctmp)
392 {
393 struct rsc *new = container_of(cnew, struct rsc, h);
394 struct rsc *tmp = container_of(ctmp, struct rsc, h);
395
396 new->handle.len = tmp->handle.len;
397 tmp->handle.len = 0;
398 new->handle.data = tmp->handle.data;
399 tmp->handle.data = NULL;
400 new->mechctx = NULL;
401 init_svc_cred(&new->cred);
402 }
403
404 static void
405 update_rsc(struct cache_head *cnew, struct cache_head *ctmp)
406 {
407 struct rsc *new = container_of(cnew, struct rsc, h);
408 struct rsc *tmp = container_of(ctmp, struct rsc, h);
409
410 new->mechctx = tmp->mechctx;
411 tmp->mechctx = NULL;
412 memset(&new->seqdata, 0, sizeof(new->seqdata));
413 spin_lock_init(&new->seqdata.sd_lock);
414 new->cred = tmp->cred;
415 init_svc_cred(&tmp->cred);
416 }
417
418 static struct cache_head *
419 rsc_alloc(void)
420 {
421 struct rsc *rsci = kmalloc(sizeof(*rsci), GFP_KERNEL);
422 if (rsci)
423 return &rsci->h;
424 else
425 return NULL;
426 }
427
428 static int rsc_parse(struct cache_detail *cd,
429 char *mesg, int mlen)
430 {
431
432 char *buf = mesg;
433 int id;
434 int len, rv;
435 struct rsc rsci, *rscp = NULL;
436 time_t expiry;
437 int status = -EINVAL;
438 struct gss_api_mech *gm = NULL;
439
440 memset(&rsci, 0, sizeof(rsci));
441
442 len = qword_get(&mesg, buf, mlen);
443 if (len < 0) goto out;
444 status = -ENOMEM;
445 if (dup_to_netobj(&rsci.handle, buf, len))
446 goto out;
447
448 rsci.h.flags = 0;
449
450 expiry = get_expiry(&mesg);
451 status = -EINVAL;
452 if (expiry == 0)
453 goto out;
454
455 rscp = rsc_lookup(cd, &rsci);
456 if (!rscp)
457 goto out;
458
459
460 rv = get_int(&mesg, &id);
461 if (rv == -EINVAL)
462 goto out;
463 if (rv == -ENOENT)
464 set_bit(CACHE_NEGATIVE, &rsci.h.flags);
465 else {
466 int N, i;
467
468
469
470
471
472
473
474
475
476
477 rsci.cred.cr_uid = make_kuid(current_user_ns(), id);
478
479
480 if (get_int(&mesg, &id))
481 goto out;
482 rsci.cred.cr_gid = make_kgid(current_user_ns(), id);
483
484
485 if (get_int(&mesg, &N))
486 goto out;
487 if (N < 0 || N > NGROUPS_MAX)
488 goto out;
489 status = -ENOMEM;
490 rsci.cred.cr_group_info = groups_alloc(N);
491 if (rsci.cred.cr_group_info == NULL)
492 goto out;
493
494
495 status = -EINVAL;
496 for (i=0; i<N; i++) {
497 kgid_t kgid;
498 if (get_int(&mesg, &id))
499 goto out;
500 kgid = make_kgid(current_user_ns(), id);
501 if (!gid_valid(kgid))
502 goto out;
503 rsci.cred.cr_group_info->gid[i] = kgid;
504 }
505 groups_sort(rsci.cred.cr_group_info);
506
507
508 len = qword_get(&mesg, buf, mlen);
509 if (len < 0)
510 goto out;
511 gm = rsci.cred.cr_gss_mech = gss_mech_get_by_name(buf);
512 status = -EOPNOTSUPP;
513 if (!gm)
514 goto out;
515
516 status = -EINVAL;
517
518 len = qword_get(&mesg, buf, mlen);
519 if (len < 0)
520 goto out;
521 status = gss_import_sec_context(buf, len, gm, &rsci.mechctx,
522 NULL, GFP_KERNEL);
523 if (status)
524 goto out;
525
526
527 len = qword_get(&mesg, buf, mlen);
528 if (len > 0) {
529 rsci.cred.cr_principal = kstrdup(buf, GFP_KERNEL);
530 if (!rsci.cred.cr_principal) {
531 status = -ENOMEM;
532 goto out;
533 }
534 }
535
536 }
537 rsci.h.expiry_time = expiry;
538 rscp = rsc_update(cd, &rsci, rscp);
539 status = 0;
540 out:
541 rsc_free(&rsci);
542 if (rscp)
543 cache_put(&rscp->h, cd);
544 else
545 status = -ENOMEM;
546 return status;
547 }
548
549 static const struct cache_detail rsc_cache_template = {
550 .owner = THIS_MODULE,
551 .hash_size = RSC_HASHMAX,
552 .name = "auth.rpcsec.context",
553 .cache_put = rsc_put,
554 .cache_parse = rsc_parse,
555 .match = rsc_match,
556 .init = rsc_init,
557 .update = update_rsc,
558 .alloc = rsc_alloc,
559 };
560
561 static struct rsc *rsc_lookup(struct cache_detail *cd, struct rsc *item)
562 {
563 struct cache_head *ch;
564 int hash = rsc_hash(item);
565
566 ch = sunrpc_cache_lookup_rcu(cd, &item->h, hash);
567 if (ch)
568 return container_of(ch, struct rsc, h);
569 else
570 return NULL;
571 }
572
573 static struct rsc *rsc_update(struct cache_detail *cd, struct rsc *new, struct rsc *old)
574 {
575 struct cache_head *ch;
576 int hash = rsc_hash(new);
577
578 ch = sunrpc_cache_update(cd, &new->h,
579 &old->h, hash);
580 if (ch)
581 return container_of(ch, struct rsc, h);
582 else
583 return NULL;
584 }
585
586
587 static struct rsc *
588 gss_svc_searchbyctx(struct cache_detail *cd, struct xdr_netobj *handle)
589 {
590 struct rsc rsci;
591 struct rsc *found;
592
593 memset(&rsci, 0, sizeof(rsci));
594 if (dup_to_netobj(&rsci.handle, handle->data, handle->len))
595 return NULL;
596 found = rsc_lookup(cd, &rsci);
597 rsc_free(&rsci);
598 if (!found)
599 return NULL;
600 if (cache_check(cd, &found->h, NULL))
601 return NULL;
602 return found;
603 }
604
605
606 static int
607 gss_check_seq_num(struct rsc *rsci, int seq_num)
608 {
609 struct gss_svc_seq_data *sd = &rsci->seqdata;
610
611 spin_lock(&sd->sd_lock);
612 if (seq_num > sd->sd_max) {
613 if (seq_num >= sd->sd_max + GSS_SEQ_WIN) {
614 memset(sd->sd_win,0,sizeof(sd->sd_win));
615 sd->sd_max = seq_num;
616 } else while (sd->sd_max < seq_num) {
617 sd->sd_max++;
618 __clear_bit(sd->sd_max % GSS_SEQ_WIN, sd->sd_win);
619 }
620 __set_bit(seq_num % GSS_SEQ_WIN, sd->sd_win);
621 goto ok;
622 } else if (seq_num <= sd->sd_max - GSS_SEQ_WIN) {
623 goto drop;
624 }
625
626 if (__test_and_set_bit(seq_num % GSS_SEQ_WIN, sd->sd_win))
627 goto drop;
628 ok:
629 spin_unlock(&sd->sd_lock);
630 return 1;
631 drop:
632 spin_unlock(&sd->sd_lock);
633 return 0;
634 }
635
636 static inline u32 round_up_to_quad(u32 i)
637 {
638 return (i + 3 ) & ~3;
639 }
640
641 static inline int
642 svc_safe_getnetobj(struct kvec *argv, struct xdr_netobj *o)
643 {
644 int l;
645
646 if (argv->iov_len < 4)
647 return -1;
648 o->len = svc_getnl(argv);
649 l = round_up_to_quad(o->len);
650 if (argv->iov_len < l)
651 return -1;
652 o->data = argv->iov_base;
653 argv->iov_base += l;
654 argv->iov_len -= l;
655 return 0;
656 }
657
658 static inline int
659 svc_safe_putnetobj(struct kvec *resv, struct xdr_netobj *o)
660 {
661 u8 *p;
662
663 if (resv->iov_len + 4 > PAGE_SIZE)
664 return -1;
665 svc_putnl(resv, o->len);
666 p = resv->iov_base + resv->iov_len;
667 resv->iov_len += round_up_to_quad(o->len);
668 if (resv->iov_len > PAGE_SIZE)
669 return -1;
670 memcpy(p, o->data, o->len);
671 memset(p + o->len, 0, round_up_to_quad(o->len) - o->len);
672 return 0;
673 }
674
675
676
677
678
679
680 static int
681 gss_verify_header(struct svc_rqst *rqstp, struct rsc *rsci,
682 __be32 *rpcstart, struct rpc_gss_wire_cred *gc, __be32 *authp)
683 {
684 struct gss_ctx *ctx_id = rsci->mechctx;
685 struct xdr_buf rpchdr;
686 struct xdr_netobj checksum;
687 u32 flavor = 0;
688 struct kvec *argv = &rqstp->rq_arg.head[0];
689 struct kvec iov;
690
691
692 iov.iov_base = rpcstart;
693 iov.iov_len = (u8 *)argv->iov_base - (u8 *)rpcstart;
694 xdr_buf_from_iov(&iov, &rpchdr);
695
696 *authp = rpc_autherr_badverf;
697 if (argv->iov_len < 4)
698 return SVC_DENIED;
699 flavor = svc_getnl(argv);
700 if (flavor != RPC_AUTH_GSS)
701 return SVC_DENIED;
702 if (svc_safe_getnetobj(argv, &checksum))
703 return SVC_DENIED;
704
705 if (rqstp->rq_deferred)
706 return SVC_OK;
707 if (gss_verify_mic(ctx_id, &rpchdr, &checksum) != GSS_S_COMPLETE) {
708 *authp = rpcsec_gsserr_credproblem;
709 return SVC_DENIED;
710 }
711
712 if (gc->gc_seq > MAXSEQ) {
713 dprintk("RPC: svcauth_gss: discarding request with "
714 "large sequence number %d\n", gc->gc_seq);
715 *authp = rpcsec_gsserr_ctxproblem;
716 return SVC_DENIED;
717 }
718 if (!gss_check_seq_num(rsci, gc->gc_seq)) {
719 dprintk("RPC: svcauth_gss: discarding request with "
720 "old sequence number %d\n", gc->gc_seq);
721 return SVC_DROP;
722 }
723 return SVC_OK;
724 }
725
726 static int
727 gss_write_null_verf(struct svc_rqst *rqstp)
728 {
729 __be32 *p;
730
731 svc_putnl(rqstp->rq_res.head, RPC_AUTH_NULL);
732 p = rqstp->rq_res.head->iov_base + rqstp->rq_res.head->iov_len;
733
734 *p++ = 0;
735 if (!xdr_ressize_check(rqstp, p))
736 return -1;
737 return 0;
738 }
739
740 static int
741 gss_write_verf(struct svc_rqst *rqstp, struct gss_ctx *ctx_id, u32 seq)
742 {
743 __be32 *xdr_seq;
744 u32 maj_stat;
745 struct xdr_buf verf_data;
746 struct xdr_netobj mic;
747 __be32 *p;
748 struct kvec iov;
749 int err = -1;
750
751 svc_putnl(rqstp->rq_res.head, RPC_AUTH_GSS);
752 xdr_seq = kmalloc(4, GFP_KERNEL);
753 if (!xdr_seq)
754 return -1;
755 *xdr_seq = htonl(seq);
756
757 iov.iov_base = xdr_seq;
758 iov.iov_len = 4;
759 xdr_buf_from_iov(&iov, &verf_data);
760 p = rqstp->rq_res.head->iov_base + rqstp->rq_res.head->iov_len;
761 mic.data = (u8 *)(p + 1);
762 maj_stat = gss_get_mic(ctx_id, &verf_data, &mic);
763 if (maj_stat != GSS_S_COMPLETE)
764 goto out;
765 *p++ = htonl(mic.len);
766 memset((u8 *)p + mic.len, 0, round_up_to_quad(mic.len) - mic.len);
767 p += XDR_QUADLEN(mic.len);
768 if (!xdr_ressize_check(rqstp, p))
769 goto out;
770 err = 0;
771 out:
772 kfree(xdr_seq);
773 return err;
774 }
775
776 struct gss_domain {
777 struct auth_domain h;
778 u32 pseudoflavor;
779 };
780
781 static struct auth_domain *
782 find_gss_auth_domain(struct gss_ctx *ctx, u32 svc)
783 {
784 char *name;
785
786 name = gss_service_to_auth_domain_name(ctx->mech_type, svc);
787 if (!name)
788 return NULL;
789 return auth_domain_find(name);
790 }
791
792 static struct auth_ops svcauthops_gss;
793
794 u32 svcauth_gss_flavor(struct auth_domain *dom)
795 {
