1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * CDDL HEADER START 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate * with the License. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate * See the License for the specific language governing permissions 12*0Sstevel@tonic-gate * and limitations under the License. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * CDDL HEADER END 21*0Sstevel@tonic-gate */ 22*0Sstevel@tonic-gate /* 23*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 24*0Sstevel@tonic-gate * Use is subject to license terms. 25*0Sstevel@tonic-gate */ 26*0Sstevel@tonic-gate 27*0Sstevel@tonic-gate /* 28*0Sstevel@tonic-gate * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved. 29*0Sstevel@tonic-gate */ 30*0Sstevel@tonic-gate 31*0Sstevel@tonic-gate /* 32*0Sstevel@tonic-gate * rpcsec_gss.h, RPCSEC_GSS security service interface. 33*0Sstevel@tonic-gate */ 34*0Sstevel@tonic-gate 35*0Sstevel@tonic-gate #ifndef _RPCSEC_GSS_H 36*0Sstevel@tonic-gate #define _RPCSEC_GSS_H 37*0Sstevel@tonic-gate 38*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 39*0Sstevel@tonic-gate 40*0Sstevel@tonic-gate #ifdef __cplusplus 41*0Sstevel@tonic-gate extern "C" { 42*0Sstevel@tonic-gate #endif 43*0Sstevel@tonic-gate 44*0Sstevel@tonic-gate #include <rpc/auth.h> 45*0Sstevel@tonic-gate #include <rpc/clnt.h> 46*0Sstevel@tonic-gate #include <gssapi/gssapi.h> 47*0Sstevel@tonic-gate 48*0Sstevel@tonic-gate /* 49*0Sstevel@tonic-gate * Interface definitions. 50*0Sstevel@tonic-gate */ 51*0Sstevel@tonic-gate #define MAX_NAME_LEN 64 52*0Sstevel@tonic-gate #define MAX_GSS_MECH 128 53*0Sstevel@tonic-gate #define MAX_GSS_NAME 128 54*0Sstevel@tonic-gate 55*0Sstevel@tonic-gate typedef enum { 56*0Sstevel@tonic-gate rpc_gss_svc_default = 0, 57*0Sstevel@tonic-gate rpc_gss_svc_none = 1, 58*0Sstevel@tonic-gate rpc_gss_svc_integrity = 2, 59*0Sstevel@tonic-gate rpc_gss_svc_privacy = 3 60*0Sstevel@tonic-gate } rpc_gss_service_t; 61*0Sstevel@tonic-gate 62*0Sstevel@tonic-gate /* 63*0Sstevel@tonic-gate * GSS-API based security mechanism type specified as 64*0Sstevel@tonic-gate * object identifiers (OIDs). 65*0Sstevel@tonic-gate * This type is derived from gss_OID_desc/gss_OID. 66*0Sstevel@tonic-gate */ 67*0Sstevel@tonic-gate #define rpc_gss_OID_s gss_OID_desc_struct 68*0Sstevel@tonic-gate typedef struct rpc_gss_OID_s rpc_gss_OID_desc, *rpc_gss_OID; 69*0Sstevel@tonic-gate 70*0Sstevel@tonic-gate /* 71*0Sstevel@tonic-gate * Interface data. 72*0Sstevel@tonic-gate * This is already suitable for both LP64 and ILP32. 