1 #include <linux/types.h>
2 #include <linux/sched.h>
3 #include <linux/module.h>
4 #include <linux/sunrpc/types.h>
5 #include <linux/sunrpc/xdr.h>
6 #include <linux/sunrpc/svcsock.h>
7 #include <linux/sunrpc/svcauth.h>
9 #include <linux/seq_file.h>
10 #include <linux/hash.h>
11 #include <linux/string.h>
13 #define RPCDBG_FACILITY RPCDBG_AUTH
17 * AUTHUNIX and AUTHNULL credentials are both handled here.
18 * AUTHNULL is treated just like AUTHUNIX except that the uid/gid
19 * are always nobody (-2). i.e. we do the same IP address checks for
20 * AUTHNULL as for AUTHUNIX, and that is done here.
27 /* other stuff later */
30 extern struct auth_ops svcauth_unix
;
32 struct auth_domain
*unix_domain_find(char *name
)
34 struct auth_domain
*rv
;
35 struct unix_domain
*new = NULL
;
37 rv
= auth_domain_lookup(name
, NULL
);
40 if (new && rv
!= &new->h
)
41 auth_domain_put(&new->h
);
43 if (rv
->flavour
!= &svcauth_unix
) {
50 new = kmalloc(sizeof(*new), GFP_KERNEL
);
53 kref_init(&new->h
.ref
);
54 new->h
.name
= kstrdup(name
, GFP_KERNEL
);
55 new->h
.flavour
= &svcauth_unix
;
56 new->addr_changes
= 0;
57 rv
= auth_domain_lookup(name
, &new->h
);
61 static void svcauth_unix_domain_release(struct auth_domain
*dom
)
63 struct unix_domain
*ud
= container_of(dom
, struct unix_domain
, h
);
70 /**************************************************
71 * cache for IP address to unix_domain
72 * as needed by AUTH_UNIX
75 #define IP_HASHMAX (1<<IP_HASHBITS)
76 #define IP_HASHMASK (IP_HASHMAX-1)
80 char m_class
[8]; /* e.g. "nfsd" */
81 struct in_addr m_addr
;
82 struct unix_domain
*m_client
;
85 static struct cache_head
*ip_table
[IP_HASHMAX
];
87 static void ip_map_put(struct kref
*kref
)
89 struct cache_head
*item
= container_of(kref
, struct cache_head
, ref
);
90 struct ip_map
*im
= container_of(item
, struct ip_map
,h
);
92 if (test_bit(CACHE_VALID
, &item
->flags
) &&
93 !test_bit(CACHE_NEGATIVE
, &item
->flags
))
94 auth_domain_put(&im
->m_client
->h
);
99 /* hash_long on a 64 bit machine is currently REALLY BAD for
100 * IP addresses in reverse-endian (i.e. on a little-endian machine).
101 * So use a trivial but reliable hash instead
103 static inline int hash_ip(unsigned long ip
)
105 int hash
= ip
^ (ip
>>16);
106 return (hash
^ (hash
>>8)) & 0xff;
109 static int ip_map_match(struct cache_head
*corig
, struct cache_head
*cnew
)
111 struct ip_map
*orig
= container_of(corig
, struct ip_map
, h
);
112 struct ip_map
*new = container_of(cnew
, struct ip_map
, h
);
113 return strcmp(orig
->m_class
, new->m_class
) == 0
114 && orig
->m_addr
.s_addr
== new->m_addr
.s_addr
;
116 static void ip_map_init(struct cache_head
*cnew
, struct cache_head
*citem
)
118 struct ip_map
*new = container_of(cnew
, struct ip_map
, h
);
119 struct ip_map
*item
= container_of(citem
, struct ip_map
, h
);
121 strcpy(new->m_class
, item
