11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * linux/net/sunrpc/gss_mech_switch.c 31da177e4SLinus Torvalds * 41da177e4SLinus Torvalds * Copyright (c) 2001 The Regents of the University of Michigan. 51da177e4SLinus Torvalds * All rights reserved. 61da177e4SLinus Torvalds * 71da177e4SLinus Torvalds * J. Bruce Fields <bfields@umich.edu> 81da177e4SLinus Torvalds * 91da177e4SLinus Torvalds * Redistribution and use in source and binary forms, with or without 101da177e4SLinus Torvalds * modification, are permitted provided that the following conditions 111da177e4SLinus Torvalds * are met: 121da177e4SLinus Torvalds * 131da177e4SLinus Torvalds * 1. Redistributions of source code must retain the above copyright 141da177e4SLinus Torvalds * notice, this list of conditions and the following disclaimer. 151da177e4SLinus Torvalds * 2. Redistributions in binary form must reproduce the above copyright 161da177e4SLinus Torvalds * notice, this list of conditions and the following disclaimer in the 171da177e4SLinus Torvalds * documentation and/or other materials provided with the distribution. 181da177e4SLinus Torvalds * 3. Neither the name of the University nor the names of its 191da177e4SLinus Torvalds * contributors may be used to endorse or promote products derived 201da177e4SLinus Torvalds * from this software without specific prior written permission. 211da177e4SLinus Torvalds * 221da177e4SLinus Torvalds * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED 231da177e4SLinus Torvalds * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 241da177e4SLinus Torvalds * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 251da177e4SLinus Torvalds * DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 261da177e4SLinus Torvalds * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 271da177e4SLinus Torvalds * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 281da177e4SLinus Torvalds * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR 291da177e4SLinus Torvalds * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 301da177e4SLinus Torvalds * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 311da177e4SLinus Torvalds * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 321da177e4SLinus Torvalds * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 331da177e4SLinus Torvalds * 341da177e4SLinus Torvalds */ 351da177e4SLinus Torvalds 361da177e4SLinus Torvalds #include <linux/types.h> 371da177e4SLinus Torvalds #include <linux/slab.h> 381da177e4SLinus Torvalds #include <linux/module.h> 391da177e4SLinus Torvalds #include <linux/sunrpc/msg_prot.h> 401da177e4SLinus Torvalds #include <linux/sunrpc/gss_asn1.h> 411da177e4SLinus Torvalds #include <linux/sunrpc/auth_gss.h> 421da177e4SLinus Torvalds #include <linux/sunrpc/svcauth_gss.h> 431da177e4SLinus Torvalds #include <linux/sunrpc/gss_err.h> 441da177e4SLinus Torvalds #include <linux/sunrpc/sched.h> 451da177e4SLinus Torvalds #include <linux/sunrpc/gss_api.h> 461da177e4SLinus Torvalds #include <linux/sunrpc/clnt.h> 471da177e4SLinus Torvalds 481da177e4SLinus Torvalds #ifdef RPC_DEBUG 491da177e4SLinus Torvalds # define RPCDBG_FACILITY RPCDBG_AUTH 501da177e4SLinus Torvalds #endif 511da177e4SLinus Torvalds 521da177e4SLinus Torvalds static LIST_HEAD(registered_mechs); 531da177e4SLinus Torvalds static DEFINE_SPINLOCK(registered_mechs_lock); 541da177e4SLinus Torvalds 551da177e4SLinus Torvalds static void 561da177e4SLinus Torvalds gss_mech_free(struct gss_api_mech *gm) 571da177e4SLinus Torvalds { 581da177e4SLinus Torvalds struct pf_desc *pf; 591da177e4SLinus Torvalds int i; 601da177e4SLinus Torvalds 611da177e4SLinus Torvalds for (i = 0; i < gm->gm_pf_num; i++) { 621da177e4SLinus Torvalds pf = &gm->gm_pfs[i]; 631da177e4SLinus Torvalds kfree(pf->auth_domain_name); 641da177e4SLinus Torvalds pf->auth_domain_name = NULL; 651da177e4SLinus Torvalds } 661da177e4SLinus Torvalds } 671da177e4SLinus Torvalds 681da177e4SLinus Torvalds static inline char * 691da177e4SLinus Torvalds make_auth_domain_name(char *name) 701da177e4SLinus Torvalds { 711da177e4SLinus Torvalds static char *prefix = "gss/"; 721da177e4SLinus Torvalds char *new; 731da177e4SLinus Torvalds 741da177e4SLinus Torvalds new = kmalloc(strlen(name) + strlen(prefix) + 1, GFP_KERNEL); 751da177e4SLinus Torvalds if (new) { 761da177e4SLinus Torvalds strcpy(new, prefix); 771da177e4SLinus Torvalds strcat(new, name); 781da177e4SLinus Torvalds } 791da177e4SLinus Torvalds return new; 801da177e4SLinus Torvalds } 811da177e4SLinus Torvalds 821da177e4SLinus Torvalds static int 831da177e4SLinus Torvalds gss_mech_svc_setup(struct gss_api_mech *gm) 841da177e4SLinus Torvalds { 851da177e4SLinus Torvalds struct pf_desc *pf; 861da177e4SLinus Torvalds int i, status; 871da177e4SLinus Torvalds 881da177e4SLinus Torvalds for (i = 0; i < gm->gm_pf_num; i++) { 891da177e4SLinus Torvalds pf = &gm->gm_pfs[i]; 901da177e4SLinus Torvalds pf->auth_domain_name = make_auth_domain_name(pf->name); 911da177e4SLinus Torvalds status = -ENOMEM; 921da177e4SLinus Torvalds if (pf->auth_domain_name == NULL) 931da177e4SLinus Torvalds goto out; 941da177e4SLinus Torvalds status = svcauth_gss_register_pseudoflavor(pf->pseudoflavor, 951da177e4SLinus Torvalds pf->auth_domain_name); 961da177e4SLinus Torvalds if (status) 971da177e4SLinus Torvalds goto out; 981da177e4SLinus Torvalds } 991da177e4SLinus Torvalds return 0; 1001da177e4SLinus Torvalds out: 1011da177e4SLinus Torvalds gss_mech_free(gm); 1021da177e4SLinus Torvalds return status; 1031da177e4SLinus Torvalds } 1041da177e4SLinus Torvalds 1051da177e4SLinus Torvalds int 1061da177e4SLinus Torvalds gss_mech_register(struct gss_api_mech *gm) 1071da177e4SLinus Torvalds { 1081da177e4SLinus Torvalds int status; 1091da177e4SLinus Torvalds 1101da177e4SLinus Torvalds status = gss_mech_svc_setup(gm); 1111da177e4SLinus Torvalds if (status) 1121da177e4SLinus Torvalds return status; 1131da177e4SLinus Torvalds spin_lock(®istered_mechs_lock); 1141da177e4SLinus Torvalds list_add(&gm->gm_list, ®istered_mechs); 1151da177e4SLinus Torvalds spin_unlock(®istered_mechs_lock); 1161da177e4SLinus Torvalds dprintk("RPC: registered gss mechanism %s\n", gm->gm_name); 1171da177e4SLinus Torvalds return 0; 1181da177e4SLinus Torvalds } 1191da177e4SLinus Torvalds 1207bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_mech_register); 1211da177e4SLinus Torvalds 1221da177e4SLinus Torvalds void 1231da177e4SLinus Torvalds gss_mech_unregister(struct gss_api_mech *gm) 1241da177e4SLinus Torvalds { 1251da177e4SLinus Torvalds spin_lock(®istered_mechs_lock); 1261da177e4SLinus Torvalds list_del(&gm->gm_list); 1271da177e4SLinus Torvalds spin_unlock(®istered_mechs_lock); 1281da177e4SLinus Torvalds dprintk("RPC: unregistered gss mechanism %s\n", gm->gm_name); 1291da177e4SLinus Torvalds gss_mech_free(gm); 1301da177e4SLinus Torvalds } 1311da177e4SLinus Torvalds 1327bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_mech_unregister); 1331da177e4SLinus Torvalds 1341da177e4SLinus Torvalds struct gss_api_mech * 1351da177e4SLinus Torvalds gss_mech_get(struct gss_api_mech *gm) 1361da177e4SLinus Torvalds { 1371da177e4SLinus Torvalds __module_get(gm->gm_owner); 1381da177e4SLinus Torvalds return gm; 1391da177e4SLinus Torvalds } 1401da177e4SLinus Torvalds 1417bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_mech_get); 1421da177e4SLinus Torvalds 1431da177e4SLinus Torvalds struct gss_api_mech * 1441da177e4SLinus Torvalds gss_mech_get_by_name(const char *name) 1451da177e4SLinus Torvalds { 1461da177e4SLinus Torvalds struct gss_api_mech *pos, *gm = NULL; 1471da177e4SLinus Torvalds 1481da177e4SLinus Torvalds spin_lock(®istered_mechs_lock); 1491da177e4SLinus Torvalds list_for_each_entry(pos, ®istered_mechs, gm_list) { 1501da177e4SLinus Torvalds if (0 == strcmp(name, pos->gm_name)) { 1511da177e4SLinus Torvalds if (try_module_get(pos->gm_owner)) 1521da177e4SLinus Torvalds gm = pos; 1531da177e4SLinus Torvalds break; 1541da177e4SLinus Torvalds } 1551da177e4SLinus Torvalds } 1561da177e4SLinus Torvalds spin_unlock(®istered_mechs_lock); 1571da177e4SLinus Torvalds return gm; 1581da177e4SLinus Torvalds 1591da177e4SLinus Torvalds } 1601da177e4SLinus Torvalds 1617bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_mech_get_by_name); 1621da177e4SLinus Torvalds 1637ebb9315SBryan Schumaker struct gss_api_mech * 1647ebb9315SBryan Schumaker gss_mech_get_by_OID(struct xdr_netobj *obj) 1657ebb9315SBryan Schumaker { 1667ebb9315SBryan Schumaker struct gss_api_mech *pos, *gm = NULL; 1677ebb9315SBryan Schumaker 1687ebb9315SBryan Schumaker spin_lock(®istered_mechs_lock); 1697ebb9315SBryan Schumaker list_for_each_entry(pos, ®istered_mechs, gm_list) { 1707ebb9315SBryan Schumaker if (obj->len == pos->gm_oid.len) { 1717ebb9315SBryan Schumaker if (0 == memcmp(obj->data, pos->gm_oid.data, obj->len)) { 1727ebb9315SBryan Schumaker if (try_module_get(pos->gm_owner)) 1737ebb9315SBryan Schumaker gm = pos; 1747ebb9315SBryan Schumaker break; 1757ebb9315SBryan Schumaker } 1767ebb9315SBryan Schumaker } 1777ebb9315SBryan Schumaker } 1787ebb9315SBryan Schumaker spin_unlock(®istered_mechs_lock); 1797ebb9315SBryan Schumaker return gm; 1807ebb9315SBryan Schumaker 1817ebb9315SBryan