Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6a1a1e34 authored by Chuck Lever's avatar Chuck Lever Committed by Trond Myklebust
Browse files

SUNRPC: Add rpcauth_list_flavors() 



The gss_mech_list_pseudoflavors() function provides a list of
currently registered GSS pseudoflavors.  This list does not include
any non-GSS flavors that have been registered with the RPC client.
nfs4_find_root_sec() currently adds these extra flavors by hand.

Instead, nfs4_find_root_sec() should be looking at the set of flavors
that have been explicitly registered via rpcauth_register().  And,
other areas of code will soon need the same kind of list that
contains all flavors the kernel currently knows about (see below).

Rather than cloning the open-coded logic in nfs4_find_root_sec() to
those new places, introduce a generic RPC function that generates a
full list of registered auth flavors and pseudoflavors.

A new rpc_authops method is added that lists a flavor's
pseudoflavors, if it has any.  I encountered an interesting module
loader loop when I tried to get the RPC client to invoke
gss_mech_list_pseudoflavors() by name.

This patch is a pre-requisite for server trunking discovery, and a
pre-requisite for fixing up the in-kernel mount client to do better
automatic security flavor selection.

Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
parent 56d08fef

fs/nfs/nfs4proc.c

+7 −4
Original line number Diff line number Diff line
@@ -43,7 +43,6 @@ 
#include <linux/printk.h>

#include <linux/slab.h>

#include <linux/sunrpc/clnt.h>

#include <linux/sunrpc/gss_api.h>

#include <linux/nfs.h>

#include <linux/nfs4.h>

#include <linux/nfs_fs.h>
@@ -2412,11 +2411,15 @@ static int nfs4_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle, 
	int i, len, status = 0;

	rpc_authflavor_t flav_array[NFS_MAX_SECFLAVORS];



	len = gss_mech_list_pseudoflavors(&flav_array[0]);

	flav_array[len] = RPC_AUTH_NULL;

	len += 1;

	len = rpcauth_list_flavors(flav_array, ARRAY_SIZE(flav_array));

	BUG_ON(len < 0);



	for (i = 0; i < len; i++) {

		/* AUTH_UNIX is the default flavor if none was specified,

		 * thus has already been tried. */

		if (flav_array[i] == RPC_AUTH_UNIX)

			continue;



		status = nfs4_lookup_root_sec(server, fhandle, info, flav_array[i]);

		if (status == -NFS4ERR_WRONGSEC || status == -EACCES)

			continue;

include/linux/sunrpc/auth.h

+2 −0
Original line number Diff line number Diff line
@@ -101,6 +101,7 @@ struct rpc_authops { 
	struct rpc_cred *	(*crcreate)(struct rpc_auth*, struct auth_cred *, int);

	int			(*pipes_create)(struct rpc_auth *);

	void			(*pipes_destroy)(struct rpc_auth *);

	int			(*list_pseudoflavors)(rpc_authflavor_t *, int);

};



struct rpc_credops {
@@ -135,6 +136,7 @@ int rpcauth_register(const struct rpc_authops *); 
int			rpcauth_unregister(const struct rpc_authops *);

struct rpc_auth *	rpcauth_create(rpc_authflavor_t, struct rpc_clnt *);

void			rpcauth_release(struct rpc_auth *);

int			rpcauth_list_flavors(rpc_authflavor_t *, int);

struct rpc_cred *	rpcauth_lookup_credcache(struct rpc_auth *, struct auth_cred *, int);

void			rpcauth_init_cred(struct rpc_cred *, const struct auth_cred *, struct rpc_auth *, const struct rpc_credops *);

struct rpc_cred *	rpcauth_lookupcred(struct rpc_auth *, int);

include/linux/sunrpc/gss_api.h

+2 −1
Original line number Diff line number Diff line
@@ -14,6 +14,7 @@ 


#ifdef __KERNEL__

#include <linux/sunrpc/xdr.h>

#include <linux/sunrpc/msg_prot.h>

#include <linux/uio.h>



/* The mechanism-independent gss-api context: */
@@ -127,7 +128,7 @@ struct gss_api_mech *gss_mech_get_by_name(const char *); 
struct gss_api_mech *gss_mech_get_by_pseudoflavor(u32);



/* Fill in an array with a list of supported pseudoflavors */

int gss_mech_list_pseudoflavors(u32 *);

int gss_mech_list_pseudoflavors(rpc_authflavor_t *, int);



/* Just increments the mechanism's reference count and returns its input: */

struct gss_api_mech * gss_mech_get(struct gss_api_mech *);

net/sunrpc/auth.c

+54 −0
Original line number Diff line number Diff line
@@ -13,6 +13,7 @@ 
#include <linux/errno.h>

#include <linux/hash.h>

#include <linux/sunrpc/clnt.h>

#include <linux/sunrpc/gss_api.h>

#include <linux/spinlock.h>



#ifdef RPC_DEBUG
@@ -122,6 +123,59 @@ rpcauth_unregister(const struct rpc_authops *ops) 
}

EXPORT_SYMBOL_GPL(rpcauth_unregister);



/**

 * rpcauth_list_flavors - discover registered flavors and pseudoflavors

 * @array: array to fill in

 * @size: size of "array"

 *

 * Returns the number of array items filled in, or a negative errno.

 *

 * The returned array is not sorted by any policy.  Callers should not

 * rely on the order of the items in the returned array.

 */

int

rpcauth_list_flavors(rpc_authflavor_t *array, int size)

{

	rpc_authflavor_t flavor;

	int result = 0;



	spin_lock(&rpc_authflavor_lock);

	for (flavor = 0; flavor < RPC_AUTH_MAXFLAVOR; flavor++) {

		const struct rpc_authops *ops = auth_flavors[flavor];

		rpc_authflavor_t pseudos[4];

		int i, len;



		if (result >= size) {

			result = -ENOMEM;

			break;

		}



		if (ops == NULL)

			continue;

		if (ops->list_pseudoflavors == NULL) {

			array[result++] = ops->au_flavor;

			continue;

		}

		len = ops->list_pseudoflavors(pseudos, ARRAY_SIZE(pseudos));

		if (len < 0) {

			result = len;

			break;

		}

		for (i = 0; i < len; i++) {

			if (result >= size) {

				result = -ENOMEM;

				break;

			}

			array[result++] = pseudos[i];

		}

	}

	spin_unlock(&rpc_authflavor_lock);



	dprintk("RPC:       %s returns %d\n", __func__, result);

	return result;

}

EXPORT_SYMBOL_GPL(rpcauth_list_flavors);



struct rpc_auth *

rpcauth_create(rpc_authflavor_t pseudoflavor, struct rpc_clnt *clnt)

{

net/sunrpc/auth_gss/auth_gss.c

+1 −0
Original line number Diff line number Diff line
@@ -1619,6 +1619,7 @@ static const struct rpc_authops authgss_ops = { 
	.crcreate	= gss_create_cred,

	.pipes_create	= gss_pipes_dentries_create,

	.pipes_destroy	= gss_pipes_dentries_destroy,

	.list_pseudoflavors = gss_mech_list_pseudoflavors,

};



static const struct rpc_credops gss_credops = {