gss_impl.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*-
    2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
    3  *
    4  * Copyright (c) 2008 Isilon Inc http://www.isilon.com/
    5  * Authors: Doug Rabson <dfr@rabson.org>
    6  * Developed with Red Inc: Alfred Perlstein <alfred@freebsd.org>
    7  *
    8  * Redistribution and use in source and binary forms, with or without
    9  * modification, are permitted provided that the following conditions
   10  * are met:
   11  * 1. Redistributions of source code must retain the above copyright
   12  *    notice, this list of conditions and the following disclaimer.
   13  * 2. Redistributions in binary form must reproduce the above copyright
   14  *    notice, this list of conditions and the following disclaimer in the
   15  *    documentation and/or other materials provided with the distribution.
   16  *
   17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   27  * SUCH DAMAGE.
   28  */
   29 
   30 #include <sys/cdefs.h>
   31 __FBSDID("$FreeBSD$");
   32 
   33 #include <sys/param.h>
   34 #include <sys/kernel.h>
   35 #include <sys/kobj.h>
   36 #include <sys/lock.h>
   37 #include <sys/malloc.h>
   38 #include <sys/module.h>
   39 #include <sys/mutex.h>
   40 #include <sys/priv.h>
   41 #include <sys/syscall.h>
   42 #include <sys/sysent.h>
   43 #include <sys/sysproto.h>
   44 
   45 #include <kgssapi/gssapi.h>
   46 #include <kgssapi/gssapi_impl.h>
   47 #include <rpc/rpc.h>
   48 #include <rpc/rpc_com.h>
   49 #include <rpc/rpcsec_gss.h>
   50 
   51 #include "gssd.h"
   52 #include "kgss_if.h"
   53 
   54 MALLOC_DEFINE(M_GSSAPI, "GSS-API", "GSS-API");
   55 
   56 /*
   57  * Syscall hooks
   58  */
   59 static struct syscall_helper_data gssd_syscalls[] = {
   60         SYSCALL_INIT_HELPER(gssd_syscall),
   61         SYSCALL_INIT_LAST
   62 };
   63 
   64 struct kgss_mech_list kgss_mechs;
   65 CLIENT *kgss_gssd_handle;
   66 struct mtx kgss_gssd_lock;
   67 
   68 static int
   69 kgss_load(void)
   70 {
   71         int error;
   72 
   73         LIST_INIT(&kgss_mechs);
   74         error = syscall_helper_register(gssd_syscalls, SY_THR_STATIC_KLD);
   75         if (error != 0)
   76                 return (error);
   77         return (0);
   78 }
   79 
   80 static void
   81 kgss_unload(void)
   82 {
   83 
   84         syscall_helper_unregister(gssd_syscalls);
   85 }
   86 
   87 int
   88 sys_gssd_syscall(struct thread *td, struct gssd_syscall_args *uap)
   89 {
   90         struct sockaddr_un sun;
   91         struct netconfig *nconf;
   92         char path[MAXPATHLEN];
   93         int error;
   94         CLIENT *cl, *oldcl;
   95         
   96         error = priv_check(td, PRIV_NFS_DAEMON);
   97         if (error)
   98                 return (error);
   99 
  100         error = copyinstr(uap->path, path, sizeof(path), NULL);
  101         if (error)
  102                 return (error);
  103         if (strlen(path) + 1 > sizeof(sun.sun_path))
  104                 return (EINVAL);
  105 
  106         if (path[0] != '\0') {
  107                 sun.sun_family = AF_LOCAL;
  108                 strlcpy(sun.sun_path, path, sizeof(sun.sun_path));
  109                 sun.sun_len = SUN_LEN(&sun);
  110                 
  111                 nconf = getnetconfigent("local");
  112                 cl = clnt_reconnect_create(nconf,
  113                     (struct sockaddr *) &sun, GSSD, GSSDVERS,
  114                     RPC_MAXDATASIZE, RPC_MAXDATASIZE);
  115                 /*
  116                  * The number of retries defaults to INT_MAX, which effectively
  117                  * means an infinite, uninterruptable loop.  Limiting it to
  118                  * five retries keeps it from running forever.
  119                  */
  120                 if (cl != NULL) {
  121                         int retry_count = 5;
  122                         struct timeval timo;
  123                         CLNT_CONTROL(cl, CLSET_RETRIES, &retry_count);
  124 
  125                         /*
  126                          * Set the timeout for an upcall to 5 minutes.  The
  127                          * default of 25 seconds is not long enough for some
  128                          * gss_XXX() calls done by the gssd(8) daemon.
