1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40#include <linux/types.h>
41#include <linux/module.h>
42#include <linux/pagemap.h>
43
44#include <linux/sunrpc/auth_gss.h>
45#include <linux/sunrpc/gss_err.h>
46#include <linux/sunrpc/svcauth.h>
47#include <linux/sunrpc/svcauth_gss.h>
48#include <linux/sunrpc/cache.h>
49
50#ifdef RPC_DEBUG
51# define RPCDBG_FACILITY RPCDBG_AUTH
52#endif
53
54
55
56
57
58
59
60
61
62static int netobj_equal(struct xdr_netobj *a, struct xdr_netobj *b)
63{
64 return a->len == b->len && 0 == memcmp(a->data, b->data, a->len);
65}
66
67#define RSI_HASHBITS 6
68#define RSI_HASHMAX (1<<RSI_HASHBITS)
69#define RSI_HASHMASK (RSI_HASHMAX-1)
70
71struct rsi {
72 struct cache_head h;
73 struct xdr_netobj in_handle, in_token;
74 struct xdr_netobj out_handle, out_token;
75 int major_status, minor_status;
76};
77
78static struct cache_head *rsi_table[RSI_HASHMAX];
79static struct cache_detail rsi_cache;
80static struct rsi *rsi_update(struct rsi *new, struct rsi *old);
81static struct rsi *rsi_lookup(struct rsi *item);
82
83static void rsi_free(struct rsi *rsii)
84{
85 kfree(rsii->in_handle.data);
86 kfree(rsii->in_token.data);
87 kfree(rsii->out_handle.data);
88 kfree(rsii->out_token.data);
89}
90
91static void rsi_put(struct kref *ref)
92{
93 struct rsi *rsii = container_of(ref, struct rsi, h.ref);
94 rsi_free(rsii);
95 kfree(rsii);
96}
97
98static inline int rsi_hash(struct rsi *item)
99{
100 return hash_mem(item->in_handle.data, item->in_handle.len, RSI_HASHBITS)
101 ^ hash_mem(item->in_token.data, item->in_token.len, RSI_HASHBITS);
102}
103
104static int rsi_match(struct cache_head *a, struct cache_head *b)
105{
106 struct rsi *item = container_of(a, struct rsi, h);
107 struct rsi *tmp = container_of(b, struct rsi, h);
108 return netobj_equal(&item->in_handle, &tmp->in_handle)
109 && netobj_equal(&item->in_token, &tmp->in_token);
110}
111
112static int dup_to_netobj(struct xdr_netobj *dst, char *src, int len)
113{
114 dst->len = len;
115 dst->data = (len ? kmemdup(src, len, GFP_KERNEL) : NULL);
116 if (len && !dst->data)
117 return -ENOMEM;
118 return 0;
119}
120
121static inline int dup_netobj(struct xdr_netobj *dst, struct xdr_netobj *src)
122{
123 return dup_to_netobj(dst, src->data, src->len);
124}
125
126static void rsi_init(struct cache_head *cnew, struct cache_head *citem)
127{
128 struct rsi *new = container_of(cnew, struct rsi, h);
129 struct rsi *item = container_of(citem, struct rsi, h);
130
131 new->out_handle.data = NULL;
132 new->out_handle.len = 0;
133 new->out_token.data = NULL;
134 new->out_token.len = 0;
135 new->in_handle.len = item->in_handle.len;
136 item->in_handle.len = 0;
137 new->in_token.len = item->in_token.len;
138 item->in_token.len = 0;
139 new->in_handle.data = item->in_handle.data;
140 item->in_handle.data = NULL;
141 new->in_token.data = item->in_token.data;
142 item->in_token.data = NULL;
143}
144
145static void update_rsi(struct cache_head *cnew, struct cache_head *citem)
146{
147 struct rsi *new = container_of(cnew, struct rsi, h);
148 struct rsi *item = container_of(citem, struct rsi, h);
149
150 BUG_ON(new->out_handle.data || new->out_token.data);
151 new->out_handle.len = item->out_handle.len;
152 item->out_handle.len = 0;
153 new->out_token.len = item->out_token.len;
154 item->out_token.len = 0;
155 new->out_handle.data = item->out_handle.data;
156 item->out_handle.data = NULL;
157 new->out_token.data = item->out_token.data;
158 item->out_token.data = NULL;
159
160 new->major_status = item->major_status;
161 new->minor_status = item->minor_status;
162}
163
164static struct cache_head *rsi_alloc(void)
165{
166 struct rsi *rsii = kmalloc(sizeof(*rsii), GFP_KERNEL);
167 if (rsii)
168 return &rsii->h;
169 else
170 return NULL;
171}
172
173static void rsi_request(struct cache_detail *cd,
174 struct cache_head *h,
175 char **bpp, int *blen)
176{
177 struct rsi *rsii = container_of(h, struct rsi, h);
178
179 qword_addhex(bpp, blen, rsii->in_handle.data, rsii->in_handle.len);
180 qword_addhex(bpp, blen, rsii->in_token.data, rsii->in_token.len);
181 (*bpp)[-1] = '\n';
182}
183
184static int rsi_upcall(struct cache_detail *cd, struct cache_head *h)
185{
186 return sunrpc_cache_pipe_upcall(cd, h, rsi_request);
187}
188
189
