lustre/sec/sec.c

   1 /* -*- mode: c; c-basic-offset: 8; indent-tabs-mode: nil; -*-
   2  * vim:expandtab:shiftwidth=8:tabstop=8:
   3  *
   4  * Copyright (C) 2004 Cluster File Systems, Inc.
   5  *
   6  *   This file is part of Lustre, http://www.lustre.org.
   7  *
   8  *   Lustre is free software; you can redistribute it and/or
   9  *   modify it under the terms of version 2 of the GNU General Public
  10  *   License as published by the Free Software Foundation.
  11  *
  12  *   Lustre is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *   GNU General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU General Public License
  18  *   along with Lustre; if not, write to the Free Software
  19  *   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20  */
  21
  22 #ifndef EXPORT_SYMTAB
  23 # define EXPORT_SYMTAB
  24 #endif
  25 #define DEBUG_SUBSYSTEM S_SEC
  26 #ifdef __KERNEL__
  27 #include <linux/init.h>
  28 #include <linux/module.h>
  29 #include <linux/slab.h>
  30 #else
  31 #include <liblustre.h>
  32 #endif
  33
  34 #include <libcfs/kp30.h>
  35 #include <linux/obd.h>
  36 #include <linux/obd_class.h>
  37 #include <linux/obd_support.h>
  38 #include <linux/lustre_net.h>
  39 #include <linux/lustre_import.h>
  40 #include <linux/lustre_dlm.h>
  41 #include <linux/lustre_sec.h>
  42
  43 static spinlock_t sectypes_lock = SPIN_LOCK_UNLOCKED;
  44 static struct ptlrpc_sec_type *sectypes[PTLRPCS_FLVR_MAJOR_MAX] = {
  45         NULL,
  46 };
  47
  48 int ptlrpcs_register(struct ptlrpc_sec_type *type)
  49 {
  50         __u32 flavor = type->pst_flavor;
  51
  52         LASSERT(type->pst_name);
  53         LASSERT(type->pst_ops);
  54
  55         if (flavor >= PTLRPCS_FLVR_MAJOR_MAX)
  56                 return -EINVAL;
  57
  58         spin_lock(&sectypes_lock);
  59         if (sectypes[flavor]) {
  60                 spin_unlock(&sectypes_lock);
  61                 return -EALREADY;
  62         }
  63         sectypes[flavor] = type;
  64         atomic_set(&type->pst_inst, 0);
  65         spin_unlock(&sectypes_lock);
  66
  67         CDEBUG(D_SEC, "%s: registered\n", type->pst_name);
  68         return 0;
  69 }
  70
  71 int ptlrpcs_unregister(struct ptlrpc_sec_type *type)
  72 {
  73         __u32 major = type->pst_flavor;
  74
  75         LASSERT(major < PTLRPCS_FLVR_MAJOR_MAX);
  76
  77         spin_lock(&sectypes_lock);
  78         if (!sectypes[major]) {
  79                 spin_unlock(&sectypes_lock);
  80                 CERROR("%s: already unregistered?\n", type->pst_name);
  81                 return -EINVAL;
  82         }
  83
  84         LASSERT(sectypes[major] == type);
  85
  86         if (atomic_read(&type->pst_inst)) {
  87                 CERROR("%s: still have %d instances\n",
  88                        type->pst_name, atomic_read(&type->pst_inst));
  89                 spin_unlock(&sectypes_lock);
  90                 return -EINVAL;
  91         }
  92
  93         sectypes[major] = NULL;
  94         spin_unlock(&sectypes_lock);
  95
  96         CDEBUG(D_SEC, "%s: unregistered\n", type->pst_name);
  97         return 0;
  98 }
  99
 100 static
 101 struct ptlrpc_sec_type * ptlrpcs_flavor2type(__u32 flavor)
 102 {
 103         struct ptlrpc_sec_type *type;
 104         __u32 major = SEC_FLAVOR_MAJOR(flavor);
 105
 106         if (major >= PTLRPCS_FLVR_MAJOR_MAX)
 107                 return NULL;
 108
 109         spin_lock(&sectypes_lock);
 110         type = sectypes[major];
 111         if (type && !try_module_get(type->pst_owner))
 112                 type = NULL;
 113         spin_unlock(&sectypes_lock);
 114         return type;
 115 }
 116
 117 static inline
 118 void ptlrpcs_type_put(struct ptlrpc_sec_type *type)
 119 {
 120         module_put(type->pst_owner);
 121 }
 122
 123 __u32 ptlrpcs_name2flavor(const char *name)
 124 {
 125         if (!strcmp(name, "null"))
 126                 return PTLRPCS_FLVR_NULL;
 127         if (!strcmp(name, "krb5"))
 128                 return PTLRPCS_FLVR_KRB5;
 129         if (!strcmp(name, "krb5i"))
 130                 return PTLRPCS_FLVR_KRB5I;
 131         if (!strcmp(name, "krb5p"))
 132                 return PTLRPCS_FLVR_KRB5P;
 133
 134         return PTLRPCS_FLVR_INVALID;
 135 }
 136
 137 char *ptlrpcs_flavor2name(__u32 flavor)
 138 {
 139         switch (flavor) {
 140         case PTLRPCS_FLVR_NULL:
 141                 return "null";
 142         case PTLRPCS_FLVR_KRB5:
 143                 return "krb5";
 144         case PTLRPCS_FLVR_KRB5I:
 145                 return "krb5i";
 146         case PTLRPCS_FLVR_KRB5P:
 147                 return "krb5p";
 148         default:
 149                 CERROR("invalid flavor 0x%x\n", flavor);
 150         }
 151         return "unknown";
 152 }
 153
 154 /***********************************************
 155  * credential cache helpers                    *
 156  ***********************************************/
 157
 158 void ptlrpcs_init_credcache(struct ptlrpc_sec *sec)
 159 {
 160         int i;
 161         for (i = 0; i < PTLRPC_CREDCACHE_NR; i++)
 162                 INIT_LIST_HEAD(&sec->ps_credcache[i]);
 163
 164         /* ps_nextgc == 0 means never do gc */
 165         if (sec->ps_nextgc)
 166                 sec->ps_nextgc = get_seconds() + (sec->ps_expire >> 1);
 167 }
 168
 169 /*
 170  * return 1 means we should also destroy the sec structure.
 171  * normally return 0
 172  */
 173 static int ptlrpcs_cred_destroy(struct ptlrpc_cred *cred)
 174 {
 175         struct ptlrpc_sec *sec = cred->pc_sec;
 176         int rc = 0;
 177
 178         LASSERT(cred->pc_sec);
 179         LASSERT(atomic_read(&cred->pc_refcount) == 0);
 180         LASSERT(list_empty(&cred->pc_hash));
 181
 182         cred->pc_ops->destroy(cred);
 183
 184         /* spinlock to protect against ptlrpcs_sec_put() */
 185         LASSERT(atomic_read(&sec->ps_credcount));
 186         spin_lock(&sec->ps_lock);
 187         if (atomic_dec_and_test(&sec->ps_credcount) &&
 188             !atomic_read(&sec->ps_refcount))
 189                 rc = 1;
 190         spin_unlock(&sec->ps_lock);
 191         return rc;
 192 }
 193
 194 static void ptlrpcs_destroy_credlist(struct list_head *head)
 195 {
 196         struct ptlrpc_cred *cred;
 197
 198         while (!list_empty(head)) {
 199                 cred = list_entry(head->next, struct ptlrpc_cred, pc_hash);
 200                 list_del_init(&cred->pc_hash);
 201                 ptlrpcs_cred_destroy(cred);
 202         }
 203 }
 204
 205 static
 206 int cred_check_dead(struct ptlrpc_cred *cred,
 207                     struct list_head *freelist, int removal)
 208 {
 209         /* here we do the exact thing as asked. but an alternative
 210          * way is remove dead entries immediately without be asked
 211          * remove, since dead entry will not lead to further rpcs.
 212          */
 213         if (unlikely(ptlrpcs_cred_is_dead(cred))) {
 214                 /* don't try to destroy a busy entry */
 215                 if (atomic_read(&cred->pc_refcount))
 216                         return 1;
 217                 goto out;
 218         }
 219
 220         /* a busy non-dead entry is considered as "good" one.
 221          * Note in a very busy client where cred always busy, we
 222          * will not be able to find the expire here, but some other
 223          * part will, e.g. checking during refresh, or got error
 224          * notification from server, etc. We don't touch busy cred
 225          * here is because a busy cred's flag might be changed at
 226          * anytime by the owner, we don't want to compete with them.
 227          */
 228         if (atomic_read(&cred->pc_refcount) != 0)
 229                 return 0;
 230
 231         /* expire is 0 means never expire. a newly created gss cred
 232          * which during upcall also has 0 expiration
 233          */
 234         if (cred->pc_expire == 0)
 235                 return 0;
 236
 237         /* check real expiration */
 238         if (time_after(cred->pc_expire, get_seconds()))
 239                 return 0;
 240
 241         /* although we'v checked the bit right above, there's still
 242          * possibility that somebody else set the bit elsewhere.
 243          */
 244         ptlrpcs_cred_expire(cred);
 245
 246 out:
 247         if (removal) {
 248                 LASSERT(atomic_read(&cred->pc_refcount) >= 0);
 249                 LASSERT(cred->pc_sec);
 250                 LASSERT(spin_is_locked(&cred->pc_sec->ps_lock));
 251                 LASSERT(freelist);
 252
 253                 list_move(&cred->pc_hash, freelist);
 254         }
 255         return 1;
 256 }
 257
 258 static
 259 void ptlrpcs_credcache_gc(struct ptlrpc_sec *sec,
 260                           struct list_head *freelist)
 261 {
 262         struct ptlrpc_cred *cred, *n;
 263         int i;
 264         ENTRY;
 265
 266         CDEBUG(D_SEC, "do gc on sec %s\n", sec->ps_type->pst_name);
 267         for (i = 0; i < PTLRPC_CREDCACHE_NR; i++) {
 268                 list_for_each_entry_safe(cred, n, &sec->ps_credcache[i],
 269                                          pc_hash)
 270                         cred_check_dead(cred, freelist, 1);
 271         }
 272         sec->ps_nextgc = get_seconds() + sec->ps_expire;
 273         EXIT;
 274 }
 275
 276 /*
 277  * @uid: which user. "-1" means flush all.
 278  * @grace: mark cred DEAD, allow graceful destroy like notify
 279  *         server side, etc.
 280  * @force: flush all entries, otherwise only free ones be flushed.
 281  */
 282 static
 283 int flush_credcache(struct ptlrpc_sec *sec, uid_t uid,
 284                     int grace, int force)
 285 {
 286         struct ptlrpc_cred *cred, *n;
 287         LIST_HEAD(freelist);
 288         int i, busy = 0;
 289         ENTRY;
 290
 291         might_sleep_if(grace);
 292
 293         spin_lock(&sec->ps_lock);
 294         for (i = 0; i < PTLRPC_CREDCACHE_NR; i++) {
 295                 list_for_each_entry_safe(cred, n, &sec->ps_credcache[i],
 296                                          pc_hash) {
 297                         LASSERT(atomic_read(&cred->pc_refcount) >= 0);
 298
 299                         if (uid != -1 && uid != cred->pc_uid)
 300                                 continue;
 301                         if (atomic_read(&cred->pc_refcount)) {
 302                                 busy = 1;
 303                                 if (!force)
 304                                         continue;
 305                                 list_del_init(&cred->pc_hash);
 306                                 CDEBUG(D_SEC, "sec %p: flush busy(%d) cred %p "
 307                                        "by force\n", sec,
 308                                        atomic_read(&cred->pc_refcount), cred);
 309                         } else
 310                                 list_move(&cred->pc_hash, &freelist);
 311
 312                         set_bit(PTLRPC_CRED_DEAD_BIT, &cred->pc_flags);
 313                         if (!grace)
 314                                 clear_bit(PTLRPC_CRED_UPTODATE_BIT,
 315                                           &cred->pc_flags);
 316                 }
 317         }
 318         spin_unlock(&sec->ps_lock);
 319
 320         ptlrpcs_destroy_credlist(&freelist);
 321         RETURN(busy);
 322 }
 323
 324 /**************************************************
 325  * credential APIs                                *
 326  **************************************************/
 327
 328 static inline
 329 int ptlrpcs_cred_get_hash(__u64 pag)
 330 {
 331         LASSERT((pag & PTLRPC_CREDCACHE_MASK) < PTLRPC_CREDCACHE_NR);
 332         return (pag & PTLRPC_CREDCACHE_MASK);
 333 }
 334
 335 /*
 336  * return an uptodate or newly created cred entry.
 337  */
 338 static
 339 struct ptlrpc_cred * cred_cache_lookup(struct ptlrpc_sec *sec,
 340                                        struct vfs_cred *vcred,
 341                                        int create, int remove_dead)
 342 {
 343         struct ptlrpc_cred *cred, *new = NULL, *n;
 344         LIST_HEAD(freelist);
 345         int hash, found = 0;
 346         ENTRY;
 347
 348         might_sleep();
 349
 350         hash = ptlrpcs_cred_get_hash(vcred->vc_pag);
 351
 352 retry:
 353         spin_lock(&sec->ps_lock);
 354
 355         /* do gc if expired */
 356         if (remove_dead &&
 357             sec->ps_nextgc && time_after(get_seconds(), sec->ps_nextgc))
 358                 ptlrpcs_credcache_gc(sec, &freelist);
 359
 360         list_for_each_entry_safe(cred, n, &sec->ps_credcache[hash], pc_hash) {
 361                 if (cred_check_dead(cred, &freelist, remove_dead))
 362                         continue;
 363                 if (cred->pc_ops->match(cred, vcred)) {
 364                         found = 1;
 365                         break;
 366                 }
 367         }
 368
 369         if (found) {
 370                 if (new && new != cred) {
 371                         /* lost the race, just free it */
 372                         list_add(&new->pc_hash, &freelist);
 373                 }
 374                 list_move(&cred->pc_hash, &sec->ps_credcache[hash]);
 375         } else {
 376                 if (new) {
 377                         list_add(&new->pc_hash, &sec->ps_credcache[hash]);
 378                         cred = new;
 379                 } else if (create) {
 380                         spin_unlock(&sec->ps_lock);
 381                         new = sec->ps_type->pst_ops->create_cred(sec, vcred);
 382                         if (new) {
 383                                 atomic_inc(&sec->ps_credcount);
 384                                 goto retry;
 385                         }
 386                 } else
 387                         cred = NULL;
 388         }
 389
 390         /* hold a ref */
 391         if (cred)
 392                 atomic_inc(&cred->pc_refcount);
 393
 394         spin_unlock(&sec->ps_lock);
 395
 396         ptlrpcs_destroy_credlist(&freelist);
 397         RETURN(cred);
 398 }
 399
 400 struct ptlrpc_cred * ptlrpcs_cred_lookup(struct ptlrpc_sec *sec,
 401                                          struct vfs_cred *vcred)
 402 {
 403         struct ptlrpc_cred *cred;
 404         ENTRY;
 405
 406         cred = cred_cache_lookup(sec, vcred, 0, 1);
 407         RETURN(cred);
 408 }
 409
 410 static struct ptlrpc_cred *get_cred(struct ptlrpc_sec *sec)
 411 {
 412         struct vfs_cred vcred;
 413
 414         LASSERT(sec);
 415         /* XXX
 416          * for now we simply let PAG == real uid
 417          */
 418         if (sec->ps_flags & (PTLRPC_SEC_FL_MDS | PTLRPC_SEC_FL_REVERSE)) {
 419                 vcred.vc_pag = 0;
 420                 vcred.vc_uid = 0;
 421         } else {
 422                 vcred.vc_pag = (__u64) current->uid;
 423                 vcred.vc_uid = current->uid;
 424         }
 425
 426         return cred_cache_lookup(sec, &vcred, 1, 1);
 427 }
 428
 429 int ptlrpcs_req_get_cred(struct ptlrpc_request *req)
 430 {
 431         struct obd_import *imp = req->rq_import;
 432         ENTRY;
 433
 434         LASSERT(!req->rq_cred);
 435         LASSERT(imp);
 436
 437         req->rq_cred = get_cred(imp->imp_sec);
 438
 439         if (!req->rq_cred) {
 440                 CERROR("req %p: fail to get cred from cache\n", req);
 441                 RETURN(-ENOMEM);
 442         }
 443
 444         RETURN(0);
 445 }
 446
 447 /*
 448  * check whether current user have valid credential for an import or not.
 449  * might repeatedly try in case of non-fatal errors.
 450  * return 0 on success, 1 on failure
 451  */
 452 int ptlrpcs_check_cred(struct obd_import *imp)
 453 {
 454         struct ptlrpc_cred *cred;
 455         ENTRY;
 456
 457         might_sleep();
 458 again:
 459         cred = get_cred(imp->imp_sec);
 460         if (!cred)
 461                 RETURN(0);
 462
 463         if (ptlrpcs_cred_is_uptodate(cred)) {
 464                 /* get_cred() has done expire checking, so we don't
 465                  * expect it could expire so quickly, and actually
 466                  * we don't care.
