lustre/sec/sec.c

   1 /* -*- mode: c; c-basic-offset: 8; indent-tabs-mode: nil; -*-
   2  * vim:expandtab:shiftwidth=8:tabstop=8:
   3  *
   4  * Copyright (C) 2004 Cluster File Systems, Inc.
   5  *
   6  *   This file is part of Lustre, http://www.lustre.org.
   7  *
   8  *   Lustre is free software; you can redistribute it and/or
   9  *   modify it under the terms of version 2 of the GNU General Public
  10  *   License as published by the Free Software Foundation.
  11  *
  12  *   Lustre is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *   GNU General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU General Public License
  18  *   along with Lustre; if not, write to the Free Software
  19  *   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20  */
  21
  22 #ifndef EXPORT_SYMTAB
  23 # define EXPORT_SYMTAB
  24 #endif
  25 #define DEBUG_SUBSYSTEM S_SEC
  26 #ifdef __KERNEL__
  27 #include <linux/init.h>
  28 #include <linux/module.h>
  29 #include <linux/slab.h>
  30 #else
  31 #include <liblustre.h>
  32 #endif
  33
  34 #include <libcfs/kp30.h>
  35 #include <linux/obd.h>
  36 #include <linux/obd_class.h>
  37 #include <linux/obd_support.h>
  38 #include <linux/lustre_net.h>
  39 #include <linux/lustre_import.h>
  40 #include <linux/lustre_dlm.h>
  41 #include <linux/lustre_sec.h>
  42
  43 static spinlock_t sectypes_lock = SPIN_LOCK_UNLOCKED;
  44 static struct ptlrpc_sec_type *sectypes[PTLRPCS_FLVR_MAJOR_MAX] = {
  45         NULL,
  46 };
  47
  48 int ptlrpcs_register(struct ptlrpc_sec_type *type)
  49 {
  50         __u32 flavor = type->pst_flavor;
  51
  52         LASSERT(type->pst_name);
  53         LASSERT(type->pst_ops);
  54
  55         if (flavor >= PTLRPCS_FLVR_MAJOR_MAX)
  56                 return -EINVAL;
  57
  58         spin_lock(&sectypes_lock);
  59         if (sectypes[flavor]) {
  60                 spin_unlock(&sectypes_lock);
  61                 return -EALREADY;
  62         }
  63         sectypes[flavor] = type;
  64         atomic_set(&type->pst_inst, 0);
  65         spin_unlock(&sectypes_lock);
  66
  67         CWARN("%s: registered\n", type->pst_name);
  68         return 0;
  69 }
  70
  71 int ptlrpcs_unregister(struct ptlrpc_sec_type *type)
  72 {
  73         __u32 major = type->pst_flavor;
  74
  75         LASSERT(major < PTLRPCS_FLVR_MAJOR_MAX);
  76
  77         spin_lock(&sectypes_lock);
  78         if (!sectypes[major]) {
  79                 spin_unlock(&sectypes_lock);
  80                 CERROR("%s: already unregistered?\n", type->pst_name);
  81                 return -EINVAL;
  82         }
  83
  84         LASSERT(sectypes[major] == type);
  85
  86         if (atomic_read(&type->pst_inst)) {
  87                 CERROR("%s: still have %d instances\n",
  88                        type->pst_name, atomic_read(&type->pst_inst));
  89                 spin_unlock(&sectypes_lock);
  90                 return -EINVAL;
  91         }
  92
  93         sectypes[major] = NULL;
  94         spin_unlock(&sectypes_lock);
  95
  96         CDEBUG(D_SEC, "%s: unregistered\n", type->pst_name);
  97         return 0;
  98 }
  99
 100 static
 101 struct ptlrpc_sec_type * ptlrpcs_flavor2type(__u32 flavor)
 102 {
 103         struct ptlrpc_sec_type *type;
 104         __u32 major = SEC_FLAVOR_MAJOR(flavor);
 105
 106         if (major >= PTLRPCS_FLVR_MAJOR_MAX)
 107                 return NULL;
 108
 109         spin_lock(&sectypes_lock);
 110         type = sectypes[major];
 111         if (type && !try_module_get(type->pst_owner))
 112                 type = NULL;
 113         spin_unlock(&sectypes_lock);
 114         return type;
 115 }
 116
 117 static inline
 118 void ptlrpcs_type_put(struct ptlrpc_sec_type *type)
 119 {
 120         module_put(type->pst_owner);
 121 }
 122
 123 __u32 ptlrpcs_name2flavor(const char *name)
 124 {
 125         if (!strcmp(name, "null"))
 126                 return PTLRPCS_FLVR_NULL;
 127         if (!strcmp(name, "krb5"))
 128                 return PTLRPCS_FLVR_KRB5;
 129         if (!strcmp(name, "krb5i"))
 130                 return PTLRPCS_FLVR_KRB5I;
 131         if (!strcmp(name, "krb5p"))
 132                 return PTLRPCS_FLVR_KRB5P;
 133
 134         return PTLRPCS_FLVR_INVALID;
 135 }
 136
 137 char *ptlrpcs_flavor2name(__u32 flavor)
 138 {
 139         switch (flavor) {
 140         case PTLRPCS_FLVR_NULL:
 141                 return "null";
 142         case PTLRPCS_FLVR_KRB5:
 143                 return "krb5";
 144         case PTLRPCS_FLVR_KRB5I:
 145                 return "krb5i";
 146         case PTLRPCS_FLVR_KRB5P:
 147                 return "krb5p";
 148         default:
 149                 CERROR("invalid flavor 0x%x\n", flavor);
 150         }
 151         return "unknown";
 152 }
 153
 154 /***********************************************
 155  * credential cache helpers                    *
 156  ***********************************************/
 157
 158 void ptlrpcs_init_credcache(struct ptlrpc_sec *sec)
 159 {
 160         int i;
 161         for (i = 0; i < PTLRPC_CREDCACHE_NR; i++)
 162                 INIT_LIST_HEAD(&sec->ps_credcache[i]);
 163
 164         /* ps_nextgc == 0 means never do gc */
 165         if (sec->ps_nextgc)
 166                 sec->ps_nextgc = get_seconds() + (sec->ps_expire >> 1);
 167 }
 168
 169 /*
 170  * return 1 means we should also destroy the sec structure.
