11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * linux/net/sunrpc/gss_mech_switch.c 31da177e4SLinus Torvalds * 41da177e4SLinus Torvalds * Copyright (c) 2001 The Regents of the University of Michigan. 51da177e4SLinus Torvalds * All rights reserved. 61da177e4SLinus Torvalds * 71da177e4SLinus Torvalds * J. Bruce Fields <bfields@umich.edu> 81da177e4SLinus Torvalds * 91da177e4SLinus Torvalds * Redistribution and use in source and binary forms, with or without 101da177e4SLinus Torvalds * modification, are permitted provided that the following conditions 111da177e4SLinus Torvalds * are met: 121da177e4SLinus Torvalds * 131da177e4SLinus Torvalds * 1. Redistributions of source code must retain the above copyright 141da177e4SLinus Torvalds * notice, this list of conditions and the following disclaimer. 151da177e4SLinus Torvalds * 2. Redistributions in binary form must reproduce the above copyright 161da177e4SLinus Torvalds * notice, this list of conditions and the following disclaimer in the 171da177e4SLinus Torvalds * documentation and/or other materials provided with the distribution. 181da177e4SLinus Torvalds * 3. Neither the name of the University nor the names of its 191da177e4SLinus Torvalds * contributors may be used to endorse or promote products derived 201da177e4SLinus Torvalds * from this software without specific prior written permission. 211da177e4SLinus Torvalds * 221da177e4SLinus Torvalds * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED 231da177e4SLinus Torvalds * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 241da177e4SLinus Torvalds * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 251da177e4SLinus Torvalds * DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 261da177e4SLinus Torvalds * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 271da177e4SLinus Torvalds * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 281da177e4SLinus Torvalds * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR 291da177e4SLinus Torvalds * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 301da177e4SLinus Torvalds * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 311da177e4SLinus Torvalds * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 321da177e4SLinus Torvalds * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 331da177e4SLinus Torvalds * 341da177e4SLinus Torvalds */ 351da177e4SLinus Torvalds 361da177e4SLinus Torvalds #include <linux/types.h> 371da177e4SLinus Torvalds #include <linux/slab.h> 381da177e4SLinus Torvalds #include <linux/module.h> 391da177e4SLinus Torvalds #include <linux/sunrpc/msg_prot.h> 401da177e4SLinus Torvalds #include <linux/sunrpc/gss_asn1.h> 411da177e4SLinus Torvalds #include <linux/sunrpc/auth_gss.h> 421da177e4SLinus Torvalds #include <linux/sunrpc/svcauth_gss.h> 431da177e4SLinus Torvalds #include <linux/sunrpc/gss_err.h> 441da177e4SLinus Torvalds #include <linux/sunrpc/sched.h> 451da177e4SLinus Torvalds #include <linux/sunrpc/gss_api.h> 461da177e4SLinus Torvalds #include <linux/sunrpc/clnt.h> 471da177e4SLinus Torvalds 481da177e4SLinus Torvalds #ifdef RPC_DEBUG 491da177e4SLinus Torvalds # define RPCDBG_FACILITY RPCDBG_AUTH 501da177e4SLinus Torvalds #endif 511da177e4SLinus Torvalds 521da177e4SLinus Torvalds static LIST_HEAD(registered_mechs); 531da177e4SLinus Torvalds static DEFINE_SPINLOCK(registered_mechs_lock); 541da177e4SLinus Torvalds 551da177e4SLinus Torvalds static void 561da177e4SLinus Torvalds gss_mech_free(struct