 467                  */
 468                 ptlrpcs_cred_put(cred, 1);
 469                 RETURN(0);
 470         }
 471
 472         ptlrpcs_cred_refresh(cred);
 473         if (ptlrpcs_cred_is_uptodate(cred)) {
 474                 ptlrpcs_cred_put(cred, 1);
 475                 RETURN(0);
 476         }
 477
 478         if (cred->pc_flags & PTLRPC_CRED_ERROR ||
 479             !imp->imp_replayable) {
 480                 ptlrpcs_cred_put(cred, 1);
 481                 RETURN(1);
 482         }
 483
 484         ptlrpcs_cred_put(cred, 1);
 485
 486         if (signal_pending(current)) {
 487                 CWARN("%s: interrupted\n", current->comm);
 488                 RETURN(1);
 489         }
 490         goto again;
 491 }
 492
 493 static void ptlrpcs_sec_destroy(struct ptlrpc_sec *sec);
 494
 495 void ptlrpcs_cred_put(struct ptlrpc_cred *cred, int sync)
 496 {
 497         struct ptlrpc_sec *sec = cred->pc_sec;
 498
 499         LASSERT(sec);
 500         LASSERT(atomic_read(&cred->pc_refcount));
 501
 502         spin_lock(&sec->ps_lock);
 503
 504         /* this has to be protected by ps_lock, because cred cache
 505          * management code might increase ref against a 0-refed cred.
 506          */
 507         if (!atomic_dec_and_test(&cred->pc_refcount)) {
 508                 spin_unlock(&sec->ps_lock);
 509                 return;
 510         }
 511
 512         /* if sec already unused, we have to destroy the cred (prevent it
 513          * hanging there for ever)
 514          */
 515         if (atomic_read(&sec->ps_refcount) == 0) {
 516                 if (!test_and_set_bit(PTLRPC_CRED_DEAD_BIT, &cred->pc_flags))
 517                         CWARN("cred %p: force expire on a unused sec\n", cred);
 518                 list_del_init(&cred->pc_hash);
 519         } else if (unlikely(sync && ptlrpcs_cred_is_dead(cred)))
 520                 list_del_init(&cred->pc_hash);
 521
 522         if (!list_empty(&cred->pc_hash)) {
 523                 spin_unlock(&sec->ps_lock);
 524                 return;
 525         }
 526
 527         /* if required async, and we reached here, we have to clear
 528          * the UPTODATE bit, thus no rpc is needed in destroy procedure.
 529          */
 530         if (!sync)
 531                 clear_bit(PTLRPC_CRED_UPTODATE_BIT, &cred->pc_flags);
 532
 533         spin_unlock(&sec->ps_lock);
 534
 535         /* destroy this cred */
 536         if (!ptlrpcs_cred_destroy(cred))
 537                 return;
 538
 539         LASSERT(!atomic_read(&sec->ps_credcount));
 540         LASSERT(!atomic_read(&sec->ps_refcount));
 541
 542         CWARN("sec %p(%s), put last cred, also destroy the sec\n",
 543               sec, sec->ps_type->pst_name);
 544 }
 545
 546 void ptlrpcs_req_drop_cred(struct ptlrpc_request *req)
 547 {
 548         ENTRY;
 549
 550         LASSERT(req);
 551         LASSERT(req->rq_cred);
 552
 553         if (req->rq_cred) {
 554                 /* this could be called with spinlock hold, use async mode */
 555                 ptlrpcs_cred_put(req->rq_cred, 0);
 556                 req->rq_cred = NULL;
 557         } else
 558                 CDEBUG(D_SEC, "req %p have no cred\n", req);
 559         EXIT;
 560 }
 561
 562 /*
 563  * request must have a cred. if failed to get new cred,
 564  * just restore the old one
 565  */
 566 int ptlrpcs_req_replace_dead_cred(struct ptlrpc_request *req)
 567 {
 568         struct ptlrpc_cred *cred = req->rq_cred;
 569         int rc;
 570         ENTRY;
 571
 572         LASSERT(cred);
 573         LASSERT(test_bit(PTLRPC_CRED_DEAD_BIT, &cred->pc_flags));
 574
 575         ptlrpcs_cred_get(cred);
 576         ptlrpcs_req_drop_cred(req);
 577         LASSERT(!req->rq_cred);
 578         rc = ptlrpcs_req_get_cred(req);
 579         if (!rc) {
 580                 LASSERT(req->rq_cred);
 581                 LASSERT(req->rq_cred != cred);
 582                 ptlrpcs_cred_put(cred, 1);
 583         } else {
 584                 LASSERT(!req->rq_cred);
 585                 req->rq_cred = cred;
 586         }
 587         RETURN(rc);
 588 }
 589
 590 /*
 591  * since there's no lock on the cred, its status could be changed
 592  * by other threads at any time, we allow this race. If an uptodate
 593  * cred turn to dead quickly under us, we don't know and continue
 594  * using it, that's fine. if necessary the later error handling code
 595  * will catch it.
