]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - net/sunrpc/auth.c
Merge branch 'for-4.9-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave...
[mirror_ubuntu-bionic-kernel.git] / net / sunrpc / auth.c
CommitLineData
1da177e4
LT
1/*
2 * linux/net/sunrpc/auth.c
3 *
4 * Generic RPC client authentication API.
5 *
6 * Copyright (C) 1996, Olaf Kirch <okir@monad.swb.de>
7 */
8
9#include <linux/types.h>
10#include <linux/sched.h>
11#include <linux/module.h>
12#include <linux/slab.h>
13#include <linux/errno.h>
25337fdc 14#include <linux/hash.h>
1da177e4 15#include <linux/sunrpc/clnt.h>
6a1a1e34 16#include <linux/sunrpc/gss_api.h>
1da177e4
LT
17#include <linux/spinlock.h>
18
f895b252 19#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
1da177e4
LT
20# define RPCDBG_FACILITY RPCDBG_AUTH
21#endif
22
241269bd
TM
23#define RPC_CREDCACHE_DEFAULT_HASHBITS (4)
24struct rpc_cred_cache {
25 struct hlist_head *hashtable;
26 unsigned int hashbits;
27 spinlock_t lock;
28};
29
30static unsigned int auth_hashbits = RPC_CREDCACHE_DEFAULT_HASHBITS;
31
fc1b356f 32static DEFINE_SPINLOCK(rpc_authflavor_lock);
f1c0a861 33static const struct rpc_authops *auth_flavors[RPC_AUTH_MAXFLAVOR] = {
1da177e4
LT
34 &authnull_ops, /* AUTH_NULL */
35 &authunix_ops, /* AUTH_UNIX */
36 NULL, /* others can be loadable modules */
37};
38
e092bdcd 39static LIST_HEAD(cred_unused);
f5c2187c 40static unsigned long number_cred_unused;
e092bdcd 41
db5fe265 42#define MAX_HASHTABLE_BITS (14)
8e4e15d4 43static int param_set_hashtbl_sz(const char *val, const struct kernel_param *kp)
241269bd
TM
44{
45 unsigned long num;
46 unsigned int nbits;
47 int ret;
48
49 if (!val)
50 goto out_inval;
00cfaa94 51 ret = kstrtoul(val, 0, &num);
241269bd
TM
52 if (ret == -EINVAL)
53 goto out_inval;
34ae685c 54 nbits = fls(num - 1);
241269bd
TM
55 if (nbits > MAX_HASHTABLE_BITS || nbits < 2)
56 goto out_inval;
57 *(unsigned int *)kp->arg = nbits;
58 return 0;
59out_inval:
60 return -EINVAL;
61}
62
8e4e15d4 63static int param_get_hashtbl_sz(char *buffer, const struct kernel_param *kp)
241269bd
TM
64{
65 unsigned int nbits;
66
67 nbits = *(unsigned int *)kp->arg;
68 return sprintf(buffer, "%u", 1U << nbits);
69}
70
71#define param_check_hashtbl_sz(name, p) __param_check(name, p, unsigned int);
72
9c27847d 73static const struct kernel_param_ops param_ops_hashtbl_sz = {
8e4e15d4
SR
74 .set = param_set_hashtbl_sz,
75 .get = param_get_hashtbl_sz,
76};
77
241269bd
TM
78module_param_named(auth_hashtable_size, auth_hashbits, hashtbl_sz, 0644);
79MODULE_PARM_DESC(auth_hashtable_size, "RPC credential cache hashtable size");
80
bae6746f
TM
81static unsigned long auth_max_cred_cachesize = ULONG_MAX;
82module_param(auth_max_cred_cachesize, ulong, 0644);
83MODULE_PARM_DESC(auth_max_cred_cachesize, "RPC credential maximum total cache size");
84
1da177e4
LT
85static u32
86pseudoflavor_to_flavor(u32 flavor) {
1c74a244 87 if (flavor > RPC_AUTH_MAXFLAVOR)
1da177e4
LT
88 return RPC_AUTH_GSS;
89 return flavor;
90}
91
92int
f1c0a861 93rpcauth_register(const struct rpc_authops *ops)
1da177e4
LT
94{
95 rpc_authflavor_t flavor;
fc1b356f 96 int ret = -EPERM;
1da177e4
LT
97
98 if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR)
99 return -EINVAL;
fc1b356f
TM
100 spin_lock(&rpc_authflavor_lock);
101 if (auth_flavors[flavor] == NULL) {
102 auth_flavors[flavor] = ops;
103 ret = 0;
104 }
105 spin_unlock(&rpc_authflavor_lock);
106 return ret;
1da177e4 107}
e8914c65 108EXPORT_SYMBOL_GPL(rpcauth_register);
1da177e4
LT
109
110int
f1c0a861 111rpcauth_unregister(const struct rpc_authops *ops)
1da177e4
LT
112{
113 rpc_authflavor_t flavor;
fc1b356f 114 int ret = -EPERM;
1da177e4
LT
115
116 if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR)
117 return -EINVAL;
fc1b356f
TM
118 spin_lock(&rpc_authflavor_lock);
119 if (auth_flavors[flavor] == ops) {
120 auth_flavors[flavor] = NULL;
121 ret = 0;
122 }
123 spin_unlock(&rpc_authflavor_lock);
124 return ret;
1da177e4 125}
e8914c65 126EXPORT_SYMBOL_GPL(rpcauth_unregister);
1da177e4 127
9568c5e9
CL
128/**
129 * rpcauth_get_pseudoflavor - check if security flavor is supported
130 * @flavor: a security flavor
131 * @info: a GSS mech OID, quality of protection, and service value
132 *
133 * Verifies that an appropriate kernel module is available or already loaded.