73*0Sstevel@tonic-gate */ 74*0Sstevel@tonic-gate typedef struct rpc_gss_principal { 75*0Sstevel@tonic-gate int len; 76*0Sstevel@tonic-gate char name[1]; 77*0Sstevel@tonic-gate } *rpc_gss_principal_t; 78*0Sstevel@tonic-gate 79*0Sstevel@tonic-gate typedef struct { 80*0Sstevel@tonic-gate int req_flags; 81*0Sstevel@tonic-gate int time_req; 82*0Sstevel@tonic-gate gss_cred_id_t my_cred; 83*0Sstevel@tonic-gate gss_channel_bindings_t input_channel_bindings; 84*0Sstevel@tonic-gate } rpc_gss_options_req_t; 85*0Sstevel@tonic-gate 86*0Sstevel@tonic-gate typedef struct { 87*0Sstevel@tonic-gate int major_status; 88*0Sstevel@tonic-gate int minor_status; 89*0Sstevel@tonic-gate uint_t rpcsec_version; 90*0Sstevel@tonic-gate int ret_flags; 91*0Sstevel@tonic-gate int time_ret; 92*0Sstevel@tonic-gate gss_ctx_id_t gss_context; 93*0Sstevel@tonic-gate #ifdef _KERNEL 94*0Sstevel@tonic-gate rpc_gss_OID actual_mechanism; 95*0Sstevel@tonic-gate #else 96*0Sstevel@tonic-gate char actual_mechanism[MAX_GSS_MECH]; 97*0Sstevel@tonic-gate #endif 98*0Sstevel@tonic-gate } rpc_gss_options_ret_t; 99*0Sstevel@tonic-gate 100*0Sstevel@tonic-gate /* 101*0Sstevel@tonic-gate * raw credentials 102*0Sstevel@tonic-gate */ 103*0Sstevel@tonic-gate typedef struct { 104*0Sstevel@tonic-gate uint_t version; 105*0Sstevel@tonic-gate #ifdef _KERNEL 106*0Sstevel@tonic-gate rpc_gss_OID mechanism; 107*0Sstevel@tonic-gate uint_t qop; 108*0Sstevel@tonic-gate #else 109*0Sstevel@tonic-gate char *mechanism; 110*0Sstevel@tonic-gate char *qop; 111*0Sstevel@tonic-gate #endif 112*0Sstevel@tonic-gate rpc_gss_principal_t client_principal; 113*0Sstevel@tonic-gate char *svc_principal; /* service@server, e.g. nfs@caribe */ 114*0Sstevel@tonic-gate rpc_gss_service_t service; 115*0Sstevel@tonic-gate } rpc_gss_rawcred_t; 116*0Sstevel@tonic-gate 117*0Sstevel@tonic-gate /* 118*0Sstevel@tonic-gate * unix credentials 119*0Sstevel@tonic-gate */ 120*0Sstevel@tonic-gate typedef struct { 121*0Sstevel@tonic-gate uid_t uid; 122*0Sstevel@tonic-gate gid_t gid; 123*0Sstevel@tonic-gate short gidlen; 124*0Sstevel@tonic-gate gid_t *gidlist; 125*0Sstevel@tonic-gate } rpc_gss_ucred_t; 126*0Sstevel@tonic-gate 127*0Sstevel@tonic-gate /* 128*0Sstevel@tonic-gate * for callback routine 129*0Sstevel@tonic-gate */ 130*0Sstevel@tonic-gate typedef struct { 131*0Sstevel@tonic-gate uint_t program; 132*0Sstevel@tonic-gate uint_t version; 133*0Sstevel@tonic-gate bool_t (*callback)(); 134*0Sstevel@tonic-gate } rpc_gss_callback_t; 135*0Sstevel@tonic-gate 136*0Sstevel@tonic-gate /* 137*0Sstevel@tonic-gate * lock used for the callback routine 138*0Sstevel@tonic-gate */ 139*0Sstevel@tonic-gate typedef struct { 140*0Sstevel@tonic-gate bool_t locked; 141*0Sstevel@tonic-gate rpc_gss_rawcred_t *raw_cred; 142*0Sstevel@tonic-gate } rpc_gss_lock_t; 143*0Sstevel@tonic-gate 144*0Sstevel@tonic-gate 145*0Sstevel@tonic-gate /* 146*0Sstevel@tonic-gate * This is for user RPC applications. 