2 * linux/net/sunrpc/auth.c
4 * Generic RPC client authentication API.
6 * Copyright (C) 1996, Olaf Kirch <okir@monad.swb.de>
9 #include <linux/types.h>
10 #include <linux/sched.h>
11 #include <linux/module.h>
12 #include <linux/slab.h>
13 #include <linux/errno.h>
14 #include <linux/sunrpc/clnt.h>
15 #include <linux/spinlock.h>
18 # define RPCDBG_FACILITY RPCDBG_AUTH
21 static struct rpc_authops
* auth_flavors
[RPC_AUTH_MAXFLAVOR
] = {
22 &authnull_ops
, /* AUTH_NULL */
23 &authunix_ops
, /* AUTH_UNIX */
24 NULL
, /* others can be loadable modules */
28 pseudoflavor_to_flavor(u32 flavor
) {
29 if (flavor
>= RPC_AUTH_MAXFLAVOR
)
35 rpcauth_register(struct rpc_authops
*ops
)
37 rpc_authflavor_t flavor
;
39 if ((flavor
= ops
->au_flavor
) >= RPC_AUTH_MAXFLAVOR
)
41 if (auth_flavors
[flavor
] != NULL
)
42 return -EPERM
; /* what else? */
43 auth_flavors
[flavor
] = ops
;
48 rpcauth_unregister(struct rpc_authops
*ops
)
50 rpc_authflavor_t flavor
;
52 if ((flavor
= ops
->au_flavor
) >= RPC_AUTH_MAXFLAVOR
)
54 if (auth_flavors
[flavor
] != ops
)
55 return -EPERM
; /* what else? */
56 auth_flavors
[flavor
] = NULL
;
61 rpcauth_create(rpc_authflavor_t pseudoflavor
, struct rpc_clnt
*clnt
)
63 struct rpc_auth
*auth
;
64 struct rpc_authops
*ops
;
65 u32 flavor
= pseudoflavor_to_flavor(pseudoflavor
);
67 if (flavor
>= RPC_AUTH_MAXFLAVOR
|| !(ops
= auth_flavors
[flavor
]))
68 return ERR_PTR(-EINVAL
);
69 auth
= ops
->create(clnt
, pseudoflavor
);
73 rpcauth_destroy(clnt
->cl_auth
);
79 rpcauth_destroy(struct rpc_auth
*auth
)
81 if (!atomic_dec_and_test(&auth
->au_count
))
83 auth
->au_ops
->destroy(auth
);
86 static DEFINE_SPINLOCK(rpc_credcache_lock
);
89 * Initialize RPC credential cache
92 rpcauth_init_credcache(struct rpc_auth
*auth
, unsigned long expire
)
94 struct rpc_cred_cache
*new;
97 new = (struct rpc_cred_cache
*)kmalloc(sizeof(*new), GFP_KERNEL
);
100 for (i
= 0; i
< RPC_CREDCACHE_NR
; i
++)
101 INIT_HLIST_HEAD(&new->hashtable
[i
]);
102 new->expire
= expire
;
103 new->nextgc
= jiffies
+ (expire
>> 1);
104 auth
->au_credcache
= new;
109 * Destroy a list of credentials
112 void rpcauth_destroy_credlist(struct hlist_head
*head
)
114 struct rpc_cred
*cred
;
116 while (!hlist_empty(head
)) {
117 cred
= hlist_entry(head
->first
, struct rpc_cred
, cr_hash
);
118 hlist_del_init(&cred
->cr_hash
);
124 * Clear the RPC credential cache, and delete those credentials
125 * that are not referenced.
128 rpcauth_free_credcache(struct rpc_auth
*auth
)
130 struct rpc_cred_cache
*cache
= auth
->au_credcache
;
132 struct hlist_node
*pos
, *next
;
133 struct rpc_cred
*cred
;
136 spin_lock(&rpc_credcache_lock
);
137 for (i
= 0; i
< RPC_CREDCACHE_NR
; i
++) {
138 hlist_for_each_safe(pos
, next
, &cache
->hashtable
[i
]) {
139 cred
= hlist_entry(pos
, struct rpc_cred
, cr_hash
);
140 __hlist_del(&cred
->cr_hash
);
141 hlist_add_head(&cred
->cr_hash
, &free
);
144 spin_unlock(&rpc_credcache_lock
);
145 rpcauth_destroy_credlist(&free
);
149 rpcauth_prune_expired(struct rpc_auth
*auth
, struct rpc_cred
*cred
, struct hlist_head
*free
)
151 if (atomic_read(&cred
->cr_count
) != 1)
153 if (time_after(jiffies
, cred
->cr_expire
+ auth
->au_credcache
->expire
))
154 cred
->cr_flags
&= ~RPCAUTH_CRED_UPTODATE
;
155 if (!(cred
->cr_flags
& RPCAUTH_CRED_UPTODATE
)) {
156 __hlist_del(&cred
->cr_hash
);
157 hlist_add_head(&cred
->cr_hash
, free
);
162 * Remove stale credentials. Avoid sleeping inside the loop.
165 rpcauth_gc_credcache(struct rpc_auth
*auth
, struct hlist_head
*free
)
167 struct rpc_cred_cache
*cache
= auth
->au_credcache
;
168 struct hlist_node
*pos
, *next
;
169 struct rpc_cred
*cred
;
172 dprintk("RPC: gc'ing RPC credentials for auth %p\n", auth
);
173 for (i
= 0; i
< RPC_CREDCACHE_NR
; i
++) {
174 hlist_for_each_safe(pos
, next
, &cache
->hashtable
[i
]) {
175 cred
= hlist_entry(pos
, struct rpc_cred
, cr_hash
);
176 rpcauth_prune_expired(auth
, cred
, free
);
179 cache
->nextgc
= jiffies
+ cache
->expire
;
183 * Look up a process' credentials in the authentication cache
186 rpcauth_lookup_credcache(struct rpc_auth
*auth
, struct auth_cred
* acred
,
189 struct rpc_cred_cache
*cache
= auth
->au_credcache
;
191 struct hlist_node
*pos
, *next
;
192 struct rpc_cred
*new = NULL
,
196 if (!(taskflags
& RPC_TASK_ROOTCREDS
))
197 nr
= acred
->uid
& RPC_CREDCACHE_MASK
;
199 spin_lock(&rpc_credcache_lock
);
200 if (time_before(cache
->nextgc
, jiffies
))
201 rpcauth_gc_credcache(auth
, &free
);
202 hlist_for_each_safe(pos
, next
, &cache
->hashtable
[nr
]) {
203 struct rpc_cred
*entry
;
204 entry
= hlist_entry(pos
, struct rpc_cred
, cr_hash
);
205 if (entry
->cr_ops
->crmatch(acred
, entry
, taskflags
)) {
206 hlist_del(&entry
->cr_hash
);
210 rpcauth_prune_expired(auth
, entry
, &free
);
214 hlist_add_head(&new->cr_hash
, &free
);
219 hlist_add_head(&cred
->cr_hash
, &cache
->hashtable
[nr
]);
222 spin_unlock(&rpc_credcache_lock
);
224 rpcauth_destroy_credlist(&free
);
227 new = auth
->au_ops
->crcreate(auth
, acred
, taskflags
);
230 new->cr_magic
= RPCAUTH_CRED_MAGIC
;
237 return (struct rpc_cred
*) cred
;
241 rpcauth_lookupcred(struct rpc_auth
*auth
, int taskflags
)
243 struct auth_cred acred
= {
244 .uid
= current
->fsuid
,
245 .gid
= current
->fsgid
,
246 .group_info
= current
->group_info
,
248 struct rpc_cred
*ret
;
250 dprintk("RPC: looking up %s cred\n",
251 auth
->au_ops
->au_name
);
252 get_group_info(acred
.group_info
);
253 ret
= auth
->au_ops
->lookup_cred(auth
, &acred
, taskflags
);
254 put_group_info(acred
.group_info
);
259 rpcauth_bindcred(struct rpc_task
*task
)
261 struct rpc_auth
*auth
= task
->tk_auth
;
262 struct auth_cred acred
= {
263 .uid
= current
->fsuid
,
264 .gid
= current
->fsgid
,
265 .group_info
= current
->group_info
,
267 struct rpc_cred
*ret
;
269 dprintk("RPC: %4d looking up %s cred\n",
270 task
->tk_pid
, task
->tk_auth
->au_ops
->au_name
);
271 get_group_info(acred
.group_info
);
272 ret
= auth
->au_ops
->lookup_cred(auth
, &acred
, task
->tk_flags
);
274 task
->tk_msg
.rpc_cred
= ret
;
276 task
->tk_status
= PTR_ERR(ret
);
277 put_group_info(acred
.group_info
);
282 rpcauth_holdcred(struct rpc_task
*task
)
284 dprintk("RPC: %4d holding %s cred %p\n",
285 task
->tk_pid
, task
->tk_auth
->au_ops
->au_name
, task
->tk_msg
.rpc_cred
);
286 if (task
->tk_msg
.rpc_cred
)
287 get_rpccred(task
->tk_msg
.rpc_cred
);
291 put_rpccred(struct rpc_cred
*cred
)
293 cred
->cr_expire
= jiffies
;
294 if (!atomic_dec_and_test(&cred
->cr_count
))
296 cred
->cr_ops
->crdestroy(cred
);
300 rpcauth_unbindcred(struct rpc_task
*task
)
302 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
304 dprintk("RPC: %4d releasing %s cred %p\n",
305 task
->tk_pid
, task
->tk_auth
->au_ops
->au_name
, cred
);
308 task
->tk_msg
.rpc_cred
= NULL
;
312 rpcauth_marshcred(struct rpc_task
*task
, u32
*p
)
314 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
316 dprintk("RPC: %4d marshaling %s cred %p\n",
317 task
->tk_pid
, task
->tk_auth
->au_ops
->au_name
, cred
);
319 return cred
->cr_ops
->crmarshal(task
, p
);
323 rpcauth_checkverf(struct rpc_task
*task
, u32
*p
)
325 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
327 dprintk("RPC: %4d validating %s cred %p\n",
328 task
->tk_pid
, task
->tk_auth
->au_ops
->au_name
, cred
);
330 return cred
->cr_ops
->crvalidate(task
, p
);
334 rpcauth_wrap_req(struct rpc_task
*task
, kxdrproc_t encode
, void *rqstp
,
335 u32
*data
, void *obj
)
337 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
339 dprintk("RPC: %4d using %s cred %p to wrap rpc data\n",
340 task
->tk_pid
, cred
->cr_ops
->cr_name
, cred
);
341 if (cred
->cr_ops
->crwrap_req
)
342 return cred
->cr_ops
->crwrap_req(task
, encode
, rqstp
, data
, obj
);
343 /* By default, we encode the arguments normally. */
344 return encode(rqstp
, data
, obj
);
348 rpcauth_unwrap_resp(struct rpc_task
*task
, kxdrproc_t decode
, void *rqstp
,
349 u32
*data
, void *obj
)
351 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
353 dprintk("RPC: %4d using %s cred %p to unwrap rpc data\n",
354 task
->tk_pid
, cred
->cr_ops
->cr_name
, cred
);
355 if (cred
->cr_ops
->crunwrap_resp
)
356 return cred
->cr_ops
->crunwrap_resp(task
, decode
, rqstp
,
358 /* By default, we decode the arguments normally. */
359 return decode(rqstp
, data
, obj
);
363 rpcauth_refreshcred(struct rpc_task
*task
)
365 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
368 dprintk("RPC: %4d refreshing %s cred %p\n",
369 task
->tk_pid
, task
->tk_auth
->au_ops
->au_name
, cred
);
371 err
= cred
->cr_ops
->crrefresh(task
);
373 task
->tk_status
= err
;
378 rpcauth_invalcred(struct rpc_task
*task
)
380 dprintk("RPC: %4d invalidating %s cred %p\n",
381 task
->tk_pid
, task
->tk_auth
->au_ops
->au_name
, task
->tk_msg
.rpc_cred
);
382 spin_lock(&rpc_credcache_lock
);
383 if (task
->tk_msg
.rpc_cred
)
384 task
->tk_msg
.rpc_cred
->cr_flags
&= ~RPCAUTH_CRED_UPTODATE
;
385 spin_unlock(&rpc_credcache_lock
);
389 rpcauth_uptodatecred(struct rpc_task
*task
)
391 return !(task
->tk_msg
.rpc_cred
) ||
392 (task
->tk_msg
.rpc_cred
->cr_flags
& RPCAUTH_CRED_UPTODATE
);