gss_api_mech *gm) 571da177e4SLinus Torvalds { 581da177e4SLinus Torvalds struct pf_desc *pf; 591da177e4SLinus Torvalds int i; 601da177e4SLinus Torvalds 611da177e4SLinus Torvalds for (i = 0; i < gm->gm_pf_num; i++) { 621da177e4SLinus Torvalds pf = &gm->gm_pfs[i]; 631da177e4SLinus Torvalds kfree(pf->auth_domain_name); 641da177e4SLinus Torvalds pf->auth_domain_name = NULL; 651da177e4SLinus Torvalds } 661da177e4SLinus Torvalds } 671da177e4SLinus Torvalds 681da177e4SLinus Torvalds static inline char * 691da177e4SLinus Torvalds make_auth_domain_name(char *name) 701da177e4SLinus Torvalds { 711da177e4SLinus Torvalds static char *prefix = "gss/"; 721da177e4SLinus Torvalds char *new; 731da177e4SLinus Torvalds 741da177e4SLinus Torvalds new = kmalloc(strlen(name) + strlen(prefix) + 1, GFP_KERNEL); 751da177e4SLinus Torvalds if (new) { 761da177e4SLinus Torvalds strcpy(new, prefix); 771da177e4SLinus Torvalds strcat(new, name); 781da177e4SLinus Torvalds } 791da177e4SLinus Torvalds return new; 801da177e4SLinus Torvalds } 811da177e4SLinus Torvalds 821da177e4SLinus Torvalds static int 831da177e4SLinus Torvalds gss_mech_svc_setup(struct gss_api_mech *gm) 841da177e4SLinus Torvalds { 851da177e4SLinus Torvalds struct pf_desc *pf; 861da177e4SLinus Torvalds int i, status; 871da177e4SLinus Torvalds 881da177e4SLinus Torvalds for (i = 0; i < gm->gm_pf_num; i++) { 891da177e4SLinus Torvalds pf = &gm->gm_pfs[i]; 901da177e4SLinus Torvalds pf->auth_domain_name = make_auth_domain_name(pf->name); 911da177e4SLinus Torvalds status = -ENOMEM; 921da177e4SLinus Torvalds if (pf->auth_domain_name == NULL) 931da177e4SLinus Torvalds goto out; 941da177e4SLinus Torvalds status = svcauth_gss_register_pseudoflavor(pf->pseudoflavor, 951da177e4SLinus Torvalds pf->auth_domain_name); 961da177e4SLinus Torvalds if (status) 971da177e4SLinus Torvalds goto out; 981da177e4SLinus Torvalds } 991da177e4SLinus Torvalds return 0; 1001da177e4SLinus Torvalds out: 1011da177e4SLinus Torvalds gss_mech_free(gm); 1021da177e4SLinus Torvalds return status; 1031da177e4SLinus Torvalds } 1041da177e4SLinus Torvalds 1051da177e4SLinus Torvalds int 1061da177e4SLinus Torvalds gss_mech_register(struct gss_api_mech *gm) 1071da177e4SLinus Torvalds { 1081da177e4SLinus Torvalds int status; 1091da177e4SLinus Torvalds 1101da177e4SLinus Torvalds status = gss_mech_svc_setup(gm); 1111da177e4SLinus Torvalds if (status) 1121da177e4SLinus Torvalds return status; 1131da177e4SLinus Torvalds spin_lock(®istered_mechs_lock); 1141da177e4SLinus Torvalds list_add(&gm->gm_list, ®istered_mechs); 1151da177e4SLinus Torvalds spin_unlock(®istered_mechs_lock); 1161da177e4SLinus Torvalds dprintk("RPC: registered gss mechanism %s\n", gm->gm_name); 1171da177e4SLinus Torvalds return 0; 1181da177e4SLinus Torvalds } 1191da177e4SLinus Torvalds 1207bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_mech_register); 1211da177e4SLinus Torvalds 1221da177e4SLinus Torvalds void 1231da177e4SLinus Torvalds gss_mech_unregister(struct gss_api_mech *gm) 1241da177e4SLinus Torvalds { 1251da177e4SLinus Torvalds spin_lock(®istered_mechs_lock); 1261da177e4SLinus Torvalds list_del(&gm->gm_list); 1271da177e4SLinus Torvalds spin_unlock(®istered_mechs_lock); 1281da177e4SLinus Torvalds dprintk("RPC: unregistered gss mechanism %s\n", gm->gm_name); 1291da177e4SLinus Torvalds gss_mech_free(gm); 1301da177e4SLinus Torvalds } 1311da177e4SLinus Torvalds 1327bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_mech_unregister); 1331da177e4SLinus Torvalds 1341da177e4SLinus Torvalds struct gss_api_mech * 1351da177e4SLinus Torvalds gss_mech_get(struct gss_api_mech *gm) 1361da177e4SLinus Torvalds { 1371da177e4SLinus Torvalds __module_get(gm->gm_owner); 1381da177e4SLinus Torvalds return gm; 1391da177e4SLinus Torvalds } 1401da177e4SLinus Torvalds 1417bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_mech_get); 1421da177e4SLinus Torvalds 1431da177e4SLinus Torvalds struct gss_api_mech * 1441da177e4SLinus Torvalds gss_mech_get_by_name(const char *name) 1451da177e4SLinus Torvalds { 1461da177e4SLinus Torvalds struct gss_api_mech *pos, *gm = NULL; 1471da177e4SLinus Torvalds 1481da177e4SLinus Torvalds spin_lock(®istered_mechs_lock); 1491da177e4SLinus Torvalds list_for_each_entry(pos, ®istered_mechs, gm_list) { 1501da177e4SLinus Torvalds if (0 == strcmp(name, pos->gm_name)) { 1511da177e4SLinus Torvalds if (try_module_get(pos->gm_owner)) 1521da177e4SLinus Torvalds gm = pos; 1531da177e4SLinus Torvalds break; 1541da177e4SLinus Torvalds } 1551da177e4SLinus Torvalds } 1561da177e4SLinus Torvalds spin_unlock(®istered_mechs_lock); 1571da177e4SLinus Torvalds return gm; 1581da177e4SLinus Torvalds 1591da177e4SLinus Torvalds } 1601da177e4SLinus Torvalds 1617bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_mech_get_by_name); 1621da177e4SLinus Torvalds 1631da177e4SLinus Torvalds static inline int 1641da177e4SLinus Torvalds mech_supports_pseudoflavor(struct gss_api_mech *gm, u32 pseudoflavor) 1651da177e4SLinus Torvalds { 1661da177e4SLinus Torvalds int i; 1671da177e4SLinus Torvalds 1681da177e4SLinus Torvalds for (i = 0; i < gm->gm_pf_num; i++) { 1691da177e4SLinus Torvalds if (gm->gm_pfs[i].pseudoflavor == pseudoflavor) 1701da177e4SLinus Torvalds return 1; 1711da177e4SLinus Torvalds } 1721da177e4SLinus Torvalds return 0; 1731da177e4SLinus Torvalds } 1741da177e4SLinus Torvalds 1751da177e4SLinus Torvalds struct gss_api_mech * 1761da177e4SLinus Torvalds gss_mech_get_by_pseudoflavor(u32 pseudoflavor) 1771da177e4SLinus Torvalds { 1781da177e4SLinus Torvalds struct gss_api_mech *pos, *gm = NULL; 1791da177e4SLinus Torvalds 1801da177e4SLinus Torvalds spin_lock(®istered_mechs_lock); 1811da177e4SLinus Torvalds list_for_each_entry(pos, ®istered_mechs, gm_list) { 1821da177e4SLinus Torvalds if (!mech_supports_pseudoflavor(pos, pseudoflavor)) { 1831da177e4SLinus Torvalds module_put(pos->gm_owner); 1841da177e4SLinus Torvalds continue; 1851da177e4SLinus Torvalds } 1861da177e4SLinus Torvalds if (try_module_get(pos->gm_owner)) 1871da177e4SLinus Torvalds gm = pos; 1881da177e4SLinus Torvalds break; 1891da177e4SLinus Torvalds } 1901da177e4SLinus Torvalds spin_unlock(®istered_mechs_lock); 1911da177e4SLinus Torvalds return gm; 1921da177e4SLinus Torvalds } 1931da177e4SLinus Torvalds 1947bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_mech_get_by_pseudoflavor); 1951da177e4SLinus Torvalds 1961da177e4SLinus Torvalds u32 197c4170583SAndy Adamson gss_svc_to_pseudoflavor(struct gss_api_mech *gm, u32 service) 198c4170583SAndy Adamson { 199c4170583SAndy Adamson int i; 200c4170583SAndy Adamson 201c4170583SAndy Adamson for (i = 0; i < gm->gm_pf_num; i++) { 202c4170583SAndy Adamson if (gm->gm_pfs[i].service == service) { 203c4170583SAndy Adamson return gm->gm_pfs[i].pseudoflavor; 204c4170583SAndy Adamson } 205c4170583SAndy Adamson } 206c4170583SAndy Adamson return RPC_AUTH_MAXFLAVOR; /* illegal value */ 207c4170583SAndy Adamson } 2087bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_svc_to_pseudoflavor); 209c4170583SAndy Adamson 210c4170583SAndy Adamson u32 2111da177e4SLinus Torvalds gss_pseudoflavor_to_service(struct gss_api_mech *gm, u32 pseudoflavor) 2121da177e4SLinus Torvalds { 2131da177e4SLinus Torvalds int i; 2141da177e4SLinus Torvalds 2151da177e4SLinus Torvalds for (i = 0; i < gm->gm_pf_num; i++) { 2161da177e4SLinus Torvalds if (gm->gm_pfs[i].pseudoflavor == pseudoflavor) 2171da177e4SLinus Torvalds return gm->gm_pfs[i].service; 2181da177e4SLinus Torvalds } 2191da177e4SLinus Torvalds return 0; 2201da177e4SLinus Torvalds } 2211da177e4SLinus Torvalds 2227bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_pseudoflavor_to_service); 2231da177e4SLinus Torvalds 2241da177e4SLinus Torvalds char * 2251da177e4SLinus Torvalds gss_service_to_auth_domain_name(struct gss_api_mech *gm, u32 service) 2261da177e4SLinus Torvalds { 2271da177e4SLinus Torvalds int i; 2281da177e4SLinus Torvalds 2291da177e4SLinus Torvalds for (i = 0; i < gm->gm_pf_num; i++) { 2301da177e4SLinus Torvalds if (gm->gm_pfs[i].service == service) 2311da177e4SLinus Torvalds return gm->gm_pfs[i].auth_domain_name; 2321da177e4SLinus Torvalds } 2331da177e4SLinus Torvalds return NULL; 2341da177e4SLinus Torvalds } 2351da177e4SLinus Torvalds 2367bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_service_to_auth_domain_name); 2371da177e4SLinus Torvalds 2381da177e4SLinus Torvalds void 2391da177e4SLinus Torvalds gss_mech_put(struct gss_api_mech * gm) 2401da177e4SLinus Torvalds { 2411df0cadaSJ. Bruce Fields if (gm) 2421da177e4SLinus Torvalds module_put(gm->gm_owner); 2431da177e4SLinus Torvalds } 2441da177e4SLinus Torvalds 2457bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_mech_put); 2461da177e4SLinus Torvalds 2471da177e4SLinus Torvalds /* The mech could probably be determined from the token instead, but it's just 2481da177e4SLinus Torvalds * as easy for now to pass it in. */ 2491da177e4SLinus Torvalds int 2501da177e4SLinus Torvalds gss_import_sec_context(const void *input_token, size_t bufsize, 2511da177e4SLinus Torvalds struct gss_api_mech *mech, 2521f4c86c0STrond Myklebust struct gss_ctx **ctx_id, 2531f4c86c0STrond Myklebust gfp_t gfp_mask) 2541da177e4SLinus Torvalds { 2551f4c86c0STrond Myklebust if (!(*ctx_id = kzalloc(sizeof(**ctx_id), gfp_mask))) 256b891e4a0STrond Myklebust return -ENOMEM; 2571da177e4SLinus Torvalds (*ctx_id)->mech_type = gss_mech_get(mech); 2581da177e4SLinus Torvalds 2591da177e4SLinus Torvalds return mech->gm_ops 2601f4c86c0STrond Myklebust ->gss_import_sec_context(input_token, bufsize, *ctx_id, gfp_mask); 2611da177e4SLinus Torvalds } 2621da177e4SLinus Torvalds 2631da177e4SLinus Torvalds /* gss_get_mic: compute a mic over message and return mic_token. */ 2641da177e4SLinus Torvalds 2651da177e4SLinus Torvalds u32 2661da177e4SLinus Torvalds gss_get_mic(struct gss_ctx *context_handle, 2671da177e4SLinus Torvalds struct xdr_buf *message, 2681da177e4SLinus Torvalds struct xdr_netobj *mic_token) 2691da177e4SLinus Torvalds { 2701da177e4SLinus Torvalds return context_handle->mech_type->gm_ops 2711da177e4SLinus Torvalds ->gss_get_mic(context_handle, 2721da177e4SLinus Torvalds message, 2731da177e4SLinus Torvalds mic_token); 2741da177e4SLinus Torvalds } 2751da177e4SLinus Torvalds 2761da177e4SLinus Torvalds /* gss_verify_mic: check whether the provided mic_token verifies message. */ 2771da177e4SLinus Torvalds 2781da177e4SLinus Torvalds u32 2791da177e4SLinus