1 /* 2 * linux/include/linux/sunrpc/svcauth.h 3 * 4 * RPC server-side authentication stuff. 5 * 6 * Copyright (C) 1995, 1996 Olaf Kirch <[email protected]> 7 */ 8 9 #ifndef _LINUX_SUNRPC_SVCAUTH_H_ 10 #define _LINUX_SUNRPC_SVCAUTH_H_ 11 12 #ifdef __KERNEL__ 13 14 #include <linux/string.h> 15 #include <linux/sunrpc/msg_prot.h> 16 #include <linux/sunrpc/cache.h> 17 #include <linux/sunrpc/gss_api.h> 18 #include <linux/hash.h> 19 #include <linux/cred.h> 20 21 struct svc_cred { 22 kuid_t cr_uid; 23 kgid_t cr_gid; 24 struct group_info *cr_group_info; 25 u32 cr_flavor; /* pseudoflavor */ 26 /* name of form servicetype/hostname@REALM, passed down by 27 * gss-proxy: */ 28 char *cr_raw_principal; 29 /* name of form servicetype@hostname, passed down by 30 * rpc.svcgssd, or computed from the above: */ 31 char *cr_principal; 32 struct gss_api_mech *cr_gss_mech; 33 }; 34 35 static inline void init_svc_cred(struct svc_cred *cred) 36 { 37 cred->cr_group_info = NULL; 38 cred->cr_raw_principal = NULL; 39 cred->cr_principal = NULL; 40 cred->cr_gss_mech = NULL; 41 } 42 43 static inline void free_svc_cred(struct svc_cred *cred) 44 { 45 if (cred->cr_group_info) 46 put_group_info(cred->cr_group_info); 47 kfree(cred->cr_raw_principal); 48 kfree(cred->cr_principal); 49 gss_mech_put(cred->cr_gss_mech); 50 init_svc_cred(cred); 51 } 52 53 struct svc_rqst; /* forward decl */ 54 struct in6_addr; 55 56 /* Authentication is done in the context of a domain. 57 * 58 * Currently, the nfs server uses the auth_domain to stand 59 * for the "client" listed in /etc/exports. 60 * 61 * More generally, a domain might represent a group of clients using 62 * a common mechanism for authentication and having a common mapping 63 * between local identity (uid) and network identity. All clients 64 * in a domain have similar general access rights. Each domain can 65 * contain multiple principals which will have different specific right 66 * based on normal Discretionary Access Control. 67 * 68 * A domain is created by an authentication flavour module based on name 69 * only. Userspace then fills in detail on demand. 70 * 71 * In the case of auth_unix and auth_null, the auth_domain is also 72 * associated with entries in another cache representing the mapping 73 * of ip addresses to the given client. 74 */ 75 struct auth_domain { 76 struct kref ref; 77 struct hlist_node hash; 78 char *name; 79 struct auth_ops *flavour; 80 }; 81 82 /* 83 * Each authentication flavour registers an auth_ops 84 * structure. 85 * name is simply the name. 86 * flavour gives the auth flavour. It determines where the flavour is registered 87 * accept() is given a request and should verify it. 88 * It should inspect the authenticator and verifier, and possibly the data. 89 * If there is a problem with the authentication *authp should be set. 90 * The return value of accept() can indicate: 91 * OK - authorised. client and credential are set in rqstp. 92 * reqbuf points to arguments 93 * resbuf points to good place for results. verfier 94 * is (probably) already in place. Certainly space is 95 * reserved for it. 96 * DROP - simply drop the request. It may have been deferred 97 * GARBAGE - rpc garbage_args error 98 * SYSERR - rpc system_err error 99 * DENIED - authp holds reason for denial. 100 * COMPLETE - the reply is encoded already and ready to be sent; no 101 * further processing is necessary. (This is used for processing 102 * null procedure calls which are used to set up encryption 103 * contexts.) 104 * 105 * accept is passed the proc number so that it can accept NULL rpc requests 106 * even if it cannot authenticate the client (as is sometimes appropriate). 107 * 108 * release() is given a request after the procedure has been run. 109 * It should sign/encrypt the results if needed 110 * It should return: 111 * OK - the resbuf is ready to be sent 112 * DROP - the reply should be quitely dropped 113 * DENIED - authp holds a reason for MSG_DENIED 114 * SYSERR - rpc system_err 115 * 116 * domain_release() 117 * This call releases a domain. 118 * set_client() 119 * Givens a pending request (struct svc_rqst), finds and assigns 120 * an appropriate 'auth_domain' as the client. 121 */ 122 struct auth_ops { 123 char * name; 124 struct module *owner; 125 int flavour; 126 int (*accept)(struct svc_rqst *rq, __be32 *authp); 127 int (*release)(struct svc_rqst *rq); 128 void (*domain_release)(struct auth_domain *); 129 int (*set_client)(struct svc_rqst *rq); 130 }; 131 132 #define SVC_GARBAGE 1 133 #define SVC_SYSERR 2 134 #define SVC_VALID 3 135 #define SVC_NEGATIVE 4 136 #define SVC_OK 5 137 #define SVC_DROP 6 138 #define SVC_CLOSE 7 /* Like SVC_DROP, but request is definitely 139 * lost so if there is a tcp connection, it 140 * should be closed 141 */ 142 #define SVC_DENIED 8 143 #define SVC_PENDING 9 144 #define SVC_COMPLETE 10 145 146 struct svc_xprt; 147 148 extern int svc_authenticate(struct svc_rqst *rqstp, __be32 *authp); 149 extern int svc_authorise(struct svc_rqst *rqstp); 150 extern int svc_set_client(struct svc_rqst *rqstp); 151 extern int svc_auth_register(rpc_authflavor_t flavor, struct auth_ops *aops); 152 extern void svc_auth_unregister(rpc_authflavor_t flavor); 153 154 extern struct auth_domain *unix_domain_find(char *name); 155 extern void auth_domain_put(struct auth_domain *item); 156 extern int auth_unix_add_addr(struct net *net, struct in6_addr *addr, struct auth_domain *dom); 157 extern struct auth_domain *auth_domain_lookup(char *name, struct auth_domain *new); 158 extern struct auth_domain *auth_domain_find(char *name); 159 extern struct auth_domain *auth_unix_lookup(struct net *net, struct in6_addr *addr); 160 extern int auth_unix_forget_old(struct auth_domain *dom); 161 extern void svcauth_unix_purge(struct net *net); 162 extern void svcauth_unix_info_release(struct svc_xprt *xpt); 163 extern int svcauth_unix_set_client(struct svc_rqst *rqstp); 164 165 extern int unix_gid_cache_create(struct net *net); 166 extern void unix_gid_cache_destroy(struct net *net); 167 168 static inline unsigned long hash_str(char *name, int bits) 169 { 170 unsigned long hash = 0; 171 unsigned long l = 0; 172 int len = 0; 173 unsigned char c; 174 do { 175 if (unlikely(!(c = *name++))) { 176 c = (char)len; len = -1; 177 } 178 l = (l << 8) | c; 179 len++; 180 if ((len & (BITS_PER_LONG/8-1))==0) 181 hash = hash_long(hash^l, BITS_PER_LONG); 182 } while (len); 183 return hash >> (BITS_PER_LONG - bits); 184 } 185 186 static inline unsigned long hash_mem(char *buf, int length, int bits) 187 { 188 unsigned long hash = 0; 189 unsigned long l = 0; 190 int len = 0; 191 unsigned char c; 192 do { 193 if (len == length) { 194 c = (char)len; len = -1; 195 } else 196 c = *buf++; 197 l = (l << 8) | c; 198 len++; 199 if ((len & (BITS_PER_LONG/8-1))==0) 200 hash = hash_long(hash^l, BITS_PER_LONG); 201 } while (len); 202 return hash >> (BITS_PER_LONG - bits); 203 } 204 205 #endif /* __KERNEL__ */ 206 207 #endif /* _LINUX_SUNRPC_SVCAUTH_H_ */ 208