134 * Returns an equivalent pseudoflavor, or RPC_AUTH_MAXFLAVOR if "flavor" is
135 * not supported locally.
136 */
137rpc_authflavor_t
138rpcauth_get_pseudoflavor(rpc_authflavor_t flavor, struct rpcsec_gss_info *info)
139{
140 const struct rpc_authops *ops;
141 rpc_authflavor_t pseudoflavor;
142
143 ops = auth_flavors[flavor];
144 if (ops == NULL)
145 request_module("rpc-auth-%u", flavor);
146 spin_lock(&rpc_authflavor_lock);
147 ops = auth_flavors[flavor];
148 if (ops == NULL || !try_module_get(ops->owner)) {
149 spin_unlock(&rpc_authflavor_lock);
150 return RPC_AUTH_MAXFLAVOR;
151 }
152 spin_unlock(&rpc_authflavor_lock);
153
154 pseudoflavor = flavor;
155 if (ops->info2flavor != NULL)
156 pseudoflavor = ops->info2flavor(info);
157
158 module_put(ops->owner);
159 return pseudoflavor;
160}
161EXPORT_SYMBOL_GPL(rpcauth_get_pseudoflavor);
162
a77c806f
CL
163/**
164 * rpcauth_get_gssinfo - find GSS tuple matching a GSS pseudoflavor
165 * @pseudoflavor: GSS pseudoflavor to match
166 * @info: rpcsec_gss_info structure to fill in
167 *
168 * Returns zero and fills in "info" if pseudoflavor matches a
169 * supported mechanism.
170 */
171int
172rpcauth_get_gssinfo(rpc_authflavor_t pseudoflavor, struct rpcsec_gss_info *info)
173{
174 rpc_authflavor_t flavor = pseudoflavor_to_flavor(pseudoflavor);
175 const struct rpc_authops *ops;
176 int result;
177
1c74a244
CL
178 if (flavor >= RPC_AUTH_MAXFLAVOR)
179 return -EINVAL;
180
a77c806f
CL
181 ops = auth_flavors[flavor];
182 if (ops == NULL)
183 request_module("rpc-auth-%u", flavor);
184 spin_lock(&rpc_authflavor_lock);
185 ops = auth_flavors[flavor];
186 if (ops == NULL || !try_module_get(ops->owner)) {
187 spin_unlock(&rpc_authflavor_lock);
188 return -ENOENT;
189 }
190 spin_unlock(&rpc_authflavor_lock);
191
192 result = -ENOENT;
193 if (ops->flavor2info != NULL)
194 result = ops->flavor2info(pseudoflavor, info);
195
196 module_put(ops->owner);
197 return result;
198}
199EXPORT_SYMBOL_GPL(rpcauth_get_gssinfo);
200
6a1a1e34
CL
201/**
202 * rpcauth_list_flavors - discover registered flavors and pseudoflavors
203 * @array: array to fill in
204 * @size: size of "array"
205 *
206 * Returns the number of array items filled in, or a negative errno.
207 *
208 * The returned array is not sorted by any policy. Callers should not
209 * rely on the order of the items in the returned array.
210 */
211int
212rpcauth_list_flavors(rpc_authflavor_t *array, int size)
213{
214 rpc_authflavor_t flavor;
215 int result = 0;
216
217 spin_lock(&rpc_authflavor_lock);
218 for (flavor = 0; flavor < RPC_AUTH_MAXFLAVOR; flavor++) {
219 const struct rpc_authops *ops = auth_flavors[flavor];
220 rpc_authflavor_t pseudos[4];
221 int i, len;
222
223 if (result >= size) {
224 result = -ENOMEM;
225 break;
226 }
227
228 if (ops == NULL)
229 continue;
230 if (ops->list_pseudoflavors == NULL) {
231 array[result++] = ops->au_flavor;
232 continue;
233 }
234 len = ops->list_pseudoflavors(pseudos, ARRAY_SIZE(pseudos));
235 if (len < 0) {
236 result = len;
237 break;
238 }
239 for (i = 0; i < len; i++) {
240 if (result >= size) {
241 result = -ENOMEM;
242 break;
243 }
244 array[result++] = pseudos[i];
245 }
246 }
247 spin_unlock(&rpc_authflavor_lock);
248
249 dprintk("RPC: %s returns %d\n", __func__, result);
250 return result;
251}
252EXPORT_SYMBOL_GPL(rpcauth_list_flavors);
253
1da177e4 254struct rpc_auth *
c2190661 255rpcauth_create(struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
1da177e4
LT
256{
257 struct rpc_auth *auth;
f1c0a861 258 const struct rpc_authops *ops;
c2190661 259 u32 flavor = pseudoflavor_to_flavor(args->pseudoflavor);
1da177e4 260
f344f6df
OK
261 auth = ERR_PTR(-EINVAL);
262 if (flavor >= RPC_AUTH_MAXFLAVOR)
263 goto out;
264
f344f6df
OK
265 if ((ops = auth_flavors[flavor]) == NULL)
266 request_module("rpc-auth-%u", flavor);
fc1b356f
TM
267 spin_lock(&rpc_authflavor_lock);
268 ops = auth_flavors[flavor];
269 if (ops == NULL || !try_module_get(ops->owner)) {
270 spin_unlock(&rpc_authflavor_lock);
f344f6df 271 goto out;
fc1b356f
TM
272 }
273 spin_unlock(&rpc_authflavor_lock);
c2190661 274 auth = ops->create(args, clnt);
fc1b356f 275 module_put(ops->owner);
6a19275a
BF
276 if (IS_ERR(auth))
277 return auth;
1da177e4 278 if (clnt->cl_auth)
de7a8ce3 279 rpcauth_release(clnt->cl_auth);
1da177e4 280 clnt->cl_auth = auth;
f344f6df
OK
281
282out:
1da177e4
LT
283 return auth;
284}
e8914c65 285EXPORT_SYMBOL_GPL(rpcauth_create);
1da177e4
LT
286
287void
de7a8ce3 288rpcauth_release(struct rpc_auth *auth)
1da177e4
LT
289{
290 if (!atomic_dec_and_test(&auth->au_count))
291 return;
292 auth->au_ops->destroy(auth);
293}
294
295static DEFINE_SPINLOCK(rpc_credcache_lock);
296
31be5bf1
TM
297static void
298rpcauth_unhash_cred_locked(struct rpc_cred *cred)
299{
300 hlist_del_rcu(&cred->cr_hash);
4e857c58 301 smp_mb__before_atomic();
31be5bf1
TM
302 clear_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags);
303}
304
f0380f3d 305static int
9499b434
TM
306rpcauth_unhash_cred(struct rpc_cred *cred)
307{
308 spinlock_t *cache_lock;
f0380f3d 309 int ret;
9499b434
TM
310
311 cache_lock = &cred->cr_auth->au_credcache->lock;
312 spin_lock(cache_lock);
f0380f3d
TM
313 ret = atomic_read(&cred->cr_count) == 0;
314 if (ret)
9499b434
TM
315 rpcauth_unhash_cred_locked(cred);
316 spin_unlock(cache_lock);
f0380f3d 317 return ret;
9499b434
TM
318}
319
1da177e4
LT
320/*
321 * Initialize RPC credential cache
322 */
323int
f5c2187c 324rpcauth_init_credcache(struct rpc_auth *auth)
1da177e4
LT
325{
326 struct rpc_cred_cache *new;
988664a0 327 unsigned int hashsize;
1da177e4 328
8b3a7005 329 new = kmalloc(sizeof(*new), GFP_KERNEL);
1da177e4 330 if (!new)
241269bd
TM
331 goto out_nocache;
332 new->hashbits = auth_hashbits;
988664a0 333 hashsize = 1U << new->hashbits;
241269bd
TM
334 new->hashtable = kcalloc(hashsize, sizeof(new->hashtable[0]), GFP_KERNEL);
335 if (!new->hashtable)
336 goto out_nohashtbl;
9499b434 337 spin_lock_init(&new->lock);
1da177e4
LT
338 auth->au_credcache = new;
339 return 0;
241269bd
TM
340out_nohashtbl:
341 kfree(new);
342out_nocache:
343 return -ENOMEM;
1da177e4 344}
e8914c65 345EXPORT_SYMBOL_GPL(rpcauth_init_credcache);
1da177e4 346
4de6caa2
AA
347/*
348 * Setup a credential key lifetime timeout notification
349 */
350int
351rpcauth_key_timeout_notify(struct rpc_auth *auth, struct rpc_cred *cred)
352{
353 if (!cred->cr_auth->au_ops->key_timeout)
354 return 0;
355 return cred->cr_auth->au_ops->key_timeout(auth, cred);
356}
357EXPORT_SYMBOL_GPL(rpcauth_key_timeout_notify);
358
359bool
ce52914e 360rpcauth_cred_key_to_expire(struct rpc_auth *auth, struct rpc_cred *cred)
4de6caa2 361{
ce52914e
SM
362 if (auth->au_flags & RPCAUTH_AUTH_NO_CRKEY_TIMEOUT)
363 return false;
4de6caa2
AA
364 if (!cred->cr_ops->crkey_to_expire)
365 return false;
366 return cred->cr_ops->crkey_to_expire(cred);
367}
368EXPORT_SYMBOL_GPL(rpcauth_cred_key_to_expire);
369
a0337d1d
JL
370char *
371rpcauth_stringify_acceptor(struct rpc_cred *cred)
372{
373 if (!cred->cr_ops->crstringify_acceptor)
374 return NULL;
375 return cred->cr_ops->crstringify_acceptor(cred);
376}
377EXPORT_SYMBOL_GPL(rpcauth_stringify_acceptor);
378
1da177e4
LT
379/*
380 * Destroy a list of credentials
381 */
382static inline
e092bdcd 383void rpcauth_destroy_credlist(struct list_head *head)
1da177e4
LT
384{
385 struct rpc_cred *cred;
386
e092bdcd
TM
387 while (!list_empty(head)) {
388 cred = list_entry(head->next, struct rpc_cred, cr_lru);
389 list_del_init(&cred->cr_lru);
1da177e4
LT
390 put_rpccred(cred);
391 }
392}
393
394/*
395 * Clear the RPC credential cache, and delete those credentials
396 * that are not referenced.
397 */
398void
3ab9bb72 399rpcauth_clear_credcache(struct rpc_cred_cache *cache)
1da177e4 400{
e092bdcd
TM
401 LIST_HEAD(free);
402 struct hlist_head *head;
1da177e4 403 struct rpc_cred *cred;
988664a0 404 unsigned int hashsize = 1U << cache->hashbits;
1da177e4
LT
405 int i;
406
407 spin_lock(&rpc_credcache_lock);
9499b434 408 spin_lock(&cache->lock);
988664a0 409 for (i = 0; i < hashsize; i++) {
e092bdcd
TM
410 head = &cache->hashtable[i];
411 while (!hlist_empty(head)) {
412 cred = hlist_entry(head->first, struct rpc_cred, cr_hash);
413 get_rpccred(cred);
f5c2187c
TM
414 if (!list_empty(&cred->cr_lru)) {
415 list_del(&cred->cr_lru);
416 number_cred_unused--;
417 }
418 list_add_tail(&cred->cr_lru, &free);
31be5bf1 419 rpcauth_unhash_cred_locked(cred);
1da177e4
LT
420 }
421 }
9499b434 422 spin_unlock(&cache->lock);
1da177e4
LT
423 spin_unlock(&rpc_credcache_lock);
424 rpcauth_destroy_credlist(&free);
425}
426
3ab9bb72
TM
427/*
428 * Destroy the RPC credential cache
429 */
430void
431rpcauth_destroy_credcache(struct rpc_auth *auth)
432{
433 struct rpc_cred_cache *cache = auth->au_credcache;
434
435 if (cache) {
436 auth->au_credcache = NULL;
437 rpcauth_clear_credcache(cache);
241269bd 438 kfree(cache->hashtable);
3ab9bb72
TM
439 kfree(cache);
440 }
441}
e8914c65 442EXPORT_SYMBOL_GPL(rpcauth_destroy_credcache);
3ab9bb72 443
d2b83141
TM
444
445#define RPC_AUTH_EXPIRY_MORATORIUM (60 * HZ)
446
e092bdcd
TM
447/*
448 * Remove stale credentials. Avoid sleeping inside the loop.
449 */
70534a73 450static long
f5c2187c 451rpcauth_prune_expired(struct list_head *free, int nr_to_scan)
1da177e4 452{
9499b434 453 spinlock_t *cache_lock;
eac0d18d 454 struct rpc_cred *cred, *next;
d2b83141 455 unsigned long expired = jiffies - RPC_AUTH_EXPIRY_MORATORIUM;
70534a73 456 long freed = 0;
e092bdcd 457
eac0d18d
TM
458 list_for_each_entry_safe(cred, next, &cred_unused, cr_lru) {
459
20673406
TM
460 if (nr_to_scan-- == 0)
461 break;
93a05e65
TM
462 /*
463 * Enforce a 60 second garbage collection moratorium
464 * Note that the cred_unused list must be time-ordered.
