11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * linux/net/sunrpc/gss_mech_switch.c 31da177e4SLinus Torvalds * 41da177e4SLinus Torvalds * Copyright (c) 2001 The Regents of the University of Michigan. 51da177e4SLinus Torvalds * All rights reserved. 61da177e4SLinus Torvalds * 71da177e4SLinus Torvalds * J. Bruce Fields <bfields@umich.edu> 81da177e4SLinus Torvalds * 91da177e4SLinus Torvalds * Redistribution and use in source and binary forms, with or without 101da177e4SLinus Torvalds * modification, are permitted provided that the following conditions 111da177e4SLinus Torvalds * are met: 121da177e4SLinus Torvalds * 131da177e4SLinus Torvalds * 1. Redistributions of source code must retain the above copyright 141da177e4SLinus Torvalds * notice, this list of conditions and the following disclaimer. 151da177e4SLinus Torvalds * 2. Redistributions in binary form must reproduce the above copyright 161da177e4SLinus Torvalds * notice, this list of conditions and the following disclaimer in the 171da177e4SLinus Torvalds * documentation and/or other materials provided with the distribution. 181da177e4SLinus Torvalds * 3. Neither the name of the University nor the names of its 191da177e4SLinus Torvalds * contributors may be used to endorse or promote products derived 201da177e4SLinus Torvalds * from this software without specific prior written permission. 211da177e4SLinus Torvalds * 221da177e4SLinus Torvalds * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED 231da177e4SLinus Torvalds * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 241da177e4SLinus Torvalds * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 251da177e4SLinus Torvalds * DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 261da177e4SLinus Torvalds * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 271da177e4SLinus Torvalds * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 281da177e4SLinus Torvalds * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR 291da177e4SLinus Torvalds * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 301da177e4SLinus Torvalds * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 311da177e4SLinus Torvalds * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 321da177e4SLinus Torvalds * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 331da177e4SLinus Torvalds * 341da177e4SLinus Torvalds */ 351da177e4SLinus Torvalds 361da177e4SLinus Torvalds #include <linux/types.h> 371da177e4SLinus Torvalds #include <linux/slab.h> 381da177e4SLinus Torvalds #include <linux/module.h> 391da177e4SLinus Torvalds #include <linux/sunrpc/msg_prot.h> 401da177e4SLinus Torvalds #include <linux/sunrpc/gss_asn1.h> 411da177e4SLinus Torvalds #include <linux/sunrpc/auth_gss.h> 421da177e4SLinus Torvalds #include <linux/sunrpc/svcauth_gss.h> 431da177e4SLinus Torvalds #include <linux/sunrpc/gss_err.h> 441da177e4SLinus Torvalds #include <linux/sunrpc/sched.h> 451da177e4SLinus Torvalds #include <linux/sunrpc/gss_api.h> 461da177e4SLinus Torvalds #include <linux/sunrpc/clnt.h> 471da177e4SLinus Torvalds 481da177e4SLinus Torvalds #ifdef RPC_DEBUG 491da177e4SLinus Torvalds # define RPCDBG_FACILITY