 596  */
 597 int ptlrpcs_req_refresh_cred(struct ptlrpc_request *req)
 598 {
 599         struct ptlrpc_cred *cred = req->rq_cred;
 600         ENTRY;
 601
 602         LASSERT(cred);
 603
 604         if (!ptlrpcs_cred_check_uptodate(cred))
 605                 RETURN(0);
 606
 607         if (test_bit(PTLRPC_CRED_ERROR_BIT, &cred->pc_flags)) {
 608                 req->rq_ptlrpcs_err = 1;
 609                 RETURN(-EPERM);
 610         }
 611
 612         if (test_bit(PTLRPC_CRED_DEAD_BIT, &cred->pc_flags)) {
 613                 if (ptlrpcs_req_replace_dead_cred(req) == 0) {
 614                         LASSERT(cred != req->rq_cred);
 615                         CDEBUG(D_SEC, "req %p: replace cred %p => %p\n",
 616                                req, cred, req->rq_cred);
 617                         cred = req->rq_cred;
 618                 } else {
 619                         LASSERT(cred == req->rq_cred);
 620                         CERROR("req %p: failed to replace dead cred %p\n",
 621                                 req, cred);
 622                         req->rq_ptlrpcs_err = 1;
 623                         RETURN(-ENOMEM);
 624                 }
 625         }
 626
 627         ptlrpcs_cred_refresh(cred);
 628
 629         if (!ptlrpcs_cred_is_uptodate(cred)) {
 630                 if (test_bit(PTLRPC_CRED_ERROR_BIT, &cred->pc_flags))
 631                         req->rq_ptlrpcs_err = 1;
 632
 633                 CERROR("req %p: failed to refresh cred %p, fatal %d\n",
 634                         req, cred, req->rq_ptlrpcs_err);
 635                 RETURN(-EPERM);
 636         } else
 637                 RETURN(0);
 638 }
 639
 640 int ptlrpcs_cli_wrap_request(struct ptlrpc_request *req)
 641 {
 642         struct ptlrpc_cred     *cred;
 643         int rc;
 644         ENTRY;
 645
 646         LASSERT(req->rq_cred);
 647         LASSERT(req->rq_cred->pc_sec);
 648         LASSERT(req->rq_cred->pc_ops);
 649         LASSERT(req->rq_reqbuf);
 650         LASSERT(req->rq_reqbuf_len);
 651
 652         rc = ptlrpcs_req_refresh_cred(req);
 653         if (rc)
 654                 RETURN(rc);
 655
 656         CDEBUG(D_SEC, "wrap req %p\n", req);
 657         cred = req->rq_cred;
 658
 659         switch (SEC_FLAVOR_SVC(req->rq_req_secflvr)) {
 660         case PTLRPCS_SVC_NONE:
 661         case PTLRPCS_SVC_AUTH:
 662                 if (req->rq_req_wrapped) {
 663                         CDEBUG(D_SEC, "req %p(o%u,x"LPU64",t"LPU64") "
 664                                "already signed, resend?\n", req,
 665                                req->rq_reqmsg ? req->rq_reqmsg->opc : -1,
 666                                req->rq_xid, req->rq_transno);
 667                         req->rq_req_wrapped = 0;
 668                         req->rq_reqdata_len = sizeof(struct ptlrpcs_wire_hdr) +
 669                                               req->rq_reqlen;
 670                         LASSERT(req->rq_reqdata_len % 8 == 0);
 671                 }
 672
 673                 LASSERT(cred->pc_ops->sign);
 674                 rc = cred->pc_ops->sign(cred, req);
 675                 if (!rc)
 676                         req->rq_req_wrapped = 1;
 677                 break;
 678         case PTLRPCS_SVC_PRIV:
 679                 if (req->rq_req_wrapped) {
 680                         CDEBUG(D_SEC, "req %p(o%u,x"LPU64",t"LPU64") "
 681                                "already encrypted, resend?\n", req,
 682                                req->rq_reqmsg ? req->rq_reqmsg->opc : -1,
 683                                req->rq_xid, req->rq_transno);
 684                         req->rq_req_wrapped = 0;
 685                         req->rq_reqdata_len = sizeof(struct ptlrpcs_wire_hdr);
 686                         LASSERT(req->rq_reqdata_len % 8 == 0);
 687                 }
 688
 689                 LASSERT(cred->pc_ops->seal);
 690                 rc = cred->pc_ops->seal(cred, req);
 691                 if (!rc)
 692                         req->rq_req_wrapped = 1;
 693                 break;
 694         default:
 695                 LBUG();
 696         }
 697         LASSERT(req->rq_reqdata_len);
 698         LASSERT(req->rq_reqdata_len % 8 == 0);
 699         LASSERT(req->rq_reqdata_len >= sizeof(struct ptlrpcs_wire_hdr));
 700         LASSERT(req->rq_reqdata_len <= req->rq_reqbuf_len);
 701
 702         RETURN(rc);
 703 }
 704
 705 /* rq_nob_received is the actual received data length */
 706 int ptlrpcs_cli_unwrap_reply(struct ptlrpc_request *req)
 707 {
 708         struct ptlrpc_cred *cred = req->rq_cred;
 709         struct ptlrpc_sec *sec;
 710         struct ptlrpcs_wire_hdr *sec_hdr;
 711         int rc;
 712         ENTRY;
 713
 714         LASSERT(cred);
 715         LASSERT(cred->pc_sec);
 716         LASSERT(cred->pc_ops);
 717         LASSERT(req->rq_repbuf);
 718
 719         if (req->rq_nob_received < sizeof(*sec_hdr)) {
 720                 CERROR("req %p: reply size only %d\n",
 721                         req, req->rq_nob_received);
 722                 RETURN(-EPROTO);
 723         }
 724
 725         sec_hdr = (struct ptlrpcs_wire_hdr *) req->rq_repbuf;
 726         sec_hdr->flavor = le32_to_cpu(sec_hdr->flavor);
 727         sec_hdr->msg_len = le32_to_cpu(sec_hdr->msg_len);
 728         sec_hdr->sec_len = le32_to_cpu(sec_hdr->sec_len);
 729
 730         CDEBUG(D_SEC, "req %p, cred %p, flavor 0x%x\n",
 731                req, cred, sec_hdr->flavor);
 732
 733         sec = cred->pc_sec;
 734
 735         /* only compare major flavor, reply might use different subflavor.
 736          */
 737         if (SEC_FLAVOR_MAJOR(sec_hdr->flavor) !=
 738             SEC_FLAVOR_MAJOR(req->rq_req_secflvr)) {
 739                 CERROR("got major flavor %u while expect %u\n",
 740                        SEC_FLAVOR_MAJOR(sec_hdr->flavor),
 741                        SEC_FLAVOR_MAJOR(req->rq_req_secflvr));
 742                 RETURN(-EPROTO);
 743         }
 744
 745         if (sizeof(*sec_hdr) + sec_hdr->msg_len + sec_hdr->sec_len >
 746             req->rq_nob_received) {
 747                 CERROR("msg %u, sec %u, while only get %d\n",
 748                         sec_hdr->msg_len, sec_hdr->sec_len,
 749                         req->rq_nob_received);
 750                 RETURN(-EPROTO);
 751         }
 752
 753         switch (SEC_FLAVOR_SVC(sec_hdr->flavor)) {
 754         case PTLRPCS_SVC_NONE:
 755         case PTLRPCS_SVC_AUTH: {
 756                 LASSERT(cred->pc_ops->verify);
 757                 rc = cred->pc_ops->verify(cred, req);
 758                 LASSERT(rc || req->rq_repmsg || req->rq_ptlrpcs_restart);
 759                 break;
 760         case PTLRPCS_SVC_PRIV:
 761                 LASSERT(cred->pc_ops->unseal);
 762                 rc = cred->pc_ops->unseal(cred, req);
 763                 LASSERT(rc || req->rq_repmsg || req->rq_ptlrpcs_restart);
 764                 break;
 765         }
 766         default:
 767                 rc = -1;
 768                 LBUG();
 769         }
 770         RETURN(rc);
 771 }
 772
 773 /**************************************************
 774  * security APIs                                  *
 775  **************************************************/
 776
 777 struct ptlrpc_sec * ptlrpcs_sec_create(__u32 flavor,
 778                                        unsigned long flags,
 779                                        struct obd_import *import,
 780                                        const char *pipe_dir,
 781                                        void *pipe_data)
 782 {
 783         struct ptlrpc_sec_type *type;
 784         struct ptlrpc_sec *sec;
 785         ENTRY;
 786
 787         type = ptlrpcs_flavor2type(flavor);
 788         if (!type) {
 789                 CERROR("invalid flavor 0x%x\n", flavor);
 790                 RETURN(NULL);
 791         }
 792
 793         sec = type->pst_ops->create_sec(flavor, pipe_dir, pipe_data);
 794         if (sec) {
 795                 spin_lock_init(&sec->ps_lock);
 796                 ptlrpcs_init_credcache(sec);
 797                 sec->ps_type = type;
 798                 sec->ps_flavor = flavor;
 799                 sec->ps_flags = flags;
 800                 sec->ps_import = class_import_get(import);
 801                 atomic_set(&sec->ps_refcount, 1);
 802                 atomic_set(&sec->ps_credcount, 0);
 803                 atomic_inc(&type->pst_inst);
 804         } else
 805                 ptlrpcs_type_put(type);
 806
 807         return sec;
 808 }
 809
 810 static void ptlrpcs_sec_destroy(struct ptlrpc_sec *sec)
 811 {
 812         struct ptlrpc_sec_type *type = sec->ps_type;
 813         struct obd_import *imp = sec->ps_import;
 814
 815         LASSERT(type && type->pst_ops);
 816         LASSERT(type->pst_ops->destroy_sec);
 817
 818         type->pst_ops->destroy_sec(sec);
 819         atomic_dec(&type->pst_inst);
 820         ptlrpcs_type_put(type);
 821         class_import_put(imp);
 822 }
 823
 824 void ptlrpcs_sec_put(struct ptlrpc_sec *sec)
 825 {
 826         int ncred;
 827
 828         if (atomic_dec_and_test(&sec->ps_refcount)) {
 829                 flush_credcache(sec, -1, 1, 1);
 830
 831                 /* this spinlock is protect against ptlrpcs_cred_destroy() */
 832                 spin_lock(&sec->ps_lock);
 833                 ncred = atomic_read(&sec->ps_credcount);
 834                 spin_unlock(&sec->ps_lock);
 835
 836                 if (ncred == 0) {
 837                         ptlrpcs_sec_destroy(sec);
 838                 } else {
 839                         CWARN("%s %p is no usage while %d cred still "
 840                               "holded, destroy delayed\n",
 841                                sec->ps_type->pst_name, sec,
 842                                atomic_read(&sec->ps_credcount));
 843                 }
 844         }
 845 }
 846
 847 void ptlrpcs_sec_invalidate_cache(struct ptlrpc_sec *sec)
 848 {
 849         flush_credcache(sec, -1, 0, 1);
 850 }
 851
 852 int sec_alloc_reqbuf(struct ptlrpc_sec *sec,
 853                      struct ptlrpc_request *req,
 854                      int msgsize, int secsize)
 855 {
 856         struct ptlrpcs_wire_hdr *hdr;
 857         ENTRY;
 858
 859         LASSERT(msgsize % 8 == 0);
 860         LASSERT(secsize % 8 == 0);
 861
 862         req->rq_reqbuf_len = sizeof(*hdr) + msgsize + secsize;
 863         OBD_ALLOC(req->rq_reqbuf, req->rq_reqbuf_len);
 864         if (!req->rq_reqbuf) {
 865                 CERROR("can't alloc %d\n", req->rq_reqbuf_len);
 866                 RETURN(-ENOMEM);
 867         }
 868
 869         hdr = buf_to_sec_hdr(req->rq_reqbuf);
 870         hdr->flavor = cpu_to_le32(req->rq_req_secflvr);
 871         hdr->msg_len = msgsize;
 872         /* security length will be filled later */
 873
 874         /* later reqdata_len will be added on actual security payload */
 875         req->rq_reqdata_len = sizeof(*hdr) + msgsize;
 876         req->rq_reqmsg = buf_to_lustre_msg(req->rq_reqbuf);
 877
 878         CDEBUG(D_SEC, "req %p: rqbuf at %p, len %d, msg %d, sec %d\n",
 879                req, req->rq_reqbuf, req->rq_reqbuf_len,
 880                msgsize, secsize);
 881
 882         RETURN(0);
 883 }
 884
 885 /* when complete successfully, req->rq_reqmsg should point to the
 886  * right place.
 887  */
 888 int ptlrpcs_cli_alloc_reqbuf(struct ptlrpc_request *req, int msgsize)
 889 {
 890         struct ptlrpc_cred *cred = req->rq_cred;
 891         struct ptlrpc_sec *sec;
 892         struct ptlrpc_secops *ops;
 893
 894         LASSERT(msgsize % 8 == 0);
 895         LASSERT(sizeof(struct ptlrpcs_wire_hdr) % 8 == 0);
 896         LASSERT(cred);
 897         LASSERT(atomic_read(&cred->pc_refcount));
 898         LASSERT(cred->pc_sec);
 899         LASSERT(cred->pc_sec->ps_type);
 900         LASSERT(cred->pc_sec->ps_type->pst_ops);
 901         LASSERT(req->rq_reqbuf == NULL);
 902         LASSERT(req->rq_reqmsg == NULL);
 903
 904         sec = cred->pc_sec;
 905         ops = sec->ps_type->pst_ops;
 906         if (ops->alloc_reqbuf)
 907                 return ops->alloc_reqbuf(sec, req, msgsize);
 908         else
 909                 return sec_alloc_reqbuf(sec, req, msgsize, 0);
 910 }
 911
 912 void sec_free_reqbuf(struct ptlrpc_sec *sec,
 913                      struct ptlrpc_request *req)
 914 {
 915         LASSERT(req->rq_reqbuf);
 916         LASSERT(req->rq_reqbuf_len);
 917
 918         /* sanity check */
 919         if (req->rq_reqmsg) {
 920                 LASSERT((char *) req->rq_reqmsg >= req->rq_reqbuf &&
 921                         (char *) req->rq_reqmsg < req->rq_reqbuf +
 922                                                   req->rq_reqbuf_len);
 923         }
 924
 925         OBD_FREE(req->rq_reqbuf, req->rq_reqbuf_len);
 926         req->rq_reqbuf = NULL;
 927         req->rq_reqmsg = NULL;
 928 }
 929
 930 void ptlrpcs_cli_free_reqbuf(struct ptlrpc_request *req)
 931 {
 932         struct ptlrpc_cred *cred = req->rq_cred;
 933         struct ptlrpc_sec *sec;
 934         struct ptlrpc_secops *ops;
 935
 936         LASSERT(cred);
 937         LASSERT(atomic_read(&cred->pc_refcount));
 938         LASSERT(cred->pc_sec);
 939         LASSERT(cred->pc_sec->ps_type);
 940         LASSERT(cred->pc_sec->ps_type->pst_ops);
 941         LASSERT(req->rq_reqbuf);
 942
 943         sec = cred->pc_sec;
 944         ops = sec->ps_type->pst_ops;
 945         if (ops->free_reqbuf)
 946                 ops->free_reqbuf(sec, req);
 947         else
 948                 sec_free_reqbuf(sec, req);
 949 }
 950
 951 int ptlrpcs_cli_alloc_repbuf(struct ptlrpc_request *req, int msgsize)
 952 {
 953         struct ptlrpc_cred *cred = req->rq_cred;
 954         struct ptlrpc_sec *sec;
 955         struct ptlrpc_secops *ops;
 956         int msg_payload, sec_payload;
 957         ENTRY;
 958
 959         LASSERT(msgsize % 8 == 0);
 960         LASSERT(sizeof(struct ptlrpcs_wire_hdr) % 8 == 0);
 961         LASSERT(cred);
 962         LASSERT(atomic_read(&cred->pc_refcount));
 963         LASSERT(cred->pc_sec);
 964         LASSERT(cred->pc_sec->ps_type);
 965         LASSERT(cred->pc_sec->ps_type->pst_ops);
 966         LASSERT(req->rq_repbuf == NULL);
 967
 968         sec = cred->pc_sec;
 969         ops = sec->ps_type->pst_ops;
 970         if (ops->alloc_repbuf)
 971                 RETURN(ops->alloc_repbuf(sec, req, msgsize));
 972
 973         /* default allocation scheme */
 974         msg_payload = SEC_FLAVOR_SVC(req->rq_req_secflvr) == PTLRPCS_SVC_PRIV ?
 975                       0 : msgsize;
 976         sec_payload = size_round(ptlrpcs_est_rep_payload(req, msgsize));
 977
 978         req->rq_repbuf_len = sizeof(struct ptlrpcs_wire_hdr) +
 979                              msg_payload + sec_payload;
 980         OBD_ALLOC(req->rq_repbuf, req->rq_repbuf_len);
 981         if (!req->rq_repbuf)
 982                 RETURN(-ENOMEM);
 983
 984         CDEBUG(D_SEC, "req %p: repbuf at %p, len %d, msg %d, sec %d\n",
 985                req, req->rq_repbuf, req->rq_repbuf_len,
 986                msg_payload, sec_payload);
 987
 988         RETURN(0);
 989 }
 990
 991 void ptlrpcs_cli_free_repbuf(struct ptlrpc_request *req)
 992 {
 993         struct ptlrpc_cred *cred = req->rq_cred;
 994         struct ptlrpc_sec *sec;
 995         struct ptlrpc_secops *ops;
 996         ENTRY;
 997
 998         LASSERT(cred);
 999         LASSERT(atomic_read(&cred->pc_refcount));
1000         LASSERT(cred->pc_sec);
1001         LASSERT(cred->pc_sec->ps_type);
1002         LASSERT(cred->pc_sec->ps_type->pst_ops);
1003         LASSERT(req->rq_repbuf);
1004
1005         sec = cred->pc_sec;
1006         ops = sec->ps_type->pst_ops;
1007         if (ops->free_repbuf)
1008                 ops->free_repbuf(sec, req);
1009         else {
1010                 OBD_FREE(req->rq_repbuf, req->rq_repbuf_len);
1011                 req->rq_repbuf = NULL;
1012                 req->rq_repmsg = NULL;
1013         }
1014         EXIT;
1015 }
1016
1017 int ptlrpcs_import_get_sec(struct obd_import *imp)
1018 {
1019         __u32 flavor = PTLRPCS_FLVR_NULL;
1020         unsigned long flags = 0;
1021         char *pipedir = NULL;
1022         ENTRY;
1023
1024         LASSERT(imp->imp_obd);
1025         LASSERT(imp->imp_obd->obd_type);
1026
1027         /* old sec might be still there in reconnecting */
1028         if (imp->imp_sec)
1029                 RETURN(0);
1030
1031         /* find actual flavor for client obd. right now server side
1032          * obd (reverse imp, etc) will simply use NULL.