190static int rsi_parse(struct cache_detail *cd,
191 char *mesg, int mlen)
192{
193
194 char *buf = mesg;
195 char *ep;
196 int len;
197 struct rsi rsii, *rsip = NULL;
198 time_t expiry;
199 int status = -EINVAL;
200
201 memset(&rsii, 0, sizeof(rsii));
202
203 len = qword_get(&mesg, buf, mlen);
204 if (len < 0)
205 goto out;
206 status = -ENOMEM;
207 if (dup_to_netobj(&rsii.in_handle, buf, len))
208 goto out;
209
210
211 len = qword_get(&mesg, buf, mlen);
212 status = -EINVAL;
213 if (len < 0)
214 goto out;
215 status = -ENOMEM;
216 if (dup_to_netobj(&rsii.in_token, buf, len))
217 goto out;
218
219 rsip = rsi_lookup(&rsii);
220 if (!rsip)
221 goto out;
222
223 rsii.h.flags = 0;
224
225 expiry = get_expiry(&mesg);
226 status = -EINVAL;
227 if (expiry == 0)
228 goto out;
229
230
231 len = qword_get(&mesg, buf, mlen);
232 if (len <= 0)
233 goto out;
234 rsii.major_status = simple_strtoul(buf, &ep, 10);
235 if (*ep)
236 goto out;
237 len = qword_get(&mesg, buf, mlen);
238 if (len <= 0)
239 goto out;
240 rsii.minor_status = simple_strtoul(buf, &ep, 10);
241 if (*ep)
242 goto out;
243
244
245 len = qword_get(&mesg, buf, mlen);
246 if (len < 0)
247 goto out;
248 status = -ENOMEM;
249 if (dup_to_netobj(&rsii.out_handle, buf, len))
250 goto out;
251
252
253 len = qword_get(&mesg, buf, mlen);
254 status = -EINVAL;
255 if (len < 0)
256 goto out;
257 status = -ENOMEM;
258 if (dup_to_netobj(&rsii.out_token, buf, len))
259 goto out;
260 rsii.h.expiry_time = expiry;
261 rsip = rsi_update(&rsii, rsip);
262 status = 0;
263out:
264 rsi_free(&rsii);
265 if (rsip)
266 cache_put(&rsip->h, &rsi_cache);
267 else
268 status = -ENOMEM;
269 return status;
270}
271
272static struct cache_detail rsi_cache = {
273 .owner = THIS_MODULE,
274 .hash_size = RSI_HASHMAX,
275 .hash_table = rsi_table,
276 .name = "auth.rpcsec.init",
277 .cache_put = rsi_put,
278 .cache_upcall = rsi_upcall,
279 .cache_parse = rsi_parse,
280 .match = rsi_match,
281 .init = rsi_init,
282 .update = update_rsi,
283 .alloc = rsi_alloc,
284};
285
286static struct rsi *rsi_lookup(struct rsi *item)
287{
288 struct cache_head *ch;
289 int hash = rsi_hash(item);
290
291 ch = sunrpc_cache_lookup(&rsi_cache, &item->h, hash);
292 if (ch)
293 return container_of(ch, struct rsi, h);
294 else
295 return NULL;
296}
297
298static struct rsi *rsi_update(struct rsi *new, struct rsi *old)
299{
300 struct cache_head *ch;
301 int hash = rsi_hash(new);
302
303 ch = sunrpc_cache_update(&rsi_cache, &new->h,
304 &old->h, hash);
305 if (ch)
306 return container_of(ch, struct rsi, h);
307 else
308 return NULL;
309}
310
311
312
313
314
315
316
317
318
319#define RSC_HASHBITS 10
320#define RSC_HASHMAX (1<<RSC_HASHBITS)
321#define RSC_HASHMASK (RSC_HASHMAX-1)
322
323#define GSS_SEQ_WIN 128
324
325struct gss_svc_seq_data {
326
327 int sd_max;
328
329
330 unsigned long sd_win[GSS_SEQ_WIN/BITS_PER_LONG];
331 spinlock_t sd_lock;
332};
333
334struct rsc {
335 struct cache_head h;
336 struct xdr_netobj handle;
337 struct svc_cred cred;
338 struct gss_svc_seq_data seqdata;
339 struct gss_ctx *mechctx;
340 char *client_name;
341};
342
343static struct cache_head *rsc_table[RSC_HASHMAX];
344static struct cache_detail rsc_cache;
345static struct rsc *rsc_update(struct rsc *new, struct rsc *old);
346static struct rsc *rsc_lookup(struct rsc *item);
347
348static void rsc_free(struct rsc *rsci)
349{
350 kfree(rsci->handle.data);
351 if (rsci->mechctx)
352 gss_delete_sec_context(&rsci->mechctx);
353 if (rsci->cred.cr_group_info)
354 put_group_info(rsci->cred.cr_group_info);
355 kfree(rsci->client_name);
356}
357
358static void rsc_put(struct kref *ref)
359{
360 struct rsc *rsci = container_of(ref, struct rsc, h.ref);
361
362 rsc_free(rsci);
363 kfree(rsci);
364}
365
366static inline int
367rsc_hash(struct rsc *rsci)
368{
369 return hash_mem(rsci->handle.data, rsci->handle.len, RSC_HASHBITS);
370}
371
372static int
373rsc_match(struct cache_head *a, struct cache_head *b)
374{
375 struct rsc *new = container_of(a, struct rsc, h);
376 struct rsc *tmp = container_of(b, struct rsc, h);
377
378 return netobj_equal(&new->handle, &tmp->handle);
379}
380
381static void
382rsc_init(struct cache_head *cnew, struct cache_head *ctmp)
383{
384 struct rsc *new = container_of(cnew, struct rsc, h);
