2 * linux/net/sunrpc/auth.c
4 * Generic RPC client authentication API.
6 * Copyright (C) 1996, Olaf Kirch <okir@monad.swb.de>
9 #include <linux/types.h>
10 #include <linux/sched.h>
11 #include <linux/module.h>
12 #include <linux/slab.h>
13 #include <linux/errno.h>
14 #include <linux/hash.h>
15 #include <linux/sunrpc/clnt.h>
16 #include <linux/spinlock.h>
19 # define RPCDBG_FACILITY RPCDBG_AUTH
22 static DEFINE_SPINLOCK(rpc_authflavor_lock
);
23 static const struct rpc_authops
*auth_flavors
[RPC_AUTH_MAXFLAVOR
] = {
24 &authnull_ops
, /* AUTH_NULL */
25 &authunix_ops
, /* AUTH_UNIX */
26 NULL
, /* others can be loadable modules */
29 static LIST_HEAD(cred_unused
);
30 static unsigned long number_cred_unused
;
33 pseudoflavor_to_flavor(u32 flavor
) {
34 if (flavor
>= RPC_AUTH_MAXFLAVOR
)
40 rpcauth_register(const struct rpc_authops
*ops
)
42 rpc_authflavor_t flavor
;
45 if ((flavor
= ops
->au_flavor
) >= RPC_AUTH_MAXFLAVOR
)
47 spin_lock(&rpc_authflavor_lock
);
48 if (auth_flavors
[flavor
] == NULL
) {
49 auth_flavors
[flavor
] = ops
;
52 spin_unlock(&rpc_authflavor_lock
);
55 EXPORT_SYMBOL_GPL(rpcauth_register
);
58 rpcauth_unregister(const struct rpc_authops
*ops
)
60 rpc_authflavor_t flavor
;
63 if ((flavor
= ops
->au_flavor
) >= RPC_AUTH_MAXFLAVOR
)
65 spin_lock(&rpc_authflavor_lock
);
66 if (auth_flavors
[flavor
] == ops
) {
67 auth_flavors
[flavor
] = NULL
;
70 spin_unlock(&rpc_authflavor_lock
);
73 EXPORT_SYMBOL_GPL(rpcauth_unregister
);
76 rpcauth_create(rpc_authflavor_t pseudoflavor
, struct rpc_clnt
*clnt
)
78 struct rpc_auth
*auth
;
79 const struct rpc_authops
*ops
;
80 u32 flavor
= pseudoflavor_to_flavor(pseudoflavor
);
82 auth
= ERR_PTR(-EINVAL
);
83 if (flavor
>= RPC_AUTH_MAXFLAVOR
)
86 if ((ops
= auth_flavors
[flavor
]) == NULL
)
87 request_module("rpc-auth-%u", flavor
);
88 spin_lock(&rpc_authflavor_lock
);
89 ops
= auth_flavors
[flavor
];
90 if (ops
== NULL
|| !try_module_get(ops
->owner
)) {
91 spin_unlock(&rpc_authflavor_lock
);
94 spin_unlock(&rpc_authflavor_lock
);
95 auth
= ops
->create(clnt
, pseudoflavor
);
96 module_put(ops
->owner
);
100 rpcauth_release(clnt
->cl_auth
);
101 clnt
->cl_auth
= auth
;
106 EXPORT_SYMBOL_GPL(rpcauth_create
);
109 rpcauth_release(struct rpc_auth
*auth
)
111 if (!atomic_dec_and_test(&auth
->au_count
))
113 auth
->au_ops
->destroy(auth
);
116 static DEFINE_SPINLOCK(rpc_credcache_lock
);
119 rpcauth_unhash_cred_locked(struct rpc_cred
*cred
)
121 hlist_del_rcu(&cred
->cr_hash
);
122 smp_mb__before_clear_bit();
123 clear_bit(RPCAUTH_CRED_HASHED
, &cred
->cr_flags
);
127 rpcauth_unhash_cred(struct rpc_cred
*cred
)
129 spinlock_t
*cache_lock
;
131 cache_lock
= &cred
->cr_auth
->au_credcache
->lock
;
132 spin_lock(cache_lock
);
133 if (atomic_read(&cred
->cr_count
) == 0)
134 rpcauth_unhash_cred_locked(cred
);
135 spin_unlock(cache_lock
);
139 * Initialize RPC credential cache
142 rpcauth_init_credcache(struct rpc_auth
*auth
)
144 struct rpc_cred_cache
*new;
147 new = kmalloc(sizeof(*new), GFP_KERNEL
);
150 for (i
= 0; i
< RPC_CREDCACHE_NR
; i
++)
151 INIT_HLIST_HEAD(&new->hashtable
[i
]);
152 spin_lock_init(&new->lock
);
153 auth
->au_credcache
= new;
156 EXPORT_SYMBOL_GPL(rpcauth_init_credcache
);
159 * Destroy a list of credentials
162 void rpcauth_destroy_credlist(struct list_head
*head
)
164 struct rpc_cred
*cred
;
166 while (!list_empty(head
)) {
167 cred
= list_entry(head
->next
, struct rpc_cred
, cr_lru
);
168 list_del_init(&cred
->cr_lru
);
174 * Clear the RPC credential cache, and delete those credentials
175 * that are not referenced.
178 rpcauth_clear_credcache(struct rpc_cred_cache
*cache
)
181 struct hlist_head
*head
;
182 struct rpc_cred
*cred
;
185 spin_lock(&rpc_credcache_lock
);
186 spin_lock(&cache
->lock
);
187 for (i
= 0; i
< RPC_CREDCACHE_NR
; i
++) {
188 head
= &cache
->hashtable
[i
];
189 while (!hlist_empty(head
)) {
190 cred
= hlist_entry(head
->first
, struct rpc_cred
, cr_hash
);
192 if (!list_empty(&cred
->cr_lru
)) {
193 list_del(&cred
->cr_lru
);
194 number_cred_unused
--;
196 list_add_tail(&cred
->cr_lru
, &free
);
197 rpcauth_unhash_cred_locked(cred
);
200 spin_unlock(&cache
->lock
);
201 spin_unlock(&rpc_credcache_lock
);
202 rpcauth_destroy_credlist(&free
);
206 * Destroy the RPC credential cache
209 rpcauth_destroy_credcache(struct rpc_auth
*auth
)
211 struct rpc_cred_cache
*cache
= auth
->au_credcache
;
214 auth
->au_credcache
= NULL
;
215 rpcauth_clear_credcache(cache
);
219 EXPORT_SYMBOL_GPL(rpcauth_destroy_credcache
);
222 #define RPC_AUTH_EXPIRY_MORATORIUM (60 * HZ)
225 * Remove stale credentials. Avoid sleeping inside the loop.
228 rpcauth_prune_expired(struct list_head
*free
, int nr_to_scan
)
230 spinlock_t
*cache_lock
;
231 struct rpc_cred
*cred
;
232 unsigned long expired
= jiffies
- RPC_AUTH_EXPIRY_MORATORIUM
;
234 while (!list_empty(&cred_unused
)) {
235 cred
= list_entry(cred_unused
.next
, struct rpc_cred
, cr_lru
);
236 list_del_init(&cred
->cr_lru
);
237 number_cred_unused
--;
238 if (atomic_read(&cred
->cr_count
) != 0)
240 /* Enforce a 5 second garbage collection moratorium */
241 if (time_in_range(cred
->cr_expire
, expired
, jiffies
) &&
242 test_bit(RPCAUTH_CRED_UPTODATE
, &cred
->cr_flags
) != 0)
244 cache_lock
= &cred
->cr_auth
->au_credcache
->lock
;
245 spin_lock(cache_lock
);
246 if (atomic_read(&cred
->cr_count
) == 0) {
248 list_add_tail(&cred
->cr_lru
, free
);
249 rpcauth_unhash_cred_locked(cred
);
252 spin_unlock(cache_lock
);
260 * Run memory cache shrinker.
263 rpcauth_cache_shrinker(int nr_to_scan
, gfp_t gfp_mask
)
268 if (list_empty(&cred_unused
))
270 spin_lock(&rpc_credcache_lock
);
271 nr_to_scan
= rpcauth_prune_expired(&free
, nr_to_scan
);
272 res
= (number_cred_unused
/ 100) * sysctl_vfs_cache_pressure
;
273 spin_unlock(&rpc_credcache_lock
);
274 rpcauth_destroy_credlist(&free
);
279 * Look up a process' credentials in the authentication cache
282 rpcauth_lookup_credcache(struct rpc_auth
*auth
, struct auth_cred
* acred
,
286 struct rpc_cred_cache
*cache
= auth
->au_credcache
;
287 struct hlist_node
*pos
;
288 struct rpc_cred
*cred
= NULL
,
292 nr
= hash_long(acred
->uid
, RPC_CREDCACHE_HASHBITS
);
295 hlist_for_each_entry_rcu(entry
, pos
, &cache
->hashtable
[nr
], cr_hash
) {
296 if (!entry
->cr_ops
->crmatch(acred
, entry
, flags
))
298 spin_lock(&cache
->lock
);
299 if (test_bit(RPCAUTH_CRED_HASHED
, &entry
->cr_flags
) == 0) {
300 spin_unlock(&cache
->lock
);
303 cred
= get_rpccred(entry
);
304 spin_unlock(&cache
->lock
);
312 new = auth
->au_ops
->crcreate(auth
, acred
, flags
);
318 spin_lock(&cache
->lock
);
319 hlist_for_each_entry(entry
, pos
, &cache
->hashtable
[nr
], cr_hash
) {
320 if (!entry
->cr_ops
->crmatch(acred
, entry
, flags
))
322 cred
= get_rpccred(entry
);
327 set_bit(RPCAUTH_CRED_HASHED
, &cred
->cr_flags
);
328 hlist_add_head_rcu(&cred
->cr_hash
, &cache
->hashtable
[nr
]);
330 list_add_tail(&new->cr_lru
, &free
);
331 spin_unlock(&cache
->lock
);
333 if (test_bit(RPCAUTH_CRED_NEW
, &cred
->cr_flags
)
334 && cred
->cr_ops
->cr_init
!= NULL
335 && !(flags
& RPCAUTH_LOOKUP_NEW
)) {
336 int res
= cred
->cr_ops
->cr_init(auth
, cred
);
342 rpcauth_destroy_credlist(&free
);
346 EXPORT_SYMBOL_GPL(rpcauth_lookup_credcache
);
349 rpcauth_lookupcred(struct rpc_auth
*auth
, int flags
)
351 struct auth_cred acred
= {
352 .uid
= current
->fsuid
,
353 .gid
= current
->fsgid
,
354 .group_info
= current
->group_info
,
356 struct rpc_cred
*ret
;
358 dprintk("RPC: looking up %s cred\n",
359 auth
->au_ops
->au_name
);
360 get_group_info(acred
.group_info
);
361 ret
= auth
->au_ops
->lookup_cred(auth
, &acred
, flags
);
362 put_group_info(acred
.group_info
);
367 rpcauth_init_cred(struct rpc_cred
*cred
, const struct auth_cred
*acred
,
368 struct rpc_auth
*auth
, const struct rpc_credops
*ops
)
370 INIT_HLIST_NODE(&cred
->cr_hash
);
371 INIT_LIST_HEAD(&cred
->cr_lru
);
372 atomic_set(&cred
->cr_count
, 1);
373 cred
->cr_auth
= auth
;
375 cred
->cr_expire
= jiffies
;
377 cred
->cr_magic
= RPCAUTH_CRED_MAGIC
;
379 cred
->cr_uid
= acred
->uid
;
381 EXPORT_SYMBOL_GPL(rpcauth_init_cred
);
384 rpcauth_generic_bind_cred(struct rpc_task
*task
, struct rpc_cred
*cred
)
386 task
->tk_msg
.rpc_cred
= get_rpccred(cred
);
387 dprintk("RPC: %5u holding %s cred %p\n", task
->tk_pid
,
388 cred
->cr_auth
->au_ops
->au_name
, cred
);
390 EXPORT_SYMBOL_GPL(rpcauth_generic_bind_cred
);
393 rpcauth_bind_root_cred(struct rpc_task
*task
)
395 struct rpc_auth
*auth
= task
->tk_client
->cl_auth
;
396 struct auth_cred acred
= {
400 struct rpc_cred
*ret
;
402 dprintk("RPC: %5u looking up %s cred\n",
403 task
->tk_pid
, task
->tk_client
->cl_auth
->au_ops
->au_name
);
404 ret
= auth
->au_ops
->lookup_cred(auth
, &acred
, 0);
406 task
->tk_msg
.rpc_cred
= ret
;
408 task
->tk_status
= PTR_ERR(ret
);
412 rpcauth_bind_new_cred(struct rpc_task
*task
)
414 struct rpc_auth
*auth
= task
->tk_client
->cl_auth
;
415 struct rpc_cred
*ret
;
417 dprintk("RPC: %5u looking up %s cred\n",
418 task
->tk_pid
, auth
->au_ops
->au_name
);
419 ret
= rpcauth_lookupcred(auth
, 0);
421 task
->tk_msg
.rpc_cred
= ret
;
423 task
->tk_status
= PTR_ERR(ret
);
427 rpcauth_bindcred(struct rpc_task
*task
, struct rpc_cred
*cred
, int flags
)
430 cred
->cr_ops
->crbind(task
, cred
);
431 else if (flags
& RPC_TASK_ROOTCREDS
)
432 rpcauth_bind_root_cred(task
);
434 rpcauth_bind_new_cred(task
);
438 put_rpccred(struct rpc_cred
*cred
)
440 /* Fast path for unhashed credentials */
441 if (test_bit(RPCAUTH_CRED_HASHED
, &cred
->cr_flags
) != 0)
444 if (!atomic_dec_and_test(&cred
->cr_count
))
448 if (!atomic_dec_and_lock(&cred
->cr_count
, &rpc_credcache_lock
))
450 if (!list_empty(&cred
->cr_lru
)) {
451 number_cred_unused
--;
452 list_del_init(&cred
->cr_lru
);
454 if (test_bit(RPCAUTH_CRED_UPTODATE
, &cred
->cr_flags
) == 0)
455 rpcauth_unhash_cred(cred
);
456 else if (test_bit(RPCAUTH_CRED_HASHED
, &cred
->cr_flags
) != 0) {
457 cred
->cr_expire
= jiffies
;
458 list_add_tail(&cred
->cr_lru
, &cred_unused
);
459 number_cred_unused
++;
460 spin_unlock(&rpc_credcache_lock
);
463 spin_unlock(&rpc_credcache_lock
);
465 cred
->cr_ops
->crdestroy(cred
);
467 EXPORT_SYMBOL_GPL(put_rpccred
);
470 rpcauth_unbindcred(struct rpc_task
*task
)
472 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
474 dprintk("RPC: %5u releasing %s cred %p\n",
475 task
->tk_pid
, cred
->cr_auth
->au_ops
->au_name
, cred
);
478 task
->tk_msg
.rpc_cred
= NULL
;
482 rpcauth_marshcred(struct rpc_task
*task
, __be32
*p
)
484 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
486 dprintk("RPC: %5u marshaling %s cred %p\n",
487 task
->tk_pid
, cred
->cr_auth
->au_ops
->au_name
, cred
);
489 return cred
->cr_ops
->crmarshal(task
, p
);
493 rpcauth_checkverf(struct rpc_task
*task
, __be32
*p
)
495 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
497 dprintk("RPC: %5u validating %s cred %p\n",
498 task
->tk_pid
, cred
->cr_auth
->au_ops
->au_name
, cred
);
500 return cred
->cr_ops
->crvalidate(task
, p
);
504 rpcauth_wrap_req(struct rpc_task
*task
, kxdrproc_t encode
, void *rqstp
,
505 __be32
*data
, void *obj
)
507 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
509 dprintk("RPC: %5u using %s cred %p to wrap rpc data\n",
510 task
->tk_pid
, cred
->cr_ops
->cr_name
, cred
);
511 if (cred
->cr_ops
->crwrap_req
)
512 return cred
->cr_ops
->crwrap_req(task
, encode
, rqstp
, data
, obj
);
513 /* By default, we encode the arguments normally. */
514 return rpc_call_xdrproc(encode
, rqstp
, data
, obj
);
518 rpcauth_unwrap_resp(struct rpc_task
*task
, kxdrproc_t decode
, void *rqstp
,
519 __be32
*data
, void *obj
)
521 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
523 dprintk("RPC: %5u using %s cred %p to unwrap rpc data\n",
524 task
->tk_pid
, cred
->cr_ops
->cr_name
, cred
);
525 if (cred
->cr_ops
->crunwrap_resp
)
526 return cred
->cr_ops
->crunwrap_resp(task
, decode
, rqstp
,
528 /* By default, we decode the arguments normally. */
529 return rpc_call_xdrproc(decode
, rqstp
, data
, obj
);
533 rpcauth_refreshcred(struct rpc_task
*task
)
535 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
538 dprintk("RPC: %5u refreshing %s cred %p\n",
539 task
->tk_pid
, cred
->cr_auth
->au_ops
->au_name
, cred
);
541 err
= cred
->cr_ops
->crrefresh(task
);
543 task
->tk_status
= err
;
548 rpcauth_invalcred(struct rpc_task
*task
)
550 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
552 dprintk("RPC: %5u invalidating %s cred %p\n",
553 task
->tk_pid
, cred
->cr_auth
->au_ops
->au_name
, cred
);
555 clear_bit(RPCAUTH_CRED_UPTODATE
, &cred
->cr_flags
);
559 rpcauth_uptodatecred(struct rpc_task
*task
)
561 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
563 return cred
== NULL
||
564 test_bit(RPCAUTH_CRED_UPTODATE
, &cred
->cr_flags
) != 0;
567 static struct shrinker rpc_cred_shrinker
= {
568 .shrink
= rpcauth_cache_shrinker
,
569 .seeks
= DEFAULT_SEEKS
,
572 void __init
rpcauth_init_module(void)
575 rpc_init_generic_auth();
576 register_shrinker(&rpc_cred_shrinker
);
579 void __exit
rpcauth_remove_module(void)
581 unregister_shrinker(&rpc_cred_shrinker
);