aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTrond Myklebust <Trond.Myklebust@netapp.com>2013-04-23 15:40:40 -0400
committerTrond Myklebust <Trond.Myklebust@netapp.com>2013-04-23 15:40:40 -0400
commitbd1d421abcaae1b84ba377ea4c33bba31d654199 (patch)
tree10bf67d7063a95ffd013a9d01a35b906a7d89fcf
parentbdeca1b76cd56cd10a029f0ad2fd9ab6dd7e313d (diff)
parent79d852bf5e7691dc78cc6322ecd1860c50940785 (diff)
Merge branch 'rpcsec_gss-from_cel' into linux-next
* rpcsec_gss-from_cel: (21 commits) NFS: Retry SETCLIENTID with AUTH_SYS instead of AUTH_NONE NFSv4: Don't clear the machine cred when client establish returns EACCES NFSv4: Fix issues in nfs4_discover_server_trunking NFSv4: Fix the fallback to AUTH_NULL if krb5i is not available NFS: Use server-recommended security flavor by default (NFSv3) SUNRPC: Don't recognize RPC_AUTH_MAXFLAVOR NFS: Use "krb5i" to establish NFSv4 state whenever possible NFS: Try AUTH_UNIX when PUTROOTFH gets NFS4ERR_WRONGSEC NFS: Use static list of security flavors during root FH lookup recovery NFS: Avoid PUTROOTFH when managing leases NFS: Clean up nfs4_proc_get_rootfh NFS: Handle missing rpc.gssd when looking up root FH SUNRPC: Remove EXPORT_SYMBOL_GPL() from GSS mech switch SUNRPC: Make gss_mech_get() static SUNRPC: Refactor nfsd4_do_encode_secinfo() SUNRPC: Consider qop when looking up pseudoflavors SUNRPC: Load GSS kernel module by OID SUNRPC: Introduce rpcauth_get_pseudoflavor() SUNRPC: Define rpcsec_gss_info structure NFS: Remove unneeded forward declaration ...
Diffstat
-rw-r--r--fs/nfs/nfs4client.c4
-rw-r--r--fs/nfs/nfs4namespace.c43
-rw-r--r--fs/nfs/nfs4proc.c92
-rw-r--r--fs/nfs/nfs4state.c60
-rw-r--r--fs/nfs/nfs4super.c2
-rw-r--r--fs/nfs/nfs4xdr.c39
-rw-r--r--fs/nfs/super.c80
-rw-r--r--fs/nfsd/nfs4xdr.c24
-rw-r--r--include/linux/nfs_xdr.h24
-rw-r--r--include/linux/sunrpc/auth.h9
-rw-r--r--include/linux/sunrpc/gss_api.h30
-rw-r--r--net/sunrpc/Kconfig1
-rw-r--r--net/sunrpc/auth.c75
-rw-r--r--net/sunrpc/auth_gss/auth_gss.c3
-rw-r--r--net/sunrpc/auth_gss/gss_krb5_mech.c6
-rw-r--r--net/sunrpc/auth_gss/gss_mech_switch.c119
-rw-r--r--net/sunrpc/auth_gss/svcauth_gss.c4
17 files changed, 375 insertions, 240 deletions
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index f4d4d4ec6bf7..c2b069e25819 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -201,7 +201,9 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
201 if (clp->cl_minorversion != 0) 201 if (clp->cl_minorversion != 0)
202 __set_bit(NFS_CS_INFINITE_SLOTS, &clp->cl_flags); 202 __set_bit(NFS_CS_INFINITE_SLOTS, &clp->cl_flags);
203 __set_bit(NFS_CS_DISCRTRY, &clp->cl_flags); 203 __set_bit(NFS_CS_DISCRTRY, &clp->cl_flags);
204 error = nfs_create_rpc_client(clp, timeparms, authflavour); 204 error = nfs_create_rpc_client(clp, timeparms, RPC_AUTH_GSS_KRB5I);
205 if (error == -EINVAL)
206 error = nfs_create_rpc_client(clp, timeparms, RPC_AUTH_NULL);
205 if (error < 0) 207 if (error < 0)
206 goto error; 208 goto error;
207 209
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index 0dd766079e1c..cdb0b41a4810 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -134,33 +134,38 @@ static size_t nfs_parse_server_name(char *string, size_t len,
134 return ret; 134 return ret;
135} 135}
136 136
137/**
138 * nfs_find_best_sec - Find a security mechanism supported locally
139 * @flavors: List of security tuples returned by SECINFO procedure
140 *
141 * Return the pseudoflavor of the first security mechanism in
142 * "flavors" that is locally supported. Return RPC_AUTH_UNIX if
143 * no matching flavor is found in the array. The "flavors" array
144 * is searched in the order returned from the server, per RFC 3530
145 * recommendation.
146 */
137rpc_authflavor_t nfs_find_best_sec(struct nfs4_secinfo_flavors *flavors) 147rpc_authflavor_t nfs_find_best_sec(struct nfs4_secinfo_flavors *flavors)
138{ 148{
139 struct gss_api_mech *mech; 149 rpc_authflavor_t pseudoflavor;
140 struct xdr_netobj oid; 150 struct nfs4_secinfo4 *secinfo;
141 int i; 151 unsigned int i;
142 rpc_authflavor_t pseudoflavor = RPC_AUTH_UNIX;
143 152
144 for (i = 0; i < flavors->num_flavors; i++) { 153 for (i = 0; i < flavors->num_flavors; i++) {
145 struct nfs4_secinfo_flavor *flavor; 154 secinfo = &flavors->flavors[i];
146 flavor = &flavors->flavors[i]; 155
147 156 switch (secinfo->flavor) {
148 if (flavor->flavor == RPC_AUTH_NULL || flavor->flavor == RPC_AUTH_UNIX) { 157 case RPC_AUTH_NULL:
149 pseudoflavor = flavor->flavor; 158 case RPC_AUTH_UNIX:
150 break; 159 case RPC_AUTH_GSS:
151 } else if (flavor->flavor == RPC_AUTH_GSS) { 160 pseudoflavor = rpcauth_get_pseudoflavor(secinfo->flavor,
152 oid.len = flavor->gss.sec_oid4.len; 161 &secinfo->flavor_info);
153 oid.data = flavor->gss.sec_oid4.data; 162 if (pseudoflavor != RPC_AUTH_MAXFLAVOR)
154 mech = gss_mech_get_by_OID(&oid); 163 return pseudoflavor;
155 if (!mech)
156 continue;
157 pseudoflavor = gss_svc_to_pseudoflavor(mech, flavor->gss.service);
158 gss_mech_put(mech);
159 break; 164 break;
160 } 165 }
161 } 166 }
162 167
163 return pseudoflavor; 168 return RPC_AUTH_UNIX;
164} 169}
165 170
166static rpc_authflavor_t nfs4_negotiate_security(struct inode *inode, struct qstr *name) 171static rpc_authflavor_t nfs4_negotiate_security(struct inode *inode, struct qstr *name)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index e18b3b46c001..e13b7ccee98d 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2547,7 +2547,7 @@ static int nfs4_lookup_root_sec(struct nfs_server *server, struct nfs_fh *fhandl
2547 2547
2548 auth = rpcauth_create(flavor, server->client); 2548 auth = rpcauth_create(flavor, server->client);
2549 if (IS_ERR(auth)) { 2549 if (IS_ERR(auth)) {
2550 ret = -EIO; 2550 ret = -EACCES;
2551 goto out; 2551 goto out;
2552 } 2552 }
2553 ret = nfs4_lookup_root(server, fhandle, info); 2553 ret = nfs4_lookup_root(server, fhandle, info);
@@ -2555,27 +2555,36 @@ out:
2555 return ret; 2555 return ret;
2556} 2556}
2557 2557
2558/*
2559 * Retry pseudoroot lookup with various security flavors. We do this when:
2560 *
2561 * NFSv4.0: the PUTROOTFH operation returns NFS4ERR_WRONGSEC
2562 * NFSv4.1: the server does not support the SECINFO_NO_NAME operation
2563 *
2564 * Returns zero on success, or a negative NFS4ERR value, or a
2565 * negative errno value.
2566 */
2558static int nfs4_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle, 2567static int nfs4_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle,
2559 struct nfs_fsinfo *info) 2568 struct nfs_fsinfo *info)
2560{ 2569{
2561 int i, len, status = 0; 2570 /* Per 3530bis 15.33.5 */
2562 rpc_authflavor_t flav_array[NFS_MAX_SECFLAVORS]; 2571 static const rpc_authflavor_t flav_array[] = {
2563 2572 RPC_AUTH_GSS_KRB5P,
2564 len = rpcauth_list_flavors(flav_array, ARRAY_SIZE(flav_array)); 2573 RPC_AUTH_GSS_KRB5I,
2565 if (len < 0) 2574 RPC_AUTH_GSS_KRB5,
2566 return len; 2575 RPC_AUTH_UNIX, /* courtesy */
2567 2576 RPC_AUTH_NULL,
2568 for (i = 0; i < len; i++) { 2577 };
2569 /* AUTH_UNIX is the default flavor if none was specified, 2578 int status = -EPERM;
2570 * thus has already been tried. */ 2579 size_t i;
2571 if (flav_array[i] == RPC_AUTH_UNIX)
2572 continue;
2573 2580
2581 for (i = 0; i < ARRAY_SIZE(flav_array); i++) {
2574 status = nfs4_lookup_root_sec(server, fhandle, info, flav_array[i]); 2582 status = nfs4_lookup_root_sec(server, fhandle, info, flav_array[i]);
2575 if (status == -NFS4ERR_WRONGSEC || status == -EACCES) 2583 if (status == -NFS4ERR_WRONGSEC || status == -EACCES)
2576 continue; 2584 continue;
2577 break; 2585 break;
2578 } 2586 }
2587
2579 /* 2588 /*
2580 * -EACCESS could mean that the user doesn't have correct permissions 2589 * -EACCESS could mean that the user doesn't have correct permissions
2581 * to access the mount. It could also mean that we tried to mount 2590 * to access the mount. It could also mean that we tried to mount
@@ -2588,24 +2597,36 @@ static int nfs4_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle,
2588 return status; 2597 return status;
2589} 2598}
2590 2599
2591/* 2600static int nfs4_do_find_root_sec(struct nfs_server *server,
2592 * get the file handle for the "/" directory on the server 2601 struct nfs_fh *fhandle, struct nfs_fsinfo *info)
2602{
2603 int mv = server->nfs_client->cl_minorversion;
2604 return nfs_v4_minor_ops[mv]->find_root_sec(server, fhandle, info);
2605}
2606
2607/**
2608 * nfs4_proc_get_rootfh - get file handle for server's pseudoroot
2609 * @server: initialized nfs_server handle
2610 * @fhandle: we fill in the pseudo-fs root file handle
2611 * @info: we fill in an FSINFO struct
2612 *
2613 * Returns zero on success, or a negative errno.
2593 */ 2614 */
2594int nfs4_proc_get_rootfh(struct nfs_server *server, struct nfs_fh *fhandle, 2615int nfs4_proc_get_rootfh(struct nfs_server *server, struct nfs_fh *fhandle,
2595 struct nfs_fsinfo *info) 2616 struct nfs_fsinfo *info)
2596{ 2617{
2597 int minor_version = server->nfs_client->cl_minorversion; 2618 int status;
2598 int status = nfs4_lookup_root(server, fhandle, info); 2619
2599 if ((status == -NFS4ERR_WRONGSEC) && !(server->flags & NFS_MOUNT_SECFLAVOUR)) 2620 status = nfs4_lookup_root(server, fhandle, info);
2600 /* 2621 if ((status == -NFS4ERR_WRONGSEC) &&
2601 * A status of -NFS4ERR_WRONGSEC will be mapped to -EPERM 2622 !(server->flags & NFS_MOUNT_SECFLAVOUR))
2602 * by nfs4_map_errors() as this function exits. 2623 status = nfs4_do_find_root_sec(server, fhandle, info);
2603 */ 2624
2604 status = nfs_v4_minor_ops[minor_version]->find_root_sec(server, fhandle, info);
2605 if (status == 0) 2625 if (status == 0)
2606 status = nfs4_server_capabilities(server, fhandle); 2626 status = nfs4_server_capabilities(server, fhandle);
2607 if (status == 0) 2627 if (status == 0)
2608 status = nfs4_do_fsinfo(server, fhandle, info); 2628 status = nfs4_do_fsinfo(server, fhandle, info);
2629
2609 return nfs4_map_errors(status); 2630 return nfs4_map_errors(status);
2610} 2631}
2611 2632
@@ -3484,12 +3505,21 @@ static int _nfs4_do_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle,
3484static int nfs4_do_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsinfo *fsinfo) 3505static int nfs4_do_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsinfo *fsinfo)
3485{ 3506{
3486 struct nfs4_exception exception = { }; 3507 struct nfs4_exception exception = { };
3508 unsigned long now = jiffies;
3487 int err; 3509 int err;
3488 3510
3489 do { 3511 do {
3490 err = nfs4_handle_exception(server, 3512 err = _nfs4_do_fsinfo(server, fhandle, fsinfo);
3491 _nfs4_do_fsinfo(server, fhandle, fsinfo), 3513 if (err == 0) {
3492 &exception); 3514 struct nfs_client *clp = server->nfs_client;
3515
3516 spin_lock(&clp->cl_lock);
3517 clp->cl_lease_time = fsinfo->lease_time * HZ;
3518 clp->cl_last_renewal = now;
3519 spin_unlock(&clp->cl_lock);
3520 break;
3521 }
3522 err = nfs4_handle_exception(server, err, &exception);
3493 } while (exception.retry); 3523 } while (exception.retry);
3494 return err; 3524 return err;
3495} 3525}
@@ -4330,27 +4360,17 @@ int nfs4_proc_setclientid_confirm(struct nfs_client *clp,
4330 struct nfs4_setclientid_res *arg, 4360 struct nfs4_setclientid_res *arg,
4331 struct rpc_cred *cred) 4361 struct rpc_cred *cred)
4332{ 4362{
4333 struct nfs_fsinfo fsinfo;
4334 struct rpc_message msg = { 4363 struct rpc_message msg = {
4335 .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_SETCLIENTID_CONFIRM], 4364 .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_SETCLIENTID_CONFIRM],
4336 .rpc_argp = arg, 4365 .rpc_argp = arg,
4337 .rpc_resp = &fsinfo,
4338 .rpc_cred = cred, 4366 .rpc_cred = cred,
4339 }; 4367 };
4340 unsigned long now;
4341 int status; 4368 int status;
4342 4369
4343 dprintk("NFS call setclientid_confirm auth=%s, (client ID %llx)\n", 4370 dprintk("NFS call setclientid_confirm auth=%s, (client ID %llx)\n",
4344 clp->cl_rpcclient->cl_auth->au_ops->au_name, 4371 clp->cl_rpcclient->cl_auth->au_ops->au_name,
4345 clp->cl_clientid); 4372 clp->cl_clientid);
4346 now = jiffies;
4347 status = rpc_call_sync(clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT); 4373 status = rpc_call_sync(clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
4348 if (status == 0) {
4349 spin_lock(&clp->cl_lock);
4350 clp->cl_lease_time = fsinfo.lease_time * HZ;
4351 clp->cl_last_renewal = now;
4352 spin_unlock(&clp->cl_lock);
4353 }
4354 dprintk("NFS reply setclientid_confirm: %d\n", status); 4374 dprintk("NFS reply setclientid_confirm: %d\n", status);
4355 return status; 4375 return status;
4356} 4376}
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index b7796950eceb..7a74ea64bf54 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -154,18 +154,6 @@ struct rpc_cred *nfs4_get_machine_cred_locked(struct nfs_client *clp)
154 return cred; 154 return cred;
155} 155}
