~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/include/linux/sunrpc/svcauth.h

Version: ~ [ linux-5.7-rc7 ] ~ [ linux-5.6.14 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.42 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.124 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.181 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.224 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.224 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.84 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * linux/include/linux/sunrpc/svcauth.h
  3  *
  4  * RPC server-side authentication stuff.
  5  *
  6  * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
  7  */
  8 
  9 #ifndef _LINUX_SUNRPC_SVCAUTH_H_
 10 #define _LINUX_SUNRPC_SVCAUTH_H_
 11 
 12 #ifdef __KERNEL__
 13 
 14 #include <linux/string.h>
 15 #include <linux/sunrpc/msg_prot.h>
 16 #include <linux/sunrpc/cache.h>
 17 #include <linux/sunrpc/gss_api.h>
 18 #include <linux/hash.h>
 19 #include <linux/cred.h>
 20 
 21 struct svc_cred {
 22         kuid_t                  cr_uid;
 23         kgid_t                  cr_gid;
 24         struct group_info       *cr_group_info;
 25         u32                     cr_flavor; /* pseudoflavor */
 26         char                    *cr_principal; /* for gss */
 27         struct gss_api_mech     *cr_gss_mech;
 28 };
 29 
 30 static inline void init_svc_cred(struct svc_cred *cred)
 31 {
 32         cred->cr_group_info = NULL;
 33         cred->cr_principal = NULL;
 34         cred->cr_gss_mech = NULL;
 35 }
 36 
 37 static inline void free_svc_cred(struct svc_cred *cred)
 38 {
 39         if (cred->cr_group_info)
 40                 put_group_info(cred->cr_group_info);
 41         kfree(cred->cr_principal);
 42         gss_mech_put(cred->cr_gss_mech);
 43         init_svc_cred(cred);
 44 }
 45 
 46 struct svc_rqst;                /* forward decl */
 47 struct in6_addr;
 48 
 49 /* Authentication is done in the context of a domain.
 50  *
 51  * Currently, the nfs server uses the auth_domain to stand
 52  * for the "client" listed in /etc/exports.
 53  *
 54  * More generally, a domain might represent a group of clients using
 55  * a common mechanism for authentication and having a common mapping
 56  * between local identity (uid) and network identity.  All clients
 57  * in a domain have similar general access rights.  Each domain can
 58  * contain multiple principals which will have different specific right
 59  * based on normal Discretionary Access Control.
 60  *
 61  * A domain is created by an authentication flavour module based on name
 62  * only.  Userspace then fills in detail on demand.
 63  *
 64  * In the case of auth_unix and auth_null, the auth_domain is also
 65  * associated with entries in another cache representing the mapping
 66  * of ip addresses to the given client.
 67  */
 68 struct auth_domain {
 69         struct kref             ref;
 70         struct hlist_node       hash;
 71         char                    *name;
 72         struct auth_ops         *flavour;
 73 };
 74 
 75 /*
 76  * Each authentication flavour registers an auth_ops
 77  * structure.
 78  * name is simply the name.
 79  * flavour gives the auth flavour. It determines where the flavour is registered
 80  * accept() is given a request and should verify it.
 81  *   It should inspect the authenticator and verifier, and possibly the data.
 82  *    If there is a problem with the authentication *authp should be set.
 83  *    The return value of accept() can indicate:
 84  *      OK - authorised. client and credential are set in rqstp.
 85  *           reqbuf points to arguments
 86  *           resbuf points to good place for results.  verfier
 87  *             is (probably) already in place.  Certainly space is
 88  *             reserved for it.
 89  *      DROP - simply drop the request. It may have been deferred
 90  *      GARBAGE - rpc garbage_args error
 91  *      SYSERR - rpc system_err error
 92  *      DENIED - authp holds reason for denial.
 93  *      COMPLETE - the reply is encoded already and ready to be sent; no
 94  *              further processing is necessary.  (This is used for processing
 95  *              null procedure calls which are used to set up encryption
 96  *              contexts.)
 97  *
 98  *   accept is passed the proc number so that it can accept NULL rpc requests
 99  *   even if it cannot authenticate the client (as is sometimes appropriate).
