net/sunrpc/auth_gss/auth_gss.c

   1 // SPDX-License-Identifier: BSD-3-Clause
   2 /*
   3  * linux/net/sunrpc/auth_gss/auth_gss.c
   4  *
   5  * RPCSEC_GSS client authentication.
   6  *
   7  *  Copyright (c) 2000 The Regents of the University of Michigan.
   8  *  All rights reserved.
   9  *
  10  *  Dug Song       <dugsong@monkey.org>
  11  *  Andy Adamson   <andros@umich.edu>
  12  */
  13
  14 #include <linux/module.h>
  15 #include <linux/init.h>
  16 #include <linux/types.h>
  17 #include <linux/slab.h>
  18 #include <linux/sched.h>
  19 #include <linux/pagemap.h>
  20 #include <linux/sunrpc/clnt.h>
  21 #include <linux/sunrpc/auth.h>
  22 #include <linux/sunrpc/auth_gss.h>
  23 #include <linux/sunrpc/gss_krb5.h>
  24 #include <linux/sunrpc/svcauth_gss.h>
  25 #include <linux/sunrpc/gss_err.h>
  26 #include <linux/workqueue.h>
  27 #include <linux/sunrpc/rpc_pipe_fs.h>
  28 #include <linux/sunrpc/gss_api.h>
  29 #include <linux/uaccess.h>
  30 #include <linux/hashtable.h>
  31
  32 #include "auth_gss_internal.h"
  33 #include "../netns.h"
  34
  35 #include <trace/events/rpcgss.h>
  36
  37 static const struct rpc_authops authgss_ops;
  38
  39 static const struct rpc_credops gss_credops;
  40 static const struct rpc_credops gss_nullops;
  41
  42 #define GSS_RETRY_EXPIRED 5
  43 static unsigned int gss_expired_cred_retry_delay = GSS_RETRY_EXPIRED;
  44
  45 #define GSS_KEY_EXPIRE_TIMEO 240
  46 static unsigned int gss_key_expire_timeo = GSS_KEY_EXPIRE_TIMEO;
  47
  48 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
  49 # define RPCDBG_FACILITY        RPCDBG_AUTH
  50 #endif
  51
  52 #define GSS_CRED_SLACK          (RPC_MAX_AUTH_SIZE * 2)
  53 /* length of a krb5 verifier (48), plus data added before arguments when
  54  * using integrity (two 4-byte integers): */
  55 #define GSS_VERF_SLACK          100
  56
  57 static DEFINE_HASHTABLE(gss_auth_hash_table, 4);
  58 static DEFINE_SPINLOCK(gss_auth_hash_lock);
  59
  60 struct gss_pipe {
  61         struct rpc_pipe_dir_object pdo;
  62         struct rpc_pipe *pipe;
  63         struct rpc_clnt *clnt;
  64         const char *name;
  65         struct kref kref;
  66 };
  67
  68 struct gss_auth {
  69         struct kref kref;
  70         struct hlist_node hash;
  71         struct rpc_auth rpc_auth;
  72         struct gss_api_mech *mech;
  73         enum rpc_gss_svc service;
  74         struct rpc_clnt *client;
  75         struct net *net;
  76         /*
  77          * There are two upcall pipes; dentry[1], named "gssd", is used
  78          * for the new text-based upcall; dentry[0] is named after the
  79          * mechanism (for example, "krb5") and exists for
  80          * backwards-compatibility with older gssd's.
  81          */
  82         struct gss_pipe *gss_pipe[2];
  83         const char *target_name;
  84 };
  85
  86 /* pipe_version >= 0 if and only if someone has a pipe open. */
  87 static DEFINE_SPINLOCK(pipe_version_lock);
  88 static struct rpc_wait_queue pipe_version_rpc_waitqueue;
  89 static DECLARE_WAIT_QUEUE_HEAD(pipe_version_waitqueue);
  90 static void gss_put_auth(struct gss_auth *gss_auth);
  91
  92 static void gss_free_ctx(struct gss_cl_ctx *);
  93 static const struct rpc_pipe_ops gss_upcall_ops_v0;
  94 static const struct rpc_pipe_ops gss_upcall_ops_v1;
  95
  96 static inline struct gss_cl_ctx *
  97 gss_get_ctx(struct gss_cl_ctx *ctx)
  98 {
  99         refcount_inc(&ctx->count);
 100         return ctx;
 101 }
 102
 103 static inline void
 104 gss_put_ctx(struct gss_cl_ctx *ctx)
 105 {
 106         if (refcount_dec_and_test(&ctx->count))
 107                 gss_free_ctx(ctx);
 108 }
 109
 110 /* gss_cred_set_ctx:
 111  * called by gss_upcall_callback and gss_create_upcall in order
 112  * to set the gss context. The actual exchange of an old context
 113  * and a new one is protected by the pipe->lock.
 114  */
 115 static void
 116 gss_cred_set_ctx(struct rpc_cred *cred, struct gss_cl_ctx *ctx)
 117 {
 118         struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
 119
 120         if (!test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags))
 121                 return;
 122         gss_get_ctx(ctx);
 123         rcu_assign_pointer(gss_cred->gc_ctx, ctx);
 124         set_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
 125         smp_mb__before_atomic();
 126         clear_bit(RPCAUTH_CRED_NEW, &cred->cr_flags);
 127 }
 128
 129 static struct gss_cl_ctx *
 130 gss_cred_get_ctx(struct rpc_cred *cred)
 131 {
 132         struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
 133         struct gss_cl_ctx *ctx = NULL;
 134
 135         rcu_read_lock();
 136         ctx = rcu_dereference(gss_cred->gc_ctx);
 137         if (ctx)
 138                 gss_get_ctx(ctx);
 139         rcu_read_unlock();
 140         return ctx;
 141 }
 142
 143 static struct gss_cl_ctx *
 144 gss_alloc_context(void)
 145 {
 146         struct gss_cl_ctx *ctx;
 147
 148         ctx = kzalloc(sizeof(*ctx), GFP_NOFS);
 149         if (ctx != NULL) {
 150                 ctx->gc_proc = RPC_GSS_PROC_DATA;
 151                 ctx->gc_seq = 1;        /* NetApp 6.4R1 doesn't accept seq. no. 0 */
 152                 spin_lock_init(&ctx->gc_seq_lock);
 153                 refcount_set(&ctx->count,1);
 154         }
 155         return ctx;
 156 }
 157
 158 #define GSSD_MIN_TIMEOUT (60 * 60)
 159 static const void *
 160 gss_fill_context(const void *p, const void *end, struct gss_cl_ctx *ctx, struct gss_api_mech *gm)
 161 {
 162         const void *q;
 163         unsigned int seclen;
 164         unsigned int timeout;
 165         unsigned long now = jiffies;
 166         u32 window_size;
 167         int ret;
 168
 169         /* First unsigned int gives the remaining lifetime in seconds of the
 170          * credential - e.g. the remaining TGT lifetime for Kerberos or
 171          * the -t value passed to GSSD.
 172          */
 173         p = simple_get_bytes(p, end, &timeout, sizeof(timeout));
 174         if (IS_ERR(p))
 175                 goto err;
 176         if (timeout == 0)
 177                 timeout = GSSD_MIN_TIMEOUT;
 178         ctx->gc_expiry = now + ((unsigned long)timeout * HZ);
 179         /* Sequence number window. Determines the maximum number of
 180          * simultaneous requests
 181          */
 182         p = simple_get_bytes(p, end, &window_size, sizeof(window_size));
 183         if (IS_ERR(p))
 184                 goto err;
 185         ctx->gc_win = window_size;
 186         /* gssd signals an error by passing ctx->gc_win = 0: */
 187         if (ctx->gc_win == 0) {
 188                 /*
 189                  * in which case, p points to an error code. Anything other
 190                  * than -EKEYEXPIRED gets converted to -EACCES.
 191                  */
 192                 p = simple_get_bytes(p, end, &ret, sizeof(ret));
 193                 if (!IS_ERR(p))
 194                         p = (ret == -EKEYEXPIRED) ? ERR_PTR(-EKEYEXPIRED) :
 195                                                     ERR_PTR(-EACCES);
 196                 goto err;
 197         }
 198         /* copy the opaque wire context */
 199         p = simple_get_netobj(p, end, &ctx->gc_wire_ctx);
 200         if (IS_ERR(p))
 201                 goto err;
 202         /* import the opaque security context */
 203         p  = simple_get_bytes(p, end, &seclen, sizeof(seclen));
 204         if (IS_ERR(p))
 205                 goto err;
 206         q = (const void *)((const char *)p + seclen);
 207         if (unlikely(q > end || q < p)) {
 208                 p = ERR_PTR(-EFAULT);
 209                 goto err;
 210         }
 211         ret = gss_import_sec_context(p, seclen, gm, &ctx->gc_gss_ctx, NULL, GFP_NOFS);
 212         if (ret < 0) {
 213                 trace_rpcgss_import_ctx(ret);
 214                 p = ERR_PTR(ret);
 215                 goto err;
 216         }
 217
 218         /* is there any trailing data? */
 219         if (q == end) {
 220                 p = q;
 221                 goto done;
 222         }
 223
 224         /* pull in acceptor name (if there is one) */
 225         p = simple_get_netobj(q, end, &ctx->gc_acceptor);
 226         if (IS_ERR(p))
 227                 goto err;
 228 done:
 229         trace_rpcgss_context(ctx->gc_expiry, now, timeout,
 230                              ctx->gc_acceptor.len, ctx->gc_acceptor.data);
 231 err:
 232         return p;
 233 }
 234
 235 /* XXX: Need some documentation about why UPCALL_BUF_LEN is so small.
 236  *      Is user space expecting no more than UPCALL_BUF_LEN bytes?
 237  *      Note that there are now _two_ NI_MAXHOST sized data items
 238  *      being passed in this string.
