net/sunrpc/auth_gss/auth_gss.c

   1 // SPDX-License-Identifier: BSD-3-Clause
   2 /*
   3  * linux/net/sunrpc/auth_gss/auth_gss.c
   4  *
   5  * RPCSEC_GSS client authentication.
   6  *
   7  *  Copyright (c) 2000 The Regents of the University of Michigan.
   8  *  All rights reserved.
   9  *
  10  *  Dug Song       <dugsong@monkey.org>
  11  *  Andy Adamson   <andros@umich.edu>
  12  */
  13
  14 #include <linux/module.h>
  15 #include <linux/init.h>
  16 #include <linux/types.h>
  17 #include <linux/slab.h>
  18 #include <linux/sched.h>
  19 #include <linux/pagemap.h>
  20 #include <linux/sunrpc/clnt.h>
  21 #include <linux/sunrpc/auth.h>
  22 #include <linux/sunrpc/auth_gss.h>
  23 #include <linux/sunrpc/gss_krb5.h>
  24 #include <linux/sunrpc/svcauth_gss.h>
  25 #include <linux/sunrpc/gss_err.h>
  26 #include <linux/workqueue.h>
  27 #include <linux/sunrpc/rpc_pipe_fs.h>
  28 #include <linux/sunrpc/gss_api.h>
  29 #include <linux/uaccess.h>
  30 #include <linux/hashtable.h>
  31
  32 #include "auth_gss_internal.h"
  33 #include "../netns.h"
  34
  35 #include <trace/events/rpcgss.h>
  36
  37 static const struct rpc_authops authgss_ops;
  38
  39 static const struct rpc_credops gss_credops;
  40 static const struct rpc_credops gss_nullops;
  41
  42 #define GSS_RETRY_EXPIRED 5
  43 static unsigned int gss_expired_cred_retry_delay = GSS_RETRY_EXPIRED;
  44
  45 #define GSS_KEY_EXPIRE_TIMEO 240
  46 static unsigned int gss_key_expire_timeo = GSS_KEY_EXPIRE_TIMEO;
  47
  48 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
  49 # define RPCDBG_FACILITY        RPCDBG_AUTH
  50 #endif
  51
  52 #define GSS_CRED_SLACK          (RPC_MAX_AUTH_SIZE * 2)
  53 /* length of a krb5 verifier (48), plus data added before arguments when
  54  * using integrity (two 4-byte integers): */
  55 #define GSS_VERF_SLACK          100
  56
  57 static DEFINE_HASHTABLE(gss_auth_hash_table, 4);
  58 static DEFINE_SPINLOCK(gss_auth_hash_lock);
  59
  60 struct gss_pipe {
  61         struct rpc_pipe_dir_object pdo;
  62         struct rpc_pipe *pipe;
  63         struct rpc_clnt *clnt;
  64         const char *name;
  65         struct kref kref;
  66 };
  67
  68 struct gss_auth {
  69         struct kref kref;
  70         struct hlist_node hash;
  71         struct rpc_auth rpc_auth;
  72         struct gss_api_mech *mech;
  73         enum rpc_gss_svc service;
  74         struct rpc_clnt *client;
  75         struct net      *net;
  76         netns_tracker   ns_tracker;
  77         /*
  78          * There are two upcall pipes; dentry[1], named "gssd", is used
  79          * for the new text-based upcall; dentry[0] is named after the
  80          * mechanism (for example, "krb5") and exists for
  81          * backwards-compatibility with older gssd's.
  82          */
  83         struct gss_pipe *gss_pipe[2];
  84         const char *target_name;
  85 };
  86
  87 /* pipe_version >= 0 if and only if someone has a pipe open. */
  88 static DEFINE_SPINLOCK(pipe_version_lock);
  89 static struct rpc_wait_queue pipe_version_rpc_waitqueue;
  90 static DECLARE_WAIT_QUEUE_HEAD(pipe_version_waitqueue);
  91 static void gss_put_auth(struct gss_auth *gss_auth);
  92
  93 static void gss_free_ctx(struct gss_cl_ctx *);
  94 static const struct rpc_pipe_ops gss_upcall_ops_v0;
  95 static const struct rpc_pipe_ops gss_upcall_ops_v1;
  96
  97 static inline struct gss_cl_ctx *
  98 gss_get_ctx(struct gss_cl_ctx *ctx)
  99 {
 100         refcount_inc(&ctx->count);
 101         return ctx;
 102 }
 103
 104 static inline void
 105 gss_put_ctx(struct gss_cl_ctx *ctx)
 106 {
 107         if (refcount_dec_and_test(&ctx->count))
 108                 gss_free_ctx(ctx);
 109 }
 110
 111 /* gss_cred_set_ctx:
 112  * called by gss_upcall_callback and gss_create_upcall in order
 113  * to set the gss context. The actual exchange of an old context
 114  * and a new one is protected by the pipe->lock.
 115  */
 116 static void
 117 gss_cred_set_ctx(struct rpc_cred *cred, struct gss_cl_ctx *ctx)
 118 {
 119         struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
 120
 121         if (!test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags))
 122                 return;
 123         gss_get_ctx(ctx);
 124         rcu_assign_pointer(gss_cred->gc_ctx, ctx);
 125         set_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
 126         smp_mb__before_atomic();
 127         clear_bit(RPCAUTH_CRED_NEW, &cred->cr_flags);
 128 }
 129
 130 static struct gss_cl_ctx *
 131 gss_cred_get_ctx(struct rpc_cred *cred)
 132 {
 133         struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
 134         struct gss_cl_ctx *ctx = NULL;
 135
 136         rcu_read_lock();
 137         ctx = rcu_dereference(gss_cred->gc_ctx);
 138         if (ctx)
 139                 gss_get_ctx(ctx);
 140         rcu_read_unlock();
 141         return ctx;
 142 }
 143
 144 static struct gss_cl_ctx *
 145 gss_alloc_context(void)
 146 {
 147         struct gss_cl_ctx *ctx;
 148
 149         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
 150         if (ctx != NULL) {
 151                 ctx->gc_proc = RPC_GSS_PROC_DATA;
 152                 ctx->gc_seq = 1;        /* NetApp 6.4R1 doesn't accept seq. no. 0 */
 153                 spin_lock_init(&ctx->gc_seq_lock);
 154                 refcount_set(&ctx->count,1);
 155         }
 156         return ctx;
 157 }
 158
 159 #define GSSD_MIN_TIMEOUT (60 * 60)
 160 static const void *
 161 gss_fill_context(const void *p, const void *end, struct gss_cl_ctx *ctx, struct gss_api_mech *gm)
 162 {
 163         const void *q;
 164         unsigned int seclen;
 165         unsigned int timeout;
 166         unsigned long now = jiffies;
 167         u32 window_size;
 168         int ret;
 169
 170         /* First unsigned int gives the remaining lifetime in seconds of the
 171          * credential - e.g. the remaining TGT lifetime for Kerberos or
 172          * the -t value passed to GSSD.
 173          */
 174         p = simple_get_bytes(p, end, &timeout, sizeof(timeout));
 175         if (IS_ERR(p))
 176                 goto err;
 177         if (timeout == 0)
 178                 timeout = GSSD_MIN_TIMEOUT;
 179         ctx->gc_expiry = now + ((unsigned long)timeout * HZ);
 180         /* Sequence number window. Determines the maximum number of
 181          * simultaneous requests
 182          */
 183         p = simple_get_bytes(p, end, &window_size, sizeof(window_size));
 184         if (IS_ERR(p))
 185                 goto err;
 186         ctx->gc_win = window_size;
 187         /* gssd signals an error by passing ctx->gc_win = 0: */
 188         if (ctx->gc_win == 0) {
 189                 /*
 190                  * in which case, p points to an error code. Anything other
 191                  * than -EKEYEXPIRED gets converted to -EACCES.
 192                  */
 193                 p = simple_get_bytes(p, end, &ret, sizeof(ret));
 194                 if (!IS_ERR(p))
 195                         p = (ret == -EKEYEXPIRED) ? ERR_PTR(-EKEYEXPIRED) :
 196                                                     ERR_PTR(-EACCES);
 197                 goto err;
 198         }
 199         /* copy the opaque wire context */
 200         p = simple_get_netobj(p, end, &ctx->gc_wire_ctx);
 201         if (IS_ERR(p))
 202                 goto err;
 203         /* import the opaque security context */
 204         p  = simple_get_bytes(p, end, &seclen, sizeof(seclen));
 205         if (IS_ERR(p))
 206                 goto err;
 207         q = (const void *)((const char *)p + seclen);
 208         if (unlikely(q > end || q < p)) {
 209                 p = ERR_PTR(-EFAULT);
 210                 goto err;
 211         }
 212         ret = gss_import_sec_context(p, seclen, gm, &ctx->gc_gss_ctx, NULL, GFP_KERNEL);
 213         if (ret < 0) {
 214                 trace_rpcgss_import_ctx(ret);
 215                 p = ERR_PTR(ret);
 216                 goto err;
 217         }
 218
 219         /* is there any trailing data? */
 220         if (q == end) {
 221                 p = q;
 222                 goto done;
 223         }
 224
 225         /* pull in acceptor name (if there is one) */
 226         p = simple_get_netobj(q, end, &ctx->gc_acceptor);
 227         if (IS_ERR(p))
 228                 goto err;
 229 done:
 230         trace_rpcgss_context(window_size, ctx->gc_expiry, now, timeout,
 231                              ctx->gc_acceptor.len, ctx->gc_acceptor.data);
 232 err:
 233         return p;
 234 }
 235
 236 /* XXX: Need some documentation about why UPCALL_BUF_LEN is so small.
 237  *      Is user space expecting no more than UPCALL_BUF_LEN bytes?
 238  *      Note that there are now _two_ NI_MAXHOST sized data items
 239  *      being passed in this string.
 240  */
 241 #define UPCALL_BUF_LEN  256
 242
 243 struct gss_upcall_msg {
 244         refcount_t count;
 245         kuid_t  uid;
 246         const char *service_name;
 247         struct rpc_pipe_msg msg;
 248         struct list_head list;
 249         struct gss_auth *auth;
 250         struct rpc_pipe *pipe;
 251         struct rpc_wait_queue rpc_waitqueue;
 252         wait_queue_head_t waitqueue;
 253         struct gss_cl_ctx *ctx;
 254         char databuf[UPCALL_BUF_LEN];
 255 };
 256
 257 static int get_pipe_version(struct net *net)
 258 {
 259         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 260         int ret;
 261
 262         spin_lock(&pipe_version_lock);
 263         if (sn->pipe_version >= 0) {
 264                 atomic_inc(&sn->pipe_users);
 265                 ret = sn->pipe_version;
 266         } else
 267                 ret = -EAGAIN;
 268         spin_unlock(&pipe_version_lock);
 269         return ret;
 270 }
 271
 272 static void put_pipe_version(struct net *net)
 273 {
 274         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 275
 276         if (atomic_dec_and_lock(&sn->pipe_users, &pipe_version_lock)) {
 277                 sn->pipe_version = -1;
 278                 spin_unlock(&pipe_version_lock);
 279         }
 280 }
 281
 282 static void
 283 gss_release_msg(struct gss_upcall_msg *gss_msg)
 284 {
 285         struct net *net = gss_msg->auth->net;
 286         if (!refcount_dec_and_test(&gss_msg->count))
 287                 return;
 288         put_pipe_version(net);
 289         BUG_ON(!list_empty(&gss_msg->list));
 290         if (gss_msg->ctx != NULL)
 291                 gss_put_ctx(gss_msg->ctx);
 292         rpc_destroy_wait_queue(&gss_msg->rpc_waitqueue);
 293         gss_put_auth(gss_msg->auth);
 294         kfree_const(gss_msg->service_name);
 295         kfree(gss_msg);
 296 }
 297
 298 static struct gss_upcall_msg *
 299 __gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid, const struct gss_auth *auth)
 300 {
 301         struct gss_upcall_msg *pos;
 302         list_for_each_entry(pos, &pipe->in_downcall, list) {
 303                 if (!uid_eq(pos->uid, uid))
 304                         continue;
 305                 if (pos->auth->service != auth->service)
 306                         continue;
 307                 refcount_inc(&pos->count);
 308                 return pos;
 309         }
 310         return NULL;
 311 }
 312
 313 /* Try to add an upcall to the pipefs queue.
 314  * If an upcall owned by our uid already exists, then we return a reference
 315  * to that upcall instead of adding the new upcall.
 316  */
 317 static inline struct gss_upcall_msg *
 318 gss_add_msg(struct gss_upcall_msg *gss_msg)
 319 {
 320         struct rpc_pipe *pipe = gss_msg->pipe;
 321         struct gss_upcall_msg *old;
 322
 323         spin_lock(&pipe->lock);
 324         old = __gss_find_upcall(pipe, gss_msg->uid, gss_msg->auth);
 325         if (old == NULL) {
 326                 refcount_inc(&gss_msg->count);
 327                 list_add(&gss_msg->list, &pipe->in_downcall);
 328         } else
 329                 gss_msg = old;
 330         spin_unlock(&pipe->lock);
 331         return gss_msg;
 332 }
 333
 334 static void
 335 __gss_unhash_msg(struct gss_upcall_msg *gss_msg)
 336 {
 337         list_del_init(&gss_msg->list);
 338         rpc_wake_up_status(&gss_msg->rpc_waitqueue, gss_msg->msg.errno);
 339         wake_up_all(&gss_msg->waitqueue);
 340         refcount_dec(&gss_msg->count);
 341 }
 342
 343 static void
 344 gss_unhash_msg(struct gss_upcall_msg *gss_msg)
 345 {
 346         struct rpc_pipe *pipe = gss_msg->pipe;
 347
 348         if (list_empty(&gss_msg->list))
 349                 return;
 350         spin_lock(&pipe->lock);
 351         if (!list_empty(&gss_msg->list))
 352                 __gss_unhash_msg(gss_msg);
 353         spin_unlock(&pipe->lock);
 354 }
 355
 356 static void
 357 gss_handle_downcall_result(struct gss_cred *gss_cred, struct gss_upcall_msg *gss_msg)
 358 {
 359         switch (gss_msg->msg.errno) {
 360         case 0:
 361                 if (gss_msg->ctx == NULL)
 362                         break;
 363                 clear_bit(RPCAUTH_CRED_NEGATIVE, &gss_cred->gc_base.cr_flags);
 364                 gss_cred_set_ctx(&gss_cred->gc_base, gss_msg->ctx);
 365                 break;
 366         case -EKEYEXPIRED:
 367                 set_bit(RPCAUTH_CRED_NEGATIVE, &gss_cred->gc_base.cr_flags);
 368         }
 369         gss_cred->gc_upcall_timestamp = jiffies;
 370         gss_cred->gc_upcall = NULL;
 371         rpc_wake_up_status(&gss_msg->rpc_waitqueue, gss_msg->msg.errno);
 372 }
 373
 374 static void
 375 gss_upcall_callback(struct rpc_task *task)
 376 {
 377         struct gss_cred *gss_cred = container_of(task->tk_rqstp->rq_cred,
 378                         struct gss_cred, gc_base);
 379         struct gss_upcall_msg *gss_msg = gss_cred->gc_upcall;
 380         struct rpc_pipe *pipe = gss_msg->pipe;
 381
 382         spin_lock(&pipe->lock);
 383         gss_handle_downcall_result(gss_cred, gss_msg);
 384         spin_unlock(&pipe->lock);
 385         task->tk_status = gss_msg->msg.errno;
 386         gss_release_msg(gss_msg);
 387 }
 388
 389 static void gss_encode_v0_msg(struct gss_upcall_msg *gss_msg,
 390                               const struct cred *cred)
 391 {
 392         struct user_namespace *userns = cred->user_ns;
 393
 394         uid_t uid = from_kuid_munged(userns, gss_msg->uid);
 395         memcpy(gss_msg->databuf, &uid, sizeof(uid));
 396         gss_msg->msg.data = gss_msg->databuf;
 397         gss_msg->msg.len = sizeof(uid);
 398
 399         BUILD_BUG_ON(sizeof(uid) > sizeof(gss_msg->databuf));
 400 }
 401
 402 static ssize_t
 403 gss_v0_upcall(struct file *file, struct rpc_pipe_msg *msg,
 404                 char __user *buf, size_t buflen)
 405 {
 406         struct gss_upcall_msg *gss_msg = container_of(msg,
 407                                                       struct gss_upcall_msg,
 408                                                       msg);
 409         if (msg->copied == 0)
 410                 gss_encode_v0_msg(gss_msg, file->f_cred);
 411         return rpc_pipe_generic_upcall(file, msg, buf, buflen);
 412 }
 413
 414 static int gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
 415                                 const char *service_name,
 416                                 const char *target_name,
 417                                 const struct cred *cred)
 418 {
 419         struct user_namespace *userns = cred->user_ns;
 420         struct gss_api_mech *mech = gss_msg->auth->mech;
 421         char *p = gss_msg->databuf;
 422         size_t buflen = sizeof(gss_msg->databuf);
 423         int len;
 424
 425         len = scnprintf(p, buflen, "mech=%s uid=%d", mech->gm_name,
 426                         from_kuid_munged(userns, gss_msg->uid));
 427         buflen -= len;
 428         p += len;
 429         gss_msg->msg.len = len;
 430
 431         /*
 432          * target= is a full service principal that names the remote
 433          * identity that we are authenticating to.
 434          */
 435         if (target_name) {
 436                 len = scnprintf(p, buflen, " target=%s", target_name);
 437                 buflen -= len;
 438                 p += len;
 439                 gss_msg->msg.len += len;
 440         }
 441
 442         /*
 443          * gssd uses service= and srchost= to select a matching key from
 444          * the system's keytab to use as the source principal.
 445          *
 446          * service= is the service name part of the source principal,
 447          * or "*" (meaning choose any).
 448          *
 449          * srchost= is the hostname part of the source principal. When
 450          * not provided, gssd uses the local hostname.
 451          */
 452         if (service_name) {
 453                 char *c = strchr(service_name, '@');
 454
 455                 if (!c)
 456                         len = scnprintf(p, buflen, " service=%s",
 457                                         service_name);
 458                 else
 459                         len = scnprintf(p, buflen,
 460                                         " service=%.*s srchost=%s",
 461                                         (int)(c - service_name),
 462                                         service_name, c + 1);
 463                 buflen -= len;
 464                 p += len;
 465                 gss_msg->msg.len += len;
 466         }
 467
 468         if (mech->gm_upcall_enctypes) {
 469                 len = scnprintf(p, buflen, " enctypes=%s",
 470                                 mech->gm_upcall_enctypes);
 471                 buflen -= len;
 472                 p += len;
 473                 gss_msg->msg.len += len;
 474         }
 475         trace_rpcgss_upcall_msg(gss_msg->databuf);
 476         len = scnprintf(p, buflen, "\n");
 477         if (len == 0)
 478                 goto out_overflow;
 479         gss_msg->msg.len += len;
 480         gss_msg->msg.data = gss_msg->databuf;
 481         return 0;
 482 out_overflow:
 483         WARN_ON_ONCE(1);
 484         return -ENOMEM;
 485 }
 486
 487 static ssize_t
 488 gss_v1_upcall(struct file *file, struct rpc_pipe_msg *msg,
 489                 char __user *buf, size_t buflen)
 490 {
 491         struct gss_upcall_msg *gss_msg = container_of(msg,
 492                                                       struct gss_upcall_msg,
 493                                                       msg);
 494         int err;
 495         if (msg->copied == 0) {
 496                 err = gss_encode_v1_msg(gss_msg,
 497                                         gss_msg->service_name,
 498                                         gss_msg->auth->target_name,
 499                                         file->f_cred);
 500                 if (err)
 501                         return err;
 502         }
 503         return rpc_pipe_generic_upcall(file, msg, buf, buflen);
 504 }
 505
 506 static struct gss_upcall_msg *
 507 gss_alloc_msg(struct gss_auth *gss_auth,
 508                 kuid_t uid, const char *service_name)
 509 {
 510         struct gss_upcall_msg *gss_msg;
 511         int vers;
 512         int err = -ENOMEM;
 513
 514         gss_msg = kzalloc(sizeof(*gss_msg), GFP_KERNEL);
 515         if (gss_msg == NULL)
 516                 goto err;
 517         vers = get_pipe_version(gss_auth->net);
 518         err = vers;
 519         if (err < 0)
 520                 goto err_free_msg;
 521         gss_msg->pipe = gss_auth->gss_pipe[vers]->pipe;
 522         INIT_LIST_HEAD(&gss_msg->list);
 523         rpc_init_wait_queue(&gss_msg->rpc_waitqueue, "RPCSEC_GSS upcall waitq");
 524         init_waitqueue_head(&gss_msg->waitqueue);
 525         refcount_set(&gss_msg->count, 1);
 526         gss_msg->uid = uid;
 527         gss_msg->auth = gss_auth;
 528         kref_get(&gss_auth->kref);
 529         if (service_name) {
 530                 gss_msg->service_name = kstrdup_const(service_name, GFP_KERNEL);
 531                 if (!gss_msg->service_name) {
 532                         err = -ENOMEM;
 533                         goto err_put_pipe_version;
 534                 }
 535         }
 536         return gss_msg;
 537 err_put_pipe_version:
 538         put_pipe_version(gss_auth->net);
 539 err_free_msg:
 540         kfree(gss_msg);
 541 err:
 542         return ERR_PTR(err);
 543 }
 544
 545 static struct gss_upcall_msg *
 546 gss_setup_upcall(struct gss_auth *gss_auth, struct rpc_cred *cred)
 547 {
 548         struct gss_cred *gss_cred = container_of(cred,
 549                         struct gss_cred, gc_base);
 550         struct gss_upcall_msg *gss_new, *gss_msg;
 551         kuid_t uid = cred->cr_cred->fsuid;
 552
 553         gss_new = gss_alloc_msg(gss_auth, uid, gss_cred->gc_principal);
 554         if (IS_ERR(gss_new))
 555                 return gss_new;
 556         gss_msg = gss_add_msg(gss_new);
 557         if (gss_msg == gss_new) {
 558                 int res;
 559                 refcount_inc(&gss_msg->count);
 560                 res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg);
 561                 if (res) {
 562                         gss_unhash_msg(gss_new);
 563                         refcount_dec(&gss_msg->count);
 564                         gss_release_msg(gss_new);
 565                         gss_msg = ERR_PTR(res);
 566                 }
 567         } else
 568                 gss_release_msg(gss_new);
 569         return gss_msg;
 570 }
 571
 572 static void warn_gssd(void)
 573 {
 574         dprintk("AUTH_GSS upcall failed. Please check user daemon is running.\n");
 575 }
 576
 577 static inline int
 578 gss_refresh_upcall(struct rpc_task *task)
 579 {
 580         struct rpc_cred *cred = task->tk_rqstp->rq_cred;
 581         struct gss_auth *gss_auth = container_of(cred->cr_auth,
 582                         struct gss_auth, rpc_auth);
 583         struct gss_cred *gss_cred = container_of(cred,
 584                         struct gss_cred, gc_base);
 585         struct gss_upcall_msg *gss_msg;
 586         struct rpc_pipe *pipe;
 587         int err = 0;
 588
 589         gss_msg = gss_setup_upcall(gss_auth, cred);
 590         if (PTR_ERR(gss_msg) == -EAGAIN) {
 591                 /* XXX: warning on the first, under the assumption we
 592                  * shouldn't normally hit this case on a refresh. */
 593                 warn_gssd();
 594                 rpc_sleep_on_timeout(&pipe_version_rpc_waitqueue,
 595                                 task, NULL, jiffies + (15 * HZ));
 596                 err = -EAGAIN;
 597                 goto out;
 598         }
 599         if (IS_ERR(gss_msg)) {
 600                 err = PTR_ERR(gss_msg);
 601                 goto out;
 602         }
 603         pipe = gss_msg->pipe;
 604         spin_lock(&pipe->lock);
 605         if (gss_cred->gc_upcall != NULL)
 606                 rpc_sleep_on(&gss_cred->gc_upcall->rpc_waitqueue, task, NULL);
 607         else if (gss_msg->ctx == NULL && gss_msg->msg.errno >= 0) {
 608                 gss_cred->gc_upcall = gss_msg;
 609                 /* gss_upcall_callback will release the reference to gss_upcall_msg */
 610                 refcount_inc(&gss_msg->count);
 611                 rpc_sleep_on(&gss_msg->rpc_waitqueue, task, gss_upcall_callback);
 612         } else {
 613                 gss_handle_downcall_result(gss_cred, gss_msg);
 614                 err = gss_msg->msg.errno;
 615         }
 616         spin_unlock(&pipe->lock);
 617         gss_release_msg(gss_msg);
 618 out:
 619         trace_rpcgss_upcall_result(from_kuid(&init_user_ns,
 620                                              cred->cr_cred->fsuid), err);
 621         return err;
 622 }
 623
 624 static inline int
 625 gss_create_upcall(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
 626 {
 627         struct net *net = gss_auth->net;
 628         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 629         struct rpc_pipe *pipe;
 630         struct rpc_cred *cred = &gss_cred->gc_base;
 631         struct gss_upcall_msg *gss_msg;
 632         DEFINE_WAIT(wait);
 633         int err;
 634
 635 retry:
 636         err = 0;
 637         /* if gssd is down, just skip upcalling altogether */
 638         if (!gssd_running(net)) {
 639                 warn_gssd();
 640                 err = -EACCES;
 641                 goto out;
 642         }
 643         gss_msg = gss_setup_upcall(gss_auth, cred);
 644         if (PTR_ERR(gss_msg) == -EAGAIN) {
 645                 err = wait_event_interruptible_timeout(pipe_version_waitqueue,
 646                                 sn->pipe_version >= 0, 15 * HZ);
 647                 if (sn->pipe_version < 0) {
 648                         warn_gssd();
 649                         err = -EACCES;
 650                 }
 651                 if (err < 0)
 652                         goto out;
 653                 goto retry;
 654         }
 655         if (IS_ERR(gss_msg)) {
 656                 err = PTR_ERR(gss_msg);
 657                 goto out;
 658         }
 659         pipe = gss_msg->pipe;
 660         for (;;) {
 661                 prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_KILLABLE);
 662                 spin_lock(&pipe->lock);
 663                 if (gss_msg->ctx != NULL || gss_msg->msg.errno < 0) {
 664                         break;
 665                 }
 666                 spin_unlock(&pipe->lock);
 667                 if (fatal_signal_pending(current)) {
 668                         err = -ERESTARTSYS;
 669                         goto out_intr;
 670                 }
 671                 schedule();
 672         }
 673         if (gss_msg->ctx) {
 674                 trace_rpcgss_ctx_init(gss_cred);
 675                 gss_cred_set_ctx(cred, gss_msg->ctx);
 676         } else {
 677                 err = gss_msg->msg.errno;
 678         }
 679         spin_unlock(&pipe->lock);
 680 out_intr:
 681         finish_wait(&gss_msg->waitqueue, &wait);
 682         gss_release_msg(gss_msg);
 683 out:
 684         trace_rpcgss_upcall_result(from_kuid(&init_user_ns,
 685                                              cred->cr_cred->fsuid), err);
 686         return err;
 687 }
 688
 689 static struct gss_upcall_msg *
 690 gss_find_downcall(struct rpc_pipe *pipe, kuid_t uid)
 691 {
 692         struct gss_upcall_msg *pos;
 693         list_for_each_entry(pos, &pipe->in_downcall, list) {
 694                 if (!uid_eq(pos->uid, uid))
 695                         continue;
 696                 if (!rpc_msg_is_inflight(&pos->msg))
 697                         continue;
 698                 refcount_inc(&pos->count);
 699                 return pos;
 700         }
 701         return NULL;
 702 }
 703
 704 #define MSG_BUF_MAXSIZE 1024
 705
 706 static ssize_t
 707 gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
 708 {
 709         const void *p, *end;
 710         void *buf;
 711         struct gss_upcall_msg *gss_msg;
 712         struct rpc_pipe *pipe = RPC_I(file_inode(filp))->pipe;
 713         struct gss_cl_ctx *ctx;
 714         uid_t id;
 715         kuid_t uid;
 716         ssize_t err = -EFBIG;
 717
 718         if (mlen > MSG_BUF_MAXSIZE)
 719                 goto out;
 720         err = -ENOMEM;
 721         buf = kmalloc(mlen, GFP_KERNEL);
 722         if (!buf)
 723                 goto out;
 724
 725         err = -EFAULT;
 726         if (copy_from_user(buf, src, mlen))
 727                 goto err;
 728
 729         end = (const void *)((char *)buf + mlen);
 730         p = simple_get_bytes(buf, end, &id, sizeof(id));
 731         if (IS_ERR(p)) {
 732                 err = PTR_ERR(p);
 733                 goto err;
 734         }
 735
 736         uid = make_kuid(current_user_ns(), id);
 737         if (!uid_valid(uid)) {
 738                 err = -EINVAL;
 739                 goto err;
 740         }
 741
 742         err = -ENOMEM;
 743         ctx = gss_alloc_context();
 744         if (ctx == NULL)
 745                 goto err;
 746
 747         err = -ENOENT;
 748         /* Find a matching upcall */
 749         spin_lock(&pipe->lock);
 750         gss_msg = gss_find_downcall(pipe, uid);
 751         if (gss_msg == NULL) {
 752                 spin_unlock(&pipe->lock);
 753                 goto err_put_ctx;
 754         }
 755         list_del_init(&gss_msg->list);
 756         spin_unlock(&pipe->lock);
 757
 758         p = gss_fill_context(p, end, ctx, gss_msg->auth->mech);
 759         if (IS_ERR(p)) {
 760                 err = PTR_ERR(p);
 761                 switch (err) {
 762                 case -EACCES:
 763                 case -EKEYEXPIRED:
 764                         gss_msg->msg.errno = err;
 765                         err = mlen;
 766                         break;
 767                 case -EFAULT:
 768                 case -ENOMEM:
 769                 case -EINVAL:
 770                 case -ENOSYS:
 771                         gss_msg->msg.errno = -EAGAIN;
 772                         break;
 773                 default:
 774                         printk(KERN_CRIT "%s: bad return from "
 775                                 "gss_fill_context: %zd\n", __func__, err);
 776                         gss_msg->msg.errno = -EIO;
 777                 }
 778                 goto err_release_msg;
 779         }
 780         gss_msg->ctx = gss_get_ctx(ctx);
 781         err = mlen;
 782
 783 err_release_msg:
 784         spin_lock(&pipe->lock);
 785         __gss_unhash_msg(gss_msg);
 786         spin_unlock(&pipe->lock);
 787         gss_release_msg(gss_msg);
 788 err_put_ctx:
 789         gss_put_ctx(ctx);
 790 err:
 791         kfree(buf);
 792 out:
 793         return err;
 794 }
 795
 796 static int gss_pipe_open(struct inode *inode, int new_version)
 797 {
 798         struct net *net = inode->i_sb->s_fs_info;
 799         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 800         int ret = 0;
 801
 802         spin_lock(&pipe_version_lock);
 803         if (sn->pipe_version < 0) {
 804                 /* First open of any gss pipe determines the version: */
 805                 sn->pipe_version = new_version;
 806                 rpc_wake_up(&pipe_version_rpc_waitqueue);
 807                 wake_up(&pipe_version_waitqueue);
 808         } else if (sn->pipe_version != new_version) {
 809                 /* Trying to open a pipe of a different version */
 810                 ret = -EBUSY;
 811                 goto out;
 812         }
 813         atomic_inc(&sn->pipe_users);
 814 out:
 815         spin_unlock(&pipe_version_lock);
 816         return ret;
 817
 818 }
 819
 820 static int gss_pipe_open_v0(struct inode *inode)
 821 {
 822         return gss_pipe_open(inode, 0);
 823 }
 824
 825 static int gss_pipe_open_v1(struct inode *inode)
 826 {
 827         return gss_pipe_open(inode, 1);
 828 }
 829
 830 static void
 831 gss_pipe_release(struct inode *inode)
 832 {
 833         struct net *net = inode->i_sb->s_fs_info;
 834         struct rpc_pipe *pipe = RPC_I(inode)->pipe;
 835         struct gss_upcall_msg *gss_msg;
 836
 837 restart:
 838         spin_lock(&pipe->lock);
 839         list_for_each_entry(gss_msg, &pipe->in_downcall, list) {
 840
 841                 if (!list_empty(&gss_msg->msg.list))
 842                         continue;
 843                 gss_msg->msg.errno = -EPIPE;
 844                 refcount_inc(&gss_msg->count);
 845                 __gss_unhash_msg(gss_msg);
 846                 spin_unlock(&pipe->lock);
 847                 gss_release_msg(gss_msg);
 848                 goto restart;
 849         }
 850         spin_unlock(&pipe->lock);
 851
 852         put_pipe_version(net);
 853 }
 854
 855 static void
 856 gss_pipe_destroy_msg(struct rpc_pipe_msg *msg)
 857 {
 858         struct gss_upcall_msg *gss_msg = container_of(msg, struct gss_upcall_msg, msg);
 859
 860         if (msg->errno < 0) {
