1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40#include <linux/slab.h>
41#include <linux/types.h>
42#include <linux/module.h>
43#include <linux/pagemap.h>
44#include <linux/user_namespace.h>
45
46#include <linux/sunrpc/auth_gss.h>
47#include <linux/sunrpc/gss_err.h>
48#include <linux/sunrpc/svcauth.h>
49#include <linux/sunrpc/svcauth_gss.h>
50#include <linux/sunrpc/cache.h>
51#include "gss_rpc_upcall.h"
52
53
54#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
55# define RPCDBG_FACILITY RPCDBG_AUTH
56#endif
57
58
59
60
61
62
63
64
65
66static int netobj_equal(struct xdr_netobj *a, struct xdr_netobj *b)
67{
68 return a->len == b->len && 0 == memcmp(a->data, b->data, a->len);
69}
70
71#define RSI_HASHBITS 6
72#define RSI_HASHMAX (1<<RSI_HASHBITS)
73
74struct rsi {
75 struct cache_head h;
76 struct xdr_netobj in_handle, in_token;
77 struct xdr_netobj out_handle, out_token;
78 int major_status, minor_status;
79};
80
81static struct rsi *rsi_update(struct cache_detail *cd, struct rsi *new, struct rsi *old);
82static struct rsi *rsi_lookup(struct cache_detail *cd, struct rsi *item);
83
84static void rsi_free(struct rsi *rsii)
85{
86 kfree(rsii->in_handle.data);
87 kfree(rsii->in_token.data);
88 kfree(rsii->out_handle.data);
89 kfree(rsii->out_token.data);
90}
91
92static void rsi_put(struct kref *ref)
93{
94 struct rsi *rsii = container_of(ref, struct rsi, h.ref);
95 rsi_free(rsii);
96 kfree(rsii);
97}
98
99static inline int rsi_hash(struct rsi *item)
100{
101 return hash_mem(item->in_handle.data, item->in_handle.len, RSI_HASHBITS)
102 ^ hash_mem(item->in_token.data, item->in_token.len, RSI_HASHBITS);
103}
104
105static int rsi_match(struct cache_head *a, struct cache_head *b)
106{
107 struct rsi *item = container_of(a, struct rsi, h);
108 struct rsi *tmp = container_of(b, struct rsi, h);
109 return netobj_equal(&item->in_handle, &tmp->in_handle) &&
110 netobj_equal(&item->in_token, &tmp->in_token);
111}
112
113static int dup_to_netobj(struct xdr_netobj *dst, char *src, int len)
114{
115 dst->len = len;
116 dst->data = (len ? kmemdup(src, len, GFP_KERNEL) : NULL);
117 if (len && !dst->data)
118 return -ENOMEM;
119 return 0;
120}
121
122static inline int dup_netobj(struct xdr_netobj *dst, struct xdr_netobj *src)
123{
124 return dup_to_netobj(dst, src->data, src->len);
125}
126
127static void rsi_init(struct cache_head *cnew, struct cache_head *citem)
128{
129 struct rsi *new = container_of(cnew, struct rsi, h);
130 struct rsi *item = container_of(citem, struct rsi, h);
131
132 new->out_handle.data = NULL;
133 new->out_handle.len = 0;
134 new->out_token.data = NULL;
135 new->out_token.len = 0;
136 new->in_handle.len = item->in_handle.len;
137 item->in_handle.len = 0;
138 new->in_token.len = item->in_token.len;
139 item->in_token.len = 0;
140 new->in_handle.data = item->in_handle.data;
141 item->in_handle.data = NULL;
142 new->in_token.data = item->in_token.data;
143 item->in_token.data = NULL;
144}
145
146static void update_rsi(struct cache_head *cnew, struct cache_head *citem)
147{
148 struct rsi *new = container_of(cnew, struct rsi, h);
149 struct rsi *item = container_of(citem, struct rsi, h);
150
151 BUG_ON(new->out_handle.data || new->out_token.data);
152 new->out_handle.len = item->out_handle.len;
153 item->out_handle.len = 0;
154 new->out_token.len = item->out_token.len;
155 item->out_token.len = 0;
156 new->out_handle.data = item->out_handle.data;
157 item->out_handle.data = NULL;
158 new->out_token.data = item->out_token.data;
159 item->out_token.data = NULL;
160
161 new->major_status = item->major_status;
162 new->minor_status = item->minor_status;
163}
164
165static struct cache_head *rsi_alloc(void)
166{
167 struct rsi *rsii = kmalloc(sizeof(*rsii), GFP_KERNEL);
168 if (rsii)
169 return &rsii->h;
170 else
171 return NULL;
172}
173
174static void rsi_request(struct cache_detail *cd,
175 struct cache_head *h,
176 char **bpp, int *blen)
177{
178 struct rsi *rsii = container_of(h, struct rsi, h);
179
180 qword_addhex(bpp, blen, rsii->in_handle.data, rsii->in_handle.len);
181 qword_addhex(bpp, blen, rsii->in_token.data, rsii->in_token.len);
182 (*bpp)[-1] = '\n';
183}
184
185static int rsi_parse(struct cache_detail *cd,
186 char *mesg, int mlen)
187{
188
189 char *buf = mesg;
190 char *ep;
191 int len;
192 struct rsi rsii, *rsip = NULL;
193 time_t expiry;
194 int status = -EINVAL;
195
196 memset(&rsii, 0, sizeof(rsii));
197
198 len = qword_get(&mesg, buf, mlen);
199 if (len < 0)
200 goto out;
201 status = -ENOMEM;
202 if (dup_to_netobj(&rsii.in_handle, buf, len))
203 goto out;
204
205
206 len = qword_get(&mesg, buf, mlen);
207 status = -EINVAL;
208 if (len < 0)
209 goto out;
210 status = -ENOMEM;
211 if (dup_to_netobj(&rsii.in_token, buf, len))
212 goto out;
213
214 rsip = rsi_lookup(cd, &rsii);
215 if (!rsip)
216 goto out;
217
218 rsii.h.flags = 0;
219
220 expiry = get_expiry(&mesg);
221 status = -EINVAL;
222 if (expiry == 0)
223 goto out;
224
225
226 len = qword_get(&mesg, buf, mlen);
227 if (len <= 0)
228 goto out;
229 rsii.major_status = simple_strtoul(buf, &ep, 10);
230 if (*ep)
231 goto out;
232 len = qword_get(&mesg, buf, mlen);
233 if (len <= 0)
234 goto out;
235 rsii.minor_status = simple_strtoul(buf, &ep, 10);
236 if (*ep)
237 goto out;
238
239
240 len = qword_get(&mesg, buf, mlen);
241 if (len < 0)
242 goto out;
243 status = -ENOMEM;
244 if (dup_to_netobj(&rsii.out_handle, buf, len))
245 goto out;
246
247
248 len = qword_get(&mesg, buf, mlen);
249 status = -EINVAL;
250 if (len < 0)
251 goto out;
252 status = -ENOMEM;
253 if (dup_to_netobj(&rsii.out_token, buf, len))
254 goto out;
255 rsii.h.expiry_time = expiry;
256 rsip = rsi_update(cd, &rsii, rsip);
257 status = 0;
258out:
259 rsi_free(&rsii);
260 if (rsip)
261 cache_put(&rsip->h, cd);
262 else
263 status = -ENOMEM;
264 return status;
265}
266
267static struct cache_detail rsi_cache_template = {
268 .owner = THIS_MODULE,
269 .hash_size = RSI_HASHMAX,
270 .name = "auth.rpcsec.init",
271 .cache_put = rsi_put,
272 .cache_request = rsi_request,
273 .cache_parse = rsi_parse,
274 .match = rsi_match,
275 .init = rsi_init,
276 .update = update_rsi,
277 .alloc = rsi_alloc,
278};
279
280static struct rsi *rsi_lookup(struct cache_detail *cd, struct rsi *item)
281{
282 struct cache_head *ch;
283 int hash = rsi_hash(item);
284
285 ch = sunrpc_cache_lookup(cd, &item->h, hash);
286 if (ch)
287 return container_of(ch, struct rsi, h);
288 else
289 return NULL;
290}
291
292static struct rsi *rsi_update(struct cache_detail *cd, struct rsi *new, struct rsi *old)
293{
294 struct cache_head *ch;
295 int hash = rsi_hash(new);
296
297 ch = sunrpc_cache_update(cd, &new->h,
298 &old->h, hash);
299 if (ch)
300 return container_of(ch, struct rsi, h);
301 else
302 return NULL;
303}
304
305
306
307
308
309
310
311
312
313#define RSC_HASHBITS 10
314#define RSC_HASHMAX (1<<RSC_HASHBITS)
315
316#define GSS_SEQ_WIN 128
317
318struct gss_svc_seq_data {
319
320 int sd_max;
321
322
323 unsigned long sd_win[GSS_SEQ_WIN/BITS_PER_LONG];
324 spinlock_t sd_lock;
325};
326
327struct rsc {
328 struct cache_head h;
329 struct xdr_netobj handle;
330 struct svc_cred cred;
331 struct gss_svc_seq_data seqdata;
332 struct gss_ctx *mechctx;
333};
334
335static struct rsc *rsc_update(struct cache_detail *cd, struct rsc *new, struct rsc *old);
336static struct rsc *rsc_lookup(struct cache_detail *cd, struct rsc *item);
337
338static void rsc_free(struct rsc *rsci)
339{
340 kfree(rsci->handle.data);
341 if (rsci->mechctx)
342 gss_delete_sec_context(&rsci->mechctx);
343 free_svc_cred(&rsci->cred);
344}
345
346static void rsc_put(struct kref *ref)
347{
348 struct rsc *rsci = container_of(ref, struct rsc, h.ref);
349
350 rsc_free(rsci);
351 kfree(rsci);
352}
353
354static inline int
355rsc_hash(struct rsc *rsci)
356{
357 return hash_mem(rsci->handle.data, rsci->handle.len, RSC_HASHBITS);
358}
359
360static int
361rsc_match(struct cache_head *a, struct cache_head *b)
362{
363 struct rsc *new = container_of(a, struct rsc, h);
364 struct rsc *tmp = container_of(b, struct rsc, h);
365
366 return netobj_equal(&new->handle, &tmp->handle);
367}
368
369static void
370rsc_init(struct cache_head *cnew, struct cache_head *ctmp)
371{
372 struct rsc *new = container_of(cnew, struct rsc, h);
373 struct rsc *tmp = container_of(ctmp, struct rsc, h);
374
375 new->handle.len = tmp->handle.len;
376 tmp->handle.len = 0;
377 new->handle.data = tmp->handle.data;
378 tmp->handle.data = NULL;
379 new->mechctx = NULL;
380 init_svc_cred(&new->cred);
381}
382
383static void
384update_rsc(struct cache_head *cnew, struct cache_head *ctmp)
385{
386 struct rsc *new = container_of(cnew, struct rsc, h);
387 struct rsc *tmp = container_of(ctmp, struct rsc, h);
388
389 new->mechctx = tmp->mechctx;
390 tmp->mechctx = NULL;
391 memset(&new->seqdata, 0, sizeof(new->seqdata));
392 spin_lock_init(&new->seqdata.sd_lock);
393 new->cred = tmp->cred;
394 init_svc_cred(&tmp->cred);
395}
396
397static struct cache_head *
398rsc_alloc(void)
399{
400 struct rsc *rsci = kmalloc(sizeof(*rsci), GFP_KERNEL);
401 if (rsci)
402 return &rsci->h;
403 else
404 return NULL;
405}
406
407static int rsc_parse(struct cache_detail *cd,
408 char *mesg, int mlen)
409{
410
411 char *buf = mesg;
412 int id;
413 int len, rv;
414 struct rsc rsci, *rscp = NULL;
415 time_t expiry;
416 int status = -EINVAL;
417 struct gss_api_mech *gm = NULL;
418
419 memset(&rsci, 0, sizeof(rsci));
420
421 len = qword_get(&mesg, buf, mlen);
422 if (len < 0) goto out;
423 status = -ENOMEM;
424 if (dup_to_netobj(&rsci.handle, buf, len))
425 goto out;
426
427 rsci.h.flags = 0;
428
429 expiry = get_expiry(&mesg);
430 status = -EINVAL;
431 if (expiry == 0)
432 goto out;
433
434 rscp = rsc_lookup(cd, &rsci);
435 if (!rscp)
436 goto out;
437
438
439 rv = get_int(&mesg, &id);
440 if (rv == -EINVAL)
441 goto out;
442 if (rv == -ENOENT)
443 set_bit(CACHE_NEGATIVE, &rsci.h.flags);
444 else {
445 int N, i;
446
447
448
449
450
451
452
453
454
455
456 rsci.cred.cr_uid = make_kuid(&init_user_ns, id);
457
458
459 if (get_int(&mesg, &id))
460 goto out;
461 rsci.cred.cr_gid = make_kgid(&init_user_ns, id);
462
463
464 if (get_int(&mesg, &N))
465 goto out;
466 status = -ENOMEM;
467 rsci.cred.cr_group_info = groups_alloc(N);
468 if (rsci.cred.cr_group_info == NULL)
469 goto out;
470
471
472 status = -EINVAL;
473 for (i=0; i<N; i++) {
474 kgid_t kgid;
475 if (get_int(&mesg, &id))
476 goto out;
477 kgid = make_kgid(&init_user_ns, id);
478 if (!gid_valid(kgid))
479 goto out;
480 GROUP_AT(rsci.cred.cr_group_info, i) = kgid;
481 }
482
483
484 len = qword_get(&mesg, buf, mlen);
485 if (len < 0)
486 goto out;
487 gm = rsci.cred.cr_gss_mech = gss_mech_get_by_name(buf);
488 status = -EOPNOTSUPP;
489 if (!gm)
490 goto out;
491
492 status = -EINVAL;
493
494 len = qword_get(&mesg, buf, mlen);
495 if (len < 0)
496 goto out;
497 status = gss_import_sec_context(buf, len, gm, &rsci.mechctx,
498 NULL, GFP_KERNEL);
499 if (status)
500 goto out;
501
502
503 len = qword_get(&mesg, buf, mlen);
504 if (len > 0) {
505 rsci.cred.cr_principal = kstrdup(buf, GFP_KERNEL);
506 if (!rsci.cred.cr_principal) {
507 status = -ENOMEM;
508 goto out;
509 }
510 }
511
512 }
513 rsci.h.expiry_time = expiry;
514 rscp = rsc_update(cd, &rsci, rscp);
515 status = 0;
516out:
517 rsc_free(&rsci);
518 if (rscp)
519 cache_put(&rscp->h, cd);
520 else
521 status = -ENOMEM;
522 return status;
523}
524
525static struct cache_detail rsc_cache_template = {
526 .owner = THIS_MODULE,
527 .hash_size = RSC_HASHMAX,
528 .name = "auth.rpcsec.context",
529 .cache_put = rsc_put,
530 .cache_parse = rsc_parse,
531 .match = rsc_match,
532 .init = rsc_init,
533 .update = update_rsc,
534 .alloc = rsc_alloc,
535};
536
537static struct rsc *rsc_lookup(struct cache_detail *cd, struct rsc *item)
538{
539 struct cache_head *ch;
540 int hash = rsc_hash(item);
541
542 ch = sunrpc_cache_lookup(cd, &item->h, hash);
543 if (ch)
544 return container_of(ch, struct rsc, h);
545 else
546 return NULL;
547}
548
549static struct rsc *rsc_update(struct cache_detail *cd, struct rsc *new, struct rsc *old)
550{
551 struct cache_head *ch;
552 int hash = rsc_hash(new);
553
554 ch = sunrpc_cache_update(cd, &new->h,
555 &old->h, hash);
556 if (ch)
557 return container_of(ch, struct rsc, h);
558 else
559 return NULL;
560}
561
562
563static struct rsc *
564gss_svc_searchbyctx(struct cache_detail *cd, struct xdr_netobj *handle)
565{
566 struct rsc rsci;
567 struct rsc *found;
568
569 memset(&rsci, 0, sizeof(rsci));
570 if (dup_to_netobj(&rsci.handle, handle->data, handle->len))
571 return NULL;
572 found = rsc_lookup(cd, &rsci);
573 rsc_free(&rsci);
574 if (!found)
575 return NULL;
576 if (cache_check(cd, &found->h, NULL))
577 return NULL;
578 return found;
579}
580
581
582static int
583gss_check_seq_num(struct rsc *rsci, int seq_num)
584{
585 struct gss_svc_seq_data *sd = &rsci->seqdata;
586
587 spin_lock(&sd->sd_lock);
588 if (seq_num > sd->sd_max) {
589 if (seq_num >= sd->sd_max + GSS_SEQ_WIN) {
590 memset(sd->sd_win,0,sizeof(sd->sd_win));
591 sd->sd_max = seq_num;
592 } else while (sd->sd_max < seq_num) {
593 sd->sd_max++;
594 __clear_bit(sd->sd_max % GSS_SEQ_WIN, sd->sd_win);
595 }
596 __set_bit(seq_num % GSS_SEQ_WIN, sd->sd_win);
597 goto ok;
598 } else if (seq_num <= sd->sd_max - GSS_SEQ_WIN) {
599 goto drop;
600 }
601
602 if (__test_and_set_bit(seq_num % GSS_SEQ_WIN, sd->sd_win))
603 goto drop;
604ok:
605 spin_unlock(&sd->sd_lock);
606 return 1;
607drop:
608 spin_unlock(&sd->sd_lock);
609 return 0;
610}
611
612static inline u32 round_up_to_quad(u32 i)
613{
614 return (i + 3 ) & ~3;
615}
616
617static inline int
618svc_safe_getnetobj(struct kvec *argv, struct xdr_netobj *o)
619{
620 int l;
621
622 if (argv->iov_len < 4)
623 return -1;
624 o->len = svc_getnl(argv);
625 l = round_up_to_quad(o->len);
626 if (argv->iov_len < l)
627 return -1;
628 o->data = argv->iov_base;
629 argv->iov_base += l;
630 argv->iov_len -= l;
631 return 0;
632}
633
634static inline int
635svc_safe_putnetobj(struct kvec *resv, struct xdr_netobj *o)
636{
637 u8 *p;
638
639 if (resv->iov_len + 4 > PAGE_SIZE)
640 return -1;
641 svc_putnl(resv, o->len);
642 p = resv->iov_base + resv->iov_len;
643 resv->iov_len += round_up_to_quad(o->len);
644 if (resv->iov_len > PAGE_SIZE)
645 return -1;
646 memcpy(p, o->data, o->len);
647 memset(p + o->len, 0, round_up_to_quad(o->len) - o->len);
648 return 0;
649}
650
651
652
653
654
655
656static int
657gss_verify_header(struct svc_rqst *rqstp, struct rsc *rsci,
658 __be32 *rpcstart, struct rpc_gss_wire_cred *gc, __be32 *authp)
659{
660 struct gss_ctx *ctx_id = rsci->mechctx;
661 struct xdr_buf rpchdr;
662 struct xdr_netobj checksum;
663 u32 flavor = 0;
664 struct kvec *argv = &rqstp->rq_arg.head[0];
665 struct kvec iov;
666
667
668 iov.iov_base = rpcstart;
669 iov.iov_len = (u8 *)argv->iov_base - (u8 *)rpcstart;
670 xdr_buf_from_iov(&iov, &rpchdr);
671
672 *authp = rpc_autherr_badverf;
673 if (argv->iov_len < 4)
674 return SVC_DENIED;
675 flavor = svc_getnl(argv);
676 if (flavor != RPC_AUTH_GSS)
677 return SVC_DENIED;
678 if (svc_safe_getnetobj(argv, &checksum))
679 return SVC_DENIED;
680
681 if (rqstp->rq_deferred)
682 return SVC_OK;
683 if (gss_verify_mic(ctx_id, &rpchdr, &checksum) != GSS_S_COMPLETE) {
684 *authp = rpcsec_gsserr_credproblem;
685 return SVC_DENIED;
686 }
687
688 if (gc->gc_seq > MAXSEQ) {
689 dprintk("RPC: svcauth_gss: discarding request with "
690 "large sequence number %d\n", gc->gc_seq);
691 *authp = rpcsec_gsserr_ctxproblem;
692 return SVC_DENIED;
693 }
694 if (!gss_check_seq_num(rsci, gc->gc_seq)) {
695 dprintk("RPC: svcauth_gss: discarding request with "
696 "old sequence number %d\n", gc->gc_seq);
697 return SVC_DROP;
698 }
699 return SVC_OK;
700}
701
702static int
703gss_write_null_verf(struct svc_rqst *rqstp)
704{
705 __be32 *p;
706
707 svc_putnl(rqstp->rq_res.head, RPC_AUTH_NULL);
708 p = rqstp->rq_res.head->iov_base + rqstp->rq_res.head->iov_len;
709
710 *p++ = 0;
711 if (!xdr_ressize_check(rqstp, p))
712 return -1;
713 return 0;
714}
715
716static int
717gss_write_verf(struct svc_rqst *rqstp, struct gss_ctx *ctx_id, u32 seq)
718{
719 __be32 xdr_seq;
720 u32 maj_stat;
721 struct xdr_buf verf_data;
722 struct xdr_netobj mic;
723 __be32 *p;
724 struct kvec iov;
725
726 svc_putnl(rqstp->rq_res.head, RPC_AUTH_GSS);
727 xdr_seq = htonl(seq);
728
729 iov.iov_base = &xdr_seq;
730 iov.iov_len = sizeof(xdr_seq);
731 xdr_buf_from_iov(&iov, &verf_data);
732 p = rqstp->rq_res.head->iov_base + rqstp->rq_res.head->iov_len;
733 mic.data = (u8 *)(p + 1);
734 maj_stat = gss_get_mic(ctx_id, &verf_data, &mic);
735 if (maj_stat != GSS_S_COMPLETE)
736 return -1;
737 *p++ = htonl(mic.len);
738 memset((u8 *)p + mic.len, 0, round_up_to_quad(mic.len) - mic.len);
739 p += XDR_QUADLEN(mic.len);
740 if (!xdr_ressize_check(rqstp, p))
741 return -1;
742 return 0;
743}
744
745struct gss_domain {
746 struct auth_domain h;
747 u32 pseudoflavor;
748};
749
750static struct auth_domain *
751find_gss_auth_domain(struct gss_ctx *ctx, u32 svc)
752{
753 char *name;
754
755 name = gss_service_to_auth_domain_name(ctx->mech_type, svc);
756 if (!name)
757 return NULL;
758 return auth_domain_find(name);
759}
760
761static struct auth_ops svcauthops_gss;
762
763u32 svcauth_gss_flavor(struct auth_domain *dom)
764{
765 struct gss_domain *gd = container_of(dom, struct gss_domain, h);
766
767 return gd->pseudoflavor;
768}
769
770EXPORT_SYMBOL_GPL(svcauth_gss_flavor);
771
772int
773svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name)
774{
775 struct gss_domain *new;
776 struct auth_domain *test;
777 int stat = -ENOMEM;
778
779 new = kmalloc(sizeof(*new), GFP_KERNEL);
780 if (!new)
781 goto out;
782 kref_init(&new->h.ref);
783 new->h.name = kstrdup(name, GFP_KERNEL);
784 if (!new->h.name)
785 goto out_free_dom;
786 new->h.flavour = &svcauthops_gss;
787 new->pseudoflavor = pseudoflavor;
788
789 stat = 0;
790 test = auth_domain_lookup(name, &new->h);
791 if (test != &new->h) {
792 auth_domain_put(test);
793 kfree(new->h.name);
794 goto out_free_dom;
795 }
796 return 0;
797
798out_free_dom:
799 kfree(new);
800out:
801 return stat;
802}
803
804EXPORT_SYMBOL_GPL(svcauth_gss_register_pseudoflavor);
805
806static inline int
807read_u32_from_xdr_buf(struct xdr_buf *buf, int base, u32 *obj)
808{
809 __be32 raw;
810 int status;
811
812 status = read_bytes_from_xdr_buf(buf, base, &raw, sizeof(*obj));
813 if (status)
814 return status;
815 *obj = ntohl(raw);
816 return 0;
817}
818
819
820
821
822
823
824static int
825unwrap_integ_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
826{
827 int stat = -EINVAL;
828 u32 integ_len, maj_stat;
829 struct xdr_netobj mic;
830 struct xdr_buf integ_buf;
831
832
833 if (rqstp->rq_deferred)
834 return 0;
835
836 integ_len = svc_getnl(&buf->head[0]);
837 if (integ_len & 3)
838 return stat;
839 if (integ_len > buf->len)
840 return stat;
841 if (xdr_buf_subsegment(buf, &integ_buf, 0, integ_len))
842 BUG();
843
844 if (read_u32_from_xdr_buf(buf, integ_len, &mic.len))
845 BUG();
846 if (mic.len > RPC_MAX_AUTH_SIZE)
847 return stat;
848 mic.data = kmalloc(mic.len, GFP_KERNEL);
849 if (!mic.data)
850 return stat;
851 if (read_bytes_from_xdr_buf(buf, integ_len + 4, mic.data, mic.len))
852 goto out;
853 maj_stat = gss_verify_mic(ctx, &integ_buf, &mic);
854 if (maj_stat != GSS_S_COMPLETE)
855 goto out;
856 if (svc_getnl(&buf->head[0]) != seq)
857 goto out;
858
859 xdr_buf_trim(buf, mic.len + 4);
860 stat = 0;
861out:
862 kfree(mic.data);
863 return stat;
864}
865
866static inline int
867total_buf_len(struct xdr_buf *buf)
868{
869 return buf->head[0].iov_len + buf->page_len + buf->tail[0].iov_len;
870}
871
872static void
873fix_priv_head(struct xdr_buf *buf, int pad)
874{
875 if (buf->page_len == 0) {
876
877
878
879 buf->head[0].iov_len -= pad;
880 }
881}
882
883static int
884unwrap_priv_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
885{
886 u32 priv_len, maj_stat;
887 int pad, saved_len, remaining_len, offset;
888
889 clear_bit(RQ_SPLICE_OK, &rqstp->rq_flags);
890
891 priv_len = svc_getnl(&buf->head[0]);
892 if (rqstp->rq_deferred) {
893
894
895 goto out_seq;
896 }
897
898
899
900 remaining_len = total_buf_len(buf);
901 if (priv_len > remaining_len)
902 return -EINVAL;
903 pad = remaining_len - priv_len;
904 buf->len -= pad;
905 fix_priv_head(buf, pad);
906
907
908 saved_len = buf->len;
909 buf->len = priv_len;
910 maj_stat = gss_unwrap(ctx, 0, buf);
911 pad = priv_len - buf->len;
912 buf->len = saved_len;
913 buf->len -= pad;
914
915
916
917
918
919
920 offset = buf->head[0].iov_len % 4;
921 if (offset) {
922 buf->buflen = RPCSVC_MAXPAYLOAD;
923 xdr_shift_buf(buf, offset);
924 fix_priv_head(buf, pad);
925 }
926 if (maj_stat != GSS_S_COMPLETE)
927 return -EINVAL;
928out_seq:
929 if (svc_getnl(&buf->head[0]) != seq)
930 return -EINVAL;
931 return 0;
932}
933
934struct gss_svc_data {
935
936 struct rpc_gss_wire_cred clcred;
937
938
939 __be32 *verf_start;
940 struct rsc *rsci;
941};
942
943static int
944svcauth_gss_set_client(struct svc_rqst *rqstp)
945{
946 struct gss_svc_data *svcdata = rqstp->rq_auth_data;
947 struct rsc *rsci = svcdata->rsci;
948 struct rpc_gss_wire_cred *gc = &svcdata->clcred;
949 int stat;
950
951
952
953
954
955
956
957
958
959
960 rqstp->rq_gssclient = find_gss_auth_domain(rsci->mechctx, gc->gc_svc);
961 if (rqstp->rq_gssclient == NULL)
962 return SVC_DENIED;
963 stat = svcauth_unix_set_client(rqstp);
964 if (stat == SVC_DROP || stat == SVC_CLOSE)
965 return stat;
966 return SVC_OK;
967}
968
969static inline int
970gss_write_init_verf(struct cache_detail *cd, struct svc_rqst *rqstp,
971 struct xdr_netobj *out_handle, int *major_status)
972{
973 struct rsc *rsci;
974 int rc;
975
976 if (*major_status != GSS_S_COMPLETE)
977 return gss_write_null_verf(rqstp);
978 rsci = gss_svc_searchbyctx(cd, out_handle);
979 if (rsci == NULL) {
980 *major_status = GSS_S_NO_CONTEXT;
981 return gss_write_null_verf(rqstp);
982 }
983 rc = gss_write_verf(rqstp, rsci->mechctx, GSS_SEQ_WIN);
984 cache_put(&rsci->h, cd);
985 return rc;
986}
987
988static inline int
989gss_read_common_verf(struct rpc_gss_wire_cred *gc,
990 struct kvec *argv, __be32 *authp,
991 struct xdr_netobj *in_handle)
992{
993
994 *authp = rpc_autherr_badverf;
995 if (argv->iov_len < 2 * 4)
996 return SVC_DENIED;
997 if (svc_getnl(argv) != RPC_AUTH_NULL)
998 return SVC_DENIED;
999 if (svc_getnl(argv) != 0)
1000 return SVC_DENIED;
1001
1002 *authp = rpc_autherr_badcred;
1003 if (gc->gc_proc == RPC_GSS_PROC_INIT && gc->gc_ctx.len != 0)
1004 return SVC_DENIED;
1005 if (dup_netobj(in_handle, &gc->gc_ctx))
1006 return SVC_CLOSE;
1007 *authp = rpc_autherr_badverf;
1008
1009 return 0;
1010}
1011
1012static inline int
1013gss_read_verf(struct rpc_gss_wire_cred *gc,
1014 struct kvec *argv, __be32 *authp,
1015 struct xdr_netobj *in_handle,
1016 struct xdr_netobj *in_token)
1017{
1018 struct xdr_netobj tmpobj;
1019 int res;
1020
1021 res = gss_read_common_verf(gc, argv, authp, in_handle);
1022 if (res)
1023 return res;
1024
1025 if (svc_safe_getnetobj(argv, &tmpobj)) {
1026 kfree(in_handle->data);
1027 return SVC_DENIED;
1028 }
1029 if (dup_netobj(in_token, &tmpobj)) {
1030 kfree(in_handle->data);
1031 return SVC_CLOSE;
1032 }
1033
1034 return 0;
1035}
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046static inline int
1047gss_read_proxy_verf(struct svc_rqst *rqstp,
1048 struct rpc_gss_wire_cred *gc, __be32 *authp,
1049 struct xdr_netobj *in_handle,
1050 struct gssp_in_token *in_token)
1051{
1052 struct kvec *argv = &rqstp->rq_arg.head[0];
1053 u32 inlen;
1054 int res;
1055
1056 res = gss_read_common_verf(gc, argv, authp, in_handle);
1057 if (res)
1058 return res;
1059
1060 inlen = svc_getnl(argv);
1061 if (inlen > (argv->iov_len + rqstp->rq_arg.page_len))
1062 return SVC_DENIED;
1063
1064 in_token->pages = rqstp->rq_pages;
1065 in_token->page_base = (ulong)argv->iov_base & ~PAGE_MASK;
1066 in_token->page_len = inlen;
1067
1068 return 0;
1069}
1070
1071static inline int
1072gss_write_resv(struct kvec *resv, size_t size_limit,
1073 struct xdr_netobj *out_handle, struct xdr_netobj *out_token,
1074 int major_status, int minor_status)
1075{
1076 if (resv->iov_len + 4 > size_limit)
1077 return -1;
1078 svc_putnl(resv, RPC_SUCCESS);
1079 if (svc_safe_putnetobj(resv, out_handle))
1080 return -1;
1081 if (resv->iov_len + 3 * 4 > size_limit)
1082 return -1;
1083 svc_putnl(resv, major_status);
1084 svc_putnl(resv, minor_status);
1085 svc_putnl(resv, GSS_SEQ_WIN);
1086 if (svc_safe_putnetobj(resv, out_token))
1087 return -1;
1088 return 0;
1089}
1090
1091
1092
1093
1094
1095
1096
1097
1098static int svcauth_gss_legacy_init(struct svc_rqst *rqstp,
1099 struct rpc_gss_wire_cred *gc, __be32 *authp)
1100{
1101 struct kvec *argv = &rqstp->rq_arg.head[0];
1102 struct kvec *resv = &rqstp->rq_res.head[0];
1103 struct rsi *rsip, rsikey;
1104 int ret;
1105 struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id);
1106
1107 memset(&rsikey, 0, sizeof(rsikey));
1108 ret = gss_read_verf(gc, argv, authp,
1109 &rsikey.in_handle, &rsikey.in_token);
1110 if (ret)
1111 return ret;
1112
1113
1114 rsip = rsi_lookup(sn->rsi_cache, &rsikey);
1115 rsi_free(&rsikey);
1116 if (!rsip)
1117 return SVC_CLOSE;
1118 if (cache_check(sn->rsi_cache, &rsip->h, &rqstp->rq_chandle) < 0)
1119
1120 return SVC_CLOSE;
1121
1122 ret = SVC_CLOSE;
1123
1124 if (gss_write_init_verf(sn->rsc_cache, rqstp,
1125 &rsip->out_handle, &rsip->major_status))
1126 goto out;
1127 if (gss_write_resv(resv, PAGE_SIZE,
1128 &rsip->out_handle, &rsip->out_token,
1129 rsip->major_status, rsip->minor_status))
1130 goto out;
1131
1132 ret = SVC_COMPLETE;
1133out:
1134 cache_put(&rsip->h, sn->rsi_cache);
1135 return ret;
1136}
1137
1138static int gss_proxy_save_rsc(struct cache_detail *cd,
1139 struct gssp_upcall_data *ud,
1140 uint64_t *handle)
1141{
1142 struct rsc rsci, *rscp = NULL;
1143 static atomic64_t ctxhctr;
1144 long long ctxh;
1145 struct gss_api_mech *gm = NULL;
1146 time_t expiry;
1147 int status = -EINVAL;
1148
1149 memset(&rsci, 0, sizeof(rsci));
1150
1151 status = -ENOMEM;
1152
1153
1154 ctxh = atomic64_inc_return(&ctxhctr);
1155
1156
1157 *handle = ctxh;
1158
1159
1160 if (dup_to_netobj(&rsci.handle, (char *)handle, sizeof(uint64_t)))
1161 goto out;
1162 rscp = rsc_lookup(cd, &rsci);
1163 if (!rscp)
1164 goto out;
1165
1166
1167 if (!ud->found_creds) {
1168
1169
1170 dprintk("RPC: No creds found!\n");
1171 goto out;
1172 } else {
1173
1174
1175 rsci.cred = ud->creds;
1176 memset(&ud->creds, 0, sizeof(struct svc_cred));
1177
1178 status = -EOPNOTSUPP;
1179
1180 gm = gss_mech_get_by_OID(&ud->mech_oid);
1181 if (!gm)
1182 goto out;
1183 rsci.cred.cr_gss_mech = gm;
1184
1185 status = -EINVAL;
1186
1187 status = gss_import_sec_context(ud->out_handle.data,
1188 ud->out_handle.len,
1189 gm, &rsci.mechctx,
1190 &expiry, GFP_KERNEL);
1191 if (status)
1192 goto out;
1193 }
1194
1195 rsci.h.expiry_time = expiry;
1196 rscp = rsc_update(cd, &rsci, rscp);
1197 status = 0;
1198out:
1199 rsc_free(&rsci);
1200 if (rscp)
1201 cache_put(&rscp->h, cd);
1202 else
1203 status = -ENOMEM;
1204 return status;
1205}
1206
1207static int svcauth_gss_proxy_init(struct svc_rqst *rqstp,
1208 struct rpc_gss_wire_cred *gc, __be32 *authp)