100  *
101  * release() is given a request after the procedure has been run.
102  *  It should sign/encrypt the results if needed
103  * It should return:
104  *    OK - the resbuf is ready to be sent
105  *    DROP - the reply should be quitely dropped
106  *    DENIED - authp holds a reason for MSG_DENIED
107  *    SYSERR - rpc system_err
108  *
109  * domain_release()
110  *   This call releases a domain.
111  * set_client()
112  *   Givens a pending request (struct svc_rqst), finds and assigns
113  *   an appropriate 'auth_domain' as the client.
114  */
115 struct auth_ops {
116         char *  name;
117         struct module *owner;
118         int     flavour;
119         int     (*accept)(struct svc_rqst *rq, __be32 *authp);
120         int     (*release)(struct svc_rqst *rq);
121         void    (*domain_release)(struct auth_domain *);
122         int     (*set_client)(struct svc_rqst *rq);
123 };
124 
125 #define SVC_GARBAGE     1
126 #define SVC_SYSERR      2
127 #define SVC_VALID       3
128 #define SVC_NEGATIVE    4
129 #define SVC_OK          5
130 #define SVC_DROP        6
131 #define SVC_CLOSE       7       /* Like SVC_DROP, but request is definitely
132                                  * lost so if there is a tcp connection, it
133                                  * should be closed
134                                  */
135 #define SVC_DENIED      8
136 #define SVC_PENDING     9
137 #define SVC_COMPLETE    10
138 
139 struct svc_xprt;
140 
141 extern int      svc_authenticate(struct svc_rqst *rqstp, __be32 *authp);
142 extern int      svc_authorise(struct svc_rqst *rqstp);
143 extern int      svc_set_client(struct svc_rqst *rqstp);
144 extern int      svc_auth_register(rpc_authflavor_t flavor, struct auth_ops *aops);
145 extern void     svc_auth_unregister(rpc_authflavor_t flavor);
146 
147 extern struct auth_domain *unix_domain_find(char *name);
148 extern void auth_domain_put(struct auth_domain *item);
149 extern int auth_unix_add_addr(struct net *net, struct in6_addr *addr, struct auth_domain *dom);
150 extern struct auth_domain *auth_domain_lookup(char *name, struct auth_domain *new);
151 extern struct auth_domain *auth_domain_find(char *name);
152 extern struct auth_domain *auth_unix_lookup(struct net *net, struct in6_addr *addr);
153 extern int auth_unix_forget_old(struct auth_domain *dom);
154 extern void svcauth_unix_purge(struct net *net);
155 extern void svcauth_unix_info_release(struct svc_xprt *xpt);
156 extern int svcauth_unix_set_client(struct svc_rqst *rqstp);
157 
158 extern int unix_gid_cache_create(struct net *net);
159 extern void unix_gid_cache_destroy(struct net *net);
160 
161 static inline unsigned long hash_str(char *name, int bits)
162 {
163         unsigned long hash = 0;
164         unsigned long l = 0;
165         int len = 0;
166         unsigned char c;
167         do {
168                 if (unlikely(!(c = *name++))) {
169                         c = (char)len; len = -1;
170                 }
171                 l = (l << 8) | c;
172                 len++;
173                 if ((len & (BITS_PER_LONG/8-1))==0)
174                         hash = hash_long(hash^l, BITS_PER_LONG);
175         } while (len);
176         return hash >> (BITS_PER_LONG - bits);
177 }
178 
179 static inline unsigned long hash_mem(char *buf, int length, int bits)
180 {
181         unsigned long hash = 0;
182         unsigned long l = 0;
183         int len = 0;
184         unsigned char c;
185         do {
186                 if (len == length) {
187                         c = (char)len; len = -1;
188                 } else
189                         c = *buf++;
190                 l = (l << 8) | c;
191                 len++;
192                 if ((len & (BITS_PER_LONG/8-1))==0)
193                         hash = hash_long(hash^l, BITS_PER_LONG);
194         } while (len);
195         return hash >> (BITS_PER_LONG - bits);
196 }
197 
198 #endif /* __KERNEL__ */
199 
200 #endif /* _LINUX_SUNRPC_SVCAUTH_H_ */
201 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp