~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/include/linux/sunrpc/svcauth.h

Version: ~ [ linux-5.6 ] ~ [ linux-5.5.13 ] ~ [ linux-5.4.28 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.113 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.174 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.217 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.217 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.82 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * linux/include/linux/sunrpc/svcauth.h
  3  *
  4  * RPC server-side authentication stuff.
  5  *
  6  * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
  7  */
  8 
  9 #ifndef _LINUX_SUNRPC_SVCAUTH_H_
 10 #define _LINUX_SUNRPC_SVCAUTH_H_
 11 
 12 #ifdef __KERNEL__
 13 
 14 #include <linux/string.h>
 15 #include <linux/sunrpc/msg_prot.h>
 16 #include <linux/sunrpc/cache.h>
 17 #include <linux/sunrpc/gss_api.h>
 18 #include <linux/hash.h>
 19 #include <linux/cred.h>
 20 
 21 struct svc_cred {
 22         kuid_t                  cr_uid;
 23         kgid_t                  cr_gid;
 24         struct group_info       *cr_group_info;
 25         u32                     cr_flavor; /* pseudoflavor */
 26         /* name of form servicetype/hostname@REALM, passed down by
 27          * gss-proxy: */
 28         char                    *cr_raw_principal;
 29         /* name of form servicetype@hostname, passed down by
 30          * rpc.svcgssd, or computed from the above: */
 31         char                    *cr_principal;
 32         struct gss_api_mech     *cr_gss_mech;
 33 };
 34 
 35 static inline void init_svc_cred(struct svc_cred *cred)
 36 {
 37         cred->cr_group_info = NULL;
 38         cred->cr_raw_principal = NULL;
 39         cred->cr_principal = NULL;
 40         cred->cr_gss_mech = NULL;
 41 }
 42 
 43 static inline void free_svc_cred(struct svc_cred *cred)
 44 {
 45         if (cred->cr_group_info)
 46                 put_group_info(cred->cr_group_info);
 47         kfree(cred->cr_raw_principal);
 48         kfree(cred->cr_principal);
 49         gss_mech_put(cred->cr_gss_mech);
 50         init_svc_cred(cred);
 51 }
 52 
 53 struct svc_rqst;                /* forward decl */
 54 struct in6_addr;
 55 
 56 /* Authentication is done in the context of a domain.
 57  *
 58  * Currently, the nfs server uses the auth_domain to stand
 59  * for the "client" listed in /etc/exports.
 60  *
 61  * More generally, a domain might represent a group of clients using
 62  * a common mechanism for authentication and having a common mapping
 63  * between local identity (uid) and network identity.  All clients
 64  * in a domain have similar general access rights.  Each domain can
 65  * contain multiple principals which will have different specific right
 66  * based on normal Discretionary Access Control.
 67  *
 68  * A domain is created by an authentication flavour module based on name
 69  * only.  Userspace then fills in detail on demand.
 70  *
 71  * In the case of auth_unix and auth_null, the auth_domain is also
 72  * associated with entries in another cache representing the mapping
 73  * of ip addresses to the given client.
 74  */
 75 struct auth_domain {
 76         struct kref             ref;
 77         struct hlist_node       hash;
 78         char                    *name;
 79         struct auth_ops         *flavour;
 80 };
 81 
 82 /*
 83  * Each authentication flavour registers an auth_ops
 84  * structure.
 85  * name is simply the name.
 86  * flavour gives the auth flavour. It determines where the flavour is registered
 87  * accept() is given a request and should verify it.
 88  *   It should inspect the authenticator and verifier, and possibly the data.
 89  *    If there is a problem with the authentication *authp should be set.
 90  *    The return value of accept() can indicate:
 91  *      OK - authorised. client and credential are set in rqstp.
 92  *           reqbuf points to arguments
 93  *           resbuf points to good place for results.  verfier
 94  *             is (probably) already in place.  Certainly space is
 95  *             reserved for it.
 96  *      DROP - simply drop the request. It may have been deferred
 97  *      GARBAGE - rpc garbage_args error
 98  *      SYSERR - rpc system_err error
 99  *      DENIED - authp holds reason for denial.
100  *      COMPLETE - the reply is encoded already and ready to be sent; no
101  *              further processing is necessary.  (This is used for processing
102  *              null procedure calls which are used to set up encryption
103  *              contexts.)