1209{
1210 struct kvec *resv = &rqstp->rq_res.head[0];
1211 struct xdr_netobj cli_handle;
1212 struct gssp_upcall_data ud;
1213 uint64_t handle;
1214 int status;
1215 int ret;
1216 struct net *net = rqstp->rq_xprt->xpt_net;
1217 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1218
1219 memset(&ud, 0, sizeof(ud));
1220 ret = gss_read_proxy_verf(rqstp, gc, authp,
1221 &ud.in_handle, &ud.in_token);
1222 if (ret)
1223 return ret;
1224
1225 ret = SVC_CLOSE;
1226
1227
1228 status = gssp_accept_sec_context_upcall(net, &ud);
1229 if (status)
1230 goto out;
1231
1232 dprintk("RPC: svcauth_gss: gss major status = %d\n",
1233 ud.major_status);
1234
1235 switch (ud.major_status) {
1236 case GSS_S_CONTINUE_NEEDED:
1237 cli_handle = ud.out_handle;
1238 break;
1239 case GSS_S_COMPLETE:
1240 status = gss_proxy_save_rsc(sn->rsc_cache, &ud, &handle);
1241 if (status)
1242 goto out;
1243 cli_handle.data = (u8 *)&handle;
1244 cli_handle.len = sizeof(handle);
1245 break;
1246 default:
1247 ret = SVC_CLOSE;
1248 goto out;
1249 }
1250
1251
1252 if (gss_write_init_verf(sn->rsc_cache, rqstp,
1253 &cli_handle, &ud.major_status))
1254 goto out;
1255 if (gss_write_resv(resv, PAGE_SIZE,
1256 &cli_handle, &ud.out_token,
1257 ud.major_status, ud.minor_status))
1258 goto out;
1259
1260 ret = SVC_COMPLETE;
1261out:
1262 gssp_free_upcall_data(&ud);
1263 return ret;
1264}
1265
1266
1267
1268
1269
1270
1271static int set_gss_proxy(struct net *net, int type)
1272{
1273 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1274 int ret;
1275
1276 WARN_ON_ONCE(type != 0 && type != 1);
1277 ret = cmpxchg(&sn->use_gss_proxy, -1, type);
1278 if (ret != -1 && ret != type)
1279 return -EBUSY;
1280 return 0;
1281}
1282
1283static bool use_gss_proxy(struct net *net)
1284{
1285 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1286
1287
1288 if (sn->use_gss_proxy == -1)
1289 set_gss_proxy(net, 0);
1290 return sn->use_gss_proxy;
1291}
1292
1293#ifdef CONFIG_PROC_FS
1294
1295static ssize_t write_gssp(struct file *file, const char __user *buf,
1296 size_t count, loff_t *ppos)
1297{
1298 struct net *net = PDE_DATA(file_inode(file));
1299 char tbuf[20];
1300 unsigned long i;
1301 int res;
1302
1303 if (*ppos || count > sizeof(tbuf)-1)
1304 return -EINVAL;
1305 if (copy_from_user(tbuf, buf, count))
1306 return -EFAULT;
1307
1308 tbuf[count] = 0;
1309 res = kstrtoul(tbuf, 0, &i);
1310 if (res)
1311 return res;
1312 if (i != 1)
1313 return -EINVAL;
1314 res = set_gssp_clnt(net);
1315 if (res)
1316 return res;
1317 res = set_gss_proxy(net, 1);
1318 if (res)
1319 return res;
1320 return count;
1321}
1322
1323static ssize_t read_gssp(struct file *file, char __user *buf,
1324 size_t count, loff_t *ppos)
1325{
1326 struct net *net = PDE_DATA(file_inode(file));
1327 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1328 unsigned long p = *ppos;
1329 char tbuf[10];
1330 size_t len;
1331
1332 snprintf(tbuf, sizeof(tbuf), "%d\n", sn->use_gss_proxy);
1333 len = strlen(tbuf);
1334 if (p >= len)
1335 return 0;
1336 len -= p;
1337 if (len > count)
1338 len = count;
1339 if (copy_to_user(buf, (void *)(tbuf+p), len))
1340 return -EFAULT;
1341 *ppos += len;
1342 return len;
1343}
1344
1345static const struct file_operations use_gss_proxy_ops = {
1346 .open = nonseekable_open,
1347 .write = write_gssp,
1348 .read = read_gssp,
1349};
1350
1351static int create_use_gss_proxy_proc_entry(struct net *net)
1352{
1353 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1354 struct proc_dir_entry **p = &sn->use_gssp_proc;
1355
1356 sn->use_gss_proxy = -1;
1357 *p = proc_create_data("use-gss-proxy", S_IFREG|S_IRUSR|S_IWUSR,
1358 sn->proc_net_rpc,
1359 &use_gss_proxy_ops, net);
1360 if (!*p)
1361 return -ENOMEM;
1362 init_gssp_clnt(sn);
1363 return 0;
1364}
1365
1366static void destroy_use_gss_proxy_proc_entry(struct net *net)
1367{
1368 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1369
1370 if (sn->use_gssp_proc) {
1371 remove_proc_entry("use-gss-proxy", sn->proc_net_rpc);
1372 clear_gssp_clnt(sn);
1373 }
1374}
1375#else
1376
1377static int create_use_gss_proxy_proc_entry(struct net *net)
1378{
1379 return 0;
1380}
1381
1382static void destroy_use_gss_proxy_proc_entry(struct net *net) {}
1383
1384#endif
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394static int
1395svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
1396{
1397 struct kvec *argv = &rqstp->rq_arg.head[0];
1398 struct kvec *resv = &rqstp->rq_res.head[0];
1399 u32 crlen;
1400 struct gss_svc_data *svcdata = rqstp->rq_auth_data;
1401 struct rpc_gss_wire_cred *gc;
1402 struct rsc *rsci = NULL;
1403 __be32 *rpcstart;
1404 __be32 *reject_stat = resv->iov_base + resv->iov_len;
1405 int ret;
1406 struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id);
1407
1408 dprintk("RPC: svcauth_gss: argv->iov_len = %zd\n",
1409 argv->iov_len);
1410
1411 *authp = rpc_autherr_badcred;
1412 if (!svcdata)
1413 svcdata = kmalloc(sizeof(*svcdata), GFP_KERNEL);
1414 if (!svcdata)
1415 goto auth_err;
1416 rqstp->rq_auth_data = svcdata;
1417 svcdata->verf_start = NULL;
1418 svcdata->rsci = NULL;
1419 gc = &svcdata->clcred;
1420
1421
1422
1423
1424 rpcstart = argv->iov_base;
1425 rpcstart -= 7;
1426
1427
1428
1429
1430
1431
1432 if (argv->iov_len < 5 * 4)
1433 goto auth_err;
1434 crlen = svc_getnl(argv);
1435 if (svc_getnl(argv) != RPC_GSS_VERSION)
1436 goto auth_err;
1437 gc->gc_proc = svc_getnl(argv);
1438 gc->gc_seq = svc_getnl(argv);
1439 gc->gc_svc = svc_getnl(argv);
1440 if (svc_safe_getnetobj(argv, &gc->gc_ctx))
1441 goto auth_err;
1442 if (crlen != round_up_to_quad(gc->gc_ctx.len) + 5 * 4)
1443 goto auth_err;
1444
1445 if ((gc->gc_proc != RPC_GSS_PROC_DATA) && (rqstp->rq_proc != 0))
1446 goto auth_err;
1447
1448 *authp = rpc_autherr_badverf;
1449 switch (gc->gc_proc) {
1450 case RPC_GSS_PROC_INIT:
1451 case RPC_GSS_PROC_CONTINUE_INIT:
1452 if (use_gss_proxy(SVC_NET(rqstp)))
1453 return svcauth_gss_proxy_init(rqstp, gc, authp);
1454 else
1455 return svcauth_gss_legacy_init(rqstp, gc, authp);
1456 case RPC_GSS_PROC_DATA:
1457 case RPC_GSS_PROC_DESTROY:
1458
1459 *authp = rpcsec_gsserr_credproblem;
1460 rsci = gss_svc_searchbyctx(sn->rsc_cache, &gc->gc_ctx);
1461 if (!rsci)
1462 goto auth_err;
1463 switch (gss_verify_header(rqstp, rsci, rpcstart, gc, authp)) {
1464 case SVC_OK:
1465 break;
1466 case SVC_DENIED:
1467 goto auth_err;
1468 case SVC_DROP:
1469 goto drop;
1470 }
1471 break;
1472 default:
1473 *authp = rpc_autherr_rejectedcred;
1474 goto auth_err;
1475 }
1476
1477
1478 switch (gc->gc_proc) {
1479 case RPC_GSS_PROC_DESTROY:
1480 if (gss_write_verf(rqstp, rsci->mechctx, gc->gc_seq))
1481 goto auth_err;
1482 rsci->h.expiry_time = get_seconds();
1483 set_bit(CACHE_NEGATIVE, &rsci->h.flags);
1484 if (resv->iov_len + 4 > PAGE_SIZE)
1485 goto drop;
1486 svc_putnl(resv, RPC_SUCCESS);
1487 goto complete;
1488 case RPC_GSS_PROC_DATA:
1489 *authp = rpcsec_gsserr_ctxproblem;
1490 svcdata->verf_start = resv->iov_base + resv->iov_len;
1491 if (gss_write_verf(rqstp, rsci->mechctx, gc->gc_seq))
1492 goto auth_err;
1493 rqstp->rq_cred = rsci->cred;
1494 get_group_info(rsci->cred.cr_group_info);
1495 *authp = rpc_autherr_badcred;
1496 switch (gc->gc_svc) {
1497 case RPC_GSS_SVC_NONE:
1498 break;
1499 case RPC_GSS_SVC_INTEGRITY:
1500
1501 svc_putnl(resv, 0);
1502 svc_putnl(resv, 0);
1503 if (unwrap_integ_data(rqstp, &rqstp->rq_arg,
1504 gc->gc_seq, rsci->mechctx))
1505 goto garbage_args;
1506 rqstp->rq_auth_slack = RPC_MAX_AUTH_SIZE;
1507 break;
1508 case RPC_GSS_SVC_PRIVACY:
1509
1510 svc_putnl(resv, 0);
1511 svc_putnl(resv, 0);
1512 if (unwrap_priv_data(rqstp, &rqstp->rq_arg,
1513 gc->gc_seq, rsci->mechctx))
1514 goto garbage_args;
1515 rqstp->rq_auth_slack = RPC_MAX_AUTH_SIZE * 2;
1516 break;
1517 default:
1518 goto auth_err;
1519 }
1520 svcdata->rsci = rsci;
1521 cache_get(&rsci->h);
1522 rqstp->rq_cred.cr_flavor = gss_svc_to_pseudoflavor(
1523 rsci->mechctx->mech_type,
1524 GSS_C_QOP_DEFAULT,
1525 gc->gc_svc);
1526 ret = SVC_OK;
1527 goto out;
1528 }
1529garbage_args:
1530 ret = SVC_GARBAGE;
1531 goto out;
1532auth_err:
1533
1534 xdr_ressize_check(rqstp, reject_stat);
1535 ret = SVC_DENIED;
1536 goto out;
1537complete:
1538 ret = SVC_COMPLETE;
1539 goto out;
1540drop:
1541 ret = SVC_DROP;
1542out:
1543 if (rsci)
1544 cache_put(&rsci->h, sn->rsc_cache);
1545 return ret;
1546}
1547
1548static __be32 *
1549svcauth_gss_prepare_to_wrap(struct xdr_buf *resbuf, struct gss_svc_data *gsd)
1550{
1551 __be32 *p;
1552 u32 verf_len;
1553
1554 p = gsd->verf_start;
1555 gsd->verf_start = NULL;
1556
1557
1558 if (*(p-1) != rpc_success)
1559 return NULL;
1560
1561 p += 1;
1562 verf_len = ntohl(*p++);
1563 p += XDR_QUADLEN(verf_len);
1564
1565 memcpy(p, p + 2, 4);
1566
1567 if (*p != rpc_success) {
1568 resbuf->head[0].iov_len -= 2 * 4;
1569 return NULL;
1570 }
1571 p++;
1572 return p;
1573}
1574
1575static inline int
1576svcauth_gss_wrap_resp_integ(struct svc_rqst *rqstp)
1577{
1578 struct gss_svc_data *gsd = (struct gss_svc_data *)rqstp->rq_auth_data;
1579 struct rpc_gss_wire_cred *gc = &gsd->clcred;
1580 struct xdr_buf *resbuf = &rqstp->rq_res;
1581 struct xdr_buf integ_buf;
1582 struct xdr_netobj mic;
1583 struct kvec *resv;
1584 __be32 *p;
1585 int integ_offset, integ_len;
1586 int stat = -EINVAL;
1587
1588 p = svcauth_gss_prepare_to_wrap(resbuf, gsd);
1589 if (p == NULL)
1590 goto out;
1591 integ_offset = (u8 *)(p + 1) - (u8 *)resbuf->head[0].iov_base;
1592 integ_len = resbuf->len - integ_offset;
1593 BUG_ON(integ_len % 4);
1594 *p++ = htonl(integ_len);
1595 *p++ = htonl(gc->gc_seq);
1596 if (xdr_buf_subsegment(resbuf, &integ_buf, integ_offset, integ_len))
1597 BUG();
1598 if (resbuf->tail[0].iov_base == NULL) {
1599 if (resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE > PAGE_SIZE)
1600 goto out_err;
1601 resbuf->tail[0].iov_base = resbuf->head[0].iov_base
1602 + resbuf->head[0].iov_len;
1603 resbuf->tail[0].iov_len = 0;
1604 }
1605 resv = &resbuf->tail[0];
1606 mic.data = (u8 *)resv->iov_base + resv->iov_len + 4;
1607 if (gss_get_mic(gsd->rsci->mechctx, &integ_buf, &mic))
1608 goto out_err;
1609 svc_putnl(resv, mic.len);
1610 memset(mic.data + mic.len, 0,
1611 round_up_to_quad(mic.len) - mic.len);
1612 resv->iov_len += XDR_QUADLEN(mic.len) << 2;
1613
1614 resbuf->len += XDR_QUADLEN(mic.len) << 2;
1615 BUG_ON(resv->iov_len > PAGE_SIZE);
1616out:
1617 stat = 0;
1618out_err:
1619 return stat;
1620}
1621
1622static inline int
1623svcauth_gss_wrap_resp_priv(struct svc_rqst *rqstp)
1624{
1625 struct gss_svc_data *gsd = (struct gss_svc_data *)rqstp->rq_auth_data;
1626 struct rpc_gss_wire_cred *gc = &gsd->clcred;
1627 struct xdr_buf *resbuf = &rqstp->rq_res;
1628 struct page **inpages = NULL;
1629 __be32 *p, *len;
1630 int offset;
1631 int pad;
1632
1633 p = svcauth_gss_prepare_to_wrap(resbuf, gsd);
1634 if (p == NULL)
1635 return 0;
1636 len = p++;
1637 offset = (u8 *)p - (u8 *)resbuf->head[0].iov_base;
