usr/src/uts/common/rpc/auth.h

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  23  * Copyright 2017 Joyent Inc
  24  * Use is subject to license terms.
  25  */
  26 /* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
  27 /* All Rights Reserved */
  28 /*
  29  * Portions of this source code were derived from Berkeley
  30  * 4.3 BSD under license from the Regents of the University of
  31  * California.
  32  */
  33
  34 /*
  35  * auth.h, Authentication interface.
  36  *
  37  * The data structures are completely opaque to the client. The client
  38  * is required to pass a AUTH * to routines that create rpc
  39  * "sessions".
  40  */
  41
  42 #ifndef _RPC_AUTH_H
  43 #define _RPC_AUTH_H
  44
  45 #include <rpc/xdr.h>
  46 #include <rpc/clnt_stat.h>
  47 #include <sys/cred.h>
  48 #include <sys/tiuser.h>
  49 #ifdef _KERNEL
  50 #include <sys/zone.h>
  51 #endif
  52
  53 #ifdef  __cplusplus
  54 extern "C" {
  55 #endif
  56
  57 #define MAX_AUTH_BYTES  400     /* maximum length of an auth type, from RFC */
  58 #define MAXNETNAMELEN   255     /* maximum length of network user's name */
  59
  60 /*
  61  * NOTE: this value *must* be kept larger than the maximum size of all the
  62  * structs that rq_clntcred is cast to in the different authentication types.
  63  * If changes are made to any of these *_area structs, double-check they all
  64  * still fit. If any new authentication mechanisms are added, add a note here.
  65  *
  66  * Currently these structs can be found in:
  67  *  - __svcauth_sys (svc_auth_sys.c)
  68  *  - __svcauth_des (svcauth_des.c)
  69  *  - __svcauth_loopback (svc_auth_loopb.c)
  70  */
  71 #define RQCRED_SIZE     700     /* size allocated for rq_clntcred */
  72
  73 /*
  74  *  Client side authentication/security data
  75  */
  76 typedef struct sec_data {
  77         uint_t  secmod;         /* security mode number e.g. in nfssec.conf */
  78         uint_t  rpcflavor;      /* rpc flavors:AUTH_UNIX,AUTH_DES,RPCSEC_GSS */
  79         int     flags;          /* AUTH_F_xxx flags */
  80         uid_t   uid;            /* uid of caller for all sec flavors (NFSv4)  */
  81         caddr_t data;           /* opaque data per flavor */
  82 } sec_data_t;
  83
  84 #ifdef _SYSCALL32_IMPL
  85 struct sec_data32 {
  86         uint32_t        secmod; /* security mode number e.g. in nfssec.conf */
  87         uint32_t        rpcflavor; /* AUTH_UNIX,AUTH_DES,RPCSEC_GSS */
  88         int32_t         flags;  /* AUTH_F_xxx flags */
  89         uid_t           uid;    /* uid of caller for all sec flavors (NFSv4) */
  90         caddr32_t       data;   /* opaque data per flavor */
  91 };
  92 #endif /* _SYSCALL32_IMPL */
  93
  94 /*
  95  * AUTH_DES flavor specific data from sec_data opaque data field.
  96  * AUTH_KERB has the same structure.
  97  */
  98 typedef struct des_clnt_data {
  99         struct netbuf   syncaddr;       /* time sync addr */
 100         struct knetconfig *knconf;      /* knetconfig info that associated */
 101                                         /* with the syncaddr. */
 102         char            *netname;       /* server's netname */
 103         int             netnamelen;     /* server's netname len */
 104 } dh_k4_clntdata_t;
 105
 106 #ifdef _SYSCALL32_IMPL
 107 struct des_clnt_data32 {
 108         struct netbuf32 syncaddr;       /* time sync addr */
 109         caddr32_t knconf;               /* knetconfig info that associated */
 110                                         /* with the syncaddr. */
 111         caddr32_t netname;              /* server's netname */
 112         int32_t netnamelen;             /* server's netname len */
 113 };
 114 #endif /* _SYSCALL32_IMPL */
 115
 116 /*
 117  * flavor specific data to hold the data for AUTH_DES/AUTH_KERB(v4)
 118  * in sec_data->data opaque field.