465 */
3d7b0894 466 if (time_in_range(cred->cr_expire, expired, jiffies) &&
eac0d18d 467 test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) != 0)
70534a73 468 break;
eac0d18d 469
e092bdcd 470 list_del_init(&cred->cr_lru);
f5c2187c 471 number_cred_unused--;
70534a73 472 freed++;
e092bdcd
TM
473 if (atomic_read(&cred->cr_count) != 0)
474 continue;
eac0d18d 475
9499b434
TM
476 cache_lock = &cred->cr_auth->au_credcache->lock;
477 spin_lock(cache_lock);
478 if (atomic_read(&cred->cr_count) == 0) {
479 get_rpccred(cred);
480 list_add_tail(&cred->cr_lru, free);
481 rpcauth_unhash_cred_locked(cred);
482 }
483 spin_unlock(cache_lock);
1da177e4 484 }
70534a73 485 return freed;
1da177e4
LT
486}
487
bae6746f
TM
488static unsigned long
489rpcauth_cache_do_shrink(int nr_to_scan)
490{
491 LIST_HEAD(free);
492 unsigned long freed;
493
494 spin_lock(&rpc_credcache_lock);
495 freed = rpcauth_prune_expired(&free, nr_to_scan);
496 spin_unlock(&rpc_credcache_lock);
497 rpcauth_destroy_credlist(&free);
498
499 return freed;
500}
501
1da177e4 502/*
f5c2187c 503 * Run memory cache shrinker.
1da177e4 504 */
70534a73
DC
505static unsigned long
506rpcauth_cache_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
507
1da177e4 508{
70534a73
DC
509 if ((sc->gfp_mask & GFP_KERNEL) != GFP_KERNEL)
510 return SHRINK_STOP;
f5c2187c 511
70534a73 512 /* nothing left, don't come back */
f5c2187c 513 if (list_empty(&cred_unused))
70534a73
DC
514 return SHRINK_STOP;
515
bae6746f 516 return rpcauth_cache_do_shrink(sc->nr_to_scan);
70534a73
DC
517}
518
519static unsigned long
520rpcauth_cache_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
521
522{
523 return (number_cred_unused / 100) * sysctl_vfs_cache_pressure;
1da177e4
LT
524}
525
bae6746f
TM
526static void
527rpcauth_cache_enforce_limit(void)
528{
529 unsigned long diff;
530 unsigned int nr_to_scan;
531
532 if (number_cred_unused <= auth_max_cred_cachesize)
533 return;
534 diff = number_cred_unused - auth_max_cred_cachesize;
535 nr_to_scan = 100;
536 if (diff < nr_to_scan)
537 nr_to_scan = diff;
538 rpcauth_cache_do_shrink(nr_to_scan);
539}
540
1da177e4
LT
541/*
542 * Look up a process' credentials in the authentication cache
543 */
544struct rpc_cred *
545rpcauth_lookup_credcache(struct rpc_auth *auth, struct auth_cred * acred,
3c6e0bc8 546 int flags, gfp_t gfp)
1da177e4 547{
e092bdcd 548 LIST_HEAD(free);
1da177e4 549 struct rpc_cred_cache *cache = auth->au_credcache;
31be5bf1
TM
550 struct rpc_cred *cred = NULL,
551 *entry, *new;
25337fdc
TM
552 unsigned int nr;
553
66cbd4ba 554 nr = auth->au_ops->hash_cred(acred, cache->hashbits);
1da177e4 555
31be5bf1 556 rcu_read_lock();
b67bfe0d 557 hlist_for_each_entry_rcu(entry, &cache->hashtable[nr], cr_hash) {
e092bdcd
TM
558 if (!entry->cr_ops->crmatch(acred, entry, flags))
559 continue;
bd956080
N
560 if (flags & RPCAUTH_LOOKUP_RCU) {
561 if (test_bit(RPCAUTH_CRED_HASHED, &entry->cr_flags) &&
562 !test_bit(RPCAUTH_CRED_NEW, &entry->cr_flags))
563 cred = entry;
564 break;
565 }
9499b434 566 spin_lock(&cache->lock);
31be5bf1 567 if (test_bit(RPCAUTH_CRED_HASHED, &entry->cr_flags) == 0) {
9499b434 568 spin_unlock(&cache->lock);
31be5bf1
TM
569 continue;
570 }
e092bdcd 571 cred = get_rpccred(entry);
9499b434 572 spin_unlock(&cache->lock);
e092bdcd 573 break;
1da177e4 574 }
31be5bf1
TM
575 rcu_read_unlock();
576
9499b434 577 if (cred != NULL)
31be5bf1 578 goto found;
1da177e4 579
bd956080
N
580 if (flags & RPCAUTH_LOOKUP_RCU)