1638 *p++ = htonl(gc->gc_seq);
1639 inpages = resbuf->pages;
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650 if (resbuf->tail[0].iov_base) {
1651 BUG_ON(resbuf->tail[0].iov_base >= resbuf->head[0].iov_base
1652 + PAGE_SIZE);
1653 BUG_ON(resbuf->tail[0].iov_base < resbuf->head[0].iov_base);
1654 if (resbuf->tail[0].iov_len + resbuf->head[0].iov_len
1655 + 2 * RPC_MAX_AUTH_SIZE > PAGE_SIZE)
1656 return -ENOMEM;
1657 memmove(resbuf->tail[0].iov_base + RPC_MAX_AUTH_SIZE,
1658 resbuf->tail[0].iov_base,
1659 resbuf->tail[0].iov_len);
1660 resbuf->tail[0].iov_base += RPC_MAX_AUTH_SIZE;
1661 }
1662
1663
1664
1665
1666
1667
1668
1669 if (resbuf->tail[0].iov_base == NULL) {
1670 if (resbuf->head[0].iov_len + 2*RPC_MAX_AUTH_SIZE > PAGE_SIZE)
1671 return -ENOMEM;
1672 resbuf->tail[0].iov_base = resbuf->head[0].iov_base
1673 + resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE;
1674 resbuf->tail[0].iov_len = 0;
1675 }
1676 if (gss_wrap(gsd->rsci->mechctx, offset, resbuf, inpages))
1677 return -ENOMEM;
1678 *len = htonl(resbuf->len - offset);
1679 pad = 3 - ((resbuf->len - offset - 1)&3);
1680 p = (__be32 *)(resbuf->tail[0].iov_base + resbuf->tail[0].iov_len);
1681 memset(p, 0, pad);
1682 resbuf->tail[0].iov_len += pad;
1683 resbuf->len += pad;
1684 return 0;
1685}
1686
1687static int
1688svcauth_gss_release(struct svc_rqst *rqstp)
1689{
1690 struct gss_svc_data *gsd = (struct gss_svc_data *)rqstp->rq_auth_data;
1691 struct rpc_gss_wire_cred *gc = &gsd->clcred;
1692 struct xdr_buf *resbuf = &rqstp->rq_res;
1693 int stat = -EINVAL;
1694 struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id);
1695
1696 if (gc->gc_proc != RPC_GSS_PROC_DATA)
1697 goto out;
1698
1699 if (gsd->verf_start == NULL)
1700 goto out;
1701
1702
1703
1704 resbuf->len = total_buf_len(resbuf);
1705 switch (gc->gc_svc) {
1706 case RPC_GSS_SVC_NONE:
1707 break;
1708 case RPC_GSS_SVC_INTEGRITY:
1709 stat = svcauth_gss_wrap_resp_integ(rqstp);
1710 if (stat)
1711 goto out_err;
1712 break;
1713 case RPC_GSS_SVC_PRIVACY:
1714 stat = svcauth_gss_wrap_resp_priv(rqstp);
1715 if (stat)
1716 goto out_err;
1717 break;
1718
1719
1720
1721
1722 }
1723
1724out:
1725 stat = 0;
1726out_err:
1727 if (rqstp->rq_client)
1728 auth_domain_put(rqstp->rq_client);
1729 rqstp->rq_client = NULL;
1730 if (rqstp->rq_gssclient)
1731 auth_domain_put(rqstp->rq_gssclient);
1732 rqstp->rq_gssclient = NULL;
1733 if (rqstp->rq_cred.cr_group_info)
1734 put_group_info(rqstp->rq_cred.cr_group_info);
1735 rqstp->rq_cred.cr_group_info = NULL;
1736 if (gsd->rsci)
1737 cache_put(&gsd->rsci->h, sn->rsc_cache);
1738 gsd->rsci = NULL;
1739
1740 return stat;
1741}
1742
1743static void
1744svcauth_gss_domain_release(struct auth_domain *dom)
1745{
1746 struct gss_domain *gd = container_of(dom, struct gss_domain, h);
1747
1748 kfree(dom->name);
1749 kfree(gd);
1750}
1751
1752static struct auth_ops svcauthops_gss = {
1753 .name = "rpcsec_gss",
1754 .owner = THIS_MODULE,
1755 .flavour = RPC_AUTH_GSS,
1756 .accept = svcauth_gss_accept,
1757 .release = svcauth_gss_release,
1758 .domain_release = svcauth_gss_domain_release,
1759 .set_client = svcauth_gss_set_client,
1760};
1761
1762static int rsi_cache_create_net(struct net *net)
1763{
1764 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1765 struct cache_detail *cd;
1766 int err;
1767
1768 cd = cache_create_net(&rsi_cache_template, net);
1769 if (IS_ERR(cd))
1770 return PTR_ERR(cd);
1771 err = cache_register_net(cd, net);
1772 if (err) {
1773 cache_destroy_net(cd, net);
1774 return err;
1775 }
1776 sn->rsi_cache = cd;
1777 return 0;
1778}
1779
1780static void rsi_cache_destroy_net(struct net *net)
1781{
1782 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1783 struct cache_detail *cd = sn->rsi_cache;
1784
1785 sn->rsi_cache = NULL;
1786 cache_purge(cd);
1787 cache_unregister_net(cd, net);
1788 cache_destroy_net(cd, net);
1789}
1790
1791static int rsc_cache_create_net(struct net *net)
1792{
1793 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1794 struct cache_detail *cd;
1795 int err;
1796
1797 cd = cache_create_net(&rsc_cache_template, net);
1798 if (IS_ERR(cd))
1799 return PTR_ERR(cd);
1800 err = cache_register_net(cd, net);
1801 if (err) {
1802 cache_destroy_net(cd, net);
1803 return err;
1804 }
1805 sn->rsc_cache = cd;
1806 return 0;
1807}
1808
1809static void rsc_cache_destroy_net(struct net *net)
1810{
1811 struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
1812 struct cache_detail *cd = sn->rsc_cache;
1813
1814 sn->rsc_cache = NULL;
1815 cache_purge(cd);
1816 cache_unregister_net(cd, net);
1817 cache_destroy_net(cd, net);
1818}
1819
1820int
1821gss_svc_init_net(struct net *net)
1822{
1823 int rv;
1824
1825 rv = rsc_cache_create_net(net);
1826 if (rv)
1827 return rv;
1828 rv = rsi_cache_create_net(net);
1829 if (rv)
1830 goto out1;
1831 rv = create_use_gss_proxy_proc_entry(net);
1832 if (rv)
1833 goto out2;
1834 return 0;
1835out2:
1836 destroy_use_gss_proxy_proc_entry(net);
1837out1:
1838 rsc_cache_destroy_net(net);
1839 return rv;
1840}
1841
1842void
1843gss_svc_shutdown_net(struct net *net)
1844{
1845 destroy_use_gss_proxy_proc_entry(net);
1846 rsi_cache_destroy_net(net);
1847 rsc_cache_destroy_net(net);
1848}
1849
1850int
1851gss_svc_init(void)
1852{
1853 return svc_auth_register(RPC_AUTH_GSS, &svcauthops_gss);
1854}
1855
1856void
1857gss_svc_shutdown(void)
1858{
1859 svc_auth_unregister(RPC_AUTH_GSS);
1860}
1861