Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1/*
2 * linux/include/linux/sunrpc/svcauth.h
3 *
4 * RPC server-side authentication stuff.
5 *
6 * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
7 */
8
9#ifndef _LINUX_SUNRPC_SVCAUTH_H_
10#define _LINUX_SUNRPC_SVCAUTH_H_
11
12#ifdef __KERNEL__
13
14#include <linux/string.h>
15#include <linux/sunrpc/msg_prot.h>
16#include <linux/sunrpc/cache.h>
17#include <linux/hash.h>
18#include <linux/cred.h>
19
20struct svc_cred {
21 kuid_t cr_uid;
22 kgid_t cr_gid;
23 struct group_info *cr_group_info;
24 u32 cr_flavor; /* pseudoflavor */
25 char *cr_principal; /* for gss */
26};
27
28static inline void free_svc_cred(struct svc_cred *cred)
29{
30 if (cred->cr_group_info)
31 put_group_info(cred->cr_group_info);
32 kfree(cred->cr_principal);
33}
34
35struct svc_rqst; /* forward decl */
36struct in6_addr;
37
38/* Authentication is done in the context of a domain.
39 *
40 * Currently, the nfs server uses the auth_domain to stand
41 * for the "client" listed in /etc/exports.
42 *
43 * More generally, a domain might represent a group of clients using
44 * a common mechanism for authentication and having a common mapping
45 * between local identity (uid) and network identity. All clients
46 * in a domain have similar general access rights. Each domain can
47 * contain multiple principals which will have different specific right
48 * based on normal Discretionary Access Control.
49 *
50 * A domain is created by an authentication flavour module based on name
51 * only. Userspace then fills in detail on demand.
52 *
53 * In the case of auth_unix and auth_null, the auth_domain is also
54 * associated with entries in another cache representing the mapping
55 * of ip addresses to the given client.
56 */
57struct auth_domain {
58 struct kref ref;
59 struct hlist_node hash;
60 char *name;
61 struct auth_ops *flavour;
62};
63
64/*
65 * Each authentication flavour registers an auth_ops
66 * structure.
67 * name is simply the name.
68 * flavour gives the auth flavour. It determines where the flavour is registered
69 * accept() is given a request and should verify it.
70 * It should inspect the authenticator and verifier, and possibly the data.
71 * If there is a problem with the authentication *authp should be set.
72 * The return value of accept() can indicate:
73 * OK - authorised. client and credential are set in rqstp.
74 * reqbuf points to arguments
75 * resbuf points to good place for results. verfier
76 * is (probably) already in place. Certainly space is
77 * reserved for it.
78 * DROP - simply drop the request. It may have been deferred
79 * GARBAGE - rpc garbage_args error
80 * SYSERR - rpc system_err error
81 * DENIED - authp holds reason for denial.
82 * COMPLETE - the reply is encoded already and ready to be sent; no
83 * further processing is necessary. (This is used for processing
84 * null procedure calls which are used to set up encryption
85 * contexts.)
86 *
87 * accept is passed the proc number so that it can accept NULL rpc requests
88 * even if it cannot authenticate the client (as is sometimes appropriate).
89 *
90 * release() is given a request after the procedure has been run.
91 * It should sign/encrypt the results if needed
92 * It should return:
93 * OK - the resbuf is ready to be sent
94 * DROP - the reply should be quitely dropped
95 * DENIED - authp holds a reason for MSG_DENIED
96 * SYSERR - rpc system_err
97 *
98 * domain_release()
99 * This call releases a domain.
100 * set_client()
101 * Givens a pending request (struct svc_rqst), finds and assigns
102 * an appropriate 'auth_domain' as the client.
103 */
104struct auth_ops {
105 char * name;
106 struct module *owner;
107 int flavour;
108 int (*accept)(struct svc_rqst *rq, __be32 *authp);
109 int (*release)(struct svc_rqst *rq);
110 void (*domain_release)(struct auth_domain *);
111 int (*set_client)(struct svc_rqst *rq);
112};
113
114#define SVC_GARBAGE 1
115#define SVC_SYSERR 2
116#define SVC_VALID 3
117#define SVC_NEGATIVE 4
118#define SVC_OK 5
119#define SVC_DROP 6
120#define SVC_CLOSE 7 /* Like SVC_DROP, but request is definitely
121 * lost so if there is a tcp connection, it
122 * should be closed
123 */
124#define SVC_DENIED 8
125#define SVC_PENDING 9
126#define SVC_COMPLETE 10
127
128struct svc_xprt;
129
130extern int svc_authenticate(struct svc_rqst *rqstp, __be32 *authp);
131extern int svc_authorise(struct svc_rqst *rqstp);
132extern int svc_set_client(struct svc_rqst *rqstp);
133extern int svc_auth_register(rpc_authflavor_t flavor, struct auth_ops *aops);
134extern void svc_auth_unregister(rpc_authflavor_t flavor);
135
136extern struct auth_domain *unix_domain_find(char *name);
137extern void auth_domain_put(struct auth_domain *item);
138extern int auth_unix_add_addr(struct net *net, struct in6_addr *addr, struct auth_domain *dom);
139extern struct auth_domain *auth_domain_lookup(char *name, struct auth_domain *new);
140extern struct auth_domain *auth_domain_find(char *name);
141extern struct auth_domain *auth_unix_lookup(struct net *net, struct in6_addr *addr);
142extern int auth_unix_forget_old(struct auth_domain *dom);
143extern void svcauth_unix_purge(struct net *net);
144extern void svcauth_unix_info_release(struct svc_xprt *xpt);
145extern int svcauth_unix_set_client(struct svc_rqst *rqstp);
146
147extern int unix_gid_cache_create(struct net *net);
148extern void unix_gid_cache_destroy(struct net *net);
149
150static inline unsigned long hash_str(char *name, int bits)
151{
152 unsigned long hash = 0;
153 unsigned long l = 0;
154 int len = 0;
155 unsigned char c;
156 do {
157 if (unlikely(!(c = *name++))) {
158 c = (char)len; len = -1;
159 }
160 l = (l << 8) | c;
161 len++;
162 if ((len & (BITS_PER_LONG/8-1))==0)
163 hash = hash_long(hash^l, BITS_PER_LONG);
164 } while (len);
165 return hash >> (BITS_PER_LONG - bits);
166}
167
168static inline unsigned long hash_mem(char *buf, int length, int bits)
169{
170 unsigned long hash = 0;
171 unsigned long l = 0;
172 int len = 0;
173 unsigned char c;
174 do {
175 if (len == length) {
176 c = (char)len; len = -1;
177 } else
178 c = *buf++;
179 l = (l << 8) | c;
180 len++;
181 if ((len & (BITS_PER_LONG/8-1))==0)
182 hash = hash_long(hash^l, BITS_PER_LONG);
183 } while (len);
184 return hash >> (BITS_PER_LONG - bits);
185}
186
187#endif /* __KERNEL__ */
188
189#endif /* _LINUX_SUNRPC_SVCAUTH_H_ */