1 /* 2 * linux/include/linux/sunrpc/svcauth.h 3 * 4 * RPC server-side authentication stuff. 5 * 6 * Copyright (C) 1995, 1996 Olaf Kirch <[email protected]> 7 */ 8 9 #ifndef _LINUX_SUNRPC_SVCAUTH_H_ 10 #define _LINUX_SUNRPC_SVCAUTH_H_ 11 12 #ifdef __KERNEL__ 13 14 #include <linux/string.h> 15 #include <linux/sunrpc/msg_prot.h> 16 #include <linux/sunrpc/cache.h> 17 #include <linux/hash.h> 18 #include <linux/cred.h> 19 20 struct svc_cred { 21 uid_t cr_uid; 22 gid_t cr_gid; 23 struct group_info *cr_group_info; 24 u32 cr_flavor; /* pseudoflavor */ 25 char *cr_principal; /* for gss */ 26 }; 27 28 static inline void free_svc_cred(struct svc_cred *cred) 29 { 30 if (cred->cr_group_info) 31 put_group_info(cred->cr_group_info); 32 kfree(cred->cr_principal); 33 } 34 35 struct svc_rqst; /* forward decl */ 36 struct in6_addr; 37 38 /* Authentication is done in the context of a domain. 39 * 40 * Currently, the nfs server uses the auth_domain to stand 41 * for the "client" listed in /etc/exports. 42 * 43 * More generally, a domain might represent a group of clients using 44 * a common mechanism for authentication and having a common mapping 45 * between local identity (uid) and network identity. All clients 46 * in a domain have similar general access rights. Each domain can 47 * contain multiple principals which will have different specific right 48 * based on normal Discretionary Access Control. 49 * 50 * A domain is created by an authentication flavour module based on name 51 * only. Userspace then fills in detail on demand. 52 * 53 * In the case of auth_unix and auth_null, the auth_domain is also 54 * associated with entries in another cache representing the mapping 55 * of ip addresses to the given client. 56 */ 57 struct auth_domain { 58 struct kref ref; 59 struct hlist_node hash; 60 char *name; 61 struct auth_ops *flavour; 62 }; 63 64 /* 65 * Each authentication flavour registers an auth_ops 66 * structure. 67 * name is simply the name. 68 * flavour gives the auth flavour. It determines where the flavour is registered 69 * accept() is given a request and should verify it. 70 * It should inspect the authenticator and verifier, and possibly the data. 71 * If there is a problem with the authentication *authp should be set. 72 * The return value of accept() can indicate: 73 * OK - authorised. client and credential are set in rqstp. 74 * reqbuf points to arguments 75 * resbuf points to good place for results. verfier 76 * is (probably) already in place. Certainly space is 77 * reserved for it. 78 * DROP - simply drop the request. It may have been deferred 79 * GARBAGE - rpc garbage_args error 80 * SYSERR - rpc system_err error 81 * DENIED - authp holds reason for denial. 82 * COMPLETE - the reply is encoded already and ready to be sent; no 83 * further processing is necessary. (This is used for processing 84 * null procedure calls which are used to set up encryption 85 * contexts.) 86 * 87 * accept is passed the proc number so that it can accept NULL rpc requests 88 * even if it cannot authenticate the client (as is sometimes appropriate). 89 * 90 * release() is given a request after the procedure has been run. 91 * It should sign/encrypt the results if needed 92 * It should return: 93 * OK - the resbuf is ready to be sent 94 * DROP - the reply should be quitely dropped 95 * DENIED - authp holds a reason for MSG_DENIED 96 * SYSERR - rpc system_err 97 * 98 * domain_release() 99 * This call releases a domain. 100 * set_client() 101 * Givens a pending request (struct svc_rqst), finds and assigns 102 * an appropriate 'auth_domain' as the client. 103 */ 104 struct auth_ops { 105 char * name; 106 struct module *owner; 107 int flavour; 108 int (*accept)(struct svc_rqst *rq, __be32 *authp); 109 int (*release)(struct svc_rqst *rq); 110 void (*domain_release)(struct auth_domain *); 111 int (*set_client)(struct svc_rqst *rq); 112 }; 113 114 #define SVC_GARBAGE 1 115 #define SVC_SYSERR 2 116 #define SVC_VALID 3 117 #define SVC_NEGATIVE 4 118 #define SVC_OK 5 119 #define SVC_DROP 6 120 #define SVC_CLOSE 7 /* Like SVC_DROP, but request is definitely 121 * lost so if there is a tcp connection, it 122 * should be closed 123 */ 124 #define SVC_DENIED 8 125 #define SVC_PENDING 9 126 #define SVC_COMPLETE 10 127 128 struct svc_xprt; 129 130 extern int svc_authenticate(struct svc_rqst *rqstp, __be32 *authp); 131 extern int svc_authorise(struct svc_rqst *rqstp); 132 extern int svc_set_client(struct svc_rqst *rqstp); 133 extern int svc_auth_register(rpc_authflavor_t flavor, struct auth_ops *aops); 134 extern void svc_auth_unregister(rpc_authflavor_t flavor); 135 136 extern struct auth_domain *unix_domain_find(char *name); 137 extern void auth_domain_put(struct auth_domain *item); 138 extern int auth_unix_add_addr(struct net *net, struct in6_addr *addr, struct auth_domain *dom); 139 extern struct auth_domain *auth_domain_lookup(char *name, struct auth_domain *new); 140 extern struct auth_domain *auth_domain_find(char *name); 141 extern struct auth_domain *auth_unix_lookup(struct net *net, struct in6_addr *addr); 142 extern int auth_unix_forget_old(struct auth_domain *dom); 143 extern void svcauth_unix_purge(struct net *net); 144 extern void svcauth_unix_info_release(struct svc_xprt *xpt); 145 extern int svcauth_unix_set_client(struct svc_rqst *rqstp); 146 147 extern int unix_gid_cache_create(struct net *net); 148 extern void unix_gid_cache_destroy(struct net *net); 149 150 static inline unsigned long hash_str(char *name, int bits) 151 { 152 unsigned long hash = 0; 153 unsigned long l = 0; 154 int len = 0; 155 unsigned char c; 156 do { 157 if (unlikely(!(c = *name++))) { 158 c = (char)len; len = -1; 159 } 160 l = (l << 8) | c; 161 len++; 162 if ((len & (BITS_PER_LONG/8-1))==0) 163 hash = hash_long(hash^l, BITS_PER_LONG); 164 } while (len); 165 return hash >> (BITS_PER_LONG - bits); 166 } 167 168 static inline unsigned long hash_mem(char *buf, int length, int bits) 169 { 170 unsigned long hash = 0; 171 unsigned long l = 0; 172 int len = 0; 173 unsigned char c; 174 do { 175 if (len == length) { 176 c = (char)len; len = -1; 177 } else 178 c = *buf++; 179 l = (l << 8) | c; 180 len++; 181 if ((len & (BITS_PER_LONG/8-1))==0) 182 hash = hash_long(hash^l, BITS_PER_LONG); 183 } while (len); 184 return hash >> (BITS_PER_LONG - bits); 185 } 186 187 #endif /* __KERNEL__ */ 188 189 #endif /* _LINUX_SUNRPC_SVCAUTH_H_ */ 190