796 struct gss_domain *gd = container_of(dom, struct gss_domain, h);
797
798 return gd->pseudoflavor;
799 }
800
801 EXPORT_SYMBOL_GPL(svcauth_gss_flavor);
802
803 int
804 svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name)
805 {
806 struct gss_domain *new;
807 struct auth_domain *test;
808 int stat = -ENOMEM;
809
810 new = kmalloc(sizeof(*new), GFP_KERNEL);
811 if (!new)
812 goto out;
813 kref_init(&new->h.ref);
814 new->h.name = kstrdup(name, GFP_KERNEL);
815 if (!new->h.name)
816 goto out_free_dom;
817 new->h.flavour = &svcauthops_gss;
818 new->pseudoflavor = pseudoflavor;
819
820 stat = 0;
821 test = auth_domain_lookup(name, &new->h);
822 if (test != &new->h) {
823 auth_domain_put(test);
824 kfree(new->h.name);
825 goto out_free_dom;
826 }
827 return 0;
828
829 out_free_dom:
830 kfree(new);
831 out:
832 return stat;
833 }
834
835 EXPORT_SYMBOL_GPL(svcauth_gss_register_pseudoflavor);
836
837 static inline int
838 read_u32_from_xdr_buf(struct xdr_buf *buf, int base, u32 *obj)
839 {
840 __be32 raw;
841 int status;
842
843 status = read_bytes_from_xdr_buf(buf, base, &raw, sizeof(*obj));
844 if (status)
845 return status;
846 *obj = ntohl(raw);
847 return 0;
848 }
849
850
851
852
853
854
855 static int
856 unwrap_integ_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
857 {
858 int stat = -EINVAL;
859 u32 integ_len, maj_stat;
860 struct xdr_netobj mic;
861 struct xdr_buf integ_buf;
862
863
864
865
866
867
868
869 clear_bit(RQ_SPLICE_OK, &rqstp->rq_flags);
870
871
872 if (rqstp->rq_deferred)
873 return 0;
874
875 integ_len = svc_getnl(&buf->head[0]);
876 if (integ_len & 3)
877 return stat;
878 if (integ_len > buf->len)
879 return stat;
880 if (xdr_buf_subsegment(buf, &integ_buf, 0, integ_len)) {
881 WARN_ON_ONCE(1);
882 return stat;
883 }
884
885 if (read_u32_from_xdr_buf(buf, integ_len, &mic.len))
886 return stat;
887 if (mic.len > RPC_MAX_AUTH_SIZE)
888 return stat;
889 mic.data = kmalloc(mic.len, GFP_KERNEL);
890 if (!mic.data)
891 return stat;
892 if (read_bytes_from_xdr_buf(buf, integ_len + 4, mic.data, mic.len))
893 goto out;
894 maj_stat = gss_verify_mic(ctx, &integ_buf, &mic);
895 if (maj_stat != GSS_S_COMPLETE)
896 goto out;
897 if (svc_getnl(&buf->head[0]) != seq)
898 goto out;
899
900 xdr_buf_trim(buf, round_up_to_quad(mic.len) + 4);
901 stat = 0;
902 out:
903 kfree(mic.data);
904 return stat;
905 }
906
907 static inline int
908 total_buf_len(struct xdr_buf *buf)
909 {
910 return buf->head[0].iov_len + buf->page_len + buf->tail[0].iov_len;
911 }
912
913 static void
914 fix_priv_head(struct xdr_buf *buf, int pad)
915 {
916 if (buf->page_len == 0) {
917
918
919
920 buf->head[0].iov_len -= pad;
921 }
922 }
923
924 static int
925 unwrap_priv_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
926 {
927 u32 priv_len, maj_stat;
928 int pad, remaining_len, offset;
929
930 clear_bit(RQ_SPLICE_OK, &rqstp->rq_flags);
931
932 priv_len = svc_getnl(&buf->head[0]);
933 if (rqstp->rq_deferred) {
934
935
936 goto out_seq;
937 }
938
939
940
941 remaining_len = total_buf_len(buf);
942 if (priv_len > remaining_len)
943 return -EINVAL;
944 pad = remaining_len - priv_len;
945 buf->len -= pad;
946 fix_priv_head(buf, pad);
947
948 maj_stat = gss_unwrap(ctx, 0, priv_len, buf);
949 pad = priv_len - buf->len;
950 buf->len -= pad;
951
952
953
954
955
956
957 offset = buf->head[0].iov_len % 4;
958 if (offset) {
959 buf->buflen = RPCSVC_MAXPAYLOAD;
960 xdr_shift_buf(buf, offset);
961 fix_priv_head(buf, pad);
962 }
963 if (maj_stat != GSS_S_COMPLETE)
964 return -EINVAL;
965 out_seq:
966 if (svc_getnl(&buf->head[0]) != seq)
967 return -EINVAL;
968 return 0;
969 }
970
971 struct gss_svc_data {
972
973 struct rpc_gss_wire_cred clcred;
974
975
976 __be32 *verf_start;
977 struct rsc *rsci;
978 };
979
980 static int
981 svcauth_gss_set_client(struct svc_rqst *rqstp)
982 {
983 struct gss_svc_data *svcdata = rqstp->rq_auth_data;
984 struct rsc *rsci = svcdata->rsci;
985 struct rpc_gss_wire_cred *gc = &svcdata->clcred;
986 int stat;
987
988
989
990
991
992
993
994
995
996
997 rqstp->rq_gssclient = find_gss_auth_domain(rsci->mechctx, gc->gc_svc);
998 if (rqstp->rq_gssclient == NULL)
999 return SVC_DENIED;
1000 stat = svcauth_unix_set_client(rqstp);
1001 if (stat == SVC_DROP || stat == SVC_CLOSE)
1002 return stat;
1003 return SVC_OK;
1004 }
1005
1006 static inline int
1007 gss_write_init_verf(struct cache_detail *cd, struct svc_rqst *rqstp,
1008 struct xdr_netobj *out_handle, int *major_status)
1009 {
1010 struct rsc *rsci;
1011 int rc;
1012
1013 if (*major_status != GSS_S_COMPLETE)
1014 return gss_write_null_verf(rqstp);
1015 rsci = gss_svc_searchbyctx(cd, out_handle);
1016 if (rsci == NULL) {
1017 *major_status = GSS_S_NO_CONTEXT;
1018 return gss_write_null_verf(rqstp);
1019 }
1020 rc = gss_write_verf(rqstp, rsci->mechctx, GSS_SEQ_WIN);
1021 cache_put(&rsci->h, cd);
1022 return rc;
1023 }
1024
1025 static inline int
1026 gss_read_common_verf(struct rpc_gss_wire_cred *gc,
1027 struct kvec *argv, __be32 *authp,
1028 struct xdr_netobj *in_handle)
1029 {
1030
1031 *authp = rpc_autherr_badverf;
1032 if (argv->iov_len < 2 * 4)
1033 return SVC_DENIED;
1034 if (svc_getnl(argv) != RPC_AUTH_NULL)
1035 return SVC_DENIED;
1036 if (svc_getnl(argv) != 0)
1037 return SVC_DENIED;
1038
1039 *authp = rpc_autherr_badcred;
1040 if (gc->gc_proc == RPC_GSS_PROC_INIT && gc->gc_ctx.len != 0)
1041 return SVC_DENIED;
1042 if (dup_netobj(in_handle, &gc->gc_ctx))
1043 return SVC_CLOSE;
1044 *authp = rpc_autherr_badverf;
1045
1046 return 0;
1047 }
1048
1049 static inline int
1050 gss_read_verf(struct rpc_gss_wire_cred *gc,
1051 struct kvec *argv, __be32 *authp,
1052 struct xdr_netobj *in_handle,
1053 struct xdr_netobj *in_token)
1054 {
1055 struct xdr_netobj tmpobj;
1056 int res;
1057
1058 res = gss_read_common_verf(gc, argv, authp, in_handle);
1059 if (res)
1060 return res;
1061
1062 if (svc_safe_getnetobj(argv, &tmpobj)) {
1063 kfree(in_handle->data);
1064 return SVC_DENIED;
1065 }
1066 if (dup_netobj(in_token, &tmpobj)) {
1067 kfree(in_handle->data);
1068 return SVC_CLOSE;
1069 }
1070
1071 return 0;
1072 }
1073
1074 static void gss_free_in_token_pages(struct gssp_in_token *in_token)
1075 {
1076 u32 inlen;
1077 int i;
1078
1079 i = 0;
1080 inlen = in_token->page_len;
1081 while (inlen) {
1082 if (in_token->pages[i])
1083 put_page(in_token->pages[i]);
1084 inlen -= inlen > PAGE_SIZE ? PAGE_SIZE : inlen;
1085 }
1086
1087 kfree(in_token->pages);
1088 in_token->pages = NULL;
1089 }
1090
1091 static int gss_read_proxy_verf(struct svc_rqst *rqstp,
1092 struct rpc_gss_wire_cred *gc, __be32 *authp,
1093 struct xdr_netobj *in_handle,
1094 struct gssp_in_token *in_token)
1095 {
1096 struct kvec *argv = &rqstp->rq_arg.head[0];
1097 unsigned int page_base, length;
1098 int pages, i, res;
1099 size_t inlen;
1100
1101 res = gss_read_common_verf(gc, argv, authp, in_handle);
1102 if (res)
1103 return res;
1104
1105 inlen = svc_getnl(argv);
1106 if (inlen > (argv->iov_len + rqstp->rq_arg.page_len))
1107 return SVC_DENIED;
1108
1109 pages = DIV_ROUND_UP(inlen, PAGE_SIZE);
1110 in_token->pages = kcalloc(pages, sizeof(struct page *), GFP_KERNEL);
1111 if (!in_token->pages)
1112 return SVC_DENIED;
1113 in_token->page_base = 0;
1114 in_token->page_len = inlen;
1115 for (i = 0; i < pages; i++) {
1116 in_token->pages[i] = alloc_page(GFP_KERNEL);
1117 if (!in_token->pages[i]) {
1118 gss_free_in_token_pages(in_token);
1119 return SVC_DENIED;
1120 }
1121 }
1122
1123 length = min_t(unsigned int, inlen, argv->iov_len);
1124 memcpy(page_address(in_token->pages[0]), argv->iov_base, length);
1125 inlen -= length;
1126
1127 i = 1;
1128 page_base = rqstp->rq_arg.page_base;
1129 while (inlen) {
1130 length = min_t(unsigned int, inlen, PAGE_SIZE);
1131 memcpy(page_address(in_token->pages[i]),
1132 page_address(rqstp->rq_arg.pages[i]) + page_base,
1133 length);
1134
1135 inlen -= length;
1136 page_base = 0;
1137 i++;
1138 }
1139 return 0;
1140 }
1141
1142 static inline int
1143 gss_write_resv(struct kvec *resv, size_t size_limit,
1144 struct xdr_netobj *out_handle, struct xdr_netobj *out_token,
1145 int major_status, int minor_status)
1146 {
1147 if (resv->iov_len + 4 > size_limit)
1148 return -1;
1149 svc_putnl(resv, RPC_SUCCESS);
1150 if (svc_safe_putnetobj(resv, out_handle))
1151 return -1;
1152 if (resv->iov_len + 3 * 4 > size_limit)
1153 return -1;
1154 svc_putnl(resv, major_status);
1155 svc_putnl(resv, minor_status);
1156 svc_putnl(resv, GSS_SEQ_WIN);
1157 if (svc_safe_putnetobj(resv, out_token))
1158 return -1;
1159 return 0;
1160 }
1161
1162
1163
1164
1165
1166
1167
1168
1169 static int svcauth_gss_legacy_init(struct svc_rqst *rqstp,
1170 struct rpc_gss_wire_cred *gc, __be32 *authp)
1171 {
1172 struct kvec *argv = &rqstp->rq_arg.head[0];
1173 struct kvec *resv = &rqstp->rq_res.head[0];
1174 struct rsi *rsip, rsikey;
1175 int ret;
1176 struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
1177
1178 memset(&rsikey, 0, sizeof(rsikey));
1179 ret = gss_read_verf(gc, argv, authp,
1180 &rsikey.in_handle, &rsikey.in_token);
1181 if (ret)
1182 return ret;
1183
1184
1185 rsip = rsi_lookup(sn->rsi_cache, &rsikey);
1186 rsi_free(&rsikey);
1187 if (!rsip)
1188 return SVC_CLOSE;
1189 if (cache_check(sn->rsi_cache, &rsip->h, &rqstp->rq_chandle) < 0)
1190
1191 return SVC_CLOSE;
1192
1193 ret = SVC_CLOSE;
1194
1195 if (gss_write_init_verf(sn->rsc_cache, rqstp,
1196 &rsip->out_handle, &rsip->major_status))
1197 goto out;
