?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
[PATCH] knfsd: svcrpc: Simplify nfsd rpcsec_gss integrity code
[linux-2.6/verdex.git] / net / sunrpc / auth_gss / svcauth_gss.c
blobce8dc0db214ed4b7731ae074d04f3d968a47e34a
1 /*
2 * Neil Brown <neilb@cse.unsw.edu.au>
3 * J. Bruce Fields <bfields@umich.edu>
4 * Andy Adamson <andros@umich.edu>
5 * Dug Song <dugsong@monkey.org>
6 *
7 * RPCSEC_GSS server authentication.
8 * This implements RPCSEC_GSS as defined in rfc2203 (rpcsec_gss) and rfc2078
9 * (gssapi)
10 *
11 * The RPCSEC_GSS involves three stages:
12 * 1/ context creation
13 * 2/ data exchange
14 * 3/ context destruction
15 *
16 * Context creation is handled largely by upcalls to user-space.
17 * In particular, GSS_Accept_sec_context is handled by an upcall
18 * Data exchange is handled entirely within the kernel
19 * In particular, GSS_GetMIC, GSS_VerifyMIC, GSS_Seal, GSS_Unseal are in-kernel.
20 * Context destruction is handled in-kernel
21 * GSS_Delete_sec_context is in-kernel
22 *
23 * Context creation is initiated by a RPCSEC_GSS_INIT request arriving.
24 * The context handle and gss_token are used as a key into the rpcsec_init cache.
25 * The content of this cache includes some of the outputs of GSS_Accept_sec_context,
26 * being major_status, minor_status, context_handle, reply_token.
27 * These are sent back to the client.
28 * Sequence window management is handled by the kernel. The window size if currently
29 * a compile time constant.
30 *
31 * When user-space is happy that a context is established, it places an entry
32 * in the rpcsec_context cache. The key for this cache is the context_handle.
33 * The content includes:
34 * uid/gidlist - for determining access rights
35 * mechanism type
36 * mechanism specific information, such as a key
37 *
38 */
39
40 #include <linux/types.h>
41 #include <linux/module.h>
42 #include <linux/pagemap.h>
43
44 #include <linux/sunrpc/auth_gss.h>
45 #include <linux/sunrpc/svcauth.h>
46 #include <linux/sunrpc/gss_err.h>
47 #include <linux/sunrpc/svcauth.h>
48 #include <linux/sunrpc/svcauth_gss.h>
49 #include <linux/sunrpc/cache.h>
50
51 #ifdef RPC_DEBUG
52 # define RPCDBG_FACILITY RPCDBG_AUTH
53 #endif
54
55 /* The rpcsec_init cache is used for mapping RPCSEC_GSS_{,CONT_}INIT requests
56 * into replies.
57 *
58 * Key is context handle (\x if empty) and gss_token.
59 * Content is major_status minor_status (integers) context_handle, reply_token.
60 *
61 */
62
63 static int netobj_equal(struct xdr_netobj *a, struct xdr_netobj *b)
64 {
65 return a->len == b->len && 0 == memcmp(a->data, b->data, a->len);
66 }
67
68 #define RSI_HASHBITS 6
69 #define RSI_HASHMAX (1<<RSI_HASHBITS)
70 #define RSI_HASHMASK (RSI_HASHMAX-1)
71
72 struct rsi {
73 struct cache_head h;
74 struct xdr_netobj in_handle, in_token;
75 struct xdr_netobj out_handle, out_token;
76 int major_status, minor_status;
77 };
78
79 static struct cache_head *rsi_table[RSI_HASHMAX];
80 static struct cache_detail rsi_cache;
81 static struct rsi *rsi_update(struct rsi *new, struct rsi *old);
82 static struct rsi *rsi_lookup(struct rsi *item);
83
84 static void rsi_free(struct rsi *rsii)
85 {
86 kfree(rsii->in_handle.data);
87 kfree(rsii->in_token.data);
88 kfree(rsii->out_handle.data);
89 kfree(rsii->out_token.data);
90 }
91
92 static void rsi_put(struct kref *ref)
93 {
94 struct rsi *rsii = container_of(ref, struct rsi, h.ref);
95 rsi_free(rsii);
96 kfree(rsii);
97 }
98
99 static inline int rsi_hash(struct rsi *item)
100 {
101 return hash_mem(item->in_handle.data, item->in_handle.len, RSI_HASHBITS)
102 ^ hash_mem(item->in_token.data, item->in_token.len, RSI_HASHBITS);
103 }
104
105 static int rsi_match(struct cache_head *a, struct cache_head *b)
106 {
107 struct rsi *item = container_of(a, struct rsi, h);
108 struct rsi *tmp = container_of(b, struct rsi, h);
109 return netobj_equal(&item->in_handle, &tmp->in_handle)
110 && netobj_equal(&item->in_token, &tmp->in_token);
111 }
112
113 static int dup_to_netobj(struct xdr_netobj *dst, char *src, int len)
114 {
115 dst->len = len;
116 dst->data = (len ? kmalloc(len, GFP_KERNEL) : NULL);
117 if (dst->data)
118 memcpy(dst->data, src, len);
119 if (len && !dst->data)
120 return -ENOMEM;
121 return 0;
122 }
123
124 static inline int dup_netobj(struct xdr_netobj *dst, struct xdr_netobj *src)
125 {
126 return dup_to_netobj(dst, src->data, src->len);
127 }
128
129 static void rsi_init(struct cache_head *cnew, struct cache_head *citem)
130 {
131 struct rsi *new = container_of(cnew, struct rsi, h);
132 struct rsi *item = container_of(citem, struct rsi, h);
133
134 new->out_handle.data = NULL;
135 new->out_handle.len = 0;
136 new->out_token.data = NULL;
137 new->out_token.len = 0;
138 new->in_handle.len = item->in_handle.len;
139 item->in_handle.len = 0;
140 new->in_token.len = item->in_token.len;
141 item->in_token.len = 0;
142 new->in_handle.data = item->in_handle.data;
143 item->in_handle.data = NULL;
144 new->in_token.data = item->in_token.data;
145 item->in_token.data = NULL;
146 }
147
148 static void update_rsi(struct cache_head *cnew, struct cache_head *citem)
149 {
150 struct rsi *new = container_of(cnew, struct rsi, h);
151 struct rsi *item = container_of(citem, struct rsi, h);
152
153 BUG_ON(new->out_handle.data || new->out_token.data);
154 new->out_handle.len = item->out_handle.len;
155 item->out_handle.len = 0;
156 new->out_token.len = item->out_token.len;
157 item->out_token.len = 0;
158 new->out_handle.data = item->out_handle.data;
159 item->out_handle.data = NULL;
160 new->out_token.data = item->out_token.data;
161 item->out_token.data = NULL;
162
163 new->major_status = item->major_status;
164 new->minor_status = item->minor_status;
165 }
166
167 static struct cache_head *rsi_alloc(void)
168 {
169 struct rsi *rsii = kmalloc(sizeof(*rsii), GFP_KERNEL);
170 if (rsii)
171 return &rsii->h;
172 else
173 return NULL;
174 }
175
176 static void rsi_request(struct cache_detail *cd,
177 struct cache_head *h,
178 char **bpp, int *blen)
179 {
180 struct rsi *rsii = container_of(h, struct rsi, h);
181
182 qword_addhex(bpp, blen, rsii->in_handle.data, rsii->in_handle.len);
183 qword_addhex(bpp, blen, rsii->in_token.data, rsii->in_token.len);
184 (*bpp)[-1] = '\n';
185 }
186
187
188 static int rsi_parse(struct cache_detail *cd,
189 char *mesg, int mlen)
190 {
191 /* context token expiry major minor context token */
192 char *buf = mesg;
193 char *ep;
194 int len;
195 struct rsi rsii, *rsip = NULL;
196 time_t expiry;
197 int status = -EINVAL;
198
199 memset(&rsii, 0, sizeof(rsii));
200 /* handle */
201 len = qword_get(&mesg, buf, mlen);
202 if (len < 0)
203 goto out;
204 status = -ENOMEM;
205 if (dup_to_netobj(&rsii.in_handle, buf, len))
206 goto out;
207
208 /* token */
209 len = qword_get(&mesg, buf, mlen);
210 status = -EINVAL;
211 if (len < 0)
212 goto out;
213 status = -ENOMEM;
214 if (dup_to_netobj(&rsii.in_token, buf, len))
215 goto out;
216
217 rsip = rsi_lookup(&rsii);
218 if (!rsip)
219 goto out;
220
221 rsii.h.flags = 0;
222 /* expiry */
223 expiry = get_expiry(&mesg);
224 status = -EINVAL;
225 if (expiry == 0)
226 goto out;
227
228 /* major/minor */
229 len = qword_get(&mesg, buf, mlen);
230 if (len < 0)
231 goto out;
232 if (len == 0) {
233 goto out;
234 } else {
235 rsii.major_status = simple_strtoul(buf, &ep, 10);
236 if (*ep)
237 goto out;
238 len = qword_get(&mesg, buf, mlen);
239 if (len <= 0)
240 goto out;
241 rsii.minor_status = simple_strtoul(buf, &ep, 10);
242 if (*ep)
243 goto out;
244
245 /* out_handle */
246 len = qword_get(&mesg, buf, mlen);
247 if (len < 0)
248 goto out;
249 status = -ENOMEM;
250 if (dup_to_netobj(&rsii.out_handle, buf, len))
251 goto out;
252
253 /* out_token */
254 len = qword_get(&mesg, buf, mlen);
255 status = -EINVAL;
256 if (len < 0)
257 goto out;
258 status = -ENOMEM;
259 if (dup_to_netobj(&rsii.out_token, buf, len))
260 goto out;
261 }
262 rsii.h.expiry_time = expiry;
263 rsip = rsi_update(&rsii, rsip);
264 status = 0;
265 out:
266 rsi_free(&rsii);
267 if (rsip)
268 cache_put(&rsip->h, &rsi_cache);
269 else
270 status = -ENOMEM;
271 return status;
272 }
273
274 static struct cache_detail rsi_cache = {
275 .owner = THIS_MODULE,
276 .hash_size = RSI_HASHMAX,
277 .hash_table = rsi_table,
278 .name = "auth.rpcsec.init",
279 .cache_put = rsi_put,
280 .cache_request = rsi_request,
281 .cache_parse = rsi_parse,
282 .match = rsi_match,
283 .init = rsi_init,
284 .update = update_rsi,
285 .alloc = rsi_alloc,
286 };
287
288 static struct rsi *rsi_lookup(struct rsi *item)
289 {
290 struct cache_head *ch;
291 int hash = rsi_hash(item);
292
293 ch = sunrpc_cache_lookup(&rsi_cache, &item->h, hash);
294 if (ch)
295 return container_of(ch, struct rsi, h);
296 else
297 return NULL;
298 }
299
300 static struct rsi *rsi_update(struct rsi *new, struct rsi *old)
301 {
302 struct cache_head *ch;
303 int hash = rsi_hash(new);
304
305 ch = sunrpc_cache_update(&rsi_cache, &new->h,
306 &old->h, hash);
307 if (ch)
308 return container_of(ch, struct rsi, h);
309 else
310 return NULL;
311 }
312
313
314 /*
315 * The rpcsec_context cache is used to store a context that is
316 * used in data exchange.