385 struct rsc *tmp = container_of(ctmp, struct rsc, h);
386
387 new->handle.len = tmp->handle.len;
388 tmp->handle.len = 0;
389 new->handle.data = tmp->handle.data;
390 tmp->handle.data = NULL;
391 new->mechctx = NULL;
392 new->cred.cr_group_info = NULL;
393 new->client_name = NULL;
394}
395
396static void
397update_rsc(struct cache_head *cnew, struct cache_head *ctmp)
398{
399 struct rsc *new = container_of(cnew, struct rsc, h);
400 struct rsc *tmp = container_of(ctmp, struct rsc, h);
401
402 new->mechctx = tmp->mechctx;
403 tmp->mechctx = NULL;
404 memset(&new->seqdata, 0, sizeof(new->seqdata));
405 spin_lock_init(&new->seqdata.sd_lock);
406 new->cred = tmp->cred;
407 tmp->cred.cr_group_info = NULL;
408 new->client_name = tmp->client_name;
409 tmp->client_name = NULL;
410}
411
412static struct cache_head *
413rsc_alloc(void)
414{
415 struct rsc *rsci = kmalloc(sizeof(*rsci), GFP_KERNEL);
416 if (rsci)
417 return &rsci->h;
418 else
419 return NULL;
420}
421
422static int rsc_parse(struct cache_detail *cd,
423 char *mesg, int mlen)
424{
425
426 char *buf = mesg;
427 int len, rv;
428 struct rsc rsci, *rscp = NULL;
429 time_t expiry;
430 int status = -EINVAL;
431 struct gss_api_mech *gm = NULL;
432
433 memset(&rsci, 0, sizeof(rsci));
434
435 len = qword_get(&mesg, buf, mlen);
436 if (len < 0) goto out;
437 status = -ENOMEM;
438 if (dup_to_netobj(&rsci.handle, buf, len))
439 goto out;
440
441 rsci.h.flags = 0;
442
443 expiry = get_expiry(&mesg);
444 status = -EINVAL;
445 if (expiry == 0)
446 goto out;
447
448 rscp = rsc_lookup(&rsci);
449 if (!rscp)
450 goto out;
451
452
453 rv = get_int(&mesg, &rsci.cred.cr_uid);
454 if (rv == -EINVAL)
455 goto out;
456 if (rv == -ENOENT)
457 set_bit(CACHE_NEGATIVE, &rsci.h.flags);
458 else {
459 int N, i;
460
461
462 if (get_int(&mesg, &rsci.cred.cr_gid))
463 goto out;
464
465
466 if (get_int(&mesg, &N))
467 goto out;
468 status = -ENOMEM;
469 rsci.cred.cr_group_info = groups_alloc(N);
470 if (rsci.cred.cr_group_info == NULL)
471 goto out;
472
473
474 status = -EINVAL;
475 for (i=0; i<N; i++) {
476 gid_t gid;
477 if (get_int(&mesg, &gid))
478 goto out;
479 GROUP_AT(rsci.cred.cr_group_info, i) = gid;
480 }
481
482
483 len = qword_get(&mesg, buf, mlen);
484 if (len < 0)
485 goto out;
486 gm = gss_mech_get_by_name(buf);
487 status = -EOPNOTSUPP;
488 if (!gm)
489 goto out;
490
491 status = -EINVAL;
492
493 len = qword_get(&mesg, buf, mlen);
494 if (len < 0)
495 goto out;
496 status = gss_import_sec_context(buf, len, gm, &rsci.mechctx);
497 if (status)
498 goto out;
499
500
501 len = qword_get(&mesg, buf, mlen);
502 if (len > 0) {
503 rsci.client_name = kstrdup(buf, GFP_KERNEL);
504 if (!rsci.client_name)
505 goto out;
506 }
507
508 }
509 rsci.h.expiry_time = expiry;
510 rscp = rsc_update(&rsci, rscp);
511 status = 0;
512out:
513 gss_mech_put(gm);
514 rsc_free(&rsci);
515 if (rscp)
516 cache_put(&rscp->h, &rsc_cache);
517 else
518 status = -ENOMEM;
519 return status;
520}
521
522static struct cache_detail rsc_cache = {
523 .owner = THIS_MODULE,
524 .hash_size = RSC_HASHMAX,
525 .hash_table = rsc_table,
526 .name = "auth.rpcsec.context",
527 .cache_put = rsc_put,
528 .cache_parse = rsc_parse,
529 .match = rsc_match,
530 .init = rsc_init,
531 .update = update_rsc,
532 .alloc = rsc_alloc,
533};
534
535static struct rsc *rsc_lookup(struct rsc *item)
536{
537 struct cache_head *ch;
538 int hash = rsc_hash(item);
539
540 ch = sunrpc_cache_lookup(&rsc_cache, &item->h, hash);
541 if (ch)
542 return container_of(ch, struct rsc, h);
543 else
544 return NULL;
545}
546
547static struct rsc *rsc_update(struct rsc *new, struct rsc *old)
548{
549 struct cache_head *ch;
550 int hash = rsc_hash(new);
551
552 ch = sunrpc_cache_update(&rsc_cache, &new->h,
553 &old->h, hash);
554 if (ch)
555 return container_of(ch, struct rsc, h);
556 else
557 return NULL;
558}
559
560
561static struct rsc *
562gss_svc_searchbyctx(struct xdr_netobj *handle)
563{
564 struct rsc rsci;
565 struct rsc *found;
566
567 memset(&rsci, 0, sizeof(rsci));
568 if (dup_to_netobj(&rsci.handle, handle->data, handle->len))
569 return NULL;
570 found = rsc_lookup(&rsci);
571 rsc_free(&rsci);
572 if (!found)
573 return NULL;
574 if (cache_check(&rsc_cache, &found->h, NULL))
575 return NULL;