 239  */
 240 #define UPCALL_BUF_LEN  256
 241
 242 struct gss_upcall_msg {
 243         refcount_t count;
 244         kuid_t  uid;
 245         const char *service_name;
 246         struct rpc_pipe_msg msg;
 247         struct list_head list;
 248         struct gss_auth *auth;
 249         struct rpc_pipe *pipe;
 250         struct rpc_wait_queue rpc_waitqueue;
 251         wait_queue_head_t waitqueue;
 252         struct gss_cl_ctx *ctx;
 253         char databuf[UPCALL_BUF_LEN];
 254 };
 255
 256 static int get_pipe_version(struct net *net)
 257 {
 258         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 259         int ret;
 260
 261         spin_lock(&pipe_version_lock);
 262         if (sn->pipe_version >= 0) {
 263                 atomic_inc(&sn->pipe_users);
 264                 ret = sn->pipe_version;
 265         } else
 266                 ret = -EAGAIN;
 267         spin_unlock(&pipe_version_lock);
 268         return ret;
 269 }
 270
 271 static void put_pipe_version(struct net *net)
 272 {
 273         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 274
 275         if (atomic_dec_and_lock(&sn->pipe_users, &pipe_version_lock)) {
 276                 sn->pipe_version = -1;
 277                 spin_unlock(&pipe_version_lock);
 278         }
 279 }
 280
 281 static void
 282 gss_release_msg(struct gss_upcall_msg *gss_msg)
 283 {
 284         struct net *net = gss_msg->auth->net;
 285         if (!refcount_dec_and_test(&gss_msg->count))
 286                 return;
 287         put_pipe_version(net);
 288         BUG_ON(!list_empty(&gss_msg->list));
 289         if (gss_msg->ctx != NULL)
 290                 gss_put_ctx(gss_msg->ctx);
 291         rpc_destroy_wait_queue(&gss_msg->rpc_waitqueue);
 292         gss_put_auth(gss_msg->auth);
 293         kfree_const(gss_msg->service_name);
 294         kfree(gss_msg);
 295 }
 296
 297 static struct gss_upcall_msg *
 298 __gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid, const struct gss_auth *auth)
 299 {
 300         struct gss_upcall_msg *pos;
 301         list_for_each_entry(pos, &pipe->in_downcall, list) {
 302                 if (!uid_eq(pos->uid, uid))
 303                         continue;
 304                 if (auth && pos->auth->service != auth->service)
 305                         continue;
 306                 refcount_inc(&pos->count);
 307                 return pos;
 308         }
 309         return NULL;
 310 }
 311
 312 /* Try to add an upcall to the pipefs queue.
 313  * If an upcall owned by our uid already exists, then we return a reference
 314  * to that upcall instead of adding the new upcall.
 315  */
 316 static inline struct gss_upcall_msg *
 317 gss_add_msg(struct gss_upcall_msg *gss_msg)
 318 {
 319         struct rpc_pipe *pipe = gss_msg->pipe;
 320         struct gss_upcall_msg *old;
 321
 322         spin_lock(&pipe->lock);
 323         old = __gss_find_upcall(pipe, gss_msg->uid, gss_msg->auth);
 324         if (old == NULL) {
 325                 refcount_inc(&gss_msg->count);
 326                 list_add(&gss_msg->list, &pipe->in_downcall);
 327         } else
 328                 gss_msg = old;
 329         spin_unlock(&pipe->lock);
 330         return gss_msg;
 331 }
 332
 333 static void
 334 __gss_unhash_msg(struct gss_upcall_msg *gss_msg)
 335 {
 336         list_del_init(&gss_msg->list);
 337         rpc_wake_up_status(&gss_msg->rpc_waitqueue, gss_msg->msg.errno);
 338         wake_up_all(&gss_msg->waitqueue);
 339         refcount_dec(&gss_msg->count);
 340 }
 341
 342 static void
 343 gss_unhash_msg(struct gss_upcall_msg *gss_msg)
 344 {
 345         struct rpc_pipe *pipe = gss_msg->pipe;
 346
 347         if (list_empty(&gss_msg->list))
 348                 return;
 349         spin_lock(&pipe->lock);
 350         if (!list_empty(&gss_msg->list))
 351                 __gss_unhash_msg(gss_msg);
 352         spin_unlock(&pipe->lock);
 353 }
 354
 355 static void
 356 gss_handle_downcall_result(struct gss_cred *gss_cred, struct gss_upcall_msg *gss_msg)
 357 {
 358         switch (gss_msg->msg.errno) {
 359         case 0:
 360                 if (gss_msg->ctx == NULL)
 361                         break;
 362                 clear_bit(RPCAUTH_CRED_NEGATIVE, &gss_cred->gc_base.cr_flags);
 363                 gss_cred_set_ctx(&gss_cred->gc_base, gss_msg->ctx);
 364                 break;
 365         case -EKEYEXPIRED:
 366                 set_bit(RPCAUTH_CRED_NEGATIVE, &gss_cred->gc_base.cr_flags);
 367         }
 368         gss_cred->gc_upcall_timestamp = jiffies;
 369         gss_cred->gc_upcall = NULL;
 370         rpc_wake_up_status(&gss_msg->rpc_waitqueue, gss_msg->msg.errno);
 371 }
 372
 373 static void
 374 gss_upcall_callback(struct rpc_task *task)
 375 {
 376         struct gss_cred *gss_cred = container_of(task->tk_rqstp->rq_cred,
 377                         struct gss_cred, gc_base);
 378         struct gss_upcall_msg *gss_msg = gss_cred->gc_upcall;
 379         struct rpc_pipe *pipe = gss_msg->pipe;
 380
 381         spin_lock(&pipe->lock);
 382         gss_handle_downcall_result(gss_cred, gss_msg);
 383         spin_unlock(&pipe->lock);
 384         task->tk_status = gss_msg->msg.errno;
 385         gss_release_msg(gss_msg);
 386 }
 387
 388 static void gss_encode_v0_msg(struct gss_upcall_msg *gss_msg,
 389                               const struct cred *cred)
 390 {
 391         struct user_namespace *userns = cred->user_ns;
 392
 393         uid_t uid = from_kuid_munged(userns, gss_msg->uid);
 394         memcpy(gss_msg->databuf, &uid, sizeof(uid));
 395         gss_msg->msg.data = gss_msg->databuf;
 396         gss_msg->msg.len = sizeof(uid);
 397
 398         BUILD_BUG_ON(sizeof(uid) > sizeof(gss_msg->databuf));
 399 }
 400
 401 static ssize_t
 402 gss_v0_upcall(struct file *file, struct rpc_pipe_msg *msg,
 403                 char __user *buf, size_t buflen)
 404 {
 405         struct gss_upcall_msg *gss_msg = container_of(msg,
 406                                                       struct gss_upcall_msg,
 407                                                       msg);
 408         if (msg->copied == 0)
 409                 gss_encode_v0_msg(gss_msg, file->f_cred);
 410         return rpc_pipe_generic_upcall(file, msg, buf, buflen);
 411 }
 412
 413 static int gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
 414                                 const char *service_name,
 415                                 const char *target_name,
 416                                 const struct cred *cred)
 417 {
 418         struct user_namespace *userns = cred->user_ns;
 419         struct gss_api_mech *mech = gss_msg->auth->mech;
 420         char *p = gss_msg->databuf;
 421         size_t buflen = sizeof(gss_msg->databuf);
 422         int len;
 423
 424         len = scnprintf(p, buflen, "mech=%s uid=%d", mech->gm_name,
 425                         from_kuid_munged(userns, gss_msg->uid));
 426         buflen -= len;
 427         p += len;
 428         gss_msg->msg.len = len;
 429
 430         /*
 431          * target= is a full service principal that names the remote
 432          * identity that we are authenticating to.
 433          */
 434         if (target_name) {
 435                 len = scnprintf(p, buflen, " target=%s", target_name);
 436                 buflen -= len;
 437                 p += len;
 438                 gss_msg->msg.len += len;
 439         }
 440
 441         /*
 442          * gssd uses service= and srchost= to select a matching key from
 443          * the system's keytab to use as the source principal.
 444          *
 445          * service= is the service name part of the source principal,
 446          * or "*" (meaning choose any).
 447          *
 448          * srchost= is the hostname part of the source principal. When
 449          * not provided, gssd uses the local hostname.
 450          */
 451         if (service_name) {
 452                 char *c = strchr(service_name, '@');
 453
 454                 if (!c)
 455                         len = scnprintf(p, buflen, " service=%s",
 456                                         service_name);
 457                 else
 458                         len = scnprintf(p, buflen,
 459                                         " service=%.*s srchost=%s",
 460                                         (int)(c - service_name),
 461                                         service_name, c + 1);
 462                 buflen -= len;
 463                 p += len;
 464                 gss_msg->msg.len += len;
 465         }
 466
 467         if (mech->gm_upcall_enctypes) {
 468                 len = scnprintf(p, buflen, " enctypes=%s",
 469                                 mech->gm_upcall_enctypes);
 470                 buflen -= len;
 471                 p += len;
 472                 gss_msg->msg.len += len;
 473         }
 474         trace_rpcgss_upcall_msg(gss_msg->databuf);
 475         len = scnprintf(p, buflen, "\n");
 476         if (len == 0)
 477                 goto out_overflow;
 478         gss_msg->msg.len += len;
 479         gss_msg->msg.data = gss_msg->databuf;
 480         return 0;
 481 out_overflow:
 482         WARN_ON_ONCE(1);
 483         return -ENOMEM;
 484 }
 485
 486 static ssize_t
 487 gss_v1_upcall(struct file *file, struct rpc_pipe_msg *msg,
 488                 char __user *buf, size_t buflen)
 489 {
 490         struct gss_upcall_msg *gss_msg = container_of(msg,
 491                                                       struct gss_upcall_msg,
 492                                                       msg);
 493         int err;
 494         if (msg->copied == 0) {
 495                 err = gss_encode_v1_msg(gss_msg,
 496                                         gss_msg->service_name,
 497                                         gss_msg->auth->target_name,
 498                                         file->f_cred);
 499                 if (err)
 500                         return err;
 501         }
 502         return rpc_pipe_generic_upcall(file, msg, buf, buflen);
 503 }
 504
 505 static struct gss_upcall_msg *
 506 gss_alloc_msg(struct gss_auth *gss_auth,
 507                 kuid_t uid, const char *service_name)
 508 {
 509         struct gss_upcall_msg *gss_msg;
 510         int vers;
 511         int err = -ENOMEM;
 512
 513         gss_msg = kzalloc(sizeof(*gss_msg), GFP_NOFS);
 514         if (gss_msg == NULL)
 515                 goto err;
 516         vers = get_pipe_version(gss_auth->net);
 517         err = vers;
 518         if (err < 0)
 519                 goto err_free_msg;
 520         gss_msg->pipe = gss_auth->gss_pipe[vers]->pipe;
 521         INIT_LIST_HEAD(&gss_msg->list);
 522         rpc_init_wait_queue(&gss_msg->rpc_waitqueue, "RPCSEC_GSS upcall waitq");
 523         init_waitqueue_head(&gss_msg->waitqueue);