RPCDBG_AUTH 501da177e4SLinus Torvalds #endif 511da177e4SLinus Torvalds 521da177e4SLinus Torvalds static LIST_HEAD(registered_mechs); 531da177e4SLinus Torvalds static DEFINE_SPINLOCK(registered_mechs_lock); 541da177e4SLinus Torvalds 551da177e4SLinus Torvalds static void 561da177e4SLinus Torvalds gss_mech_free(struct gss_api_mech *gm) 571da177e4SLinus Torvalds { 581da177e4SLinus Torvalds struct pf_desc *pf; 591da177e4SLinus Torvalds int i; 601da177e4SLinus Torvalds 611da177e4SLinus Torvalds for (i = 0; i < gm->gm_pf_num; i++) { 621da177e4SLinus Torvalds pf = &gm->gm_pfs[i]; 631da177e4SLinus Torvalds kfree(pf->auth_domain_name); 641da177e4SLinus Torvalds pf->auth_domain_name = NULL; 651da177e4SLinus Torvalds } 661da177e4SLinus Torvalds } 671da177e4SLinus Torvalds 681da177e4SLinus Torvalds static inline char * 691da177e4SLinus Torvalds make_auth_domain_name(char *name) 701da177e4SLinus Torvalds { 711da177e4SLinus Torvalds static char *prefix = "gss/"; 721da177e4SLinus Torvalds char *new; 731da177e4SLinus Torvalds 741da177e4SLinus Torvalds new = kmalloc(strlen(name) + strlen(prefix) + 1, GFP_KERNEL); 751da177e4SLinus Torvalds if (new) { 761da177e4SLinus Torvalds strcpy(new, prefix); 771da177e4SLinus Torvalds strcat(new, name); 781da177e4SLinus Torvalds } 791da177e4SLinus Torvalds return new; 801da177e4SLinus Torvalds } 811da177e4SLinus Torvalds 821da177e4SLinus Torvalds static int 831da177e4SLinus Torvalds gss_mech_svc_setup(struct gss_api_mech *gm) 841da177e4SLinus Torvalds { 851da177e4SLinus Torvalds struct pf_desc *pf; 861da177e4SLinus Torvalds int i, status; 871da177e4SLinus Torvalds 881da177e4SLinus Torvalds for (i = 0; i < gm->gm_pf_num; i++) { 891da177e4SLinus Torvalds pf = &gm->gm_pfs[i]; 901da177e4SLinus Torvalds pf->auth_domain_name = make_auth_domain_name(pf->name); 911da177e4SLinus Torvalds status = -ENOMEM; 921da177e4SLinus Torvalds if (pf->auth_domain_name == NULL) 931da177e4SLinus Torvalds goto out; 941da177e4SLinus Torvalds status = svcauth_gss_register_pseudoflavor(pf->pseudoflavor, 951da177e4SLinus Torvalds pf->auth_domain_name); 961da177e4SLinus Torvalds if (status) 971da177e4SLinus Torvalds goto out; 981da177e4SLinus Torvalds } 991da177e4SLinus Torvalds return 0; 1001da177e4SLinus Torvalds out: 1011da177e4SLinus Torvalds gss_mech_free(gm); 1021da177e4SLinus Torvalds return status; 1031da177e4SLinus Torvalds } 1041da177e4SLinus Torvalds 1051da177e4SLinus Torvalds int 1061da177e4SLinus Torvalds gss_mech_register(struct gss_api_mech *gm) 1071da177e4SLinus Torvalds { 1081da177e4SLinus Torvalds int status; 1091da177e4SLinus Torvalds 1101da177e4SLinus Torvalds status = gss_mech_svc_setup(gm); 1111da177e4SLinus Torvalds if (status) 1121da177e4SLinus Torvalds return status; 1131da177e4SLinus Torvalds spin_lock(®istered_mechs_lock); 1141da177e4SLinus Torvalds list_add(&gm->gm_list, ®istered_mechs); 1151da177e4SLinus Torvalds spin_unlock(®istered_mechs_lock); 1161da177e4SLinus Torvalds dprintk("RPC: registered gss mechanism %s\n", gm->gm_name); 1171da177e4SLinus Torvalds return 0; 1181da177e4SLinus Torvalds } 1191da177e4SLinus Torvalds 1201da177e4SLinus Torvalds EXPORT_SYMBOL(gss_mech_register); 1211da177e4SLinus Torvalds 1221da177e4SLinus Torvalds void 1231da177e4SLinus Torvalds gss_mech_unregister(struct gss_api_mech *gm) 1241da177e4SLinus Torvalds { 1251da177e4SLinus Torvalds spin_lock(®istered_mechs_lock); 1261da177e4SLinus Torvalds list_del(&gm->gm_list); 1271da177e4SLinus Torvalds spin_unlock(®istered_mechs_lock); 1281da177e4SLinus Torvalds dprintk("RPC: unregistered gss mechanism %s\n", gm->gm_name); 1291da177e4SLinus Torvalds gss_mech_free(gm); 1301da177e4SLinus Torvalds } 1311da177e4SLinus Torvalds 1321da177e4SLinus Torvalds EXPORT_SYMBOL(gss_mech_unregister); 1331da177e4SLinus Torvalds 1341da177e4SLinus Torvalds struct gss_api_mech * 1351da177e4SLinus Torvalds gss_mech_get(struct gss_api_mech *gm) 1361da177e4SLinus Torvalds { 1371da177e4SLinus Torvalds __module_get(gm->gm_owner); 1381da177e4SLinus Torvalds return gm; 1391da177e4SLinus Torvalds } 1401da177e4SLinus Torvalds 1411da177e4SLinus Torvalds EXPORT_SYMBOL(gss_mech_get); 1421da177e4SLinus Torvalds 1431da177e4SLinus Torvalds struct gss_api_mech * 1441da177e4SLinus Torvalds gss_mech_get_by_name(const char *name) 1451da177e4SLinus Torvalds { 1461da177e4SLinus Torvalds struct gss_api_mech *pos, *gm = NULL; 1471da177e4SLinus Torvalds 1481da177e4SLinus Torvalds spin_lock(®istered_mechs_lock); 1491da177e4SLinus Torvalds list_for_each_entry(pos, ®istered_mechs, gm_list) { 1501da177e4SLinus Torvalds if (0 == strcmp(name, pos->gm_name)) { 1511da177e4SLinus Torvalds if (try_module_get(pos->gm_owner)) 1521da177e4SLinus Torvalds gm = pos; 1531da177e4SLinus Torvalds break; 1541da177e4SLinus Torvalds } 1551da177e4SLinus Torvalds } 1561da177e4SLinus Torvalds spin_unlock(®istered_mechs_lock); 1571da177e4SLinus Torvalds return gm; 1581da177e4SLinus Torvalds 1591da177e4SLinus Torvalds } 1601da177e4SLinus Torvalds 1611da177e4SLinus Torvalds EXPORT_SYMBOL(gss_mech_get_by_name); 1621da177e4SLinus Torvalds 1631da177e4SLinus Torvalds static inline int 1641da177e4SLinus Torvalds mech_supports_pseudoflavor(struct gss_api_mech *gm, u32 pseudoflavor) 1651da177e4SLinus Torvalds { 1661da177e4SLinus Torvalds int i; 1671da177e4SLinus Torvalds 1681da177e4SLinus Torvalds for (i = 0; i < gm->gm_pf_num; i++) { 1691da177e4SLinus Torvalds if (gm->gm_pfs[i].pseudoflavor == pseudoflavor) 1701da177e4SLinus Torvalds return 1; 1711da177e4SLinus Torvalds } 1721da177e4SLinus Torvalds return 0; 1731da177e4SLinus Torvalds } 1741da177e4SLinus Torvalds 1751da177e4SLinus Torvalds struct gss_api_mech * 1761da177e4SLinus Torvalds gss_mech_get_by_pseudoflavor(u32 pseudoflavor) 1771da177e4SLinus Torvalds { 1781da177e4SLinus Torvalds struct gss_api_mech *pos, *gm = NULL; 1791da177e4SLinus Torvalds 1801da177e4SLinus Torvalds spin_lock(®istered_mechs_lock); 1811da177e4SLinus Torvalds list_for_each_entry(pos, ®istered_mechs, gm_list) { 1821da177e4SLinus Torvalds if (!mech_supports_pseudoflavor(pos, pseudoflavor)) { 1831da177e4SLinus Torvalds module_put(pos->gm_owner); 1841da177e4SLinus Torvalds continue; 1851da177e4SLinus Torvalds } 1861da177e4SLinus Torvalds if (try_module_get(pos->gm_owner)) 1871da177e4SLinus Torvalds gm = pos; 1881da177e4SLinus Torvalds break; 1891da177e4SLinus Torvalds } 1901da177e4SLinus Torvalds spin_unlock(®istered_mechs_lock); 1911da177e4SLinus Torvalds return gm; 1921da177e4SLinus Torvalds } 1931da177e4SLinus Torvalds 1941da177e4SLinus Torvalds EXPORT_SYMBOL(gss_mech_get_by_pseudoflavor); 1951da177e4SLinus Torvalds 1961da177e4SLinus Torvalds u32 1971da177e4SLinus Torvalds gss_pseudoflavor_to_service(struct gss_api_mech *gm, u32 pseudoflavor) 1981da177e4SLinus Torvalds { 1991da177e4SLinus Torvalds int i; 2001da177e4SLinus Torvalds 2011da177e4SLinus Torvalds for (i = 0; i < gm->gm_pf_num; i++) { 2021da177e4SLinus Torvalds if (gm->gm_pfs[i].pseudoflavor == pseudoflavor) 2031da177e4SLinus Torvalds return gm->gm_pfs[i].service; 2041da177e4SLinus Torvalds } 2051da177e4SLinus Torvalds return 0; 2061da177e4SLinus Torvalds } 2071da177e4SLinus Torvalds 2081da177e4SLinus Torvalds EXPORT_SYMBOL(gss_pseudoflavor_to_service); 2091da177e4SLinus Torvalds 2101da177e4SLinus Torvalds char * 2111da177e4SLinus Torvalds gss_service_to_auth_domain_name(struct gss_api_mech *gm, u32 service) 2121da177e4SLinus Torvalds { 2131da177e4SLinus Torvalds int i; 2141da177e4SLinus Torvalds 2151da177e4SLinus Torvalds for (i = 0; i < gm->gm_pf_num; i++) { 2161da177e4SLinus Torvalds if (gm->gm_pfs[i].service == service) 2171da177e4SLinus Torvalds return gm->gm_pfs[i].auth_domain_name; 2181da177e4SLinus Torvalds } 2191da177e4SLinus Torvalds return NULL; 2201da177e4SLinus Torvalds } 2211da177e4SLinus Torvalds 2221da177e4SLinus Torvalds EXPORT_SYMBOL(gss_service_to_auth_domain_name); 2231da177e4SLinus Torvalds 2241da177e4SLinus Torvalds void 2251da177e4SLinus Torvalds gss_mech_put(struct gss_api_mech * gm) 2261da177e4SLinus Torvalds { 2271df0cadaSJ. Bruce Fields if (gm) 2281da177e4SLinus Torvalds module_put(gm->gm_owner); 2291da177e4SLinus Torvalds } 2301da177e4SLinus Torvalds 2311da177e4SLinus Torvalds EXPORT_SYMBOL(gss_mech_put); 2321da177e4SLinus Torvalds 2331da177e4SLinus Torvalds /* The mech could probably be determined from the token instead, but it's just 2341da177e4SLinus Torvalds * as easy for now to pass it in. */ 2351da177e4SLinus Torvalds int 2361da177e4SLinus Torvalds gss_import_sec_context(const void *input_token, size_t bufsize, 2371da177e4SLinus Torvalds struct gss_api_mech *mech, 2381da177e4SLinus Torvalds struct gss_ctx **ctx_id) 2391da177e4SLinus Torvalds { 2401da177e4SLinus Torvalds if (!(*ctx_id = kmalloc(sizeof(**ctx_id), GFP_KERNEL))) 2411da177e4SLinus Torvalds return GSS_S_FAILURE; 2421da177e4SLinus Torvalds memset(*ctx_id, 0, sizeof(**ctx_id)); 2431da177e4SLinus Torvalds (*ctx_id)->mech_type = gss_mech_get(mech); 2441da177e4SLinus Torvalds 2451da177e4SLinus Torvalds return mech->gm_ops 2461da177e4SLinus Torvalds ->gss_import_sec_context(input_token, bufsize, *ctx_id); 2471da177e4SLinus Torvalds } 2481da177e4SLinus Torvalds 2491da177e4SLinus Torvalds /* gss_get_mic: compute a mic over message and return mic_token. */ 2501da177e4SLinus Torvalds 2511da177e4SLinus Torvalds u32 2521da177e4SLinus Torvalds gss_get_mic(struct gss_ctx *context_handle, 2531da177e4SLinus Torvalds struct xdr_buf *message, 2541da177e4SLinus Torvalds struct xdr_netobj *mic_token) 2551da177e4SLinus Torvalds { 2561da177e4SLinus Torvalds return context_handle->mech_type->gm_ops 2571da177e4SLinus Torvalds ->gss_get_mic(context_handle, 2581da177e4SLinus Torvalds message, 2591da177e4SLinus Torvalds mic_token); 2601da177e4SLinus Torvalds } 2611da177e4SLinus Torvalds 2621da177e4SLinus Torvalds /* gss_verify_mic: check whether the provided mic_token verifies message. */ 2631da177e4SLinus Torvalds 2641da177e4SLinus Torvalds u32 2651da177e4SLinus Torvalds gss_verify_mic(struct gss_ctx *context_handle, 2661da177e4SLinus Torvalds struct xdr_buf *message, 26700fd6e14SJ. Bruce Fields struct xdr_netobj *mic_token) 2681da177e4SLinus Torvalds { 2691da177e4SLinus Torvalds return context_handle->mech_type->gm_ops 2701da177e4SLinus Torvalds ->gss_verify_mic(context_handle, 2711da177e4SLinus Torvalds message, 27200fd6e14SJ. Bruce Fields mic_token); 2731da177e4SLinus Torvalds } 2741da177e4SLinus Torvalds 275293f1eb5SJ. Bruce Fields u32 276293f1eb5SJ. Bruce Fields gss_wrap(struct gss_ctx *ctx_id, 277293f1eb5SJ. Bruce Fields int offset, 278293f1eb5SJ. Bruce Fields struct xdr_buf *buf, 279293f1eb5SJ. Bruce Fields struct page **inpages) 280293f1eb5SJ. Bruce Fields { 281293f1eb5SJ. Bruce Fields return ctx_id->mech_type->gm_ops 28200fd6e14SJ. Bruce Fields ->gss_wrap(ctx_id, offset, buf, inpages); 283293f1eb5SJ. Bruce Fields } 284293f1eb5SJ. Bruce Fields 285293f1eb5SJ. Bruce Fields u32 286293f1eb5SJ. Bruce Fields gss_unwrap(struct gss_ctx *ctx_id, 287293f1eb5SJ. Bruce Fields int offset, 288293f1eb5SJ. Bruce Fields struct xdr_buf *buf) 289293f1eb5SJ. Bruce Fields { 290293f1eb5SJ. Bruce Fields return ctx_id->mech_type->gm_ops 29100fd6e14SJ. Bruce Fields ->gss_unwrap(ctx_id, offset, buf); 292293f1eb5SJ. Bruce Fields } 293293f1eb5SJ. Bruce Fields 294293f1eb5SJ. Bruce Fields 2951da177e4SLinus Torvalds /* gss_delete_sec_context: free all resources associated with context_handle. 2961da177e4SLinus Torvalds * Note this differs from the RFC 2744-specified prototype in that we don't 2971da177e4SLinus Torvalds * bother returning an output token, since it would never be used anyway. */ 2981da177e4SLinus Torvalds 2991da177e4SLinus Torvalds u32 3001da177e4SLinus Torvalds gss_delete_sec_context(struct gss_ctx **context_handle) 3011da177e4SLinus Torvalds { 3021da177e4SLinus Torvalds dprintk("RPC: gss_delete_sec_context deleting %p\n", 3031da177e4SLinus Torvalds *context_handle); 3041da177e4SLinus Torvalds 3051da177e4SLinus Torvalds if (!*context_handle) 3061da177e4SLinus Torvalds return(GSS_S_NO_CONTEXT); 3071da177e4SLinus Torvalds if ((*context_handle)->internal_ctx_id != 0) 3081da177e4SLinus Torvalds (*context_handle)->mech_type->gm_ops 3091da177e4SLinus Torvalds ->gss_delete_sec_context((*context_handle) 3101da177e4SLinus Torvalds ->internal_ctx_id); 3111da177e4SLinus Torvalds gss_mech_put((*context_handle)->mech_type); 3121da177e4SLinus Torvalds kfree(*context_handle); 3131da177e4SLinus Torvalds *context_handle=NULL; 3141da177e4SLinus Torvalds return GSS_S_COMPLETE; 3151da177e4SLinus Torvalds } 316