317 * The key is a context handle. The content is:
318 * uid, gidlist, mechanism, service-set, mech-specific-data
319 */
320
321 #define RSC_HASHBITS 10
322 #define RSC_HASHMAX (1<<RSC_HASHBITS)
323 #define RSC_HASHMASK (RSC_HASHMAX-1)
324
325 #define GSS_SEQ_WIN 128
326
327 struct gss_svc_seq_data {
328 /* highest seq number seen so far: */
329 int sd_max;
330 /* for i such that sd_max-GSS_SEQ_WIN < i <= sd_max, the i-th bit of
331 * sd_win is nonzero iff sequence number i has been seen already: */
332 unsigned long sd_win[GSS_SEQ_WIN/BITS_PER_LONG];
333 spinlock_t sd_lock;
334 };
335
336 struct rsc {
337 struct cache_head h;
338 struct xdr_netobj handle;
339 struct svc_cred cred;
340 struct gss_svc_seq_data seqdata;
341 struct gss_ctx *mechctx;
342 };
343
344 static struct cache_head *rsc_table[RSC_HASHMAX];
345 static struct cache_detail rsc_cache;
346 static struct rsc *rsc_update(struct rsc *new, struct rsc *old);
347 static struct rsc *rsc_lookup(struct rsc *item);
348
349 static void rsc_free(struct rsc *rsci)
350 {
351 kfree(rsci->handle.data);
352 if (rsci->mechctx)
353 gss_delete_sec_context(&rsci->mechctx);
354 if (rsci->cred.cr_group_info)
355 put_group_info(rsci->cred.cr_group_info);
356 }
357
358 static void rsc_put(struct kref *ref)
359 {
360 struct rsc *rsci = container_of(ref, struct rsc, h.ref);
361
362 rsc_free(rsci);
363 kfree(rsci);
364 }
365
366 static inline int
367 rsc_hash(struct rsc *rsci)
368 {
369 return hash_mem(rsci->handle.data, rsci->handle.len, RSC_HASHBITS);
370 }
371
372 static int
373 rsc_match(struct cache_head *a, struct cache_head *b)
374 {
375 struct rsc *new = container_of(a, struct rsc, h);
376 struct rsc *tmp = container_of(b, struct rsc, h);
377
378 return netobj_equal(&new->handle, &tmp->handle);
379 }
380
381 static void
382 rsc_init(struct cache_head *cnew, struct cache_head *ctmp)
383 {
384 struct rsc *new = container_of(cnew, struct rsc, h);
385 struct rsc *tmp = container_of(ctmp, struct rsc, h);
386
387 new->handle.len = tmp->handle.len;
388 tmp->handle.len = 0;
389 new->handle.data = tmp->handle.data;
390 tmp->handle.data = NULL;
391 new->mechctx = NULL;
392 new->cred.cr_group_info = NULL;
393 }
394
395 static void
396 update_rsc(struct cache_head *cnew, struct cache_head *ctmp)
397 {
398 struct rsc *new = container_of(cnew, struct rsc, h);
399 struct rsc *tmp = container_of(ctmp, struct rsc, h);
400
401 new->mechctx = tmp->mechctx;
402 tmp->mechctx = NULL;
403 memset(&new->seqdata, 0, sizeof(new->seqdata));
404 spin_lock_init(&new->seqdata.sd_lock);
405 new->cred = tmp->cred;
406 tmp->cred.cr_group_info = NULL;
407 }
408
409 static struct cache_head *
410 rsc_alloc(void)
411 {
412 struct rsc *rsci = kmalloc(sizeof(*rsci), GFP_KERNEL);
413 if (rsci)
414 return &rsci->h;
415 else
416 return NULL;
417 }
418
419 static int rsc_parse(struct cache_detail *cd,
420 char *mesg, int mlen)
421 {
422 /* contexthandle expiry [ uid gid N <n gids> mechname ...mechdata... ] */
423 char *buf = mesg;
424 int len, rv;
425 struct rsc rsci, *rscp = NULL;
426 time_t expiry;
427 int status = -EINVAL;
428 struct gss_api_mech *gm = NULL;
429
430 memset(&rsci, 0, sizeof(rsci));
431 /* context handle */
432 len = qword_get(&mesg, buf, mlen);
433 if (len < 0) goto out;
434 status = -ENOMEM;
435 if (dup_to_netobj(&rsci.handle, buf, len))
436 goto out;
437
438 rsci.h.flags = 0;
439 /* expiry */
440 expiry = get_expiry(&mesg);
441 status = -EINVAL;
442 if (expiry == 0)
443 goto out;
444
445 rscp = rsc_lookup(&rsci);
446 if (!rscp)
447 goto out;
448
449 /* uid, or NEGATIVE */
450 rv = get_int(&mesg, &rsci.cred.cr_uid);
451 if (rv == -EINVAL)
452 goto out;
453 if (rv == -ENOENT)
454 set_bit(CACHE_NEGATIVE, &rsci.h.flags);
455 else {
456 int N, i;
457
458 /* gid */
459 if (get_int(&mesg, &rsci.cred.cr_gid))
460 goto out;
461
462 /* number of additional gid's */
463 if (get_int(&mesg, &N))
464 goto out;
465 status = -ENOMEM;
466 rsci.cred.cr_group_info = groups_alloc(N);
467 if (rsci.cred.cr_group_info == NULL)
468 goto out;
469
470 /* gid's */
471 status = -EINVAL;
472 for (i=0; i<N; i++) {