 171  * normally return 0
 172  */
 173 static int ptlrpcs_cred_destroy(struct ptlrpc_cred *cred)
 174 {
 175         struct ptlrpc_sec *sec = cred->pc_sec;
 176         int rc = 0;
 177
 178         LASSERT(cred->pc_sec);
 179         LASSERT(atomic_read(&cred->pc_refcount) == 0);
 180         LASSERT(list_empty(&cred->pc_hash));
 181
 182         cred->pc_ops->destroy(cred);
 183
 184         /* spinlock to protect against ptlrpcs_sec_put() */
 185         LASSERT(atomic_read(&sec->ps_credcount));
 186         spin_lock(&sec->ps_lock);
 187         if (atomic_dec_and_test(&sec->ps_credcount) &&
 188             !atomic_read(&sec->ps_refcount))
 189                 rc = 1;
 190         spin_unlock(&sec->ps_lock);
 191         return rc;
 192 }
 193
 194 static void ptlrpcs_destroy_credlist(struct list_head *head)
 195 {
 196         struct ptlrpc_cred *cred;
 197
 198         while (!list_empty(head)) {
 199                 cred = list_entry(head->next, struct ptlrpc_cred, pc_hash);
 200                 list_del_init(&cred->pc_hash);
 201                 ptlrpcs_cred_destroy(cred);
 202         }
 203 }
 204
 205 static
 206 int cred_check_dead(struct ptlrpc_cred *cred,
 207                     struct list_head *freelist, int removal)
 208 {
 209         /* here we do the exact thing as asked. but an alternative
 210          * way is remove dead entries immediately without be asked
 211          * remove, since dead entry will not lead to further rpcs.
 212          */
 213         if (unlikely(ptlrpcs_cred_is_dead(cred))) {
 214                 /* don't try to destroy a busy entry */
 215                 if (atomic_read(&cred->pc_refcount))
 216                         return 1;
 217                 goto out;
 218         }
 219
 220         /* a busy non-dead entry is considered as "good" one.
 221          * Note in a very busy client where cred always busy, we
 222          * will not be able to find the expire here, but some other
 223          * part will, e.g. checking during refresh, or got error
 224          * notification from server, etc. We don't touch busy cred
 225          * here is because a busy cred's flag might be changed at
 226          * anytime by the owner, we don't want to compete with them.
 227          */
 228         if (atomic_read(&cred->pc_refcount) != 0)
 229                 return 0;
 230
 231         /* expire is 0 means never expire. a newly created gss cred
 232          * which during upcall also has 0 expiration
 233          */
 234         if (cred->pc_expire == 0)
 235                 return 0;
 236
 237         /* check real expiration */
 238         if (time_after(cred->pc_expire, get_seconds()))
 239                 return 0;
 240
 241         /* although we'v checked the bit right above, there's still
 242          * possibility that somebody else set the bit elsewhere.
 243          */
 244         ptlrpcs_cred_expire(cred);
 245
 246 out:
 247         if (removal) {
 248                 LASSERT(atomic_read(&cred->pc_refcount) >= 0);
 249                 LASSERT(cred->pc_sec);
 250                 LASSERT(spin_is_locked(&cred->pc_sec->ps_lock));
 251                 LASSERT(freelist);
 252
 253                 list_move(&cred->pc_hash, freelist);
 254         }
 255         return 1;
 256 }
 257
 258 static
 259 void ptlrpcs_credcache_gc(struct ptlrpc_sec *sec,
 260                           struct list_head *freelist)
 261 {
 262         struct ptlrpc_cred *cred, *n;
 263         int i;
 264         ENTRY;
 265
 266         CDEBUG(D_SEC, "do gc on sec %s\n", sec->ps_type->pst_name);
 267         for (i = 0; i < PTLRPC_CREDCACHE_NR; i++) {
 268                 list_for_each_entry_safe(cred, n, &sec->ps_credcache[i],
 269                                          pc_hash)
 270                         cred_check_dead(cred, freelist, 1);
 271         }
 272         sec->ps_nextgc = get_seconds() + sec->ps_expire;
 273         EXIT;
 274 }
 275
 276 /*
 277  * @uid: which user. "-1" means flush all.
 278  * @grace: mark cred DEAD, allow graceful destroy like notify
 279  *         server side, etc.
 280  * @force: flush all entries, otherwise only free ones be flushed.
 281  */
 282 static
 283 int flush_credcache(struct ptlrpc_sec *sec, unsigned long pag, uid_t uid,
 284                     int grace, int force)
 285 {
 286         struct ptlrpc_cred *cred, *n;
 287         LIST_HEAD(freelist);
 288         int i, busy = 0;
 289         ENTRY;
 290
 291         might_sleep_if(grace);
 292
 293         spin_lock(&sec->ps_lock);
 294         for (i = 0; i < PTLRPC_CREDCACHE_NR; i++) {
 295                 list_for_each_entry_safe(cred, n, &sec->ps_credcache[i],
 296                                          pc_hash) {
 297                         LASSERT(atomic_read(&cred->pc_refcount) >= 0);
 298
 299                         if (sec->ps_flags & PTLRPC_SEC_FL_PAG) {
 300                                 if (pag != -1 && pag != cred->pc_pag)
 301                                         continue;
 302                         } else {
 303                                 if (uid != -1 && uid != cred->pc_uid)
 304                                         continue;
 305                         }
 306
 307                         if (atomic_read(&cred->pc_refcount)) {
 308                                 busy = 1;
 309                                 if (!force)
 310                                         continue;
 311                                 list_del_init(&cred->pc_hash);
 312                                 CDEBUG(D_SEC, "sec %p: flush busy(%d) cred %p "
 313                                        "by force\n", sec,
 314                                        atomic_read(&cred->pc_refcount), cred);
 315                         } else
 316                                 list_move(&cred->pc_hash, &freelist);
 317
 318                         set_bit(PTLRPC_CRED_DEAD_BIT, &cred->pc_flags);
 319                         if (!grace)
 320                                 clear_bit(PTLRPC_CRED_UPTODATE_BIT,
 321                                           &cred->pc_flags);
 322                 }
 323         }
 324         spin_unlock(&sec->ps_lock);
 325
 326         ptlrpcs_destroy_credlist(&freelist);
 327         RETURN(busy);
 328 }
 329
 330 /**************************************************
 331  * credential APIs                                *
 332  **************************************************/
 333
 334 static inline
 335 int ptlrpcs_cred_get_hash(__u64 pag)
 336 {
 337         LASSERT((pag & PTLRPC_CREDCACHE_MASK) < PTLRPC_CREDCACHE_NR);
 338         return (pag & PTLRPC_CREDCACHE_MASK);
 339 }
 340
 341 /*
 342  * return an uptodate or newly created cred entry.