 119  */
 120 typedef struct krb4_svc_data {
 121         int             window;         /* window option value */
 122 } krb4_svcdata_t;
 123
 124 typedef struct krb4_svc_data    des_svcdata_t;
 125
 126 /*
 127  * authentication/security specific flags
 128  */
 129 #define AUTH_F_RPCTIMESYNC      0x001   /* use RPC to do time sync */
 130 #define AUTH_F_TRYNONE          0x002   /* allow fall back to AUTH_NONE */
 131
 132
 133 /*
 134  * Status returned from authentication check
 135  */
 136 enum auth_stat {
 137         AUTH_OK = 0,
 138         /*
 139          * failed at remote end
 140          */
 141         AUTH_BADCRED = 1,               /* bogus credentials (seal broken) */
 142         AUTH_REJECTEDCRED = 2,          /* client should begin new session */
 143         AUTH_BADVERF = 3,               /* bogus verifier (seal broken) */
 144         AUTH_REJECTEDVERF = 4,          /* verifier expired or was replayed */
 145         AUTH_TOOWEAK = 5,               /* rejected due to security reasons */
 146         /*
 147          * failed locally
 148          */
 149         AUTH_INVALIDRESP = 6,           /* bogus response verifier */
 150         AUTH_FAILED = 7,                        /* some unknown reason */
 151         /*
 152          * kerberos errors
 153          */
 154         AUTH_KERB_GENERIC = 8,          /* kerberos generic error */
 155         AUTH_TIMEEXPIRE = 9,            /* time of credential expired */
 156         AUTH_TKT_FILE = 10,             /* something wrong with ticket file */
 157         AUTH_DECODE = 11,               /* can't decode authenticator */
 158         AUTH_NET_ADDR = 12,             /* wrong net address in ticket */
 159         /*
 160          * GSS related errors
 161          */
 162         RPCSEC_GSS_NOCRED = 13,         /* no credentials for user */
 163         RPCSEC_GSS_FAILED = 14          /* GSS failure, credentials deleted */
 164 };
 165 typedef enum auth_stat AUTH_STAT;
 166
 167 union des_block {
 168         struct  {
 169                 uint32_t high;
 170                 uint32_t low;
 171         } key;
 172         char c[8];
 173 };
 174 typedef union des_block des_block;
 175
 176 #ifdef __STDC__
 177 extern bool_t xdr_des_block(XDR *, des_block *);
 178 #else
 179 extern bool_t xdr_des_block();
 180 #endif
 181
 182
 183 /*
 184  * Authentication info. Opaque to client.
 185  */
 186 struct opaque_auth {
 187         enum_t  oa_flavor;              /* flavor of auth */
 188         caddr_t oa_base;                /* address of more auth stuff */
 189         uint_t  oa_length;              /* not to exceed MAX_AUTH_BYTES */
 190 };
 191
 192
 193 /*
 194  * Auth handle, interface to client side authenticators.
 195  */
 196 typedef struct __auth {
 197         struct  opaque_auth     ah_cred;
 198         struct  opaque_auth     ah_verf;
 199         union   des_block       ah_key;
 200         struct auth_ops {
 201 #ifdef __STDC__
 202                 void    (*ah_nextverf)(struct __auth *);
 203 #ifdef _KERNEL
 204                 int     (*ah_marshal)(struct __auth *, XDR *, struct cred *);
 205 #else
 206                 int     (*ah_marshal)(struct __auth *, XDR *);
 207 #endif
 208                 /* nextverf & serialize */
 209                 int     (*ah_validate)(struct __auth *,
 210                     struct opaque_auth *);
 211                 /* validate varifier */
 212 #ifdef _KERNEL
 213                 int     (*ah_refresh)(struct __auth *, struct rpc_msg *,
 214                     cred_t *);
 215 #else
 216                 int     (*ah_refresh)(struct __auth *, void *);
 217                 /* refresh credentials */
 218 #endif
 219                 void    (*ah_destroy)(struct __auth *);
 220                 /* destroy this structure */
 221
 222 #ifdef _KERNEL
 223                 int     (*ah_wrap)(struct __auth *, caddr_t, uint_t,
 224                     XDR *, xdrproc_t, caddr_t);
 225                 int     (*ah_unwrap)(struct __auth *, XDR *, xdrproc_t,
 226                     caddr_t);
 227 #endif
 228 #else
 229                 void    (*ah_nextverf)();
 230                 int     (*ah_marshal)();        /* nextverf & serialize */
 231                 int     (*ah_validate)();       /* validate verifier */
 232                 int     (*ah_refresh)();        /* refresh credentials */
 233                 void    (*ah_destroy)();        /* destroy this structure */
 234 #ifdef _KERNEL
 235                 int     (*ah_wrap)();           /* encode XDR data */
 236                 int     (*ah_unwrap)();         /* decode XDR data */
 237 #endif
 238
 239 #endif
 240         } *ah_ops;
 241         caddr_t ah_private;
 242 } AUTH;
 243
 244
 245 /*
 246  * Authentication ops.