Schumaker } 1827ebb9315SBryan Schumaker 1837ebb9315SBryan Schumaker EXPORT_SYMBOL_GPL(gss_mech_get_by_OID); 1847ebb9315SBryan Schumaker 1851da177e4SLinus Torvalds static inline int 1861da177e4SLinus Torvalds mech_supports_pseudoflavor(struct gss_api_mech *gm, u32 pseudoflavor) 1871da177e4SLinus Torvalds { 1881da177e4SLinus Torvalds int i; 1891da177e4SLinus Torvalds 1901da177e4SLinus Torvalds for (i = 0; i < gm->gm_pf_num; i++) { 1911da177e4SLinus Torvalds if (gm->gm_pfs[i].pseudoflavor == pseudoflavor) 1921da177e4SLinus Torvalds return 1; 1931da177e4SLinus Torvalds } 1941da177e4SLinus Torvalds return 0; 1951da177e4SLinus Torvalds } 1961da177e4SLinus Torvalds 1971da177e4SLinus Torvalds struct gss_api_mech * 1981da177e4SLinus Torvalds gss_mech_get_by_pseudoflavor(u32 pseudoflavor) 1991da177e4SLinus Torvalds { 2001da177e4SLinus Torvalds struct gss_api_mech *pos, *gm = NULL; 2011da177e4SLinus Torvalds 2021da177e4SLinus Torvalds spin_lock(®istered_mechs_lock); 2031da177e4SLinus Torvalds list_for_each_entry(pos, ®istered_mechs, gm_list) { 2041da177e4SLinus Torvalds if (!mech_supports_pseudoflavor(pos, pseudoflavor)) { 2051da177e4SLinus Torvalds module_put(pos->gm_owner); 2061da177e4SLinus Torvalds continue; 2071da177e4SLinus Torvalds } 2081da177e4SLinus Torvalds if (try_module_get(pos->gm_owner)) 2091da177e4SLinus Torvalds gm = pos; 2101da177e4SLinus Torvalds break; 2111da177e4SLinus Torvalds } 2121da177e4SLinus Torvalds spin_unlock(®istered_mechs_lock); 2131da177e4SLinus Torvalds return gm; 2141da177e4SLinus Torvalds } 2151da177e4SLinus Torvalds 2167bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_mech_get_by_pseudoflavor); 2171da177e4SLinus Torvalds 2181da177e4SLinus Torvalds u32 219c4170583SAndy Adamson gss_svc_to_pseudoflavor(struct gss_api_mech *gm, u32 service) 220c4170583SAndy Adamson { 221c4170583SAndy Adamson int i; 222c4170583SAndy Adamson 223c4170583SAndy Adamson for (i = 0; i < gm->gm_pf_num; i++) { 224c4170583SAndy Adamson if (gm->gm_pfs[i].service == service) { 225c4170583SAndy Adamson return gm->gm_pfs[i].pseudoflavor; 226c4170583SAndy Adamson } 227c4170583SAndy Adamson } 228c4170583SAndy Adamson return RPC_AUTH_MAXFLAVOR; /* illegal value */ 229c4170583SAndy Adamson } 2307bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_svc_to_pseudoflavor); 231c4170583SAndy Adamson 232c4170583SAndy Adamson u32 2331da177e4SLinus Torvalds gss_pseudoflavor_to_service(struct gss_api_mech *gm, u32 pseudoflavor) 2341da177e4SLinus Torvalds { 2351da177e4SLinus Torvalds int i; 2361da177e4SLinus Torvalds 2371da177e4SLinus Torvalds for (i = 0; i < gm->gm_pf_num; i++) { 2381da177e4SLinus Torvalds if (gm->gm_pfs[i].pseudoflavor == pseudoflavor) 2391da177e4SLinus Torvalds return gm->gm_pfs[i].service; 2401da177e4SLinus Torvalds } 2411da177e4SLinus Torvalds return 0; 2421da177e4SLinus Torvalds } 2431da177e4SLinus Torvalds 2447bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_pseudoflavor_to_service); 2451da177e4SLinus Torvalds 2461da177e4SLinus Torvalds char * 2471da177e4SLinus Torvalds gss_service_to_auth_domain_name(struct gss_api_mech *gm, u32 service) 2481da177e4SLinus Torvalds { 2491da177e4SLinus Torvalds int i; 2501da177e4SLinus Torvalds 2511da177e4SLinus Torvalds for (i = 0; i < gm->gm_pf_num; i++) { 2521da177e4SLinus Torvalds if (gm->gm_pfs[i].service == service) 2531da177e4SLinus Torvalds return gm->gm_pfs[i].auth_domain_name; 2541da177e4SLinus Torvalds } 2551da177e4SLinus Torvalds return NULL; 2561da177e4SLinus Torvalds } 2571da177e4SLinus Torvalds 2587bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_service_to_auth_domain_name); 2591da177e4SLinus Torvalds 2601da177e4SLinus Torvalds void 2611da177e4SLinus Torvalds gss_mech_put(struct gss_api_mech * gm) 2621da177e4SLinus Torvalds { 2631df0cadaSJ. Bruce Fields if (gm) 2641da177e4SLinus Torvalds module_put(gm->gm_owner); 2651da177e4SLinus Torvalds } 2661da177e4SLinus Torvalds 2677bd88269STrond Myklebust EXPORT_SYMBOL_GPL(gss_mech_put); 2681da177e4SLinus Torvalds 2691da177e4SLinus Torvalds /* The mech could probably be determined from the token instead, but it's just 2701da177e4SLinus Torvalds * as easy for now to pass it in. */ 2711da177e4SLinus Torvalds int 2721da177e4SLinus Torvalds gss_import_sec_context(const void *input_token, size_t bufsize, 2731da177e4SLinus Torvalds struct gss_api_mech *mech, 2741f4c86c0STrond Myklebust struct gss_ctx **ctx_id, 2751f4c86c0STrond Myklebust gfp_t gfp_mask) 2761da177e4SLinus Torvalds { 2771f4c86c0STrond Myklebust if (!(*ctx_id = kzalloc(sizeof(**ctx_id), gfp_mask))) 278b891e4a0STrond Myklebust return -ENOMEM; 2791da177e4SLinus Torvalds (*ctx_id)->mech_type = gss_mech_get(mech); 2801da177e4SLinus Torvalds 2811da177e4SLinus Torvalds return mech->gm_ops 2821f4c86c0STrond Myklebust ->gss_import_sec_context(input_token, bufsize, *ctx_id, gfp_mask); 2831da177e4SLinus Torvalds } 2841da177e4SLinus Torvalds 2851da177e4SLinus Torvalds /* gss_get_mic: compute a mic over message and return mic_token. */ 2861da177e4SLinus Torvalds 2871da177e4SLinus Torvalds u32 2881da177e4SLinus Torvalds gss_get_mic(struct gss_ctx *context_handle, 2891da177e4SLinus Torvalds struct xdr_buf *message, 2901da177e4SLinus Torvalds struct xdr_netobj *mic_token) 2911da177e4SLinus Torvalds { 2921da177e4SLinus Torvalds return context_handle->mech_type->gm_ops 2931da177e4SLinus Torvalds ->gss_get_mic(context_handle, 2941da177e4SLinus Torvalds message, 2951da177e4SLinus Torvalds mic_token); 2961da177e4SLinus Torvalds } 2971da177e4SLinus Torvalds 2981da177e4SLinus Torvalds /* gss_verify_mic: check whether the provided mic_token verifies message. */ 2991da177e4SLinus Torvalds 3001da177e4SLinus Torvalds u32 3011da177e4SLinus Torvalds gss_verify_mic(struct gss_ctx *context_handle, 3021da177e4SLinus Torvalds struct xdr_buf *message, 30300fd6e14SJ. Bruce Fields struct xdr_netobj *mic_token) 3041da177e4SLinus Torvalds { 3051da177e4SLinus Torvalds return context_handle->mech_type->gm_ops 3061da177e4SLinus Torvalds ->gss_verify_mic(context_handle, 3071da177e4SLinus Torvalds message, 30800fd6e14SJ. Bruce Fields mic_token); 