 343  */
 344 static
 345 struct ptlrpc_cred * cred_cache_lookup(struct ptlrpc_sec *sec,
 346                                        struct vfs_cred *vcred,
 347                                        int create, int remove_dead)
 348 {
 349         struct ptlrpc_cred *cred, *new = NULL, *n;
 350         LIST_HEAD(freelist);
 351         int hash, found = 0;
 352         ENTRY;
 353
 354         might_sleep();
 355
 356         hash = ptlrpcs_cred_get_hash(vcred->vc_pag);
 357
 358 retry:
 359         spin_lock(&sec->ps_lock);
 360
 361         /* do gc if expired */
 362         if (remove_dead &&
 363             sec->ps_nextgc && time_after(get_seconds(), sec->ps_nextgc))
 364                 ptlrpcs_credcache_gc(sec, &freelist);
 365
 366         list_for_each_entry_safe(cred, n, &sec->ps_credcache[hash], pc_hash) {
 367                 if (cred_check_dead(cred, &freelist, remove_dead))
 368                         continue;
 369                 if (cred->pc_ops->match(cred, vcred)) {
 370                         found = 1;
 371                         break;
 372                 }
 373         }
 374
 375         if (found) {
 376                 if (new && new != cred) {
 377                         /* lost the race, just free it */
 378                         list_add(&new->pc_hash, &freelist);
 379                 }
 380                 list_move(&cred->pc_hash, &sec->ps_credcache[hash]);
 381         } else {
 382                 if (new) {
 383                         list_add(&new->pc_hash, &sec->ps_credcache[hash]);
 384                         cred = new;
 385                 } else if (create) {
 386                         spin_unlock(&sec->ps_lock);
 387                         new = sec->ps_type->pst_ops->create_cred(sec, vcred);
 388                         if (new) {
 389                                 atomic_inc(&sec->ps_credcount);
 390                                 goto retry;
 391                         }
 392                 } else
 393                         cred = NULL;
 394         }
 395
 396         /* hold a ref */
 397         if (cred)
 398                 atomic_inc(&cred->pc_refcount);
 399
 400         spin_unlock(&sec->ps_lock);
 401
 402         ptlrpcs_destroy_credlist(&freelist);
 403         RETURN(cred);
 404 }
 405
 406 struct ptlrpc_cred * ptlrpcs_cred_lookup(struct ptlrpc_sec *sec,
 407                                          struct vfs_cred *vcred)
 408 {
 409         struct ptlrpc_cred *cred;
 410         ENTRY;
 411
 412         cred = cred_cache_lookup(sec, vcred, 0, 1);
 413         RETURN(cred);
 414 }
 415
 416 static struct ptlrpc_cred *get_cred(struct ptlrpc_sec *sec)
 417 {
 418         struct vfs_cred vcred;
 419
 420         LASSERT(sec);
 421
 422         if (sec->ps_flags & (PTLRPC_SEC_FL_MDS | PTLRPC_SEC_FL_REVERSE)) {
 423                 vcred.vc_pag = 0;
 424                 vcred.vc_uid = 0;
 425         } else {
 426                 if (sec->ps_flags & PTLRPC_SEC_FL_PAG)
 427                         vcred.vc_pag = (__u64) current->pag;
 428                 else
 429                         vcred.vc_pag = (__u64) current->uid;
 430                 vcred.vc_uid = current->uid;
 431         }
 432
 433         return cred_cache_lookup(sec, &vcred, 1, 1);
 434 }
 435
 436 int ptlrpcs_req_get_cred(struct ptlrpc_request *req)
 437 {
 438         struct obd_import *imp = req->rq_import;
 439         ENTRY;
 440
 441         LASSERT(!req->rq_cred);
 442         LASSERT(imp);
 443
 444         req->rq_cred = get_cred(imp->imp_sec);
 445
 446         if (!req->rq_cred) {
 447                 CERROR("req %p: fail to get cred from cache\n", req);
 448                 RETURN(-ENOMEM);
 449         }
 450
 451         RETURN(0);
 452 }
 453
 454 /*
 455  * check whether current user have valid credential for an import or not.
 456  * might repeatedly try in case of non-fatal errors.
 457  * return 0 on success, 1 on failure
 458  */
 459 int ptlrpcs_check_cred(struct obd_import *imp)
 460 {
 461         struct ptlrpc_cred *cred;
 462         ENTRY;
 463
 464         might_sleep();
 465 again:
 466         cred = get_cred(imp->imp_sec);
 467         if (!cred)
 468                 RETURN(0);
 469
 470         if (ptlrpcs_cred_is_uptodate(cred)) {
 471                 /* get_cred() has done expire checking, so we don't
 472                  * expect it could expire so quickly, and actually
 473                  * we don't care.