  129                          */
  130                         timo.tv_sec = 5 * 60;
  131                         timo.tv_usec = 0;
  132                         CLNT_CONTROL(cl, CLSET_TIMEOUT, &timo);
  133                 }
  134         } else
  135                 cl = NULL;
  136 
  137         mtx_lock(&kgss_gssd_lock);
  138         oldcl = kgss_gssd_handle;
  139         kgss_gssd_handle = cl;
  140         mtx_unlock(&kgss_gssd_lock);
  141 
  142         if (oldcl != NULL) {
  143                 CLNT_CLOSE(oldcl);
  144                 CLNT_RELEASE(oldcl);
  145         }
  146 
  147         return (0);
  148 }
  149 
  150 int
  151 kgss_oid_equal(const gss_OID oid1, const gss_OID oid2)
  152 {
  153 
  154         if (oid1 == oid2)
  155                 return (1);
  156         if (!oid1 || !oid2)
  157                 return (0);
  158         if (oid1->length != oid2->length)
  159                 return (0);
  160         if (memcmp(oid1->elements, oid2->elements, oid1->length))
  161                 return (0);
  162         return (1);
  163 }
  164 
  165 void
  166 kgss_install_mech(gss_OID mech_type, const char *name, struct kobj_class *cls)
  167 {
  168         struct kgss_mech *km;
  169 
  170         km = malloc(sizeof(struct kgss_mech), M_GSSAPI, M_WAITOK);
  171         km->km_mech_type = mech_type;
  172         km->km_mech_name = name;
  173         km->km_class = cls;
  174         LIST_INSERT_HEAD(&kgss_mechs, km, km_link);
  175 }
  176 
  177 void
  178 kgss_uninstall_mech(gss_OID mech_type)
  179 {
  180         struct kgss_mech *km;
  181 
  182         LIST_FOREACH(km, &kgss_mechs, km_link) {
  183                 if (kgss_oid_equal(km->km_mech_type, mech_type)) {
  184                         LIST_REMOVE(km, km_link);
  185                         free(km, M_GSSAPI);
  186                         return;
  187                 }
  188         }
  189 }
  190 
  191 gss_OID
  192 kgss_find_mech_by_name(const char *name)
  193 {
  194         struct kgss_mech *km;
  195 
  196         LIST_FOREACH(km, &kgss_mechs, km_link) {
  197                 if (!strcmp(km->km_mech_name, name)) {
  198                         return (km->km_mech_type);
  199                 }
  200         }
  201         return (GSS_C_NO_OID);
  202 }
  203 
  204 const char *
  205 kgss_find_mech_by_oid(const gss_OID oid)
  206 {
  207         struct kgss_mech *km;
  208 
  209         LIST_FOREACH(km, &kgss_mechs, km_link) {
  210                 if (kgss_oid_equal(km->km_mech_type, oid)) {
  211                         return (km->km_mech_name);
  212                 }
  213         }
  214         return (NULL);
  215 }
  216 
  217 gss_ctx_id_t
  218 kgss_create_context(gss_OID mech_type)
  219 {
  220         struct kgss_mech *km;
  221         gss_ctx_id_t ctx;
  222 
  223         LIST_FOREACH(km, &kgss_mechs, km_link) {
  224                 if (kgss_oid_equal(km->km_mech_type, mech_type))
  225                         break;
  226         }
  227         if (!km)
  228                 return (NULL);
  229 
  230         ctx = (gss_ctx_id_t) kobj_create(km->km_class, M_GSSAPI, M_WAITOK);
  231         KGSS_INIT(ctx);
  232 
  233         return (ctx);
  234 }
  235 
  236 void
  237 kgss_delete_context(gss_ctx_id_t ctx, gss_buffer_t output_token)
  238 {
  239 
  240         KGSS_DELETE(ctx, output_token);
  241         kobj_delete((kobj_t) ctx, M_GSSAPI);
  242 }
  243 
  244 OM_uint32
  245 kgss_transfer_context(gss_ctx_id_t ctx)
  246 {
  247         struct export_sec_context_res res;
  248         struct export_sec_context_args args;
  249         enum clnt_stat stat;
  250         OM_uint32 maj_stat;
  251 
  252         if (!kgss_gssd_handle)
  253                 return (GSS_S_FAILURE);
  254 
  255         args.ctx = ctx->handle;
  256         bzero(&res, sizeof(res));
  257         stat = gssd_export_sec_context_1(&args, &res, kgss_gssd_handle);
  258         if (stat != RPC_SUCCESS) {
  259                 return (GSS_S_FAILURE);
  260         }
  261 
  262         maj_stat = KGSS_IMPORT(ctx, res.format, &res.interprocess_token);
  263         ctx->handle = 0;
  264 
  265         xdr_free((xdrproc_t) xdr_export_sec_context_res, &res);
  266 
  267         return (maj_stat);
  268 }
  269 
  270 void
  271 kgss_copy_buffer(const gss_buffer_t from, gss_buffer_t to)
  272 {
  273         to->length = from->length;
  274         if (from->length) {
  275                 to->value = malloc(from->length, M_GSSAPI, M_WAITOK);
  276                 bcopy(from->value, to->value, from->length);
  277         } else {
  278                 to->value = NULL;
  279         }
  280 }
  281 
  282 /*
  283  * Acquire the kgss_gssd_handle and return it with a reference count,
  284  * if it is available.
