Home | History | Annotate | Line # | Download | only in rpc
svc_auth.c revision 1.15.56.1 
      1 /*	$NetBSD: svc_auth.c,v 1.15.56.1 2012/04/17 00:05:23 yamt Exp $	*/
      2 
      3 /*
      4  * Sun RPC is a product of Sun Microsystems, Inc. and is provided for
      5  * unrestricted use provided that this legend is included on all tape
      6  * media and as a part of the software program in whole or part.  Users
      7  * may copy or modify Sun RPC without charge, but are not authorized
      8  * to license or distribute it to anyone else except as part of a product or
      9  * program developed by the user.
     10  *
     11  * SUN RPC IS PROVIDED AS IS WITH NO WARRANTIES OF ANY KIND INCLUDING THE
     12  * WARRANTIES OF DESIGN, MERCHANTIBILITY AND FITNESS FOR A PARTICULAR
     13  * PURPOSE, OR ARISING FROM A COURSE OF DEALING, USAGE OR TRADE PRACTICE.
     14  *
     15  * Sun RPC is provided with no support and without any obligation on the
     16  * part of Sun Microsystems, Inc. to assist in its use, correction,
     17  * modification or enhancement.
     18  *
     19  * SUN MICROSYSTEMS, INC. SHALL HAVE NO LIABILITY WITH RESPECT TO THE
     20  * INFRINGEMENT OF COPYRIGHTS, TRADE SECRETS OR ANY PATENTS BY SUN RPC
     21  * OR ANY PART THEREOF.
     22  *
     23  * In no event will Sun Microsystems, Inc. be liable for any lost revenue
     24  * or profits or other special, indirect and consequential damages, even if
     25  * Sun has been advised of the possibility of such damages.
     26  *
     27  * Sun Microsystems, Inc.
     28  * 2550 Garcia Avenue
     29  * Mountain View, California  94043
     30  */
     31 /*
     32  * Copyright (c) 1986-1991 by Sun Microsystems Inc.
     33  */
     34 
     35 /* #ident	"@(#)svc_auth.c	1.16	94/04/24 SMI" */
     36 
     37 #include <sys/cdefs.h>
     38 #if defined(LIBC_SCCS) && !defined(lint)
     39 #if 0
     40 static char sccsid[] = "@(#)svc_auth.c 1.26 89/02/07 Copyr 1984 Sun Micro";
     41 #else
     42 __RCSID("$NetBSD: svc_auth.c,v 1.15.56.1 2012/04/17 00:05:23 yamt Exp $");
     43 #endif
     44 #endif
     45 
     46 /*
     47  * svc_auth.c, Server-side rpc authenticator interface.
     48  *
     49  */
     50 
     51 #include "namespace.h"
     52 #include "reentrant.h"
     53 #include <sys/types.h>
     54 #include <rpc/rpc.h>
     55 #include <assert.h>
     56 #include <stdlib.h>
     57 
     58 #ifdef __weak_alias
     59 __weak_alias(svc_auth_reg,_svc_auth_reg)
     60 #endif
     61 
     62 /*
     63  * svcauthsw is the bdevsw of server side authentication.
     64  *
     65  * Server side authenticators are called from authenticate by
     66  * using the client auth struct flavor field to index into svcauthsw.
     67  * The server auth flavors must implement a routine that looks
     68  * like:
     69  *
     70  *	enum auth_stat
     71  *	flavorx_auth(rqst, msg)
     72  *		struct svc_req *rqst;
     73  *		struct rpc_msg *msg;
     74  *
     75  */
     76 
     77 /* declarations to allow servers to specify new authentication flavors */
     78 struct authsvc {
     79 	int	flavor;
     80 	enum	auth_stat (*handler)(struct svc_req *, struct rpc_msg *);
     81 	struct	authsvc	  *next;
     82 };
     83 static struct authsvc *Auths = NULL;
     84 
     85 /*
     86  * The call rpc message, msg has been obtained from the wire.  The msg contains
     87  * the raw form of credentials and verifiers.  authenticate returns AUTH_OK
     88  * if the msg is successfully authenticated.  If AUTH_OK then the routine also
     89  * does the following things:
     90  * set rqst->rq_xprt->verf to the appropriate response verifier;
     91  * sets rqst->rq_client_cred to the "cooked" form of the credentials.
     92  *
     93  * NB: rqst->rq_cxprt->verf must be pre-alloctaed;
     94  * its length is set appropriately.
     95  *
     96  * The caller still owns and is responsible for msg->u.cmb.cred and
     97  * msg->u.cmb.verf.  The authentication system retains ownership of
     98  * rqst->rq_client_cred, the cooked credentials.
     99  *
    100  * There is an assumption that any flavour less than AUTH_NULL is
    101  * invalid.
    102  */
    103 enum auth_stat
    104 _authenticate(struct svc_req *rqst, struct rpc_msg *msg)
    105 {
    106 	int cred_flavor;
    107 	struct authsvc *asp;
    108 	enum auth_stat dummy;
    109 #ifdef _REENTRANT
    110 	extern mutex_t authsvc_lock;
    111 #endif
    112 
    113 	_DIAGASSERT(rqst != NULL);
    114 	_DIAGASSERT(msg != NULL);
    115 
    116 /* VARIABLES PROTECTED BY authsvc_lock: asp, Auths */
    117 
    118 	rqst->rq_cred = msg->rm_call.cb_cred;
    119 	rqst->rq_xprt->xp_verf.oa_flavor = _null_auth.oa_flavor;
    120 	rqst->rq_xprt->xp_verf.oa_length = 0;
    121 	cred_flavor = rqst->rq_cred.oa_flavor;
    122 	switch (cred_flavor) {
    123 	case AUTH_NULL:
    124 		dummy = _svcauth_null(rqst, msg);
    125 		return (dummy);
    126 	case AUTH_SYS:
    127 		dummy = _svcauth_unix(rqst, msg);
    128 		return (dummy);
    129 	case AUTH_SHORT:
    130 		dummy = _svcauth_short(rqst, msg);
    131 		return (dummy);
    132 #if 0
    133 	case AUTH_DES:
    134 		dummy = __svcauth_des(rqst, msg);
    135 		return (dummy);
    136 #endif
    137 	default:
    138 		break;
    139 	}
    140 
    141 	/* flavor doesn't match any of the builtin types, so try new ones */
    142 	mutex_lock(&authsvc_lock);
    143 	for (asp = Auths; asp; asp = asp->next) {
    144 		if (asp->flavor == cred_flavor) {
    145 			enum auth_stat as;
    146 
    147 			as = (*asp->handler)(rqst, msg);
    148 			mutex_unlock(&authsvc_lock);
    149 			return (as);
    150 		}
    151 	}
    152 	mutex_unlock(&authsvc_lock);
    153 
    154 	return (AUTH_REJECTEDCRED);
    155 }
    156 
    157 /*ARGSUSED*/
    158 enum auth_stat
    159 _svcauth_null(struct svc_req *rqst, struct rpc_msg *msg)
    160 {
    161 	return (AUTH_OK);
    162 }
    163 
    164 /*
    165  *  Allow the rpc service to register new authentication types that it is
    166  *  prepared to handle.  When an authentication flavor is registered,
    167  *  the flavor is checked against already registered values.  If not
    168  *  registered, then a new Auths entry is added on the list.
    169  *
    170  *  There is no provision to delete a registration once registered.
    171  *
    172  *  This routine returns:
    173  *	 0 if registration successful
    174  *	 1 if flavor already registered
    175  *	-1 if can't register (errno set)
    176  */
    177 
    178 int
    179 svc_auth_reg(
    180 	int cred_flavor,
    181 	enum auth_stat (*handler)(struct svc_req *, struct rpc_msg *))
    182 {
    183 	struct authsvc *asp;
    184 #ifdef _REENTRANT
    185 	extern mutex_t authsvc_lock;
    186 #endif
    187 
    188 	switch (cred_flavor) {
    189 	    case AUTH_NULL:
    190 	    case AUTH_SYS:
    191 	    case AUTH_SHORT:
    192 #if 0
    193 	    case AUTH_DES:
    194 #endif
    195 		/* already registered */
    196 		return (1);
    197 
    198 	    default:
    199 		mutex_lock(&authsvc_lock);
    200 		for (asp = Auths; asp; asp = asp->next) {
    201 			if (asp->flavor == cred_flavor) {
    202 				/* already registered */
    203 				mutex_unlock(&authsvc_lock);
    204 				return (1);
    205 			}
    206 		}
    207 
    208 		/* this is a new one, so go ahead and register it */
    209 		asp = mem_alloc(sizeof (*asp));
    210 		if (asp == NULL) {
    211 			mutex_unlock(&authsvc_lock);
    212 			return (-1);
    213 		}
    214 		asp->flavor = cred_flavor;
    215 		asp->handler = handler;
    216 		asp->next = Auths;
    217 		Auths = asp;
    218 		mutex_unlock(&authsvc_lock);
    219 		break;
    220 	}
    221 	return (0);
    222 }
    223