 474                  */
 475                 ptlrpcs_cred_put(cred, 1);
 476                 RETURN(0);
 477         }
 478
 479         ptlrpcs_cred_refresh(cred);
 480         if (ptlrpcs_cred_is_uptodate(cred)) {
 481                 ptlrpcs_cred_put(cred, 1);
 482                 RETURN(0);
 483         }
 484
 485         if (cred->pc_flags & PTLRPC_CRED_ERROR ||
 486             !imp->imp_replayable) {
 487                 ptlrpcs_cred_put(cred, 1);
 488                 RETURN(1);
 489         }
 490
 491         ptlrpcs_cred_put(cred, 1);
 492
 493         if (signal_pending(current)) {
 494                 CWARN("%s: interrupted\n", current->comm);
 495                 RETURN(1);
 496         }
 497         goto again;
 498 }
 499
 500 static void ptlrpcs_sec_destroy(struct ptlrpc_sec *sec);
 501
 502 void ptlrpcs_cred_put(struct ptlrpc_cred *cred, int sync)
 503 {
 504         struct ptlrpc_sec *sec = cred->pc_sec;
 505
 506         LASSERT(sec);
 507         LASSERT(atomic_read(&cred->pc_refcount));
 508
 509         spin_lock(&sec->ps_lock);
 510
 511         /* this has to be protected by ps_lock, because cred cache
 512          * management code might increase ref against a 0-refed cred.
 513          */
 514         if (!atomic_dec_and_test(&cred->pc_refcount)) {
 515                 spin_unlock(&sec->ps_lock);
 516                 return;
 517         }
 518
 519         /* if sec already unused, we have to destroy the cred (prevent it
 520          * hanging there for ever)
 521          */
 522         if (atomic_read(&sec->ps_refcount) == 0) {
 523                 if (!test_and_set_bit(PTLRPC_CRED_DEAD_BIT, &cred->pc_flags))
 524                         CWARN("cred %p: force expire on a unused sec\n", cred);
 525                 list_del_init(&cred->pc_hash);
 526         } else if (unlikely(sync && ptlrpcs_cred_is_dead(cred)))
 527                 list_del_init(&cred->pc_hash);
 528
 529         if (!list_empty(&cred->pc_hash)) {
 530                 spin_unlock(&sec->ps_lock);
 531                 return;
 532         }
 533
 534         /* if required async, and we reached here, we have to clear
 535          * the UPTODATE bit, thus no rpc is needed in destroy procedure.
 536          */
 537         if (!sync)
 538                 clear_bit(PTLRPC_CRED_UPTODATE_BIT, &cred->pc_flags);
 539
 540         spin_unlock(&sec->ps_lock);
 541
 542         /* destroy this cred */
 543         if (!ptlrpcs_cred_destroy(cred))
 544                 return;
 545
 546         LASSERT(!atomic_read(&sec->ps_credcount));
 547         LASSERT(!atomic_read(&sec->ps_refcount));
 548
 549         CWARN("sec %p(%s), put last cred, also destroy the sec\n",
 550               sec, sec->ps_type->pst_name);
 551 }
 552
 553 void ptlrpcs_req_drop_cred(struct ptlrpc_request *req)
 554 {
 555         ENTRY;
 556
 557         LASSERT(req);
 558         LASSERT(req->rq_cred);
 559
 560         if (req->rq_cred) {
 561                 /* this could be called with spinlock hold, use async mode */
 562                 ptlrpcs_cred_put(req->rq_cred, 0);
 563                 req->rq_cred = NULL;
 564         } else
 565                 CDEBUG(D_SEC, "req %p have no cred\n", req);
 566         EXIT;
 567 }
 568
 569 /*
 570  * request must have a cred. if failed to get new cred,
 571  * just restore the old one
 572  */
 573 int ptlrpcs_req_replace_dead_cred(struct ptlrpc_request *req)
 574 {
 575         struct ptlrpc_cred *cred = req->rq_cred;
 576         int rc;
 577         ENTRY;
 578
 579         LASSERT(cred);
 580         LASSERT(test_bit(PTLRPC_CRED_DEAD_BIT, &cred->pc_flags));
 581
 582         ptlrpcs_cred_get(cred);
 583         ptlrpcs_req_drop_cred(req);
 584         LASSERT(!req->rq_cred);
 585         rc = ptlrpcs_req_get_cred(req);
 586         if (!rc) {
 587                 LASSERT(req->rq_cred);
 588                 LASSERT(req->rq_cred != cred);
 589                 ptlrpcs_cred_put(cred, 1);
 590         } else {
 591                 LASSERT(!req->rq_cred);
 592                 req->rq_cred = cred;
 593         }
 594         RETURN(rc);
 595 }
 596
 597 /*
 598  * since there's no lock on the cred, its status could be changed
 599  * by other threads at any time, we allow this race. If an uptodate
 600  * cred turn to dead quickly under us, we don't know and continue
 601  * using it, that's fine. if necessary the later error handling code
 602  * will catch it.