->m_class
);
122 new->m_addr
.s_addr
= item
->m_addr
.s_addr
;
124 static void update(struct cache_head
*cnew
, struct cache_head
*citem
)
126 struct ip_map
*new = container_of(cnew
, struct ip_map
, h
);
127 struct ip_map
*item
= container_of(citem
, struct ip_map
, h
);
129 kref_get(&item
->m_client
->h
.ref
);
130 new->m_client
= item
->m_client
;
131 new->m_add_change
= item
->m_add_change
;
133 static struct cache_head
*ip_map_alloc(void)
135 struct ip_map
*i
= kmalloc(sizeof(*i
), GFP_KERNEL
);
142 static void ip_map_request(struct cache_detail
*cd
,
143 struct cache_head
*h
,
144 char **bpp
, int *blen
)
147 struct ip_map
*im
= container_of(h
, struct ip_map
, h
);
148 __u32 addr
= im
->m_addr
.s_addr
;
150 snprintf(text_addr
, 20, "%u.%u.%u.%u",
151 ntohl(addr
) >> 24 & 0xff,
152 ntohl(addr
) >> 16 & 0xff,
153 ntohl(addr
) >> 8 & 0xff,
154 ntohl(addr
) >> 0 & 0xff);
156 qword_add(bpp
, blen
, im
->m_class
);
157 qword_add(bpp
, blen
, text_addr
);
161 static struct ip_map
*ip_map_lookup(char *class, struct in_addr addr
);
162 static int ip_map_update(struct ip_map
*ipm
, struct unix_domain
*udom
, time_t expiry
);
164 static int ip_map_parse(struct cache_detail
*cd
,
165 char *mesg
, int mlen
)
167 /* class ipaddress [domainname] */
168 /* should be safe just to use the start of the input buffer
179 struct auth_domain
*dom
;
182 if (mesg
[mlen
-1] != '\n')
187 len
= qword_get(&mesg
, class, sizeof(class));
188 if (len
<= 0) return -EINVAL
;
191 len
= qword_get(&mesg
, buf
, mlen
);
192 if (len
<= 0) return -EINVAL
;
194 if (sscanf(buf
, "%u.%u.%u.%u%c", &b1
, &b2
, &b3
, &b4
, &c
) != 4)
197 expiry
= get_expiry(&mesg
);
201 /* domainname, or empty for NEGATIVE */
202 len
= qword_get(&mesg
, buf
, mlen
);
203 if (len
< 0) return -EINVAL
;
206 dom
= unix_domain_find(buf
);
213 htonl((((((b1
<<8)|b2
)<<8)|b3
)<<8)|b4
);
215 ipmp
= ip_map_lookup(class,addr
);
217 err
= ip_map_update(ipmp
,
218 container_of(dom
, struct unix_domain
, h
),
224 auth_domain_put(dom
);
230 static int ip_map_show(struct seq_file
*m
,
231 struct cache_detail
*cd
,
232 struct cache_head
*h
)
236 char *dom
= "-no-domain-";
239 seq_puts(m
, "#class IP domain\n");
242 im
= container_of(h
, struct ip_map
, h
);
243 /* class addr domain */
246 if (test_bit(CACHE_VALID
, &h
->flags
) &&
247 !test_bit(CACHE_NEGATIVE
, &h
->flags
))
248 dom
= im
->m_client
->h
.name
;
250 seq_printf(m
, "%s %d.%d.%d.%d %s\n",
252 htonl(addr
.s_addr
) >> 24 & 0xff,
253 htonl(addr
.s_addr
) >> 16 & 0xff,
254 htonl(addr
.s_addr
) >> 8 & 0xff,
255 htonl(addr
.s_addr
) >> 0 & 0xff,
262 struct cache_detail ip_map_cache
= {
263 .owner
= THIS_MODULE
,
264 .hash_size
= IP_HASHMAX
,
265 .hash_table
= ip_table
,
266 .name
= "auth.unix.ip",
267 .cache_put
= ip_map_put
,
268 .cache_request
= ip_map_request
,
269 .cache_parse
= ip_map_parse
,
270 .cache_show