3091da177e4SLinus Torvalds } 3101da177e4SLinus Torvalds 3117561042fSKevin Coffman /* 3127561042fSKevin Coffman * This function is called from both the client and server code. 3137561042fSKevin Coffman * Each makes guarantees about how much "slack" space is available 3147561042fSKevin Coffman * for the underlying function in "buf"'s head and tail while 3157561042fSKevin Coffman * performing the wrap. 3167561042fSKevin Coffman * 3177561042fSKevin Coffman * The client and server code allocate RPC_MAX_AUTH_SIZE extra 3187561042fSKevin Coffman * space in both the head and tail which is available for use by 3197561042fSKevin Coffman * the wrap function. 3207561042fSKevin Coffman * 3217561042fSKevin Coffman * Underlying functions should verify they do not use more than 3227561042fSKevin Coffman * RPC_MAX_AUTH_SIZE of extra space in either the head or tail 3237561042fSKevin Coffman * when performing the wrap. 3247561042fSKevin Coffman */ 325293f1eb5SJ. Bruce Fields u32 326293f1eb5SJ. Bruce Fields gss_wrap(struct gss_ctx *ctx_id, 327293f1eb5SJ. Bruce Fields int offset, 328293f1eb5SJ. Bruce Fields struct xdr_buf *buf, 329293f1eb5SJ. Bruce Fields struct page **inpages) 330293f1eb5SJ. Bruce Fields { 331293f1eb5SJ. Bruce Fields return ctx_id->mech_type->gm_ops 33200fd6e14SJ. Bruce Fields ->gss_wrap(ctx_id, offset, buf, inpages); 333293f1eb5SJ. Bruce Fields } 334293f1eb5SJ. Bruce Fields 335293f1eb5SJ. Bruce Fields u32 336293f1eb5SJ. Bruce Fields gss_unwrap(struct gss_ctx *ctx_id, 337293f1eb5SJ. Bruce Fields int offset, 338293f1eb5SJ. Bruce Fields struct xdr_buf *buf) 339293f1eb5SJ. Bruce Fields { 340293f1eb5SJ. Bruce Fields return ctx_id->mech_type->gm_ops 34100fd6e14SJ. Bruce Fields ->gss_unwrap(ctx_id, offset, buf); 342293f1eb5SJ. Bruce Fields } 343293f1eb5SJ. Bruce Fields 344293f1eb5SJ. Bruce Fields 3451da177e4SLinus Torvalds /* gss_delete_sec_context: free all resources associated with context_handle. 3461da177e4SLinus Torvalds * Note this differs from the RFC 2744-specified prototype in that we don't 3471da177e4SLinus Torvalds * bother returning an output token, since it would never be used anyway. */ 3481da177e4SLinus Torvalds 3491da177e4SLinus Torvalds u32 3501da177e4SLinus Torvalds gss_delete_sec_context(struct gss_ctx **context_handle) 3511da177e4SLinus Torvalds { 3521da177e4SLinus Torvalds dprintk("RPC: gss_delete_sec_context deleting %p\n", 3531da177e4SLinus Torvalds *context_handle); 3541da177e4SLinus Torvalds 3551da177e4SLinus Torvalds if (!*context_handle) 356a02cec21SEric Dumazet return GSS_S_NO_CONTEXT; 35727724426SAl Viro if ((*context_handle)->internal_ctx_id) 3581da177e4SLinus Torvalds (*context_handle)->mech_type->gm_ops 3591da177e4SLinus Torvalds ->gss_delete_sec_context((*context_handle) 3601da177e4SLinus Torvalds ->internal_ctx_id); 3611da177e4SLinus Torvalds gss_mech_put((*context_handle)->mech_type); 3621da177e4SLinus Torvalds kfree(*context_handle); 3631da177e4SLinus Torvalds *context_handle=NULL; 3641da177e4SLinus Torvalds return GSS_S_COMPLETE; 3651da177e4SLinus Torvalds } 366