 524         refcount_set(&gss_msg->count, 1);
 525         gss_msg->uid = uid;
 526         gss_msg->auth = gss_auth;
 527         kref_get(&gss_auth->kref);
 528         if (service_name) {
 529                 gss_msg->service_name = kstrdup_const(service_name, GFP_NOFS);
 530                 if (!gss_msg->service_name) {
 531                         err = -ENOMEM;
 532                         goto err_put_pipe_version;
 533                 }
 534         }
 535         return gss_msg;
 536 err_put_pipe_version:
 537         put_pipe_version(gss_auth->net);
 538 err_free_msg:
 539         kfree(gss_msg);
 540 err:
 541         return ERR_PTR(err);
 542 }
 543
 544 static struct gss_upcall_msg *
 545 gss_setup_upcall(struct gss_auth *gss_auth, struct rpc_cred *cred)
 546 {
 547         struct gss_cred *gss_cred = container_of(cred,
 548                         struct gss_cred, gc_base);
 549         struct gss_upcall_msg *gss_new, *gss_msg;
 550         kuid_t uid = cred->cr_cred->fsuid;
 551
 552         gss_new = gss_alloc_msg(gss_auth, uid, gss_cred->gc_principal);
 553         if (IS_ERR(gss_new))
 554                 return gss_new;
 555         gss_msg = gss_add_msg(gss_new);
 556         if (gss_msg == gss_new) {
 557                 int res;
 558                 refcount_inc(&gss_msg->count);
 559                 res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg);
 560                 if (res) {
 561                         gss_unhash_msg(gss_new);
 562                         refcount_dec(&gss_msg->count);
 563                         gss_release_msg(gss_new);
 564                         gss_msg = ERR_PTR(res);
 565                 }
 566         } else
 567                 gss_release_msg(gss_new);
 568         return gss_msg;
 569 }
 570
 571 static void warn_gssd(void)
 572 {
 573         dprintk("AUTH_GSS upcall failed. Please check user daemon is running.\n");
 574 }
 575
 576 static inline int
 577 gss_refresh_upcall(struct rpc_task *task)
 578 {
 579         struct rpc_cred *cred = task->tk_rqstp->rq_cred;
 580         struct gss_auth *gss_auth = container_of(cred->cr_auth,
 581                         struct gss_auth, rpc_auth);
 582         struct gss_cred *gss_cred = container_of(cred,
 583                         struct gss_cred, gc_base);
 584         struct gss_upcall_msg *gss_msg;
 585         struct rpc_pipe *pipe;
 586         int err = 0;
 587
 588         gss_msg = gss_setup_upcall(gss_auth, cred);
 589         if (PTR_ERR(gss_msg) == -EAGAIN) {
 590                 /* XXX: warning on the first, under the assumption we
 591                  * shouldn't normally hit this case on a refresh. */
 592                 warn_gssd();
 593                 rpc_sleep_on_timeout(&pipe_version_rpc_waitqueue,
 594                                 task, NULL, jiffies + (15 * HZ));
 595                 err = -EAGAIN;
 596                 goto out;
 597         }
 598         if (IS_ERR(gss_msg)) {
 599                 err = PTR_ERR(gss_msg);
 600                 goto out;
 601         }
 602         pipe = gss_msg->pipe;
 603         spin_lock(&pipe->lock);
 604         if (gss_cred->gc_upcall != NULL)
 605                 rpc_sleep_on(&gss_cred->gc_upcall->rpc_waitqueue, task, NULL);
 606         else if (gss_msg->ctx == NULL && gss_msg->msg.errno >= 0) {
 607                 gss_cred->gc_upcall = gss_msg;
 608                 /* gss_upcall_callback will release the reference to gss_upcall_msg */
 609                 refcount_inc(&gss_msg->count);
 610                 rpc_sleep_on(&gss_msg->rpc_waitqueue, task, gss_upcall_callback);
 611         } else {
 612                 gss_handle_downcall_result(gss_cred, gss_msg);
 613                 err = gss_msg->msg.errno;
 614         }
 615         spin_unlock(&pipe->lock);
 616         gss_release_msg(gss_msg);
 617 out:
 618         trace_rpcgss_upcall_result(from_kuid(&init_user_ns,
 619                                              cred->cr_cred->fsuid), err);
 620         return err;
 621 }
 622
 623 static inline int
 624 gss_create_upcall(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
 625 {
 626         struct net *net = gss_auth->net;
 627         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 628         struct rpc_pipe *pipe;
 629         struct rpc_cred *cred = &gss_cred->gc_base;
 630         struct gss_upcall_msg *gss_msg;
 631         DEFINE_WAIT(wait);
 632         int err;
 633
 634 retry:
 635         err = 0;
 636         /* if gssd is down, just skip upcalling altogether */
 637         if (!gssd_running(net)) {
 638                 warn_gssd();
 639                 err = -EACCES;
 640                 goto out;
 641         }
 642         gss_msg = gss_setup_upcall(gss_auth, cred);
 643         if (PTR_ERR(gss_msg) == -EAGAIN) {
 644                 err = wait_event_interruptible_timeout(pipe_version_waitqueue,
 645                                 sn->pipe_version >= 0, 15 * HZ);
 646                 if (sn->pipe_version < 0) {
 647                         warn_gssd();
 648                         err = -EACCES;
 649                 }
 650                 if (err < 0)
 651                         goto out;
 652                 goto retry;
 653         }
 654         if (IS_ERR(gss_msg)) {
 655                 err = PTR_ERR(gss_msg);
 656                 goto out;
 657         }
 658         pipe = gss_msg->pipe;
 659         for (;;) {
 660                 prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_KILLABLE);
 661                 spin_lock(&pipe->lock);
 662                 if (gss_msg->ctx != NULL || gss_msg->msg.errno < 0) {
 663                         break;
 664                 }
 665                 spin_unlock(&pipe->lock);
 666                 if (fatal_signal_pending(current)) {
 667                         err = -ERESTARTSYS;
 668                         goto out_intr;
 669                 }
 670                 schedule();
 671         }
 672         if (gss_msg->ctx)
 673                 gss_cred_set_ctx(cred, gss_msg->ctx);
 674         else
 675                 err = gss_msg->msg.errno;
 676         spin_unlock(&pipe->lock);
 677 out_intr:
 678         finish_wait(&gss_msg->waitqueue, &wait);
 679         gss_release_msg(gss_msg);
 680 out:
 681         trace_rpcgss_upcall_result(from_kuid(&init_user_ns,
 682                                              cred->cr_cred->fsuid), err);
 683         return err;
 684 }
 685
 686 #define MSG_BUF_MAXSIZE 1024
 687
 688 static ssize_t
 689 gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
 690 {
 691         const void *p, *end;
 692         void *buf;
 693         struct gss_upcall_msg *gss_msg;
 694         struct rpc_pipe *pipe = RPC_I(file_inode(filp))->pipe;
 695         struct gss_cl_ctx *ctx;
 696         uid_t id;
 697         kuid_t uid;
 698         ssize_t err = -EFBIG;
 699
 700         if (mlen > MSG_BUF_MAXSIZE)
 701                 goto out;
 702         err = -ENOMEM;
 703         buf = kmalloc(mlen, GFP_NOFS);
 704         if (!buf)
 705                 goto out;
 706
 707         err = -EFAULT;
 708         if (copy_from_user(buf, src, mlen))
 709                 goto err;
 710
 711         end = (const void *)((char *)buf + mlen);
 712         p = simple_get_bytes(buf, end, &id, sizeof(id));
 713         if (IS_ERR(p)) {
 714                 err = PTR_ERR(p);
 715                 goto err;
 716         }
 717
 718         uid = make_kuid(current_user_ns(), id);
 719         if (!uid_valid(uid)) {
 720                 err = -EINVAL;
 721                 goto err;
 722         }
 723
 724         err = -ENOMEM;
 725         ctx = gss_alloc_context();
 726         if (ctx == NULL)
 727                 goto err;
 728
 729         err = -ENOENT;
 730         /* Find a matching upcall */
 731         spin_lock(&pipe->lock);
 732         gss_msg = __gss_find_upcall(pipe, uid, NULL);
 733         if (gss_msg == NULL) {
 734                 spin_unlock(&pipe->lock);
 735                 goto err_put_ctx;
 736         }
 737         list_del_init(&gss_msg->list);
 738         spin_unlock(&pipe->lock);
 739
 740         p = gss_fill_context(p, end, ctx, gss_msg->auth->mech);
 741         if (IS_ERR(p)) {
 742                 err = PTR_ERR(p);
 743                 switch (err) {
 744                 case -EACCES:
 745                 case -EKEYEXPIRED:
 746                         gss_msg->msg.errno = err;
 747                         err = mlen;
 748                         break;
 749                 case -EFAULT:
 750                 case -ENOMEM:
 751                 case -EINVAL:
 752                 case -ENOSYS:
 753                         gss_msg->msg.errno = -EAGAIN;
 754                         break;
 755                 default:
 756                         printk(KERN_CRIT "%s: bad return from "
 757                                 "gss_fill_context: %zd\n", __func__, err);
 758                         gss_msg->msg.errno = -EIO;
 759                 }
 760                 goto err_release_msg;
 761         }
 762         gss_msg->ctx = gss_get_ctx(ctx);
 763         err = mlen;
 764
 765 err_release_msg:
 766         spin_lock(&pipe->lock);
 767         __gss_unhash_msg(gss_msg);
 768         spin_unlock(&pipe->lock);
 769         gss_release_msg(gss_msg);
 770 err_put_ctx:
 771         gss_put_ctx(ctx);
 772 err:
 773         kfree(buf);
 774 out:
 775         return err;
 776 }
 777
 778 static int gss_pipe_open(struct inode *inode, int new_version)
 779 {
 780         struct net *net = inode->i_sb->s_fs_info;
 781         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 782         int ret = 0;
 783
 784         spin_lock(&pipe_version_lock);
 785         if (sn->pipe_version < 0) {
 786                 /* First open of any gss pipe determines the version: */
 787                 sn->pipe_version = new_version;
 788                 rpc_wake_up(&pipe_version_rpc_waitqueue);
 789                 wake_up(&pipe_version_waitqueue);
 790         } else if (sn->pipe_version != new_version) {
 791                 /* Trying to open a pipe of a different version */
 792                 ret = -EBUSY;
 793                 goto out;
 794         }
 795         atomic_inc(&sn->pipe_users);
 796 out:
 797         spin_unlock(&pipe_version_lock);
 798         return ret;
 799
 800 }
 801
 802 static int gss_pipe_open_v0(struct inode *inode)
 803 {
 804         return gss_pipe_open(inode, 0);
 805 }
 806
 807 static int gss_pipe_open_v1(struct inode *inode)
 808 {
 809         return gss_pipe_open(inode, 1);
 810 }
 811
 812 static void
 813 gss_pipe_release(struct inode *inode)
 814 {
 815         struct net *net = inode->i_sb->s_fs_info;
 816         struct rpc_pipe *pipe = RPC_I(inode)->pipe;
 817         struct gss_upcall_msg *gss_msg;
 818
 819 restart:
 820         spin_lock(&pipe->lock);
 821         list_for_each_entry(gss_msg, &pipe->in_downcall, list) {
 822
 823                 if (!list_empty(&gss_msg->msg.list))
 824                         continue;
 825                 gss_msg->msg.errno = -EPIPE;
 826                 refcount_inc(&gss_msg->count);
 827                 __gss_unhash_msg(gss_msg);
 828                 spin_unlock(&pipe->lock);
 829                 gss_release_msg(gss_msg);
 830                 goto restart;
 831         }
 832         spin_unlock(&pipe->lock);
 833
 834         put_pipe_version(net);
 835 }
 836
 837 static void
 838 gss_pipe_destroy_msg(struct rpc_pipe_msg *msg)
 839 {
 840         struct gss_upcall_msg *gss_msg = container_of(msg, struct gss_upcall_msg, msg);
 841
 842         if (msg->errno < 0) {
 843                 refcount_inc(&gss_msg->count);
 844                 gss_unhash_msg(gss_msg);
 845                 if (msg->errno == -ETIMEDOUT)
 846                         warn_gssd();
 847                 gss_release_msg(gss_msg);
 848         }
 849         gss_release_msg(gss_msg);
 850 }
 851
 852 static void gss_pipe_dentry_destroy(struct dentry *dir,
 853                 struct rpc_pipe_dir_object *pdo)
 854 {
 855         struct gss_pipe *gss_pipe = pdo->pdo_data;
 856         struct rpc_pipe *pipe = gss_pipe->pipe;
 857
 858         if (pipe->dentry != NULL) {
 859                 rpc_unlink(pipe->dentry);
 860                 pipe->dentry = NULL;
 861         }
 862 }
 863
 864 static int gss_pipe_dentry_create(struct dentry *dir,
 865                 struct rpc_pipe_dir_object *pdo)
 866 {
 867         struct gss_pipe *p = pdo->pdo_data;
 868         struct dentry *dentry;
 869
 870         dentry = rpc_mkpipe_dentry(dir, p->name, p->clnt, p->pipe);
 871         if (IS_ERR(dentry))
 872                 return PTR_ERR(dentry);
 873         p->pipe->dentry = dentry;
 874         return 0;
 875 }
 876
 877 static const struct rpc_pipe_dir_object_ops gss_pipe_dir_object_ops = {
 878         .create = gss_pipe_dentry_create,
 879         .destroy = gss_pipe_dentry_destroy,
 880 };
 881
 882 static struct gss_pipe *gss_pipe_alloc(struct rpc_clnt *clnt,
 883                 const char *name,
 884                 const struct rpc_pipe_ops *upcall_ops)
 885 {
 886         struct gss_pipe *p;
 887         int err = -ENOMEM;
 888
 889         p = kmalloc(sizeof(*p), GFP_KERNEL);
 890         if (p == NULL)
 891                 goto err;
 892         p->pipe = rpc_mkpipe_data(upcall_ops, RPC_PIPE_WAIT_FOR_OPEN);
 893         if (IS_ERR(p->pipe)) {
 894                 err = PTR_ERR(p->pipe);
 895                 goto err_free_gss_pipe;
 896         }
 897         p->name = name;
 898         p->clnt = clnt;
 899         kref_init(&p->kref);
 900         rpc_init_pipe_dir_object(&p->pdo,
 901                         &gss_pipe_dir_object_ops,
 902                         p);
 903         return p;
 904 err_free_gss_pipe:
 905         kfree(p);
 906 err:
 907         return ERR_PTR(err);
 908 }
 909
 910 struct gss_alloc_pdo {
 911         struct rpc_clnt *clnt;
 912         const char *name;
 913         const struct rpc_pipe_ops *upcall_ops;
 914 };
 915
 916 static int gss_pipe_match_pdo(struct rpc_pipe_dir_object *pdo, void *data)
 917 {
 918         struct gss_pipe *gss_pipe;
 919         struct gss_alloc_pdo *args = data;
 920
 921         if (pdo->pdo_ops != &gss_pipe_dir_object_ops)
 922                 return 0;
 923         gss_pipe = container_of(pdo, struct gss_pipe, pdo);
 924         if (strcmp(gss_pipe->name, args->name) != 0)
 925                 return 0;
 926         if (!kref_get_unless_zero(&gss_pipe->kref))
 927                 return 0;
 928         return 1;
 929 }
 930
 931 static struct rpc_pipe_dir_object *gss_pipe_alloc_pdo(void *data)
 932 {
 933         struct gss_pipe *gss_pipe;
 934         struct gss_alloc_pdo *args = data;
 935
 936         gss_pipe = gss_pipe_alloc(args->clnt, args->name, args->upcall_ops);
 937         if (!IS_ERR(gss_pipe))
 938                 return &gss_pipe->pdo;
 939         return NULL;
 940 }
 941
 942 static struct gss_pipe *gss_pipe_get(struct rpc_clnt *clnt,
 943                 const char *name,
 944                 const struct rpc_pipe_ops *upcall_ops)
 945 {
 946         struct net *net = rpc_net_ns(clnt);
 947         struct rpc_pipe_dir_object *pdo;
 948         struct gss_alloc_pdo args = {
 949                 .clnt = clnt,
 950                 .name = name,
 951                 .upcall_ops = upcall_ops,
 952         };
 953
 954         pdo = rpc_find_or_alloc_pipe_dir_object(net,
 955                         &clnt->cl_pipedir_objects,
 956                         gss_pipe_match_pdo,
 957                         gss_pipe_alloc_pdo,
 958                         &args);
 959         if (pdo != NULL)
 960                 return container_of(pdo, struct gss_pipe, pdo);
 961         return ERR_PTR(-ENOMEM);
 962 }
 963
 964 static void __gss_pipe_free(struct gss_pipe *p)
 965 {
 966         struct rpc_clnt *clnt = p->clnt;
 967         struct net *net = rpc_net_ns(clnt);
 968
 969         rpc_remove_pipe_dir_object(net,
 970                         &clnt->cl_pipedir_objects,
 971                         &p->pdo);
 972         rpc_destroy_pipe_data(p->pipe);
 973         kfree(p);
 974 }
 975
 976 static void __gss_pipe_release(struct kref *kref)
 977 {
 978         struct gss_pipe *p = container_of(kref, struct gss_pipe, kref);
 979
 980         __gss_pipe_free(p);
 981 }
 982
 983 static void gss_pipe_free(struct gss_pipe *p)
 984 {
 985         if (p != NULL)
 986                 kref_put(&p->kref, __gss_pipe_release);
 987 }
 988
 989 /*
 990  * NOTE: we have the opportunity to use different
 991  * parameters based on the input flavor (which must be a pseudoflavor)
 992  */
 993 static struct gss_auth *
 994 gss_create_new(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
 995 {
 996         rpc_authflavor_t flavor = args->pseudoflavor;
 997         struct gss_auth *gss_auth;
 998         struct gss_pipe *gss_pipe;
 999         struct rpc_auth * auth;
1000         int err = -ENOMEM; /* XXX? */
1001
1002         if (!try_module_get(THIS_MODULE))
1003                 return ERR_PTR(err);
1004         if (!(gss_auth = kmalloc(sizeof(*gss_auth), GFP_KERNEL)))
1005                 goto out_dec;
1006         INIT_HLIST_NODE(&gss_auth->hash);
1007         gss_auth->target_name = NULL;
1008         if (args->target_name) {
1009                 gss_auth->target_name = kstrdup(args->target_name, GFP_KERNEL);
1010                 if (gss_auth->target_name == NULL)
1011                         goto err_free;
1012         }
1013         gss_auth->client = clnt;
1014         gss_auth->net = get_net(rpc_net_ns(clnt));
1015         err = -EINVAL;
1016         gss_auth->mech = gss_mech_get_by_pseudoflavor(flavor);
1017         if (!gss_auth->mech)
1018                 goto err_put_net;
1019         gss_auth->service = gss_pseudoflavor_to_service(gss_auth->mech, flavor);
1020         if (gss_auth->service == 0)
1021                 goto err_put_mech;
1022         if (!gssd_running(gss_auth->net))
1023                 goto err_put_mech;
1024         auth = &gss_auth->rpc_auth;
1025         auth->au_cslack = GSS_CRED_SLACK >> 2;
1026         auth->au_rslack = GSS_KRB5_MAX_SLACK_NEEDED >> 2;
1027         auth->au_verfsize = GSS_VERF_SLACK >> 2;
1028         auth->au_ralign = GSS_VERF_SLACK >> 2;
1029         auth->au_flags = 0;
1030         auth->au_ops = &authgss_ops;
1031         auth->au_flavor = flavor;
1032         if (gss_pseudoflavor_to_datatouch(gss_auth->mech, flavor))
1033                 auth->au_flags |= RPCAUTH_AUTH_DATATOUCH;
1034         refcount_set(&auth->au_count, 1);
1035         kref_init(&gss_auth->kref);
1036
1037         err = rpcauth_init_credcache(auth);
1038         if (err)
1039                 goto err_put_mech;
1040         /*
1041          * Note: if we created the old pipe first, then someone who
1042          * examined the directory at the right moment might conclude
1043          * that we supported only the old pipe.  So we instead create
1044          * the new pipe first.
1045          */
1046         gss_pipe = gss_pipe_get(clnt, "gssd", &gss_upcall_ops_v1);
1047         if (IS_ERR(gss_pipe)) {
1048                 err = PTR_ERR(gss_pipe);
1049                 goto err_destroy_credcache;
1050         }
1051         gss_auth->gss_pipe[1] = gss_pipe;
1052
1053         gss_pipe = gss_pipe_get(clnt, gss_auth->mech->gm_name,
1054                         &gss_upcall_ops_v0);
1055         if (IS_ERR(gss_pipe)) {
1056                 err = PTR_ERR(gss_pipe);
1057                 goto err_destroy_pipe_1;
1058         }
1059         gss_auth->gss_pipe[0] = gss_pipe;
1060
1061         return gss_auth;
1062 err_destroy_pipe_1:
1063         gss_pipe_free(gss_auth->gss_pipe[1]);
1064 err_destroy_credcache:
1065         rpcauth_destroy_credcache(auth);
1066 err_put_mech:
1067         gss_mech_put(gss_auth->mech);
1068 err_put_net:
1069         put_net(gss_auth->net);
1070 err_free:
1071         kfree(gss_auth->target_name);
1072         kfree(gss_auth);
1073 out_dec:
1074         module_put(THIS_MODULE);
1075         trace_rpcgss_createauth(flavor, err);
1076         return ERR_PTR(err);
1077 }
1078
1079 static void
1080 gss_free(struct gss_auth *gss_auth)
1081 {
1082         gss_pipe_free(gss_auth->gss_pipe[0]);
1083         gss_pipe_free(gss_auth->gss_pipe[1]);
1084         gss_mech_put(gss_auth->mech);
1085         put_net(gss_auth->net);
1086         kfree(gss_auth->target_name);
1087
1088         kfree(gss_auth);
1089         module_put(THIS_MODULE);
1090 }
1091
1092 static void
1093 gss_free_callback(struct kref *kref)
1094 {
1095         struct gss_auth *gss_auth = container_of(kref, struct gss_auth, kref);
1096
1097         gss_free(gss_auth);
1098 }
1099
1100 static void
1101 gss_put_auth(struct gss_auth *gss_auth)
1102 {
1103         kref_put(&gss_auth->kref, gss_free_callback);
1104 }
1105
1106 static void
1107 gss_destroy(struct rpc_auth *auth)
1108 {
1109         struct gss_auth *gss_auth = container_of(auth,
1110                         struct gss_auth, rpc_auth);
1111
1112         if (hash_hashed(&gss_auth->hash)) {
1113                 spin_lock(&gss_auth_hash_lock);
1114                 hash_del(&gss_auth->hash);
1115                 spin_unlock(&gss_auth_hash_lock);
1116         }
1117
1118         gss_pipe_free(gss_auth->gss_pipe[0]);
1119         gss_auth->gss_pipe[0] = NULL;
1120         gss_pipe_free(gss_auth->gss_pipe[1]);
1121         gss_auth->gss_pipe[1] = NULL;
1122         rpcauth_destroy_credcache(auth);
1123
1124         gss_put_auth(gss_auth);
1125 }
1126
1127 /*
1128  * Auths may be shared between rpc clients that were cloned from a
1129  * common client with the same xprt, if they also share the flavor and
1130  * target_name.
1131  *
1132  * The auth is looked up from the oldest parent sharing the same
1133  * cl_xprt, and the auth itself references only that common parent
1134  * (which is guaranteed to last as long as any of its descendants).
1135  */
1136 static struct gss_auth *
1137 gss_auth_find_or_add_hashed(const struct rpc_auth_create_args *args,
1138                 struct rpc_clnt *clnt,
1139                 struct gss_auth *new)
1140 {
1141         struct gss_auth *gss_auth;
1142         unsigned long hashval = (unsigned long)clnt;
1143
1144         spin_lock(&gss_auth_hash_lock);
1145         hash_for_each_possible(gss_auth_hash_table,
1146                         gss_auth,
1147                         hash,
1148                         hashval) {
1149                 if (gss_auth->client != clnt)
1150                         continue;
1151                 if (gss_auth->rpc_auth.au_flavor != args->pseudoflavor)
1152                         continue;
1153                 if (gss_auth->target_name != args->target_name) {
1154                         if (gss_auth->target_name == NULL)
1155                                 continue;
1156                         if (args->target_name == NULL)
1157                                 continue;
1158                         if (strcmp(gss_auth->target_name, args->target_name))
1159                                 continue;
1160                 }
1161                 if (!refcount_inc_not_zero(&gss_auth->rpc_auth.au_count))
1162                         continue;
1163                 goto out;
1164         }
1165         if (new)
1166                 hash_add(gss_auth_hash_table, &new->hash, hashval);
1167         gss_auth = new;
1168 out:
1169         spin_unlock(&gss_auth_hash_lock);
1170         return gss_auth;
1171 }
1172
1173 static struct gss_auth *
1174 gss_create_hashed(const struct rpc_auth_create_args *args,
1175                   struct rpc_clnt *clnt)
1176 {
1177         struct gss_auth *gss_auth;
1178         struct gss_auth *new;
1179
1180         gss_auth = gss_auth_find_or_add_hashed(args, clnt, NULL);
1181         if (gss_auth != NULL)
1182                 goto out;
1183         new = gss_create_new(args, clnt);
1184         if (IS_ERR(new))
1185                 return new;
1186         gss_auth = gss_auth_find_or_add_hashed(args, clnt, new);
1187         if (gss_auth != new)
1188                 gss_destroy(&new->rpc_auth);
1189 out:
1190         return gss_auth;
1191 }
1192
1193 static struct rpc_auth *
1194 gss_create(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
1195 {
1196         struct gss_auth *gss_auth;
1197         struct rpc_xprt_switch *xps = rcu_access_pointer(clnt->cl_xpi.xpi_xpswitch);
1198
1199         while (clnt != clnt->cl_parent) {
1200                 struct rpc_clnt *parent = clnt->cl_parent;
1201                 /* Find the original parent for this transport */
1202                 if (rcu_access_pointer(parent->cl_xpi.xpi_xpswitch) != xps)
1203                         break;
1204                 clnt = parent;
1205         }
1206
1207         gss_auth = gss_create_hashed(args, clnt);
1208         if (IS_ERR(gss_auth))
1209                 return ERR_CAST(gss_auth);
1210         return &gss_auth->rpc_auth;
1211 }
1212
1213 static struct gss_cred *
1214 gss_dup_cred(struct gss_auth *gss_auth, struct gss_cred *gss_cred)
1215 {
1216         struct gss_cred *new;
1217
1218         /* Make a copy of the cred so that we can reference count it */
1219         new = kzalloc(sizeof(*gss_cred), GFP_NOFS);
1220         if (new) {
1221                 struct auth_cred acred = {
1222                         .cred = gss_cred->gc_base.cr_cred,
1223                 };
1224                 struct gss_cl_ctx *ctx =
1225                         rcu_dereference_protected(gss_cred->gc_ctx, 1);
1226
1227                 rpcauth_init_cred(&new->gc_base, &acred,
1228                                 &gss_auth->rpc_auth,
1229                                 &gss_nullops);
1230                 new->gc_base.cr_flags = 1UL << RPCAUTH_CRED_UPTODATE;
1231                 new->gc_service = gss_cred->gc_service;
1232                 new->gc_principal = gss_cred->gc_principal;
1233                 kref_get(&gss_auth->kref);
1234                 rcu_assign_pointer(new->gc_ctx, ctx);
1235                 gss_get_ctx(ctx);
1236         }
1237         return new;
1238 }
1239
1240 /*
1241  * gss_send_destroy_context will cause the RPCSEC_GSS to send a NULL RPC call
1242  * to the server with the GSS control procedure field set to
1243  * RPC_GSS_PROC_DESTROY. This should normally cause the server to release
1244  * all RPCSEC_GSS state associated with that context.
1245  */
1246 static void
1247 gss_send_destroy_context(struct rpc_cred *cred)
1248 {
1249         struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1250         struct gss_auth *gss_auth = container_of(cred->cr_auth, struct gss_auth, rpc_auth);
1251         struct gss_cl_ctx *ctx = rcu_dereference_protected(gss_cred->gc_ctx, 1);
1252         struct gss_cred *new;
1253         struct rpc_task *task;
1254
1255         new = gss_dup_cred(gss_auth, gss_cred);
1256         if (new) {
1257                 ctx->gc_proc = RPC_GSS_PROC_DESTROY;
1258
1259                 task = rpc_call_null(gss_auth->client, &new->gc_base,
1260                                 RPC_TASK_ASYNC|RPC_TASK_SOFT);
1261                 if (!IS_ERR(task))
1262                         rpc_put_task(task);
1263
1264                 put_rpccred(&new->gc_base);
1265         }
1266 }
1267
1268 /* gss_destroy_cred (and gss_free_ctx) are used to clean up after failure
1269  * to create a new cred or context, so they check that things have been
1270  * allocated before freeing them. */
1271 static void
1272 gss_do_free_ctx(struct gss_cl_ctx *ctx)
1273 {
1274         gss_delete_sec_context(&ctx->gc_gss_ctx);
1275         kfree(ctx->gc_wire_ctx.data);
1276         kfree(ctx->gc_acceptor.data);
1277         kfree(ctx);
1278 }
1279
1280 static void
1281 gss_free_ctx_callback(struct rcu_head *head)
1282 {
1283         struct gss_cl_ctx *ctx = container_of(head, struct gss_cl_ctx, gc_rcu);
1284         gss_do_free_ctx(ctx);
1285 }
1286
1287 static void
1288 gss_free_ctx(struct gss_cl_ctx *ctx)
1289 {
1290         call_rcu(&ctx->gc_rcu, gss_free_ctx_callback);
1291 }
1292
1293 static void
1294 gss_free_cred(struct gss_cred *gss_cred)
1295 {
1296         kfree(gss_cred);
1297 }
1298
1299 static void
1300 gss_free_cred_callback(struct rcu_head *head)
1301 {
1302         struct gss_cred *gss_cred = container_of(head, struct gss_cred, gc_base.cr_rcu);
1303         gss_free_cred(gss_cred);
1304 }
1305
1306 static void
1307 gss_destroy_nullcred(struct rpc_cred *cred)
1308 {
1309         struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1310         struct gss_auth *gss_auth = container_of(cred->cr_auth, struct gss_auth, rpc_auth);
1311         struct gss_cl_ctx *ctx = rcu_dereference_protected(gss_cred->gc_ctx, 1);
1312
1313         RCU_INIT_POINTER(gss_cred->gc_ctx, NULL);
1314         put_cred(cred->cr_cred);
1315         call_rcu(&cred->cr_rcu, gss_free_cred_callback);
1316         if (ctx)
1317                 gss_put_ctx(ctx);
1318         gss_put_auth(gss_auth);
1319 }
1320
1321 static void
1322 gss_destroy_cred(struct rpc_cred *cred)
1323 {
1324
1325         if (test_and_clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0)
1326                 gss_send_destroy_context(cred);
1327         gss_destroy_nullcred(cred);
1328 }
1329
1330 static int
1331 gss_hash_cred(struct auth_cred *acred, unsigned int hashbits)
1332 {
1333         return hash_64(from_kuid(&init_user_ns, acred->cred->fsuid), hashbits);
1334 }
1335
1336 /*
1337  * Lookup RPCSEC_GSS cred for the current process
1338  */
1339 static struct rpc_cred *
1340 gss_lookup_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
1341 {
1342         return rpcauth_lookup_credcache(auth, acred, flags, GFP_NOFS);
1343 }
1344
1345 static struct rpc_cred *
1346 gss_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags, gfp_t gfp)
1347 {
1348         struct gss_auth *gss_auth = container_of(auth, struct gss_auth, rpc_auth);
1349         struct gss_cred *cred = NULL;
1350         int err = -ENOMEM;
1351
1352         if (!(cred = kzalloc(sizeof(*cred), gfp)))
1353                 goto out_err;
1354
1355         rpcauth_init_cred(&cred->gc_base, acred, auth, &gss_credops);
1356         /*
1357          * Note: in order to force a call to call_refresh(), we deliberately
1358          * fail to flag the credential as RPCAUTH_CRED_UPTODATE.
1359          */
1360         cred->gc_base.cr_flags = 1UL << RPCAUTH_CRED_NEW;
1361         cred->gc_service = gss_auth->service;
1362         cred->gc_principal = acred->principal;
1363         kref_get(&gss_auth->kref);
1364         return &cred->gc_base;
1365
1366 out_err:
1367         return ERR_PTR(err);
1368 }
1369
1370 static int
1371 gss_cred_init(struct rpc_auth *auth, struct rpc_cred *cred)
1372 {
1373         struct gss_auth *gss_auth = container_of(auth, struct gss_auth, rpc_auth);
1374         struct gss_cred *gss_cred = container_of(cred,struct gss_cred, gc_base);
1375         int err;
1376
1377         do {
1378                 err = gss_create_upcall(gss_auth, gss_cred);
1379         } while (err == -EAGAIN);
1380         return err;
1381 }
1382
1383 static char *
1384 gss_stringify_acceptor(struct rpc_cred *cred)
1385 {
1386         char *string = NULL;
1387         struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
1388         struct gss_cl_ctx *ctx;
1389         unsigned int len;
1390         struct xdr_netobj *acceptor;
1391
1392         rcu_read_lock();
1393         ctx = rcu_dereference(gss_cred->gc_ctx);
1394         if (!ctx)
1395                 goto out;
1396
1397         len = ctx->gc_acceptor.len;
1398         rcu_read_unlock();
1399
1400         /* no point if there's no string */
1401         if (!len)
1402                 return NULL;
1403 realloc:
1404         string = kmalloc(len + 1, GFP_KERNEL);
1405         if (!string)
1406                 return NULL;
1407
1408         rcu_read_lock();
1409         ctx = rcu_dereference(gss_cred->gc_ctx);
1410
1411         /* did the ctx disappear or was it replaced by one with no acceptor? */
1412         if (!ctx || !ctx->gc_acceptor.len) {
1413                 kfree(string);
1414                 string = NULL;
1415                 goto out;
1416         }
1417
1418         acceptor = &ctx->gc_acceptor;
1419
1420         /*
1421          * Did we find a new acceptor that's longer than the original? Allocate
1422          * a longer buffer and try again.
1423          */
1424         if (len < acceptor->len) {
1425                 len = acceptor->len;
1426                 rcu_read_unlock();
1427                 kfree(string);
1428                 goto realloc;
1429         }
1430
1431         memcpy(string, acceptor->data, acceptor->len);
1432         string[acceptor->len] = '\0';
1433 out:
1434         rcu_read_unlock();
1435         return string;
1436 }
1437
1438 /*
1439  * Returns -EACCES if GSS context is NULL or will expire within the
1440  * timeout (miliseconds)
1441  */
1442 static int
1443 gss_key_timeout(struct rpc_cred *rc)
1444 {
1445         struct gss_cred *gss_cred = container_of(rc, struct gss_cred, gc_base);
1446         struct gss_cl_ctx *ctx;
1447         unsigned long timeout = jiffies + (gss_key_expire_timeo * HZ);
1448         int ret = 0;
1449
1450         rcu_read_lock();
1451         ctx = rcu_dereference(gss_cred->gc_ctx);
1452         if (!ctx || time_after(timeout, ctx->gc_expiry))
1453                 ret = -EACCES;
1454         rcu_read_unlock();
1455
1456         return ret;
1457 }
1458
1459 static int
1460 gss_match(struct auth_cred *acred, struct rpc_cred *rc, int flags)
1461 {
1462         struct gss_cred *gss_cred = container_of(rc, struct gss_cred, gc_base);
1463         struct gss_cl_ctx *ctx;
1464         int ret;
1465
1466         if (test_bit(RPCAUTH_CRED_NEW, &rc->cr_flags))
1467                 goto out;
1468         /* Don't match with creds that have expired. */
1469         rcu_read_lock();
1470         ctx = rcu_dereference(gss_cred->gc_ctx);
1471         if (!ctx || time_after(jiffies, ctx->gc_expiry)) {
1472                 rcu_read_unlock();
1473                 return 0;
1474         }
1475         rcu_read_unlock();
1476         if (!test_bit(RPCAUTH_CRED_UPTODATE, &rc->cr_flags))
1477                 return 0;
1478 out:
1479         if (acred->principal != NULL) {
1480                 if (gss_cred->gc_principal == NULL)
1481                         return 0;
1482                 ret = strcmp(acred->principal, gss_cred->gc_principal) == 0;
1483         } else {
1484                 if (gss_cred->gc_principal != NULL)
1485                         return 0;
1486                 ret = uid_eq(rc->cr_cred->fsuid, acred->cred->fsuid);
1487         }
1488         return ret;
1489 }
1490
1491 /*
1492  * Marshal credentials.
1493  *
1494  * The expensive part is computing the verifier. We can't cache a
1495  * pre-computed version of the verifier because the seqno, which
1496  * is different every time, is included in the MIC.
1497  */
1498 static int gss_marshal(struct rpc_task *task, struct xdr_stream *xdr)
1499 {
1500         struct rpc_rqst *req = task->tk_rqstp;
1501         struct rpc_cred *cred = req->rq_cred;
1502         struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
1503                                                  gc_base);
1504         struct gss_cl_ctx       *ctx = gss_cred_get_ctx(cred);
1505         __be32          *p, *cred_len;
1506         u32             maj_stat = 0;
1507         struct xdr_netobj mic;
1508         struct kvec     iov;
1509         struct xdr_buf  verf_buf;
1510         int status;
1511
1512         /* Credential */
1513
1514         p = xdr_reserve_space(xdr, 7 * sizeof(*p) +
1515                               ctx->gc_wire_ctx.len);
1516         if (!p)
1517                 goto marshal_failed;
1518         *p++ = rpc_auth_gss;
1519         cred_len = p++;
1520
1521         spin_lock(&ctx->gc_seq_lock);
1522         req->rq_seqno = (ctx->gc_seq < MAXSEQ) ? ctx->gc_seq++ : MAXSEQ;
1523         spin_unlock(&ctx->gc_seq_lock);
1524         if (req->rq_seqno == MAXSEQ)
1525                 goto expired;
1526         trace_rpcgss_seqno(task);
1527
1528         *p++ = cpu_to_be32(RPC_GSS_VERSION);
1529         *p++ = cpu_to_be32(ctx->gc_proc);
1530         *p++ = cpu_to_be32(req->rq_seqno);
1531         *p++ = cpu_to_be32(gss_cred->gc_service);
1532         p = xdr_encode_netobj(p, &ctx->gc_wire_ctx);
1533         *cred_len = cpu_to_be32((p - (cred_len + 1)) << 2);
1534
1535         /* Verifier */
1536
1537         /* We compute the checksum for the verifier over the xdr-encoded bytes
1538          * starting with the xid and ending at the end of the credential: */
1539         iov.iov_base = req->rq_snd_buf.head[0].iov_base;
1540         iov.iov_len = (u8 *)p - (u8 *)iov.iov_base;
1541         xdr_buf_from_iov(&iov, &verf_buf);
1542
1543         p = xdr_reserve_space(xdr, sizeof(*p));
1544         if (!p)
1545                 goto marshal_failed;
1546         *p++ = rpc_auth_gss;
1547         mic.data = (u8 *)(p + 1);
1548         maj_stat = gss_get_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
1549         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1550                 goto expired;
1551         else if (maj_stat != 0)
1552                 goto bad_mic;
1553         if (xdr_stream_encode_opaque_inline(xdr, (void **)&p, mic.len) < 0)
1554                 goto marshal_failed;
1555         status = 0;
1556 out:
1557         gss_put_ctx(ctx);
1558         return status;
1559 expired:
1560         clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1561         status = -EKEYEXPIRED;
1562         goto out;
1563 marshal_failed:
1564         status = -EMSGSIZE;
1565         goto out;
1566 bad_mic:
1567         trace_rpcgss_get_mic(task, maj_stat);
1568         status = -EIO;
1569         goto out;
1570 }
1571
1572 static int gss_renew_cred(struct rpc_task *task)
1573 {
1574         struct rpc_cred *oldcred = task->tk_rqstp->rq_cred;
1575         struct gss_cred *gss_cred = container_of(oldcred,
1576                                                  struct gss_cred,
1577                                                  gc_base);
1578         struct rpc_auth *auth = oldcred->cr_auth;
1579         struct auth_cred acred = {
1580                 .cred = oldcred->cr_cred,
1581                 .principal = gss_cred->gc_principal,
1582         };
1583         struct rpc_cred *new;
1584
1585         new = gss_lookup_cred(auth, &acred, RPCAUTH_LOOKUP_NEW);
1586         if (IS_ERR(new))
1587                 return PTR_ERR(new);
1588         task->tk_rqstp->rq_cred = new;
1589         put_rpccred(oldcred);
1590         return 0;
1591 }
1592
1593 static int gss_cred_is_negative_entry(struct rpc_cred *cred)
1594 {
1595         if (test_bit(RPCAUTH_CRED_NEGATIVE, &cred->cr_flags)) {
1596                 unsigned long now = jiffies;
1597                 unsigned long begin, expire;
1598                 struct gss_cred *gss_cred;
1599
1600                 gss_cred = container_of(cred, struct gss_cred, gc_base);
1601                 begin = gss_cred->gc_upcall_timestamp;
1602                 expire = begin + gss_expired_cred_retry_delay * HZ;
1603
1604                 if (time_in_range_open(now, begin, expire))
1605                         return 1;
1606         }
1607         return 0;
1608 }
1609
1610 /*
1611 * Refresh credentials. XXX - finish
1612 */
1613 static int
1614 gss_refresh(struct rpc_task *task)
1615 {
1616         struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1617         int ret = 0;
1618
1619         if (gss_cred_is_negative_entry(cred))
1620                 return -EKEYEXPIRED;
1621
1622         if (!test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags) &&
1623                         !test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags)) {
1624                 ret = gss_renew_cred(task);
1625                 if (ret < 0)
1626                         goto out;
1627                 cred = task->tk_rqstp->rq_cred;
1628         }
1629
1630         if (test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags))
1631                 ret = gss_refresh_upcall(task);
1632 out:
1633         return ret;
1634 }
1635
1636 /* Dummy refresh routine: used only when destroying the context */
1637 static int
1638 gss_refresh_null(struct rpc_task *task)
1639 {
1640         return 0;
1641 }
1642
1643 static int
1644 gss_validate(struct rpc_task *task, struct xdr_stream *xdr)
1645 {
1646         struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1647         struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
1648         __be32          *p, *seq = NULL;
1649         struct kvec     iov;
1650         struct xdr_buf  verf_buf;
1651         struct xdr_netobj mic;
1652         u32             len, maj_stat;
1653         int             status;
1654
1655         p = xdr_inline_decode(xdr, 2 * sizeof(*p));
1656         if (!p)
1657                 goto validate_failed;
1658         if (*p++ != rpc_auth_gss)
1659                 goto validate_failed;
1660         len = be32_to_cpup(p);
1661         if (len > RPC_MAX_AUTH_SIZE)
1662                 goto validate_failed;
1663         p = xdr_inline_decode(xdr, len);
1664         if (!p)
1665                 goto validate_failed;
1666
1667         seq = kmalloc(4, GFP_NOFS);
1668         if (!seq)
1669                 goto validate_failed;
1670         *seq = cpu_to_be32(task->tk_rqstp->rq_seqno);
1671         iov.iov_base = seq;
1672         iov.iov_len = 4;
1673         xdr_buf_from_iov(&iov, &verf_buf);
1674         mic.data = (u8 *)p;
1675         mic.len = len;
1676         maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
1677         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1678                 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1679         if (maj_stat)
1680                 goto bad_mic;
1681
1682         /* We leave it to unwrap to calculate au_rslack. For now we just
1683          * calculate the length of the verifier: */
1684         cred->cr_auth->au_verfsize = XDR_QUADLEN(len) + 2;
1685         status = 0;
1686 out:
1687         gss_put_ctx(ctx);
1688         kfree(seq);
1689         return status;
1690
1691 validate_failed:
1692         status = -EIO;
1693         goto out;
1694 bad_mic:
1695         trace_rpcgss_verify_mic(task, maj_stat);
1696         status = -EACCES;