147*0Sstevel@tonic-gate * Structure used to fetch the error code when one of 148*0Sstevel@tonic-gate * the rpc_gss_* routines fails. 149*0Sstevel@tonic-gate */ 150*0Sstevel@tonic-gate typedef struct { 151*0Sstevel@tonic-gate int rpc_gss_error; 152*0Sstevel@tonic-gate int system_error; 153*0Sstevel@tonic-gate } rpc_gss_error_t; 154*0Sstevel@tonic-gate 155*0Sstevel@tonic-gate #define RPC_GSS_ER_SUCCESS 0 /* no error */ 156*0Sstevel@tonic-gate #define RPC_GSS_ER_SYSTEMERROR 1 /* system error */ 157*0Sstevel@tonic-gate 158*0Sstevel@tonic-gate 159*0Sstevel@tonic-gate #ifdef _SYSCALL32 160*0Sstevel@tonic-gate struct gss_clnt_data32 { 161*0Sstevel@tonic-gate gss_OID_desc32 mechanism; 162*0Sstevel@tonic-gate rpc_gss_service_t service; 163*0Sstevel@tonic-gate char uname[MAX_NAME_LEN]; /* server's service name */ 164*0Sstevel@tonic-gate char inst[MAX_NAME_LEN]; /* server's instance name */ 165*0Sstevel@tonic-gate char realm[MAX_NAME_LEN]; /* server's realm */ 166*0Sstevel@tonic-gate uint_t qop; 167*0Sstevel@tonic-gate }; 168*0Sstevel@tonic-gate #endif 169*0Sstevel@tonic-gate 170*0Sstevel@tonic-gate /* 171*0Sstevel@tonic-gate * This is for Kernel RPC applications. 172*0Sstevel@tonic-gate * RPCSEC_GSS flavor specific data in sec_data opaque field. 173*0Sstevel@tonic-gate */ 174*0Sstevel@tonic-gate typedef struct gss_clnt_data { 175*0Sstevel@tonic-gate rpc_gss_OID_desc mechanism; 176*0Sstevel@tonic-gate rpc_gss_service_t service; 177*0Sstevel@tonic-gate char uname[MAX_NAME_LEN]; /* server's service name */ 178*0Sstevel@tonic-gate char inst[MAX_NAME_LEN]; /* server's instance name */ 179*0Sstevel@tonic-gate char realm[MAX_NAME_LEN]; /* server's realm */ 180*0Sstevel@tonic-gate uint_t qop; 181*0Sstevel@tonic-gate } gss_clntdata_t; 182*0Sstevel@tonic-gate 183*0Sstevel@tonic-gate 184*0Sstevel@tonic-gate struct svc_req; 185*0Sstevel@tonic-gate /* 186*0Sstevel@tonic-gate * KERNEL rpc_gss_* interfaces. 187*0Sstevel@tonic-gate */ 188*0Sstevel@tonic-gate #ifdef _KERNEL 189*0Sstevel@tonic-gate int rpc_gss_secget(CLIENT *, char *, rpc_gss_OID, 190*0Sstevel@tonic-gate rpc_gss_service_t, uint_t, rpc_gss_options_req_t *, 191*0Sstevel@tonic-gate rpc_gss_options_ret_t *, void *, cred_t *, AUTH **); 192*0Sstevel@tonic-gate 193*0Sstevel@tonic-gate void rpc_gss_secfree(AUTH *); 194*0Sstevel@tonic-gate 195*0Sstevel@tonic-gate int rpc_gss_seccreate(CLIENT *, char *, rpc_gss_OID, 196*0Sstevel@tonic-gate rpc_gss_service_t, uint_t, rpc_gss_options_req_t *, 197*0Sstevel@tonic-gate rpc_gss_options_ret_t *, cred_t *, AUTH **); 198*0Sstevel@tonic-gate 199*0Sstevel@tonic-gate int rpc_gss_revauth(uid_t, rpc_gss_OID); 200*0Sstevel@tonic-gate void rpc_gss_secpurge(void *); 201*0Sstevel@tonic-gate enum auth_stat __svcrpcsec_gss(struct