156 156
157static void nfs4_clear_machine_cred(struct nfs_client *clp)
158{
159 struct rpc_cred *cred;
160
161 spin_lock(&clp->cl_lock);
162 cred = clp->cl_machine_cred;
163 clp->cl_machine_cred = NULL;
164 spin_unlock(&clp->cl_lock);
165 if (cred != NULL)
166 put_rpccred(cred);
167}
168
169static struct rpc_cred * 157static struct rpc_cred *
170nfs4_get_renew_cred_server_locked(struct nfs_server *server) 158nfs4_get_renew_cred_server_locked(struct nfs_server *server)
171{ 159{
@@ -1776,10 +1764,6 @@ static int nfs4_handle_reclaim_lease_error(struct nfs_client *clp, int status)
1776 clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state); 1764 clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
1777 return -EPERM; 1765 return -EPERM;
1778 case -EACCES: 1766 case -EACCES:
1779 if (clp->cl_machine_cred == NULL)
1780 return -EACCES;
1781 /* Handle case where the user hasn't set up machine creds */
1782 nfs4_clear_machine_cred(clp);
1783 case -NFS4ERR_DELAY: 1767 case -NFS4ERR_DELAY:
1784 case -ETIMEDOUT: 1768 case -ETIMEDOUT:
1785 case -EAGAIN: 1769 case -EAGAIN:
@@ -1874,31 +1858,18 @@ int nfs4_discover_server_trunking(struct nfs_client *clp,
1874{ 1858{
1875 const struct nfs4_state_recovery_ops *ops = 1859 const struct nfs4_state_recovery_ops *ops =
1876 clp->cl_mvops->reboot_recovery_ops; 1860 clp->cl_mvops->reboot_recovery_ops;
1877 rpc_authflavor_t *flavors, flav, save;
1878 struct rpc_clnt *clnt; 1861 struct rpc_clnt *clnt;
1879 struct rpc_cred *cred; 1862 struct rpc_cred *cred;
1880 int i, len, status; 1863 int i, status;
1881 1864
1882 dprintk("NFS: %s: testing '%s'\n", __func__, clp->cl_hostname); 1865 dprintk("NFS: %s: testing '%s'\n", __func__, clp->cl_hostname);
1883 1866
1884 len = NFS_MAX_SECFLAVORS;
1885 flavors = kcalloc(len, sizeof(*flavors), GFP_KERNEL);
1886 if (flavors == NULL) {
1887 status = -ENOMEM;
1888 goto out;
1889 }
1890 len = rpcauth_list_flavors(flavors, len);
1891 if (len < 0) {
1892 status = len;
1893 goto out_free;
1894 }
1895 clnt = clp->cl_rpcclient; 1867 clnt = clp->cl_rpcclient;
1896 save = clnt->cl_auth->au_flavor;
1897 i = 0; 1868 i = 0;
1898 1869
1899 mutex_lock(&nfs_clid_init_mutex); 1870 mutex_lock(&nfs_clid_init_mutex);
1900 status = -ENOENT;
1901again: 1871again:
1872 status = -ENOENT;
1902 cred = ops->get_clid_cred(clp); 1873 cred = ops->get_clid_cred(clp);
1903 if (cred == NULL) 1874 if (cred == NULL)
1904 goto out_unlock; 1875 goto out_unlock;
@@ -1908,12 +1879,6 @@ again:
1908 switch (status) { 1879 switch (status) {
1909 case 0: 1880 case 0:
1910 break; 1881 break;
1911
1912 case -EACCES:
1913 if (clp->cl_machine_cred == NULL)
1914 break;
1915 /* Handle case where the user hasn't set up machine creds */
1916 nfs4_clear_machine_cred(clp);
1917 case -NFS4ERR_DELAY: 1882 case -NFS4ERR_DELAY:
1918 case -ETIMEDOUT: 1883 case -ETIMEDOUT:
1919 case -EAGAIN: 1884 case -EAGAIN:
@@ -1922,17 +1887,12 @@ again:
1922 dprintk("NFS: %s after status %d, retrying\n", 1887 dprintk("NFS: %s after status %d, retrying\n",
1923 __func__, status); 1888 __func__, status);
1924 goto again; 1889 goto again;
1925 1890 case -EACCES:
1891 if (i++)
1892 break;
1926 case -NFS4ERR_CLID_INUSE: 1893 case -NFS4ERR_CLID_INUSE:
1927 case -NFS4ERR_WRONGSEC: 1894 case -NFS4ERR_WRONGSEC:
1928 status = -EPERM; 1895 clnt = rpc_clone_client_set_auth(clnt, RPC_AUTH_UNIX);
1929 if (i >= len)
1930 break;
1931
1932 flav = flavors[i++];
1933 if (flav == save)
1934 flav = flavors[i++];
1935 clnt = rpc_clone_client_set_auth(clnt, flav);
1936 if (IS_ERR(clnt)) { 1896 if (IS_ERR(clnt)) {
1937 status = PTR_ERR(clnt); 1897 status = PTR_ERR(clnt);
1938 break; 1898 break;
@@ -1948,13 +1908,15 @@ again:
1948 case -NFS4ERR_NOT_SAME: /* FixMe: implement recovery 1908 case -NFS4ERR_NOT_SAME: /* FixMe: implement recovery
1949 * in nfs4_exchange_id */ 1909 * in nfs4_exchange_id */
1950 status = -EKEYEXPIRED; 1910 status = -EKEYEXPIRED;
1911 break;
1912 default:
1913 pr_warn("NFS: %s unhandled error %d. Exiting with error EIO\n",
1914 __func__, status);
1915 status = -EIO;
1951 } 1916 }
1952 1917
1953out_unlock: 1918out_unlock:
1954 mutex_unlock(&nfs_clid_init_mutex); 1919 mutex_unlock(&nfs_clid_init_mutex);
1955out_free:
1956 kfree(flavors);
1957out:
1958 dprintk("NFS: %s: status = %d\n", __func__, status); 1920 dprintk("NFS: %s: status = %d\n", __func__, status);
1959 return status; 1921 return status;
1960} 1922}
diff --git a/fs/nfs/nfs4super.c b/fs/nfs/nfs4super.c
index 569b166cc050..a5e1a3026d48 100644
--- a/fs/nfs/nfs4super.c
+++ b/fs/nfs/nfs4super.c
@@ -252,6 +252,8 @@ struct dentry *nfs4_try_mount(int flags, const char *dev_name,
252 252
253 dfprintk(MOUNT, "--> nfs4_try_mount()\n"); 253 dfprintk(MOUNT, "--> nfs4_try_mount()\n");
254 254
255 if (data->auth_flavors[0] == RPC_AUTH_MAXFLAVOR)
256 data->auth_flavors[0] = RPC_AUTH_UNIX;
255 export_path = data->nfs_server.export_path; 257 export_path = data->nfs_server.export_path;
256 data->nfs_server.export_path = "/"; 258 data->nfs_server.export_path = "/";
257 root_mnt = nfs_do_root_mount(&nfs4_remote_fs_type, flags, mount_info, 259 root_mnt = nfs_do_root_mount(&nfs4_remote_fs_type, flags, mount_info,
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index c2cbf0d90a31..3c79c5878c6d 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -530,14 +530,10 @@ static int nfs4_stat_to_errno(int);
530 decode_setclientid_maxsz) 530 decode_setclientid_maxsz)
531#define NFS4_enc_setclientid_confirm_sz \ 531#define NFS4_enc_setclientid_confirm_sz \
532 (compound_encode_hdr_maxsz + \ 532 (compound_encode_hdr_maxsz + \
533 encode_setclientid_confirm_maxsz + \ 533 encode_setclientid_confirm_maxsz)
534 encode_putrootfh_maxsz + \
535 encode_fsinfo_maxsz)
536#define NFS4_dec_setclientid_confirm_sz \ 534#define NFS4_dec_setclientid_confirm_sz \
537 (compound_decode_hdr_maxsz + \ 535 (compound_decode_hdr_maxsz + \
538 decode_setclientid_confirm_maxsz + \ 536 decode_setclientid_confirm_maxsz)
539 decode_putrootfh_maxsz + \
540 decode_fsinfo_maxsz)
541#define NFS4_enc_lock_sz (compound_encode_hdr_maxsz + \ 537#define NFS4_enc_lock_sz (compound_encode_hdr_maxsz + \
542 encode_sequence_maxsz + \ 538 encode_sequence_maxsz + \
543 encode_putfh_maxsz + \ 539 encode_putfh_maxsz + \
@@ -2601,12 +2597,9 @@ static void nfs4_xdr_enc_setclientid_confirm(struct rpc_rqst *req,
2601 struct compound_hdr hdr = { 2597 struct compound_hdr hdr = {
2602 .nops = 0, 2598 .nops = 0,
2603 }; 2599 };
2604 const u32 lease_bitmap[3] = { FATTR4_WORD0_LEASE_TIME };
2605 2600