1033          */
1034         if (!strcmp(imp->imp_obd->obd_type->typ_name, "mdc") ||
1035             !strcmp(imp->imp_obd->obd_type->typ_name, "osc")) {
1036                 struct client_obd *cli = &imp->imp_obd->u.cli;
1037
1038                 switch (SEC_FLAVOR_MAJOR(cli->cl_sec_flavor)) {
1039                 case PTLRPCS_FLVR_MAJOR_NULL:
1040                         CWARN("select security null for %s(%s)\n",
1041                               imp->imp_obd->obd_type->typ_name,
1042                               imp->imp_obd->obd_name);
1043                         break;
1044                 case PTLRPCS_FLVR_MAJOR_GSS:
1045                         CWARN("select security %s for %s(%s)\n",
1046                               ptlrpcs_flavor2name(cli->cl_sec_flavor),
1047                               imp->imp_obd->obd_type->typ_name,
1048                               imp->imp_obd->obd_name);
1049                         flavor = cli->cl_sec_flavor;
1050                         pipedir = imp->imp_obd->obd_name;
1051                         break;
1052                 default:
1053                         CWARN("unknown security flavor for %s(%s), use null\n",
1054                               imp->imp_obd->obd_type->typ_name,
1055                               imp->imp_obd->obd_name);
1056                 }
1057
1058                 flags = cli->cl_sec_flags;
1059         }
1060
1061         imp->imp_sec = ptlrpcs_sec_create(flavor, flags, imp, pipedir, imp);
1062         if (!imp->imp_sec)
1063                 RETURN(-EINVAL);
1064         else
1065                 RETURN(0);
1066 }
1067
1068 void ptlrpcs_import_drop_sec(struct obd_import *imp)
1069 {
1070         ENTRY;
1071         if (imp->imp_sec) {
1072                 ptlrpcs_sec_put(imp->imp_sec);
1073                 imp->imp_sec = NULL;
1074         }
1075         EXIT;
1076 }
1077
1078 void ptlrpcs_import_flush_creds(struct obd_import *imp, uid_t uid)
1079 {
1080         LASSERT(imp);
1081
1082         class_import_get(imp);
1083         if (imp->imp_sec)
1084                 flush_credcache(imp->imp_sec, uid, 1, 1);
1085         class_import_put(imp);
1086 }
1087
1088 int __init ptlrpc_sec_init(void)
1089 {
1090         int rc;
1091
1092         if ((rc = ptlrpcs_null_init()))
1093                 return rc;
1094
1095         if ((rc = svcsec_null_init())) {
1096                 ptlrpcs_null_exit();
1097                 return rc;
1098         }
1099
1100 #if 0
1101 #if !defined __KERNEL__ && defined ENABLE_GSS
1102         ptlrpcs_gss_init();
1103 #endif
1104 #endif
1105         return 0;
1106 }
1107
1108 static void __exit ptlrpc_sec_exit(void)
1109 {
1110         svcsec_null_exit();
1111         ptlrpcs_null_exit();
1112 }
1113
1114
1115 EXPORT_SYMBOL(ptlrpcs_register);
1116 EXPORT_SYMBOL(ptlrpcs_unregister);
1117 EXPORT_SYMBOL(ptlrpcs_sec_create);
1118 EXPORT_SYMBOL(ptlrpcs_sec_put);
1119 EXPORT_SYMBOL(ptlrpcs_sec_invalidate_cache);
1120 EXPORT_SYMBOL(ptlrpcs_import_get_sec);
1121 EXPORT_SYMBOL(ptlrpcs_import_drop_sec);
1122 EXPORT_SYMBOL(ptlrpcs_import_flush_creds);
1123 EXPORT_SYMBOL(ptlrpcs_cred_lookup);
1124 EXPORT_SYMBOL(ptlrpcs_cred_put);
1125 EXPORT_SYMBOL(ptlrpcs_req_get_cred);
1126 EXPORT_SYMBOL(ptlrpcs_req_drop_cred);
1127 EXPORT_SYMBOL(ptlrpcs_req_replace_dead_cred);
1128 EXPORT_SYMBOL(ptlrpcs_req_refresh_cred);
1129 EXPORT_SYMBOL(ptlrpcs_check_cred);
1130 EXPORT_SYMBOL(ptlrpcs_cli_alloc_reqbuf);
1131 EXPORT_SYMBOL(ptlrpcs_cli_free_reqbuf);
1132 EXPORT_SYMBOL(ptlrpcs_cli_alloc_repbuf);
1133 EXPORT_SYMBOL(ptlrpcs_cli_free_repbuf);
1134 EXPORT_SYMBOL(ptlrpcs_cli_wrap_request);
1135 EXPORT_SYMBOL(ptlrpcs_cli_unwrap_reply);
1136 EXPORT_SYMBOL(sec_alloc_reqbuf);
1137 EXPORT_SYMBOL(sec_free_reqbuf);
1138
1139 EXPORT_SYMBOL(svcsec_register);
1140 EXPORT_SYMBOL(svcsec_unregister);
1141 EXPORT_SYMBOL(svcsec_accept);
1142 EXPORT_SYMBOL(svcsec_authorize);
1143 EXPORT_SYMBOL(svcsec_alloc_repbuf);
1144 EXPORT_SYMBOL(svcsec_cleanup_req);
1145 EXPORT_SYMBOL(svcsec_get);
1146 EXPORT_SYMBOL(svcsec_put);
1147 EXPORT_SYMBOL(svcsec_alloc_reply_state);
1148 EXPORT_SYMBOL(svcsec_free_reply_state);
1149
1150 EXPORT_SYMBOL(ptlrpcs_name2flavor);
1151 EXPORT_SYMBOL(ptlrpcs_flavor2name);
1152
1153 MODULE_AUTHOR("Cluster File Systems, Inc. <info@clusterfs.com>");
1154 MODULE_DESCRIPTION("Lustre Security Support");
1155 MODULE_LICENSE("GPL");
1156
1157 module_init(ptlrpc_sec_init);
1158 module_exit(ptlrpc_sec_exit);