Torvalds gss_verify_mic(struct gss_ctx *context_handle, 2801da177e4SLinus Torvalds struct xdr_buf *message, 28100fd6e14SJ. Bruce Fields struct xdr_netobj *mic_token) 2821da177e4SLinus Torvalds { 2831da177e4SLinus Torvalds return context_handle->mech_type->gm_ops 2841da177e4SLinus Torvalds ->gss_verify_mic(context_handle, 2851da177e4SLinus Torvalds message, 28600fd6e14SJ. Bruce Fields mic_token); 2871da177e4SLinus Torvalds } 2881da177e4SLinus Torvalds 2897561042fSKevin Coffman /* 2907561042fSKevin Coffman * This function is called from both the client and server code. 2917561042fSKevin Coffman * Each makes guarantees about how much "slack" space is available 2927561042fSKevin Coffman * for the underlying function in "buf"'s head and tail while 2937561042fSKevin Coffman * performing the wrap. 2947561042fSKevin Coffman * 2957561042fSKevin Coffman * The client and server code allocate RPC_MAX_AUTH_SIZE extra 2967561042fSKevin Coffman * space in both the head and tail which is available for use by 2977561042fSKevin Coffman * the wrap function. 2987561042fSKevin Coffman * 2997561042fSKevin Coffman * Underlying functions should verify they do not use more than 3007561042fSKevin Coffman * RPC_MAX_AUTH_SIZE of extra space in either the head or tail 3017561042fSKevin Coffman * when performing the wrap. 3027561042fSKevin Coffman */ 303293f1eb5SJ. Bruce Fields u32 304293f1eb5SJ. Bruce Fields gss_wrap(struct gss_ctx *ctx_id, 305293f1eb5SJ. Bruce Fields int offset, 306293f1eb5SJ. Bruce Fields struct xdr_buf *buf, 307293f1eb5SJ. Bruce Fields struct page **inpages) 308293f1eb5SJ. Bruce Fields { 309293f1eb5SJ. Bruce Fields return ctx_id->mech_type->gm_ops 31000fd6e14SJ. Bruce Fields ->gss_wrap(ctx_id, offset, buf, inpages); 311293f1eb5SJ. Bruce Fields } 312293f1eb5SJ. Bruce Fields 313293f1eb5SJ. Bruce Fields u32 314293f1eb5SJ. Bruce Fields gss_unwrap(struct gss_ctx *ctx_id, 315293f1eb5SJ. Bruce Fields int offset, 316293f1eb5SJ. Bruce Fields struct xdr_buf *buf) 317293f1eb5SJ. Bruce Fields { 318293f1eb5SJ. Bruce Fields return ctx_id->mech_type->gm_ops 31900fd6e14SJ. Bruce Fields ->gss_unwrap(ctx_id, offset, buf); 320293f1eb5SJ. Bruce Fields } 321293f1eb5SJ. Bruce Fields 322293f1eb5SJ. Bruce Fields 3231da177e4SLinus Torvalds /* gss_delete_sec_context: free all resources associated with context_handle. 3241da177e4SLinus Torvalds * Note this differs from the RFC 2744-specified prototype in that we don't 3251da177e4SLinus Torvalds * bother returning an output token, since it would never be used anyway. */ 3261da177e4SLinus Torvalds 3271da177e4SLinus Torvalds u32 3281da177e4SLinus Torvalds gss_delete_sec_context(struct gss_ctx **context_handle) 3291da177e4SLinus Torvalds { 3301da177e4SLinus Torvalds dprintk("RPC: gss_delete_sec_context deleting %p\n", 3311da177e4SLinus Torvalds *context_handle); 3321da177e4SLinus Torvalds 3331da177e4SLinus Torvalds if (!*context_handle) 3341da177e4SLinus Torvalds return(GSS_S_NO_CONTEXT); 33527724426SAl Viro if ((*context_handle)->internal_ctx_id) 3361da177e4SLinus Torvalds (*context_handle)->mech_type->gm_ops 3371da177e4SLinus Torvalds ->gss_delete_sec_context((*context_handle) 3381da177e4SLinus Torvalds ->internal_ctx_id); 3391da177e4SLinus Torvalds gss_mech_put((*context_handle)->mech_type); 3401da177e4SLinus Torvalds kfree(*context_handle); 3411da177e4SLinus Torvalds *context_handle=NULL; 3421da177e4SLinus Torvalds return GSS_S_COMPLETE; 3431da177e4SLinus Torvalds } 344