104  *
105  *   accept is passed the proc number so that it can accept NULL rpc requests
106  *   even if it cannot authenticate the client (as is sometimes appropriate).
107  *
108  * release() is given a request after the procedure has been run.
109  *  It should sign/encrypt the results if needed
110  * It should return:
111  *    OK - the resbuf is ready to be sent
112  *    DROP - the reply should be quitely dropped
113  *    DENIED - authp holds a reason for MSG_DENIED
114  *    SYSERR - rpc system_err
115  *
116  * domain_release()
117  *   This call releases a domain.
118  * set_client()
119  *   Givens a pending request (struct svc_rqst), finds and assigns
120  *   an appropriate 'auth_domain' as the client.
121  */
122 struct auth_ops {
123         char *  name;
124         struct module *owner;
125         int     flavour;
126         int     (*accept)(struct svc_rqst *rq, __be32 *authp);
127         int     (*release)(struct svc_rqst *rq);
128         void    (*domain_release)(struct auth_domain *);
129         int     (*set_client)(struct svc_rqst *rq);
130 };
131 
132 #define SVC_GARBAGE     1
133 #define SVC_SYSERR      2
134 #define SVC_VALID       3
135 #define SVC_NEGATIVE    4
136 #define SVC_OK          5
137 #define SVC_DROP        6
138 #define SVC_CLOSE       7       /* Like SVC_DROP, but request is definitely
139                                  * lost so if there is a tcp connection, it
140                                  * should be closed
141                                  */
142 #define SVC_DENIED      8
143 #define SVC_PENDING     9
144 #define SVC_COMPLETE    10
145 
146 struct svc_xprt;
147 
148 extern int      svc_authenticate(struct svc_rqst *rqstp, __be32 *authp);
149 extern int      svc_authorise(struct svc_rqst *rqstp);
150 extern int      svc_set_client(struct svc_rqst *rqstp);
151 extern int      svc_auth_register(rpc_authflavor_t flavor, struct auth_ops *aops);
152 extern void     svc_auth_unregister(rpc_authflavor_t flavor);
153 
154 extern struct auth_domain *unix_domain_find(char *name);
155 extern void auth_domain_put(struct auth_domain *item);
156 extern int auth_unix_add_addr(struct net *net, struct in6_addr *addr, struct auth_domain *dom);
157 extern struct auth_domain *auth_domain_lookup(char *name, struct auth_domain *new);
158 extern struct auth_domain *auth_domain_find(char *name);
159 extern struct auth_domain *auth_unix_lookup(struct net *net, struct in6_addr *addr);
160 extern int auth_unix_forget_old(struct auth_domain *dom);
161 extern void svcauth_unix_purge(struct net *net);
162 extern void svcauth_unix_info_release(struct svc_xprt *xpt);
163 extern int svcauth_unix_set_client(struct svc_rqst *rqstp);
164 
165 extern int unix_gid_cache_create(struct net *net);
166 extern void unix_gid_cache_destroy(struct net *net);
167 
168 static inline unsigned long hash_str(char *name, int bits)
169 {
170         unsigned long hash = 0;
171         unsigned long l = 0;
172         int len = 0;
173         unsigned char c;
174         do {
175                 if (unlikely(!(c = *name++))) {
176                         c = (char)len; len = -1;
177                 }
178                 l = (l << 8) | c;
179                 len++;
180                 if ((len & (BITS_PER_LONG/8-1))==0)
181                         hash = hash_long(hash^l, BITS_PER_LONG);
182         } while (len);
183         return hash >> (BITS_PER_LONG - bits);
184 }
185 
186 static inline unsigned long hash_mem(char *buf, int length, int bits)
187 {
188         unsigned long hash = 0;
189         unsigned long l = 0;
190         int len = 0;
191         unsigned char c;
192         do {
193                 if (len == length) {
194                         c = (char)len; len = -1;
195                 } else
196                         c = *buf++;
197                 l = (l << 8) | c;
198                 len++;
199                 if ((len & (BITS_PER_LONG/8-1))==0)
200                         hash = hash_long(hash^l, BITS_PER_LONG);
201         } while (len);
202         return hash >> (BITS_PER_LONG - bits);
203 }
204 
205 #endif /* __KERNEL__ */
206 
207 #endif /* _LINUX_SUNRPC_SVCAUTH_H_ */
208 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp