]>
Commit | Line | Data |
---|---|---|
9a559efd TM |
1 | /* |
2 | * Generic RPC credential | |
3 | * | |
4 | * Copyright (C) 2008, Trond Myklebust <Trond.Myklebust@netapp.com> | |
5 | */ | |
6 | ||
7 | #include <linux/err.h> | |
5a0e3ad6 | 8 | #include <linux/slab.h> |
9a559efd TM |
9 | #include <linux/types.h> |
10 | #include <linux/module.h> | |
11 | #include <linux/sched.h> | |
12 | #include <linux/sunrpc/auth.h> | |
13 | #include <linux/sunrpc/clnt.h> | |
14 | #include <linux/sunrpc/debug.h> | |
15 | #include <linux/sunrpc/sched.h> | |
16 | ||
f895b252 | 17 | #if IS_ENABLED(CONFIG_SUNRPC_DEBUG) |
9a559efd TM |
18 | # define RPCDBG_FACILITY RPCDBG_AUTH |
19 | #endif | |
20 | ||
bf37f794 EB |
21 | #define RPC_MACHINE_CRED_USERID GLOBAL_ROOT_UID |
22 | #define RPC_MACHINE_CRED_GROUPID GLOBAL_ROOT_GID | |
7c67db3a | 23 | |
9a559efd TM |
24 | struct generic_cred { |
25 | struct rpc_cred gc_base; | |
26 | struct auth_cred acred; | |
27 | }; | |
28 | ||
29 | static struct rpc_auth generic_auth; | |
9a559efd TM |
30 | static const struct rpc_credops generic_credops; |
31 | ||
32 | /* | |
33 | * Public call interface | |
34 | */ | |
35 | struct rpc_cred *rpc_lookup_cred(void) | |
36 | { | |
37 | return rpcauth_lookupcred(&generic_auth, 0); | |
38 | } | |
39 | EXPORT_SYMBOL_GPL(rpc_lookup_cred); | |
40 | ||
c065d229 WAA |
41 | struct rpc_cred * |
42 | rpc_lookup_generic_cred(struct auth_cred *acred, int flags, gfp_t gfp) | |
43 | { | |
44 | return rpcauth_lookup_credcache(&generic_auth, acred, flags, gfp); | |
45 | } | |
46 | EXPORT_SYMBOL_GPL(rpc_lookup_generic_cred); | |
47 | ||
bd956080 N |
48 | struct rpc_cred *rpc_lookup_cred_nonblock(void) |
49 | { | |
50 | return rpcauth_lookupcred(&generic_auth, RPCAUTH_LOOKUP_RCU); | |
51 | } | |
52 | EXPORT_SYMBOL_GPL(rpc_lookup_cred_nonblock); | |
53 | ||
7c67db3a TM |
54 | /* |
55 | * Public call interface for looking up machine creds. | |
56 | */ | |
68c97153 | 57 | struct rpc_cred *rpc_lookup_machine_cred(const char *service_name) |
7c67db3a TM |
58 | { |
59 | struct auth_cred acred = { | |
b4528762 TM |
60 | .uid = RPC_MACHINE_CRED_USERID, |
61 | .gid = RPC_MACHINE_CRED_GROUPID, | |
68c97153 | 62 | .principal = service_name, |
7c67db3a TM |
63 | .machine_cred = 1, |
64 | }; | |
65 | ||
68c97153 TM |
66 | dprintk("RPC: looking up machine cred for service %s\n", |
67 | service_name); | |
7c67db3a TM |
68 | return generic_auth.au_ops->lookup_cred(&generic_auth, &acred, 0); |
69 | } | |
70 | EXPORT_SYMBOL_GPL(rpc_lookup_machine_cred); | |
71 | ||
8572b8e2 TM |
72 | static struct rpc_cred *generic_bind_cred(struct rpc_task *task, |
73 | struct rpc_cred *cred, int lookupflags) | |
5c691044 TM |
74 | { |
75 | struct rpc_auth *auth = task->tk_client->cl_auth; | |
76 | struct auth_cred *acred = &container_of(cred, struct generic_cred, gc_base)->acred; | |
5c691044 | 77 | |
8572b8e2 | 78 | return auth->au_ops->lookup_cred(auth, acred, lookupflags); |
5c691044 TM |
79 | } |
80 | ||
9a559efd TM |
81 | /* |
82 | * Lookup generic creds for current process | |
83 | */ | |
84 | static struct rpc_cred * | |
85 | generic_lookup_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags) | |
86 | { | |
3c6e0bc8 | 87 | return rpcauth_lookup_credcache(&generic_auth, acred, flags, GFP_KERNEL); |
9a559efd TM |
88 | } |
89 | ||
90 | static struct rpc_cred * | |
3c6e0bc8 | 91 | generic_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags, gfp_t gfp) |
9a559efd TM |
92 | { |
93 | struct generic_cred *gcred; | |
94 | ||
3c6e0bc8 | 95 | gcred = kmalloc(sizeof(*gcred), gfp); |
9a559efd TM |
96 | if (gcred == NULL) |
97 | return ERR_PTR(-ENOMEM); | |
98 | ||
99 | rpcauth_init_cred(&gcred->gc_base, acred, &generic_auth, &generic_credops); | |
100 | gcred->gc_base.cr_flags = 1UL << RPCAUTH_CRED_UPTODATE; | |
101 | ||
102 | gcred->acred.uid = acred->uid; | |
103 | gcred->acred.gid = acred->gid; | |
104 | gcred->acred.group_info = acred->group_info; | |
4de6caa2 | 105 | gcred->acred.ac_flags = 0; |
9a559efd TM |
106 | if (gcred->acred.group_info != NULL) |
107 | get_group_info(gcred->acred.group_info); | |
7c67db3a | 108 | gcred->acred.machine_cred = acred->machine_cred; |
875ad3f8 | 109 | gcred->acred.principal = acred->principal; |
9a559efd | 110 | |
7c67db3a TM |
111 | dprintk("RPC: allocated %s cred %p for uid %d gid %d\n", |
112 | gcred->acred.machine_cred ? "machine" : "generic", | |
cdba321e EB |
113 | gcred, |
114 | from_kuid(&init_user_ns, acred->uid), | |
115 | from_kgid(&init_user_ns, acred->gid)); | |
9a559efd TM |
116 | return &gcred->gc_base; |
117 | } | |
118 | ||
119 | static void | |
120 | generic_free_cred(struct rpc_cred *cred) | |
121 | { | |
122 | struct generic_cred *gcred = container_of(cred, struct generic_cred, gc_base); | |
123 | ||
124 | dprintk("RPC: generic_free_cred %p\n", gcred); | |
125 | if (gcred->acred.group_info != NULL) | |
126 | put_group_info(gcred->acred.group_info); | |
127 | kfree(gcred); | |
128 | } | |
129 | ||
130 | static void | |
131 | generic_free_cred_callback(struct rcu_head *head) | |
132 | { | |
133 | struct rpc_cred *cred = container_of(head, struct rpc_cred, cr_rcu); | |
134 | generic_free_cred(cred); | |
135 | } | |
136 | ||
137 | static void | |
138 | generic_destroy_cred(struct rpc_cred *cred) | |
139 | { | |
140 | call_rcu(&cred->cr_rcu, generic_free_cred_callback); | |
141 | } | |
142 | ||
875ad3f8 TM |
143 | static int |
144 | machine_cred_match(struct auth_cred *acred, struct generic_cred *gcred, int flags) | |
145 | { | |
146 | if (!gcred->acred.machine_cred || | |
147 | gcred->acred.principal != acred->principal || | |
0b4d51b0 EB |
148 | !uid_eq(gcred->acred.uid, acred->uid) || |
149 | !gid_eq(gcred->acred.gid, acred->gid)) | |
875ad3f8 TM |
150 | return 0; |
151 | return 1; | |
152 | } | |
153 | ||
9a559efd TM |
154 | /* |
155 | * Match credentials against current process creds. | |
156 | */ | |
157 | static int | |
158 | generic_match(struct auth_cred *acred, struct rpc_cred *cred, int flags) | |
159 | { | |
160 | struct generic_cred *gcred = container_of(cred, struct generic_cred, gc_base); | |
23918b03 | 161 | int i; |
9a559efd | 162 | |
875ad3f8 TM |
163 | if (acred->machine_cred) |
164 | return machine_cred_match(acred, gcred, flags); | |
165 | ||
0b4d51b0 EB |
166 | if (!uid_eq(gcred->acred.uid, acred->uid) || |
167 | !gid_eq(gcred->acred.gid, acred->gid) || | |
875ad3f8 | 168 | gcred->acred.machine_cred != 0) |
23918b03 TM |
169 | goto out_nomatch; |
170 | ||
171 | /* Optimisation in the case where pointers are identical... */ | |
172 | if (gcred->acred.group_info == acred->group_info) | |
173 | goto out_match; | |
174 | ||
175 | /* Slow path... */ | |
176 | if (gcred->acred.group_info->ngroups != acred->group_info->ngroups) | |
177 | goto out_nomatch; | |
178 | for (i = 0; i < gcred->acred.group_info->ngroups; i++) { | |
ae2975bc EB |
179 | if (!gid_eq(GROUP_AT(gcred->acred.group_info, i), |
180 | GROUP_AT(acred->group_info, i))) | |
23918b03 TM |
181 | goto out_nomatch; |
182 | } | |
183 | out_match: | |
9a559efd | 184 | return 1; |
23918b03 TM |
185 | out_nomatch: |
186 | return 0; | |
9a559efd TM |
187 | } |
188 | ||
5d8d9a4d | 189 | int __init rpc_init_generic_auth(void) |
9a559efd | 190 | { |
5d8d9a4d | 191 | return rpcauth_init_credcache(&generic_auth); |
9a559efd TM |
192 | } |
193 | ||
c135e84a | 194 | void rpc_destroy_generic_auth(void) |
9a559efd | 195 | { |
5d8d9a4d | 196 | rpcauth_destroy_credcache(&generic_auth); |
9a559efd TM |
197 | } |
198 | ||
4de6caa2 AA |
199 | /* |
200 | * Test the the current time (now) against the underlying credential key expiry | |
201 | * minus a timeout and setup notification. | |
202 | * | |
203 | * The normal case: | |
204 | * If 'now' is before the key expiry minus RPC_KEY_EXPIRE_TIMEO, set | |
205 | * the RPC_CRED_NOTIFY_TIMEOUT flag to setup the underlying credential | |
206 | * rpc_credops crmatch routine to notify this generic cred when it's key | |
207 | * expiration is within RPC_KEY_EXPIRE_TIMEO, and return 0. | |
208 | * | |
209 | * The error case: | |
210 | * If the underlying cred lookup fails, return -EACCES. | |
211 | * | |
212 | * The 'almost' error case: | |
213 | * If 'now' is within key expiry minus RPC_KEY_EXPIRE_TIMEO, but not within | |
214 | * key expiry minus RPC_KEY_EXPIRE_FAIL, set the RPC_CRED_EXPIRE_SOON bit | |
215 | * on the acred ac_flags and return 0. | |
216 | */ | |
217 | static int | |
218 | generic_key_timeout(struct rpc_auth *auth, struct rpc_cred *cred) | |
219 | { | |
220 | struct auth_cred *acred = &container_of(cred, struct generic_cred, | |
221 | gc_base)->acred; | |
222 | struct rpc_cred *tcred; | |
223 | int ret = 0; | |
224 | ||
225 | ||
226 | /* Fast track for non crkey_timeout (no key) underlying credentials */ | |
227 | if (test_bit(RPC_CRED_NO_CRKEY_TIMEOUT, &acred->ac_flags)) | |
228 | return 0; | |
229 | ||
230 | /* Fast track for the normal case */ | |
231 | if (test_bit(RPC_CRED_NOTIFY_TIMEOUT, &acred->ac_flags)) | |
232 | return 0; | |
233 | ||
234 | /* lookup_cred either returns a valid referenced rpc_cred, or PTR_ERR */ | |
235 | tcred = auth->au_ops->lookup_cred(auth, acred, 0); | |
236 | if (IS_ERR(tcred)) | |
237 | return -EACCES; | |
238 | ||
239 | if (!tcred->cr_ops->crkey_timeout) { | |
240 | set_bit(RPC_CRED_NO_CRKEY_TIMEOUT, &acred->ac_flags); | |
241 | ret = 0; | |
242 | goto out_put; | |
243 | } | |
244 | ||
245 | /* Test for the almost error case */ | |
246 | ret = tcred->cr_ops->crkey_timeout(tcred); | |
247 | if (ret != 0) { | |
248 | set_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags); | |
249 | ret = 0; | |
250 | } else { | |
251 | /* In case underlying cred key has been reset */ | |
252 | if (test_and_clear_bit(RPC_CRED_KEY_EXPIRE_SOON, | |
253 | &acred->ac_flags)) | |
254 | dprintk("RPC: UID %d Credential key reset\n", | |
13429305 | 255 | from_kuid(&init_user_ns, tcred->cr_uid)); |
4de6caa2 AA |
256 | /* set up fasttrack for the normal case */ |
257 | set_bit(RPC_CRED_NOTIFY_TIMEOUT, &acred->ac_flags); | |
258 | } | |
259 | ||
260 | out_put: | |
261 | put_rpccred(tcred); | |
262 | return ret; | |
263 | } | |
264 | ||
9a559efd TM |
265 | static const struct rpc_authops generic_auth_ops = { |
266 | .owner = THIS_MODULE, | |
9a559efd | 267 | .au_name = "Generic", |
9a559efd TM |
268 | .lookup_cred = generic_lookup_cred, |
269 | .crcreate = generic_create_cred, | |
4de6caa2 | 270 | .key_timeout = generic_key_timeout, |
9a559efd TM |
271 | }; |
272 | ||
273 | static struct rpc_auth generic_auth = { | |
274 | .au_ops = &generic_auth_ops, | |
275 | .au_count = ATOMIC_INIT(0), | |
9a559efd TM |
276 | }; |
277 | ||
4de6caa2 AA |
278 | static bool generic_key_to_expire(struct rpc_cred *cred) |
279 | { | |
280 | struct auth_cred *acred = &container_of(cred, struct generic_cred, | |
281 | gc_base)->acred; | |
282 | bool ret; | |
283 | ||
284 | get_rpccred(cred); | |
285 | ret = test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags); | |
286 | put_rpccred(cred); | |
287 | ||
288 | return ret; | |
289 | } | |
290 | ||
9a559efd TM |
291 | static const struct rpc_credops generic_credops = { |
292 | .cr_name = "Generic cred", | |
293 | .crdestroy = generic_destroy_cred, | |
5c691044 | 294 | .crbind = generic_bind_cred, |
9a559efd | 295 | .crmatch = generic_match, |
4de6caa2 | 296 | .crkey_to_expire = generic_key_to_expire, |
9a559efd | 297 | }; |