1198 if (gss_write_resv(resv, PAGE_SIZE,
1199 &rsip->out_handle, &rsip->out_token,
1200 rsip->major_status, rsip->minor_status))
1201 goto out;
1202
1203 ret = SVC_COMPLETE;
1204 out:
1205 cache_put(&rsip->h, sn->rsi_cache);
1206 return ret;
1207 }
1208
1209 static int gss_proxy_save_rsc(struct cache_detail *cd,
1210 struct gssp_upcall_data *ud,
1211 uint64_t *handle)
1212 {
1213 struct rsc rsci, *rscp = NULL;
1214 static atomic64_t ctxhctr;
1215 long long ctxh;
1216 struct gss_api_mech *gm = NULL;
1217 time_t expiry;
1218 int status = -EINVAL;
1219
1220 memset(&rsci, 0, sizeof(rsci));
1221
1222 status = -ENOMEM;
1223
1224
1225 ctxh = atomic64_inc_return(&ctxhctr);
1226
1227
1228 *handle = ctxh;
1229
1230
1231 if (dup_to_netobj(&rsci.handle, (char *)handle, sizeof(uint64_t)))
1232 goto out;
1233 rscp = rsc_lookup(cd, &rsci);
1234 if (!rscp)
1235 goto out;
1236
1237
1238 if (!ud->found_creds) {
1239
1240
1241 dprintk("RPC: No creds found!\n");
1242 goto out;
1243 } else {
1244 struct timespec64 boot;
1245
1246
1247 rsci.cred = ud->creds;
1248 memset(&ud->creds, 0, sizeof(struct svc_cred));
1249
1250 status = -EOPNOTSUPP;
1251
1252 gm = gss_mech_get_by_OID(&ud->mech_oid);
1253 if (!gm)
1254 goto out;
1255 rsci.cred.cr_gss_mech = gm;
1256
1257 status = -EINVAL;
1258
1259 status = gss_import_sec_context(ud->out_handle.data,
1260 ud->out_handle.len,
1261 gm, &rsci.mechctx,
1262 &expiry, GFP_KERNEL);
1263 if (status)
1264 goto out;
1265
1266 getboottime64(&boot);
1267 expiry -= boot.tv_sec;
1268 }
1269
1270 rsci.h.expiry_time = expiry;
1271 rscp = rsc_update(cd, &rsci, rscp);
1272 status = 0;
1273 out:
1274 rsc_free(&rsci);
1275 if (rscp)
1276 cache_put(&rscp->h, cd);
1277 else
1278 status = -ENOMEM;
1279 return status;
1280 }
1281
1282 static int svcauth_gss_proxy_init(struct svc_rqst *rqstp,
1283 struct rpc_gss_wire_cred *gc, __be32 *authp)
1284 {
1285 struct kvec *resv = &rqstp->rq_res.head[0];
1286 struct xdr_netobj cli_handle;
1287 struct gssp_upcall_data ud;
1288 uint64_t handle;
1289 int status;
1290 int ret;
1291 struct net *net = SVC_NET(rqstp);
1292 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1293
1294 memset(&ud, 0, sizeof(ud));
1295 ret = gss_read_proxy_verf(rqstp, gc, authp,
1296 &ud.in_handle, &ud.in_token);
1297 if (ret)
1298 return ret;
1299
1300 ret = SVC_CLOSE;
1301
1302
1303 status = gssp_accept_sec_context_upcall(net, &ud);
1304 if (status)
1305 goto out;
1306
1307 dprintk("RPC: svcauth_gss: gss major status = %d "
1308 "minor status = %d\n",
1309 ud.major_status, ud.minor_status);
1310
1311 switch (ud.major_status) {
1312 case GSS_S_CONTINUE_NEEDED:
1313 cli_handle = ud.out_handle;
1314 break;
1315 case GSS_S_COMPLETE:
1316 status = gss_proxy_save_rsc(sn->rsc_cache, &ud, &handle);
1317 if (status) {
1318 pr_info("%s: gss_proxy_save_rsc failed (%d)\n",
1319 __func__, status);
1320 goto out;
1321 }
1322 cli_handle.data = (u8 *)&handle;
1323 cli_handle.len = sizeof(handle);
1324 break;
1325 default:
1326 ret = SVC_CLOSE;
1327 goto out;
1328 }
1329
1330
1331 if (gss_write_init_verf(sn->rsc_cache, rqstp,
1332 &cli_handle, &ud.major_status)) {
1333 pr_info("%s: gss_write_init_verf failed\n", __func__);
1334 goto out;
1335 }
1336 if (gss_write_resv(resv, PAGE_SIZE,
1337 &cli_handle, &ud.out_token,
1338 ud.major_status, ud.minor_status)) {
1339 pr_info("%s: gss_write_resv failed\n", __func__);
1340 goto out;
1341 }
1342
1343 ret = SVC_COMPLETE;
1344 out:
1345 gss_free_in_token_pages(&ud.in_token);
1346 gssp_free_upcall_data(&ud);
1347 return ret;
1348 }
1349
1350
1351
1352
1353
1354
1355 static int set_gss_proxy(struct net *net, int type)
1356 {
1357 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1358 int ret;
1359
1360 WARN_ON_ONCE(type != 0 && type != 1);
1361 ret = cmpxchg(&sn->use_gss_proxy, -1, type);
1362 if (ret != -1 && ret != type)
1363 return -EBUSY;
1364 return 0;
1365 }
1366
1367 static bool use_gss_proxy(struct net *net)
1368 {
1369 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1370
1371
1372 if (sn->use_gss_proxy == -1)
1373 set_gss_proxy(net, 0);
1374 return sn->use_gss_proxy;
1375 }
1376
1377 #ifdef CONFIG_PROC_FS
1378
1379 static ssize_t write_gssp(struct file *file, const char __user *buf,
1380 size_t count, loff_t *ppos)
1381 {
1382 struct net *net = PDE_DATA(file_inode(file));
1383 char tbuf[20];
1384 unsigned long i;
1385 int res;
1386
1387 if (*ppos || count > sizeof(tbuf)-1)
1388 return -EINVAL;
1389 if (copy_from_user(tbuf, buf, count))
1390 return -EFAULT;
1391
1392 tbuf[count] = 0;
1393 res = kstrtoul(tbuf, 0, &i);
1394 if (res)
1395 return res;
1396 if (i != 1)
1397 return -EINVAL;
1398 res = set_gssp_clnt(net);
1399 if (res)
1400 return res;
