2 * linux/net/sunrpc/auth.c
4 * Generic RPC client authentication API.
6 * Copyright (C) 1996, Olaf Kirch <okir@monad.swb.de>
9 #include <linux/types.h>
10 #include <linux/sched.h>
11 #include <linux/module.h>
12 #include <linux/slab.h>
13 #include <linux/errno.h>
14 #include <linux/sunrpc/clnt.h>
15 #include <linux/spinlock.h>
16 #include <linux/smp_lock.h>
19 # define RPCDBG_FACILITY RPCDBG_AUTH
22 static DEFINE_SPINLOCK(rpc_authflavor_lock
);
23 static const struct rpc_authops
*auth_flavors
[RPC_AUTH_MAXFLAVOR
] = {
24 &authnull_ops
, /* AUTH_NULL */
25 &authunix_ops
, /* AUTH_UNIX */
26 NULL
, /* others can be loadable modules */
29 static LIST_HEAD(cred_unused
);
30 static unsigned long number_cred_unused
;
33 pseudoflavor_to_flavor(u32 flavor
) {
34 if (flavor
>= RPC_AUTH_MAXFLAVOR
)
40 rpcauth_register(const struct rpc_authops
*ops
)
42 rpc_authflavor_t flavor
;
45 if ((flavor
= ops
->au_flavor
) >= RPC_AUTH_MAXFLAVOR
)
47 spin_lock(&rpc_authflavor_lock
);
48 if (auth_flavors
[flavor
] == NULL
) {
49 auth_flavors
[flavor
] = ops
;
52 spin_unlock(&rpc_authflavor_lock
);
57 rpcauth_unregister(const struct rpc_authops
*ops
)
59 rpc_authflavor_t flavor
;
62 if ((flavor
= ops
->au_flavor
) >= RPC_AUTH_MAXFLAVOR
)
64 spin_lock(&rpc_authflavor_lock
);
65 if (auth_flavors
[flavor
] == ops
) {
66 auth_flavors
[flavor
] = NULL
;
69 spin_unlock(&rpc_authflavor_lock
);
74 rpcauth_create(rpc_authflavor_t pseudoflavor
, struct rpc_clnt
*clnt
)
76 struct rpc_auth
*auth
;
77 const struct rpc_authops
*ops
;
78 u32 flavor
= pseudoflavor_to_flavor(pseudoflavor
);
80 auth
= ERR_PTR(-EINVAL
);
81 if (flavor
>= RPC_AUTH_MAXFLAVOR
)
85 if ((ops
= auth_flavors
[flavor
]) == NULL
)
86 request_module("rpc-auth-%u", flavor
);
88 spin_lock(&rpc_authflavor_lock
);
89 ops
= auth_flavors
[flavor
];
90 if (ops
== NULL
|| !try_module_get(ops
->owner
)) {
91 spin_unlock(&rpc_authflavor_lock
);
94 spin_unlock(&rpc_authflavor_lock
);
95 auth
= ops
->create(clnt
, pseudoflavor
);
96 module_put(ops
->owner
);
100 rpcauth_release(clnt
->cl_auth
);
101 clnt
->cl_auth
= auth
;
108 rpcauth_release(struct rpc_auth
*auth
)
110 if (!atomic_dec_and_test(&auth
->au_count
))
112 auth
->au_ops
->destroy(auth
);
115 static DEFINE_SPINLOCK(rpc_credcache_lock
);
118 rpcauth_unhash_cred_locked(struct rpc_cred
*cred
)
120 hlist_del_rcu(&cred
->cr_hash
);
121 smp_mb__before_clear_bit();
122 clear_bit(RPCAUTH_CRED_HASHED
, &cred
->cr_flags
);
126 rpcauth_unhash_cred(struct rpc_cred
*cred
)
128 spinlock_t
*cache_lock
;
130 cache_lock
= &cred
->cr_auth
->au_credcache
->lock
;
131 spin_lock(cache_lock
);
132 if (atomic_read(&cred
->cr_count
) == 0)
133 rpcauth_unhash_cred_locked(cred
);
134 spin_unlock(cache_lock
);
138 * Initialize RPC credential cache
141 rpcauth_init_credcache(struct rpc_auth
*auth
)
143 struct rpc_cred_cache
*new;
146 new = kmalloc(sizeof(*new), GFP_KERNEL
);
149 for (i
= 0; i
< RPC_CREDCACHE_NR
; i
++)
150 INIT_HLIST_HEAD(&new->hashtable
[i
]);
151 spin_lock_init(&new->lock
);
152 auth
->au_credcache
= new;
157 * Destroy a list of credentials
160 void rpcauth_destroy_credlist(struct list_head
*head
)
162 struct rpc_cred
*cred
;
164 while (!list_empty(head
)) {
165 cred
= list_entry(head
->next
, struct rpc_cred
, cr_lru
);
166 list_del_init(&cred
->cr_lru
);
172 * Clear the RPC credential cache, and delete those credentials
173 * that are not referenced.