576 return found;
577}
578
579
580static int
581gss_check_seq_num(struct rsc *rsci, int seq_num)
582{
583 struct gss_svc_seq_data *sd = &rsci->seqdata;
584
585 spin_lock(&sd->sd_lock);
586 if (seq_num > sd->sd_max) {
587 if (seq_num >= sd->sd_max + GSS_SEQ_WIN) {
588 memset(sd->sd_win,0,sizeof(sd->sd_win));
589 sd->sd_max = seq_num;
590 } else while (sd->sd_max < seq_num) {
591 sd->sd_max++;
592 __clear_bit(sd->sd_max % GSS_SEQ_WIN, sd->sd_win);
593 }
594 __set_bit(seq_num % GSS_SEQ_WIN, sd->sd_win);
595 goto ok;
596 } else if (seq_num <= sd->sd_max - GSS_SEQ_WIN) {
597 goto drop;
598 }
599
600 if (__test_and_set_bit(seq_num % GSS_SEQ_WIN, sd->sd_win))
601 goto drop;
602ok:
603 spin_unlock(&sd->sd_lock);
604 return 1;
605drop:
606 spin_unlock(&sd->sd_lock);
607 return 0;
608}
609
610static inline u32 round_up_to_quad(u32 i)
611{
612 return (i + 3 ) & ~3;
613}
614
615static inline int
616svc_safe_getnetobj(struct kvec *argv, struct xdr_netobj *o)
617{
618 int l;
619
620 if (argv->iov_len < 4)
621 return -1;
622 o->len = svc_getnl(argv);
623 l = round_up_to_quad(o->len);
624 if (argv->iov_len < l)
625 return -1;
626 o->data = argv->iov_base;
627 argv->iov_base += l;
628 argv->iov_len -= l;
629 return 0;
630}
631
632static inline int
633svc_safe_putnetobj(struct kvec *resv, struct xdr_netobj *o)
634{
635 u8 *p;
636
637 if (resv->iov_len + 4 > PAGE_SIZE)
638 return -1;
639 svc_putnl(resv, o->len);
640 p = resv->iov_base + resv->iov_len;
641 resv->iov_len += round_up_to_quad(o->len);
642 if (resv->iov_len > PAGE_SIZE)
643 return -1;
644 memcpy(p, o->data, o->len);
645 memset(p + o->len, 0, round_up_to_quad(o->len) - o->len);
646 return 0;
647}
648
649
650
651
652
653
654static int
655gss_verify_header(struct svc_rqst *rqstp, struct rsc *rsci,
656 __be32 *rpcstart, struct rpc_gss_wire_cred *gc, __be32 *authp)
657{
658 struct gss_ctx *ctx_id = rsci->mechctx;
659 struct xdr_buf rpchdr;
660 struct xdr_netobj checksum;
661 u32 flavor = 0;
662 struct kvec *argv = &rqstp->rq_arg.head[0];
663 struct kvec iov;
664
665
666 iov.iov_base = rpcstart;
667 iov.iov_len = (u8 *)argv->iov_base - (u8 *)rpcstart;
668 xdr_buf_from_iov(&iov, &rpchdr);
669
670 *authp = rpc_autherr_badverf;
671 if (argv->iov_len < 4)
672 return SVC_DENIED;
673 flavor = svc_getnl(argv);
674 if (flavor != RPC_AUTH_GSS)
675 return SVC_DENIED;
676 if (svc_safe_getnetobj(argv, &checksum))
677 return SVC_DENIED;
678
679 if (rqstp->rq_deferred)
680 return SVC_OK;
681 if (gss_verify_mic(ctx_id, &rpchdr, &checksum) != GSS_S_COMPLETE) {
682 *authp = rpcsec_gsserr_credproblem;
683 return SVC_DENIED;
684 }
685
686 if (gc->gc_seq > MAXSEQ) {
687 dprintk("RPC: svcauth_gss: discarding request with "
688 "large sequence number %d\n", gc->gc_seq);
689 *authp = rpcsec_gsserr_ctxproblem;
690 return SVC_DENIED;
691 }
692 if (!gss_check_seq_num(rsci, gc->gc_seq)) {
693 dprintk("RPC: svcauth_gss: discarding request with "
694 "old sequence number %d\n", gc->gc_seq);
695 return SVC_DROP;
696 }
697 return SVC_OK;
698}
699
700static int
701gss_write_null_verf(struct svc_rqst *rqstp)
702{
703 __be32 *p;
704
705 svc_putnl(rqstp->rq_res.head, RPC_AUTH_NULL);
706 p = rqstp->rq_res.head->iov_base + rqstp->rq_res.head->iov_len;
707
708 *p++ = 0;
709 if (!xdr_ressize_check(rqstp, p))
710 return -1;
711 return 0;
712}
713
714static int
715gss_write_verf(struct svc_rqst *rqstp, struct gss_ctx *ctx_id, u32 seq)
716{
717 __be32 xdr_seq;
718 u32 maj_stat;
719 struct xdr_buf verf_data;
720 struct xdr_netobj mic;
721 __be32 *p;
722 struct kvec iov;
723
724 svc_putnl(rqstp->rq_res.head, RPC_AUTH_GSS);
725 xdr_seq = htonl(seq);
726
727 iov.iov_base = &xdr_seq;
728 iov.iov_len = sizeof(xdr_seq);
729 xdr_buf_from_iov(&iov, &verf_data);
730 p = rqstp->rq_res.head->iov_base + rqstp->rq_res.head->iov_len;
731 mic.data = (u8 *)(p + 1);
732 maj_stat = gss_get_mic(ctx_id, &verf_data, &mic);
733 if (maj_stat != GSS_S_COMPLETE)
734 return -1;
735 *p++ = htonl(mic.len);
736 memset((u8 *)p + mic.len, 0, round_up_to_quad(mic.len) - mic.len);
737 p += XDR_QUADLEN(mic.len);
738 if (!xdr_ressize_check(rqstp, p))
739 return -1;
740 return 0;
741}
742
743struct gss_domain {
744 struct auth_domain h;
745 u32 pseudoflavor;
746};
747
748static struct auth_domain *
749find_gss_auth_domain(struct gss_ctx *ctx, u32 svc)