 861                 refcount_inc(&gss_msg->count);
 862                 gss_unhash_msg(gss_msg);
 863                 if (msg->errno == -ETIMEDOUT)
 864                         warn_gssd();
 865                 gss_release_msg(gss_msg);
 866         }
 867         gss_release_msg(gss_msg);
 868 }
 869
 870 static void gss_pipe_dentry_destroy(struct dentry *dir,
 871                 struct rpc_pipe_dir_object *pdo)
 872 {
 873         struct gss_pipe *gss_pipe = pdo->pdo_data;
 874         struct rpc_pipe *pipe = gss_pipe->pipe;
 875
 876         if (pipe->dentry != NULL) {
 877                 rpc_unlink(pipe->dentry);
 878                 pipe->dentry = NULL;
 879         }
 880 }
 881
 882 static int gss_pipe_dentry_create(struct dentry *dir,
 883                 struct rpc_pipe_dir_object *pdo)
 884 {
 885         struct gss_pipe *p = pdo->pdo_data;
 886         struct dentry *dentry;
 887
 888         dentry = rpc_mkpipe_dentry(dir, p->name, p->clnt, p->pipe);
 889         if (IS_ERR(dentry))
 890                 return PTR_ERR(dentry);
 891         p->pipe->dentry = dentry;
 892         return 0;
 893 }
 894
 895 static const struct rpc_pipe_dir_object_ops gss_pipe_dir_object_ops = {
 896         .create = gss_pipe_dentry_create,
 897         .destroy = gss_pipe_dentry_destroy,
 898 };
 899
 900 static struct gss_pipe *gss_pipe_alloc(struct rpc_clnt *clnt,
 901                 const char *name,
 902                 const struct rpc_pipe_ops *upcall_ops)
 903 {
 904         struct gss_pipe *p;
 905         int err = -ENOMEM;
 906
 907         p = kmalloc(sizeof(*p), GFP_KERNEL);
 908         if (p == NULL)
 909                 goto err;
 910         p->pipe = rpc_mkpipe_data(upcall_ops, RPC_PIPE_WAIT_FOR_OPEN);
 911         if (IS_ERR(p->pipe)) {
 912                 err = PTR_ERR(p->pipe);
 913                 goto err_free_gss_pipe;
 914         }
 915         p->name = name;
 916         p->clnt = clnt;
 917         kref_init(&p->kref);
 918         rpc_init_pipe_dir_object(&p->pdo,
 919                         &gss_pipe_dir_object_ops,
 920                         p);
 921         return p;
 922 err_free_gss_pipe:
 923         kfree(p);
 924 err:
 925         return ERR_PTR(err);
 926 }
 927
 928 struct gss_alloc_pdo {
 929         struct rpc_clnt *clnt;
 930         const char *name;
 931         const struct rpc_pipe_ops *upcall_ops;
 932 };
 933
 934 static int gss_pipe_match_pdo(struct rpc_pipe_dir_object *pdo, void *data)
 935 {
 936         struct gss_pipe *gss_pipe;
 937         struct gss_alloc_pdo *args = data;
 938
 939         if (pdo->pdo_ops != &gss_pipe_dir_object_ops)
 940                 return 0;
 941         gss_pipe = container_of(pdo, struct gss_pipe, pdo);
 942         if (strcmp(gss_pipe->name, args->name) != 0)
 943                 return 0;
 944         if (!kref_get_unless_zero(&gss_pipe->kref))
 945                 return 0;
 946         return 1;
 947 }
 948
 949 static struct rpc_pipe_dir_object *gss_pipe_alloc_pdo(void *data)
 950 {
 951         struct gss_pipe *gss_pipe;
 952         struct gss_alloc_pdo *args = data;
 953
 954         gss_pipe = gss_pipe_alloc(args->clnt, args->name, args->upcall_ops);
 955         if (!IS_ERR(gss_pipe))
 956                 return &gss_pipe->pdo;
 957         return NULL;
 958 }
 959
 960 static struct gss_pipe *gss_pipe_get(struct rpc_clnt *clnt,
 961                 const char *name,
 962                 const struct rpc_pipe_ops *upcall_ops)
 963 {
 964         struct net *net = rpc_net_ns(clnt);
 965         struct rpc_pipe_dir_object *pdo;
 966         struct gss_alloc_pdo args = {
 967                 .clnt = clnt,
 968                 .name = name,
 969                 .upcall_ops = upcall_ops,
 970         };
 971
 972         pdo = rpc_find_or_alloc_pipe_dir_object(net,
 973                         &clnt->cl_pipedir_objects,
 974                         gss_pipe_match_pdo,
 975                         gss_pipe_alloc_pdo,
 976                         &args);
 977         if (pdo != NULL)
 978                 return container_of(pdo, struct gss_pipe, pdo);
 979         return ERR_PTR(-ENOMEM);
 980 }
 981
 982 static void __gss_pipe_free(struct gss_pipe *p)
 983 {
 984         struct rpc_clnt *clnt = p->clnt;
 985         struct net *net = rpc_net_ns(clnt);
 986
 987         rpc_remove_pipe_dir_object(net,
 988                         &clnt->cl_pipedir_objects,
 989                         &p->pdo);
 990         rpc_destroy_pipe_data(p->pipe);
 991         kfree(p);
 992 }
 993
 994 static void __gss_pipe_release(struct kref *kref)
 995 {
 996         struct gss_pipe *p = container_of(kref, struct gss_pipe, kref);
 997
 998         __gss_pipe_free(p);
 999 }
1000
1001 static void gss_pipe_free(struct gss_pipe *p)
1002 {
1003         if (p != NULL)
1004                 kref_put(&p->kref, __gss_pipe_release);
1005 }
1006
1007 /*
1008  * NOTE: we have the opportunity to use different
1009  * parameters based on the input flavor (which must be a pseudoflavor)
1010  */
1011 static struct gss_auth *
1012 gss_create_new(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
1013 {
1014         rpc_authflavor_t flavor = args->pseudoflavor;
1015         struct gss_auth *gss_auth;
1016         struct gss_pipe *gss_pipe;
1017         struct rpc_auth * auth;
1018         int err = -ENOMEM; /* XXX? */
1019
1020         if (!try_module_get(THIS_MODULE))
1021                 return ERR_PTR(err);
1022         if (!(gss_auth = kmalloc(sizeof(*gss_auth), GFP_KERNEL)))
1023                 goto out_dec;
1024         INIT_HLIST_NODE(&gss_auth->hash);
1025         gss_auth->target_name = NULL;
1026         if (args->target_name) {
1027                 gss_auth->target_name = kstrdup(args->target_name, GFP_KERNEL);
1028                 if (gss_auth->target_name == NULL)
1029                         goto err_free;
1030         }
1031         gss_auth->client = clnt;
1032         gss_auth->net = get_net_track(rpc_net_ns(clnt), &gss_auth->ns_tracker,
1033                                       GFP_KERNEL);
1034         err = -EINVAL;
1035         gss_auth->mech = gss_mech_get_by_pseudoflavor(flavor);
1036         if (!gss_auth->mech)
1037                 goto err_put_net;
1038         gss_auth->service = gss_pseudoflavor_to_service(gss_auth->mech, flavor);
1039         if (gss_auth->service == 0)
1040                 goto err_put_mech;
1041         if (!gssd_running(gss_auth->net))
1042                 goto err_put_mech;
1043         auth = &gss_auth->rpc_auth;
1044         auth->au_cslack = GSS_CRED_SLACK >> 2;
1045         auth->au_rslack = GSS_KRB5_MAX_SLACK_NEEDED >> 2;
1046         auth->au_verfsize = GSS_VERF_SLACK >> 2;
1047         auth->au_ralign = GSS_VERF_SLACK >> 2;
1048         __set_bit(RPCAUTH_AUTH_UPDATE_SLACK, &auth->au_flags);
1049         auth->au_ops = &authgss_ops;
1050         auth->au_flavor = flavor;
1051         if (gss_pseudoflavor_to_datatouch(gss_auth->mech, flavor))
1052                 __set_bit(RPCAUTH_AUTH_DATATOUCH, &auth->au_flags);
1053         refcount_set(&auth->au_count, 1);
1054         kref_init(&gss_auth->kref);
1055
1056         err = rpcauth_init_credcache(auth);
1057         if (err)
1058                 goto err_put_mech;
1059         /*
1060          * Note: if we created the old pipe first, then someone who
1061          * examined the directory at the right moment might conclude
1062          * that we supported only the old pipe.  So we instead create
1063          * the new pipe first.
1064          */
1065         gss_pipe = gss_pipe_get(clnt, "gssd", &gss_upcall_ops_v1);
1066         if (IS_ERR(gss_pipe)) {
1067                 err = PTR_ERR(gss_pipe);
1068                 goto err_destroy_credcache;
1069         }
1070         gss_auth->gss_pipe[1] = gss_pipe;
1071
1072         gss_pipe = gss_pipe_get(clnt, gss_auth->mech->gm_name,
1073                         &gss_upcall_ops_v0);
1074         if (IS_ERR(gss_pipe)) {
1075                 err = PTR_ERR(gss_pipe);
1076                 goto err_destroy_pipe_1;
1077         }
1078         gss_auth->gss_pipe[0] = gss_pipe;
1079
1080         return gss_auth;
1081 err_destroy_pipe_1:
1082         gss_pipe_free(gss_auth->gss_pipe[1]);
1083 err_destroy_credcache:
1084         rpcauth_destroy_credcache(auth);
1085 err_put_mech:
1086         gss_mech_put(gss_auth->mech);
1087 err_put_net:
1088         put_net_track(gss_auth->net, &gss_auth->ns_tracker);
1089 err_free:
1090         kfree(gss_auth->target_name);
1091         kfree(gss_auth);
1092 out_dec:
1093         module_put(THIS_MODULE);
1094         trace_rpcgss_createauth(flavor, err);
1095         return ERR_PTR(err);
1096 }
1097
1098 static void
1099 gss_free(struct gss_auth *gss_auth)
1100 {
1101         gss_pipe_free(gss_auth->gss_pipe[0]);
1102         gss_pipe_free(gss_auth->gss_pipe[1]);
1103         gss_mech_put(gss_auth->mech);
1104         put_net_track(gss_auth->net, &gss_auth->ns_tracker);
1105         kfree(gss_auth->target_name);
1106
1107         kfree(gss_auth);
1108         module_put(THIS_MODULE);
1109 }
1110
1111 static void
1112 gss_free_callback(struct kref *kref)
1113 {
1114         struct gss_auth *gss_auth = container_of(kref, struct gss_auth, kref);
1115
1116         gss_free(gss_auth);
1117 }
1118
1119 static void
1120 gss_put_auth(struct gss_auth *gss_auth)
1121 {
1122         kref_put(&gss_auth->kref, gss_free_callback);
1123 }
1124
1125 static void
1126 gss_destroy(struct rpc_auth *auth)
1127 {
1128         struct gss_auth *gss_auth = container_of(auth,
1129                         struct gss_auth, rpc_auth);
1130
1131         if (hash_hashed(&gss_auth->hash)) {
1132                 spin_lock(&gss_auth_hash_lock);
1133                 hash_del(&gss_auth->hash);
1134                 spin_unlock(&gss_auth_hash_lock);
1135         }
1136
1137         gss_pipe_free(gss_auth->gss_pipe[0]);
1138         gss_auth->gss_pipe[0] = NULL;
1139         gss_pipe_free(gss_auth->gss_pipe[1]);
1140         gss_auth->gss_pipe[1] = NULL;
1141         rpcauth_destroy_credcache(auth);
1142
1143         gss_put_auth(gss_auth);
1144 }
1145
1146 /*
1147  * Auths may be shared between rpc clients that were cloned from a
1148  * common client with the same xprt, if they also share the flavor and
1149  * target_name.
