| 1 | // SPDX-License-Identifier: GPL-2.0 |
| 2 | /* |
| 3 | * linux/fs/nfs/callback.c |
| 4 | * |
| 5 | * Copyright (C) 2004 Trond Myklebust |
| 6 | * |
| 7 | * NFSv4 callback handling |
| 8 | */ |
| 9 | |
| 10 | #include <linux/completion.h> |
| 11 | #include <linux/ip.h> |
| 12 | #include <linux/module.h> |
| 13 | #include <linux/sched/signal.h> |
| 14 | #include <linux/sunrpc/svc.h> |
| 15 | #include <linux/sunrpc/svcsock.h> |
| 16 | #include <linux/nfs_fs.h> |
| 17 | #include <linux/errno.h> |
| 18 | #include <linux/mutex.h> |
| 19 | #include <linux/freezer.h> |
| 20 | #include <linux/kthread.h> |
| 21 | #include <linux/sunrpc/svcauth_gss.h> |
| 22 | #include <linux/sunrpc/bc_xprt.h> |
| 23 | |
| 24 | #include <net/inet_sock.h> |
| 25 | |
| 26 | #include "nfs4_fs.h" |
| 27 | #include "callback.h" |
| 28 | #include "internal.h" |
| 29 | #include "netns.h" |
| 30 | |
| 31 | #define NFSDBG_FACILITY NFSDBG_CALLBACK |
| 32 | |
| 33 | struct nfs_callback_data { |
| 34 | unsigned int users; |
| 35 | struct svc_serv *serv; |
| 36 | }; |
| 37 | |
| 38 | static struct nfs_callback_data nfs_callback_info[NFS4_MAX_MINOR_VERSION + 1]; |
| 39 | static DEFINE_MUTEX(nfs_callback_mutex); |
| 40 | static struct svc_program nfs4_callback_program; |
| 41 | |
| 42 | static int nfs4_callback_up_net(struct svc_serv *serv, struct net *net) |
| 43 | { |
| 44 | int ret; |
| 45 | struct nfs_net *nn = net_generic(net, nfs_net_id); |
| 46 | |
| 47 | ret = svc_create_xprt(serv, "tcp", net, PF_INET, |
| 48 | nfs_callback_set_tcpport, SVC_SOCK_ANONYMOUS); |
| 49 | if (ret <= 0) |
| 50 | goto out_err; |
| 51 | nn->nfs_callback_tcpport = ret; |
| 52 | dprintk("NFS: Callback listener port = %u (af %u, net %x)\n", |
| 53 | nn->nfs_callback_tcpport, PF_INET, net->ns.inum); |
| 54 | |
| 55 | ret = svc_create_xprt(serv, "tcp", net, PF_INET6, |
| 56 | nfs_callback_set_tcpport, SVC_SOCK_ANONYMOUS); |
| 57 | if (ret > 0) { |
| 58 | nn->nfs_callback_tcpport6 = ret; |
| 59 | dprintk("NFS: Callback listener port = %u (af %u, net %x\n", |
| 60 | nn->nfs_callback_tcpport6, PF_INET6, net->ns.inum); |
| 61 | } else if (ret != -EAFNOSUPPORT) |
| 62 | goto out_err; |
| 63 | return 0; |
| 64 | |
| 65 | out_err: |
| 66 | return (ret) ? ret : -ENOMEM; |
| 67 | } |
| 68 | |
| 69 | /* |
| 70 | * This is the NFSv4 callback kernel thread. |
| 71 | */ |
| 72 | static int |
| 73 | nfs4_callback_svc(void *vrqstp) |
| 74 | { |
| 75 | int err; |
| 76 | struct svc_rqst *rqstp = vrqstp; |
| 77 | |
| 78 | set_freezable(); |
| 79 | |
| 80 | while (!kthread_freezable_should_stop(NULL)) { |
| 81 | |
| 82 | if (signal_pending(current)) |
| 83 | flush_signals(current); |
| 84 | /* |
| 85 | * Listen for a request on the socket |
| 86 | */ |
| 87 | err = svc_recv(rqstp, MAX_SCHEDULE_TIMEOUT); |
| 88 | if (err == -EAGAIN || err == -EINTR) |
| 89 | continue; |
| 90 | svc_process(rqstp); |
| 91 | } |
| 92 | svc_exit_thread(rqstp); |
| 93 | module_put_and_exit(0); |
| 94 | return 0; |
| 95 | } |
| 96 | |
| 97 | #if defined(CONFIG_NFS_V4_1) |
| 98 | /* |
| 99 | * The callback service for NFSv4.1 callbacks |
| 100 | */ |
| 101 | static int |
| 102 | nfs41_callback_svc(void *vrqstp) |
| 103 | { |
| 104 | struct svc_rqst *rqstp = vrqstp; |
| 105 | struct svc_serv *serv = rqstp->rq_server; |
| 106 | struct rpc_rqst *req; |
| 107 | int error; |
| 108 | DEFINE_WAIT(wq); |
| 109 | |
| 110 | set_freezable(); |
| 111 | |
| 112 | while (!kthread_freezable_should_stop(NULL)) { |
| 113 | |
| 114 | if (signal_pending(current)) |
| 115 | flush_signals(current); |
| 116 | |
| 117 | prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_INTERRUPTIBLE); |
| 118 | spin_lock_bh(&serv->sv_cb_lock); |
| 119 | if (!list_empty(&serv->sv_cb_list)) { |
| 120 | req = list_first_entry(&serv->sv_cb_list, |
| 121 | struct rpc_rqst, rq_bc_list); |
| 122 | list_del(&req->rq_bc_list); |
| 123 | spin_unlock_bh(&serv->sv_cb_lock); |
| 124 | finish_wait(&serv->sv_cb_waitq, &wq); |
| 125 | dprintk("Invoking bc_svc_process()\n"); |
| 126 | error = bc_svc_process(serv, req, rqstp); |
| 127 | dprintk("bc_svc_process() returned w/ error code= %d\n", |
| 128 | error); |
| 129 | } else { |
| 130 | spin_unlock_bh(&serv->sv_cb_lock); |
| 131 | if (!kthread_should_stop()) |
| 132 | schedule(); |
| 133 | finish_wait(&serv->sv_cb_waitq, &wq); |
| 134 | } |
| 135 | } |
| 136 | svc_exit_thread(rqstp); |
| 137 | module_put_and_exit(0); |
| 138 | return 0; |
| 139 | } |
| 140 | |
| 141 | static inline void nfs_callback_bc_serv(u32 minorversion, struct rpc_xprt *xprt, |
| 142 | struct svc_serv *serv) |
| 143 | { |
| 144 | if (minorversion) |
| 145 | /* |
| 146 | * Save the svc_serv in the transport so that it can |
| 147 | * be referenced when the session backchannel is initialized |
| 148 | */ |
| 149 | xprt->bc_serv = serv; |
| 150 | } |
| 151 | #else |
| 152 | static inline void nfs_callback_bc_serv(u32 minorversion, struct rpc_xprt *xprt, |
| 153 | struct svc_serv *serv) |
| 154 | { |
| 155 | } |
| 156 | #endif /* CONFIG_NFS_V4_1 */ |
| 157 | |
| 158 | static int nfs_callback_start_svc(int minorversion, struct rpc_xprt *xprt, |
| 159 | struct svc_serv *serv) |
| 160 | { |
| 161 | int nrservs = nfs_callback_nr_threads; |
| 162 | int ret; |
| 163 | |
| 164 | nfs_callback_bc_serv(minorversion, xprt, serv); |
| 165 | |
| 166 | if (nrservs < NFS4_MIN_NR_CALLBACK_THREADS) |
| 167 | nrservs = NFS4_MIN_NR_CALLBACK_THREADS; |
| 168 | |
| 169 | if (serv->sv_nrthreads-1 == nrservs) |
| 170 | return 0; |
| 171 | |
| 172 | ret = serv->sv_ops->svo_setup(serv, NULL, nrservs); |
| 173 | if (ret) { |
| 174 | serv->sv_ops->svo_setup(serv, NULL, 0); |
| 175 | return ret; |
| 176 | } |
| 177 | dprintk("nfs_callback_up: service started\n"); |
| 178 | return 0; |
| 179 | } |
| 180 | |
| 181 | static void nfs_callback_down_net(u32 minorversion, struct svc_serv *serv, struct net *net) |
| 182 | { |
| 183 | struct nfs_net *nn = net_generic(net, nfs_net_id); |
| 184 | |
| 185 | if (--nn->cb_users[minorversion]) |
| 186 | return; |
| 187 | |
| 188 | dprintk("NFS: destroy per-net callback data; net=%x\n", net->ns.inum); |
| 189 | svc_shutdown_net(serv, net); |
| 190 | } |
| 191 | |
| 192 | static int nfs_callback_up_net(int minorversion, struct svc_serv *serv, |
| 193 | struct net *net, struct rpc_xprt *xprt) |
| 194 | { |
| 195 | struct nfs_net *nn = net_generic(net, nfs_net_id); |
| 196 | int ret; |
| 197 | |
| 198 | if (nn->cb_users[minorversion]++) |
| 199 | return 0; |
| 200 | |
| 201 | dprintk("NFS: create per-net callback data; net=%x\n", net->ns.inum); |
| 202 | |
| 203 | ret = svc_bind(serv, net); |
| 204 | if (ret < 0) { |
| 205 | printk(KERN_WARNING "NFS: bind callback service failed\n"); |
| 206 | goto err_bind; |
| 207 | } |
| 208 | |
| 209 | ret = -EPROTONOSUPPORT; |
| 210 | if (!IS_ENABLED(CONFIG_NFS_V4_1) || minorversion == 0) |
| 211 | ret = nfs4_callback_up_net(serv, net); |
| 212 | else if (xprt->ops->bc_up) |
| 213 | ret = xprt->ops->bc_up(serv, net); |
| 214 | |
| 215 | if (ret < 0) { |
| 216 | printk(KERN_ERR "NFS: callback service start failed\n"); |
| 217 | goto err_socks; |
| 218 | } |
| 219 | return 0; |
| 220 | |
| 221 | err_socks: |
| 222 | svc_rpcb_cleanup(serv, net); |
| 223 | err_bind: |
| 224 | nn->cb_users[minorversion]--; |
| 225 | dprintk("NFS: Couldn't create callback socket: err = %d; " |
| 226 | "net = %x\n", ret, net->ns.inum); |
| 227 | return ret; |
| 228 | } |
| 229 | |
| 230 | static const struct svc_serv_ops nfs40_cb_sv_ops = { |
| 231 | .svo_function = nfs4_callback_svc, |
| 232 | .svo_enqueue_xprt = svc_xprt_do_enqueue, |
| 233 | .svo_setup = svc_set_num_threads_sync, |
| 234 | .svo_module = THIS_MODULE, |
| 235 | }; |
| 236 | #if defined(CONFIG_NFS_V4_1) |
| 237 | static const struct svc_serv_ops nfs41_cb_sv_ops = { |
| 238 | .svo_function = nfs41_callback_svc, |
| 239 | .svo_enqueue_xprt = svc_xprt_do_enqueue, |
| 240 | .svo_setup = svc_set_num_threads_sync, |
| 241 | .svo_module = THIS_MODULE, |
| 242 | }; |
| 243 | |
| 244 | static const struct svc_serv_ops *nfs4_cb_sv_ops[] = { |
| 245 | [0] = &nfs40_cb_sv_ops, |
| 246 | [1] = &nfs41_cb_sv_ops, |
| 247 | }; |
| 248 | #else |
| 249 | static const struct svc_serv_ops *nfs4_cb_sv_ops[] = { |
| 250 | [0] = &nfs40_cb_sv_ops, |
| 251 | [1] = NULL, |
| 252 | }; |
| 253 | #endif |
| 254 | |
| 255 | static struct svc_serv *nfs_callback_create_svc(int minorversion) |
| 256 | { |
| 257 | struct nfs_callback_data *cb_info = &nfs_callback_info[minorversion]; |
| 258 | const struct svc_serv_ops *sv_ops; |
| 259 | struct svc_serv *serv; |
| 260 | |
| 261 | /* |
| 262 | * Check whether we're already up and running. |
| 263 | */ |
| 264 | if (cb_info->serv) { |
| 265 | /* |
| 266 | * Note: increase service usage, because later in case of error |
| 267 | * svc_destroy() will be called. |
| 268 | */ |
| 269 | svc_get(cb_info->serv); |
| 270 | return cb_info->serv; |
| 271 | } |
| 272 | |
| 273 | switch (minorversion) { |
| 274 | case 0: |
| 275 | sv_ops = nfs4_cb_sv_ops[0]; |
| 276 | break; |
| 277 | default: |
| 278 | sv_ops = nfs4_cb_sv_ops[1]; |
| 279 | } |
| 280 | |
| 281 | if (sv_ops == NULL) |
| 282 | return ERR_PTR(-ENOTSUPP); |
| 283 | |
| 284 | /* |
| 285 | * Sanity check: if there's no task, |
| 286 | * we should be the first user ... |
| 287 | */ |
| 288 | if (cb_info->users) |
| 289 | printk(KERN_WARNING "nfs_callback_create_svc: no kthread, %d users??\n", |
| 290 | cb_info->users); |
| 291 | |
| 292 | serv = svc_create_pooled(&nfs4_callback_program, NFS4_CALLBACK_BUFSIZE, sv_ops); |
| 293 | if (!serv) { |
| 294 | printk(KERN_ERR "nfs_callback_create_svc: create service failed\n"); |
| 295 | return ERR_PTR(-ENOMEM); |
| 296 | } |
| 297 | cb_info->serv = serv; |
| 298 | /* As there is only one thread we need to over-ride the |
| 299 | * default maximum of 80 connections |
| 300 | */ |
| 301 | serv->sv_maxconn = 1024; |
| 302 | dprintk("nfs_callback_create_svc: service created\n"); |
| 303 | return serv; |
| 304 | } |
| 305 | |
| 306 | /* |
| 307 | * Bring up the callback thread if it is not already up. |
| 308 | */ |
| 309 | int nfs_callback_up(u32 minorversion, struct rpc_xprt *xprt) |
| 310 | { |
| 311 | struct svc_serv *serv; |
| 312 | struct nfs_callback_data *cb_info = &nfs_callback_info[minorversion]; |
| 313 | int ret; |
| 314 | struct net *net = xprt->xprt_net; |
| 315 | |
| 316 | mutex_lock(&nfs_callback_mutex); |
| 317 | |
| 318 | serv = nfs_callback_create_svc(minorversion); |
| 319 | if (IS_ERR(serv)) { |
| 320 | ret = PTR_ERR(serv); |
| 321 | goto err_create; |
| 322 | } |
| 323 | |
| 324 | ret = nfs_callback_up_net(minorversion, serv, net, xprt); |
| 325 | if (ret < 0) |
| 326 | goto err_net; |
| 327 | |
| 328 | ret = nfs_callback_start_svc(minorversion, xprt, serv); |
| 329 | if (ret < 0) |
| 330 | goto err_start; |
| 331 | |
| 332 | cb_info->users++; |
| 333 | /* |
| 334 | * svc_create creates the svc_serv with sv_nrthreads == 1, and then |
| 335 | * svc_prepare_thread increments that. So we need to call svc_destroy |
| 336 | * on both success and failure so that the refcount is 1 when the |
| 337 | * thread exits. |
| 338 | */ |
| 339 | err_net: |
| 340 | if (!cb_info->users) |
| 341 | cb_info->serv = NULL; |
| 342 | svc_destroy(serv); |
| 343 | err_create: |
| 344 | mutex_unlock(&nfs_callback_mutex); |
| 345 | return ret; |
| 346 | |
| 347 | err_start: |
| 348 | nfs_callback_down_net(minorversion, serv, net); |
| 349 | dprintk("NFS: Couldn't create server thread; err = %d\n", ret); |
| 350 | goto err_net; |
| 351 | } |
| 352 | |
| 353 | /* |
| 354 | * Kill the callback thread if it's no longer being used. |
| 355 | */ |
| 356 | void nfs_callback_down(int minorversion, struct net *net) |
| 357 | { |
| 358 | struct nfs_callback_data *cb_info = &nfs_callback_info[minorversion]; |
| 359 | struct svc_serv *serv; |
| 360 | |
| 361 | mutex_lock(&nfs_callback_mutex); |
| 362 | serv = cb_info->serv; |
| 363 | nfs_callback_down_net(minorversion, serv, net); |
| 364 | cb_info->users--; |
| 365 | if (cb_info->users == 0) { |
| 366 | svc_get(serv); |
| 367 | serv->sv_ops->svo_setup(serv, NULL, 0); |
| 368 | svc_destroy(serv); |
| 369 | dprintk("nfs_callback_down: service destroyed\n"); |
| 370 | cb_info->serv = NULL; |
| 371 | } |
| 372 | mutex_unlock(&nfs_callback_mutex); |
| 373 | } |
| 374 | |
| 375 | /* Boolean check of RPC_AUTH_GSS principal */ |
| 376 | int |
| 377 | check_gss_callback_principal(struct nfs_client *clp, struct svc_rqst *rqstp) |
| 378 | { |
| 379 | char *p = rqstp->rq_cred.cr_principal; |
| 380 | |
| 381 | if (rqstp->rq_authop->flavour != RPC_AUTH_GSS) |
| 382 | return 1; |
| 383 | |
| 384 | /* No RPC_AUTH_GSS on NFSv4.1 back channel yet */ |
| 385 | if (clp->cl_minorversion != 0) |
| 386 | return 0; |
| 387 | /* |
| 388 | * It might just be a normal user principal, in which case |
| 389 | * userspace won't bother to tell us the name at all. |
| 390 | */ |
| 391 | if (p == NULL) |
| 392 | return 0; |
| 393 | |
| 394 | /* |
| 395 | * Did we get the acceptor from userland during the SETCLIENID |
| 396 | * negotiation? |
| 397 | */ |
| 398 | if (clp->cl_acceptor) |
| 399 | return !strcmp(p, clp->cl_acceptor); |
| 400 | |
| 401 | /* |
| 402 | * Otherwise try to verify it using the cl_hostname. Note that this |
| 403 | * doesn't work if a non-canonical hostname was used in the devname. |
| 404 | */ |
| 405 | |
| 406 | /* Expect a GSS_C_NT_HOSTBASED_NAME like "nfs@serverhostname" */ |
| 407 | |
| 408 | if (memcmp(p, "nfs@", 4) != 0) |
| 409 | return 0; |
| 410 | p += 4; |
| 411 | if (strcmp(p, clp->cl_hostname) != 0) |
| 412 | return 0; |
| 413 | return 1; |
| 414 | } |
| 415 | |
| 416 | /* |
| 417 | * pg_authenticate method for nfsv4 callback threads. |
| 418 | * |
| 419 | * The authflavor has been negotiated, so an incorrect flavor is a server |
| 420 | * bug. Deny packets with incorrect authflavor. |
| 421 | * |
| 422 | * All other checking done after NFS decoding where the nfs_client can be |
| 423 | * found in nfs4_callback_compound |
| 424 | */ |
| 425 | static int nfs_callback_authenticate(struct svc_rqst *rqstp) |
| 426 | { |
| 427 | switch (rqstp->rq_authop->flavour) { |
| 428 | case RPC_AUTH_NULL: |
| 429 | if (rqstp->rq_proc != CB_NULL) |
| 430 | return SVC_DENIED; |
| 431 | break; |
| 432 | case RPC_AUTH_GSS: |
| 433 | /* No RPC_AUTH_GSS support yet in NFSv4.1 */ |
| 434 | if (svc_is_backchannel(rqstp)) |
| 435 | return SVC_DENIED; |
| 436 | } |
| 437 | return SVC_OK; |
| 438 | } |
| 439 | |
| 440 | /* |
| 441 | * Define NFS4 callback program |
| 442 | */ |
| 443 | static const struct svc_version *nfs4_callback_version[] = { |
| 444 | [1] = &nfs4_callback_version1, |
| 445 | [4] = &nfs4_callback_version4, |
| 446 | }; |
| 447 | |
| 448 | static struct svc_stat nfs4_callback_stats; |
| 449 | |
| 450 | static struct svc_program nfs4_callback_program = { |
| 451 | .pg_prog = NFS4_CALLBACK, /* RPC service number */ |
| 452 | .pg_nvers = ARRAY_SIZE(nfs4_callback_version), /* Number of entries */ |
| 453 | .pg_vers = nfs4_callback_version, /* version table */ |
| 454 | .pg_name = "NFSv4 callback", /* service name */ |
| 455 | .pg_class = "nfs", /* authentication class */ |
| 456 | .pg_stats = &nfs4_callback_stats, |
| 457 | .pg_authenticate = nfs_callback_authenticate, |
| 458 | }; |