1401 res = set_gss_proxy(net, 1);
1402 if (res)
1403 return res;
1404 return count;
1405 }
1406
1407 static ssize_t read_gssp(struct file *file, char __user *buf,
1408 size_t count, loff_t *ppos)
1409 {
1410 struct net *net = PDE_DATA(file_inode(file));
1411 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1412 unsigned long p = *ppos;
1413 char tbuf[10];
1414 size_t len;
1415
1416 snprintf(tbuf, sizeof(tbuf), "%d\n", sn->use_gss_proxy);
1417 len = strlen(tbuf);
1418 if (p >= len)
1419 return 0;
1420 len -= p;
1421 if (len > count)
1422 len = count;
1423 if (copy_to_user(buf, (void *)(tbuf+p), len))
1424 return -EFAULT;
1425 *ppos += len;
1426 return len;
1427 }
1428
1429 static const struct file_operations use_gss_proxy_ops = {
1430 .open = nonseekable_open,
1431 .write = write_gssp,
1432 .read = read_gssp,
1433 };
1434
1435 static int create_use_gss_proxy_proc_entry(struct net *net)
1436 {
1437 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1438 struct proc_dir_entry **p = &sn->use_gssp_proc;
1439
1440 sn->use_gss_proxy = -1;
1441 *p = proc_create_data("use-gss-proxy", S_IFREG | 0600,
1442 sn->proc_net_rpc,
1443 &use_gss_proxy_ops, net);
1444 if (!*p)
1445 return -ENOMEM;
1446 init_gssp_clnt(sn);
1447 return 0;
1448 }
1449
1450 static void destroy_use_gss_proxy_proc_entry(struct net *net)
1451 {
1452 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1453
1454 if (sn->use_gssp_proc) {
1455 remove_proc_entry("use-gss-proxy", sn->proc_net_rpc);
1456 clear_gssp_clnt(sn);
1457 }
1458 }
1459 #else
1460
1461 static int create_use_gss_proxy_proc_entry(struct net *net)
1462 {
1463 return 0;
1464 }
1465
1466 static void destroy_use_gss_proxy_proc_entry(struct net *net) {}
1467
1468 #endif
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478 static int
1479 svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
1480 {
1481 struct kvec *argv = &rqstp->rq_arg.head[0];
1482 struct kvec *resv = &rqstp->rq_res.head[0];
1483 u32 crlen;
1484 struct gss_svc_data *svcdata = rqstp->rq_auth_data;
1485 struct rpc_gss_wire_cred *gc;
1486 struct rsc *rsci = NULL;
1487 __be32 *rpcstart;
1488 __be32 *reject_stat = resv->iov_base + resv->iov_len;
1489 int ret;
1490 struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
1491
1492 dprintk("RPC: svcauth_gss: argv->iov_len = %zd\n",
1493 argv->iov_len);
1494
1495 *authp = rpc_autherr_badcred;
1496 if (!svcdata)
1497 svcdata = kmalloc(sizeof(*svcdata), GFP_KERNEL);
1498 if (!svcdata)
1499 goto auth_err;
1500 rqstp->rq_auth_data = svcdata;
1501 svcdata->verf_start = NULL;
1502 svcdata->rsci = NULL;
1503 gc = &svcdata->clcred;
1504
1505
1506
1507
1508 rpcstart = argv->iov_base;
1509 rpcstart -= 7;
1510
1511
1512
1513
1514
1515
1516 if (argv->iov_len < 5 * 4)
1517 goto auth_err;
1518 crlen = svc_getnl(argv);
1519 if (svc_getnl(argv) != RPC_GSS_VERSION)
1520 goto auth_err;
1521 gc->gc_proc = svc_getnl(argv);
1522 gc->gc_seq = svc_getnl(argv);
1523 gc->gc_svc = svc_getnl(argv);
1524 if (svc_safe_getnetobj(argv, &gc->gc_ctx))
1525 goto auth_err;
1526 if (crlen != round_up_to_quad(gc->gc_ctx.len) + 5 * 4)
1527 goto auth_err;
1528
1529 if ((gc->gc_proc != RPC_GSS_PROC_DATA) && (rqstp->rq_proc != 0))
1530 goto auth_err;
1531
1532 *authp = rpc_autherr_badverf;
1533 switch (gc->gc_proc) {
1534 case RPC_GSS_PROC_INIT:
1535 case RPC_GSS_PROC_CONTINUE_INIT:
1536 if (use_gss_proxy(SVC_NET(rqstp)))
1537 return svcauth_gss_proxy_init(rqstp, gc, authp);
1538 else
1539 return svcauth_gss_legacy_init(rqstp, gc, authp);
1540 case RPC_GSS_PROC_DATA:
1541 case RPC_GSS_PROC_DESTROY:
1542
1543 *authp = rpcsec_gsserr_credproblem;
1544 rsci = gss_svc_searchbyctx(sn->rsc_cache, &gc->gc_ctx);
1545 if (!rsci)
1546 goto auth_err;
1547 switch (gss_verify_header(rqstp, rsci, rpcstart, gc, authp)) {
1548 case SVC_OK:
1549 break;
1550 case SVC_DENIED:
1551 goto auth_err;
1552 case SVC_DROP:
1553 goto drop;
1554 }
1555 break;
1556 default:
1557 *authp = rpc_autherr_rejectedcred;
1558 goto auth_err;
1559 }
1560
1561
1562 switch (gc->gc_proc) {
1563 case RPC_GSS_PROC_DESTROY:
1564 if (gss_write_verf(rqstp, rsci->mechctx, gc->gc_seq))
1565 goto auth_err;
1566
1567 sunrpc_cache_unhash(sn->rsc_cache, &rsci->h);
1568 if (resv->iov_len + 4 > PAGE_SIZE)
1569 goto drop;
1570 svc_putnl(resv, RPC_SUCCESS);
1571 goto complete;
1572 case RPC_GSS_PROC_DATA:
1573 *authp = rpcsec_gsserr_ctxproblem;
1574 svcdata->verf_start = resv->iov_base + resv->iov_len;
1575 if (gss_write_verf(rqstp, rsci->mechctx, gc->gc_seq))
1576 goto auth_err;
1577 rqstp->rq_cred = rsci->cred;
1578 get_group_info(rsci->cred.cr_group_info);
1579 *authp = rpc_autherr_badcred;
1580 switch (gc->gc_svc) {
1581 case RPC_GSS_SVC_NONE:
1582 break;
1583 case RPC_GSS_SVC_INTEGRITY:
1584
1585 svc_putnl(resv, 0);
1586 svc_putnl(resv, 0);
1587 if (unwrap_integ_data(rqstp, &rqstp->rq_arg,
1588 gc->gc_seq, rsci->mechctx))
1589 goto garbage_args;
1590 rqstp->rq_auth_slack = RPC_MAX_AUTH_SIZE;
1591 break;
1592 case RPC_GSS_SVC_PRIVACY:
1593
1594 svc_putnl(resv, 0);
1595 svc_putnl(resv, 0);
1596 if (unwrap_priv_data(rqstp, &rqstp->rq_arg,
1597 gc->gc_seq, rsci->mechctx))
1598 goto garbage_args;
1599 rqstp->rq_auth_slack = RPC_MAX_AUTH_SIZE * 2;
1600 break;
1601 default:
1602 goto auth_err;
1603 }
1604 svcdata->rsci = rsci;
1605 cache_get(&rsci->h);
1606 rqstp->rq_cred.cr_flavor = gss_svc_to_pseudoflavor(
1607 rsci->mechctx->mech_type,
1608 GSS_C_QOP_DEFAULT,
1609 gc->gc_svc);
1610 ret = SVC_OK;
1611 goto out;
1612 }
1613 garbage_args:
1614 ret = SVC_GARBAGE;
1615 goto out;
1616 auth_err:
1617
1618 xdr_ressize_check(rqstp, reject_stat);
1619 ret = SVC_DENIED;
1620 goto out;
1621 complete:
1622 ret = SVC_COMPLETE;
1623 goto out;
1624 drop:
1625 ret = SVC_CLOSE;
1626 out:
1627 if (rsci)
1628 cache_put(&rsci->h, sn->rsc_cache);
1629 return ret;
1630 }
1631
1632 static __be32 *
1633 svcauth_gss_prepare_to_wrap(struct xdr_buf *resbuf, struct gss_svc_data *gsd)
1634 {
1635 __be32 *p;
1636 u32 verf_len;
1637
1638 p = gsd->verf_start;
1639 gsd->verf_start = NULL;
1640
1641
1642 if (*(p-1) != rpc_success)
1643 return NULL;
1644
1645 p += 1;
1646 verf_len = ntohl(*p++);
1647 p += XDR_QUADLEN(verf_len);
1648
1649 memcpy(p, p + 2, 4);
1650
1651 if (*p != rpc_success) {
1652 resbuf->head[0].iov_len -= 2 * 4;
1653 return NULL;
1654 }
1655 p++;
1656 return p;
1657 }
1658
1659 static inline int
1660 svcauth_gss_wrap_resp_integ(struct svc_rqst *rqstp)
1661 {
1662 struct gss_svc_data *gsd = (struct gss_svc_data *)rqstp->rq_auth_data;
1663 struct rpc_gss_wire_cred *gc = &gsd->clcred;
1664 struct xdr_buf *resbuf = &rqstp->rq_res;
1665 struct xdr_buf integ_buf;
1666 struct xdr_netobj mic;
1667 struct kvec *resv;
1668 __be32 *p;
1669 int integ_offset, integ_len;
1670 int stat = -EINVAL;
1671
1672 p = svcauth_gss_prepare_to_wrap(resbuf, gsd);
1673 if (p == NULL)
1674 goto out;
1675 integ_offset = (u8 *)(p + 1) - (u8 *)resbuf->head[0].iov_base;
1676 integ_len = resbuf->len - integ_offset;
1677 BUG_ON(integ_len % 4);
1678 *p++ = htonl(integ_len);
1679 *p++ = htonl(gc->gc_seq);
1680 if (xdr_buf_subsegment(resbuf, &integ_buf, integ_offset, integ_len)) {
1681 WARN_ON_ONCE(1);
1682 goto out_err;
1683 }
1684 if (resbuf->tail[0].iov_base == NULL) {
1685 if (resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE > PAGE_SIZE)
1686 goto out_err;
1687 resbuf->tail[0].iov_base = resbuf->head[0].iov_base
1688 + resbuf->head[0].iov_len;
1689 resbuf->tail[0].iov_len = 0;
1690 }
1691 resv = &resbuf->tail[0];
1692 mic.data = (u8 *)resv->iov_base + resv->iov_len + 4;
1693 if (gss_get_mic(gsd->rsci->mechctx, &integ_buf, &mic))
1694 goto out_err;
1695 svc_putnl(resv, mic.len);
1696 memset(mic.data + mic.len, 0,
1697 round_up_to_quad(mic.len) - mic.len);
1698 resv->iov_len += XDR_QUADLEN(mic.len) << 2;
1699
1700 resbuf->len += XDR_QUADLEN(mic.len) << 2;
1701 BUG_ON(resv->iov_len > PAGE_SIZE);
1702 out:
1703 stat = 0;
1704 out_err:
1705 return stat;
1706 }
1707
1708 static inline int
1709 svcauth_gss_wrap_resp_priv(struct svc_rqst *rqstp)
1710 {
1711 struct gss_svc_data *gsd = (struct gss_svc_data *)rqstp->rq_auth_data;
1712 struct rpc_gss_wire_cred *gc = &gsd->clcred;
1713 struct xdr_buf *resbuf = &rqstp->rq_res;
1714 struct page **inpages = NULL;
1715 __be32 *p, *len;
1716 int offset;
1717 int pad;
1718
1719 p = svcauth_gss_prepare_to_wrap(resbuf, gsd);
1720 if (p == NULL)
1721 return 0;
1722 len = p++;
1723 offset = (u8 *)p - (u8 *)resbuf->head[0].iov_base;
1724 *p++ = htonl(gc->gc_seq);
1725 inpages = resbuf->pages;
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736 if (resbuf->tail[0].iov_base) {
1737 BUG_ON(resbuf->tail[0].iov_base >= resbuf->head[0].iov_base
1738 + PAGE_SIZE);
1739 BUG_ON(resbuf->tail[0].iov_base < resbuf->head[0].iov_base);
1740 if (resbuf->tail[0].iov_len + resbuf->head[0].iov_len
1741 + 2 * RPC_MAX_AUTH_SIZE > PAGE_SIZE)
1742 return -ENOMEM;
1743 memmove(resbuf->tail[0].iov_base + RPC_MAX_AUTH_SIZE,
1744 resbuf->tail[0].iov_base,
1745 resbuf->tail[0].iov_len);
1746 resbuf->tail[0].iov_base += RPC_MAX_AUTH_SIZE;
1747 }
1748
1749
1750
1751
1752
1753
1754
1755 if (resbuf->tail[0].iov_base == NULL) {
1756 if (resbuf->head[0].iov_len + 2*RPC_MAX_AUTH_SIZE > PAGE_SIZE)
1757 return -ENOMEM;
1758 resbuf->tail[0].iov_base = resbuf->head[0].iov_base
1759 + resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE;
1760 resbuf->tail[0].iov_len = 0;
1761 }
1762 if (gss_wrap(gsd->rsci->mechctx, offset, resbuf, inpages))