1150  *
1151  * The auth is looked up from the oldest parent sharing the same
1152  * cl_xprt, and the auth itself references only that common parent
1153  * (which is guaranteed to last as long as any of its descendants).
1154  */
1155 static struct gss_auth *
1156 gss_auth_find_or_add_hashed(const struct rpc_auth_create_args *args,
1157                 struct rpc_clnt *clnt,
1158                 struct gss_auth *new)
1159 {
1160         struct gss_auth *gss_auth;
1161         unsigned long hashval = (unsigned long)clnt;
1162
1163         spin_lock(&gss_auth_hash_lock);
1164         hash_for_each_possible(gss_auth_hash_table,
1165                         gss_auth,
1166                         hash,
1167                         hashval) {
1168                 if (gss_auth->client != clnt)
1169                         continue;
1170                 if (gss_auth->rpc_auth.au_flavor != args->pseudoflavor)
1171                         continue;
1172                 if (gss_auth->target_name != args->target_name) {
1173                         if (gss_auth->target_name == NULL)
1174                                 continue;
1175                         if (args->target_name == NULL)
1176                                 continue;
1177                         if (strcmp(gss_auth->target_name, args->target_name))
1178                                 continue;
1179                 }
1180                 if (!refcount_inc_not_zero(&gss_auth->rpc_auth.au_count))
1181                         continue;
1182                 goto out;
1183         }
1184         if (new)
1185                 hash_add(gss_auth_hash_table, &new->hash, hashval);
1186         gss_auth = new;
1187 out:
1188         spin_unlock(&gss_auth_hash_lock);
1189         return gss_auth;
1190 }
1191
1192 static struct gss_auth *
1193 gss_create_hashed(const struct rpc_auth_create_args *args,
1194                   struct rpc_clnt *clnt)
1195 {
1196         struct gss_auth *gss_auth;
1197         struct gss_auth *new;
1198
1199         gss_auth = gss_auth_find_or_add_hashed(args, clnt, NULL);
1200         if (gss_auth != NULL)
1201                 goto out;
1202         new = gss_create_new(args, clnt);
1203         if (IS_ERR(new))
1204                 return new;
1205         gss_auth = gss_auth_find_or_add_hashed(args, clnt, new);
1206         if (gss_auth != new)
1207                 gss_destroy(&new->rpc_auth);
1208 out:
1209         return gss_auth;
1210 }
1211
1212 static struct rpc_auth *
1213 gss_create(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
1214 {
1215         struct gss_auth *gss_auth;
1216         struct rpc_xprt_switch *xps = rcu_access_pointer(clnt->cl_xpi.xpi_xpswitch);
1217
1218         while (clnt != clnt->cl_parent) {
1219                 struct rpc_clnt *parent = clnt->cl_parent;
1220                 /* Find the original parent for this transport */
1221                 if (rcu_access_pointer(parent->cl_xpi.xpi_xpswitch) != xps)
1222                         break;
1223                 clnt = parent;
1224         }
1225
1226         gss_auth = gss_create_hashed(args, clnt);
1227         if (IS_ERR(gss_auth))
1228                 return ERR_CAST(gss_auth);
1229         return &gss_auth->rpc_auth;
1230 }
1231
1232 static struct gss_cred *
1233 gss_dup_cred(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
1234 {
1235         struct gss_cred *new;
1236
1237         /* Make a copy of the cred so that we can reference count it */
1238         new = kzalloc(sizeof(*gss_cred), GFP_KERNEL);
1239         if (new) {
1240                 struct auth_cred acred = {
1241                         .cred = gss_cred->gc_base.cr_cred,
1242                 };
1243                 struct gss_cl_ctx *ctx =
1244                         rcu_dereference_protected(gss_cred->gc_ctx, 1);
1245
1246                 rpcauth_init_cred(&new->gc_base, &acred,
1247                                 &gss_auth->rpc_auth,
1248                                 &gss_nullops);
1249                 new->gc_base.cr_flags = 1UL << RPCAUTH_CRED_UPTODATE;
1250                 new->gc_service = gss_cred->gc_service;
1251                 new->gc_principal = gss_cred->gc_principal;
1252                 kref_get(&gss_auth->kref);
1253                 rcu_assign_pointer(new->gc_ctx, ctx);
1254                 gss_get_ctx(ctx);
1255         }
1256         return new;
1257 }
1258
1259 /*
1260  * gss_send_destroy_context will cause the RPCSEC_GSS to send a NULL RPC call
1261  * to the server with the GSS control procedure field set to
1262  * RPC_GSS_PROC_DESTROY. This should normally cause the server to release
1263  * all RPCSEC_GSS state associated with that context.
1264  */
1265 static void
1266 gss_send_destroy_context(struct rpc_cred *cred)
1267 {
1268         struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1269         struct gss_auth *gss_auth = container_of(cred->cr_auth, struct gss_auth, rpc_auth);
1270         struct gss_cl_ctx *ctx = rcu_dereference_protected(gss_cred->gc_ctx, 1);
1271         struct gss_cred *new;
1272         struct rpc_task *task;
1273
1274         new = gss_dup_cred(gss_auth, gss_cred);
1275         if (new) {
1276                 ctx->gc_proc = RPC_GSS_PROC_DESTROY;
1277
1278                 trace_rpcgss_ctx_destroy(gss_cred);
1279                 task = rpc_call_null(gss_auth->client, &new->gc_base,
1280                                      RPC_TASK_ASYNC);
1281                 if (!IS_ERR(task))
1282                         rpc_put_task(task);
1283
1284                 put_rpccred(&new->gc_base);
1285         }
1286 }
1287
1288 /* gss_destroy_cred (and gss_free_ctx) are used to clean up after failure
1289  * to create a new cred or context, so they check that things have been
1290  * allocated before freeing them. */
1291 static void
1292 gss_do_free_ctx(struct gss_cl_ctx *ctx)
1293 {
1294         gss_delete_sec_context(&ctx->gc_gss_ctx);
1295         kfree(ctx->gc_wire_ctx.data);
1296         kfree(ctx->gc_acceptor.data);
1297         kfree(ctx);
1298 }
1299
1300 static void
1301 gss_free_ctx_callback(struct rcu_head *head)
1302 {
1303         struct gss_cl_ctx *ctx = container_of(head, struct gss_cl_ctx, gc_rcu);
1304         gss_do_free_ctx(ctx);
1305 }
1306
1307 static void
1308 gss_free_ctx(struct gss_cl_ctx *ctx)
1309 {
1310         call_rcu(&ctx->gc_rcu, gss_free_ctx_callback);
1311 }
1312
1313 static void
1314 gss_free_cred(struct gss_cred *gss_cred)
1315 {
1316         kfree(gss_cred);
1317 }
1318
1319 static void
1320 gss_free_cred_callback(struct rcu_head *head)
1321 {
1322         struct gss_cred *gss_cred = container_of(head, struct gss_cred, gc_base.cr_rcu);
1323         gss_free_cred(gss_cred);
1324 }
1325
1326 static void
1327 gss_destroy_nullcred(struct rpc_cred *cred)
1328 {
1329         struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1330         struct gss_auth *gss_auth = container_of(cred->cr_auth, struct gss_auth, rpc_auth);
1331         struct gss_cl_ctx *ctx = rcu_dereference_protected(gss_cred->gc_ctx, 1);
1332
1333         RCU_INIT_POINTER(gss_cred->gc_ctx, NULL);
1334         put_cred(cred->cr_cred);
1335         call_rcu(&cred->cr_rcu, gss_free_cred_callback);
1336         if (ctx)
1337                 gss_put_ctx(ctx);
1338         gss_put_auth(gss_auth);
1339 }
1340
1341 static void
1342 gss_destroy_cred(struct rpc_cred *cred)
1343 {
1344         if (test_and_clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0)
1345                 gss_send_destroy_context(cred);
1346         gss_destroy_nullcred(cred);
1347 }
1348
1349 static int
1350 gss_hash_cred(struct auth_cred *acred, unsigned int hashbits)
1351 {
1352         return hash_64(from_kuid(&init_user_ns, acred->cred->fsuid), hashbits);
1353 }
1354
1355 /*
1356  * Lookup RPCSEC_GSS cred for the current process
1357  */
1358 static struct rpc_cred *gss_lookup_cred(struct rpc_auth *auth,
1359                                         struct auth_cred *acred, int flags)
1360 {
1361         return rpcauth_lookup_credcache(auth, acred, flags,
1362                                         rpc_task_gfp_mask());
1363 }
1364
1365 static struct rpc_cred *
1366 gss_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags, gfp_t gfp)
1367 {
1368         struct gss_auth *gss_auth = container_of(auth, struct gss_auth, rpc_auth);
1369         struct gss_cred *cred = NULL;
1370         int err = -ENOMEM;
1371
1372         if (!(cred = kzalloc(sizeof(*cred), gfp)))
1373                 goto out_err;
1374
1375         rpcauth_init_cred(&cred->gc_base, acred, auth, &gss_credops);
1376         /*
1377          * Note: in order to force a call to call_refresh(), we deliberately
1378          * fail to flag the credential as RPCAUTH_CRED_UPTODATE.
1379          */
1380         cred->gc_base.cr_flags = 1UL << RPCAUTH_CRED_NEW;
1381         cred->gc_service = gss_auth->service;
1382         cred->gc_principal = acred->principal;
1383         kref_get(&gss_auth->kref);
1384         return &cred->gc_base;
1385
1386 out_err:
1387         return ERR_PTR(err);
1388 }
1389
1390 static int
1391 gss_cred_init(struct rpc_auth *auth, struct rpc_cred *cred)
1392 {
1393         struct gss_auth *gss_auth = container_of(auth, struct gss_auth, rpc_auth);
1394         struct gss_cred *gss_cred = container_of(cred,struct gss_cred, gc_base);
1395         int err;
1396
1397         do {
1398                 err = gss_create_upcall(gss_auth, gss_cred);
1399         } while (err == -EAGAIN);
1400         return err;
1401 }
1402
1403 static char *
1404 gss_stringify_acceptor(struct rpc_cred *cred)
1405 {
1406         char *string = NULL;
1407         struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1408         struct gss_cl_ctx *ctx;
1409         unsigned int len;
1410         struct xdr_netobj *acceptor;
1411
1412         rcu_read_lock();
1413         ctx = rcu_dereference(gss_cred->gc_ctx);
1414         if (!ctx)
1415                 goto out;
1416
1417         len = ctx->gc_acceptor.len;
1418         rcu_read_unlock();
1419
1420         /* no point if there's no string */
1421         if (!len)
1422                 return NULL;
1423 realloc:
1424         string = kmalloc(len + 1, GFP_KERNEL);
1425         if (!string)
1426                 return NULL;
1427
1428         rcu_read_lock();
1429         ctx = rcu_dereference(gss_cred->gc_ctx);
1430
1431         /* did the ctx disappear or was it replaced by one with no acceptor? */
1432         if (!ctx || !ctx->gc_acceptor.len) {
1433                 kfree(string);
1434                 string = NULL;
1435                 goto out;
1436         }
1437
1438         acceptor = &ctx->gc_acceptor;
1439
1440         /*
1441          * Did we find a new acceptor that's longer than the original? Allocate
1442          * a longer buffer and try again.