svc_req *, 202*0Sstevel@tonic-gate struct rpc_msg *, bool_t *); 203*0Sstevel@tonic-gate bool_t rpc_gss_set_defaults(AUTH *, rpc_gss_service_t, uint_t); 204*0Sstevel@tonic-gate 205*0Sstevel@tonic-gate 206*0Sstevel@tonic-gate #else 207*0Sstevel@tonic-gate /* 208*0Sstevel@tonic-gate * USER rpc_gss_* public interfaces 209*0Sstevel@tonic-gate */ 210*0Sstevel@tonic-gate AUTH * 211*0Sstevel@tonic-gate rpc_gss_seccreate( 212*0Sstevel@tonic-gate CLIENT *clnt, /* associated client handle */ 213*0Sstevel@tonic-gate char *principal, /* server service principal */ 214*0Sstevel@tonic-gate char *mechanism, /* security mechanism */ 215*0Sstevel@tonic-gate rpc_gss_service_t service_type, /* security service */ 216*0Sstevel@tonic-gate char *qop, /* requested QOP */ 217*0Sstevel@tonic-gate rpc_gss_options_req_t *options_req, /* requested options */ 218*0Sstevel@tonic-gate rpc_gss_options_ret_t *options_ret /* returned options */ 219*0Sstevel@tonic-gate ); 220*0Sstevel@tonic-gate 221*0Sstevel@tonic-gate bool_t 222*0Sstevel@tonic-gate rpc_gss_get_principal_name( 223*0Sstevel@tonic-gate rpc_gss_principal_t *principal, 224*0Sstevel@tonic-gate char *mechanism, 225*0Sstevel@tonic-gate char *user_name, 226*0Sstevel@tonic-gate char *node, 227*0Sstevel@tonic-gate char *secdomain 228*0Sstevel@tonic-gate ); 229*0Sstevel@tonic-gate 230*0Sstevel@tonic-gate char **rpc_gss_get_mechanisms(); 231*0Sstevel@tonic-gate 232*0Sstevel@tonic-gate char **rpc_gss_get_mech_info( 233*0Sstevel@tonic-gate char *mechanism, 234*0Sstevel@tonic-gate rpc_gss_service_t *service 235*0Sstevel@tonic-gate ); 236*0Sstevel@tonic-gate 237*0Sstevel@tonic-gate bool_t 238*0Sstevel@tonic-gate rpc_gss_is_installed( 239*0Sstevel@tonic-gate char *mechanism 240*0Sstevel@tonic-gate ); 241*0Sstevel@tonic-gate 242*0Sstevel@tonic-gate bool_t 243*0Sstevel@tonic-gate rpc_gss_mech_to_oid( 244*0Sstevel@tonic-gate char *mech, 245*0Sstevel@tonic-gate rpc_gss_OID *oid 246*0Sstevel@tonic-gate ); 247*0Sstevel@tonic-gate 248*0Sstevel@tonic-gate bool_t 249*0Sstevel@tonic-gate rpc_gss_qop_to_num( 250*0Sstevel@tonic-gate char *qop, 251*0Sstevel@tonic-gate char *mech, 252*0Sstevel@tonic-gate uint_t *num 253*0Sstevel@tonic-gate ); 254*0Sstevel@tonic-gate 255*0Sstevel@tonic-gate bool_t 256*0Sstevel@tonic-gate rpc_gss_set_svc_name( 257*0Sstevel@tonic-gate char *principal, 258*0Sstevel@tonic-gate char *mechanism, 259*0Sstevel@tonic-gate uint_t req_time, 260*0Sstevel@tonic-gate uint_t program, 261*0Sstevel@tonic-gate uint_t version 262*0Sstevel@tonic-gate ); 263*0Sstevel@tonic-gate 264*0Sstevel@tonic-gate bool_t 265*0Sstevel@tonic-gate rpc_gss_set_defaults( 266*0Sstevel@tonic-gate AUTH *auth, 267*0Sstevel@tonic-gate rpc_gss_service_t service, 268*0Sstevel@tonic-gate char *qop 269*0Sstevel@tonic-gate ); 270*0Sstevel@tonic-gate 271*0Sstevel@tonic-gate void 272*0Sstevel@tonic-gate rpc_gss_get_error( 273*0Sstevel@tonic-gate rpc_gss_error_t *error 274*0Sstevel@tonic-gate ); 275*0Sstevel@tonic-gate 276*0Sstevel@tonic-gate /* 277*0Sstevel@tonic-gate * User level private interfaces 278*0Sstevel@tonic-gate */ 279*0Sstevel@tonic-gate enum auth_stat __svcrpcsec_gss(); 280*0Sstevel@tonic-gate bool_t __rpc_gss_wrap(); 281*0Sstevel@tonic-gate bool_t __rpc_gss_unwrap(); 282*0Sstevel@tonic-gate 283*0Sstevel@tonic-gate #endif 284*0Sstevel@tonic-gate 285*0Sstevel@tonic-gate /* 286*0Sstevel@tonic-gate * USER and KERNEL rpc_gss_* interfaces. 287*0Sstevel@tonic-gate */ 288*0Sstevel@tonic-gate bool_t 289*0Sstevel@tonic-gate rpc_gss_set_callback( 290*0Sstevel@tonic-gate rpc_gss_callback_t *cb 291*0Sstevel@tonic-gate ); 292*0Sstevel@tonic-gate 293*0Sstevel@tonic-gate bool_t 294*0Sstevel@tonic-gate rpc_gss_getcred( 295*0Sstevel@tonic-gate struct svc_req *req, 296*0Sstevel@tonic-gate rpc_gss_rawcred_t **rcred, 297*0Sstevel@tonic-gate rpc_gss_ucred_t **ucred, 298*0Sstevel@tonic-gate void **cookie 299*0Sstevel@tonic-gate ); 300*0Sstevel@tonic-gate 301*0Sstevel@tonic-gate int 302*0Sstevel@tonic-gate rpc_gss_max_data_length( 303*0Sstevel@tonic-gate AUTH *rpcgss_handle, 304*0Sstevel@tonic-gate int max_tp_unit_len 305*0Sstevel@tonic-gate ); 306*0Sstevel@tonic-gate 307*0Sstevel@tonic-gate int 308*0Sstevel@tonic-gate rpc_gss_svc_max_data_length( 309*0Sstevel@tonic-gate struct svc_req *req, 310*0Sstevel@tonic-gate int max_tp_unit_len 311*0Sstevel@tonic-gate ); 312*0Sstevel@tonic-gate 313*0Sstevel@tonic-gate bool_t 314*0Sstevel@tonic-gate rpc_gss_get_versions( 315*0Sstevel@tonic-gate uint_t *vers_hi, 316*0Sstevel@tonic-gate uint_t *vers_lo 317*0Sstevel@tonic-gate ); 318*0Sstevel@tonic-gate 319*0Sstevel@tonic-gate #define RPCSEC_GSS_REFRESH_ATTEMPTS 20 320*0Sstevel@tonic-gate 321*0Sstevel@tonic-gate /* 322*0Sstevel@tonic-gate * Protocol data. 323*0Sstevel@tonic-gate * 324*0Sstevel@tonic-gate * The reason to put these definition in this header file 325*0Sstevel@tonic-gate * is for 2.6 snoop to handle the RPCSEC_GSS protocol 326*0Sstevel@tonic-gate * interpretation. 327*0Sstevel@tonic-gate */ 328*0Sstevel@tonic-gate #define RPCSEC_GSS_DATA 0 329*0Sstevel@tonic-gate #define RPCSEC_GSS_INIT 1 330*0Sstevel@tonic-gate #define RPCSEC_GSS_CONTINUE_INIT 2 331*0Sstevel@tonic-gate #define RPCSEC_GSS_DESTROY 3 332*0Sstevel@tonic-gate 333*0Sstevel@tonic-gate #define RPCSEC_GSS_VERSION 1 334*0Sstevel@tonic-gate 335*0Sstevel@tonic-gate #ifdef __cplusplus 336*0Sstevel@tonic-gate } 337*0Sstevel@tonic-gate #endif 338*0Sstevel@tonic-gate 339*0Sstevel@tonic-gate #endif /* !_RPCSEC_GSS_H */ 340