Add an API similar to rpcauth_lookup_pseudoflavor(). The NFS server
should not call GSS API functions directly without first pinning
the GSS module.
Signed-off-by: Chuck Lever <[email protected]>
---
Bruce-
Are you interested in taking something like this (untested) patch
for 3.9? (This has pre-requisites I posted earlier this week).
Not sure what to do about svcauth_gss_flavor(), which has the same
issue.
fs/nfsd/nfs4xdr.c | 18 ++++++++---------
include/linux/sunrpc/auth.h | 2 ++
include/linux/sunrpc/gss_api.h | 3 +++
net/sunrpc/auth.c | 35 +++++++++++++++++++++++++++++++++
net/sunrpc/auth_gss/auth_gss.c | 1 +
net/sunrpc/auth_gss/gss_mech_switch.c | 31 +++++++++++++++++++++++++++++
6 files changed, 80 insertions(+), 10 deletions(-)
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 0dc1158..f986209 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -3129,8 +3129,7 @@ static __be32
nfsd4_do_encode_secinfo(struct nfsd4_compoundres *resp,
__be32 nfserr,struct svc_export *exp)
{
- int i = 0;
- u32 nflavs;
+ u32 i, nflavs;
struct exp_flavor_info *flavs;
struct exp_flavor_info def_flavs[2];
__be32 *p;
@@ -3162,23 +3161,22 @@ nfsd4_do_encode_secinfo(struct nfsd4_compoundres *resp,
ADJUST_ARGS();
for (i = 0; i < nflavs; i++) {
u32 flav = flavs[i].pseudoflavor;
- struct gss_api_mech *gm = gss_mech_get_by_pseudoflavor(flav);
+ struct rpcsec_gss_info info;
- if (gm) {
+ if (rpcauth_lookup_gss_info(flav, &info) == 0) {
RESERVE_SPACE(4);
WRITE32(RPC_AUTH_GSS);
ADJUST_ARGS();
- RESERVE_SPACE(4 + gm->gm_oid.len);
- WRITE32(gm->gm_oid.len);
- WRITEMEM(gm->gm_oid.data, gm->gm_oid.len);
+ RESERVE_SPACE(4 + info.oid.len);
+ WRITE32(info.oid.len);
+ WRITEMEM(info.oid.data, info.oid.len);
ADJUST_ARGS();
RESERVE_SPACE(4);
- WRITE32(0); /* qop */
+ WRITE32(info.qop);
ADJUST_ARGS();
RESERVE_SPACE(4);
- WRITE32(gss_pseudoflavor_to_service(gm, flav));
+ WRITE32(info.service);
ADJUST_ARGS();
- gss_mech_put(gm);
} else {
RESERVE_SPACE(4);
WRITE32(flav);
diff --git a/include/linux/sunrpc/auth.h b/include/linux/sunrpc/auth.h
index b1a49a5..312684c 100644
--- a/include/linux/sunrpc/auth.h
+++ b/include/linux/sunrpc/auth.h
@@ -105,6 +105,7 @@ struct rpc_authops {
void (*pipes_destroy)(struct rpc_auth *);
int (*list_pseudoflavors)(rpc_authflavor_t *, int);
rpc_authflavor_t (*lookup_pseudoflavor)(struct rpcsec_gss_info *);
+ int (*lookup_gss_info)(rpc_authflavor_t, struct rpcsec_gss_info *);
};
struct rpc_credops {
@@ -140,6 +141,7 @@ int rpcauth_unregister(const struct rpc_authops *);
struct rpc_auth * rpcauth_create(rpc_authflavor_t, struct rpc_clnt *);
void rpcauth_release(struct rpc_auth *);
rpc_authflavor_t rpcauth_lookup_gss_pseudoflavor(struct rpcsec_gss_info *);
+int rpcauth_lookup_gss_info(rpc_authflavor_t, struct rpcsec_gss_info *);
int rpcauth_list_flavors(rpc_authflavor_t *, int);
struct rpc_cred * rpcauth_lookup_credcache(struct rpc_auth *, struct auth_cred *, int);
void rpcauth_init_cred(struct rpc_cred *, const struct auth_cred *, struct rpc_auth *, const struct rpc_credops *);
diff --git a/include/linux/sunrpc/gss_api.h b/include/linux/sunrpc/gss_api.h
index 6f40fd1..1293a7b 100644
--- a/include/linux/sunrpc/gss_api.h
+++ b/include/linux/sunrpc/gss_api.h
@@ -133,6 +133,9 @@ void gss_mech_unregister(struct gss_api_mech *);
/* Given a GSS security tuple, look up a pseudoflavor */
rpc_authflavor_t gss_mech_lookup_pseudoflavor(struct rpcsec_gss_info *);
+/* Given a pseudoflavor, look up a GSS security tuple */
+int gss_mech_lookup_info(rpc_authflavor_t, struct rpcsec_gss_info *);
+
/* Returns a reference to a mechanism, given a name like "krb5" etc. */
struct gss_api_mech *gss_mech_get_by_name(const char *);
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 32e305b..0cfffbc 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -157,6 +157,41 @@ rpcauth_lookup_gss_pseudoflavor(struct rpcsec_gss_info *info)
EXPORT_SYMBOL_GPL(rpcauth_lookup_gss_pseudoflavor);
/**
+ * rpcauth_lookup_gss_info - find GSS tuple matching a pseudoflavor
+ * @pseudoflavor: GSS pseudoflavor to match
+ * @info: rpcsec_gss_info structure to fill in
+ *
+ * Returns zero and fills in "info" if pseudoflavor matches a
+ * supported mechanism.
+ */
+int
+rpcauth_lookup_gss_info(rpc_authflavor_t pseudoflavor, struct rpcsec_gss_info *info)
+{
+ const struct rpc_authops *ops;
+ int result;
+
+ if ((ops = auth_flavors[pseudoflavor]) == NULL)
+ request_module("rpc-auth-%u", RPC_AUTH_GSS);
+ spin_lock(&rpc_authflavor_lock);
+ ops = auth_flavors[pseudoflavor];
+ if (ops == NULL || !try_module_get(ops->owner)) {
+ spin_unlock(&rpc_authflavor_lock);
+ dprintk("RPC: %s: failed to pin module\n", __func__);
+ return -ENOMEM;
+ }
+ spin_unlock(&rpc_authflavor_lock);
+
+ if (ops->lookup_gss_info == NULL)
+ result = -ENOMEM;
+ else
+ result = ops->lookup_gss_info(pseudoflavor, info);
+
+ module_put(ops->owner);
+ return result;
+}
+EXPORT_SYMBOL_GPL(rpcauth_lookup_gss_info);
+
+/**
* rpcauth_list_flavors - discover registered flavors and pseudoflavors
* @array: array to fill in
* @size: size of "array"
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index f2e8f45..f1e92f4 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1630,6 +1630,7 @@ static const struct rpc_authops authgss_ops = {
.pipes_destroy = gss_pipes_dentries_destroy,
.list_pseudoflavors = gss_mech_list_pseudoflavors,
.lookup_pseudoflavor = gss_mech_lookup_pseudoflavor,
+ .lookup_gss_info = gss_mech_lookup_info,
};
static const struct rpc_credops gss_credops = {
diff --git a/net/sunrpc/auth_gss/gss_mech_switch.c b/net/sunrpc/auth_gss/gss_mech_switch.c
index 3ba0450..7331b0b 100644
--- a/net/sunrpc/auth_gss/gss_mech_switch.c
+++ b/net/sunrpc/auth_gss/gss_mech_switch.c
@@ -314,6 +314,37 @@ rpc_authflavor_t gss_mech_lookup_pseudoflavor(struct rpcsec_gss_info *info)
return pseudoflavor;
}
+/**
+ * gss_mech_lookup_info - look up a GSS tuple for a given pseudoflavor
+ * @pseudoflavor: GSS pseudoflavor to match
+ * @info: rpcsec_gss_info structure to fill in
+ *
+ * Returns zero and fills in "info" if pseudoflavor matches a
+ * supported mechanism.
+ */
+int gss_mech_lookup_info(rpc_authflavor_t pseudoflavor, struct rpcsec_gss_info *info)
+{
+ struct gss_api_mech *gm;
+ int i;
+
+ gm = gss_mech_get_by_pseudoflavor(pseudoflavor);
+ if (gm == NULL)
+ return -ENOMEM;
+
+ for (i = 0; i < gm->gm_pf_num; i++)
+ if (gm->gm_pfs[i].pseudoflavor == pseudoflavor) {
+ memcpy(info->oid.data, gm->gm_oid.data, gm->gm_oid.len);
+ info->oid.len = gm->gm_oid.len;
+ info->qop = gm->gm_pfs[i].qop;
+ info->service = gm->gm_pfs[i].service;
+ gss_mech_put(gm);
+ return 0;
+ }
+
+ gss_mech_put(gm);
+ return -ENOMEM;
+}
+
u32
gss_pseudoflavor_to_service(struct gss_api_mech *gm, u32 pseudoflavor)
{
On Jan 30, 2013, at 3:27 PM, "J. Bruce Fields" <[email protected]> wrote:
> On Wed, Jan 30, 2013 at 02:34:30PM -0500, Chuck Lever wrote:
>> Add an API similar to rpcauth_lookup_pseudoflavor(). The NFS server
>> should not call GSS API functions directly without first pinning
>> the GSS module.
>>
>> Signed-off-by: Chuck Lever <[email protected]>
>> ---
>>
>> Bruce-
>>
>> Are you interested in taking something like this (untested) patch
>> for 3.9? (This has pre-requisites I posted earlier this week).