581 return ERR_PTR(-ECHILD);
582
3c6e0bc8 583 new = auth->au_ops->crcreate(auth, acred, flags, gfp);
31be5bf1
TM
584 if (IS_ERR(new)) {
585 cred = new;
586 goto out;
587 }
1da177e4 588
9499b434 589 spin_lock(&cache->lock);
b67bfe0d 590 hlist_for_each_entry(entry, &cache->hashtable[nr], cr_hash) {
31be5bf1
TM
591 if (!entry->cr_ops->crmatch(acred, entry, flags))
592 continue;
593 cred = get_rpccred(entry);
594 break;
595 }
596 if (cred == NULL) {
5fe4755e 597 cred = new;
31be5bf1
TM
598 set_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags);
599 hlist_add_head_rcu(&cred->cr_hash, &cache->hashtable[nr]);
600 } else
601 list_add_tail(&new->cr_lru, &free);
9499b434 602 spin_unlock(&cache->lock);
bae6746f 603 rpcauth_cache_enforce_limit();
31be5bf1 604found:
f64f9e71
JP
605 if (test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags) &&
606 cred->cr_ops->cr_init != NULL &&
607 !(flags & RPCAUTH_LOOKUP_NEW)) {
fba3bad4
TM
608 int res = cred->cr_ops->cr_init(auth, cred);
609 if (res < 0) {
610 put_rpccred(cred);
611 cred = ERR_PTR(res);
612 }
1da177e4 613 }
31be5bf1
TM
614 rpcauth_destroy_credlist(&free);
615out:
616 return cred;
1da177e4 617}
e8914c65 618EXPORT_SYMBOL_GPL(rpcauth_lookup_credcache);
1da177e4
LT
619
620struct rpc_cred *
8a317760 621rpcauth_lookupcred(struct rpc_auth *auth, int flags)
1da177e4 622{
86a264ab 623 struct auth_cred acred;
1da177e4 624 struct rpc_cred *ret;
86a264ab 625 const struct cred *cred = current_cred();
1da177e4 626
46121cf7 627 dprintk("RPC: looking up %s cred\n",
1da177e4 628 auth->au_ops->au_name);
86a264ab
DH
629
630 memset(&acred, 0, sizeof(acred));
631 acred.uid = cred->fsuid;
632 acred.gid = cred->fsgid;
122a8cda 633 acred.group_info = cred->group_info;
8a317760 634 ret = auth->au_ops->lookup_cred(auth, &acred, flags);
1da177e4
LT
635 return ret;
636}
66b06860 637EXPORT_SYMBOL_GPL(rpcauth_lookupcred);
1da177e4 638
5fe4755e
TM
639void
640rpcauth_init_cred(struct rpc_cred *cred, const struct auth_cred *acred,
641 struct rpc_auth *auth, const struct rpc_credops *ops)
642{
643 INIT_HLIST_NODE(&cred->cr_hash);
e092bdcd 644 INIT_LIST_HEAD(&cred->cr_lru);
5fe4755e
TM
645 atomic_set(&cred->cr_count, 1);
646 cred->cr_auth = auth;
647 cred->cr_ops = ops;
648 cred->cr_expire = jiffies;
f895b252 649#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
5fe4755e
TM
650 cred->cr_magic = RPCAUTH_CRED_MAGIC;
651#endif
652 cred->cr_uid = acred->uid;
653}
e8914c65 654EXPORT_SYMBOL_GPL(rpcauth_init_cred);
5fe4755e 655
8572b8e2 656struct rpc_cred *
5d351754 657rpcauth_generic_bind_cred(struct rpc_task *task, struct rpc_cred *cred, int lookupflags)
4ccda2cd 658{
4ccda2cd
TM
659 dprintk("RPC: %5u holding %s cred %p\n", task->tk_pid,
660 cred->cr_auth->au_ops->au_name, cred);
8572b8e2 661 return get_rpccred(cred);
4ccda2cd 662}
5c691044 663EXPORT_SYMBOL_GPL(rpcauth_generic_bind_cred);
4ccda2cd 664
8572b8e2 665static struct rpc_cred *
5d351754 666rpcauth_bind_root_cred(struct rpc_task *task, int lookupflags)
1da177e4 667{
1be27f36 668 struct rpc_auth *auth = task->tk_client->cl_auth;
1da177e4 669 struct auth_cred acred = {
bf37f794
EB
670 .uid = GLOBAL_ROOT_UID,
671 .gid = GLOBAL_ROOT_GID,
1da177e4 672 };
1da177e4 673
46121cf7 674 dprintk("RPC: %5u looking up %s cred\n",
1be27f36 675 task->tk_pid, task->tk_client->cl_auth->au_ops->au_name);
8572b8e2 676 return auth->au_ops->lookup_cred(auth, &acred, lookupflags);
af093835
TM
677}
678
8572b8e2 679static struct rpc_cred *