2606 encode_compound_hdr(xdr, req, &hdr); 2601 encode_compound_hdr(xdr, req, &hdr);
2607 encode_setclientid_confirm(xdr, arg, &hdr); 2602 encode_setclientid_confirm(xdr, arg, &hdr);
2608 encode_putrootfh(xdr, &hdr);
2609 encode_fsinfo(xdr, lease_bitmap, &hdr);
2610 encode_nops(&hdr); 2603 encode_nops(&hdr);
2611} 2604}
2612 2605
@@ -5198,27 +5191,30 @@ static int decode_delegreturn(struct xdr_stream *xdr)
5198 return decode_op_hdr(xdr, OP_DELEGRETURN); 5191 return decode_op_hdr(xdr, OP_DELEGRETURN);
5199} 5192}
5200 5193
5201static int decode_secinfo_gss(struct xdr_stream *xdr, struct nfs4_secinfo_flavor *flavor) 5194static int decode_secinfo_gss(struct xdr_stream *xdr,
5195 struct nfs4_secinfo4 *flavor)
5202{ 5196{
5197 u32 oid_len;
5203 __be32 *p; 5198 __be32 *p;
5204 5199
5205 p = xdr_inline_decode(xdr, 4); 5200 p = xdr_inline_decode(xdr, 4);
5206 if (unlikely(!p)) 5201 if (unlikely(!p))
5207 goto out_overflow; 5202 goto out_overflow;
5208 flavor->gss.sec_oid4.len = be32_to_cpup(p); 5203 oid_len = be32_to_cpup(p);
5209 if (flavor->gss.sec_oid4.len > GSS_OID_MAX_LEN) 5204 if (oid_len > GSS_OID_MAX_LEN)
5210 goto out_err; 5205 goto out_err;
5211 5206
5212 p = xdr_inline_decode(xdr, flavor->gss.sec_oid4.len); 5207 p = xdr_inline_decode(xdr, oid_len);
5213 if (unlikely(!p)) 5208 if (unlikely(!p))
5214 goto out_overflow; 5209 goto out_overflow;
5215 memcpy(flavor->gss.sec_oid4.data, p, flavor->gss.sec_oid4.len); 5210 memcpy(flavor->flavor_info.oid.data, p, oid_len);
5211 flavor->flavor_info.oid.len = oid_len;
5216 5212
5217 p = xdr_inline_decode(xdr, 8); 5213 p = xdr_inline_decode(xdr, 8);
5218 if (unlikely(!p)) 5214 if (unlikely(!p))
5219 goto out_overflow; 5215 goto out_overflow;
5220 flavor->gss.qop4 = be32_to_cpup(p++); 5216 flavor->flavor_info.qop = be32_to_cpup(p++);
5221 flavor->gss.service = be32_to_cpup(p); 5217 flavor->flavor_info.service = be32_to_cpup(p);
5222 5218
5223 return 0; 5219 return 0;
5224 5220
@@ -5231,10 +5227,10 @@ out_err:
5231 5227
5232static int decode_secinfo_common(struct xdr_stream *xdr, struct nfs4_secinfo_res *res) 5228static int decode_secinfo_common(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
5233{ 5229{
5234 struct nfs4_secinfo_flavor *sec_flavor; 5230 struct nfs4_secinfo4 *sec_flavor;
5231 unsigned int i, num_flavors;
5235 int status; 5232 int status;
5236 __be32 *p; 5233 __be32 *p;
5237 int i, num_flavors;
5238 5234
5239 p = xdr_inline_decode(xdr, 4); 5235 p = xdr_inline_decode(xdr, 4);
5240 if (unlikely(!p)) 5236 if (unlikely(!p))
@@ -6637,8 +6633,7 @@ static int nfs4_xdr_dec_setclientid(struct rpc_rqst *req,
6637 * Decode SETCLIENTID_CONFIRM response 6633 * Decode SETCLIENTID_CONFIRM response
6638 */ 6634 */
6639static int nfs4_xdr_dec_setclientid_confirm(struct rpc_rqst *req, 6635static int nfs4_xdr_dec_setclientid_confirm(struct rpc_rqst *req,
6640 struct xdr_stream *xdr, 6636 struct xdr_stream *xdr)
6641 struct nfs_fsinfo *fsinfo)
6642{ 6637{
6643 struct compound_hdr hdr; 6638 struct compound_hdr hdr;
6644 int status; 6639 int status;
@@ -6646,10 +6641,6 @@ static int nfs4_xdr_dec_setclientid_confirm(struct rpc_rqst *req,
6646 status = decode_compound_hdr(xdr, &hdr); 6641 status = decode_compound_hdr(xdr, &hdr);
6647 if (!status) 6642 if (!status)
6648 status = decode_setclientid_confirm(xdr); 6643 status = decode_setclientid_confirm(xdr);
6649 if (!status)
6650 status = decode_putrootfh(xdr);
6651 if (!status)
6652 status = decode_fsinfo(xdr, fsinfo);
6653 return status; 6644 return status;
6654} 6645}
6655 6646
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 17b32b722457..3bb8318f6d0c 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -917,7 +917,7 @@ static struct nfs_parsed_mount_data *nfs_alloc_parsed_mount_data(void)
917 data->mount_server.port = NFS_UNSPEC_PORT; 917 data->mount_server.port = NFS_UNSPEC_PORT;
918 data->nfs_server.port = NFS_UNSPEC_PORT; 918 data->nfs_server.port = NFS_UNSPEC_PORT;
919 data->nfs_server.protocol = XPRT_TRANSPORT_TCP; 919 data->nfs_server.protocol = XPRT_TRANSPORT_TCP;
920 data->auth_flavors[0] = RPC_AUTH_UNIX; 920 data->auth_flavors[0] = RPC_AUTH_MAXFLAVOR;
921 data->auth_flavor_len = 1; 921 data->auth_flavor_len = 1;
922 data->minorversion = 0; 922 data->minorversion = 0;
923 data->need_mount = true; 923 data->need_mount = true;
@@ -1605,49 +1605,57 @@ out_security_failure:
1605} 1605}
1606 1606
1607/* 1607/*
1608 * Match the requested auth flavors with the list returned by 1608 * Select a security flavor for this mount. The selected flavor
1609 * the server. Returns zero and sets the mount's authentication 1609 * is planted in args->auth_flavors[0].
1610 * flavor on success; returns -EACCES if server does not support
1611 * the requested flavor.
1612 */ 1610 */
1613static int nfs_walk_authlist(struct nfs_parsed_mount_data *args, 1611static void nfs_select_flavor(struct nfs_parsed_mount_data *args,
1614 struct nfs_mount_request *request) 1612 struct nfs_mount_request *request)
1615{ 1613{
1616 unsigned int i, j, server_authlist_len = *(request->auth_flav_len); 1614 unsigned int i, count = *(request->auth_flav_len);
1615 rpc_authflavor_t flavor;
1616
1617 if (args->auth_flavors[0] != RPC_AUTH_MAXFLAVOR)
1618 goto out;
1619
1620 /*
1621 * The NFSv2 MNT operation does not return a flavor list.
1622 */
1623 if (args->mount_server.version != NFS_MNT3_VERSION)
1624 goto out_default;
1617 1625
1618 /* 1626 /*
1619 * Certain releases of Linux's mountd return an empty 1627 * Certain releases of Linux's mountd return an empty
1620 * flavor list. To prevent behavioral regression with 1628 * flavor list in some cases.
1621 * these servers (ie. rejecting mounts that used to
1622 * succeed), revert to pre-2.6.32 behavior (no checking)
1623 * if the returned flavor list is empty.
1624 */ 1629 */
1625 if (server_authlist_len == 0) 1630 if (count == 0)
1626 return 0; 1631 goto out_default;
1627 1632
1628 /* 1633 /*
1629 * We avoid sophisticated negotiating here, as there are
1630 * plenty of cases where we can get it wrong, providing
1631 * either too little or too much security.
1632 *
1633 * RFC 2623, section 2.7 suggests we SHOULD prefer the 1634 * RFC 2623, section 2.7 suggests we SHOULD prefer the
1634 * flavor listed first. However, some servers list 1635 * flavor listed first. However, some servers list
1635 * AUTH_NULL first. Our caller plants AUTH_SYS, the 1636 * AUTH_NULL first. Avoid ever choosing AUTH_NULL.
1636 * preferred default, in args->auth_flavors[0] if user
1637 * didn't specify sec= mount option.