= ip_map_show
,
271 .match
= ip_map_match
,
274 .alloc
= ip_map_alloc
,
277 static struct ip_map
*ip_map_lookup(char *class, struct in_addr addr
)
280 struct cache_head
*ch
;
282 strcpy(ip
.m_class
, class);
284 ch
= sunrpc_cache_lookup(&ip_map_cache
, &ip
.h
,
285 hash_str(class, IP_HASHBITS
) ^
286 hash_ip((unsigned long)addr
.s_addr
));
289 return container_of(ch
, struct ip_map
, h
);
294 static int ip_map_update(struct ip_map
*ipm
, struct unix_domain
*udom
, time_t expiry
)
297 struct cache_head
*ch
;
302 set_bit(CACHE_NEGATIVE
, &ip
.h
.flags
);
304 ip
.m_add_change
= udom
->addr_changes
;
305 /* if this is from the legacy set_client system call,
306 * we need m_add_change to be one higher
311 ip
.h
.expiry_time
= expiry
;
312 ch
= sunrpc_cache_update(&ip_map_cache
,
314 hash_str(ipm
->m_class
, IP_HASHBITS
) ^
315 hash_ip((unsigned long)ipm
->m_addr
.s_addr
));
318 cache_put(ch
, &ip_map_cache
);
322 int auth_unix_add_addr(struct in_addr addr
, struct auth_domain
*dom
)
324 struct unix_domain
*udom
;
327 if (dom
->flavour
!= &svcauth_unix
)
329 udom
= container_of(dom
, struct unix_domain
, h
);
330 ipmp
= ip_map_lookup("nfsd", addr
);
333 return ip_map_update(ipmp
, udom
, NEVER
);
338 int auth_unix_forget_old(struct auth_domain
*dom
)
340 struct unix_domain
*udom
;
342 if (dom
->flavour
!= &svcauth_unix
)
344 udom
= container_of(dom
, struct unix_domain
, h
);
345 udom
->addr_changes
++;
349 struct auth_domain
*auth_unix_lookup(struct in_addr addr
)
351 struct ip_map key
, *ipm
;
352 struct auth_domain
*rv
;
354 strcpy(key
.m_class
, "nfsd");
357 ipm
= ip_map_lookup("nfsd", addr
);
361 if (cache_check(&ip_map_cache
, &ipm
->h
, NULL
))
364 if ((ipm
->m_client
->addr_changes
- ipm
->m_add_change
) >0) {
365 if (test_and_set_bit(CACHE_NEGATIVE
, &ipm
->h
.flags
) == 0)
366 auth_domain_put(&ipm
->m_client
->h
);
369 rv
= &ipm
->m_client
->h
;
372 cache_put(&ipm
->h
, &ip_map_cache
);
376 void svcauth_unix_purge(void)
378 cache_purge(&ip_map_cache
);
382 svcauth_unix_set_client(struct svc_rqst
*rqstp
)
386 rqstp
->rq_client
= NULL
;
387 if (rqstp
->rq_proc
== 0)
390 ipm
= ip_map_lookup(rqstp
->rq_server
->sv_program
->pg_class
,
391 rqstp
->rq_addr
.sin_addr
);
396 switch (cache_check(&ip_map_cache
, &ipm
->h
, &rqstp
->rq_chandle
)) {
404 rqstp
->rq_client
= &ipm
->m_client
->h
;
405 kref_get(&rqstp
->rq_client
->ref
);
406 cache_put(&ipm
->h
, &ip_map_cache
);
413 svcauth_null_accept(struct svc_rqst
*rqstp
, u32
*authp
)
415 struct kvec
*argv
= &rqstp
->rq_arg
.head
[0];
416 struct kvec
*resv
= &rqstp
->rq_res
.head
[0];
417 struct svc_cred
*cred
= &rqstp
->rq_cred
;
419 cred
->cr_group_info
= NULL
;
420 rqstp
->rq_client
= NULL
;
422 if (argv
->iov_len
< 3*4)
425 if (svc_getu32(argv
) != 0) {
426 dprintk("svc: bad null cred\n");
427 *authp
= rpc_autherr_badcred
;
430 if (svc_getu32(argv
) != RPC_AUTH_NULL
|| svc_getu32(argv
) != 0) {
431 dprintk("svc: bad null verf\n");
432 *authp
= rpc_autherr_badverf
;
436 /* Signal that mapping to nobody uid/gid is required */
437 cred
->cr_uid
= (uid_t
) -1;
438 cred
->cr_gid
= (gid_t
) -1;
439 cred
->cr_group_info
= groups_alloc(0);
440 if (cred
->cr_group_info
== NULL
)
441 return SVC_DROP
; /* kmalloc failure - client must retry */
443 /* Put NULL verifier */
444 svc_putu32(resv
, RPC_AUTH_NULL
);
451 svcauth_null_release(struct svc_rqst
*rqstp
)
453 if (rqstp
->rq_client
)
454 auth_domain_put(rqstp
->rq_client
);
455 rqstp
->rq_client
= NULL
;
456 if (rqstp
->rq_cred
.cr_group_info
)
457 put_group_info(rqstp
->rq_cred
.cr_group_info
);
458 rqstp
->rq_cred
.cr_group_info
= NULL
;
460 return 0; /* don't drop */
464 struct auth_ops svcauth_null
= {
466 .owner
= THIS_MODULE
,
467 .flavour
= RPC_AUTH_NULL
,
468 .accept
= svcauth_null_accept
,
469 .release
= svcauth_null_release
,
470 .set_client
= svcauth_unix_set_client
,
475 svcauth_unix_accept(struct svc_rqst
*rqstp
, u32
*authp
)
477 struct kvec
*argv
= &rqstp
->rq_arg
.head
[0];
478 struct kvec
*resv
= &rqstp
->rq_res
.head
[0];
479 struct svc_cred
*cred
= &rqstp
->rq_cred
;
481 int len
= argv
->iov_len
;
483 cred
->cr_group_info
= NULL
;
484 rqstp
->rq_client
= NULL
;
486 if ((len
-= 3*4) < 0)
489 svc_getu32(argv
); /* length */
490 svc_getu32(argv
); /* time stamp */
491 slen
= XDR_QUADLEN(ntohl(svc_getu32(argv
))); /* machname length */
492 if (slen
> 64 || (len
-= (slen
+ 3)*4) < 0)
494 argv
->iov_base
= (void*)((u32
*)argv
->iov_base
+ slen
); /* skip machname */
495 argv
->iov_len
-= slen
*4;
497 cred
->cr_uid
= ntohl(svc_getu32(argv
)); /* uid */
498 cred
->cr_gid
= ntohl(svc_getu32(argv
)); /* gid */
499 slen
= ntohl(svc_getu32(argv
)); /* gids length */
500 if (slen
> 16 || (len
-= (slen
+ 2)*4) < 0)
502 cred
->cr_group_info
= groups_alloc(slen
);
503 if (cred
->cr_group_info
== NULL
)
505 for (i
= 0; i
< slen
; i
++)
506 GROUP_AT(cred
->cr_group_info
, i
) = ntohl(svc_getu32(argv
));
508 if (svc_getu32(argv
) != RPC_AUTH_NULL
|| svc_getu32(argv
) != 0) {
509 *authp
= rpc_autherr_badverf
;
513 /* Put NULL verifier */
514 svc_putu32(resv
, RPC_AUTH_NULL
);
520 *authp
= rpc_autherr_badcred
;
525 svcauth_unix_release(struct svc_rqst
*rqstp
)
527 /* Verifier (such as it is) is already in place.
529 if (rqstp
->rq_client
)
530 auth_domain_put(rqstp
->rq_client
);
531 rqstp
->rq_client
= NULL
;
532 if (rqstp
->rq_cred
.cr_group_info
)
533 put_group_info(rqstp
->rq_cred
.cr_group_info
);
534 rqstp
->rq_cred
.cr_group_info
= NULL
;
540 struct auth_ops svcauth_unix
= {
542 .owner
= THIS_MODULE
,
543 .flavour
= RPC_AUTH_UNIX
,
544 .accept
= svcauth_unix_accept
,
545 .release
= svcauth_unix_release
,
546 .domain_release
= svcauth_unix_domain_release
,
547 .set_client
= svcauth_unix_set_client
,