1763 return -ENOMEM;
1764 *len = htonl(resbuf->len - offset);
1765 pad = 3 - ((resbuf->len - offset - 1)&3);
1766 p = (__be32 *)(resbuf->tail[0].iov_base + resbuf->tail[0].iov_len);
1767 memset(p, 0, pad);
1768 resbuf->tail[0].iov_len += pad;
1769 resbuf->len += pad;
1770 return 0;
1771 }
1772
1773 static int
1774 svcauth_gss_release(struct svc_rqst *rqstp)
1775 {
1776 struct gss_svc_data *gsd = (struct gss_svc_data *)rqstp->rq_auth_data;
1777 struct rpc_gss_wire_cred *gc = &gsd->clcred;
1778 struct xdr_buf *resbuf = &rqstp->rq_res;
1779 int stat = -EINVAL;
1780 struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
1781
1782 if (gc->gc_proc != RPC_GSS_PROC_DATA)
1783 goto out;
1784
1785 if (gsd->verf_start == NULL)
1786 goto out;
1787
1788
1789
1790 resbuf->len = total_buf_len(resbuf);
1791 switch (gc->gc_svc) {
1792 case RPC_GSS_SVC_NONE:
1793 break;
1794 case RPC_GSS_SVC_INTEGRITY:
1795 stat = svcauth_gss_wrap_resp_integ(rqstp);
1796 if (stat)
1797 goto out_err;
1798 break;
1799 case RPC_GSS_SVC_PRIVACY:
1800 stat = svcauth_gss_wrap_resp_priv(rqstp);
1801 if (stat)
1802 goto out_err;
1803 break;
1804
1805
1806
1807
1808 }
1809
1810 out:
1811 stat = 0;
1812 out_err:
1813 if (rqstp->rq_client)
1814 auth_domain_put(rqstp->rq_client);
1815 rqstp->rq_client = NULL;
1816 if (rqstp->rq_gssclient)
1817 auth_domain_put(rqstp->rq_gssclient);
1818 rqstp->rq_gssclient = NULL;
1819 if (rqstp->rq_cred.cr_group_info)
1820 put_group_info(rqstp->rq_cred.cr_group_info);
1821 rqstp->rq_cred.cr_group_info = NULL;
1822 if (gsd->rsci)
1823 cache_put(&gsd->rsci->h, sn->rsc_cache);
1824 gsd->rsci = NULL;
1825
1826 return stat;
1827 }
1828
1829 static void
1830 svcauth_gss_domain_release_rcu(struct rcu_head *head)
1831 {
1832 struct auth_domain *dom = container_of(head, struct auth_domain, rcu_head);
1833 struct gss_domain *gd = container_of(dom, struct gss_domain, h);
1834
1835 kfree(dom->name);
1836 kfree(gd);
1837 }
1838
1839 static void
1840 svcauth_gss_domain_release(struct auth_domain *dom)
1841 {
1842 call_rcu(&dom->rcu_head, svcauth_gss_domain_release_rcu);
1843 }
1844
1845 static struct auth_ops svcauthops_gss = {
1846 .name = "rpcsec_gss",
1847 .owner = THIS_MODULE,
1848 .flavour = RPC_AUTH_GSS,
1849 .accept = svcauth_gss_accept,
1850 .release = svcauth_gss_release,
1851 .domain_release = svcauth_gss_domain_release,
1852 .set_client = svcauth_gss_set_client,
1853 };
1854
1855 static int rsi_cache_create_net(struct net *net)
1856 {
1857 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1858 struct cache_detail *cd;
1859 int err;
1860
1861 cd = cache_create_net(&rsi_cache_template, net);
1862 if (IS_ERR(cd))
1863 return PTR_ERR(cd);
1864 err = cache_register_net(cd, net);
1865 if (err) {
1866 cache_destroy_net(cd, net);
1867 return err;
1868 }
1869 sn->rsi_cache = cd;
1870 return 0;
1871 }
1872
1873 static void rsi_cache_destroy_net(struct net *net)
1874 {
1875 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1876 struct cache_detail *cd = sn->rsi_cache;
1877
1878 sn->rsi_cache = NULL;
1879 cache_purge(cd);
1880 cache_unregister_net(cd, net);
1881 cache_destroy_net(cd, net);
1882 }
1883
1884 static int rsc_cache_create_net(struct net *net)
1885 {
1886 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1887 struct cache_detail *cd;
1888 int err;
1889
1890 cd = cache_create_net(&rsc_cache_template, net);
1891 if (IS_ERR(cd))
1892 return PTR_ERR(cd);
1893 err = cache_register_net(cd, net);
1894 if (err) {
1895 cache_destroy_net(cd, net);
1896 return err;
1897 }
1898 sn->rsc_cache = cd;
1899 return 0;
1900 }
1901
1902 static void rsc_cache_destroy_net(struct net *net)
1903 {
1904 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1905 struct cache_detail *cd = sn->rsc_cache;
1906
1907 sn->rsc_cache = NULL;
1908 cache_purge(cd);
1909 cache_unregister_net(cd, net);
1910 cache_destroy_net(cd, net);
1911 }
1912
1913 int
1914 gss_svc_init_net(struct net *net)
1915 {
1916 int rv;
1917
1918 rv = rsc_cache_create_net(net);
1919 if (rv)
1920 return rv;
1921 rv = rsi_cache_create_net(net);
1922 if (rv)
1923 goto out1;
1924 rv = create_use_gss_proxy_proc_entry(net);
1925 if (rv)
1926 goto out2;
1927 return 0;
1928 out2:
1929 destroy_use_gss_proxy_proc_entry(net);
1930 out1:
1931 rsc_cache_destroy_net(net);
1932 return rv;
1933 }
1934
1935 void
1936 gss_svc_shutdown_net(struct net *net)
1937 {
1938 destroy_use_gss_proxy_proc_entry(net);
1939 rsi_cache_destroy_net(net);
1940 rsc_cache_destroy_net(net);
1941 }
1942
1943 int
1944 gss_svc_init(void)
1945 {
1946 return svc_auth_register(RPC_AUTH_GSS, &svcauthops_gss);
1947 }
1948
1949 void
1950 gss_svc_shutdown(void)
1951 {
1952 svc_auth_unregister(RPC_AUTH_GSS);
1953 }