1638 */ 1637 */
1639 for (i = 0; i < args->auth_flavor_len; i++) 1638 for (i = 0; i < count; i++) {
1640 for (j = 0; j < server_authlist_len; j++) 1639 struct rpcsec_gss_info info;
1641 if (args->auth_flavors[i] == request->auth_flavs[j]) { 1640
1642 dfprintk(MOUNT, "NFS: using auth flavor %d\n", 1641 flavor = request->auth_flavs[i];
1643 request->auth_flavs[j]); 1642 switch (flavor) {
1644 args->auth_flavors[0] = request->auth_flavs[j]; 1643 case RPC_AUTH_UNIX:
1645 return 0; 1644 goto out_set;
1646 } 1645 case RPC_AUTH_NULL:
1646 continue;
1647 default:
1648 if (rpcauth_get_gssinfo(flavor, &info) == 0)
1649 goto out_set;
1650 }
1651 }
1647 1652
1648 dfprintk(MOUNT, "NFS: server does not support requested auth flavor\n"); 1653out_default:
1649 nfs_umount(request); 1654 flavor = RPC_AUTH_UNIX;
1650 return -EACCES; 1655out_set:
1656 args->auth_flavors[0] = flavor;
1657out:
1658 dfprintk(MOUNT, "NFS: using auth flavor %d\n", args->auth_flavors[0]);
1651} 1659}
1652 1660
1653/* 1661/*
@@ -1710,12 +1718,8 @@ static int nfs_request_mount(struct nfs_parsed_mount_data *args,
1710 return status; 1718 return status;
1711 } 1719 }
1712 1720
1713 /* 1721 nfs_select_flavor(args, &request);
1714 * MNTv1 (NFSv2) does not support auth flavor negotiation. 1722 return 0;
1715 */
1716 if (args->mount_server.version != NFS_MNT3_VERSION)
1717 return 0;
1718 return nfs_walk_authlist(args, &request);
1719} 1723}
1720 1724
1721struct dentry *nfs_try_mount(int flags, const char *dev_name, 1725struct dentry *nfs_try_mount(int flags, const char *dev_name,
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 01168865dd37..2a2745615b42 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -3138,10 +3138,9 @@ nfsd4_encode_rename(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_
3138 3138
3139static __be32 3139static __be32
3140nfsd4_do_encode_secinfo(struct nfsd4_compoundres *resp, 3140nfsd4_do_encode_secinfo(struct nfsd4_compoundres *resp,
3141 __be32 nfserr,struct svc_export *exp) 3141 __be32 nfserr, struct svc_export *exp)
3142{ 3142{
3143 int i = 0; 3143 u32 i, nflavs;
3144 u32 nflavs;
3145 struct exp_flavor_info *flavs; 3144 struct exp_flavor_info *flavs;
3146 struct exp_flavor_info def_flavs[2]; 3145 struct exp_flavor_info def_flavs[2];
3147 __be32 *p; 3146 __be32 *p;
@@ -3172,30 +3171,29 @@ nfsd4_do_encode_secinfo(struct nfsd4_compoundres *resp,
3172 WRITE32(nflavs); 3171 WRITE32(nflavs);
3173 ADJUST_ARGS(); 3172 ADJUST_ARGS();
3174 for (i = 0; i < nflavs; i++) { 3173 for (i = 0; i < nflavs; i++) {
3175 u32 flav = flavs[i].pseudoflavor; 3174 struct rpcsec_gss_info info;
3176 struct gss_api_mech *gm = gss_mech_get_by_pseudoflavor(flav);
3177 3175
3178 if (gm) { 3176 if (rpcauth_get_gssinfo(flavs[i].pseudoflavor, &info) == 0) {
3179 RESERVE_SPACE(4); 3177 RESERVE_SPACE(4);
3180 WRITE32(RPC_AUTH_GSS); 3178 WRITE32(RPC_AUTH_GSS);
3181 ADJUST_ARGS(); 3179 ADJUST_ARGS();
3182 RESERVE_SPACE(4 + gm->gm_oid.len); 3180 RESERVE_SPACE(4 + info.oid.len);
3183 WRITE32(gm->gm_oid.len); 3181 WRITE32(info.oid.len);
3184 WRITEMEM(gm->gm_oid.data, gm->gm_oid.len); 3182 WRITEMEM(info.oid.data, info.oid.len);
3185 ADJUST_ARGS(); 3183 ADJUST_ARGS();
3186 RESERVE_SPACE(4); 3184 RESERVE_SPACE(4);
3187 WRITE32(0); /* qop */ 3185 WRITE32(info.qop);
3188 ADJUST_ARGS(); 3186 ADJUST_ARGS();
3189 RESERVE_SPACE(4); 3187 RESERVE_SPACE(4);
3190 WRITE32(gss_pseudoflavor_to_service(gm, flav)); 3188 WRITE32(info.service);
3191 ADJUST_ARGS(); 3189 ADJUST_ARGS();
3192 gss_mech_put(gm);
3193 } else { 3190 } else {
3194 RESERVE_SPACE(4); 3191 RESERVE_SPACE(4);
3195 WRITE32(flav); 3192 WRITE32(flavs[i].pseudoflavor);
3196 ADJUST_ARGS(); 3193 ADJUST_ARGS();
3197 } 3194 }
3198 } 3195 }
3196
3199out: 3197out:
3200 if (exp) 3198 if (exp)
3201 exp_put(exp); 3199 exp_put(exp);
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index bdc100f66dfb..766c5bc9d441 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -14,9 +14,6 @@
14#define NFS_DEF_FILE_IO_SIZE (4096U) 14#define NFS_DEF_FILE_IO_SIZE (4096U)
15#define NFS_MIN_FILE_IO_SIZE (1024U) 15#define NFS_MIN_FILE_IO_SIZE (1024U)
16 16
17/* Forward declaration for NFS v3 */
18struct nfs4_secinfo_flavors;
19
20struct nfs4_string { 17struct nfs4_string {
21 unsigned int len; 18 unsigned int len;
22 char *data; 19 char *data;
@@ -1053,25 +1050,14 @@ struct nfs4_fs_locations_res {
1053 struct nfs4_fs_locations *fs_locations; 1050 struct nfs4_fs_locations *fs_locations;
1054}; 1051};
1055 1052
1056struct nfs4_secinfo_oid { 1053struct nfs4_secinfo4 {
1057 unsigned int len; 1054 u32 flavor;
1058 char data[GSS_OID_MAX_LEN]; 1055 struct rpcsec_gss_info flavor_info;
1059};
1060
1061struct nfs4_secinfo_gss {
1062 struct nfs4_secinfo_oid sec_oid4;
1063 unsigned int qop4;
1064 unsigned int service;
1065};
1066
1067struct nfs4_secinfo_flavor {
1068 unsigned int flavor;
1069 struct nfs4_secinfo_gss gss;
1070}; 1056};
1071 1057
1072struct nfs4_secinfo_flavors { 1058struct nfs4_secinfo_flavors {
1073 unsigned int num_flavors; 1059 unsigned int num_flavors;
1074 struct nfs4_secinfo_flavor flavors[0]; 1060 struct nfs4_secinfo4 flavors[0];
1075}; 1061};
1076 1062
1077struct nfs4_secinfo_arg { 1063struct nfs4_secinfo_arg {
diff --git a/include/linux/sunrpc/auth.h b/include/linux/sunrpc/auth.h
index 58fda1c3c783..0dd00f4f6810 100644
--- a/include/linux/sunrpc/auth.h
+++ b/include/linux/sunrpc/auth.h
@@ -22,6 +22,8 @@
22/* size of the nodename buffer */ 22/* size of the nodename buffer */
23#define UNX_MAXNODENAME 32 23#define UNX_MAXNODENAME 32
24 24
25struct rpcsec_gss_info;
26
25/* Work around the lack of a VFS credential */ 27/* Work around the lack of a VFS credential */
26struct auth_cred { 28struct auth_cred {
27 kuid_t uid; 29 kuid_t uid;
@@ -103,6 +105,9 @@ struct rpc_authops {
103 int (*pipes_create)(struct rpc_auth *); 105 int (*pipes_create)(struct rpc_auth *);
104 void (*pipes_destroy)(struct rpc_auth *); 106 void (*pipes_destroy)(struct rpc_auth *);
105 int (*list_pseudoflavors)(rpc_authflavor_t *, int); 107 int (*list_pseudoflavors)(rpc_authflavor_t *, int);
108 rpc_authflavor_t (*info2flavor)(struct rpcsec_gss_info *);
109 int (*flavor2info)(rpc_authflavor_t,
110 struct rpcsec_gss_info *);
106}; 111};
107 112
108struct rpc_credops { 113struct rpc_credops {
@@ -137,6 +142,10 @@ int rpcauth_register(const struct rpc_authops *);
137int rpcauth_unregister(const struct rpc_authops *); 142int rpcauth_unregister(const struct rpc_authops *);
138struct rpc_auth * rpcauth_create(rpc_authflavor_t, struct rpc_clnt *); 143struct rpc_auth * rpcauth_create(rpc_authflavor_t, struct rpc_clnt *);
139void rpcauth_release(struct rpc_auth *); 144void rpcauth_release(struct rpc_auth *);
145rpc_authflavor_t rpcauth_get_pseudoflavor(rpc_authflavor_t,
146 struct rpcsec_gss_info *);
147int rpcauth_get_gssinfo(rpc_authflavor_t,
148 struct rpcsec_gss_info *);
140int rpcauth_list_flavors(rpc_authflavor_t *, int); 149int rpcauth_list_flavors(rpc_authflavor_t *, int);