750{
751 char *name;
752
753 name = gss_service_to_auth_domain_name(ctx->mech_type, svc);
754 if (!name)
755 return NULL;
756 return auth_domain_find(name);
757}
758
759static struct auth_ops svcauthops_gss;
760
761u32 svcauth_gss_flavor(struct auth_domain *dom)
762{
763 struct gss_domain *gd = container_of(dom, struct gss_domain, h);
764
765 return gd->pseudoflavor;
766}
767
768EXPORT_SYMBOL_GPL(svcauth_gss_flavor);
769
770int
771svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name)
772{
773 struct gss_domain *new;
774 struct auth_domain *test;
775 int stat = -ENOMEM;
776
777 new = kmalloc(sizeof(*new), GFP_KERNEL);
778 if (!new)
779 goto out;
780 kref_init(&new->h.ref);
781 new->h.name = kstrdup(name, GFP_KERNEL);
782 if (!new->h.name)
783 goto out_free_dom;
784 new->h.flavour = &svcauthops_gss;
785 new->pseudoflavor = pseudoflavor;
786
787 stat = 0;
788 test = auth_domain_lookup(name, &new->h);
789 if (test != &new->h) {
790 auth_domain_put(test);
791 kfree(new->h.name);
792 goto out_free_dom;
793 }
794 return 0;
795
796out_free_dom:
797 kfree(new);
798out:
799 return stat;
800}
801
802EXPORT_SYMBOL_GPL(svcauth_gss_register_pseudoflavor);
803
804static inline int
805read_u32_from_xdr_buf(struct xdr_buf *buf, int base, u32 *obj)
806{
807 __be32 raw;
808 int status;
809
810 status = read_bytes_from_xdr_buf(buf, base, &raw, sizeof(*obj));
811 if (status)
812 return status;
813 *obj = ntohl(raw);
814 return 0;
815}
816
817
818
819
820
821
822static int
823unwrap_integ_data(struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
824{
825 int stat = -EINVAL;
826 u32 integ_len, maj_stat;
827 struct xdr_netobj mic;
828 struct xdr_buf integ_buf;
829
830 integ_len = svc_getnl(&buf->head[0]);
831 if (integ_len & 3)
832 return stat;
833 if (integ_len > buf->len)
834 return stat;
835 if (xdr_buf_subsegment(buf, &integ_buf, 0, integ_len))
836 BUG();
837
838 if (read_u32_from_xdr_buf(buf, integ_len, &mic.len))
839 BUG();
840 if (mic.len > RPC_MAX_AUTH_SIZE)
841 return stat;
842 mic.data = kmalloc(mic.len, GFP_KERNEL);
843 if (!mic.data)
844 return stat;
845 if (read_bytes_from_xdr_buf(buf, integ_len + 4, mic.data, mic.len))
846 goto out;
847 maj_stat = gss_verify_mic(ctx, &integ_buf, &mic);
848 if (maj_stat != GSS_S_COMPLETE)
849 goto out;
850 if (svc_getnl(&buf->head[0]) != seq)
851 goto out;
852 stat = 0;
853out:
854 kfree(mic.data);
855 return stat;
856}
857
858static inline int
859total_buf_len(struct xdr_buf *buf)
860{
861 return buf->head[0].iov_len + buf->page_len + buf->tail[0].iov_len;
862}
863
864static void
865fix_priv_head(struct xdr_buf *buf, int pad)
866{
867 if (buf->page_len == 0) {
868
869
870
871 buf->head[0].iov_len -= pad;
872 }
873}
874
875static int
876unwrap_priv_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
877{
878 u32 priv_len, maj_stat;
879 int pad, saved_len, remaining_len, offset;
880
881 rqstp->rq_splice_ok = 0;
882
883 priv_len = svc_getnl(&buf->head[0]);
884 if (rqstp->rq_deferred) {
885
886
887 goto out_seq;
888 }
889
890
891
892 remaining_len = total_buf_len(buf);
893 if (priv_len > remaining_len)
894 return -EINVAL;
895 pad = remaining_len - priv_len;
896 buf->len -= pad;
897 fix_priv_head(buf, pad);
898
899
900 saved_len = buf->len;
901 buf->len = priv_len;
902 maj_stat = gss_unwrap(ctx, 0, buf);
903 pad = priv_len - buf->len;
904 buf->len = saved_len;
905 buf->len -= pad;
906
907
908
909
910
911
912 offset = buf->head[0].iov_len % 4;
913 if (offset) {
914 buf->buflen = RPCSVC_MAXPAYLOAD;
915 xdr_shift_buf(buf, offset);
916 fix_priv_head(buf, pad);
917 }
918 if (maj_stat != GSS_S_COMPLETE)
919 return -EINVAL;
920out_seq:
921 if (svc_getnl(&buf->head[0]) != seq)
922 return -EINVAL;
923 return 0;
924}
925
926struct gss_svc_data {
927
928 struct rpc_gss_wire_cred clcred;
929
930
931 __be32 *verf_start;
932 struct rsc *rsci;
933};
934
935char *svc_gss_principal(struct svc_rqst *rqstp)
936{
937 struct gss_svc_data *gd = (struct gss_svc_data *)rqstp->rq_auth_data;
938
939 if (gd && gd->rsci)
940 return gd->rsci->client_name;
941 return NULL;
942}
943EXPORT_SYMBOL_GPL(svc_gss_principal);
944
945static int
946svcauth_gss_set_client(struct svc_rqst *rqstp)
947{
948 struct gss_svc_data *svcdata = rqstp->rq_auth_data;