 603  */
 604 int ptlrpcs_req_refresh_cred(struct ptlrpc_request *req)
 605 {
 606         struct ptlrpc_cred *cred = req->rq_cred;
 607         ENTRY;
 608
 609         LASSERT(cred);
 610
 611         if (!ptlrpcs_cred_check_uptodate(cred))
 612                 RETURN(0);
 613
 614         if (test_bit(PTLRPC_CRED_ERROR_BIT, &cred->pc_flags)) {
 615                 req->rq_ptlrpcs_err = 1;
 616                 RETURN(-EPERM);
 617         }
 618
 619         if (test_bit(PTLRPC_CRED_DEAD_BIT, &cred->pc_flags)) {
 620                 if (ptlrpcs_req_replace_dead_cred(req) == 0) {
 621                         LASSERT(cred != req->rq_cred);
 622                         CDEBUG(D_SEC, "req %p: replace cred %p => %p\n",
 623                                req, cred, req->rq_cred);
 624                         cred = req->rq_cred;
 625                 } else {
 626                         LASSERT(cred == req->rq_cred);
 627                         CERROR("req %p: failed to replace dead cred %p\n",
 628                                 req, cred);
 629                         req->rq_ptlrpcs_err = 1;
 630                         RETURN(-ENOMEM);
 631                 }
 632         }
 633
 634         ptlrpcs_cred_refresh(cred);
 635
 636         if (!ptlrpcs_cred_is_uptodate(cred)) {
 637                 if (test_bit(PTLRPC_CRED_ERROR_BIT, &cred->pc_flags))
 638                         req->rq_ptlrpcs_err = 1;
 639
 640                 CERROR("req %p: failed to refresh cred %p, fatal %d\n",
 641                         req, cred, req->rq_ptlrpcs_err);
 642                 RETURN(-EPERM);
 643         } else
 644                 RETURN(0);
 645 }
 646
 647 int ptlrpcs_cli_wrap_request(struct ptlrpc_request *req)
 648 {
 649         struct ptlrpc_cred     *cred;
 650         int rc;
 651         ENTRY;
 652
 653         LASSERT(req->rq_cred);
 654         LASSERT(req->rq_cred->pc_sec);
 655         LASSERT(req->rq_cred->pc_ops);
 656         LASSERT(req->rq_reqbuf);
 657         LASSERT(req->rq_reqbuf_len);
 658
 659         rc = ptlrpcs_req_refresh_cred(req);
 660         if (rc)
 661                 RETURN(rc);
 662
 663         CDEBUG(D_SEC, "wrap req %p\n", req);
 664         cred = req->rq_cred;
 665
 666         switch (SEC_FLAVOR_SVC(req->rq_req_secflvr)) {
 667         case PTLRPCS_SVC_NONE:
 668         case PTLRPCS_SVC_AUTH:
 669                 if (req->rq_req_wrapped) {
 670                         CDEBUG(D_SEC, "req %p(o%u,x"LPU64",t"LPU64") "
 671                                "already signed, resend?\n", req,
 672                                req->rq_reqmsg ? req->rq_reqmsg->opc : -1,
 673                                req->rq_xid, req->rq_transno);
 674                         req->rq_req_wrapped = 0;
 675                         req->rq_reqdata_len = sizeof(struct ptlrpcs_wire_hdr) +
 676                                               req->rq_reqlen;
 677                         LASSERT(req->rq_reqdata_len % 8 == 0);
 678                 }
 679
 680                 LASSERT(cred->pc_ops->sign);
 681                 rc = cred->pc_ops->sign(cred, req);
 682                 if (!rc)
 683                         req->rq_req_wrapped = 1;
 684                 break;
 685         case PTLRPCS_SVC_PRIV:
 686                 if (req->rq_req_wrapped) {
 687                         CDEBUG(D_SEC, "req %p(o%u,x"LPU64",t"LPU64") "
 688                                "already encrypted, resend?\n", req,
 689                                req->rq_reqmsg ? req->rq_reqmsg->opc : -1,
 690                                req->rq_xid, req->rq_transno);
 691                         req->rq_req_wrapped = 0;
 692                         req->rq_reqdata_len = sizeof(struct ptlrpcs_wire_hdr);
 693                         LASSERT(req->rq_reqdata_len % 8 == 0);
 694                 }
 695
 696                 LASSERT(cred->pc_ops->seal);
 697                 rc = cred->pc_ops->seal(cred, req);
 698                 if (!rc)
 699                         req->rq_req_wrapped = 1;
 700                 break;
 701         default:
 702                 LBUG();
 703         }
 704         LASSERT(req->rq_reqdata_len);
 705         LASSERT(req->rq_reqdata_len % 8 == 0);
 706         LASSERT(req->rq_reqdata_len >= sizeof(struct ptlrpcs_wire_hdr));
 707         LASSERT(req->rq_reqdata_len <= req->rq_reqbuf_len);
 708
 709         RETURN(rc);
 710 }
 711
 712 /* rq_nob_received is the actual received data length */
 713 int ptlrpcs_cli_unwrap_reply(struct ptlrpc_request *req)
 714 {
 715         struct ptlrpc_cred *cred = req->rq_cred;
 716         struct ptlrpc_sec *sec;
 717         struct ptlrpcs_wire_hdr *sec_hdr;
 718         int rc;
 719         ENTRY;
 720
 721         LASSERT(cred);
 722         LASSERT(cred->pc_sec);
 723         LASSERT(cred->pc_ops);
 724         LASSERT(req->rq_repbuf);
 725
 726         if (req->rq_nob_received < sizeof(*sec_hdr)) {
 727                 CERROR("req %p: reply size only %d\n",
 728                         req, req->rq_nob_received);
 729                 RETURN(-EPROTO);
 730         }
 731
 732         sec_hdr = (struct ptlrpcs_wire_hdr *) req->rq_repbuf;
 733         sec_hdr->flavor = le32_to_cpu(sec_hdr->flavor);
 734         sec_hdr->msg_len = le32_to_cpu(sec_hdr->msg_len);
 735         sec_hdr->sec_len = le32_to_cpu(sec_hdr->sec_len);
 736
 737         CDEBUG(D_SEC, "req %p, cred %p, flavor 0x%x\n",
 738                req, cred, sec_hdr->flavor);
 739
 740         sec = cred->pc_sec;
 741
 742         /* only compare major flavor, reply might use different subflavor.
