linux/net/sunrpc/svcauth.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * linux/net/sunrpc/svcauth.c
 *
 * The generic interface for RPC authentication on the server side.
 *
 * Copyright (C) 1995, 1996 Olaf Kirch <[email protected]>
 *
 * CHANGES
 * 19-Apr-2000 Chris Evans      - Security fix
 */

#include <linux/types.h>
#include <linux/module.h>
#include <linux/sunrpc/types.h>
#include <linux/sunrpc/xdr.h>
#include <linux/sunrpc/svcsock.h>
#include <linux/sunrpc/svcauth.h>
#include <linux/err.h>
#include <linux/hash.h>

#include <trace/events/sunrpc.h>

#include "sunrpc.h"

#define RPCDBG_FACILITY …


/*
 * Table of authenticators
 */
extern struct auth_ops svcauth_null;
extern struct auth_ops svcauth_unix;
extern struct auth_ops svcauth_tls;

static struct auth_ops __rcu *authtab[RPC_AUTH_MAXFLAVOR] = …;

static struct auth_ops *
svc_get_auth_ops(rpc_authflavor_t flavor)
{ … }

static void
svc_put_auth_ops(struct auth_ops *aops)
{ … }

/**
 * svc_authenticate - Initialize an outgoing credential
 * @rqstp: RPC execution context
 *
 * Return values:
 *   %SVC_OK: XDR encoding of the result can begin
 *   %SVC_DENIED: Credential or verifier is not valid
 *   %SVC_GARBAGE: Failed to decode credential or verifier
 *   %SVC_COMPLETE: GSS context lifetime event; no further action
 *   %SVC_DROP: Drop this request; no further action
 *   %SVC_CLOSE: Like drop, but also close transport connection
 */
enum svc_auth_status svc_authenticate(struct svc_rqst *rqstp)
{ … }
EXPORT_SYMBOL_GPL(…);

/**
 * svc_set_client - Assign an appropriate 'auth_domain' as the client
 * @rqstp: RPC execution context
 *
 * Return values:
 *   %SVC_OK: Client was found and assigned
 *   %SVC_DENY: Client was explicitly denied
 *   %SVC_DROP: Ignore this request
 *   %SVC_CLOSE: Ignore this request and close the connection
 */
enum svc_auth_status svc_set_client(struct svc_rqst *rqstp)
{ … }
EXPORT_SYMBOL_GPL(…);

/**
 * svc_authorise - Finalize credentials/verifier and release resources
 * @rqstp: RPC execution context
 *
 * Returns zero on success, or a negative errno.
 */
int svc_authorise(struct svc_rqst *rqstp)
{ … }

int
svc_auth_register(rpc_authflavor_t flavor, struct auth_ops *aops)
{ … }
EXPORT_SYMBOL_GPL(…);

void
svc_auth_unregister(rpc_authflavor_t flavor)
{ … }
EXPORT_SYMBOL_GPL(…);

/**
 * svc_auth_flavor - return RPC transaction's RPC_AUTH flavor
 * @rqstp: RPC transaction context
 *
 * Returns an RPC flavor or GSS pseudoflavor.
 */
rpc_authflavor_t svc_auth_flavor(struct svc_rqst *rqstp)
{ … }
EXPORT_SYMBOL_GPL(…);

/**************************************************
 * 'auth_domains' are stored in a hash table indexed by name.
 * When the last reference to an 'auth_domain' is dropped,
 * the object is unhashed and freed.
 * If auth_domain_lookup fails to find an entry, it will return
 * it's second argument 'new'.  If this is non-null, it will
 * have been atomically linked into the table.
 */

#define DN_HASHBITS …
#define DN_HASHMAX …

static struct hlist_head	auth_domain_table[DN_HASHMAX];
static DEFINE_SPINLOCK(auth_domain_lock);

static void auth_domain_release(struct kref *kref)
	__releases(&auth_domain_lock)
{ … }

void auth_domain_put(struct auth_domain *dom)
{ … }
EXPORT_SYMBOL_GPL(…);

struct auth_domain *
auth_domain_lookup(char *name, struct auth_domain *new)
{ … }
EXPORT_SYMBOL_GPL(…);

struct auth_domain *auth_domain_find(char *name)
{ … }
EXPORT_SYMBOL_GPL(…);

/**
 * auth_domain_cleanup - check that the auth_domain table is empty
 *
 * On module unload the auth_domain_table must be empty.  To make it
 * easier to catch bugs which don't clean up domains properly, we
 * warn if anything remains in the table at cleanup time.
 *
 * Note that we cannot proactively remove the domains at this stage.
 * The ->release() function might be in a module that has already been
 * unloaded.
 */

void auth_domain_cleanup(void)
{ … }