141struct rpc_cred * rpcauth_lookup_credcache(struct rpc_auth *, struct auth_cred *, int); 150struct rpc_cred * rpcauth_lookup_credcache(struct rpc_auth *, struct auth_cred *, int);
142void rpcauth_init_cred(struct rpc_cred *, const struct auth_cred *, struct rpc_auth *, const struct rpc_credops *); 151void rpcauth_init_cred(struct rpc_cred *, const struct auth_cred *, struct rpc_auth *, const struct rpc_credops *);
diff --git a/include/linux/sunrpc/gss_api.h b/include/linux/sunrpc/gss_api.h
index a19e2547ae6a..f32b7a47e13f 100644
--- a/include/linux/sunrpc/gss_api.h
+++ b/include/linux/sunrpc/gss_api.h
@@ -25,10 +25,21 @@ struct gss_ctx {
25 25
26#define GSS_C_NO_BUFFER ((struct xdr_netobj) 0) 26#define GSS_C_NO_BUFFER ((struct xdr_netobj) 0)
27#define GSS_C_NO_CONTEXT ((struct gss_ctx *) 0) 27#define GSS_C_NO_CONTEXT ((struct gss_ctx *) 0)
28#define GSS_C_NULL_OID ((struct xdr_netobj) 0) 28#define GSS_C_QOP_DEFAULT (0)
29 29
30/*XXX arbitrary length - is this set somewhere? */ 30/*XXX arbitrary length - is this set somewhere? */
31#define GSS_OID_MAX_LEN 32 31#define GSS_OID_MAX_LEN 32
32struct rpcsec_gss_oid {
33 unsigned int len;
34 u8 data[GSS_OID_MAX_LEN];
35};
36
37/* From RFC 3530 */
38struct rpcsec_gss_info {
39 struct rpcsec_gss_oid oid;
40 u32 qop;
41 u32 service;
42};
32 43
33/* gss-api prototypes; note that these are somewhat simplified versions of 44/* gss-api prototypes; note that these are somewhat simplified versions of
34 * the prototypes specified in RFC 2744. */ 45 * the prototypes specified in RFC 2744. */
@@ -58,12 +69,14 @@ u32 gss_unwrap(
58u32 gss_delete_sec_context( 69u32 gss_delete_sec_context(
59 struct gss_ctx **ctx_id); 70 struct gss_ctx **ctx_id);
60 71
61u32 gss_svc_to_pseudoflavor(struct gss_api_mech *, u32 service); 72rpc_authflavor_t gss_svc_to_pseudoflavor(struct gss_api_mech *, u32 qop,
73 u32 service);
62u32 gss_pseudoflavor_to_service(struct gss_api_mech *, u32 pseudoflavor); 74u32 gss_pseudoflavor_to_service(struct gss_api_mech *, u32 pseudoflavor);
63char *gss_service_to_auth_domain_name(struct gss_api_mech *, u32 service); 75char *gss_service_to_auth_domain_name(struct gss_api_mech *, u32 service);
64 76
65struct pf_desc { 77struct pf_desc {
66 u32 pseudoflavor; 78 u32 pseudoflavor;
79 u32 qop;
67 u32 service; 80 u32 service;
68 char *name; 81 char *name;
69 char *auth_domain_name; 82 char *auth_domain_name;
@@ -76,7 +89,7 @@ struct pf_desc {
76struct gss_api_mech { 89struct gss_api_mech {
77 struct list_head gm_list; 90 struct list_head gm_list;
78 struct module *gm_owner; 91 struct module *gm_owner;
79 struct xdr_netobj gm_oid; 92 struct rpcsec_gss_oid gm_oid;
80 char *gm_name; 93 char *gm_name;
81 const struct gss_api_ops *gm_ops; 94 const struct gss_api_ops *gm_ops;
82 /* pseudoflavors supported by this mechanism: */ 95 /* pseudoflavors supported by this mechanism: */
@@ -117,9 +130,11 @@ struct gss_api_ops {
117int gss_mech_register(struct gss_api_mech *); 130int gss_mech_register(struct gss_api_mech *);
118void gss_mech_unregister(struct gss_api_mech *); 131void gss_mech_unregister(struct gss_api_mech *);
119 132
120/* returns a mechanism descriptor given an OID, and increments the mechanism's 133/* Given a GSS security tuple, look up a pseudoflavor */
121 * reference count. */ 134rpc_authflavor_t gss_mech_info2flavor(struct rpcsec_gss_info *);
122struct gss_api_mech * gss_mech_get_by_OID(struct xdr_netobj *); 135
136/* Given a pseudoflavor, look up a GSS security tuple */
137int gss_mech_flavor2info(rpc_authflavor_t, struct rpcsec_gss_info *);
123 138
124/* Returns a reference to a mechanism, given a name like "krb5" etc. */ 139/* Returns a reference to a mechanism, given a name like "krb5" etc. */
125struct gss_api_mech *gss_mech_get_by_name(const char *); 140struct gss_api_mech *gss_mech_get_by_name(const char *);
@@ -130,9 +145,6 @@ struct gss_api_mech *gss_mech_get_by_pseudoflavor(u32);
130/* Fill in an array with a list of supported pseudoflavors */ 145/* Fill in an array with a list of supported pseudoflavors */
131int gss_mech_list_pseudoflavors(rpc_authflavor_t *, int); 146int gss_mech_list_pseudoflavors(rpc_authflavor_t *, int);
132 147
133/* Just increments the mechanism's reference count and returns its input: */
134struct gss_api_mech * gss_mech_get(struct gss_api_mech *);
135
136/* For every successful gss_mech_get or gss_mech_get_by_* call there must be a 148/* For every successful gss_mech_get or gss_mech_get_by_* call there must be a
137 * corresponding call to gss_mech_put. */ 149 * corresponding call to gss_mech_put. */
138void gss_mech_put(struct gss_api_mech *); 150void gss_mech_put(struct gss_api_mech *);
diff --git a/net/sunrpc/Kconfig b/net/sunrpc/Kconfig
index 262caf03bd5f..241b54f30204 100644
--- a/net/sunrpc/Kconfig
+++ b/net/sunrpc/Kconfig
@@ -3,6 +3,7 @@ config SUNRPC
3 3
4config SUNRPC_GSS 4config SUNRPC_GSS
5 tristate 5 tristate
6 select OID_REGISTRY
6 7
7config SUNRPC_BACKCHANNEL 8config SUNRPC_BACKCHANNEL
8 bool 9 bool
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index f5294047df77..ed2fdd210c0b 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -82,7 +82,7 @@ MODULE_PARM_DESC(auth_hashtable_size, "RPC credential cache hashtable size");
82 82
83static u32 83static u32
84pseudoflavor_to_flavor(u32 flavor) { 84pseudoflavor_to_flavor(u32 flavor) {
85 if (flavor >= RPC_AUTH_MAXFLAVOR) 85 if (flavor > RPC_AUTH_MAXFLAVOR)
86 return RPC_AUTH_GSS; 86 return RPC_AUTH_GSS;
87 return flavor; 87 return flavor;
88} 88}
@@ -124,6 +124,79 @@ rpcauth_unregister(const struct rpc_authops *ops)
124EXPORT_SYMBOL_GPL(rpcauth_unregister); 124EXPORT_SYMBOL_GPL(rpcauth_unregister);
125 125
126/** 126/**
127 * rpcauth_get_pseudoflavor - check if security flavor is supported
128 * @flavor: a security flavor
129 * @info: a GSS mech OID, quality of protection, and service value
130 *
131 * Verifies that an appropriate kernel module is available or already loaded.
132 * Returns an equivalent pseudoflavor, or RPC_AUTH_MAXFLAVOR if "flavor" is
133 * not supported locally.
134 */
135rpc_authflavor_t
136rpcauth_get_pseudoflavor(rpc_authflavor_t flavor, struct rpcsec_gss_info *info)
137{
138 const struct rpc_authops *ops;
139 rpc_authflavor_t pseudoflavor;
140
141 ops = auth_flavors[flavor];
142 if (ops == NULL)
143 request_module("rpc-auth-%u", flavor);
144 spin_lock(&rpc_authflavor_lock);
145 ops = auth_flavors[flavor];
146 if (ops == NULL || !try_module_get(ops->owner)) {
147 spin_unlock(&rpc_authflavor_lock);
148 return RPC_AUTH_MAXFLAVOR;
149 }
150 spin_unlock(&rpc_authflavor_lock);
151
152 pseudoflavor = flavor;
153 if (ops->info2flavor != NULL)
154 pseudoflavor = ops->info2flavor(info);
155
156 module_put(ops->owner);
157 return pseudoflavor;
158}
159EXPORT_SYMBOL_GPL(rpcauth_get_pseudoflavor);
160
161/**
162 * rpcauth_get_gssinfo - find GSS tuple matching a GSS pseudoflavor
163 * @pseudoflavor: GSS pseudoflavor to match
164 * @info: rpcsec_gss_info structure to fill in
165 *
166 * Returns zero and fills in "info" if pseudoflavor matches a
167 * supported mechanism.