1697         goto out;
1698 }
1699
1700 static int gss_wrap_req_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
1701                               struct rpc_task *task, struct xdr_stream *xdr)
1702 {
1703         struct rpc_rqst *rqstp = task->tk_rqstp;
1704         struct xdr_buf integ_buf, *snd_buf = &rqstp->rq_snd_buf;
1705         struct xdr_netobj mic;
1706         __be32 *p, *integ_len;
1707         u32 offset, maj_stat;
1708
1709         p = xdr_reserve_space(xdr, 2 * sizeof(*p));
1710         if (!p)
1711                 goto wrap_failed;
1712         integ_len = p++;
1713         *p = cpu_to_be32(rqstp->rq_seqno);
1714
1715         if (rpcauth_wrap_req_encode(task, xdr))
1716                 goto wrap_failed;
1717
1718         offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base;
1719         if (xdr_buf_subsegment(snd_buf, &integ_buf,
1720                                 offset, snd_buf->len - offset))
1721                 goto wrap_failed;
1722         *integ_len = cpu_to_be32(integ_buf.len);
1723
1724         p = xdr_reserve_space(xdr, 0);
1725         if (!p)
1726                 goto wrap_failed;
1727         mic.data = (u8 *)(p + 1);
1728         maj_stat = gss_get_mic(ctx->gc_gss_ctx, &integ_buf, &mic);
1729         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1730                 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1731         else if (maj_stat)
1732                 goto bad_mic;
1733         /* Check that the trailing MIC fit in the buffer, after the fact */
1734         if (xdr_stream_encode_opaque_inline(xdr, (void **)&p, mic.len) < 0)
1735                 goto wrap_failed;
1736         return 0;
1737 wrap_failed:
1738         return -EMSGSIZE;
1739 bad_mic:
1740         trace_rpcgss_get_mic(task, maj_stat);
1741         return -EIO;
1742 }
1743
1744 static void
1745 priv_release_snd_buf(struct rpc_rqst *rqstp)
1746 {
1747         int i;
1748
1749         for (i=0; i < rqstp->rq_enc_pages_num; i++)
1750                 __free_page(rqstp->rq_enc_pages[i]);
1751         kfree(rqstp->rq_enc_pages);
1752         rqstp->rq_release_snd_buf = NULL;
1753 }
1754
1755 static int
1756 alloc_enc_pages(struct rpc_rqst *rqstp)
1757 {
1758         struct xdr_buf *snd_buf = &rqstp->rq_snd_buf;
1759         int first, last, i;
1760
1761         if (rqstp->rq_release_snd_buf)
1762                 rqstp->rq_release_snd_buf(rqstp);
1763
1764         if (snd_buf->page_len == 0) {
1765                 rqstp->rq_enc_pages_num = 0;
1766                 return 0;
1767         }
1768
1769         first = snd_buf->page_base >> PAGE_SHIFT;
1770         last = (snd_buf->page_base + snd_buf->page_len - 1) >> PAGE_SHIFT;
1771         rqstp->rq_enc_pages_num = last - first + 1 + 1;
1772         rqstp->rq_enc_pages
1773                 = kmalloc_array(rqstp->rq_enc_pages_num,
1774                                 sizeof(struct page *),
1775                                 GFP_NOFS);
1776         if (!rqstp->rq_enc_pages)
1777                 goto out;
1778         for (i=0; i < rqstp->rq_enc_pages_num; i++) {
1779                 rqstp->rq_enc_pages[i] = alloc_page(GFP_NOFS);
1780                 if (rqstp->rq_enc_pages[i] == NULL)
1781                         goto out_free;
1782         }
1783         rqstp->rq_release_snd_buf = priv_release_snd_buf;
1784         return 0;
1785 out_free:
1786         rqstp->rq_enc_pages_num = i;
1787         priv_release_snd_buf(rqstp);
1788 out:
1789         return -EAGAIN;
1790 }
1791
1792 static int gss_wrap_req_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
1793                              struct rpc_task *task, struct xdr_stream *xdr)
1794 {
1795         struct rpc_rqst *rqstp = task->tk_rqstp;
1796         struct xdr_buf  *snd_buf = &rqstp->rq_snd_buf;
1797         u32             pad, offset, maj_stat;
1798         int             status;
1799         __be32          *p, *opaque_len;
1800         struct page     **inpages;
1801         int             first;
1802         struct kvec     *iov;
1803
1804         status = -EIO;
1805         p = xdr_reserve_space(xdr, 2 * sizeof(*p));
1806         if (!p)
1807                 goto wrap_failed;
1808         opaque_len = p++;
1809         *p = cpu_to_be32(rqstp->rq_seqno);
1810
1811         if (rpcauth_wrap_req_encode(task, xdr))
1812                 goto wrap_failed;
1813
1814         status = alloc_enc_pages(rqstp);
1815         if (unlikely(status))
1816                 goto wrap_failed;
1817         first = snd_buf->page_base >> PAGE_SHIFT;
1818         inpages = snd_buf->pages + first;
1819         snd_buf->pages = rqstp->rq_enc_pages;
1820         snd_buf->page_base -= first << PAGE_SHIFT;
1821         /*
1822          * Move the tail into its own page, in case gss_wrap needs
1823          * more space in the head when wrapping.
1824          *
1825          * Still... Why can't gss_wrap just slide the tail down?
1826          */
1827         if (snd_buf->page_len || snd_buf->tail[0].iov_len) {
1828                 char *tmp;
1829
1830                 tmp = page_address(rqstp->rq_enc_pages[rqstp->rq_enc_pages_num - 1]);
1831                 memcpy(tmp, snd_buf->tail[0].iov_base, snd_buf->tail[0].iov_len);
1832                 snd_buf->tail[0].iov_base = tmp;
1833         }
1834         offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base;
1835         maj_stat = gss_wrap(ctx->gc_gss_ctx, offset, snd_buf, inpages);
1836         /* slack space should prevent this ever happening: */
1837         if (unlikely(snd_buf->len > snd_buf->buflen))
1838                 goto wrap_failed;
1839         /* We're assuming that when GSS_S_CONTEXT_EXPIRED, the encryption was
1840          * done anyway, so it's safe to put the request on the wire: */
1841         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1842                 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1843         else if (maj_stat)
1844                 goto bad_wrap;
1845
1846         *opaque_len = cpu_to_be32(snd_buf->len - offset);
1847         /* guess whether the pad goes into the head or the tail: */
1848         if (snd_buf->page_len || snd_buf->tail[0].iov_len)
1849                 iov = snd_buf->tail;
1850         else
1851                 iov = snd_buf->head;
1852         p = iov->iov_base + iov->iov_len;
1853         pad = 3 - ((snd_buf->len - offset - 1) & 3);
1854         memset(p, 0, pad);
1855         iov->iov_len += pad;
1856         snd_buf->len += pad;
1857
1858         return 0;
1859 wrap_failed:
1860         return status;
1861 bad_wrap:
1862         trace_rpcgss_wrap(task, maj_stat);
1863         return -EIO;
1864 }
1865
1866 static int gss_wrap_req(struct rpc_task *task, struct xdr_stream *xdr)
1867 {
1868         struct rpc_cred *cred = task->tk_rqstp->rq_cred;
1869         struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
1870                         gc_base);
1871         struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
1872         int status;
1873
1874         status = -EIO;
1875         if (ctx->gc_proc != RPC_GSS_PROC_DATA) {
1876                 /* The spec seems a little ambiguous here, but I think that not
1877                  * wrapping context destruction requests makes the most sense.
1878                  */
1879                 status = rpcauth_wrap_req_encode(task, xdr);
1880                 goto out;
1881         }
1882         switch (gss_cred->gc_service) {
1883         case RPC_GSS_SVC_NONE:
1884                 status = rpcauth_wrap_req_encode(task, xdr);
1885                 break;
1886         case RPC_GSS_SVC_INTEGRITY:
1887                 status = gss_wrap_req_integ(cred, ctx, task, xdr);
1888                 break;
1889         case RPC_GSS_SVC_PRIVACY:
1890                 status = gss_wrap_req_priv(cred, ctx, task, xdr);
1891                 break;
1892         default:
1893                 status = -EIO;
1894         }
1895 out:
1896         gss_put_ctx(ctx);
1897         return status;
1898 }
1899
1900 static int
1901 gss_unwrap_resp_auth(struct rpc_cred *cred)
1902 {
1903         struct rpc_auth *auth = cred->cr_auth;
1904
1905         auth->au_rslack = auth->au_verfsize;
1906         auth->au_ralign = auth->au_verfsize;
1907         return 0;
1908 }
1909
1910 /*
1911  * RFC 2203, Section 5.3.2.2
1912  *
1913  *      struct rpc_gss_integ_data {
1914  *              opaque databody_integ<>;
1915  *              opaque checksum<>;
1916  *      };
1917  *
1918  *      struct rpc_gss_data_t {
1919  *              unsigned int seq_num;
1920  *              proc_req_arg_t arg;
1921  *      };
1922  */
1923 static int
1924 gss_unwrap_resp_integ(struct rpc_task *task, struct rpc_cred *cred,
1925                       struct gss_cl_ctx *ctx, struct rpc_rqst *rqstp,
1926                       struct xdr_stream *xdr)
1927 {
1928         struct xdr_buf gss_data, *rcv_buf = &rqstp->rq_rcv_buf;
1929         struct rpc_auth *auth = cred->cr_auth;
1930         u32 len, offset, seqno, maj_stat;
1931         struct xdr_netobj mic;
1932         int ret;
1933
1934         ret = -EIO;
1935         mic.data = NULL;
1936
1937         /* opaque databody_integ<>; */
1938         if (xdr_stream_decode_u32(xdr, &len))
1939                 goto unwrap_failed;
1940         if (len & 3)
1941                 goto unwrap_failed;
1942         offset = rcv_buf->len - xdr_stream_remaining(xdr);
1943         if (xdr_stream_decode_u32(xdr, &seqno))
1944                 goto unwrap_failed;
1945         if (seqno != rqstp->rq_seqno)
1946                 goto bad_seqno;
1947         if (xdr_buf_subsegment(rcv_buf, &gss_data, offset, len))
1948                 goto unwrap_failed;
1949
1950         /*
1951          * The xdr_stream now points to the beginning of the
1952          * upper layer payload, to be passed below to
1953          * rpcauth_unwrap_resp_decode(). The checksum, which
1954          * follows the upper layer payload in @rcv_buf, is
1955          * located and parsed without updating the xdr_stream.