>
> OK. Let me know what you want me to do.
Since the pre-requisites are going through Trond, I can just send it in through him, as long as you both agree to it.
--
Chuck Lever
chuck[dot]lever[at]oracle[dot]com
PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBsaW51eC1uZnMtb3duZXJAdmdl
ci5rZXJuZWwub3JnIFttYWlsdG86bGludXgtbmZzLQ0KPiBvd25lckB2Z2VyLmtlcm5lbC5vcmdd
IE9uIEJlaGFsZiBPZiBDaHVjayBMZXZlcg0KPiBTZW50OiBXZWRuZXNkYXksIEphbnVhcnkgMzAs
IDIwMTMgMjozNSBQTQ0KPiBUbzogbGludXgtbmZzQHZnZXIua2VybmVsLm9yZw0KPiBTdWJqZWN0
OiBbUEFUQ0hdIFNVTlJQQzogUGluIEdTUyBtb2R1bGUgd2hpbGUgaGFuZGxpbmcgZmxhdm9yIGxv
b2t1cHMNCj4gDQo+IEFkZCBhbiBBUEkgc2ltaWxhciB0byBycGNhdXRoX2xvb2t1cF9wc2V1ZG9m
bGF2b3IoKS4gIFRoZSBORlMgc2VydmVyIHNob3VsZA0KPiBub3QgY2FsbCBHU1MgQVBJIGZ1bmN0
aW9ucyBkaXJlY3RseSB3aXRob3V0IGZpcnN0IHBpbm5pbmcgdGhlIEdTUyBtb2R1bGUuDQo+IA0K
PiBTaWduZWQtb2ZmLWJ5OiBDaHVjayBMZXZlciA8Y2h1Y2subGV2ZXJAb3JhY2xlLmNvbT4NCj4g
LS0tDQo+IA0KPiBCcnVjZS0NCj4gDQo+IEFyZSB5b3UgaW50ZXJlc3RlZCBpbiB0YWtpbmcgc29t
ZXRoaW5nIGxpa2UgdGhpcyAodW50ZXN0ZWQpIHBhdGNoIGZvciAzLjk/DQo+IChUaGlzIGhhcyBw
cmUtcmVxdWlzaXRlcyBJIHBvc3RlZCBlYXJsaWVyIHRoaXMgd2VlaykuDQo+IA0KPiBOb3Qgc3Vy
ZSB3aGF0IHRvIGRvIGFib3V0IHN2Y2F1dGhfZ3NzX2ZsYXZvcigpLCB3aGljaCBoYXMgdGhlIHNh
bWUgaXNzdWUuDQo+IA0KPiANCj4gIGZzL25mc2QvbmZzNHhkci5jICAgICAgICAgICAgICAgICAg
ICAgfCAgIDE4ICsrKysrKysrLS0tLS0tLS0tDQo+ICBpbmNsdWRlL2xpbnV4L3N1bnJwYy9hdXRo
LmggICAgICAgICAgIHwgICAgMiArKw0KPiAgaW5jbHVkZS9saW51eC9zdW5ycGMvZ3NzX2FwaS5o
ICAgICAgICB8ICAgIDMgKysrDQo+ICBuZXQvc3VucnBjL2F1dGguYyAgICAgICAgICAgICAgICAg
ICAgIHwgICAzNQ0KPiArKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCj4gIG5ldC9z
dW5ycGMvYXV0aF9nc3MvYXV0aF9nc3MuYyAgICAgICAgfCAgICAxICsNCj4gIG5ldC9zdW5ycGMv
YXV0aF9nc3MvZ3NzX21lY2hfc3dpdGNoLmMgfCAgIDMxDQo+ICsrKysrKysrKysrKysrKysrKysr
KysrKysrKysrDQo+ICA2IGZpbGVzIGNoYW5nZWQsIDgwIGluc2VydGlvbnMoKyksIDEwIGRlbGV0
aW9ucygtKQ0KPiANCj4gZGlmZiAtLWdpdCBhL2ZzL25mc2QvbmZzNHhkci5jIGIvZnMvbmZzZC9u
ZnM0eGRyLmMgaW5kZXggMGRjMTE1OC4uZjk4NjIwOQ0KPiAxMDA2NDQNCj4gLS0tIGEvZnMvbmZz
ZC9uZnM0eGRyLmMNCj4gKysrIGIvZnMvbmZzZC9uZnM0eGRyLmMNCj4gQEAgLTMxMjksOCArMzEy
OSw3IEBAIHN0YXRpYyBfX2JlMzINCj4gIG5mc2Q0X2RvX2VuY29kZV9zZWNpbmZvKHN0cnVjdCBu
ZnNkNF9jb21wb3VuZHJlcyAqcmVzcCwNCj4gIAkJCSBfX2JlMzIgbmZzZXJyLHN0cnVjdCBzdmNf
ZXhwb3J0ICpleHApICB7DQo+IC0JaW50IGkgPSAwOw0KPiAtCXUzMiBuZmxhdnM7DQo+ICsJdTMy
IGksIG5mbGF2czsNCj4gIAlzdHJ1Y3QgZXhwX2ZsYXZvcl9pbmZvICpmbGF2czsNCj4gIAlzdHJ1
Y3QgZXhwX2ZsYXZvcl9pbmZvIGRlZl9mbGF2c1syXTsNCj4gIAlfX2JlMzIgKnA7DQo+IEBAIC0z
MTYyLDIzICszMTYxLDIyIEBAIG5mc2Q0X2RvX2VuY29kZV9zZWNpbmZvKHN0cnVjdA0KPiBuZnNk
NF9jb21wb3VuZHJlcyAqcmVzcCwNCj4gIAlBREpVU1RfQVJHUygpOw0KPiAgCWZvciAoaSA9IDA7
IGkgPCBuZmxhdnM7IGkrKykgew0KPiAgCQl1MzIgZmxhdiA9IGZsYXZzW2ldLnBzZXVkb2ZsYXZv
cjsNCj4gLQkJc3RydWN0IGdzc19hcGlfbWVjaCAqZ20gPQ0KPiBnc3NfbWVjaF9nZXRfYnlfcHNl
dWRvZmxhdm9yKGZsYXYpOw0KPiArCQlzdHJ1Y3QgcnBjc2VjX2dzc19pbmZvIGluZm87DQo+IA0K
PiAtCQlpZiAoZ20pIHsNCj4gKwkJaWYgKHJwY2F1dGhfbG9va3VwX2dzc19pbmZvKGZsYXYsICZp
bmZvKSA9PSAwKSB7DQo+ICAJCQlSRVNFUlZFX1NQQUNFKDQpOw0KPiAgCQkJV1JJVEUzMihSUENf
QVVUSF9HU1MpOw0KPiAgCQkJQURKVVNUX0FSR1MoKTsNCj4gLQkJCVJFU0VSVkVfU1BBQ0UoNCAr
IGdtLT5nbV9vaWQubGVuKTsNCj4gLQkJCVdSSVRFMzIoZ20tPmdtX29pZC5sZW4pOw0KPiAtCQkJ
V1JJVEVNRU0oZ20tPmdtX29pZC5kYXRhLCBnbS0+Z21fb2lkLmxlbik7DQo+ICsJCQlSRVNFUlZF
X1NQQUNFKDQgKyBpbmZvLm9pZC5sZW4pOw0KPiArCQkJV1JJVEUzMihpbmZvLm9pZC5sZW4pOw0K
PiArCQkJV1JJVEVNRU0oaW5mby5vaWQuZGF0YSwgaW5mby5vaWQubGVuKTsNCj4gIAkJCUFESlVT
VF9BUkdTKCk7DQo+ICAJCQlSRVNFUlZFX1NQQUNFKDQpOw0KPiAtCQkJV1JJVEUzMigwKTsgLyog
cW9wICovDQo+ICsJCQlXUklURTMyKGluZm8ucW9wKTsNCj4gIAkJCUFESlVTVF9BUkdTKCk7DQo+
ICAJCQlSRVNFUlZFX1NQQUNFKDQpOw0KPiAtCQkJV1JJVEUzMihnc3NfcHNldWRvZmxhdm9yX3Rv
X3NlcnZpY2UoZ20sIGZsYXYpKTsNCj4gKwkJCVdSSVRFMzIoaW5mby5zZXJ2aWNlKTsNCj4gIAkJ
CUFESlVTVF9BUkdTKCk7DQo+IC0JCQlnc3NfbWVjaF9wdXQoZ20pOw0KPiAgCQl9IGVsc2Ugew0K
PiAgCQkJUkVTRVJWRV9TUEFDRSg0KTsNCj4gIAkJCVdSSVRFMzIoZmxhdik7DQo+IGRpZmYgLS1n
aXQgYS9pbmNsdWRlL2xpbnV4L3N1bnJwYy9hdXRoLmggYi9pbmNsdWRlL2xpbnV4L3N1bnJwYy9h
dXRoLmggaW5kZXgNCj4gYjFhNDlhNS4uMzEyNjg0YyAxMDA2NDQNCj4gLS0tIGEvaW5jbHVkZS9s
aW51eC9zdW5ycGMvYXV0aC5oDQo+ICsrKyBiL2luY2x1ZGUvbGludXgvc3VucnBjL2F1dGguaA0K
PiBAQCAtMTA1LDYgKzEwNSw3IEBAIHN0cnVjdCBycGNfYXV0aG9wcyB7DQo+ICAJdm9pZAkJCSgq
cGlwZXNfZGVzdHJveSkoc3RydWN0IHJwY19hdXRoICopOw0KPiAgCWludAkJCSgqbGlzdF9wc2V1
ZG9mbGF2b3JzKShycGNfYXV0aGZsYXZvcl90ICosDQo+IGludCk7DQo+ICAJcnBjX2F1dGhmbGF2
b3JfdAkoKmxvb2t1cF9wc2V1ZG9mbGF2b3IpKHN0cnVjdA0KPiBycGNzZWNfZ3NzX2luZm8gKik7
DQo+ICsJaW50CQkJKCpsb29rdXBfZ3NzX2luZm8pKHJwY19hdXRoZmxhdm9yX3QsIHN0cnVjdA0K
PiBycGNzZWNfZ3NzX2luZm8gKik7DQo+ICB9Ow0KPiANCj4gIHN0cnVjdCBycGNfY3JlZG9wcyB7
DQo+IEBAIC0xNDAsNiArMTQxLDcgQEAgaW50CQkJcnBjYXV0aF91bnJlZ2lzdGVyKGNvbnN0DQo+
IHN0cnVjdCBycGNfYXV0aG9wcyAqKTsNCj4gIHN0cnVjdCBycGNfYXV0aCAqCXJwY2F1dGhfY3Jl
YXRlKHJwY19hdXRoZmxhdm9yX3QsIHN0cnVjdCBycGNfY2xudCAqKTsNCj4gIHZvaWQJCQlycGNh
dXRoX3JlbGVhc2Uoc3RydWN0IHJwY19hdXRoICopOw0KPiAgcnBjX2F1dGhmbGF2b3JfdAlycGNh
dXRoX2xvb2t1cF9nc3NfcHNldWRvZmxhdm9yKHN0cnVjdA0KPiBycGNzZWNfZ3NzX2luZm8gKik7
DQo+ICtpbnQJCQlycGNhdXRoX2xvb2t1cF9nc3NfaW5mbyhycGNfYXV0aGZsYXZvcl90LCBzdHJ1
Y3QNCj4gcnBjc2VjX2dzc19pbmZvICopOw0KPiAgaW50CQkJcnBjYXV0aF9saXN0X2ZsYXZvcnMo
cnBjX2F1dGhmbGF2b3JfdCAqLCBpbnQpOw0KPiAgc3RydWN0IHJwY19jcmVkICoJcnBjYXV0aF9s
b29rdXBfY3JlZGNhY2hlKHN0cnVjdCBycGNfYXV0aCAqLCBzdHJ1Y3QNCj4gYXV0aF9jcmVkICos
IGludCk7DQo+ICB2b2lkCQkJcnBjYXV0aF9pbml0X2NyZWQoc3RydWN0IHJwY19jcmVkICosIGNv
bnN0IHN0cnVjdA0KPiBhdXRoX2NyZWQgKiwgc3RydWN0IHJwY19hdXRoICosIGNvbnN0IHN0cnVj
dCBycGNfY3JlZG9wcyAqKTsNCj4gZGlmZiAtLWdpdCBhL2luY2x1ZGUvbGludXgvc3VucnBjL2dz
c19hcGkuaCBiL2luY2x1ZGUvbGludXgvc3VucnBjL2dzc19hcGkuaA0KPiBpbmRleCA2ZjQwZmQx
Li4xMjkzYTdiIDEwMDY0NA0KPiAtLS0gYS9pbmNsdWRlL2xpbnV4L3N1bnJwYy9nc3NfYXBpLmgN
Cj4gKysrIGIvaW5jbHVkZS9saW51eC9zdW5ycGMvZ3NzX2FwaS5oDQo+IEBAIC0xMzMsNiArMTMz
LDkgQEAgdm9pZCBnc3NfbWVjaF91bnJlZ2lzdGVyKHN0cnVjdCBnc3NfYXBpX21lY2ggKik7DQo+
ICAvKiBHaXZlbiBhIEdTUyBzZWN1cml0eSB0dXBsZSwgbG9vayB1cCBhIHBzZXVkb2ZsYXZvciAq
LyAgcnBjX2F1dGhmbGF2b3JfdA0KPiBnc3NfbWVjaF9sb29rdXBfcHNldWRvZmxhdm9yKHN0cnVj
dCBycGNzZWNfZ3NzX2luZm8gKik7DQo+IA0KPiArLyogR2l2ZW4gYSBwc2V1ZG9mbGF2b3IsIGxv