 743          */
 744         if (SEC_FLAVOR_MAJOR(sec_hdr->flavor) !=
 745             SEC_FLAVOR_MAJOR(req->rq_req_secflvr)) {
 746                 CERROR("got major flavor %u while expect %u\n",
 747                        SEC_FLAVOR_MAJOR(sec_hdr->flavor),
 748                        SEC_FLAVOR_MAJOR(req->rq_req_secflvr));
 749                 RETURN(-EPROTO);
 750         }
 751
 752         if (sizeof(*sec_hdr) + sec_hdr->msg_len + sec_hdr->sec_len >
 753             req->rq_nob_received) {
 754                 CERROR("msg %u, sec %u, while only get %d\n",
 755                         sec_hdr->msg_len, sec_hdr->sec_len,
 756                         req->rq_nob_received);
 757                 RETURN(-EPROTO);
 758         }
 759
 760         switch (SEC_FLAVOR_SVC(sec_hdr->flavor)) {
 761         case PTLRPCS_SVC_NONE:
 762         case PTLRPCS_SVC_AUTH: {
 763                 LASSERT(cred->pc_ops->verify);
 764                 rc = cred->pc_ops->verify(cred, req);
 765                 LASSERT(rc || req->rq_repmsg || req->rq_ptlrpcs_restart);
 766                 break;
 767         case PTLRPCS_SVC_PRIV:
 768                 LASSERT(cred->pc_ops->unseal);
 769                 rc = cred->pc_ops->unseal(cred, req);
 770                 LASSERT(rc || req->rq_repmsg || req->rq_ptlrpcs_restart);
 771                 break;
 772         }
 773         default:
 774                 rc = -1;
 775                 LBUG();
 776         }
 777         RETURN(rc);
 778 }
 779
 780 /**************************************************
 781  * security APIs                                  *
 782  **************************************************/
 783
 784 struct ptlrpc_sec * ptlrpcs_sec_create(__u32 flavor,
 785                                        unsigned long flags,
 786                                        struct obd_import *import,
 787                                        const char *pipe_dir,
 788                                        void *pipe_data)
 789 {
 790         struct ptlrpc_sec_type *type;
 791         struct ptlrpc_sec *sec;
 792         ENTRY;
 793
 794         type = ptlrpcs_flavor2type(flavor);
 795         if (!type) {
 796                 CERROR("invalid flavor 0x%x\n", flavor);
 797                 RETURN(NULL);
 798         }
 799
 800         sec = type->pst_ops->create_sec(flavor, pipe_dir, pipe_data);
 801         if (sec) {
 802                 spin_lock_init(&sec->ps_lock);
 803                 ptlrpcs_init_credcache(sec);
 804                 sec->ps_type = type;
 805                 sec->ps_flavor = flavor;
 806                 sec->ps_flags = flags;
 807                 sec->ps_import = class_import_get(import);
 808                 atomic_set(&sec->ps_refcount, 1);
 809                 atomic_set(&sec->ps_credcount, 0);
 810                 atomic_inc(&type->pst_inst);
 811         } else
 812                 ptlrpcs_type_put(type);
 813
 814         return sec;
 815 }
 816
 817 static void ptlrpcs_sec_destroy(struct ptlrpc_sec *sec)
 818 {
 819         struct ptlrpc_sec_type *type = sec->ps_type;
 820         struct obd_import *imp = sec->ps_import;
 821
 822         LASSERT(type && type->pst_ops);
 823         LASSERT(type->pst_ops->destroy_sec);
 824
 825         type->pst_ops->destroy_sec(sec);
 826         atomic_dec(&type->pst_inst);
 827         ptlrpcs_type_put(type);
 828         class_import_put(imp);
 829 }
 830
 831 void ptlrpcs_sec_put(struct ptlrpc_sec *sec)
 832 {
 833         int ncred;
 834
 835         if (atomic_dec_and_test(&sec->ps_refcount)) {
 836                 flush_credcache(sec, -1, -1, 1, 1);
 837
 838                 /* this spinlock is protect against ptlrpcs_cred_destroy() */
 839                 spin_lock(&sec->ps_lock);
 840                 ncred = atomic_read(&sec->ps_credcount);
 841                 spin_unlock(&sec->ps_lock);
 842
 843                 if (ncred == 0) {
 844                         ptlrpcs_sec_destroy(sec);
 845                 } else {
 846                         CWARN("%s %p is no usage while %d cred still "
 847                               "holded, destroy delayed\n",
 848                                sec->ps_type->pst_name, sec,
 849                                atomic_read(&sec->ps_credcount));
 850                 }
 851         }
 852 }
 853
 854 void ptlrpcs_sec_invalidate_cache(struct ptlrpc_sec *sec)
 855 {
 856         flush_credcache(sec, -1, -1, 0, 1);
 857 }
 858
 859 int sec_alloc_reqbuf(struct ptlrpc_sec *sec,
 860                      struct ptlrpc_request *req,
 861                      int msgsize, int secsize)
 862 {
 863         struct ptlrpcs_wire_hdr *hdr;
 864         ENTRY;
 865
 866         LASSERT(msgsize % 8 == 0);
 867         LASSERT(secsize % 8 == 0);
 868
 869         req->rq_reqbuf_len = sizeof(*hdr) + msgsize + secsize;
 870         OBD_ALLOC(req->rq_reqbuf, req->rq_reqbuf_len);
 871         if (!req->rq_reqbuf) {
 872                 CERROR("can't alloc %d\n", req->rq_reqbuf_len);
 873                 RETURN(-ENOMEM);
 874         }
 875
 876         hdr = buf_to_sec_hdr(req->rq_reqbuf);
 877         hdr->flavor = cpu_to_le32(req->rq_req_secflvr);
 878         hdr->msg_len = msgsize;
 879         /* security length will be filled later */
 880
 881         /* later reqdata_len will be added on actual security payload */
 882         req->rq_reqdata_len = sizeof(*hdr) + msgsize;
 883         req->rq_reqmsg = buf_to_lustre_msg(req->rq_reqbuf);
 884
 885         CDEBUG(D_SEC, "req %p: rqbuf at %p, len %d, msg %d, sec %d\n",
 886                req, req->rq_reqbuf, req->rq_reqbuf_len,
 887                msgsize, secsize);
 888
 889         RETURN(0);
 890 }
 891
 892 /* when complete successfully, req->rq_reqmsg should point to the
 893  * right place.