176 rpcauth_clear_credcache(struct rpc_cred_cache
*cache
)
179 struct hlist_head
*head
;
180 struct rpc_cred
*cred
;
183 spin_lock(&rpc_credcache_lock
);
184 spin_lock(&cache
->lock
);
185 for (i
= 0; i
< RPC_CREDCACHE_NR
; i
++) {
186 head
= &cache
->hashtable
[i
];
187 while (!hlist_empty(head
)) {
188 cred
= hlist_entry(head
->first
, struct rpc_cred
, cr_hash
);
190 if (!list_empty(&cred
->cr_lru
)) {
191 list_del(&cred
->cr_lru
);
192 number_cred_unused
--;
194 list_add_tail(&cred
->cr_lru
, &free
);
195 rpcauth_unhash_cred_locked(cred
);
198 spin_unlock(&cache
->lock
);
199 spin_unlock(&rpc_credcache_lock
);
200 rpcauth_destroy_credlist(&free
);
204 * Destroy the RPC credential cache
207 rpcauth_destroy_credcache(struct rpc_auth
*auth
)
209 struct rpc_cred_cache
*cache
= auth
->au_credcache
;
212 auth
->au_credcache
= NULL
;
213 rpcauth_clear_credcache(cache
);
219 * Remove stale credentials. Avoid sleeping inside the loop.
222 rpcauth_prune_expired(struct list_head
*free
, int nr_to_scan
)
224 spinlock_t
*cache_lock
;
225 struct rpc_cred
*cred
;
227 while (!list_empty(&cred_unused
)) {
228 cred
= list_entry(cred_unused
.next
, struct rpc_cred
, cr_lru
);
229 list_del_init(&cred
->cr_lru
);
230 number_cred_unused
--;
231 if (atomic_read(&cred
->cr_count
) != 0)
233 cache_lock
= &cred
->cr_auth
->au_credcache
->lock
;
234 spin_lock(cache_lock
);
235 if (atomic_read(&cred
->cr_count
) == 0) {
237 list_add_tail(&cred
->cr_lru
, free
);
238 rpcauth_unhash_cred_locked(cred
);
241 spin_unlock(cache_lock
);
249 * Run memory cache shrinker.
252 rpcauth_cache_shrinker(int nr_to_scan
, gfp_t gfp_mask
)
257 if (list_empty(&cred_unused
))
259 spin_lock(&rpc_credcache_lock
);
260 nr_to_scan
= rpcauth_prune_expired(&free
, nr_to_scan
);
261 res
= (number_cred_unused
/ 100) * sysctl_vfs_cache_pressure
;
262 spin_unlock(&rpc_credcache_lock
);
263 rpcauth_destroy_credlist(&free
);
268 * Look up a process' credentials in the authentication cache
271 rpcauth_lookup_credcache(struct rpc_auth
*auth
, struct auth_cred
* acred
,
275 struct rpc_cred_cache
*cache
= auth
->au_credcache
;
276 struct hlist_node
*pos
;
277 struct rpc_cred
*cred
= NULL
,
281 if (!(flags
& RPCAUTH_LOOKUP_ROOTCREDS
))
282 nr
= acred
->uid
& RPC_CREDCACHE_MASK
;
285 hlist_for_each_entry_rcu(entry
, pos
, &cache
->hashtable
[nr
], cr_hash
) {
286 if (!entry
->cr_ops
->crmatch(acred
, entry
, flags
))
288 spin_lock(&cache
->lock
);
289 if (test_bit(RPCAUTH_CRED_HASHED
, &entry
->cr_flags
) == 0) {
290 spin_unlock(&cache
->lock
);
293 cred
= get_rpccred(entry
);
294 spin_unlock(&cache
->lock
);
302 new = auth
->au_ops
->crcreate(auth
, acred
, flags
);
308 spin_lock(&cache
->lock
);
309 hlist_for_each_entry(entry
, pos
, &cache
->hashtable
[nr
], cr_hash
) {
310 if (!entry
->cr_ops
->crmatch(acred
, entry
, flags
))
312 cred
= get_rpccred(entry
);
317 set_bit(RPCAUTH_CRED_HASHED