5d351754 680rpcauth_bind_new_cred(struct rpc_task *task, int lookupflags)
af093835
TM
681{
682 struct rpc_auth *auth = task->tk_client->cl_auth;
af093835
TM
683
684 dprintk("RPC: %5u looking up %s cred\n",
685 task->tk_pid, auth->au_ops->au_name);
8572b8e2 686 return rpcauth_lookupcred(auth, lookupflags);
1da177e4
LT
687}
688
a17c2153 689static int
4ccda2cd 690rpcauth_bindcred(struct rpc_task *task, struct rpc_cred *cred, int flags)
1da177e4 691{
a17c2153 692 struct rpc_rqst *req = task->tk_rqstp;
8572b8e2 693 struct rpc_cred *new;
5d351754
TM
694 int lookupflags = 0;
695
696 if (flags & RPC_TASK_ASYNC)
697 lookupflags |= RPCAUTH_LOOKUP_NEW;
4ccda2cd 698 if (cred != NULL)
8572b8e2 699 new = cred->cr_ops->crbind(task, cred, lookupflags);
4ccda2cd 700 else if (flags & RPC_TASK_ROOTCREDS)
8572b8e2 701 new = rpcauth_bind_root_cred(task, lookupflags);
4ccda2cd 702 else
8572b8e2
TM
703 new = rpcauth_bind_new_cred(task, lookupflags);
704 if (IS_ERR(new))
705 return PTR_ERR(new);
9a8f6b5e 706 put_rpccred(req->rq_cred);
a17c2153 707 req->rq_cred = new;
8572b8e2 708 return 0;
1da177e4
LT
709}
710
711void
712put_rpccred(struct rpc_cred *cred)
713{
9a8f6b5e
TM
714 if (cred == NULL)
715 return;
e092bdcd 716 /* Fast path for unhashed credentials */
f0380f3d
TM
717 if (test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) == 0) {
718 if (atomic_dec_and_test(&cred->cr_count))
719 cred->cr_ops->crdestroy(cred);
1da177e4 720 return;
f0380f3d
TM
721 }
722
e092bdcd
TM
723 if (!atomic_dec_and_lock(&cred->cr_count, &rpc_credcache_lock))
724 return;
f5c2187c
TM
725 if (!list_empty(&cred->cr_lru)) {
726 number_cred_unused--;
e092bdcd 727 list_del_init(&cred->cr_lru);
f5c2187c 728 }
5f707eb4 729 if (test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) != 0) {
f0380f3d
TM
730 if (test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0) {
731 cred->cr_expire = jiffies;
732 list_add_tail(&cred->cr_lru, &cred_unused);
733 number_cred_unused++;
734 goto out_nodestroy;
735 }
736 if (!rpcauth_unhash_cred(cred)) {
737 /* We were hashed and someone looked us up... */
738 goto out_nodestroy;
739 }
e092bdcd
TM
740 }
741 spin_unlock(&rpc_credcache_lock);
1da177e4 742 cred->cr_ops->crdestroy(cred);
f0380f3d
TM
743 return;
744out_nodestroy:
745 spin_unlock(&rpc_credcache_lock);
1da177e4 746}
e8914c65 747EXPORT_SYMBOL_GPL(put_rpccred);
1da177e4 748
d8ed029d
AD
749__be32 *
750rpcauth_marshcred(struct rpc_task *task, __be32 *p)
1da177e4 751{
a17c2153 752 struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1da177e4 753
46121cf7 754 dprintk("RPC: %5u marshaling %s cred %p\n",
1be27f36 755 task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
0bbacc40 756
1da177e4
LT
757 return cred->cr_ops->crmarshal(task, p);
758}
759
d8ed029d
AD
760__be32 *
761rpcauth_checkverf(struct rpc_task *task, __be32 *p)
1da177e4 762{
a17c2153 763 struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1da177e4 764
46121cf7 765 dprintk("RPC: %5u validating %s cred %p\n",
1be27f36 766 task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
0bbacc40 767
1da177e4
LT
768 return cred->cr_ops->crvalidate(task, p);
769}
770
9f06c719
CL
771static void rpcauth_wrap_req_encode(kxdreproc_t encode, struct rpc_rqst *rqstp,
772 __be32 *data, void *obj)
773{
774 struct xdr_stream xdr;
775
776 xdr_init_encode(&xdr, &rqstp->rq_snd_buf, data);
777 encode(rqstp, &xdr, obj);
778}
779
1da177e4 780int
9f06c719 781rpcauth_wrap_req(struct rpc_task *task, kxdreproc_t encode, void *rqstp,