 894  */
 895 int ptlrpcs_cli_alloc_reqbuf(struct ptlrpc_request *req, int msgsize)
 896 {
 897         struct ptlrpc_cred *cred = req->rq_cred;
 898         struct ptlrpc_sec *sec;
 899         struct ptlrpc_secops *ops;
 900
 901         LASSERT(msgsize % 8 == 0);
 902         LASSERT(sizeof(struct ptlrpcs_wire_hdr) % 8 == 0);
 903         LASSERT(cred);
 904         LASSERT(atomic_read(&cred->pc_refcount));
 905         LASSERT(cred->pc_sec);
 906         LASSERT(cred->pc_sec->ps_type);
 907         LASSERT(cred->pc_sec->ps_type->pst_ops);
 908         LASSERT(req->rq_reqbuf == NULL);
 909         LASSERT(req->rq_reqmsg == NULL);
 910
 911         sec = cred->pc_sec;
 912         ops = sec->ps_type->pst_ops;
 913         if (ops->alloc_reqbuf)
 914                 return ops->alloc_reqbuf(sec, req, msgsize);
 915         else
 916                 return sec_alloc_reqbuf(sec, req, msgsize, 0);
 917 }
 918
 919 void sec_free_reqbuf(struct ptlrpc_sec *sec,
 920                      struct ptlrpc_request *req)
 921 {
 922         LASSERT(req->rq_reqbuf);
 923         LASSERT(req->rq_reqbuf_len);
 924
 925         /* sanity check */
 926         if (req->rq_reqmsg) {
 927                 LASSERT((char *) req->rq_reqmsg >= req->rq_reqbuf &&
 928                         (char *) req->rq_reqmsg < req->rq_reqbuf +
 929                                                   req->rq_reqbuf_len);
 930         }
 931
 932         OBD_FREE(req->rq_reqbuf, req->rq_reqbuf_len);
 933         req->rq_reqbuf = NULL;
 934         req->rq_reqmsg = NULL;
 935 }
 936
 937 void ptlrpcs_cli_free_reqbuf(struct ptlrpc_request *req)
 938 {
 939         struct ptlrpc_cred *cred = req->rq_cred;
 940         struct ptlrpc_sec *sec;
 941         struct ptlrpc_secops *ops;
 942
 943         LASSERT(cred);
 944         LASSERT(atomic_read(&cred->pc_refcount));
 945         LASSERT(cred->pc_sec);
 946         LASSERT(cred->pc_sec->ps_type);
 947         LASSERT(cred->pc_sec->ps_type->pst_ops);
 948         LASSERT(req->rq_reqbuf);
 949
 950         sec = cred->pc_sec;
 951         ops = sec->ps_type->pst_ops;
 952         if (ops->free_reqbuf)
 953                 ops->free_reqbuf(sec, req);
 954         else
 955                 sec_free_reqbuf(sec, req);
 956 }
 957
 958 int ptlrpcs_cli_alloc_repbuf(struct ptlrpc_request *req, int msgsize)
 959 {
 960         struct ptlrpc_cred *cred = req->rq_cred;
 961         struct ptlrpc_sec *sec;
 962         struct ptlrpc_secops *ops;
 963         int msg_payload, sec_payload;
 964         ENTRY;
 965
 966         LASSERT(msgsize % 8 == 0);
 967         LASSERT(sizeof(struct ptlrpcs_wire_hdr) % 8 == 0);
 968         LASSERT(cred);
 969         LASSERT(atomic_read(&cred->pc_refcount));
 970         LASSERT(cred->pc_sec);
 971         LASSERT(cred->pc_sec->ps_type);
 972         LASSERT(cred->pc_sec->ps_type->pst_ops);
 973         LASSERT(req->rq_repbuf == NULL);
 974
 975         sec = cred->pc_sec;
 976         ops = sec->ps_type->pst_ops;
 977         if (ops->alloc_repbuf)
 978                 RETURN(ops->alloc_repbuf(sec, req, msgsize));
 979
 980         /* default allocation scheme */
 981         msg_payload = SEC_FLAVOR_SVC(req->rq_req_secflvr) == PTLRPCS_SVC_PRIV ?
 982                       0 : msgsize;
 983         sec_payload = size_round(ptlrpcs_est_rep_payload(req, msgsize));
 984
 985         req->rq_repbuf_len = sizeof(struct ptlrpcs_wire_hdr) +
 986                              msg_payload + sec_payload;
 987         OBD_ALLOC(req->rq_repbuf, req->rq_repbuf_len);
 988         if (!req->rq_repbuf)
 989                 RETURN(-ENOMEM);
 990
 991         CDEBUG(D_SEC, "req %p: repbuf at %p, len %d, msg %d, sec %d\n",
 992                req, req->rq_repbuf, req->rq_repbuf_len,
 993                msg_payload, sec_payload);
 994
 995         RETURN(0);
 996 }
 997
 998 void ptlrpcs_cli_free_repbuf(struct ptlrpc_request *req)
 999 {
1000         struct ptlrpc_cred *cred = req->rq_cred;
1001         struct ptlrpc_sec *sec;
1002         struct ptlrpc_secops *ops;
1003         ENTRY;
1004
1005         LASSERT(cred);
1006         LASSERT(atomic_read(&cred->pc_refcount));
1007         LASSERT(cred->pc_sec);
1008         LASSERT(cred->pc_sec->ps_type);
1009         LASSERT(cred->pc_sec->ps_type->pst_ops);
1010         LASSERT(req->rq_repbuf);
1011
1012         sec = cred->pc_sec;
1013         ops = sec->ps_type->pst_ops;
1014         if (ops->free_repbuf)
1015                 ops->free_repbuf(sec, req);
1016         else {
1017                 OBD_FREE(req->rq_repbuf, req->rq_repbuf_len);
1018                 req->rq_repbuf = NULL;
1019                 req->rq_repmsg = NULL;
1020         }
1021         EXIT;
1022 }
1023
1024 int ptlrpcs_import_get_sec(struct obd_import *imp)
1025 {
1026         __u32 flavor = PTLRPCS_FLVR_NULL;
1027         unsigned long flags = 0;
1028         char *pipedir = NULL;
1029         ENTRY;
1030
1031         LASSERT(imp->imp_obd);
1032         LASSERT(imp->imp_obd->obd_type);
1033
1034         /* old sec might be still there in reconnecting */
1035         if (imp->imp_sec)
1036                 RETURN(0);
1037
1038         /* find actual flavor for client obd. right now server side
1039          * obd (reverse imp, etc) will simply use NULL.
