svcauth.h 5.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170
  1. /*
  2. * linux/include/linux/sunrpc/svcauth.h
  3. *
  4. * RPC server-side authentication stuff.
  5. *
  6. * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
  7. */
  8. #ifndef _LINUX_SUNRPC_SVCAUTH_H_
  9. #define _LINUX_SUNRPC_SVCAUTH_H_
  10. #ifdef __KERNEL__
  11. #include <linux/string.h>
  12. #include <linux/sunrpc/msg_prot.h>
  13. #include <linux/sunrpc/cache.h>
  14. #include <linux/hash.h>
  15. #define SVC_CRED_NGROUPS 32
  16. struct svc_cred {
  17. uid_t cr_uid;
  18. gid_t cr_gid;
  19. struct group_info *cr_group_info;
  20. };
  21. struct svc_rqst; /* forward decl */
  22. /* Authentication is done in the context of a domain.
  23. *
  24. * Currently, the nfs server uses the auth_domain to stand
  25. * for the "client" listed in /etc/exports.
  26. *
  27. * More generally, a domain might represent a group of clients using
  28. * a common mechanism for authentication and having a common mapping
  29. * between local identity (uid) and network identity. All clients
  30. * in a domain have similar general access rights. Each domain can
  31. * contain multiple principals which will have different specific right
  32. * based on normal Discretionary Access Control.
  33. *
  34. * A domain is created by an authentication flavour module based on name
  35. * only. Userspace then fills in detail on demand.
  36. *
  37. * In the case of auth_unix and auth_null, the auth_domain is also
  38. * associated with entries in another cache representing the mapping
  39. * of ip addresses to the given client.
  40. */
  41. struct auth_domain {
  42. struct kref ref;
  43. struct hlist_node hash;
  44. char *name;
  45. struct auth_ops *flavour;
  46. };
  47. /*
  48. * Each authentication flavour registers an auth_ops
  49. * structure.
  50. * name is simply the name.
  51. * flavour gives the auth flavour. It determines where the flavour is registered
  52. * accept() is given a request and should verify it.
  53. * It should inspect the authenticator and verifier, and possibly the data.
  54. * If there is a problem with the authentication *authp should be set.
  55. * The return value of accept() can indicate:
  56. * OK - authorised. client and credential are set in rqstp.
  57. * reqbuf points to arguments
  58. * resbuf points to good place for results. verfier
  59. * is (probably) already in place. Certainly space is
  60. * reserved for it.
  61. * DROP - simply drop the request. It may have been deferred
  62. * GARBAGE - rpc garbage_args error
  63. * SYSERR - rpc system_err error
  64. * DENIED - authp holds reason for denial.
  65. * COMPLETE - the reply is encoded already and ready to be sent; no
  66. * further processing is necessary. (This is used for processing
  67. * null procedure calls which are used to set up encryption
  68. * contexts.)
  69. *
  70. * accept is passed the proc number so that it can accept NULL rpc requests
  71. * even if it cannot authenticate the client (as is sometimes appropriate).
  72. *
  73. * release() is given a request after the procedure has been run.
  74. * It should sign/encrypt the results if needed
  75. * It should return:
  76. * OK - the resbuf is ready to be sent
  77. * DROP - the reply should be quitely dropped
  78. * DENIED - authp holds a reason for MSG_DENIED
  79. * SYSERR - rpc system_err
  80. *
  81. * domain_release()
  82. * This call releases a domain.
  83. * set_client()
  84. * Givens a pending request (struct svc_rqst), finds and assigns
  85. * an appropriate 'auth_domain' as the client.
  86. */
  87. struct auth_ops {
  88. char * name;
  89. struct module *owner;
  90. int flavour;
  91. int (*accept)(struct svc_rqst *rq, __be32 *authp);
  92. int (*release)(struct svc_rqst *rq);
  93. void (*domain_release)(struct auth_domain *);
  94. int (*set_client)(struct svc_rqst *rq);
  95. };
  96. #define SVC_GARBAGE 1
  97. #define SVC_SYSERR 2
  98. #define SVC_VALID 3
  99. #define SVC_NEGATIVE 4
  100. #define SVC_OK 5
  101. #define SVC_DROP 6
  102. #define SVC_DENIED 7
  103. #define SVC_PENDING 8
  104. #define SVC_COMPLETE 9
  105. extern int svc_authenticate(struct svc_rqst *rqstp, __be32 *authp);
  106. extern int svc_authorise(struct svc_rqst *rqstp);
  107. extern int svc_set_client(struct svc_rqst *rqstp);
  108. extern int svc_auth_register(rpc_authflavor_t flavor, struct auth_ops *aops);
  109. extern void svc_auth_unregister(rpc_authflavor_t flavor);
  110. extern struct auth_domain *unix_domain_find(char *name);
  111. extern void auth_domain_put(struct auth_domain *item);
  112. extern int auth_unix_add_addr(struct in_addr addr, struct auth_domain *dom);
  113. extern struct auth_domain *auth_domain_lookup(char *name, struct auth_domain *new);
  114. extern struct auth_domain *auth_domain_find(char *name);
  115. extern struct auth_domain *auth_unix_lookup(struct in_addr addr);
  116. extern int auth_unix_forget_old(struct auth_domain *dom);
  117. extern void svcauth_unix_purge(void);
  118. extern void svcauth_unix_info_release(void *);
  119. static inline unsigned long hash_str(char *name, int bits)
  120. {
  121. unsigned long hash = 0;
  122. unsigned long l = 0;
  123. int len = 0;
  124. unsigned char c;
  125. do {
  126. if (unlikely(!(c = *name++))) {
  127. c = (char)len; len = -1;
  128. }
  129. l = (l << 8) | c;
  130. len++;
  131. if ((len & (BITS_PER_LONG/8-1))==0)
  132. hash = hash_long(hash^l, BITS_PER_LONG);
  133. } while (len);
  134. return hash >> (BITS_PER_LONG - bits);
  135. }
  136. static inline unsigned long hash_mem(char *buf, int length, int bits)
  137. {
  138. unsigned long hash = 0;
  139. unsigned long l = 0;
  140. int len = 0;
  141. unsigned char c;
  142. do {
  143. if (len == length) {
  144. c = (char)len; len = -1;
  145. } else
  146. c = *buf++;
  147. l = (l << 8) | c;
  148. len++;
  149. if ((len & (BITS_PER_LONG/8-1))==0)
  150. hash = hash_long(hash^l, BITS_PER_LONG);
  151. } while (len);
  152. return hash >> (BITS_PER_LONG - bits);
  153. }
  154. #endif /* __KERNEL__ */
  155. #endif /* _LINUX_SUNRPC_SVCAUTH_H_ */