b2sgdXAgYSBHU1Mgc2VjdXJpdHkgdHVwbGUgKi8gaW50DQo+ICtnc3NfbWVjaF9sb29rdXBfaW5m
byhycGNfYXV0aGZsYXZvcl90LCBzdHJ1Y3QgcnBjc2VjX2dzc19pbmZvICopOw0KPiArDQo+ICAv
KiBSZXR1cm5zIGEgcmVmZXJlbmNlIHRvIGEgbWVjaGFuaXNtLCBnaXZlbiBhIG5hbWUgbGlrZSAi
a3JiNSIgZXRjLiAqLw0KPiBzdHJ1Y3QgZ3NzX2FwaV9tZWNoICpnc3NfbWVjaF9nZXRfYnlfbmFt
ZShjb25zdCBjaGFyICopOw0KPiANCj4gZGlmZiAtLWdpdCBhL25ldC9zdW5ycGMvYXV0aC5jIGIv
bmV0L3N1bnJwYy9hdXRoLmMgaW5kZXggMzJlMzA1Yi4uMGNmZmZiYw0KPiAxMDA2NDQNCj4gLS0t
IGEvbmV0L3N1bnJwYy9hdXRoLmMNCj4gKysrIGIvbmV0L3N1bnJwYy9hdXRoLmMNCj4gQEAgLTE1
Nyw2ICsxNTcsNDEgQEAgcnBjYXV0aF9sb29rdXBfZ3NzX3BzZXVkb2ZsYXZvcihzdHJ1Y3QNCj4g
cnBjc2VjX2dzc19pbmZvICppbmZvKQ0KPiBFWFBPUlRfU1lNQk9MX0dQTChycGNhdXRoX2xvb2t1
cF9nc3NfcHNldWRvZmxhdm9yKTsNCj4gDQo+ICAvKioNCj4gKyAqIHJwY2F1dGhfbG9va3VwX2dz
c19pbmZvIC0gZmluZCBHU1MgdHVwbGUgbWF0Y2hpbmcgYSBwc2V1ZG9mbGF2b3INCj4gKyAqIEBw
c2V1ZG9mbGF2b3I6IEdTUyBwc2V1ZG9mbGF2b3IgdG8gbWF0Y2gNCj4gKyAqIEBpbmZvOiBycGNz
ZWNfZ3NzX2luZm8gc3RydWN0dXJlIHRvIGZpbGwgaW4NCj4gKyAqDQo+ICsgKiBSZXR1cm5zIHpl
cm8gYW5kIGZpbGxzIGluICJpbmZvIiBpZiBwc2V1ZG9mbGF2b3IgbWF0Y2hlcyBhDQo+ICsgKiBz
dXBwb3J0ZWQgbWVjaGFuaXNtLg0KPiArICovDQo+ICtpbnQNCj4gK3JwY2F1dGhfbG9va3VwX2dz
c19pbmZvKHJwY19hdXRoZmxhdm9yX3QgcHNldWRvZmxhdm9yLCBzdHJ1Y3QNCj4gK3JwY3NlY19n
c3NfaW5mbyAqaW5mbykgew0KPiArCWNvbnN0IHN0cnVjdCBycGNfYXV0aG9wcyAqb3BzOw0KPiAr
CWludCByZXN1bHQ7DQo+ICsNCj4gKwlpZiAoKG9wcyA9IGF1dGhfZmxhdm9yc1twc2V1ZG9mbGF2
b3JdKSA9PSBOVUxMKQ0KPiArCQlyZXF1ZXN0X21vZHVsZSgicnBjLWF1dGgtJXUiLCBSUENfQVVU
SF9HU1MpOw0KPiArCXNwaW5fbG9jaygmcnBjX2F1dGhmbGF2b3JfbG9jayk7DQo+ICsJb3BzID0g
YXV0aF9mbGF2b3JzW3BzZXVkb2ZsYXZvcl07DQo+ICsJaWYgKG9wcyA9PSBOVUxMIHx8ICF0cnlf
bW9kdWxlX2dldChvcHMtPm93bmVyKSkgew0KPiArCQlzcGluX3VubG9jaygmcnBjX2F1dGhmbGF2
b3JfbG9jayk7DQo+ICsJCWRwcmludGsoIlJQQzogICAgICAgJXM6IGZhaWxlZCB0byBwaW4gbW9k
dWxlXG4iLCBfX2Z1bmNfXyk7DQo+ICsJCXJldHVybiAtRU5PTUVNOw0KDQpXb3VsZG4ndCBFTk9F
TlQgbWFrZSBtb3JlIHNlbnNlPyBUaGlzIGlzbid0IGEgbWVtb3J5IGFsbG9jYXRpb24gaXNzdWUu
DQoNCj4gKwl9DQo+ICsJc3Bpbl91bmxvY2soJnJwY19hdXRoZmxhdm9yX2xvY2spOw0KPiArDQo+
ICsJaWYgKG9wcy0+bG9va3VwX2dzc19pbmZvID09IE5VTEwpDQo+ICsJCXJlc3VsdCA9IC1FTk9N
RU07DQoNCkRpdHRvLg0KDQo+ICsJZWxzZQ0KPiArCQlyZXN1bHQgPSBvcHMtPmxvb2t1cF9nc3Nf
aW5mbyhwc2V1ZG9mbGF2b3IsIGluZm8pOw0KPiArDQo+ICsJbW9kdWxlX3B1dChvcHMtPm93bmVy
KTsNCj4gKwlyZXR1cm4gcmVzdWx0Ow0KPiArfQ0KPiArRVhQT1JUX1NZTUJPTF9HUEwocnBjYXV0
aF9sb29rdXBfZ3NzX2luZm8pOw0KPiArDQo+ICsvKioNCj4gICAqIHJwY2F1dGhfbGlzdF9mbGF2
b3JzIC0gZGlzY292ZXIgcmVnaXN0ZXJlZCBmbGF2b3JzIGFuZCBwc2V1ZG9mbGF2b3JzDQo+ICAg
KiBAYXJyYXk6IGFycmF5IHRvIGZpbGwgaW4NCj4gICAqIEBzaXplOiBzaXplIG9mICJhcnJheSIN
Cj4gZGlmZiAtLWdpdCBhL25ldC9zdW5ycGMvYXV0aF9nc3MvYXV0aF9nc3MuYw0KPiBiL25ldC9z
dW5ycGMvYXV0aF9nc3MvYXV0aF9nc3MuYyBpbmRleCBmMmU4ZjQ1Li5mMWU5MmY0IDEwMDY0NA0K
PiAtLS0gYS9uZXQvc3VucnBjL2F1dGhfZ3NzL2F1dGhfZ3NzLmMNCj4gKysrIGIvbmV0L3N1bnJw
Yy9hdXRoX2dzcy9hdXRoX2dzcy5jDQo+IEBAIC0xNjMwLDYgKzE2MzAsNyBAQCBzdGF0aWMgY29u
c3Qgc3RydWN0IHJwY19hdXRob3BzIGF1dGhnc3Nfb3BzID0gew0KPiAgCS5waXBlc19kZXN0cm95
CT0gZ3NzX3BpcGVzX2RlbnRyaWVzX2Rlc3Ryb3ksDQo+ICAJLmxpc3RfcHNldWRvZmxhdm9ycyA9
IGdzc19tZWNoX2xpc3RfcHNldWRvZmxhdm9ycywNCj4gIAkubG9va3VwX3BzZXVkb2ZsYXZvciA9