473 gid_t gid;
474 if (get_int(&mesg, &gid))
475 goto out;
476 GROUP_AT(rsci.cred.cr_group_info, i) = gid;
477 }
478
479 /* mech name */
480 len = qword_get(&mesg, buf, mlen);
481 if (len < 0)
482 goto out;
483 gm = gss_mech_get_by_name(buf);
484 status = -EOPNOTSUPP;
485 if (!gm)
486 goto out;
487
488 status = -EINVAL;
489 /* mech-specific data: */
490 len = qword_get(&mesg, buf, mlen);
491 if (len < 0)
492 goto out;
493 status = gss_import_sec_context(buf, len, gm, &rsci.mechctx);
494 if (status)
495 goto out;
496 }
497 rsci.h.expiry_time = expiry;
498 rscp = rsc_update(&rsci, rscp);
499 status = 0;
500 out:
501 gss_mech_put(gm);
502 rsc_free(&rsci);
503 if (rscp)
504 cache_put(&rscp->h, &rsc_cache);
505 else
506 status = -ENOMEM;
507 return status;
508 }
509
510 static struct cache_detail rsc_cache = {
511 .owner = THIS_MODULE,
512 .hash_size = RSC_HASHMAX,
513 .hash_table = rsc_table,
514 .name = "auth.rpcsec.context",
515 .cache_put = rsc_put,
516 .cache_parse = rsc_parse,
517 .match = rsc_match,
518 .init = rsc_init,
519 .update = update_rsc,
520 .alloc = rsc_alloc,
521 };
522
523 static struct rsc *rsc_lookup(struct rsc *item)
524 {
525 struct cache_head *ch;
526 int hash = rsc_hash(item);
527
528 ch = sunrpc_cache_lookup(&rsc_cache, &item->h, hash);
529 if (ch)
530 return container_of(ch, struct rsc, h);
531 else
532 return NULL;
533 }
534
535 static struct rsc *rsc_update(struct rsc *new, struct rsc *old)
536 {
537 struct cache_head *ch;
538 int hash = rsc_hash(new);
539
540 ch = sunrpc_cache_update(&rsc_cache, &new->h,
541 &old->h, hash);
542 if (ch)
543 return container_of(ch, struct rsc, h);
544 else
545 return NULL;
546 }
547
548
549 static struct rsc *
550 gss_svc_searchbyctx(struct xdr_netobj *handle)
551 {
552 struct rsc rsci;
553 struct rsc *found;
554
555 memset(&rsci, 0, sizeof(rsci));
556 if (dup_to_netobj(&rsci.handle, handle->data, handle->len))
557 return NULL;
558 found = rsc_lookup(&rsci);
559 rsc_free(&rsci);
560 if (!found)
561 return NULL;
562 if (cache_check(&rsc_cache, &found->h, NULL))
563 return NULL;
564 return found;
565 }
566
567 /* Implements sequence number algorithm as specified in RFC 2203. */
568 static int
569 gss_check_seq_num(struct rsc *rsci, int seq_num)
570 {
571 struct gss_svc_seq_data *sd = &rsci->seqdata;
572
573 spin_lock(&sd->sd_lock);
574 if (seq_num > sd->sd_max) {
575 if (seq_num >= sd->sd_max + GSS_SEQ_WIN) {
576 memset(sd->sd_win,0,sizeof(sd->sd_win));
577 sd->sd_max = seq_num;
578 } else while (sd->sd_max < seq_num) {
579 sd->sd_max++;
580 __clear_bit(sd->sd_max % GSS_SEQ_WIN, sd->sd_win);
581 }
582 __set_bit(seq_num % GSS_SEQ_WIN, sd->sd_win);
583 goto ok;
584 } else if (seq_num <= sd->sd_max - GSS_SEQ_WIN) {
585 goto drop;
586 }
587 /* sd_max - GSS_SEQ_WIN < seq_num <= sd_max */
588 if (__test_and_set_bit(seq_num % GSS_SEQ_WIN, sd->sd_win))
589 goto drop;
590 ok:
591 spin_unlock(&sd->sd_lock);
592 return 1;
593 drop:
594 spin_unlock(&sd->sd_lock);
595 return 0;
596 }
597
598 static inline u32 round_up_to_quad(u32 i)
599 {
600 return (i + 3 ) & ~3;
601 }
602
603 static inline int
604 svc_safe_getnetobj(struct kvec *argv, struct xdr_netobj *o)
605 {
606 int l;
607
608 if (argv->iov_len < 4)
609 return -1;
610 o->len = ntohl(svc_getu32(argv));
611 l = round_up_to_quad(o->len);
612 if (argv->iov_len < l)
613 return -1;
614 o->data = argv->iov_base;
615 argv->iov_base += l;
616 argv->iov_len -= l;
617 return 0;
618 }
619
620 static inline int
621 svc_safe_putnetobj(struct kvec *resv, struct xdr_netobj *o)
622 {
623 u32 *p;
624
625 if (resv->iov_len + 4 > PAGE_SIZE)
626 return -1;
627 svc_putu32(resv, htonl(o->len));
628 p = resv->iov_base + resv->iov_len;
629 resv->iov_len += round_up_to_quad(o->len);
630 if (resv->iov_len > PAGE_SIZE)
631 return -1;
632 memcpy(p, o->data, o->len);
633 memset((u8 *)p + o->len, 0, round_up_to_quad(o->len) - o->len);
634 return 0;
635 }
636
637 /* Verify the checksum on the header and return SVC_OK on success.
638 * Otherwise, return SVC_DROP (in the case of a bad sequence number)
639 * or return SVC_DENIED and indicate error in authp.
640 */
641 static int
642 gss_verify_header(struct svc_rqst *rqstp, struct rsc *rsci,
643 u32 *rpcstart, struct rpc_gss_wire_cred *gc, u32 *authp)
644 {
645 struct gss_ctx *ctx_id = rsci->mechctx;
646 struct xdr_buf rpchdr;
647 struct xdr_netobj checksum;
648 u32 flavor = 0;
649 struct kvec *argv = &rqstp->rq_arg.head[0];
650 struct kvec iov;
651
652 /* data to compute the checksum over: */
653 iov.iov_base = rpcstart;
654 iov.iov_len = (u8 *)argv->iov_base - (u8 *)rpcstart;
655 xdr_buf_from_iov(&iov, &rpchdr);
656
657 *authp = rpc_autherr_badverf;
658 if (argv->iov_len < 4)
659 return SVC_DENIED;
660 flavor = ntohl(svc_getu32(argv));
661 if (flavor != RPC_AUTH_GSS)
662 return SVC_DENIED;
663 if (svc_safe_getnetobj(argv, &checksum))
664 return SVC_DENIED;
665
666 if (rqstp->rq_deferred) /* skip verification of revisited request */
667 return SVC_OK;
668 if (gss_verify_mic(ctx_id, &rpchdr, &checksum) != GSS_S_COMPLETE) {
669 *authp = rpcsec_gsserr_credproblem;
670 return SVC_DENIED;
671 }
672
673 if (gc->gc_seq > MAXSEQ) {
674 dprintk("RPC: svcauth_gss: discarding request with large sequence number %d\n",
675 gc->gc_seq);
676 *authp = rpcsec_gsserr_ctxproblem;
677 return SVC_DENIED;
678 }
679 if (!gss_check_seq_num(rsci, gc->gc_seq)) {
680 dprintk("RPC: svcauth_gss: discarding request with old sequence number %d\n",
681 gc->gc_seq);
682 return SVC_DROP;
683 }
684 return SVC_OK;
685 }
686
687 static int
688 gss_write_null_verf(struct svc_rqst *rqstp)
689 {
690 u32 *p;
691
692 svc_putu32(rqstp->rq_res.head, htonl(RPC_AUTH_NULL));
693 p = rqstp->rq_res.head->iov_base + rqstp->rq_res.head->iov_len;
694 /* don't really need to check if head->iov_len > PAGE_SIZE ... */
695 *p++ = 0;
696 if (!xdr_ressize_check(rqstp, p))
697 return -1;
698 return 0;
699 }
700
701 static int
702 gss_write_verf(struct svc_rqst *rqstp, struct gss_ctx *ctx_id, u32 seq)
703 {
704 u32 xdr_seq;
705 u32 maj_stat;
706 struct xdr_buf verf_data;
707 struct xdr_netobj mic;
708 u32 *p;
709 struct kvec iov;
710
711 svc_putu32(rqstp->rq_res.head, htonl(RPC_AUTH_GSS));
712 xdr_seq = htonl(seq);
713
714 iov.iov_base = &xdr_seq;
715 iov.iov_len = sizeof(xdr_seq);
716 xdr_buf_from_iov(&iov, &verf_data);
717 p = rqstp->rq_res.head->iov_base + rqstp->rq_res.head->iov_len;
718 mic.data = (u8 *)(p + 1);
719 maj_stat = gss_get_mic(ctx_id, &verf_data, &mic);
720 if (maj_stat != GSS_S_COMPLETE)
721 return -1;
722 *p++ = htonl(mic.len);
723 memset((u8 *)p + mic.len, 0, round_up_to_quad(mic.len) - mic.len);
724 p += XDR_QUADLEN(mic.len);
725 if (!xdr_ressize_check(rqstp, p))
726 return -1;
727 return 0;
728 }
729
730 struct gss_domain {
731 struct auth_domain h;
732 u32 pseudoflavor;
733 };
734
735 static struct auth_domain *
736 find_gss_auth_domain(struct gss_ctx *ctx, u32 svc)
737 {
738 char *name;
739
740 name = gss_service_to_auth_domain_name(ctx->mech_type, svc);
741 if (!name)
742 return NULL;
743 return auth_domain_find(name);
744 }
745
746 static struct auth_ops svcauthops_gss;
747
748 int
749 svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name)
750 {
751 struct gss_domain *new;
752 struct auth_domain *test;
753 int stat = -ENOMEM;
754
755 new = kmalloc(sizeof(*new), GFP_KERNEL);
756 if (!new)
757 goto out;
758 kref_init(&new->h.ref);
759 new->h.name = kmalloc(strlen(name) + 1, GFP_KERNEL);
760 if (!new->h.name)
761 goto out_free_dom;
762 strcpy(new->h.name, name);
763 new->h.flavour = &svcauthops_gss;
764 new->pseudoflavor = pseudoflavor;
765
766 test = auth_domain_lookup(name, &new->h);
767 if (test != &new->h) { /* XXX Duplicate registration? */
768 auth_domain_put(&new->h);
769 /* dangling ref-count... */
770 goto out;
771 }
772 return 0;
773
774 out_free_dom:
775 kfree(new);
776 out:
777 return stat;
778 }
779
780 EXPORT_SYMBOL(svcauth_gss_register_pseudoflavor);
781
782 static inline int
783 read_u32_from_xdr_buf(struct xdr_buf *buf, int base, u32 *obj)
784 {
785 u32 raw;
786 int status;
787
788 status = read_bytes_from_xdr_buf(buf, base, &raw, sizeof(*obj));
789 if (status)
790 return status;
791 *obj = ntohl(raw);
792 return 0;
793 }
794
795 /* It would be nice if this bit of code could be shared with the client.
796 * Obstacles:
797 * The client shouldn't malloc(), would have to pass in own memory.
798 * The server uses base of head iovec as read pointer, while the
799 * client uses separate pointer. */
800 static int
801 unwrap_integ_data(struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
802 {
803 int stat = -EINVAL;
804 u32 integ_len, maj_stat;
805 struct xdr_netobj mic;
806 struct xdr_buf integ_buf;
807
808 integ_len = ntohl(svc_getu32(&buf->head[0]));
809 if (integ_len & 3)
810 goto out;
811 if (integ_len > buf->len)
812 goto out;
813 if (xdr_buf_subsegment(buf, &integ_buf, 0, integ_len))
814 BUG();
815 /* copy out mic... */
816 if (read_u32_from_xdr_buf(buf, integ_len, &mic.len))
817 BUG();
818 if (mic.len > RPC_MAX_AUTH_SIZE)
819 goto out;
820 mic.data = kmalloc(mic.len, GFP_KERNEL);
821 if (!mic.data)
822 goto out;
823 if (read_bytes_from_xdr_buf(buf, integ_len + 4, mic.data, mic.len))
824 goto out;
825 maj_stat = gss_verify_mic(ctx, &integ_buf, &mic);
826 if (maj_stat != GSS_S_COMPLETE)
827 goto out;
828 if (ntohl(svc_getu32(&buf->head[0])) != seq)
829 goto out;
830 stat = 0;
831 out:
832 return stat;
833 }
834
835 struct gss_svc_data {
836 /* decoded gss client cred: */
837 struct rpc_gss_wire_cred clcred;
838 /* pointer to the beginning of the procedure-specific results,
839 * which may be encrypted/checksummed in svcauth_gss_release: */
840 u32 *body_start;
841 struct rsc *rsci;
842 };
843
844 static int
845 svcauth_gss_set_client(struct svc_rqst *rqstp)
846 {
847 struct gss_svc_data *svcdata = rqstp->rq_auth_data;
848 struct rsc *rsci = svcdata->rsci;
849 struct rpc_gss_wire_cred *gc = &svcdata->clcred;
850
851 rqstp->rq_client = find_gss_auth_domain(rsci->mechctx, gc->gc_svc);
852 if (rqstp->rq_client == NULL)
853 return SVC_DENIED;
854 return SVC_OK;
855 }
856
857 static inline int
858 gss_write_init_verf(struct svc_rqst *rqstp, struct rsi *rsip)
859 {
860 struct rsc *rsci;
861
862 if (rsip->major_status != GSS_S_COMPLETE)
863 return gss_write_null_verf(rqstp);
864 rsci = gss_svc_searchbyctx(&rsip->out_handle);
865 if (rsci == NULL) {
866 rsip->major_status = GSS_S_NO_CONTEXT;
867 return gss_write_null_verf(rqstp);
868 }
869 return gss_write_verf(rqstp, rsci->mechctx, GSS_SEQ_WIN);
870 }
871
872 /*
873 * Accept an rpcsec packet.
874 * If context establishment, punt to user space
875 * If data exchange, verify/decrypt
876 * If context destruction, handle here
877 * In the context establishment and destruction case we encode
878 * response here and return SVC_COMPLETE.
879 */
880 static int
881 svcauth_gss_accept(struct svc_rqst *rqstp, u32 *authp)
882 {
883 struct kvec *argv = &rqstp->rq_arg.head[0];
884 struct kvec *resv = &rqstp->rq_res.head[0];
885 u32 crlen;
886 struct xdr_netobj tmpobj;
887 struct gss_svc_data *svcdata = rqstp->rq_auth_data;
888 struct rpc_gss_wire_cred *gc;
889 struct rsc *rsci = NULL;
890 struct rsi *rsip, rsikey;
891 u32 *rpcstart;
892 u32 *reject_stat = resv->iov_base + resv->iov_len;
893 int ret;
894
895 dprintk("RPC: svcauth_gss: argv->iov_len = %zd\n",argv->iov_len);
896
897 *authp = rpc_autherr_badcred;
898 if (!svcdata)
899 svcdata = kmalloc(sizeof(*svcdata), GFP_KERNEL);
900 if (!svcdata)
901 goto auth_err;
902 rqstp->rq_auth_data = svcdata;
903 svcdata->body_start = NULL;
904 svcdata->rsci = NULL;
905 gc = &svcdata->clcred;
906
907 /* start of rpc packet is 7 u32's back from here:
908 * xid direction rpcversion prog vers proc flavour
909 */
910 rpcstart = argv->iov_base;
911 rpcstart -= 7;
912
913 /* credential is:
914 * version(==1), proc(0,1,2,3), seq, service (1,2,3), handle
915 * at least 5 u32s, and is preceeded by length, so that makes 6.
916 */
917
918 if (argv->iov_len < 5 * 4)
919 goto auth_err;
920 crlen = ntohl(svc_getu32(argv));
921 if (ntohl(svc_getu32(argv)) != RPC_GSS_VERSION)
922 goto auth_err;
923 gc->gc_proc = ntohl(svc_getu32(argv));
924 gc->gc_seq = ntohl(svc_getu32(argv));
925 gc->gc_svc = ntohl(svc_getu32(argv));
926 if (svc_safe_getnetobj(argv, &gc->gc_ctx))
927 goto auth_err;
928 if (crlen != round_up_to_quad(gc->gc_ctx.len) + 5 * 4)
929 goto auth_err;
930
931 if ((gc->gc_proc != RPC_GSS_PROC_DATA) && (rqstp->rq_proc != 0))
932 goto auth_err;
933
934 /*
935 * We've successfully parsed the credential. Let's check out the
936 * verifier. An AUTH_NULL verifier is allowed (and required) for
937 * INIT and CONTINUE_INIT requests. AUTH_RPCSEC_GSS is required for
938 * PROC_DATA and PROC_DESTROY.
939 *
940 * AUTH_NULL verifier is 0 (AUTH_NULL), 0 (length).
941 * AUTH_RPCSEC_GSS verifier is:
942 * 6 (AUTH_RPCSEC_GSS), length, checksum.
943 * checksum is calculated over rpcheader from xid up to here.
944 */
945 *authp = rpc_autherr_badverf;
946 switch (gc->gc_proc) {
947 case RPC_GSS_PROC_INIT:
948 case RPC_GSS_PROC_CONTINUE_INIT:
949 if (argv->iov_len < 2 * 4)
950 goto auth_err;
951 if (ntohl(svc_getu32(argv)) != RPC_AUTH_NULL)
952 goto auth_err;
953 if (ntohl(svc_getu32(argv)) != 0)
954 goto auth_err;
955 break;
956 case RPC_GSS_PROC_DATA:
957 case RPC_GSS_PROC_DESTROY:
958 *authp = rpcsec_gsserr_credproblem;
959 rsci = gss_svc_searchbyctx(&gc->gc_ctx);
960 if (!rsci)
961 goto auth_err;
962 switch (gss_verify_header(rqstp, rsci, rpcstart, gc, authp)) {
963 case SVC_OK:
964 break;
965 case SVC_DENIED:
966 goto auth_err;
967 case SVC_DROP:
968 goto drop;
969 }
970 break;
971 default:
972 *authp = rpc_autherr_rejectedcred;
973 goto auth_err;
974 }
975
976 /* now act upon the command: */
977 switch (gc->gc_proc) {
978 case RPC_GSS_PROC_INIT:
979 case RPC_GSS_PROC_CONTINUE_INIT:
980 *authp = rpc_autherr_badcred;
981 if (gc->gc_proc == RPC_GSS_PROC_INIT && gc->gc_ctx.len != 0)
982 goto auth_err;
983 memset(&rsikey, 0, sizeof(rsikey));
984 if (dup_netobj(&rsikey.in_handle, &gc->gc_ctx))
985 goto drop;
986 *authp = rpc_autherr_badverf;
987 if (svc_safe_getnetobj(argv, &tmpobj)) {
988 kfree(rsikey.in_handle.data);
989 goto auth_err;
990 }
991 if (dup_netobj(&rsikey.in_token, &tmpobj)) {
992 kfree(rsikey.in_handle.data);
993 goto drop;
994 }
995
996 rsip = rsi_lookup(&rsikey);
997 rsi_free(&rsikey);
998 if (!rsip) {
999 goto drop;
1000 }
1001 switch(cache_check(&rsi_cache, &rsip->h, &rqstp->rq_chandle)) {
1002 case -EAGAIN:
1003 goto drop;
1004 case -ENOENT:
1005 goto drop;
1006 case 0:
1007 if (gss_write_init_verf(rqstp, rsip))
1008 goto drop;
1009 if (resv->iov_len + 4 > PAGE_SIZE)
1010 goto drop;
1011 svc_putu32(resv, rpc_success);
1012 if (svc_safe_putnetobj(resv, &rsip->out_handle))
1013 goto drop;
1014 if (resv->iov_len + 3 * 4 > PAGE_SIZE)
1015 goto drop;
1016 svc_putu32(resv, htonl(rsip->major_status));
1017 svc_putu32(resv, htonl(rsip->minor_status));
1018 svc_putu32(resv, htonl(GSS_SEQ_WIN));
1019 if (svc_safe_putnetobj(resv, &rsip->out_token))
1020 goto drop;
1021 rqstp->rq_client = NULL;
1022 }
1023 goto complete;
1024 case RPC_GSS_PROC_DESTROY:
1025 set_bit(CACHE_NEGATIVE, &rsci->h.flags);
1026 if (resv->iov_len + 4 > PAGE_SIZE)
1027 goto drop;
1028 svc_putu32(resv, rpc_success);
1029 goto complete;
1030 case RPC_GSS_PROC_DATA:
1031 *authp = rpcsec_gsserr_ctxproblem;
1032 if (gss_write_verf(rqstp, rsci->mechctx, gc->gc_seq))
1033 goto auth_err;
1034 rqstp->rq_cred = rsci->cred;
1035 get_group_info(rsci->cred.cr_group_info);
1036 *authp = rpc_autherr_badcred;
1037 switch (gc->gc_svc) {
1038 case RPC_GSS_SVC_NONE:
1039 break;
1040 case RPC_GSS_SVC_INTEGRITY:
1041 if (unwrap_integ_data(&rqstp->rq_arg,
1042 gc->gc_seq, rsci->mechctx))
1043 goto auth_err;
1044 /* placeholders for length and seq. number: */
1045 svcdata->body_start = resv->iov_base + resv->iov_len;
1046 svc_putu32(resv, 0);
1047 svc_putu32(resv, 0);
1048 break;
1049 case RPC_GSS_SVC_PRIVACY:
1050 /* currently unsupported */
1051 default:
1052 goto auth_err;
1053 }
1054 svcdata->rsci = rsci;
1055 cache_get(&rsci->h);
1056 ret = SVC_OK;
1057 goto out;
1058 }
1059 auth_err:
1060 /* Restore write pointer to original value: */
1061 xdr_ressize_check(rqstp, reject_stat);
1062 ret = SVC_DENIED;
1063 goto out;
1064 complete:
1065 ret = SVC_COMPLETE;
1066 goto out;
1067 drop:
1068 ret = SVC_DROP;
1069 out:
1070 if (rsci)
1071 cache_put(&rsci->h, &rsc_cache);
1072 return ret;
1073 }
1074
1075 static inline int
1076 svcauth_gss_wrap_resp_integ(struct svc_rqst *rqstp)
1077 {
1078 struct gss_svc_data *gsd = (struct gss_svc_data *)rqstp->rq_auth_data;
1079 struct rpc_gss_wire_cred *gc = &gsd->clcred;
1080 struct xdr_buf *resbuf = &rqstp->rq_res;
1081 struct xdr_buf integ_buf;
1082 struct xdr_netobj mic;
1083 struct kvec *resv;
1084 u32 *p;
1085 int integ_offset, integ_len;
1086 int stat = -EINVAL;
1087
1088 p = gsd->body_start;
1089 gsd->body_start = NULL;