1443          */
1444         if (len < acceptor->len) {
1445                 len = acceptor->len;
1446                 rcu_read_unlock();
1447                 kfree(string);
1448                 goto realloc;
1449         }
1450
1451         memcpy(string, acceptor->data, acceptor->len);
1452         string[acceptor->len] = '\0';
1453 out:
1454         rcu_read_unlock();
1455         return string;
1456 }
1457
1458 /*
1459  * Returns -EACCES if GSS context is NULL or will expire within the
1460  * timeout (miliseconds)
1461  */
1462 static int
1463 gss_key_timeout(struct rpc_cred *rc)
1464 {
1465         struct gss_cred *gss_cred = container_of(rc, struct gss_cred, gc_base);
1466         struct gss_cl_ctx *ctx;
1467         unsigned long timeout = jiffies + (gss_key_expire_timeo * HZ);
1468         int ret = 0;
1469
1470         rcu_read_lock();
1471         ctx = rcu_dereference(gss_cred->gc_ctx);
1472         if (!ctx || time_after(timeout, ctx->gc_expiry))
1473                 ret = -EACCES;
1474         rcu_read_unlock();
1475
1476         return ret;
1477 }
1478
1479 static int
1480 gss_match(struct auth_cred *acred, struct rpc_cred *rc, int flags)
1481 {
1482         struct gss_cred *gss_cred = container_of(rc, struct gss_cred, gc_base);
1483         struct gss_cl_ctx *ctx;
1484         int ret;
1485
1486         if (test_bit(RPCAUTH_CRED_NEW, &rc->cr_flags))
1487                 goto out;
1488         /* Don't match with creds that have expired. */
1489         rcu_read_lock();
1490         ctx = rcu_dereference(gss_cred->gc_ctx);
1491         if (!ctx || time_after(jiffies, ctx->gc_expiry)) {
1492                 rcu_read_unlock();
1493                 return 0;
1494         }
1495         rcu_read_unlock();
1496         if (!test_bit(RPCAUTH_CRED_UPTODATE, &rc->cr_flags))
1497                 return 0;
1498 out:
1499         if (acred->principal != NULL) {
1500                 if (gss_cred->gc_principal == NULL)
1501                         return 0;
1502                 ret = strcmp(acred->principal, gss_cred->gc_principal) == 0;
1503         } else {
1504                 if (gss_cred->gc_principal != NULL)
1505                         return 0;
1506                 ret = uid_eq(rc->cr_cred->fsuid, acred->cred->fsuid);
1507         }
1508         return ret;
1509 }
1510
1511 /*
1512  * Marshal credentials.
1513  *
1514  * The expensive part is computing the verifier. We can't cache a
1515  * pre-computed version of the verifier because the seqno, which
1516  * is different every time, is included in the MIC.
1517  */
1518 static int gss_marshal(struct rpc_task *task, struct xdr_stream *xdr)
1519 {
1520         struct rpc_rqst *req = task->tk_rqstp;
1521         struct rpc_cred *cred = req->rq_cred;
1522         struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
1523                                                  gc_base);
1524         struct gss_cl_ctx       *ctx = gss_cred_get_ctx(cred);
1525         __be32          *p, *cred_len;
1526         u32             maj_stat = 0;
1527         struct xdr_netobj mic;
1528         struct kvec     iov;
1529         struct xdr_buf  verf_buf;
1530         int status;
1531
1532         /* Credential */
1533
1534         p = xdr_reserve_space(xdr, 7 * sizeof(*p) +
1535                               ctx->gc_wire_ctx.len);
1536         if (!p)
1537                 goto marshal_failed;
1538         *p++ = rpc_auth_gss;
1539         cred_len = p++;
1540
1541         spin_lock(&ctx->gc_seq_lock);
1542         req->rq_seqno = (ctx->gc_seq < MAXSEQ) ? ctx->gc_seq++ : MAXSEQ;
1543         spin_unlock(&ctx->gc_seq_lock);
1544         if (req->rq_seqno == MAXSEQ)
1545                 goto expired;
1546         trace_rpcgss_seqno(task);
1547
1548         *p++ = cpu_to_be32(RPC_GSS_VERSION);
1549         *p++ = cpu_to_be32(ctx->gc_proc);
1550         *p++ = cpu_to_be32(req->rq_seqno);
1551         *p++ = cpu_to_be32(gss_cred->gc_service);
1552         p = xdr_encode_netobj(p, &ctx->gc_wire_ctx);
1553         *cred_len = cpu_to_be32((p - (cred_len + 1)) << 2);
1554
1555         /* Verifier */
1556
1557         /* We compute the checksum for the verifier over the xdr-encoded bytes
1558          * starting with the xid and ending at the end of the credential: */
1559         iov.iov_base = req->rq_snd_buf.head[0].iov_base;
1560         iov.iov_len = (u8 *)p - (u8 *)iov.iov_base;
1561         xdr_buf_from_iov(&iov, &verf_buf);
1562
1563         p = xdr_reserve_space(xdr, sizeof(*p));
1564         if (!p)
1565                 goto marshal_failed;
1566         *p++ = rpc_auth_gss;
1567         mic.data = (u8 *)(p + 1);
1568         maj_stat = gss_get_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
1569         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1570                 goto expired;
1571         else if (maj_stat != 0)
1572                 goto bad_mic;
1573         if (xdr_stream_encode_opaque_inline(xdr, (void **)&p, mic.len) < 0)
1574                 goto marshal_failed;
1575         status = 0;
1576 out:
1577         gss_put_ctx(ctx);
1578         return status;
1579 expired:
1580         clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1581         status = -EKEYEXPIRED;
1582         goto out;
1583 marshal_failed:
1584         status = -EMSGSIZE;
1585         goto out;
1586 bad_mic:
1587         trace_rpcgss_get_mic(task, maj_stat);
1588         status = -EIO;
1589         goto out;
1590 }
1591
1592 static int gss_renew_cred(struct rpc_task *task)
1593 {
1594         struct rpc_cred *oldcred = task->tk_rqstp->rq_cred;
1595         struct gss_cred *gss_cred = container_of(oldcred,
1596                                                  struct gss_cred,
1597                                                  gc_base);
1598         struct rpc_auth *auth = oldcred->cr_auth;
1599         struct auth_cred acred = {
1600                 .cred = oldcred->cr_cred,
1601                 .principal = gss_cred->gc_principal,
1602         };
1603         struct rpc_cred *new;
1604
1605         new = gss_lookup_cred(auth, &acred, RPCAUTH_LOOKUP_NEW);
1606         if (IS_ERR(new))
1607                 return PTR_ERR(new);
1608
1609         task->tk_rqstp->rq_cred = new;
1610         put_rpccred(oldcred);
1611         return 0;
1612 }
1613
1614 static int gss_cred_is_negative_entry(struct rpc_cred *cred)
1615 {
1616         if (test_bit(RPCAUTH_CRED_NEGATIVE, &cred->cr_flags)) {
1617                 unsigned long now = jiffies;
1618                 unsigned long begin, expire;
1619                 struct gss_cred *gss_cred;
1620
1621                 gss_cred = container_of(cred, struct gss_cred, gc_base);
1622                 begin = gss_cred->gc_upcall_timestamp;
1623                 expire = begin + gss_expired_cred_retry_delay * HZ;
1624
1625                 if (time_in_range_open(now, begin, expire))
1626                         return 1;
1627         }
1628         return 0;
1629 }
1630
1631 /*
1632 * Refresh credentials. XXX - finish
1633 */
1634 static int
1635 gss_refresh(struct rpc_task *task)
1636 {
1637         struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1638         int ret = 0;
1639
1640         if (gss_cred_is_negative_entry(cred))
1641                 return -EKEYEXPIRED;
1642
1643         if (!test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags) &&
1644                         !test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags)) {
1645                 ret = gss_renew_cred(task);
1646                 if (ret < 0)
1647                         goto out;
1648                 cred = task->tk_rqstp->rq_cred;
1649         }
1650
1651         if (test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags))
1652                 ret = gss_refresh_upcall(task);
1653 out:
1654         return ret;
1655 }
1656
1657 /* Dummy refresh routine: used only when destroying the context */
1658 static int
1659 gss_refresh_null(struct rpc_task *task)
1660 {
1661         return 0;
1662 }
1663
1664 static int
1665 gss_validate(struct rpc_task *task, struct xdr_stream *xdr)
1666 {
1667         struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1668         struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
1669         __be32          *p, *seq = NULL;
1670         struct kvec     iov;
1671         struct xdr_buf  verf_buf;
1672         struct xdr_netobj mic;
1673         u32             len, maj_stat;
1674         int             status;
1675
1676         p = xdr_inline_decode(xdr, 2 * sizeof(*p));
1677         if (!p)
1678                 goto validate_failed;
1679         if (*p++ != rpc_auth_gss)
1680                 goto validate_failed;
1681         len = be32_to_cpup(p);
1682         if (len > RPC_MAX_AUTH_SIZE)
1683                 goto validate_failed;
1684         p = xdr_inline_decode(xdr, len);
1685         if (!p)
1686                 goto validate_failed;
1687
1688         seq = kmalloc(4, GFP_KERNEL);
1689         if (!seq)
1690                 goto validate_failed;
1691         *seq = cpu_to_be32(task->tk_rqstp->rq_seqno);
1692         iov.iov_base = seq;
1693         iov.iov_len = 4;
1694         xdr_buf_from_iov(&iov, &verf_buf);
1695         mic.data = (u8 *)p;
1696         mic.len = len;
1697         maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
1698         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1699                 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1700         if (maj_stat)
1701                 goto bad_mic;
1702
1703         /* We leave it to unwrap to calculate au_rslack. For now we just
1704          * calculate the length of the verifier: */
1705         if (test_bit(RPCAUTH_AUTH_UPDATE_SLACK, &cred->cr_auth->au_flags))
1706                 cred->cr_auth->au_verfsize = XDR_QUADLEN(len) + 2;
1707         status = 0;
1708 out:
1709         gss_put_ctx(ctx);
1710         kfree(seq);
1711         return status;
1712
1713 validate_failed:
1714         status = -EIO;
1715         goto out;
1716 bad_mic:
1717         trace_rpcgss_verify_mic(task, maj_stat);
1718         status = -EACCES;
1719         goto out;
1720 }
1721
1722 static noinline_for_stack int
1723 gss_wrap_req_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
1724                    struct rpc_task *task, struct xdr_stream *xdr)
1725 {
1726         struct rpc_rqst *rqstp = task->tk_rqstp;
1727         struct xdr_buf integ_buf, *snd_buf = &rqstp->rq_snd_buf;
1728         struct xdr_netobj mic;
1729         __be32 *p, *integ_len;
1730         u32 offset, maj_stat;
1731
1732         p = xdr_reserve_space(xdr, 2 * sizeof(*p));
1733         if (!p)
1734                 goto wrap_failed;
1735         integ_len = p++;
1736         *p = cpu_to_be32(rqstp->rq_seqno);
1737
1738         if (rpcauth_wrap_req_encode(task, xdr))
1739                 goto wrap_failed;
1740
1741         offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base;
1742         if (xdr_buf_subsegment(snd_buf, &integ_buf,
1743                                 offset, snd_buf->len - offset))
1744                 goto wrap_failed;
1745         *integ_len = cpu_to_be32(integ_buf.len);
1746
1747         p = xdr_reserve_space(xdr, 0);
1748         if (!p)
1749                 goto wrap_failed;
1750         mic.data = (u8 *)(p + 1);
1751         maj_stat = gss_get_mic(ctx->gc_gss_ctx, &integ_buf, &mic);
1752         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1753                 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1754         else if (maj_stat)
1755                 goto bad_mic;
1756         /* Check that the trailing MIC fit in the buffer, after the fact */
1757         if (xdr_stream_encode_opaque_inline(xdr, (void **)&p, mic.len) < 0)
1758                 goto wrap_failed;
1759         return 0;
1760 wrap_failed:
1761         return -EMSGSIZE;
1762 bad_mic:
1763         trace_rpcgss_get_mic(task, maj_stat);
1764         return -EIO;
1765 }
1766
1767 static void
1768 priv_release_snd_buf(struct rpc_rqst *rqstp)
1769 {
1770         int i;
1771
1772         for (i=0; i < rqstp->rq_enc_pages_num; i++)
1773                 __free_page(rqstp->rq_enc_pages[i]);
1774         kfree(rqstp->rq_enc_pages);
1775         rqstp->rq_release_snd_buf = NULL;
1776 }
1777
1778 static int
1779 alloc_enc_pages(struct rpc_rqst *rqstp)
1780 {
1781         struct xdr_buf *snd_buf = &rqstp->rq_snd_buf;
1782         int first, last, i;
1783
1784         if (rqstp->rq_release_snd_buf)
1785                 rqstp->rq_release_snd_buf(rqstp);
1786
1787         if (snd_buf->page_len == 0) {
1788                 rqstp->rq_enc_pages_num = 0;
1789                 return 0;
1790         }
1791
1792         first = snd_buf->page_base >> PAGE_SHIFT;
1793         last = (snd_buf->page_base + snd_buf->page_len - 1) >> PAGE_SHIFT;
1794         rqstp->rq_enc_pages_num = last - first + 1 + 1;
1795         rqstp->rq_enc_pages
1796                 = kmalloc_array(rqstp->rq_enc_pages_num,
1797                                 sizeof(struct page *),
1798                                 GFP_KERNEL);
1799         if (!rqstp->rq_enc_pages)
1800                 goto out;
1801         for (i=0; i < rqstp->rq_enc_pages_num; i++) {
1802                 rqstp->rq_enc_pages[i] = alloc_page(GFP_KERNEL);
1803                 if (rqstp->rq_enc_pages[i] == NULL)
1804                         goto out_free;
1805         }
1806         rqstp->rq_release_snd_buf = priv_release_snd_buf;
1807         return 0;
1808 out_free:
1809         rqstp->rq_enc_pages_num = i;
1810         priv_release_snd_buf(rqstp);
1811 out:
1812         return -EAGAIN;
1813 }
1814
1815 static noinline_for_stack int
1816 gss_wrap_req_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
1817                   struct rpc_task *task, struct xdr_stream *xdr)
1818 {
1819         struct rpc_rqst *rqstp = task->tk_rqstp;
1820         struct xdr_buf  *snd_buf = &rqstp->rq_snd_buf;
1821         u32             pad, offset, maj_stat;
1822         int             status;
1823         __be32          *p, *opaque_len;
1824         struct page     **inpages;
1825         int             first;
1826         struct kvec     *iov;
1827
1828         status = -EIO;
1829         p = xdr_reserve_space(xdr, 2 * sizeof(*p));
1830         if (!p)
1831                 goto wrap_failed;
1832         opaque_len = p++;
1833         *p = cpu_to_be32(rqstp->rq_seqno);
1834
1835         if (rpcauth_wrap_req_encode(task, xdr))
1836                 goto wrap_failed;
1837
1838         status = alloc_enc_pages(rqstp);
1839         if (unlikely(status))
1840                 goto wrap_failed;
1841         first = snd_buf->page_base >> PAGE_SHIFT;
1842         inpages = snd_buf->pages + first;
1843         snd_buf->pages = rqstp->rq_enc_pages;
1844         snd_buf->page_base -= first << PAGE_SHIFT;
1845         /*
1846          * Move the tail into its own page, in case gss_wrap needs
1847          * more space in the head when wrapping.
1848          *
1849          * Still... Why can't gss_wrap just slide the tail down?
1850          */
1851         if (snd_buf->page_len || snd_buf->tail[0].iov_len) {
1852                 char *tmp;
1853
1854                 tmp = page_address(rqstp->rq_enc_pages[rqstp->rq_enc_pages_num - 1]);
1855                 memcpy(tmp, snd_buf->tail[0].iov_base, snd_buf->tail[0].iov_len);
1856                 snd_buf->tail[0].iov_base = tmp;
1857         }
1858         offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base;
1859         maj_stat = gss_wrap(ctx->gc_gss_ctx, offset, snd_buf, inpages);
1860         /* slack space should prevent this ever happening: */
1861         if (unlikely(snd_buf->len > snd_buf->buflen))
1862                 goto wrap_failed;
1863         /* We're assuming that when GSS_S_CONTEXT_EXPIRED, the encryption was
1864          * done anyway, so it's safe to put the request on the wire: */
1865         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1866                 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1867         else if (maj_stat)
1868                 goto bad_wrap;
1869
1870         *opaque_len = cpu_to_be32(snd_buf->len - offset);
1871         /* guess whether the pad goes into the head or the tail: */
1872         if (snd_buf->page_len || snd_buf->tail[0].iov_len)
1873                 iov = snd_buf->tail;
1874         else
1875                 iov = snd_buf->head;
1876         p = iov->iov_base + iov->iov_len;
1877         pad = xdr_pad_size(snd_buf->len - offset);
1878         memset(p, 0, pad);
1879         iov->iov_len += pad;
1880         snd_buf->len += pad;
1881
1882         return 0;
1883 wrap_failed:
1884         return status;
1885 bad_wrap:
1886         trace_rpcgss_wrap(task, maj_stat);
1887         return -EIO;
1888 }
1889
1890 static int gss_wrap_req(struct rpc_task *task, struct xdr_stream *xdr)
1891 {
1892         struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1893         struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
1894                         gc_base);
1895         struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
1896         int status;
1897
1898         status = -EIO;
1899         if (ctx->gc_proc != RPC_GSS_PROC_DATA) {
1900                 /* The spec seems a little ambiguous here, but I think that not
1901                  * wrapping context destruction requests makes the most sense.
1902                  */
1903                 status = rpcauth_wrap_req_encode(task, xdr);
1904                 goto out;
1905         }
1906         switch (gss_cred->gc_service) {
1907         case RPC_GSS_SVC_NONE:
1908                 status = rpcauth_wrap_req_encode(task, xdr);
1909                 break;
1910         case RPC_GSS_SVC_INTEGRITY:
1911                 status = gss_wrap_req_integ(cred, ctx, task, xdr);
1912                 break;
1913         case RPC_GSS_SVC_PRIVACY:
1914                 status = gss_wrap_req_priv(cred, ctx, task, xdr);
1915                 break;
1916         default:
1917                 status = -EIO;
1918         }
1919 out:
1920         gss_put_ctx(ctx);
1921         return status;
1922 }
1923
1924 /**
1925  * gss_update_rslack - Possibly update RPC receive buffer size estimates
1926  * @task: rpc_task for incoming RPC Reply being unwrapped
1927  * @cred: controlling rpc_cred for @task
1928  * @before: XDR words needed before each RPC Reply message
1929  * @after: XDR words needed following each RPC Reply message
1930  *
1931  */
1932 static void gss_update_rslack(struct rpc_task *task, struct rpc_cred *cred,
1933                               unsigned int before, unsigned int after)
1934 {
1935         struct rpc_auth *auth = cred->cr_auth;
1936
1937         if (test_and_clear_bit(RPCAUTH_AUTH_UPDATE_SLACK, &auth->au_flags)) {
1938                 auth->au_ralign = auth->au_verfsize + before;
1939                 auth->au_rslack = auth->au_verfsize + after;
1940                 trace_rpcgss_update_slack(task, auth);
1941         }
1942 }
1943
1944 static int
1945 gss_unwrap_resp_auth(struct rpc_task *task, struct rpc_cred *cred)
1946 {
1947         gss_update_rslack(task, cred, 0, 0);
1948         return 0;
1949 }
1950
1951 /*
1952  * RFC 2203, Section 5.3.2.2
1953  *
1954  *      struct rpc_gss_integ_data {
1955  *              opaque databody_integ<>;
1956  *              opaque checksum<>;
1957  *      };
1958  *
1959  *      struct rpc_gss_data_t {
1960  *              unsigned int seq_num;
1961  *              proc_req_arg_t arg;
1962  *      };
1963  */
1964 static noinline_for_stack int
1965 gss_unwrap_resp_integ(struct rpc_task *task, struct rpc_cred *cred,
1966                       struct gss_cl_ctx *ctx, struct rpc_rqst *rqstp,
1967                       struct xdr_stream *xdr)
1968 {
1969         struct xdr_buf gss_data, *rcv_buf = &rqstp->rq_rcv_buf;
1970         u32 len, offset, seqno, maj_stat;
1971         struct xdr_netobj mic;
1972         int ret;
1973
1974         ret = -EIO;
1975         mic.data = NULL;
1976
1977         /* opaque databody_integ<>; */
1978         if (xdr_stream_decode_u32(xdr, &len))
1979                 goto unwrap_failed;
1980         if (len & 3)
1981                 goto unwrap_failed;
1982         offset = rcv_buf->len - xdr_stream_remaining(xdr);
1983         if (xdr_stream_decode_u32(xdr, &seqno))
1984                 goto unwrap_failed;
1985         if (seqno != rqstp->rq_seqno)
1986                 goto bad_seqno;
1987         if (xdr_buf_subsegment(rcv_buf, &gss_data, offset, len))
1988                 goto unwrap_failed;
1989
1990         /*
1991          * The xdr_stream now points to the beginning of the
1992          * upper layer payload, to be passed below to
1993          * rpcauth_unwrap_resp_decode(). The checksum, which
1994          * follows the upper layer payload in @rcv_buf, is
1995          * located and parsed without updating the xdr_stream.
1996          */
1997
1998         /* opaque checksum<>; */
1999         offset += len;
2000         if (xdr_decode_word(rcv_buf, offset, &len))
2001                 goto unwrap_failed;
2002         offset += sizeof(__be32);
2003         if (offset + len > rcv_buf->len)
2004                 goto unwrap_failed;
2005         mic.len = len;
2006         mic.data = kmalloc(len, GFP_KERNEL);
2007         if (ZERO_OR_NULL_PTR(mic.data))
2008                 goto unwrap_failed;
2009         if (read_bytes_from_xdr_buf(rcv_buf, offset, mic.data, mic.len))
2010                 goto unwrap_failed;
2011
2012         maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &gss_data, &mic);
2013         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
2014                 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
2015         if (maj_stat != GSS_S_COMPLETE)
2016                 goto bad_mic;
2017
2018         gss_update_rslack(task, cred, 2, 2 + 1 + XDR_QUADLEN(mic.len));
2019         ret = 0;
2020
2021 out:
2022         kfree(mic.data);
2023         return ret;
2024
2025 unwrap_failed:
2026         trace_rpcgss_unwrap_failed(task);
2027         goto out;
2028 bad_seqno:
2029         trace_rpcgss_bad_seqno(task, rqstp->rq_seqno, seqno);
2030         goto out;
2031 bad_mic:
2032         trace_rpcgss_verify_mic(task, maj_stat);
2033         goto out;
2034 }
2035
2036 static noinline_for_stack int
2037 gss_unwrap_resp_priv(struct rpc_task *task, struct rpc_cred *cred,
2038                      struct gss_cl_ctx *ctx, struct rpc_rqst *rqstp,
2039                      struct xdr_stream *xdr)
2040 {
2041         struct xdr_buf *rcv_buf = &rqstp->rq_rcv_buf;
2042         struct kvec *head = rqstp->rq_rcv_buf.head;
2043         u32 offset, opaque_len, maj_stat;
2044         __be32 *p;
2045
2046         p = xdr_inline_decode(xdr, 2 * sizeof(*p));
2047         if (unlikely(!p))
2048                 goto unwrap_failed;
2049         opaque_len = be32_to_cpup(p++);
2050         offset = (u8 *)(p) - (u8 *)head->iov_base;
2051         if (offset + opaque_len > rcv_buf->len)
2052                 goto unwrap_failed;
2053
2054         maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset,
2055                               offset + opaque_len, rcv_buf);
2056         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
2057                 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
2058         if (maj_stat != GSS_S_COMPLETE)
2059                 goto bad_unwrap;
2060         /* gss_unwrap decrypted the sequence number */
2061         if (be32_to_cpup(p++) != rqstp->rq_seqno)
2062                 goto bad_seqno;
2063
2064         /* gss_unwrap redacts the opaque blob from the head iovec.
2065          * rcv_buf has changed, thus the stream needs to be reset.
2066          */
2067         xdr_init_decode(xdr, rcv_buf, p, rqstp);
2068
2069         gss_update_rslack(task, cred, 2 + ctx->gc_gss_ctx->align,
2070                           2 + ctx->gc_gss_ctx->slack);
2071
2072         return 0;
2073 unwrap_failed:
2074         trace_rpcgss_unwrap_failed(task);
2075         return -EIO;
2076 bad_seqno:
2077         trace_rpcgss_bad_seqno(task, rqstp->rq_seqno, be32_to_cpup(--p));
2078         return -EIO;
2079 bad_unwrap:
2080         trace_rpcgss_unwrap(task, maj_stat);
2081         return -EIO;
2082 }
2083
2084 static bool
2085 gss_seq_is_newer(u32 new, u32 old)
2086 {
2087         return (s32)(new - old) > 0;
2088 }
2089
2090 static bool
2091 gss_xmit_need_reencode(struct rpc_task *task)
2092 {
2093         struct rpc_rqst *req = task->tk_rqstp;
2094         struct rpc_cred *cred = req->rq_cred;
2095         struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
2096         u32 win, seq_xmit = 0;
2097         bool ret = true;
2098
2099         if (!ctx)
2100                 goto out;
2101
2102         if (gss_seq_is_newer(req->rq_seqno, READ_ONCE(ctx->gc_seq)))
2103                 goto out_ctx;
2104
2105         seq_xmit = READ_ONCE(ctx->gc_seq_xmit);
2106         while (gss_seq_is_newer(req->rq_seqno, seq_xmit)) {
2107                 u32 tmp = seq_xmit;
2108
2109                 seq_xmit = cmpxchg(&ctx->gc_seq_xmit, tmp, req->rq_seqno);
2110                 if (seq_xmit == tmp) {
2111                         ret = false;
2112                         goto out_ctx;
2113                 }
2114         }
2115
2116         win = ctx->gc_win;
2117         if (win > 0)
2118                 ret = !gss_seq_is_newer(req->rq_seqno, seq_xmit - win);
2119
2120 out_ctx:
2121         gss_put_ctx(ctx);
2122 out:
2123         trace_rpcgss_need_reencode(task, seq_xmit, ret);
2124         return ret;
2125 }
2126
2127 static int
2128 gss_unwrap_resp(struct rpc_task *task, struct xdr_stream *xdr)
2129 {
2130         struct rpc_rqst *rqstp = task->tk_rqstp;
2131         struct rpc_cred *cred = rqstp->rq_cred;
2132         struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
2133                         gc_base);
2134         struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
2135         int status = -EIO;
2136
2137         if (ctx->gc_proc != RPC_GSS_PROC_DATA)
2138                 goto out_decode;
2139         switch (gss_cred->gc_service) {
2140         case RPC_GSS_SVC_NONE:
2141                 status = gss_unwrap_resp_auth(task, cred);
2142                 break;
2143         case RPC_GSS_SVC_INTEGRITY:
2144                 status = gss_unwrap_resp_integ(task, cred, ctx, rqstp, xdr);
2145                 break;
2146         case RPC_GSS_SVC_PRIVACY:
2147                 status = gss_unwrap_resp_priv(task, cred, ctx, rqstp, xdr);
2148                 break;
2149         }
2150         if (status)
2151                 goto out;
2152
2153 out_decode:
2154         status = rpcauth_unwrap_resp_decode(task, xdr);
2155 out:
2156         gss_put_ctx(ctx);
2157         return status;
2158 }
2159
2160 static const struct rpc_authops authgss_ops = {
2161         .owner          = THIS_MODULE,
2162         .au_flavor      = RPC_AUTH_GSS,
2163         .au_name        = "RPCSEC_GSS",
2164         .create         = gss_create,
2165         .destroy        = gss_destroy,
2166         .hash_cred      = gss_hash_cred,
2167         .lookup_cred    = gss_lookup_cred,
2168         .crcreate       = gss_create_cred,
2169         .info2flavor    = gss_mech_info2flavor,
2170         .flavor2info    = gss_mech_flavor2info,
2171 };
2172
2173 static const struct rpc_credops gss_credops = {
2174         .cr_name                = "AUTH_GSS",
2175         .crdestroy              = gss_destroy_cred,
2176         .cr_init                = gss_cred_init,
2177         .crmatch                = gss_match,
2178         .crmarshal              = gss_marshal,
2179         .crrefresh              = gss_refresh,
2180         .crvalidate             = gss_validate,
2181         .crwrap_req             = gss_wrap_req,
2182         .crunwrap_resp          = gss_unwrap_resp,
2183         .crkey_timeout          = gss_key_timeout,
2184         .crstringify_acceptor   = gss_stringify_acceptor,
2185         .crneed_reencode        = gss_xmit_need_reencode,
2186 };
2187
2188 static const struct rpc_credops gss_nullops = {
2189         .cr_name                = "AUTH_GSS",
2190         .crdestroy              = gss_destroy_nullcred,
2191         .crmatch                = gss_match,
2192         .crmarshal              = gss_marshal,
2193         .crrefresh              = gss_refresh_null,
2194         .crvalidate             = gss_validate,
2195         .crwrap_req             = gss_wrap_req,
2196         .crunwrap_resp          = gss_unwrap_resp,
2197         .crstringify_acceptor   = gss_stringify_acceptor,
2198 };
2199
2200 static const struct rpc_pipe_ops gss_upcall_ops_v0 = {
2201         .upcall         = gss_v0_upcall,
2202         .downcall       = gss_pipe_downcall,
2203         .destroy_msg    = gss_pipe_destroy_msg,
2204         .open_pipe      = gss_pipe_open_v0,
2205         .release_pipe   = gss_pipe_release,
2206 };
2207
2208 static const struct rpc_pipe_ops gss_upcall_ops_v1 = {
2209         .upcall         = gss_v1_upcall,
2210         .downcall       = gss_pipe_downcall,
2211         .destroy_msg    = gss_pipe_destroy_msg,
2212         .open_pipe      = gss_pipe_open_v1,
2213         .release_pipe   = gss_pipe_release,
2214 };
2215
2216 static __net_init int rpcsec_gss_init_net(struct net *net)
2217 {
2218         return gss_svc_init_net(net);
2219 }
2220
2221 static __net_exit void rpcsec_gss_exit_net(struct net *net)
2222 {
2223         gss_svc_shutdown_net(net);
2224 }
2225
2226 static struct pernet_operations rpcsec_gss_net_ops = {
2227         .init = rpcsec_gss_init_net,
2228         .exit = rpcsec_gss_exit_net,
2229 };
2230
2231 /*
2232  * Initialize RPCSEC_GSS module
2233  */
2234 static int __init init_rpcsec_gss(void)
2235 {
2236         int err = 0;
2237
2238         err = rpcauth_register(&authgss_ops);
2239         if (err)
2240                 goto out;
2241         err = gss_svc_init();
2242         if (err)
2243                 goto out_unregister;
2244         err = register_pernet_subsys(&rpcsec_gss_net_ops);
2245         if (err)
2246                 goto out_svc_exit;
2247         rpc_init_wait_queue(&pipe_version_rpc_waitqueue, "gss pipe version");
2248         return 0;
2249 out_svc_exit:
2250         gss_svc_shutdown();
2251 out_unregister:
2252         rpcauth_unregister(&authgss_ops);
2253 out:
2254         return err;
2255 }
2256
2257 static void __exit exit_rpcsec_gss(void)
2258 {
2259         unregister_pernet_subsys(&rpcsec_gss_net_ops);
2260         gss_svc_shutdown();
2261         rpcauth_unregister(&authgss_ops);
2262         rcu_barrier(); /* Wait for completion of call_rcu()'s */
2263 }
2264
2265 MODULE_ALIAS("rpc-auth-6");
2266 MODULE_LICENSE("GPL");
2267 module_param_named(expired_cred_retry_delay,
2268                    gss_expired_cred_retry_delay,
2269                    uint, 0644);
2270 MODULE_PARM_DESC(expired_cred_retry_delay, "Timeout (in seconds) until "
2271                 "the RPC engine retries an expired credential");
2272
2273 module_param_named(key_expire_timeo,
2274                    gss_key_expire_timeo,
2275                    uint, 0644);
2276 MODULE_PARM_DESC(key_expire_timeo, "Time (in seconds) at the end of a "
2277                 "credential keys lifetime where the NFS layer cleans up "
2278                 "prior to key expiration");
2279
2280 module_init(init_rpcsec_gss)
2281 module_exit(exit_rpcsec_gss)