d8ed029d 782 __be32 *data, void *obj)
1da177e4 783{
a17c2153 784 struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1da177e4 785
46121cf7 786 dprintk("RPC: %5u using %s cred %p to wrap rpc data\n",
1da177e4
LT
787 task->tk_pid, cred->cr_ops->cr_name, cred);
788 if (cred->cr_ops->crwrap_req)
789 return cred->cr_ops->crwrap_req(task, encode, rqstp, data, obj);
790 /* By default, we encode the arguments normally. */
9f06c719
CL
791 rpcauth_wrap_req_encode(encode, rqstp, data, obj);
792 return 0;
1da177e4
LT
793}
794
bf269551
CL
795static int
796rpcauth_unwrap_req_decode(kxdrdproc_t decode, struct rpc_rqst *rqstp,
797 __be32 *data, void *obj)
798{
799 struct xdr_stream xdr;
800
801 xdr_init_decode(&xdr, &rqstp->rq_rcv_buf, data);
802 return decode(rqstp, &xdr, obj);
803}
804
1da177e4 805int
bf269551 806rpcauth_unwrap_resp(struct rpc_task *task, kxdrdproc_t decode, void *rqstp,
d8ed029d 807 __be32 *data, void *obj)
1da177e4 808{
a17c2153 809 struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1da177e4 810
46121cf7 811 dprintk("RPC: %5u using %s cred %p to unwrap rpc data\n",
1da177e4
LT
812 task->tk_pid, cred->cr_ops->cr_name, cred);
813 if (cred->cr_ops->crunwrap_resp)
814 return cred->cr_ops->crunwrap_resp(task, decode, rqstp,
815 data, obj);
816 /* By default, we decode the arguments normally. */
bf269551 817 return rpcauth_unwrap_req_decode(decode, rqstp, data, obj);
1da177e4
LT
818}
819
820int
821rpcauth_refreshcred(struct rpc_task *task)
822{
9a84d380 823 struct rpc_cred *cred;
1da177e4
LT
824 int err;
825
a17c2153
TM
826 cred = task->tk_rqstp->rq_cred;
827 if (cred == NULL) {
828 err = rpcauth_bindcred(task, task->tk_msg.rpc_cred, task->tk_flags);
829 if (err < 0)
830 goto out;
831 cred = task->tk_rqstp->rq_cred;
f81c6224 832 }
46121cf7 833 dprintk("RPC: %5u refreshing %s cred %p\n",
1be27f36 834 task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
0bbacc40 835
1da177e4 836 err = cred->cr_ops->crrefresh(task);
a17c2153 837out:
1da177e4
LT
838 if (err < 0)
839 task->tk_status = err;
840 return err;
841}
842
843void
844rpcauth_invalcred(struct rpc_task *task)
845{
a17c2153 846 struct rpc_cred *cred = task->tk_rqstp->rq_cred;
fc432dd9 847
46121cf7 848 dprintk("RPC: %5u invalidating %s cred %p\n",
1be27f36 849 task->tk_pid, cred->cr_auth->au_ops->au_name, cred);
fc432dd9
TM
850 if (cred)
851 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1da177e4
LT
852}
853
854int
855rpcauth_uptodatecred(struct rpc_task *task)
856{
a17c2153 857 struct rpc_cred *cred = task->tk_rqstp->rq_cred;
fc432dd9
TM
858
859 return cred == NULL ||
860 test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0;
1da177e4 861}
f5c2187c 862
8e1f936b 863static struct shrinker rpc_cred_shrinker = {
70534a73
DC
864 .count_objects = rpcauth_cache_shrink_count,
865 .scan_objects = rpcauth_cache_shrink_scan,
8e1f936b
RR
866 .seeks = DEFAULT_SEEKS,
867};
f5c2187c 868
5d8d9a4d 869int __init rpcauth_init_module(void)
f5c2187c 870{
5d8d9a4d
TM
871 int err;
872
873 err = rpc_init_authunix();
874 if (err < 0)
875 goto out1;
876 err = rpc_init_generic_auth();
877 if (err < 0)
878 goto out2;
8e1f936b 879 register_shrinker(&rpc_cred_shrinker);
5d8d9a4d
TM
880 return 0;
881out2:
882 rpc_destroy_authunix();
883out1:
884 return err;
f5c2187c
TM
885}
886
c135e84a 887void rpcauth_remove_module(void)
f5c2187c 888{
5d8d9a4d
TM
889 rpc_destroy_authunix();
890 rpc_destroy_generic_auth();
8e1f936b 891 unregister_shrinker(&rpc_cred_shrinker);
f5c2187c 892}