168 */
169int
170rpcauth_get_gssinfo(rpc_authflavor_t pseudoflavor, struct rpcsec_gss_info *info)
171{
172 rpc_authflavor_t flavor = pseudoflavor_to_flavor(pseudoflavor);
173 const struct rpc_authops *ops;
174 int result;
175
176 if (flavor >= RPC_AUTH_MAXFLAVOR)
177 return -EINVAL;
178
179 ops = auth_flavors[flavor];
180 if (ops == NULL)
181 request_module("rpc-auth-%u", flavor);
182 spin_lock(&rpc_authflavor_lock);
183 ops = auth_flavors[flavor];
184 if (ops == NULL || !try_module_get(ops->owner)) {
185 spin_unlock(&rpc_authflavor_lock);
186 return -ENOENT;
187 }
188 spin_unlock(&rpc_authflavor_lock);
189
190 result = -ENOENT;
191 if (ops->flavor2info != NULL)
192 result = ops->flavor2info(pseudoflavor, info);
193
194 module_put(ops->owner);
195 return result;
196}
197EXPORT_SYMBOL_GPL(rpcauth_get_gssinfo);
198
199/**
127 * rpcauth_list_flavors - discover registered flavors and pseudoflavors 200 * rpcauth_list_flavors - discover registered flavors and pseudoflavors
128 * @array: array to fill in 201 * @array: array to fill in
129 * @size: size of "array" 202 * @size: size of "array"
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 5257d2982ba5..51415b07174e 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1641,6 +1641,8 @@ static const struct rpc_authops authgss_ops = {
1641 .pipes_create = gss_pipes_dentries_create, 1641 .pipes_create = gss_pipes_dentries_create,
1642 .pipes_destroy = gss_pipes_dentries_destroy, 1642 .pipes_destroy = gss_pipes_dentries_destroy,
1643 .list_pseudoflavors = gss_mech_list_pseudoflavors, 1643 .list_pseudoflavors = gss_mech_list_pseudoflavors,
1644 .info2flavor = gss_mech_info2flavor,
1645 .flavor2info = gss_mech_flavor2info,
1644}; 1646};
1645 1647
1646static const struct rpc_credops gss_credops = { 1648static const struct rpc_credops gss_credops = {
@@ -1733,6 +1735,7 @@ static void __exit exit_rpcsec_gss(void)
1733 rcu_barrier(); /* Wait for completion of call_rcu()'s */ 1735 rcu_barrier(); /* Wait for completion of call_rcu()'s */
1734} 1736}
1735 1737
1738MODULE_ALIAS("rpc-auth-6");
1736MODULE_LICENSE("GPL"); 1739MODULE_LICENSE("GPL");
1737module_param_named(expired_cred_retry_delay, 1740module_param_named(expired_cred_retry_delay,
1738 gss_expired_cred_retry_delay, 1741 gss_expired_cred_retry_delay,
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index d3611f11a8df..33255ff889c0 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -729,16 +729,19 @@ static const struct gss_api_ops gss_kerberos_ops = {
729static struct pf_desc gss_kerberos_pfs[] = { 729static struct pf_desc gss_kerberos_pfs[] = {
730 [0] = { 730 [0] = {
731 .pseudoflavor = RPC_AUTH_GSS_KRB5, 731 .pseudoflavor = RPC_AUTH_GSS_KRB5,
732 .qop = GSS_C_QOP_DEFAULT,
732 .service = RPC_GSS_SVC_NONE, 733 .service = RPC_GSS_SVC_NONE,
733 .name = "krb5", 734 .name = "krb5",
734 }, 735 },
735 [1] = { 736 [1] = {
736 .pseudoflavor = RPC_AUTH_GSS_KRB5I, 737 .pseudoflavor = RPC_AUTH_GSS_KRB5I,
738 .qop = GSS_C_QOP_DEFAULT,
737 .service = RPC_GSS_SVC_INTEGRITY, 739 .service = RPC_GSS_SVC_INTEGRITY,
738 .name = "krb5i", 740 .name = "krb5i",
739 }, 741 },
740 [2] = { 742 [2] = {
741 .pseudoflavor = RPC_AUTH_GSS_KRB5P, 743 .pseudoflavor = RPC_AUTH_GSS_KRB5P,
744 .qop = GSS_C_QOP_DEFAULT,
742 .service = RPC_GSS_SVC_PRIVACY, 745 .service = RPC_GSS_SVC_PRIVACY,
743 .name = "krb5p", 746 .name = "krb5p",
744 }, 747 },
@@ -750,11 +753,12 @@ MODULE_ALIAS("rpc-auth-gss-krb5p");
750MODULE_ALIAS("rpc-auth-gss-390003"); 753MODULE_ALIAS("rpc-auth-gss-390003");
751MODULE_ALIAS("rpc-auth-gss-390004"); 754MODULE_ALIAS("rpc-auth-gss-390004");
752MODULE_ALIAS("rpc-auth-gss-390005"); 755MODULE_ALIAS("rpc-auth-gss-390005");
756MODULE_ALIAS("rpc-auth-gss-1.2.840.113554.1.2.2");
753 757
754static struct gss_api_mech gss_kerberos_mech = { 758static struct gss_api_mech gss_kerberos_mech = {
755 .gm_name = "krb5", 759 .gm_name = "krb5",
756 .gm_owner = THIS_MODULE, 760 .gm_owner = THIS_MODULE,
757 .gm_oid = {9, (void *)"\x2a\x86\x48\x86\xf7\x12\x01\x02\x02"}, 761 .gm_oid = { 9, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" },
758 .gm_ops = &gss_kerberos_ops, 762 .gm_ops = &gss_kerberos_ops,
759 .gm_pf_num = ARRAY_SIZE(gss_kerberos_pfs), 763 .gm_pf_num = ARRAY_SIZE(gss_kerberos_pfs),
760 .gm_pfs = gss_kerberos_pfs, 764 .gm_pfs = gss_kerberos_pfs,
diff --git a/net/sunrpc/auth_gss/gss_mech_switch.c b/net/sunrpc/auth_gss/gss_mech_switch.c
index f0f4eee63a35..79881d6e68a1 100644
--- a/net/sunrpc/auth_gss/gss_mech_switch.c
+++ b/net/sunrpc/auth_gss/gss_mech_switch.c
@@ -36,6 +36,7 @@
36#include <linux/types.h> 36#include <linux/types.h>
37#include <linux/slab.h> 37#include <linux/slab.h>
38#include <linux/module.h> 38#include <linux/module.h>
39#include <linux/oid_registry.h>
39#include <linux/sunrpc/msg_prot.h> 40#include <linux/sunrpc/msg_prot.h>
40#include <linux/sunrpc/gss_asn1.h> 41#include <linux/sunrpc/gss_asn1.h>
41#include <linux/sunrpc/auth_gss.h> 42#include <linux/sunrpc/auth_gss.h>
@@ -102,8 +103,13 @@ out:
102 return status; 103 return status;
103} 104}
104 105
105int 106/**
106gss_mech_register(struct gss_api_mech *gm) 107 * gss_mech_register - register a GSS mechanism
108 * @gm: GSS mechanism handle
109 *
110 * Returns zero if successful, or a negative errno.