1040          */
1041         if (!strcmp(imp->imp_obd->obd_type->typ_name, "mdc") ||
1042             !strcmp(imp->imp_obd->obd_type->typ_name, "osc")) {
1043                 struct client_obd *cli = &imp->imp_obd->u.cli;
1044
1045                 switch (SEC_FLAVOR_MAJOR(cli->cl_sec_flavor)) {
1046                 case PTLRPCS_FLVR_MAJOR_NULL:
1047                         CWARN("select security null for %s(%s)\n",
1048                               imp->imp_obd->obd_type->typ_name,
1049                               imp->imp_obd->obd_name);
1050                         break;
1051                 case PTLRPCS_FLVR_MAJOR_GSS:
1052                         CWARN("select security %s for %s(%s)\n",
1053                               ptlrpcs_flavor2name(cli->cl_sec_flavor),
1054                               imp->imp_obd->obd_type->typ_name,
1055                               imp->imp_obd->obd_name);
1056                         flavor = cli->cl_sec_flavor;
1057                         pipedir = imp->imp_obd->obd_name;
1058                         break;
1059                 default:
1060                         CWARN("unknown security flavor for %s(%s), use null\n",
1061                               imp->imp_obd->obd_type->typ_name,
1062                               imp->imp_obd->obd_name);
1063                 }
1064
1065                 flags = cli->cl_sec_flags;
1066         }
1067
1068         imp->imp_sec = ptlrpcs_sec_create(flavor, flags, imp, pipedir, imp);
1069         if (!imp->imp_sec)
1070                 RETURN(-EINVAL);
1071         else
1072                 RETURN(0);
1073 }
1074
1075 void ptlrpcs_import_drop_sec(struct obd_import *imp)
1076 {
1077         ENTRY;
1078         if (imp->imp_sec) {
1079                 ptlrpcs_sec_put(imp->imp_sec);
1080                 imp->imp_sec = NULL;
1081         }
1082         EXIT;
1083 }
1084
1085 void ptlrpcs_import_flush_current_creds(struct obd_import *imp)
1086 {
1087         LASSERT(imp);
1088
1089         class_import_get(imp);
1090         if (imp->imp_sec)
1091                 flush_credcache(imp->imp_sec, current->pag, current->uid, 1, 1);
1092         class_import_put(imp);
1093 }
1094
1095 int __init ptlrpc_sec_init(void)
1096 {
1097         int rc;
1098
1099         if ((rc = ptlrpcs_null_init()))
1100                 return rc;
1101
1102         if ((rc = svcsec_null_init())) {
1103                 ptlrpcs_null_exit();
1104                 return rc;
1105         }
1106
1107 #if 0
1108 #if !defined __KERNEL__ && defined ENABLE_GSS
1109         ptlrpcs_gss_init();
1110 #endif
1111 #endif
1112         return 0;
1113 }
1114
1115 static void __exit ptlrpc_sec_exit(void)
1116 {
1117         svcsec_null_exit();
1118         ptlrpcs_null_exit();
1119 }
1120
1121
1122 EXPORT_SYMBOL(ptlrpcs_register);
1123 EXPORT_SYMBOL(ptlrpcs_unregister);
1124 EXPORT_SYMBOL(ptlrpcs_sec_create);
1125 EXPORT_SYMBOL(ptlrpcs_sec_put);
1126 EXPORT_SYMBOL(ptlrpcs_sec_invalidate_cache);
1127 EXPORT_SYMBOL(ptlrpcs_import_get_sec);
1128 EXPORT_SYMBOL(ptlrpcs_import_drop_sec);
1129 EXPORT_SYMBOL(ptlrpcs_import_flush_current_creds);
1130 EXPORT_SYMBOL(ptlrpcs_cred_lookup);
1131 EXPORT_SYMBOL(ptlrpcs_cred_put);
1132 EXPORT_SYMBOL(ptlrpcs_req_get_cred);
1133 EXPORT_SYMBOL(ptlrpcs_req_drop_cred);
1134 EXPORT_SYMBOL(ptlrpcs_req_replace_dead_cred);
1135 EXPORT_SYMBOL(ptlrpcs_req_refresh_cred);
1136 EXPORT_SYMBOL(ptlrpcs_check_cred);
1137 EXPORT_SYMBOL(ptlrpcs_cli_alloc_reqbuf);
1138 EXPORT_SYMBOL(ptlrpcs_cli_free_reqbuf);
1139 EXPORT_SYMBOL(ptlrpcs_cli_alloc_repbuf);
1140 EXPORT_SYMBOL(ptlrpcs_cli_free_repbuf);
1141 EXPORT_SYMBOL(ptlrpcs_cli_wrap_request);
1142 EXPORT_SYMBOL(ptlrpcs_cli_unwrap_reply);
1143 EXPORT_SYMBOL(sec_alloc_reqbuf);
1144 EXPORT_SYMBOL(sec_free_reqbuf);
1145
1146 EXPORT_SYMBOL(svcsec_register);
1147 EXPORT_SYMBOL(svcsec_unregister);
1148 EXPORT_SYMBOL(svcsec_accept);
1149 EXPORT_SYMBOL(svcsec_authorize);
1150 EXPORT_SYMBOL(svcsec_alloc_repbuf);
1151 EXPORT_SYMBOL(svcsec_cleanup_req);
1152 EXPORT_SYMBOL(svcsec_get);
1153 EXPORT_SYMBOL(svcsec_put);
1154 EXPORT_SYMBOL(svcsec_alloc_reply_state);
1155 EXPORT_SYMBOL(svcsec_free_reply_state);
1156
1157 EXPORT_SYMBOL(ptlrpcs_name2flavor);
1158 EXPORT_SYMBOL(ptlrpcs_flavor2name);
1159
1160 MODULE_AUTHOR("Cluster File Systems, Inc. <info@clusterfs.com>");
1161 MODULE_DESCRIPTION("Lustre Security Support");
1162 MODULE_LICENSE("GPL");
1163
1164 module_init(ptlrpc_sec_init);
1165 module_exit(ptlrpc_sec_exit);