949 struct rsc *rsci = svcdata->rsci;
950 struct rpc_gss_wire_cred *gc = &svcdata->clcred;
951 int stat;
952
953
954
955
956
957
958
959
960
961
962 rqstp->rq_gssclient = find_gss_auth_domain(rsci->mechctx, gc->gc_svc);
963 if (rqstp->rq_gssclient == NULL)
964 return SVC_DENIED;
965 stat = svcauth_unix_set_client(rqstp);
966 if (stat == SVC_DROP)
967 return stat;
968 return SVC_OK;
969}
970
971static inline int
972gss_write_init_verf(struct svc_rqst *rqstp, struct rsi *rsip)
973{
974 struct rsc *rsci;
975 int rc;
976
977 if (rsip->major_status != GSS_S_COMPLETE)
978 return gss_write_null_verf(rqstp);
979 rsci = gss_svc_searchbyctx(&rsip->out_handle);
980 if (rsci == NULL) {
981 rsip->major_status = GSS_S_NO_CONTEXT;
982 return gss_write_null_verf(rqstp);
983 }
984 rc = gss_write_verf(rqstp, rsci->mechctx, GSS_SEQ_WIN);
985 cache_put(&rsci->h, &rsc_cache);
986 return rc;
987}
988
989
990
991
992
993
994
995
996static int svcauth_gss_handle_init(struct svc_rqst *rqstp,
997 struct rpc_gss_wire_cred *gc, __be32 *authp)
998{
999 struct kvec *argv = &rqstp->rq_arg.head[0];
1000 struct kvec *resv = &rqstp->rq_res.head[0];
1001 struct xdr_netobj tmpobj;
1002 struct rsi *rsip, rsikey;
1003 int ret;
1004
1005
1006 *authp = rpc_autherr_badverf;
1007 if (argv->iov_len < 2 * 4)
1008 return SVC_DENIED;
1009 if (svc_getnl(argv) != RPC_AUTH_NULL)
1010 return SVC_DENIED;
1011 if (svc_getnl(argv) != 0)
1012 return SVC_DENIED;
1013
1014
1015 *authp = rpc_autherr_badcred;
1016 if (gc->gc_proc == RPC_GSS_PROC_INIT && gc->gc_ctx.len != 0)
1017 return SVC_DENIED;
1018 memset(&rsikey, 0, sizeof(rsikey));
1019 if (dup_netobj(&rsikey.in_handle, &gc->gc_ctx))
1020 return SVC_DROP;
1021 *authp = rpc_autherr_badverf;
1022 if (svc_safe_getnetobj(argv, &tmpobj)) {
1023 kfree(rsikey.in_handle.data);
1024 return SVC_DENIED;
1025 }
1026 if (dup_netobj(&rsikey.in_token, &tmpobj)) {
1027 kfree(rsikey.in_handle.data);
1028 return SVC_DROP;
1029 }
1030
1031
1032 rsip = rsi_lookup(&rsikey);
1033 rsi_free(&rsikey);
1034 if (!rsip)
1035 return SVC_DROP;
1036 switch (cache_check(&rsi_cache, &rsip->h, &rqstp->rq_chandle)) {
1037 case -EAGAIN:
1038 case -ETIMEDOUT:
1039 case -ENOENT:
1040
1041 return SVC_DROP;
1042 case 0:
1043 ret = SVC_DROP;
1044
1045 if (gss_write_init_verf(rqstp, rsip))
1046 goto out;
1047 if (resv->iov_len + 4 > PAGE_SIZE)
1048 goto out;
1049 svc_putnl(resv, RPC_SUCCESS);
1050 if (svc_safe_putnetobj(resv, &rsip->out_handle))
1051 goto out;
1052 if (resv->iov_len + 3 * 4 > PAGE_SIZE)
1053 goto out;
1054 svc_putnl(resv, rsip->major_status);
1055 svc_putnl(resv, rsip->minor_status);
1056 svc_putnl(resv, GSS_SEQ_WIN);
1057 if (svc_safe_putnetobj(resv, &rsip->out_token))
1058 goto out;
1059 }
1060 ret = SVC_COMPLETE;
1061out:
1062 cache_put(&rsip->h, &rsi_cache);
1063 return ret;
1064}
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074static int
1075svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
1076{
1077 struct kvec *argv = &rqstp->rq_arg.head[0];
1078 struct kvec *resv = &rqstp->rq_res.head[0];
1079 u32 crlen;
1080 struct gss_svc_data *svcdata = rqstp->rq_auth_data;
1081 struct rpc_gss_wire_cred *gc;
1082 struct rsc *rsci = NULL;
1083 __be32 *rpcstart;
1084 __be32 *reject_stat = resv->iov_base + resv->iov_len;
1085 int ret;
1086
1087 dprintk("RPC: svcauth_gss: argv->iov_len = %zd\n",
1088 argv->iov_len);
1089
1090 *authp = rpc_autherr_badcred;
1091 if (!svcdata)
1092 svcdata = kmalloc(sizeof(*svcdata), GFP_KERNEL);
1093 if (!svcdata)
1094 goto auth_err;
1095 rqstp->rq_auth_data = svcdata;
1096 svcdata->verf_start = NULL;
1097 svcdata->rsci = NULL;
1098 gc = &svcdata->clcred;
1099
1100
1101
1102
1103 rpcstart = argv->iov_base;
1104 rpcstart -= 7;
1105
1106
1107
1108
1109
1110
1111 if (argv->iov_len < 5 * 4)
1112 goto auth_err;
1113 crlen = svc_getnl(argv);
1114 if (svc_getnl(argv) != RPC_GSS_VERSION)
1115 goto auth_err;
1116 gc->gc_proc = svc_getnl(argv);
1117 gc->gc_seq = svc_getnl(argv);
1118 gc->gc_svc = svc_getnl(argv);
1119 if (svc_safe_getnetobj(argv, &gc->gc_ctx))
1120 goto auth_err;
1121 if (crlen != round_up_to_quad(gc->gc_ctx.len) + 5 * 4)
1122 goto auth_err;
1123
1124 if ((gc->gc_proc != RPC_GSS_PROC_DATA) && (rqstp->rq_proc != 0))
1125 goto auth_err;
1126
1127 *authp = rpc_autherr_badverf;
1128 switch (gc->gc_proc) {
1129 case RPC_GSS_PROC_INIT:
1130 case RPC_GSS_PROC_CONTINUE_INIT:
1131 return svcauth_gss_handle_init(rqstp, gc, authp);
1132 case RPC_GSS_PROC_DATA:
1133 case RPC_GSS_PROC_DESTROY:
1134
1135 *authp = rpcsec_gsserr_credproblem;
1136 rsci = gss_svc_searchbyctx(&gc->gc_ctx);
1137 if (!rsci)
1138 goto auth_err;
1139 switch (gss_verify_header(rqstp, rsci, rpcstart, gc, authp)) {
1140 case SVC_OK:
1141 break;
1142 case SVC_DENIED:
1143 goto auth_err;
1144 case SVC_DROP:
1145 goto drop;
1146 }
1147 break;
1148 default:
1149 *authp = rpc_autherr_rejectedcred;
1150 goto auth_err;
1151 }
1152
1153
1154 switch (gc->gc_proc) {
1155 case RPC_GSS_PROC_DESTROY:
1156 if (gss_write_verf(rqstp, rsci->mechctx, gc->gc_seq))
1157 goto auth_err;
1158 rsci->h.expiry_time = get_seconds();
1159 set_bit(CACHE_NEGATIVE, &rsci->h.flags);
1160 if (resv->iov_len + 4 > PAGE_SIZE)
1161 goto drop;
1162 svc_putnl(resv, RPC_SUCCESS);
1163 goto complete;
1164 case RPC_GSS_PROC_DATA:
1165 *authp = rpcsec_gsserr_ctxproblem;
1166 svcdata->verf_start = resv->iov_base + resv->iov_len;
1167 if (gss_write_verf(rqstp, rsci->mechctx, gc->gc_seq))
1168 goto auth_err;
1169 rqstp->rq_cred = rsci->cred;
1170 get_group_info(rsci->cred.cr_group_info);
1171 *authp = rpc_autherr_badcred;
1172 switch (gc->gc_svc) {
1173 case RPC_GSS_SVC_NONE:
1174 break;
1175 case RPC_GSS_SVC_INTEGRITY:
1176
1177 svc_putnl(resv, 0);
1178 svc_putnl(resv, 0);
1179 if (unwrap_integ_data(&rqstp->rq_arg,
1180 gc->gc_seq, rsci->mechctx))
1181 goto garbage_args;
1182 break;
1183 case RPC_GSS_SVC_PRIVACY:
1184
1185 svc_putnl(resv, 0);
1186 svc_putnl(resv, 0);
1187 if (unwrap_priv_data(rqstp, &rqstp->rq_arg,
1188 gc->gc_seq, rsci->mechctx))
1189 goto garbage_args;
1190 break;
1191 default:
1192 goto auth_err;
1193 }
1194 svcdata->rsci = rsci;
1195 cache_get(&rsci->h);
1196 rqstp->rq_flavor = gss_svc_to_pseudoflavor(
1197 rsci->mechctx->mech_type, gc->gc_svc);
1198 ret = SVC_OK;
1199 goto out;
1200 }
1201garbage_args:
1202 ret = SVC_GARBAGE;
1203 goto out;
1204auth_err:
1205
1206 xdr_ressize_check(rqstp, reject_stat);
1207 ret = SVC_DENIED;
1208 goto out;
1209complete:
1210 ret = SVC_COMPLETE;
1211 goto out;
1212drop:
1213 ret = SVC_DROP;
1214out:
1215 if (rsci)
1216 cache_put(&rsci->h, &rsc_cache);
1217 return ret;
1218}
1219
1220static __be32 *
1221svcauth_gss_prepare_to_wrap(struct xdr_buf *resbuf, struct gss_svc_data *gsd)
1222{
1223 __be32 *p;
1224 u32 verf_len;
1225
1226 p = gsd->verf_start;
1227 gsd->verf_start = NULL;
1228
1229
1230 if (*(p-1) != rpc_success)
1231 return NULL;
1232
1233 p += 1;
1234 verf_len = ntohl(*p++);
1235 p += XDR_QUADLEN(verf_len);
1236
1237 memcpy(p, p + 2, 4);
1238
1239 if (*p != rpc_success) {
1240 resbuf->head[0].iov_len -= 2 * 4;
1241 return NULL;
1242 }
1243 p++;
1244 return p;
1245}
1246
1247static inline int
1248svcauth_gss_wrap_resp_integ(struct svc_rqst *rqstp)
1249{
1250 struct gss_svc_data *gsd = (struct gss_svc_data *)rqstp->rq_auth_data;
1251 struct rpc_gss_wire_cred *gc = &gsd->clcred;
1252 struct xdr_buf *resbuf = &rqstp->rq_res;
1253 struct xdr_buf integ_buf;
1254 struct xdr_netobj mic;
1255 struct kvec *resv;
1256 __be32 *p;
1257 int integ_offset, integ_len;
1258 int stat = -EINVAL;
1259
1260 p = svcauth_gss_prepare_to_wrap(resbuf, gsd);
1261 if (p == NULL)
1262 goto out;
1263 integ_offset = (u8 *)(p + 1) - (u8 *)resbuf->head[0].iov_base;
1264 integ_len = resbuf->len - integ_offset;
1265 BUG_ON(integ_len % 4);
1266 *p++ = htonl(integ_len);
1267 *p++ = htonl(gc->gc_seq);
1268 if (xdr_buf_subsegment(resbuf, &integ_buf, integ_offset,
1269 integ_len))
1270 BUG();
1271 if (resbuf->tail[0].iov_base == NULL) {
1272 if (resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE > PAGE_SIZE)
1273 goto out_err;
1274 resbuf->tail[0].iov_base = resbuf->head[0].iov_base
1275 + resbuf->head[0].iov_len;
1276 resbuf->tail[0].iov_len = 0;
1277 resv = &resbuf->tail[0];
1278 } else {
1279 resv = &resbuf->tail[0];
1280 }
1281 mic.data = (u8 *)resv->iov_base + resv->iov_len + 4;
1282 if (gss_get_mic(gsd->rsci->mechctx, &integ_buf, &mic))
1283 goto out_err;
1284 svc_putnl(resv, mic.len);
1285 memset(mic.data + mic.len, 0,
1286 round_up_to_quad(mic.len) - mic.len);
1287 resv->iov_len += XDR_QUADLEN(mic.len) << 2;
1288
1289 resbuf->len += XDR_QUADLEN(mic.len) << 2;
1290 BUG_ON(resv->iov_len > PAGE_SIZE);
1291out:
1292 stat = 0;
1293out_err:
1294 return stat;
1295}
1296
1297static inline int
1298svcauth_gss_wrap_resp_priv(struct svc_rqst *rqstp)
1299{
1300 struct gss_svc_data *gsd = (struct gss_svc_data *)rqstp->rq_auth_data;
1301 struct rpc_gss_wire_cred *gc = &gsd->clcred;
1302 struct xdr_buf *resbuf = &rqstp->rq_res;
1303 struct page **inpages = NULL;
1304 __be32 *p, *len;
1305 int offset;
1306 int pad;
1307
1308 p = svcauth_gss_prepare_to_wrap(resbuf, gsd);
1309 if (p == NULL)
1310 return 0;
1311 len = p++;
1312 offset = (u8 *)p - (u8 *)resbuf->head[0].iov_base;
1313 *p++ = htonl(gc->gc_seq);
1314 inpages = resbuf->pages;
1315
1316
1317 if (resbuf->tail[0].iov_base) {
1318 BUG_ON(resbuf->tail[0].iov_base >= resbuf->head[0].iov_base
1319 + PAGE_SIZE);
1320 BUG_ON(resbuf->tail[0].iov_base < resbuf->head[0].iov_base);
1321 if (resbuf->tail[0].iov_len + resbuf->head[0].iov_len
1322 + 2 * RPC_MAX_AUTH_SIZE > PAGE_SIZE)
1323 return -ENOMEM;
1324 memmove(resbuf->tail[0].iov_base + RPC_MAX_AUTH_SIZE,
1325 resbuf->tail[0].iov_base,
1326 resbuf->tail[0].iov_len);
1327 resbuf->tail[0].iov_base += RPC_MAX_AUTH_SIZE;
1328 }
1329 if (resbuf->tail[0].iov_base == NULL) {
1330 if (resbuf->head[0].iov_len + 2*RPC_MAX_AUTH_SIZE > PAGE_SIZE)
1331 return -ENOMEM;
1332 resbuf->tail[0].iov_base = resbuf->head[0].iov_base
1333 + resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE;
1334 resbuf->tail[0].iov_len = 0;
1335 }
1336 if (gss_wrap(gsd->rsci->mechctx, offset, resbuf, inpages))
1337 return -ENOMEM;
1338 *len = htonl(resbuf->len - offset);
1339 pad = 3 - ((resbuf->len - offset - 1)&3);
1340 p = (__be32 *)(resbuf->tail[0].iov_base + resbuf->tail[0].iov_len);
1341 memset(p, 0, pad);
1342 resbuf->tail[0].iov_len += pad;
1343 resbuf->len += pad;
1344 return 0;
1345}
1346
1347static int
1348svcauth_gss_release(struct svc_rqst *rqstp)
1349{
1350 struct gss_svc_data *gsd = (struct gss_svc_data *)rqstp->rq_auth_data;
1351 struct rpc_gss_wire_cred *gc = &gsd->clcred;
1352 struct xdr_buf *resbuf = &rqstp->rq_res;
1353 int stat = -EINVAL;
1354
1355 if (gc->gc_proc != RPC_GSS_PROC_DATA)
1356 goto out;
1357
1358 if (gsd->verf_start == NULL)
1359 goto out;
1360
1361
1362
1363 resbuf->len = total_buf_len(resbuf);
1364 switch (gc->gc_svc) {
1365 case RPC_GSS_SVC_NONE:
1366 break;
1367 case RPC_GSS_SVC_INTEGRITY:
1368 stat = svcauth_gss_wrap_resp_integ(rqstp);
1369 if (stat)
1370 goto out_err;
1371 break;
1372 case RPC_GSS_SVC_PRIVACY:
1373 stat = svcauth_gss_wrap_resp_priv(rqstp);
1374 if (stat)
1375 goto out_err;
1376 break;
1377
1378
1379
1380
1381 }
1382
1383out:
1384 stat = 0;
1385out_err:
1386 if (rqstp->rq_client)
1387 auth_domain_put(rqstp->rq_client);
1388 rqstp->rq_client = NULL;
1389 if (rqstp->rq_gssclient)
1390 auth_domain_put(rqstp->rq_gssclient);
1391 rqstp->rq_gssclient = NULL;
1392 if (rqstp->rq_cred.cr_group_info)
1393 put_group_info(rqstp->rq_cred.cr_group_info);
1394 rqstp->rq_cred.cr_group_info = NULL;
1395 if (gsd->rsci)
1396 cache_put(&gsd->rsci->h, &rsc_cache);
1397 gsd->rsci = NULL;
1398
1399 return stat;
1400}
1401
1402static void
1403svcauth_gss_domain_release(struct auth_domain *dom)
1404{
1405 struct gss_domain *gd = container_of(dom, struct gss_domain, h);
1406
1407 kfree(dom->name);
1408 kfree(gd);
1409}
1410
1411static struct auth_ops svcauthops_gss = {
1412 .name = "rpcsec_gss",
1413 .owner = THIS_MODULE,
1414 .flavour = RPC_AUTH_GSS,
1415 .accept = svcauth_gss_accept,
1416 .release = svcauth_gss_release,
1417 .domain_release = svcauth_gss_domain_release,
1418 .set_client = svcauth_gss_set_client,
1419};
1420
1421int
1422gss_svc_init(void)
1423{
1424 int rv = svc_auth_register(RPC_AUTH_GSS, &svcauthops_gss);
1425 if (rv)
1426 return rv;
1427 rv = cache_register(&rsc_cache);
1428 if (rv)
1429 goto out1;
1430 rv = cache_register(&rsi_cache);
1431 if (rv)
1432 goto out2;
1433 return 0;
1434out2:
1435 cache_unregister(&rsc_cache);
1436out1:
1437 svc_auth_unregister(RPC_AUTH_GSS);
1438 return rv;
1439}
1440
1441void
1442gss_svc_shutdown(void)
1443{
1444 cache_unregister(&rsc_cache);
1445 cache_unregister(&rsi_cache);
1446 svc_auth_unregister(RPC_AUTH_GSS);
1447}
1448