111 */
112int gss_mech_register(struct gss_api_mech *gm)
107{ 113{
108 int status; 114 int status;
109 115
@@ -116,11 +122,14 @@ gss_mech_register(struct gss_api_mech *gm)
116 dprintk("RPC: registered gss mechanism %s\n", gm->gm_name); 122 dprintk("RPC: registered gss mechanism %s\n", gm->gm_name);
117 return 0; 123 return 0;
118} 124}
119
120EXPORT_SYMBOL_GPL(gss_mech_register); 125EXPORT_SYMBOL_GPL(gss_mech_register);
121 126
122void 127/**
123gss_mech_unregister(struct gss_api_mech *gm) 128 * gss_mech_unregister - release a GSS mechanism
129 * @gm: GSS mechanism handle
130 *
131 */
132void gss_mech_unregister(struct gss_api_mech *gm)
124{ 133{
125 spin_lock(&registered_mechs_lock); 134 spin_lock(&registered_mechs_lock);
126 list_del(&gm->gm_list); 135 list_del(&gm->gm_list);
@@ -128,18 +137,14 @@ gss_mech_unregister(struct gss_api_mech *gm)
128 dprintk("RPC: unregistered gss mechanism %s\n", gm->gm_name); 137 dprintk("RPC: unregistered gss mechanism %s\n", gm->gm_name);
129 gss_mech_free(gm); 138 gss_mech_free(gm);
130} 139}
131
132EXPORT_SYMBOL_GPL(gss_mech_unregister); 140EXPORT_SYMBOL_GPL(gss_mech_unregister);
133 141
134struct gss_api_mech * 142static struct gss_api_mech *gss_mech_get(struct gss_api_mech *gm)
135gss_mech_get(struct gss_api_mech *gm)
136{ 143{
137 __module_get(gm->gm_owner); 144 __module_get(gm->gm_owner);
138 return gm; 145 return gm;
139} 146}
140 147
141EXPORT_SYMBOL_GPL(gss_mech_get);
142
143static struct gss_api_mech * 148static struct gss_api_mech *
144_gss_mech_get_by_name(const char *name) 149_gss_mech_get_by_name(const char *name)
145{ 150{
@@ -169,12 +174,16 @@ struct gss_api_mech * gss_mech_get_by_name(const char *name)
169 } 174 }
170 return gm; 175 return gm;
171} 176}
172EXPORT_SYMBOL_GPL(gss_mech_get_by_name);
173 177
174struct gss_api_mech * 178static struct gss_api_mech *gss_mech_get_by_OID(struct rpcsec_gss_oid *obj)
175gss_mech_get_by_OID(struct xdr_netobj *obj)
176{ 179{
177 struct gss_api_mech *pos, *gm = NULL; 180 struct gss_api_mech *pos, *gm = NULL;
181 char buf[32];
182
183 if (sprint_oid(obj->data, obj->len, buf, sizeof(buf)) < 0)
184 return NULL;
185 dprintk("RPC: %s(%s)\n", __func__, buf);
186 request_module("rpc-auth-gss-%s", buf);
178 187
179 spin_lock(&registered_mechs_lock); 188 spin_lock(&registered_mechs_lock);
180 list_for_each_entry(pos, &registered_mechs, gm_list) { 189 list_for_each_entry(pos, &registered_mechs, gm_list) {
@@ -188,11 +197,8 @@ gss_mech_get_by_OID(struct xdr_netobj *obj)
188 } 197 }
189 spin_unlock(&registered_mechs_lock); 198 spin_unlock(&registered_mechs_lock);
190 return gm; 199 return gm;
191
192} 200}
193 201
194EXPORT_SYMBOL_GPL(gss_mech_get_by_OID);
195
196static inline int 202static inline int
197mech_supports_pseudoflavor(struct gss_api_mech *gm, u32 pseudoflavor) 203mech_supports_pseudoflavor(struct gss_api_mech *gm, u32 pseudoflavor)
198{ 204{
@@ -237,8 +243,6 @@ gss_mech_get_by_pseudoflavor(u32 pseudoflavor)
237 return gm; 243 return gm;
238} 244}
239 245
240EXPORT_SYMBOL_GPL(gss_mech_get_by_pseudoflavor);
241
242/** 246/**
243 * gss_mech_list_pseudoflavors - Discover registered GSS pseudoflavors 247 * gss_mech_list_pseudoflavors - Discover registered GSS pseudoflavors
244 * @array: array to fill in 248 * @array: array to fill in
@@ -268,19 +272,82 @@ int gss_mech_list_pseudoflavors(rpc_authflavor_t *array_ptr, int size)
268 return i; 272 return i;
269} 273}
270 274
271u32 275/**
272gss_svc_to_pseudoflavor(struct gss_api_mech *gm, u32 service) 276 * gss_svc_to_pseudoflavor - map a GSS service number to a pseudoflavor
277 * @gm: GSS mechanism handle
278 * @qop: GSS quality-of-protection value
279 * @service: GSS service value
280 *
281 * Returns a matching security flavor, or RPC_AUTH_MAXFLAVOR if none is found.
282 */
283rpc_authflavor_t gss_svc_to_pseudoflavor(struct gss_api_mech *gm, u32 qop,
284 u32 service)
273{ 285{
274 int i; 286 int i;
275 287
276 for (i = 0; i < gm->gm_pf_num; i++) { 288 for (i = 0; i < gm->gm_pf_num; i++) {
277 if (gm->gm_pfs[i].service == service) { 289 if (gm->gm_pfs[i].qop == qop &&
290 gm->gm_pfs[i].service == service) {
278 return gm->gm_pfs[i].pseudoflavor; 291 return gm->gm_pfs[i].pseudoflavor;
279 } 292 }
280 } 293 }
281 return RPC_AUTH_MAXFLAVOR; /* illegal value */ 294 return RPC_AUTH_MAXFLAVOR;
295}
296
297/**
298 * gss_mech_info2flavor - look up a pseudoflavor given a GSS tuple
299 * @info: a GSS mech OID, quality of protection, and service value
300 *
301 * Returns a matching pseudoflavor, or RPC_AUTH_MAXFLAVOR if the tuple is
302 * not supported.
303 */
304rpc_authflavor_t gss_mech_info2flavor(struct rpcsec_gss_info *info)
305{
306 rpc_authflavor_t pseudoflavor;
307 struct gss_api_mech *gm;
308
309 gm = gss_mech_get_by_OID(&info->oid);
310 if (gm == NULL)
311 return RPC_AUTH_MAXFLAVOR;
312
313 pseudoflavor = gss_svc_to_pseudoflavor(gm, info->qop, info->service);
314
315 gss_mech_put(gm);
316 return pseudoflavor;
317}
318
319/**
320 * gss_mech_flavor2info - look up a GSS tuple for a given pseudoflavor
321 * @pseudoflavor: GSS pseudoflavor to match
322 * @info: rpcsec_gss_info structure to fill in
323 *
324 * Returns zero and fills in "info" if pseudoflavor matches a
325 * supported mechanism. Otherwise a negative errno is returned.
326 */
327int gss_mech_flavor2info(rpc_authflavor_t pseudoflavor,
328 struct rpcsec_gss_info *info)
329{
330 struct gss_api_mech *gm;
331 int i;
332
333 gm = gss_mech_get_by_pseudoflavor(pseudoflavor);
334 if (gm == NULL)
335 return -ENOENT;
336
337 for (i = 0; i < gm->gm_pf_num; i++) {
338 if (gm->gm_pfs[i].pseudoflavor == pseudoflavor) {
339 memcpy(info->oid.data, gm->gm_oid.data, gm->gm_oid.len);
340 info->oid.len = gm->gm_oid.len;
341 info->qop = gm->gm_pfs[i].qop;
342 info->service = gm->gm_pfs[i].service;
343 gss_mech_put(gm);
344 return 0;
345 }
346 }
347
348 gss_mech_put(gm);
349 return -ENOENT;
282} 350}
283EXPORT_SYMBOL_GPL(gss_svc_to_pseudoflavor);
284 351
285u32 352u32
286gss_pseudoflavor_to_service(struct gss_api_mech *gm, u32 pseudoflavor) 353gss_pseudoflavor_to_service(struct gss_api_mech *gm, u32 pseudoflavor)
@@ -294,8 +361,6 @@ gss_pseudoflavor_to_service(struct gss_api_mech *gm, u32 pseudoflavor)
294 return 0; 361 return 0;
295} 362}
296 363
297EXPORT_SYMBOL_GPL(gss_pseudoflavor_to_service);
298
299char * 364char *
300gss_service_to_auth_domain_name(struct gss_api_mech *gm, u32 service) 365gss_service_to_auth_domain_name(struct gss_api_mech *gm, u32 service)
301{ 366{
@@ -308,8 +373,6 @@ gss_service_to_auth_domain_name(struct gss_api_mech *gm, u32 service)
308 return NULL; 373 return NULL;
309} 374}
310 375
311EXPORT_SYMBOL_GPL(gss_service_to_auth_domain_name);
312
313void 376void
314gss_mech_put(struct gss_api_mech * gm) 377gss_mech_put(struct gss_api_mech * gm)
315{ 378{
@@ -317,8 +380,6 @@ gss_mech_put(struct gss_api_mech * gm)
317 module_put(gm->gm_owner); 380 module_put(gm->gm_owner);
318} 381}
319 382
320EXPORT_SYMBOL_GPL(gss_mech_put);
321
322/* The mech could probably be determined from the token instead, but it's just 383/* The mech could probably be determined from the token instead, but it's just
323 * as easy for now to pass it in. */ 384 * as easy for now to pass it in. */
324int 385int
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index f7d34e7b6f81..74f6d30f5ded 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1216,7 +1216,9 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
1216 svcdata->rsci = rsci; 1216 svcdata->rsci = rsci;
1217 cache_get(&rsci->h); 1217 cache_get(&rsci->h);
1218 rqstp->rq_cred.cr_flavor = gss_svc_to_pseudoflavor( 1218 rqstp->rq_cred.cr_flavor = gss_svc_to_pseudoflavor(
1219 rsci->mechctx->mech_type, gc->gc_svc); 1219 rsci->mechctx->mech_type,
1220 GSS_C_QOP_DEFAULT,
1221 gc->gc_svc);
1220 ret = SVC_OK; 1222 ret = SVC_OK;
1221 goto out; 1223 goto out;
1222 } 1224 }
generated by cgit v1.2.2 (git 2.25.0) at 2025-01-27 20:24:55 -0500