sec_svc.c revision 7c478bd95313f5f23a4c958a745db2134aa03244
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License, Version 1.0 only
* (the "License"). You may not use this file except in compliance
* with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2004 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#pragma ident "%Z%%M% %I% %E% SMI"
/*
* sec_svc.c, Server-side rpc security interface.
*/
#ifdef _KERNEL
#include <rpc/auth_des.h>
#include <rpc/auth_sys.h>
#include <rpc/rpcsec_gss.h>
#include <rpc/svc_auth.h>
#else
#endif
/*
*/
/* ARGSUSED */
static int
{
}
struct svc_auth_ops svc_authany_ops = {
};
/*
* The call rpc message, msg has been obtained from the wire. The msg contains
* the raw form of credentials and verifiers. authenticate returns AUTH_OK
* if the msg is successfully authenticated. If AUTH_OK then the routine also
* does the following things:
* set rqst->rq_xprt->verf to the appropriate response verifier;
* sets rqst->rq_client_cred to the "cooked" form of the credentials.
*
* NB: rqst->rq_cxprt->verf must be pre-alloctaed;
* its length is set appropriately.
*
* The caller still owns and is responsible for msg->u.cmb.cred and
* msg->u.cmb.verf. The authentication system retains ownership of
* rqst->rq_client_cred, the cooked credentials.
*
* There is an assumption that any flavor less than AUTH_NULL is
* invalid.
*/
enum auth_stat
{
int cred_flavor;
/*
* Init the xp_auth to be no-op for all the flavors.
* Flavor specific routines will revise this when appropriate.
*/
*no_dispatch = FALSE;
switch (cred_flavor) {
case AUTH_NULL:
case AUTH_UNIX:
case AUTH_SHORT:
case AUTH_DES:
case RPCSEC_GSS:
/*
* RPCSEC_GSS flavor routine takes an additional
* boolean parameter that gets set to TRUE when
* the call is not to be dispatched to the server.
*/
}
return (AUTH_REJECTEDCRED);
}
/*
* sec_svc_getcred() gets unix cred of incoming security rpc requests.
* It also returns the prinicipal name and a cookie which is application
* dependent e.g. for nfs, it is the pseudo flavor.
*
* return 0 on failure
*/
int
int *secmod)
{
struct authunix_parms *aup;
struct authdes_cred *adc;
void *cookie;
stat = 1;
switch (flavor) {
case AUTH_UNIX:
stat = 0;
break;
case AUTH_NONE:
break;
case AUTH_DES:
break;
case RPCSEC_GSS:
stat = 0;
} else {
}
break;
default:
stat = 0;
break;
}
return (stat);
}
/* ARGSUSED */
enum auth_stat
{
return (AUTH_OK);
}
/*
* Load root principal names from user space to kernel space.
*
* flavor - security flavor
* count - number of principal names to be loaded
* proots - address of the array of root names.
* input is the array address in the user space,
* output is the kernel address.
*
* return 0 on failure.
*/
int
{
uint_t i, j;
#ifdef lint
#endif
/*
* Get list of names from user space
*/
/*
* And now copy each individual principal name
*/
switch (flavor) {
case AUTH_DES:
goto done;
for (i = 0; i < count; i++) {
/*
* copyinstr copies the complete string (including the
* NULL) and returns the len with the NULL byte
* included in the calculation as long as the max
* length is not exceeded.
*/
#ifdef _SYSCALL32_IMPL
if (model != DATAMODEL_NATIVE) {
} else
#endif
for (j = 0; j < i; j++) {
}
goto done;
}
}
return (1);
case RPCSEC_GSS:
goto done;
for (i = 0; i < count; i++) {
#ifdef _SYSCALL32_IMPL
if (model != DATAMODEL_NATIVE) {
} else
#endif
goto gssfreeup;
}
goto gssfreeup;
}
}
return (1);
default:
return (0);
}
for (j = 0; j < i; j++) {
}
}
done:
return (0);
}
/*
* Figure out everything we allocated in a root principal name list in
* order to free it up.
*/
void
{
int i;
switch (flavor) {
case AUTH_DES:
for (i = 0; i < count; i++)
break;
case RPCSEC_GSS:
for (i = 0; i < count; i++) {
continue;
}
break;
}
}
/*
* Check if the given principal name is in the root principal list
*/
{
int i, tmp_len;
switch (flavor) {
case AUTH_DES:
for (i = 0; i < count; i++)
return (TRUE);
break;
case RPCSEC_GSS:
for (i = 0; i < count; i++) {
return (TRUE);
}
break;
}
return (FALSE);
}
/*
* Miscellaneout "control" functions manipulating global RPC security
* attributes for server applications.
*/
{
switch (cmd) {
case RPC_SVC_SET_GSS_CALLBACK:
break;
default:
break;
}
return (result);
}