IGdzc19tZWNoX2xvb2t1cF9wc2V1ZG9mbGF2b3IsDQo+ICsJLmxvb2t1cF9nc3NfaW5mbyA9IGdz
c19tZWNoX2xvb2t1cF9pbmZvLA0KPiAgfTsNCj4gDQo+ICBzdGF0aWMgY29uc3Qgc3RydWN0IHJw
Y19jcmVkb3BzIGdzc19jcmVkb3BzID0geyBkaWZmIC0tZ2l0DQo+IGEvbmV0L3N1bnJwYy9hdXRo
X2dzcy9nc3NfbWVjaF9zd2l0Y2guYw0KPiBiL25ldC9zdW5ycGMvYXV0aF9nc3MvZ3NzX21lY2hf
c3dpdGNoLmMNCj4gaW5kZXggM2JhMDQ1MC4uNzMzMWIwYiAxMDA2NDQNCj4gLS0tIGEvbmV0L3N1
bnJwYy9hdXRoX2dzcy9nc3NfbWVjaF9zd2l0Y2guYw0KPiArKysgYi9uZXQvc3VucnBjL2F1dGhf
Z3NzL2dzc19tZWNoX3N3aXRjaC5jDQo+IEBAIC0zMTQsNiArMzE0LDM3IEBAIHJwY19hdXRoZmxh
dm9yX3QNCj4gZ3NzX21lY2hfbG9va3VwX3BzZXVkb2ZsYXZvcihzdHJ1Y3QgcnBjc2VjX2dzc19p
bmZvICppbmZvKQ0KPiAgCXJldHVybiBwc2V1ZG9mbGF2b3I7DQo+ICB9DQo+IA0KPiArLyoqDQo+
ICsgKiBnc3NfbWVjaF9sb29rdXBfaW5mbyAtIGxvb2sgdXAgYSBHU1MgdHVwbGUgZm9yIGEgZ2l2
ZW4gcHNldWRvZmxhdm9yDQo+ICsgKiBAcHNldWRvZmxhdm9yOiBHU1MgcHNldWRvZmxhdm9yIHRv
IG1hdGNoDQo+ICsgKiBAaW5mbzogcnBjc2VjX2dzc19pbmZvIHN0cnVjdHVyZSB0byBmaWxsIGlu
DQo+ICsgKg0KPiArICogUmV0dXJucyB6ZXJvIGFuZCBmaWxscyBpbiAiaW5mbyIgaWYgcHNldWRv
Zmxhdm9yIG1hdGNoZXMgYQ0KPiArICogc3VwcG9ydGVkIG1lY2hhbmlzbS4NCj4gKyAqLw0KPiAr
aW50IGdzc19tZWNoX2xvb2t1cF9pbmZvKHJwY19hdXRoZmxhdm9yX3QgcHNldWRvZmxhdm9yLCBz
dHJ1Y3QNCj4gK3JwY3NlY19nc3NfaW5mbyAqaW5mbykgew0KPiArCXN0cnVjdCBnc3NfYXBpX21l
Y2ggKmdtOw0KPiArCWludCBpOw0KPiArDQo+ICsJZ20gPSBnc3NfbWVjaF9nZXRfYnlfcHNldWRv
Zmxhdm9yKHBzZXVkb2ZsYXZvcik7DQo+ICsJaWYgKGdtID09IE5VTEwpDQo+ICsJCXJldHVybiAt
RU5PTUVNOw0KPiArDQo+ICsJZm9yIChpID0gMDsgaSA8IGdtLT5nbV9wZl9udW07IGkrKykNCj4g
KwkJaWYgKGdtLT5nbV9wZnNbaV0ucHNldWRvZmxhdm9yID09IHBzZXVkb2ZsYXZvcikgew0KPiAr
CQkJbWVtY3B5KGluZm8tPm9pZC5kYXRhLCBnbS0+Z21fb2lkLmRhdGEsIGdtLQ0KPiA+Z21fb2lk
Lmxlbik7DQo+ICsJCQlpbmZvLT5vaWQubGVuID0gZ20tPmdtX29pZC5sZW47DQo+ICsJCQlpbmZv
LT5xb3AgPSBnbS0+Z21fcGZzW2ldLnFvcDsNCj4gKwkJCWluZm8tPnNlcnZpY2UgPSBnbS0+Z21f
cGZzW2ldLnNlcnZpY2U7DQo+ICsJCQlnc3NfbWVjaF9wdXQoZ20pOw0KPiArCQkJcmV0dXJuIDA7
DQo+ICsJCX0NCj4gKw0KPiArCWdzc19tZWNoX3B1dChnbSk7DQo+ICsJcmV0dXJuIC1FTk9NRU07
DQo+ICt9DQo+ICsNCj4gIHUzMg0KPiAgZ3NzX3BzZXVkb2ZsYXZvcl90b19zZXJ2aWNlKHN0cnVj
dCBnc3NfYXBpX21lY2ggKmdtLCB1MzIgcHNldWRvZmxhdm9yKQ0KPiB7DQo+IA0KPiAtLQ0KPiBU
byB1bnN1YnNjcmliZSBmcm9tIHRoaXMgbGlzdDogc2VuZCB0aGUgbGluZSAidW5zdWJzY3JpYmUg
bGludXgtbmZzIiBpbiB0aGUNCj4gYm9keSBvZiBhIG1lc3NhZ2UgdG8gbWFqb3Jkb21vQHZnZXIu
a2VybmVsLm9yZyBNb3JlIG1ham9yZG9tbyBpbmZvIGF0DQo+IGh0dHA6Ly92Z2VyLmtlcm5lbC5v
cmcvbWFqb3Jkb21vLWluZm8uaHRtbA0K
On Jan 30, 2013, at 2:55 PM, "Myklebust, Trond" <[email protected]> wrote:
>> diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c index 32e305b..0cfffbc
>> 100644
>> --- a/net/sunrpc/auth.c
>> +++ b/net/sunrpc/auth.c
>> @@ -157,6 +157,41 @@ rpcauth_lookup_gss_pseudoflavor(struct
>> rpcsec_gss_info *info)
>> EXPORT_SYMBOL_GPL(rpcauth_lookup_gss_pseudoflavor);
>>
>> /**
>> + * rpcauth_lookup_gss_info - find GSS tuple matching a pseudoflavor
>> + * @pseudoflavor: GSS pseudoflavor to match
>> + * @info: rpcsec_gss_info structure to fill in
>> + *
>> + * Returns zero and fills in "info" if pseudoflavor matches a
>> + * supported mechanism.
>> + */
>> +int
>> +rpcauth_lookup_gss_info(rpc_authflavor_t pseudoflavor, struct
>> +rpcsec_gss_info *info) {
>> + const struct rpc_authops *ops;
>> + int result;
>> +
>> + if ((ops = auth_flavors[pseudoflavor]) == NULL)
>> + request_module("rpc-auth-%u", RPC_AUTH_GSS);
>> + spin_lock(&rpc_authflavor_lock);
>> + ops = auth_flavors[pseudoflavor];
>> + if (ops == NULL || !try_module_get(ops->owner)) {
>> + spin_unlock(&rpc_authflavor_lock);
>> + dprintk("RPC: %s: failed to pin module\n", __func__);
>> + return -ENOMEM;
>
> Wouldn't ENOENT make more sense? This isn't a memory allocation issue.
I wasn't sure what to return here. -ENOENT is fine by me.
--
Chuck Lever
chuck[dot]lever[at]oracle[dot]com
On Wed, Jan 30, 2013 at 03:44:37PM -0500, Chuck Lever wrote:
>
> On Jan 30, 2013, at 3:27 PM, "J. Bruce Fields" <[email protected]> wrote:
>
> > On Wed, Jan 30, 2013 at 02:34:30PM -0500, Chuck Lever wrote:
> >> Add an API similar to rpcauth_lookup_pseudoflavor(). The NFS server
> >> should not call GSS API functions directly without first pinning
> >> the GSS module.
> >>
> >> Signed-off-by: Chuck Lever <[email protected]>
> >> ---
> >>
> >> Bruce-
> >>
> >> Are you interested in taking something like this (untested) patch
> >> for 3.9? (This has pre-requisites I posted earlier this week).
> >
> > OK. Let me know what you want me to do.
>
> Since the pre-requisites are going through Trond, I can just send it in through him, as long as you both agree to it.
OK, feel free to add my ACK.
--b.
On Wed, Jan 30, 2013 at 02:34:30PM -0500, Chuck Lever wrote:
> Add an API similar to rpcauth_lookup_pseudoflavor(). The NFS server
> should not call GSS API functions directly without first pinning
> the GSS module.
>
> Signed-off-by: Chuck Lever <[email protected]>
> ---
>
> Bruce-
>
> Are you interested in taking something like this (untested) patch
> for 3.9? (This has pre-requisites I posted earlier this week).
OK. Let me know what you want me to do.
> Not sure what to do about svcauth_gss_flavor(), which has the same
> issue.
There's no risk of the gss module disappearing out from under us there:
it's a symbol exported from that module, so there's a static dependency
of the nfsd module on it.
--b.
>
>
> fs/nfsd/nfs4xdr.c | 18 ++++++++---------
> include/linux/sunrpc/auth.h | 2 ++
> include/linux/sunrpc/gss_api.h | 3 +++
> net/sunrpc/auth.c | 35 +++++++++++++++++++++++++++++++++
> net/sunrpc/auth_gss/auth_gss.c | 1 +
> net/sunrpc/auth_gss/gss_mech_switch.c | 31 +++++++++++++++++++++++++++++
> 6 files changed, 80 insertions(+), 10 deletions(-)
>
> diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
> index 0dc1158..f986209 100644
> --- a/fs/nfsd/nfs4xdr.c
> +++ b/fs/nfsd/nfs4xdr.c
> @@ -3129,8 +3129,7 @@ static __be32
> nfsd4_do_encode_secinfo(struct nfsd4_compoundres *resp,
> __be32 nfserr,struct svc_export *exp)
> {
> - int i = 0;
> - u32 nflavs;
> + u32 i, nflavs;
> struct exp_flavor_info *flavs;
> struct exp_flavor_info def_flavs[2];
> __be32 *p;
> @@ -3162,23 +3161,22 @@ nfsd4_do_encode_secinfo(struct nfsd4_compoundres *resp,
> ADJUST_ARGS();
> for (i = 0; i < nflavs; i++) {
> u32 flav = flavs[i].pseudoflavor;
> - struct gss_api_mech *gm = gss_mech_get_by_pseudoflavor(flav);
> + struct rpcsec_gss_info info;
>
> - if (gm) {
> + if (rpcauth_lookup_gss_info(flav, &info) == 0) {
> RESERVE_SPACE(4);
> WRITE32(RPC_AUTH_GSS);
> ADJUST_ARGS();
> - RESERVE_SPACE(4 + gm->gm_oid.len);
> - WRITE32(gm->gm_oid.len);
> - WRITEMEM(gm->gm_oid.data, gm->gm_oid.len);
> + RESERVE_SPACE(4 + info.oid.len);
> + WRITE32(info.oid.len);
> + WRITEMEM(info.oid.data, info.oid.len);
> ADJUST_ARGS();
> RESERVE_SPACE(4);
> - WRITE32(0); /* qop */
> + WRITE32(info.qop);
> ADJUST_ARGS();
> RESERVE_SPACE(4);
> - WRITE32(gss_pseudoflavor_to_service(gm, flav));
> + WRITE32(info.service);
> ADJUST_ARGS();
> - gss_mech_put(gm);
> } else {
> RESERVE_SPACE(4);
> WRITE32(flav);
> diff --git a/include/linux/sunrpc/auth.h b/include/linux/sunrpc/auth.h
> index b1a49a5..312684c 100644
> --- a/include/linux/sunrpc/auth.h
> +++ b/include/linux/sunrpc/auth.h
> @@ -105,6 +105,7 @@ struct rpc_authops {
> void (*pipes_destroy)(struct rpc_auth *);
> int (*list_pseudoflavors)(rpc_authflavor_t *, int);
> rpc_authflavor_t (*lookup_pseudoflavor)(struct rpcsec_gss_info *);
> + int (*lookup_gss_info)(rpc_authflavor_t, struct rpcsec_gss_info *);
> };
>
> struct rpc_credops {
> @@ -140,6 +141,7 @@ int rpcauth_unregister(const struct rpc_authops *);
> struct rpc_auth * rpcauth_create(rpc_authflavor_t, struct rpc_clnt *);
> void rpcauth_release(struct rpc_auth *);
> rpc_authflavor_t rpcauth_lookup_gss_pseudoflavor(struct rpcsec_gss_info *);
> +int rpcauth_lookup_gss_info(rpc_authflavor_t, struct rpcsec_gss_info *);
> int rpcauth_list_flavors(rpc_authflavor_t *, int);
> struct rpc_cred * rpcauth_lookup_credcache(struct rpc_auth *, struct auth_cred *, int);
> void rpcauth_init_cred(struct rpc_cred *, const struct auth_cred *, struct rpc_auth *, const struct rpc_credops *);
> diff --git a/include/linux/sunrpc/gss_api.h b/include/linux/sunrpc/gss_api.h
> index 6f40fd1..1293a7b 100644
> --- a/include/linux/sunrpc/gss_api.h
> +++ b/include/linux/sunrpc/gss_api.h
> @@ -133,6 +133,9 @@ void gss_mech_unregister(struct gss_api_mech *);
> /* Given a GSS security tuple, look up a pseudoflavor */
> rpc_authflavor_t gss_mech_lookup_pseudoflavor(struct rpcsec_gss_info *);
>
> +/* Given a pseudoflavor, look up a GSS security tuple */
> +int gss_mech_lookup_info(rpc_authflavor_t, struct rpcsec_gss_info *);
> +
> /* Returns a reference to a mechanism, given a name like "krb5" etc. */
> struct gss_api_mech *gss_mech_get_by_name(const char *);
>
> diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
> index 32e305b..0cfffbc 100644
> --- a/net/sunrpc/auth.c
> +++ b/net/sunrpc/auth.c
> @@ -157,6 +157,41 @@ rpcauth_lookup_gss_pseudoflavor(struct rpcsec_gss_info *info)
> EXPORT_SYMBOL_GPL(rpcauth_lookup_gss_pseudoflavor);
>
> /**
> + * rpcauth_lookup_gss_info - find GSS tuple matching a pseudoflavor
> + * @pseudoflavor: GSS pseudoflavor to match
> + * @info: rpcsec_gss_info structure to fill in
> + *
> + * Returns zero and fills in "info" if pseudoflavor matches a
> + * supported mechanism.
> + */
> +int
> +rpcauth_lookup_gss_info(rpc_authflavor_t pseudoflavor, struct rpcsec_gss_info *info)
> +{
> + const struct rpc_authops *ops;
> + int result;
> +
> + if ((ops = auth_flavors[pseudoflavor]) == NULL)
> + request_module("rpc-auth-%u", RPC_AUTH_GSS);
> + spin_lock(&rpc_authflavor_lock);
> + ops = auth_flavors[pseudoflavor];
> + if (ops == NULL || !try_module_get(ops->owner)) {
> + spin_unlock(&rpc_authflavor_lock);
> + dprintk("RPC: %s: failed to pin module\n", __func__);
> + return -ENOMEM;
> + }
> + spin_unlock(&rpc_authflavor_lock);
> +
> + if (ops->lookup_gss_info == NULL)
> + result = -ENOMEM;
> + else
> + result = ops->lookup_gss_info(pseudoflavor, info);
> +
> + module_put(ops->owner);
> + return result;
> +}
> +EXPORT_SYMBOL_GPL(rpcauth_lookup_gss_info);
> +
> +/**
> * rpcauth_list_flavors - discover registered flavors and pseudoflavors
> * @array: array to fill in
> * @size: size of "array"
> diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
> index f2e8f45..f1e92f4 100644
> --- a/net/sunrpc/auth_gss/auth_gss.c
> +++ b/net/sunrpc/auth_gss/auth_gss.c
> @@ -1630,6 +1630,7 @@ static const struct rpc_authops authgss_ops = {
> .pipes_destroy = gss_pipes_dentries_destroy,
> .list_pseudoflavors = gss_mech_list_pseudoflavors,
> .lookup_pseudoflavor = gss_mech_lookup_pseudoflavor,
> + .lookup_gss_info = gss_mech_lookup_info,
> };
>
> static const struct rpc_credops gss_credops = {
> diff --git a/net/sunrpc/auth_gss/gss_mech_switch.c b/net/sunrpc/auth_gss/gss_mech_switch.c
> index 3ba0450..7331b0b 100644
> --- a/net/sunrpc/auth_gss/gss_mech_switch.c
> +++ b/net/sunrpc/auth_gss/gss_mech_switch.c
> @@ -314,6 +314,37 @@ rpc_authflavor_t gss_mech_lookup_pseudoflavor(struct rpcsec_gss_info *info)
> return pseudoflavor;
> }
>
> +/**
> + * gss_mech_lookup_info - look up a GSS tuple for a given pseudoflavor
> + * @pseudoflavor: GSS pseudoflavor to match
> + * @info: rpcsec_gss_info structure to fill in
> + *
> + * Returns zero and fills in "info" if pseudoflavor matches a
> + * supported mechanism.
> + */
> +int gss_mech_lookup_info(rpc_authflavor_t pseudoflavor, struct rpcsec_gss_info *info)
> +{
> + struct gss_api_mech *gm;
> + int i;
> +
> + gm = gss_mech_get_by_pseudoflavor(pseudoflavor);
> + if (gm == NULL)
> + return -ENOMEM;
> +
> + for (i = 0; i < gm->gm_pf_num; i++)
> + if (gm->gm_pfs[i].pseudoflavor == pseudoflavor) {
> + memcpy(info->oid.data, gm->gm_oid.data, gm->gm_oid.len);
> + info->oid.len = gm->gm_oid.len;
> + info->qop = gm->gm_pfs[i].qop;
> + info->service = gm->gm_pfs[i].service;
> + gss_mech_put(gm);
> + return 0;
> + }
> +
> + gss_mech_put(gm);
> + return -ENOMEM;
> +}
> +
> u32
> gss_pseudoflavor_to_service(struct gss_api_mech *gm, u32 pseudoflavor)
> {
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html