, &cred
->cr_flags
);
318 hlist_add_head_rcu(&cred
->cr_hash
, &cache
->hashtable
[nr
]);
320 list_add_tail(&new->cr_lru
, &free
);
321 spin_unlock(&cache
->lock
);
323 if (test_bit(RPCAUTH_CRED_NEW
, &cred
->cr_flags
)
324 && cred
->cr_ops
->cr_init
!= NULL
325 && !(flags
& RPCAUTH_LOOKUP_NEW
)) {
326 int res
= cred
->cr_ops
->cr_init(auth
, cred
);
332 rpcauth_destroy_credlist(&free
);
338 rpcauth_lookupcred(struct rpc_auth
*auth
, int flags
)
340 struct auth_cred acred
= {
341 .uid
= current
->fsuid
,
342 .gid
= current
->fsgid
,
343 .group_info
= current
->group_info
,
345 struct rpc_cred
*ret
;
347 dprintk("RPC: looking up %s cred\n",
348 auth
->au_ops
->au_name
);
349 get_group_info(acred
.group_info
);
350 ret
= auth
->au_ops
->lookup_cred(auth
, &acred
, flags
);
351 put_group_info(acred
.group_info
);
356 rpcauth_init_cred(struct rpc_cred
*cred
, const struct auth_cred
*acred
,
357 struct rpc_auth
*auth
, const struct rpc_credops
*ops
)
359 INIT_HLIST_NODE(&cred
->cr_hash
);
360 INIT_LIST_HEAD(&cred
->cr_lru
);
361 atomic_set(&cred
->cr_count
, 1);
362 cred
->cr_auth
= auth
;
364 cred
->cr_expire
= jiffies
;
366 cred
->cr_magic
= RPCAUTH_CRED_MAGIC
;
368 cred
->cr_uid
= acred
->uid
;
370 EXPORT_SYMBOL(rpcauth_init_cred
);
373 rpcauth_bindcred(struct rpc_task
*task
)
375 struct rpc_auth
*auth
= task
->tk_client
->cl_auth
;
376 struct auth_cred acred
= {
377 .uid
= current
->fsuid
,
378 .gid
= current
->fsgid
,
379 .group_info
= current
->group_info
,
381 struct rpc_cred
*ret
;
384 dprintk("RPC: %5u looking up %s cred\n",
385 task
->tk_pid
, task
->tk_client
->cl_auth
->au_ops
->au_name
);
386 get_group_info(acred
.group_info
);
387 if (task
->tk_flags
& RPC_TASK_ROOTCREDS
)
388 flags
|= RPCAUTH_LOOKUP_ROOTCREDS
;
389 ret
= auth
->au_ops
->lookup_cred(auth
, &acred
, flags
);
391 task
->tk_msg
.rpc_cred
= ret
;
393 task
->tk_status
= PTR_ERR(ret
);
394 put_group_info(acred
.group_info
);
399 rpcauth_holdcred(struct rpc_task
*task
)
401 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
404 dprintk("RPC: %5u holding %s cred %p\n", task
->tk_pid
,
405 cred
->cr_auth
->au_ops
->au_name
, cred
);
410 put_rpccred(struct rpc_cred
*cred
)
412 /* Fast path for unhashed credentials */
413 if (test_bit(RPCAUTH_CRED_HASHED
, &cred
->cr_flags
) != 0)
416 if (!atomic_dec_and_test(&cred
->cr_count
))
420 if (!atomic_dec_and_lock(&cred
->cr_count
, &rpc_credcache_lock
))
422 if (!list_empty(&cred
->cr_lru
)) {
423 number_cred_unused
--;
424 list_del_init(&cred
->cr_lru
);
426 if (test_bit(RPCAUTH_CRED_UPTODATE
, &cred
->cr_flags
) == 0)
427 rpcauth_unhash_cred(cred
);
428 else if (test_bit(RPCAUTH_CRED_HASHED
, &cred
->cr_flags
) != 0) {
429 cred
->cr_expire
= jiffies
;
430 list_add_tail(&cred
->cr_lru
, &cred_unused
);
431 number_cred_unused
++;
432 spin_unlock(&rpc_credcache_lock
);
435 spin_unlock(&rpc_credcache_lock
