Merge branch 's5p-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git...

[sfrench/cifs-2.6.git] / fs / nfs / namespace.c

diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index bf1c68009ffd8b64001ecdd4d9f266654d2a3656..9166fcb66da219f4b9d2a8dc4445b5b945627b16 100644 (file)
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -15,6 +15,7 @@
 #include <linux/string.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/vfs.h>
+#include <linux/sunrpc/gss_api.h>
 #include "internal.h"
 
 #define NFSDBG_FACILITY                NFSDBG_VFS
@@ -27,7 +28,8 @@ int nfs_mountpoint_expiry_timeout = 500 * HZ;
 
 static struct vfsmount *nfs_do_submount(struct dentry *dentry,
                                        struct nfs_fh *fh,
-                                       struct nfs_fattr *fattr);
+                                       struct nfs_fattr *fattr,
+                                       rpc_authflavor_t authflavor);
 
 /*
  * nfs_path - reconstruct the path given an arbitrary dentry
@@ -116,6 +118,102 @@ Elong:
        return ERR_PTR(-ENAMETOOLONG);
 }
 
+#ifdef CONFIG_NFS_V4
+static rpc_authflavor_t nfs_find_best_sec(struct nfs4_secinfo_flavors *flavors, struct inode *inode)
+{
+       struct gss_api_mech *mech;
+       struct xdr_netobj oid;
+       int i;
+       rpc_authflavor_t pseudoflavor = RPC_AUTH_UNIX;
+
+       for (i = 0; i < flavors->num_flavors; i++) {
+               struct nfs4_secinfo_flavor *flavor;
+               flavor = &flavors->flavors[i];
+
+               if (flavor->flavor == RPC_AUTH_NULL || flavor->flavor == RPC_AUTH_UNIX) {
+                       pseudoflavor = flavor->flavor;
+                       break;
+               } else if (flavor->flavor == RPC_AUTH_GSS) {
+                       oid.len  = flavor->gss.sec_oid4.len;
+                       oid.data = flavor->gss.sec_oid4.data;
+                       mech = gss_mech_get_by_OID(&oid);
+                       if (!mech)
+                               continue;
+                       pseudoflavor = gss_svc_to_pseudoflavor(mech, flavor->gss.service);
+                       gss_mech_put(mech);
+                       break;
+               }
+       }
+
+       return pseudoflavor;
+}
+
+static rpc_authflavor_t nfs_negotiate_security(const struct dentry *parent, const struct dentry *dentry)
+{
+       int status = 0;
+       struct page *page;
+       struct nfs4_secinfo_flavors *flavors;
+       int (*secinfo)(struct inode *, const struct qstr *, struct nfs4_secinfo_flavors *);
+       rpc_authflavor_t flavor = RPC_AUTH_UNIX;
+
+       secinfo = NFS_PROTO(parent->d_inode)->secinfo;
+       if (secinfo != NULL) {
+               page = alloc_page(GFP_KERNEL);
+               if (!page) {
+                       status = -ENOMEM;
+                       goto out;
+               }
+               flavors = page_address(page);
+               status = secinfo(parent->d_inode, &dentry->d_name, flavors);
+               flavor = nfs_find_best_sec(flavors, dentry->d_inode);
+               put_page(page);
+       }
+
+       return flavor;
+
+out:
+       status = -ENOMEM;
+       return status;
+}
+
+static rpc_authflavor_t nfs_lookup_with_sec(struct nfs_server *server, struct dentry *parent,
+                                    struct dentry *dentry, struct path *path,
+                                    struct nfs_fh *fh, struct nfs_fattr *fattr)
+{
+       rpc_authflavor_t flavor;
+       struct rpc_clnt *clone;
+       struct rpc_auth *auth;
+       int err;
+
+       flavor = nfs_negotiate_security(parent, path->dentry);
+       if (flavor < 0)
+               goto out;
+       clone  = rpc_clone_client(server->client);
+       auth   = rpcauth_create(flavor, clone);
+       if (!auth) {
+               flavor = -EIO;
+               goto out_shutdown;
+       }
+       err = server->nfs_client->rpc_ops->lookup(clone, parent->d_inode,
+                                                 &path->dentry->d_name,
+                                                 fh, fattr);
+       if (err < 0)
+               flavor = err;
+out_shutdown:
+       rpc_shutdown_client(clone);
+out:
+       return flavor;
+}
+#else /* CONFIG_NFS_V4 */
+static inline rpc_authflavor_t nfs_lookup_with_sec(struct nfs_server *server,
+                                    struct dentry *parent, struct dentry *dentry,
+                                    struct path *path, struct nfs_fh *fh,
+                                    struct nfs_fattr *fattr)
+{
+       return -EPERM;
+}
+#endif /* CONFIG_NFS_V4 */
+
 /*
  * nfs_d_automount - Handle crossing a mountpoint on the server
  * @path - The mountpoint
@@ -136,6 +234,7 @@ struct vfsmount *nfs_d_automount(struct path *path)
        struct nfs_fh *fh = NULL;
        struct nfs_fattr *fattr = NULL;
        int err;
+       rpc_authflavor_t flavor = 1;
 
        dprintk("--> nfs_d_automount()\n");
 
@@ -153,9 +252,16 @@ struct vfsmount *nfs_d_automount(struct path *path)
 
        /* Look it up again to get its attributes */
        parent = dget_parent(path->dentry);
-       err = server->nfs_client->rpc_ops->lookup(parent->d_inode,
+       err = server->nfs_client->rpc_ops->lookup(server->client, parent->d_inode,
                                                  &path->dentry->d_name,
                                                  fh, fattr);
+       if (err == -EPERM) {
+               flavor = nfs_lookup_with_sec(server, parent, path->dentry, path, fh, fattr);
+               if (flavor < 0)
+                       err = flavor;
+               else
+                       err = 0;
+       }
        dput(parent);
        if (err != 0) {
                mnt = ERR_PTR(err);
@@ -165,7 +271,7 @@ struct vfsmount *nfs_d_automount(struct path *path)
        if (fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL)
                mnt = nfs_do_refmount(path->dentry);
        else
-               mnt = nfs_do_submount(path->dentry, fh, fattr);
+               mnt = nfs_do_submount(path->dentry, fh, fattr, flavor);
        if (IS_ERR(mnt))
                goto out;
 
@@ -232,17 +338,20 @@ static struct vfsmount *nfs_do_clone_mount(struct nfs_server *server,
  * @dentry - parent directory
  * @fh - filehandle for new root dentry
  * @fattr - attributes for new root inode
+ * @authflavor - security flavor to use when performing the mount
  *
  */
 static struct vfsmount *nfs_do_submount(struct dentry *dentry,
                                        struct nfs_fh *fh,
-                                       struct nfs_fattr *fattr)
+                                       struct nfs_fattr *fattr,
+                                       rpc_authflavor_t authflavor)
 {
        struct nfs_clone_mount mountdata = {
                .sb = dentry->d_sb,
                .dentry = dentry,
                .fh = fh,
                .fattr = fattr,
+               .authflavor = authflavor,
        };
        struct vfsmount *mnt = ERR_PTR(-ENOMEM);
        char *page = (char *) __get_free_page(GFP_USER);