  285  */
  286 CLIENT *
  287 kgss_gssd_client(void)
  288 {
  289         CLIENT *cl;
  290 
  291         mtx_lock(&kgss_gssd_lock);
  292         cl = kgss_gssd_handle;
  293         if (cl != NULL)
  294                 CLNT_ACQUIRE(cl);
  295         mtx_unlock(&kgss_gssd_lock);
  296         return (cl);
  297 }
  298 
  299 /*
  300  * Kernel module glue
  301  */
  302 static int
  303 kgssapi_modevent(module_t mod, int type, void *data)
  304 {
  305         int error = 0;
  306 
  307         switch (type) {
  308         case MOD_LOAD:
  309                 rpc_gss_entries.rpc_gss_refresh_auth = rpc_gss_refresh_auth;
  310                 rpc_gss_entries.rpc_gss_secfind = rpc_gss_secfind;
  311                 rpc_gss_entries.rpc_gss_secpurge = rpc_gss_secpurge;
  312                 rpc_gss_entries.rpc_gss_seccreate = rpc_gss_seccreate;
  313                 rpc_gss_entries.rpc_gss_set_defaults = rpc_gss_set_defaults;
  314                 rpc_gss_entries.rpc_gss_max_data_length =
  315                     rpc_gss_max_data_length;
  316                 rpc_gss_entries.rpc_gss_get_error = rpc_gss_get_error;
  317                 rpc_gss_entries.rpc_gss_mech_to_oid = rpc_gss_mech_to_oid;
  318                 rpc_gss_entries.rpc_gss_oid_to_mech = rpc_gss_oid_to_mech;
  319                 rpc_gss_entries.rpc_gss_qop_to_num = rpc_gss_qop_to_num;
  320                 rpc_gss_entries.rpc_gss_get_mechanisms = rpc_gss_get_mechanisms;
  321                 rpc_gss_entries.rpc_gss_get_versions = rpc_gss_get_versions;
  322                 rpc_gss_entries.rpc_gss_is_installed = rpc_gss_is_installed;
  323                 rpc_gss_entries.rpc_gss_set_svc_name = rpc_gss_set_svc_name;
  324                 rpc_gss_entries.rpc_gss_clear_svc_name = rpc_gss_clear_svc_name;
  325                 rpc_gss_entries.rpc_gss_getcred = rpc_gss_getcred;
  326                 rpc_gss_entries.rpc_gss_set_callback = rpc_gss_set_callback;
  327                 rpc_gss_entries.rpc_gss_clear_callback = rpc_gss_clear_callback;
  328                 rpc_gss_entries.rpc_gss_get_principal_name =
  329                     rpc_gss_get_principal_name;
  330                 rpc_gss_entries.rpc_gss_svc_max_data_length =
  331                     rpc_gss_svc_max_data_length;
  332                 mtx_init(&kgss_gssd_lock, "kgss_gssd_lock", NULL, MTX_DEF);
  333                 error = kgss_load();
  334                 break;
  335         case MOD_UNLOAD:
  336                 kgss_unload();
  337                 mtx_destroy(&kgss_gssd_lock);
  338                 /*
  339                  * Unloading of the kgssapi module is not currently supported.
  340                  * If somebody wants this, we would need to keep track of
  341                  * currently executing threads and make sure the count is 0.
  342                  */
  343                 /* FALLTHROUGH */
  344         default:
  345                 error = EOPNOTSUPP;
  346         }
  347         return (error);
  348 }
  349 static moduledata_t kgssapi_mod = {
  350         "kgssapi",
  351         kgssapi_modevent,
  352         NULL,
  353 };
  354 DECLARE_MODULE(kgssapi, kgssapi_mod, SI_SUB_VFS, SI_ORDER_ANY);
  355 MODULE_DEPEND(kgssapi, xdr, 1, 1, 1);
  356 MODULE_DEPEND(kgssapi, krpc, 1, 1, 1);
  357 MODULE_VERSION(kgssapi, 1);
Cache object: e997659114c7d4a8b04fca95efb1fd9f
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/kgssapi/gss_impl.c

FreeBSD/Linux Kernel Cross Reference
sys/kgssapi/gss_impl.c