1090 /* move accept_stat to right place: */
1091 memcpy(p, p + 2, 4);
1092 /* don't wrap in failure case: */
1093 /* Note: counting on not getting here if call was not even
1094 * accepted! */
1095 if (*p != rpc_success) {
1096 resbuf->head[0].iov_len -= 2 * 4;
1097 goto out;
1098 }
1099 p++;
1100 integ_offset = (u8 *)(p + 1) - (u8 *)resbuf->head[0].iov_base;
1101 integ_len = resbuf->len - integ_offset;
1102 BUG_ON(integ_len % 4);
1103 *p++ = htonl(integ_len);
1104 *p++ = htonl(gc->gc_seq);
1105 if (xdr_buf_subsegment(resbuf, &integ_buf, integ_offset,
1106 integ_len))
1107 BUG();
1108 if (resbuf->page_len == 0
1109 && resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE
1110 < PAGE_SIZE) {
1111 BUG_ON(resbuf->tail[0].iov_len);
1112 /* Use head for everything */
1113 resv = &resbuf->head[0];
1114 } else if (resbuf->tail[0].iov_base == NULL) {
1115 if (resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE > PAGE_SIZE)
1116 goto out_err;
1117 resbuf->tail[0].iov_base = resbuf->head[0].iov_base
1118 + resbuf->head[0].iov_len;
1119 resbuf->tail[0].iov_len = 0;
1120 rqstp->rq_restailpage = 0;
1121 resv = &resbuf->tail[0];
1122 } else {
1123 resv = &resbuf->tail[0];
1124 }
1125 mic.data = (u8 *)resv->iov_base + resv->iov_len + 4;
1126 if (gss_get_mic(gsd->rsci->mechctx, &integ_buf, &mic))
1127 goto out_err;
1128 svc_putu32(resv, htonl(mic.len));
1129 memset(mic.data + mic.len, 0,
1130 round_up_to_quad(mic.len) - mic.len);
1131 resv->iov_len += XDR_QUADLEN(mic.len) << 2;
1132 /* not strictly required: */
1133 resbuf->len += XDR_QUADLEN(mic.len) << 2;
1134 BUG_ON(resv->iov_len > PAGE_SIZE);
1135 out:
1136 stat = 0;
1137 out_err:
1138 return stat;
1139 }
1140
1141 static int
1142 svcauth_gss_release(struct svc_rqst *rqstp)
1143 {
1144 struct gss_svc_data *gsd = (struct gss_svc_data *)rqstp->rq_auth_data;
1145 struct rpc_gss_wire_cred *gc = &gsd->clcred;
1146 struct xdr_buf *resbuf = &rqstp->rq_res;
1147 int stat = -EINVAL;
1148
1149 if (gc->gc_proc != RPC_GSS_PROC_DATA)
1150 goto out;
1151 /* Release can be called twice, but we only wrap once. */
1152 if (gsd->body_start == NULL)
1153 goto out;
1154 /* normally not set till svc_send, but we need it here: */
1155 resbuf->len = resbuf->head[0].iov_len
1156 + resbuf->page_len + resbuf->tail[0].iov_len;
1157 switch (gc->gc_svc) {
1158 case RPC_GSS_SVC_NONE:
1159 break;
1160 case RPC_GSS_SVC_INTEGRITY:
1161 svcauth_gss_wrap_resp_integ(rqstp);
1162 break;
1163 case RPC_GSS_SVC_PRIVACY:
1164 default:
1165 goto out_err;
1166 }
1167
1168 out:
1169 stat = 0;
1170 out_err:
1171 if (rqstp->rq_client)
1172 auth_domain_put(rqstp->rq_client);
1173 rqstp->rq_client = NULL;
1174 if (rqstp->rq_cred.cr_group_info)
1175 put_group_info(rqstp->rq_cred.cr_group_info);
1176 rqstp->rq_cred.cr_group_info = NULL;
1177 if (gsd->rsci)
1178 cache_put(&gsd->rsci->h, &rsc_cache);
1179 gsd->rsci = NULL;
1180
1181 return stat;
1182 }
1183
1184 static void
1185 svcauth_gss_domain_release(struct auth_domain *dom)
1186 {
1187 struct gss_domain *gd = container_of(dom, struct gss_domain, h);
1188
1189 kfree(dom->name);
1190 kfree(gd);
1191 }
1192
1193 static struct auth_ops svcauthops_gss = {
1194 .name = "rpcsec_gss",
1195 .owner = THIS_MODULE,
1196 .flavour = RPC_AUTH_GSS,
1197 .accept = svcauth_gss_accept,
1198 .release = svcauth_gss_release,
1199 .domain_release = svcauth_gss_domain_release,
1200 .set_client = svcauth_gss_set_client,
1201 };
1202
1203 int
1204 gss_svc_init(void)
1205 {
1206 int rv = svc_auth_register(RPC_AUTH_GSS, &svcauthops_gss);
1207 if (rv == 0) {
1208 cache_register(&rsc_cache);
1209 cache_register(&rsi_cache);
1210 }
1211 return rv;
1212 }
1213
1214 void
1215 gss_svc_shutdown(void)
1216 {
1217 if (cache_unregister(&rsc_cache))
1218 printk(KERN_ERR "auth_rpcgss: failed to unregister rsc cache\n");
1219 if (cache_unregister(&rsi_cache))
1220 printk(KERN_ERR "auth_rpcgss: failed to unregister rsi cache\n");
1221 svc_auth_unregister(RPC_AUTH_GSS);
1222 }
Verdex Pro support