 247  * The ops and the auth handle provide the interface to the authenticators.
 248  *
 249  * AUTH *auth;
 250  * XDR  *xdrs;
 251  * struct opaque_auth verf;
 252  */
 253 #define AUTH_NEXTVERF(auth)             \
 254                 ((*((auth)->ah_ops->ah_nextverf))(auth))
 255 #define auth_nextverf(auth)             \
 256                 ((*((auth)->ah_ops->ah_nextverf))(auth))
 257
 258
 259 #ifdef _KERNEL
 260 #define AUTH_MARSHALL(auth, xdrs, cred) \
 261                 ((*((auth)->ah_ops->ah_marshal))(auth, xdrs, cred))
 262 #define auth_marshall(auth, xdrs, cred) \
 263                 ((*((auth)->ah_ops->ah_marshal))(auth, xdrs, cred))
 264 #else
 265 #define AUTH_MARSHALL(auth, xdrs)       \
 266                 ((*((auth)->ah_ops->ah_marshal))(auth, xdrs))
 267 #define auth_marshall(auth, xdrs)       \
 268                 ((*((auth)->ah_ops->ah_marshal))(auth, xdrs))
 269 #endif
 270
 271
 272 #define AUTH_VALIDATE(auth, verfp)      \
 273                 ((*((auth)->ah_ops->ah_validate))((auth), verfp))
 274 #define auth_validate(auth, verfp)      \
 275                 ((*((auth)->ah_ops->ah_validate))((auth), verfp))
 276
 277 #ifdef _KERNEL
 278 #define AUTH_REFRESH(auth, msg, cr)             \
 279                 ((*((auth)->ah_ops->ah_refresh))(auth, msg, cr))
 280 #define auth_refresh(auth, msg, cr)             \
 281                 ((*((auth)->ah_ops->ah_refresh))(auth, msg, cr))
 282 #else
 283 #define AUTH_REFRESH(auth, msg)         \
 284                 ((*((auth)->ah_ops->ah_refresh))(auth, msg))
 285 #define auth_refresh(auth, msg)         \
 286                 ((*((auth)->ah_ops->ah_refresh))(auth, msg))
 287 #endif
 288
 289 #define AUTH_DESTROY(auth)              \
 290                 ((*((auth)->ah_ops->ah_destroy))(auth))
 291 #define auth_destroy(auth)              \
 292                 ((*((auth)->ah_ops->ah_destroy))(auth))
 293
 294 /*
 295  * Auth flavors can now apply a transformation in addition to simple XDR
 296  * on the body of a call/response in ways that depend on the flavor being
 297  * used.  These interfaces provide a generic interface between the
 298  * internal RPC frame and the auth flavor specific code to allow the
 299  * auth flavor to encode (WRAP) or decode (UNWRAP) the body.
 300  */
 301 #ifdef _KERNEL
 302 #define AUTH_WRAP(auth, buf, buflen, xdrs, xfunc, xwhere)       \
 303                 ((*((auth)->ah_ops->ah_wrap))(auth, buf, buflen, \
 304                                 xdrs, xfunc, xwhere))
 305 #define auth_wrap(auth, buf, buflen, xdrs, xfunc, xwhere)       \
 306                 ((*((auth)->ah_ops->ah_wrap))(auth, buf, buflen, \
 307                                 xdrs, xfunc, xwhere))
 308
 309 #define AUTH_UNWRAP(auth, xdrs, xfunc, xwhere)  \
 310                 ((*((auth)->ah_ops->ah_unwrap))(auth, xdrs, xfunc, xwhere))
 311 #define auth_unwrap(auth, xdrs) \
 312                 ((*((auth)->ah_ops->ah_unwrap))(auth, xdrs, xfunc, xwhere))
 313 #endif
 314
 315 extern struct opaque_auth _null_auth;
 316
 317 /*
 318  * These are the various implementations of client side authenticators.
 319  */
 320
 321 /*
 322  * System style authentication
 323  * AUTH *authsys_create(machname, uid, gid, len, aup_gids)
 324  *      const char *machname;
 325  *      const uid_t uid;
 326  *      const gid_t gid;
 327  *      const int len;
 328  *      const gid_t *aup_gids;
 329  */
 330 #ifdef _KERNEL
 331 extern AUTH *authkern_create(void);             /* takes no parameters */
 332 extern int authkern_init(void *, void *, int);
 333 extern struct kmem_cache *authkern_cache;
 334 extern AUTH *authnone_create(void);             /* takes no parameters */
 335 extern int authnone_init(void *, void *, int);
 336 extern struct kmem_cache *authnone_cache;
 337 extern AUTH *authloopback_create(void);         /* takes no parameters */
 338 extern int authloopback_init(void *, void *, int);
 339 extern struct kmem_cache *authloopback_cache;
 340 #else /* _KERNEL */
 341 #ifdef __STDC__
 342 extern AUTH *authsys_create(const char *, const uid_t, const gid_t, const int,
 343     const gid_t *);
 344 extern AUTH *authsys_create_default(void);      /* takes no parameters */
 345 extern AUTH *authnone_create(void);             /* takes no parameters */
 346 #else /* __STDC__ */
 347 extern AUTH *authsys_create();
 348 extern AUTH *authsys_create_default();  /* takes no parameters */
 349 extern AUTH *authnone_create(); /* takes no parameters */
 350 #endif /* __STDC__ */
 351 /* Will get obsolete in near future */
 352 #define authunix_create         authsys_create
 353 #define authunix_create_default authsys_create_default
 354 #endif /* _KERNEL */
 355
 356 /*
 357  * DES style authentication
 358  * AUTH *authdes_seccreate(servername, window, timehost, ckey)
 359  *      const char *servername;         - network name of server
 360  *      const uint_t window;                    - time to live
 361  *      const char *timehost;                   - optional hostname to sync with
 362  *      const des_block *ckey;          - optional conversation key to use
 363  */
 364 /* Will get obsolete in near future */
 365 #ifdef _KERNEL
 366 extern int authdes_create(char *, uint_t, struct netbuf *, struct knetconfig *,
 367     des_block *, int, AUTH **retauth);
 368 #else /* _KERNEL */
 369 #ifdef __STDC__
 370 extern AUTH *authdes_seccreate(const char *, const uint_t, const  char *,
 371     const des_block *);
 372 #else
 373 extern AUTH *authdes_seccreate();
 374 #endif /* __STDC__ */
 375 #endif /* _KERNEL */
 376
 377 /*
 378  *  Netname manipulating functions
 379  */
 380
 381 #ifdef  _KERNEL
 382 extern enum clnt_stat netname2user(char *, uid_t *, gid_t *, int *, gid_t *);
 383 #endif
 384 #ifdef __STDC__
 385 extern int getnetname(char *);
 386 extern int host2netname(char *, const char *, const char *);
 387 extern int user2netname(char *, const uid_t, const char *);
 388 #ifndef _KERNEL
 389 extern int netname2user(const char *, uid_t *, gid_t *, int *, gid_t *);
 390 #endif
 391 extern int netname2host(const char *, char *, const int);
 392 #else
 393 extern int getnetname();
 394 extern int host2netname();
 395 extern int user2netname();
 396 extern int netname2host();
 397 #endif
 398
 399 /*
 400  * These routines interface to the keyserv daemon
 401  */
 402
 403 #ifdef _KERNEL
 404 extern enum clnt_stat key_decryptsession();
 405 extern enum clnt_stat key_encryptsession();
 406 extern enum clnt_stat key_gendes();
 407 extern enum clnt_stat key_getnetname();
 408 #endif
 409
 410 #ifndef _KERNEL
 411 #ifdef  __STDC__
 412 extern int key_decryptsession(const char *, des_block *);
 413 extern int key_encryptsession(const char *, des_block *);
 414 extern int key_gendes(des_block *);
 415 extern int key_setsecret(const char *);
 416 extern int key_secretkey_is_set(void);
 417 /*
 418  * The following routines are private.
 419  */
 420 extern int key_setnet_ruid();
 421 extern int key_setnet_g_ruid();
 422 extern int key_removesecret_g_ruid();
 423 extern int key_secretkey_is_set_g_ruid();
 424 extern AUTH *authsys_create_ruid();
 425 #else
 426 extern int key_decryptsession();
 427 extern int key_encryptsession();
 428 extern int key_gendes();
 429 extern int key_setsecret();
 430 extern int key_secretkey_is_set();
 431 #endif
 432 #endif
 433
 434
 435 /*
 436  * Kerberos style authentication
 437  * AUTH *authkerb_seccreate(service, srv_inst, realm, window, timehost, status)
 438  *      const char *service;                    - service name
 439  *      const char *srv_inst;                   - server instance
 440  *      const char *realm;                      - server realm
 441  *      const uint_t window;                    - time to live
 442  *      const char *timehost;                   - optional hostname to sync with
 443  *      int *status;                    - kerberos status returned
 444  */
 445 #ifdef _KERNEL
 446 extern int    authkerb_create(char *, char *, char *, uint_t,
 447     struct netbuf *, int *, struct knetconfig *, int, AUTH **);
 448 #else
 449 #ifdef __STDC__
 450 extern AUTH *authkerb_seccreate(const char *, const char *, const  char *,
 451     const uint_t, const char *, int *);
 452 #else
 453 extern AUTH *authkerb_seccreate();
 454 #endif
 455 #endif /* _KERNEL */
 456
 457 /*
 458  * Map a kerberos credential into a unix cred.
 459  *
 460  *  authkerb_getucred(rqst, uid, gid, grouplen, groups)
 461  *      const struct svc_req *rqst;             - request pointer
 462  *      uid_t *uid;
 463  *      gid_t *gid;
 464  *      short *grouplen;
 465  *      int   *groups;
 466  *
 467  */
 468 #ifdef __STDC__
 469 struct svc_req;
 470 extern int authkerb_getucred(struct svc_req *, uid_t *, gid_t *,
 471     short *, int *);
 472 #else
 473 extern int authkerb_getucred();
 474 #endif
 475
 476 #ifdef _KERNEL
 477 /*
 478  * XDR an opaque authentication struct.  See auth.h.
 479  */
 480 extern bool_t xdr_opaque_auth(XDR *, struct opaque_auth *);
 481 #endif
 482
 483 #ifdef _KERNEL
 484 extern int authany_wrap(AUTH *, caddr_t, uint_t, XDR *, xdrproc_t, caddr_t);
 485 extern int authany_unwrap(AUTH *, XDR *, xdrproc_t, caddr_t);
 486 #endif
 487
 488 #define AUTH_NONE       0               /* no authentication */
 489 #define AUTH_NULL       0               /* backward compatibility */
 490 #define AUTH_SYS        1               /* unix style (uid, gids) */
 491 #define AUTH_UNIX       AUTH_SYS
 492 #define AUTH_SHORT      2               /* short hand unix style */
 493 #define AUTH_DH         3               /* for Diffie-Hellman mechanism */
 494 #define AUTH_DES        AUTH_DH         /* for backward compatibility */
 495 #define AUTH_KERB       4               /* kerberos style */
 496 #define RPCSEC_GSS      6               /* GSS-API style */
 497
 498 #define AUTH_LOOPBACK   21982           /* unix style w/ expanded groups */
 499                                         /* for use over the local transport */
 500
 501 #ifdef _KERNEL
 502 extern char     loopback_name[];
 503
 504 extern zone_key_t       auth_zone_key;
 505 extern void *           auth_zone_init(zoneid_t);
 506 extern void             auth_zone_fini(zoneid_t, void *);
 507 #endif
 508
 509 #ifdef  __cplusplus
 510 }
 511 #endif
 512
 513 #endif  /* !_RPC_AUTH_H */