1956          */
1957
1958         /* opaque checksum<>; */
1959         offset += len;
1960         if (xdr_decode_word(rcv_buf, offset, &len))
1961                 goto unwrap_failed;
1962         offset += sizeof(__be32);
1963         if (offset + len > rcv_buf->len)
1964                 goto unwrap_failed;
1965         mic.len = len;
1966         mic.data = kmalloc(len, GFP_NOFS);
1967         if (!mic.data)
1968                 goto unwrap_failed;
1969         if (read_bytes_from_xdr_buf(rcv_buf, offset, mic.data, mic.len))
1970                 goto unwrap_failed;
1971
1972         maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &gss_data, &mic);
1973         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
1974                 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
1975         if (maj_stat != GSS_S_COMPLETE)
1976                 goto bad_mic;
1977
1978         auth->au_rslack = auth->au_verfsize + 2 + 1 + XDR_QUADLEN(mic.len);
1979         auth->au_ralign = auth->au_verfsize + 2;
1980         ret = 0;
1981
1982 out:
1983         kfree(mic.data);
1984         return ret;
1985
1986 unwrap_failed:
1987         trace_rpcgss_unwrap_failed(task);
1988         goto out;
1989 bad_seqno:
1990         trace_rpcgss_bad_seqno(task, rqstp->rq_seqno, seqno);
1991         goto out;
1992 bad_mic:
1993         trace_rpcgss_verify_mic(task, maj_stat);
1994         goto out;
1995 }
1996
1997 static int
1998 gss_unwrap_resp_priv(struct rpc_task *task, struct rpc_cred *cred,
1999                      struct gss_cl_ctx *ctx, struct rpc_rqst *rqstp,
2000                      struct xdr_stream *xdr)
2001 {
2002         struct xdr_buf *rcv_buf = &rqstp->rq_rcv_buf;
2003         struct kvec *head = rqstp->rq_rcv_buf.head;
2004         struct rpc_auth *auth = cred->cr_auth;
2005         u32 offset, opaque_len, maj_stat;
2006         __be32 *p;
2007
2008         p = xdr_inline_decode(xdr, 2 * sizeof(*p));
2009         if (unlikely(!p))
2010                 goto unwrap_failed;
2011         opaque_len = be32_to_cpup(p++);
2012         offset = (u8 *)(p) - (u8 *)head->iov_base;
2013         if (offset + opaque_len > rcv_buf->len)
2014                 goto unwrap_failed;
2015
2016         maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset,
2017                               offset + opaque_len, rcv_buf);
2018         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
2019                 clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
2020         if (maj_stat != GSS_S_COMPLETE)
2021                 goto bad_unwrap;
2022         /* gss_unwrap decrypted the sequence number */
2023         if (be32_to_cpup(p++) != rqstp->rq_seqno)
2024                 goto bad_seqno;
2025
2026         /* gss_unwrap redacts the opaque blob from the head iovec.
2027          * rcv_buf has changed, thus the stream needs to be reset.
2028          */
2029         xdr_init_decode(xdr, rcv_buf, p, rqstp);
2030
2031         auth->au_rslack = auth->au_verfsize + 2 + ctx->gc_gss_ctx->slack;
2032         auth->au_ralign = auth->au_verfsize + 2 + ctx->gc_gss_ctx->align;
2033
2034         return 0;
2035 unwrap_failed:
2036         trace_rpcgss_unwrap_failed(task);
2037         return -EIO;
2038 bad_seqno:
2039         trace_rpcgss_bad_seqno(task, rqstp->rq_seqno, be32_to_cpup(--p));
2040         return -EIO;
2041 bad_unwrap:
2042         trace_rpcgss_unwrap(task, maj_stat);
2043         return -EIO;
2044 }
2045
2046 static bool
2047 gss_seq_is_newer(u32 new, u32 old)
2048 {
2049         return (s32)(new - old) > 0;
2050 }
2051
2052 static bool
2053 gss_xmit_need_reencode(struct rpc_task *task)
2054 {
2055         struct rpc_rqst *req = task->tk_rqstp;
2056         struct rpc_cred *cred = req->rq_cred;
2057         struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
2058         u32 win, seq_xmit = 0;
2059         bool ret = true;
2060
2061         if (!ctx)
2062                 goto out;
2063
2064         if (gss_seq_is_newer(req->rq_seqno, READ_ONCE(ctx->gc_seq)))
2065                 goto out_ctx;
2066
2067         seq_xmit = READ_ONCE(ctx->gc_seq_xmit);
2068         while (gss_seq_is_newer(req->rq_seqno, seq_xmit)) {
2069                 u32 tmp = seq_xmit;
2070
2071                 seq_xmit = cmpxchg(&ctx->gc_seq_xmit, tmp, req->rq_seqno);
2072                 if (seq_xmit == tmp) {
2073                         ret = false;
2074                         goto out_ctx;
2075                 }
2076         }
2077
2078         win = ctx->gc_win;
2079         if (win > 0)
2080                 ret = !gss_seq_is_newer(req->rq_seqno, seq_xmit - win);
2081
2082 out_ctx:
2083         gss_put_ctx(ctx);
2084 out:
2085         trace_rpcgss_need_reencode(task, seq_xmit, ret);
2086         return ret;
2087 }
2088
2089 static int
2090 gss_unwrap_resp(struct rpc_task *task, struct xdr_stream *xdr)
2091 {
2092         struct rpc_rqst *rqstp = task->tk_rqstp;
2093         struct rpc_cred *cred = rqstp->rq_cred;
2094         struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
2095                         gc_base);
2096         struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
2097         int status = -EIO;
2098
2099         if (ctx->gc_proc != RPC_GSS_PROC_DATA)
2100                 goto out_decode;
2101         switch (gss_cred->gc_service) {
2102         case RPC_GSS_SVC_NONE:
2103                 status = gss_unwrap_resp_auth(cred);
2104                 break;
2105         case RPC_GSS_SVC_INTEGRITY:
2106                 status = gss_unwrap_resp_integ(task, cred, ctx, rqstp, xdr);
2107                 break;
2108         case RPC_GSS_SVC_PRIVACY:
2109                 status = gss_unwrap_resp_priv(task, cred, ctx, rqstp, xdr);
2110                 break;
2111         }
2112         if (status)
2113                 goto out;
2114
2115 out_decode:
2116         status = rpcauth_unwrap_resp_decode(task, xdr);
2117 out:
2118         gss_put_ctx(ctx);
2119         return status;
2120 }
2121
2122 static const struct rpc_authops authgss_ops = {
2123         .owner          = THIS_MODULE,
2124         .au_flavor      = RPC_AUTH_GSS,
2125         .au_name        = "RPCSEC_GSS",
2126         .create         = gss_create,
2127         .destroy        = gss_destroy,
2128         .hash_cred      = gss_hash_cred,
2129         .lookup_cred    = gss_lookup_cred,
2130         .crcreate       = gss_create_cred,
2131         .list_pseudoflavors = gss_mech_list_pseudoflavors,
2132         .info2flavor    = gss_mech_info2flavor,
2133         .flavor2info    = gss_mech_flavor2info,
2134 };
2135
2136 static const struct rpc_credops gss_credops = {
2137         .cr_name                = "AUTH_GSS",
2138         .crdestroy              = gss_destroy_cred,
2139         .cr_init                = gss_cred_init,
2140         .crmatch                = gss_match,
2141         .crmarshal              = gss_marshal,
2142         .crrefresh              = gss_refresh,
2143         .crvalidate             = gss_validate,
2144         .crwrap_req             = gss_wrap_req,
2145         .crunwrap_resp          = gss_unwrap_resp,
2146         .crkey_timeout          = gss_key_timeout,
2147         .crstringify_acceptor   = gss_stringify_acceptor,
2148         .crneed_reencode        = gss_xmit_need_reencode,
2149 };
2150
2151 static const struct rpc_credops gss_nullops = {
2152         .cr_name                = "AUTH_GSS",
2153         .crdestroy              = gss_destroy_nullcred,
2154         .crmatch                = gss_match,
2155         .crmarshal              = gss_marshal,
2156         .crrefresh              = gss_refresh_null,
2157         .crvalidate             = gss_validate,
2158         .crwrap_req             = gss_wrap_req,
2159         .crunwrap_resp          = gss_unwrap_resp,
2160         .crstringify_acceptor   = gss_stringify_acceptor,
2161 };
2162
2163 static const struct rpc_pipe_ops gss_upcall_ops_v0 = {
2164         .upcall         = gss_v0_upcall,
2165         .downcall       = gss_pipe_downcall,
2166         .destroy_msg    = gss_pipe_destroy_msg,
2167         .open_pipe      = gss_pipe_open_v0,
2168         .release_pipe   = gss_pipe_release,
2169 };
2170
2171 static const struct rpc_pipe_ops gss_upcall_ops_v1 = {
2172         .upcall         = gss_v1_upcall,
2173         .downcall       = gss_pipe_downcall,
2174         .destroy_msg    = gss_pipe_destroy_msg,
2175         .open_pipe      = gss_pipe_open_v1,
2176         .release_pipe   = gss_pipe_release,
2177 };
2178
2179 static __net_init int rpcsec_gss_init_net(struct net *net)
2180 {
2181         return gss_svc_init_net(net);
2182 }
2183
2184 static __net_exit void rpcsec_gss_exit_net(struct net *net)
2185 {
2186         gss_svc_shutdown_net(net);
2187 }
2188
2189 static struct pernet_operations rpcsec_gss_net_ops = {
2190         .init = rpcsec_gss_init_net,
2191         .exit = rpcsec_gss_exit_net,
2192 };
2193
2194 /*
2195  * Initialize RPCSEC_GSS module
2196  */
2197 static int __init init_rpcsec_gss(void)
2198 {
2199         int err = 0;
2200
2201         err = rpcauth_register(&authgss_ops);
2202         if (err)
2203                 goto out;
2204         err = gss_svc_init();
2205         if (err)
2206                 goto out_unregister;
2207         err = register_pernet_subsys(&rpcsec_gss_net_ops);
2208         if (err)
2209                 goto out_svc_exit;
2210         rpc_init_wait_queue(&pipe_version_rpc_waitqueue, "gss pipe version");
2211         return 0;
2212 out_svc_exit:
2213         gss_svc_shutdown();
2214 out_unregister:
2215         rpcauth_unregister(&authgss_ops);
2216 out:
2217         return err;
2218 }
2219
2220 static void __exit exit_rpcsec_gss(void)
2221 {
2222         unregister_pernet_subsys(&rpcsec_gss_net_ops);
2223         gss_svc_shutdown();
2224         rpcauth_unregister(&authgss_ops);
2225         rcu_barrier(); /* Wait for completion of call_rcu()'s */
2226 }
2227
2228 MODULE_ALIAS("rpc-auth-6");
2229 MODULE_LICENSE("GPL");
2230 module_param_named(expired_cred_retry_delay,
2231                    gss_expired_cred_retry_delay,
2232                    uint, 0644);
2233 MODULE_PARM_DESC(expired_cred_retry_delay, "Timeout (in seconds) until "
2234                 "the RPC engine retries an expired credential");
2235
2236 module_param_named(key_expire_timeo,
2237                    gss_key_expire_timeo,
2238                    uint, 0644);
2239 MODULE_PARM_DESC(key_expire_timeo, "Time (in seconds) at the end of a "
2240                 "credential keys lifetime where the NFS layer cleans up "
2241                 "prior to key expiration");
2242
2243 module_init(init_rpcsec_gss)
2244 module_exit(exit_rpcsec_gss)