);
437 cred
->cr_ops
->crdestroy(cred
);
441 rpcauth_unbindcred(struct rpc_task
*task
)
443 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
445 dprintk("RPC: %5u releasing %s cred %p\n",
446 task
->tk_pid
, cred
->cr_auth
->au_ops
->au_name
, cred
);
449 task
->tk_msg
.rpc_cred
= NULL
;
453 rpcauth_marshcred(struct rpc_task
*task
, __be32
*p
)
455 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
457 dprintk("RPC: %5u marshaling %s cred %p\n",
458 task
->tk_pid
, cred
->cr_auth
->au_ops
->au_name
, cred
);
460 return cred
->cr_ops
->crmarshal(task
, p
);
464 rpcauth_checkverf(struct rpc_task
*task
, __be32
*p
)
466 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
468 dprintk("RPC: %5u validating %s cred %p\n",
469 task
->tk_pid
, cred
->cr_auth
->au_ops
->au_name
, cred
);
471 return cred
->cr_ops
->crvalidate(task
, p
);
475 rpcauth_wrap_req(struct rpc_task
*task
, kxdrproc_t encode
, void *rqstp
,
476 __be32
*data
, void *obj
)
478 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
481 dprintk("RPC: %5u using %s cred %p to wrap rpc data\n",
482 task
->tk_pid
, cred
->cr_ops
->cr_name
, cred
);
483 if (cred
->cr_ops
->crwrap_req
)
484 return cred
->cr_ops
->crwrap_req(task
, encode
, rqstp
, data
, obj
);
485 /* By default, we encode the arguments normally. */
487 ret
= encode(rqstp
, data
, obj
);
493 rpcauth_unwrap_resp(struct rpc_task
*task
, kxdrproc_t decode
, void *rqstp
,
494 __be32
*data
, void *obj
)
496 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
499 dprintk("RPC: %5u using %s cred %p to unwrap rpc data\n",
500 task
->tk_pid
, cred
->cr_ops
->cr_name
, cred
);
501 if (cred
->cr_ops
->crunwrap_resp
)
502 return cred
->cr_ops
->crunwrap_resp(task
, decode
, rqstp
,
504 /* By default, we decode the arguments normally. */
506 ret
= decode(rqstp
, data
, obj
);
512 rpcauth_refreshcred(struct rpc_task
*task
)
514 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
517 dprintk("RPC: %5u refreshing %s cred %p\n",
518 task
->tk_pid
, cred
->cr_auth
->au_ops
->au_name
, cred
);
520 err
= cred
->cr_ops
->crrefresh(task
);
522 task
->tk_status
= err
;
527 rpcauth_invalcred(struct rpc_task
*task
)
529 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
531 dprintk("RPC: %5u invalidating %s cred %p\n",
532 task
->tk_pid
, cred
->cr_auth
->au_ops
->au_name
, cred
);
534 clear_bit(RPCAUTH_CRED_UPTODATE
, &cred
->cr_flags
);
538 rpcauth_uptodatecred(struct rpc_task
*task
)
540 struct rpc_cred
*cred
= task
->tk_msg
.rpc_cred
;
542 return cred
== NULL
||
543 test_bit(RPCAUTH_CRED_UPTODATE
, &cred
->cr_flags
) != 0;
547 static struct shrinker
*rpc_cred_shrinker
;
549 void __init
rpcauth_init_module(void)
552 rpc_cred_shrinker
= set_shrinker(DEFAULT_SEEKS
, rpcauth_cache_shrinker
);
555 void __exit
rpcauth_remove_module(void)
557 if (rpc_cred_shrinker
!= NULL
)
558 remove_shrinker(rpc_cred_shrinker
);