lustre/ptlrpc/gss/gss_mech_switch.c

   1 /* -*- mode: c; c-basic-offset: 8; indent-tabs-mode: nil; -*-
   2  * vim:expandtab:shiftwidth=8:tabstop=8:
   3  *
   4  * Modifications for Lustre
   5  * Copyright 2004 - 2006, Cluster File Systems, Inc.
   6  * All rights reserved
   7  * Author: Eric Mei <ericm@clusterfs.com>
   8  */
   9
  10 /*
  11  *  linux/net/sunrpc/gss_mech_switch.c
  12  *
  13  *  Copyright (c) 2001 The Regents of the University of Michigan.
  14  *  All rights reserved.
  15  *
  16  *  J. Bruce Fields   <bfields@umich.edu>
  17  *
  18  *  Redistribution and use in source and binary forms, with or without
  19  *  modification, are permitted provided that the following conditions
  20  *  are met:
  21  *
  22  *  1. Redistributions of source code must retain the above copyright
  23  *     notice, this list of conditions and the following disclaimer.
  24  *  2. Redistributions in binary form must reproduce the above copyright
  25  *     notice, this list of conditions and the following disclaimer in the
  26  *     documentation and/or other materials provided with the distribution.
  27  *  3. Neither the name of the University nor the names of its
  28  *     contributors may be used to endorse or promote products derived
  29  *     from this software without specific prior written permission.
  30  *
  31  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  32  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  33  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  34  *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  35  *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  36  *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  37  *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  38  *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  39  *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  40  *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  41  *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  42  *
  43  */
  44
  45 #ifndef EXPORT_SYMTAB
  46 # define EXPORT_SYMTAB
  47 #endif
  48 #define DEBUG_SUBSYSTEM S_SEC
  49 #ifdef __KERNEL__
  50 #include <linux/init.h>
  51 #include <linux/module.h>
  52 #include <linux/slab.h>
  53 #include <linux/mutex.h>
  54 #else
  55 #include <liblustre.h>
  56 #endif
  57
  58 #include <obd.h>
  59 #include <obd_class.h>
  60 #include <obd_support.h>
  61 #include <lustre/lustre_idl.h>
  62 #include <lustre_net.h>
  63 #include <lustre_import.h>
  64 #include <lustre_sec.h>
  65
  66 #include "gss_err.h"
  67 #include "gss_internal.h"
  68 #include "gss_api.h"
  69
  70 static CFS_LIST_HEAD(registered_mechs);
  71 static spinlock_t registered_mechs_lock = SPIN_LOCK_UNLOCKED;
  72
  73 int lgss_mech_register(struct gss_api_mech *gm)
  74 {
  75         spin_lock(&registered_mechs_lock);
  76         list_add(&gm->gm_list, &registered_mechs);
  77         spin_unlock(&registered_mechs_lock);
  78         CWARN("Register %s mechanism\n", gm->gm_name);
  79         return 0;
  80 }
  81
  82 void lgss_mech_unregister(struct gss_api_mech *gm)
  83 {
  84         spin_lock(&registered_mechs_lock);
  85         list_del(&gm->gm_list);
  86         spin_unlock(&registered_mechs_lock);
  87         CWARN("Unregister %s mechanism\n", gm->gm_name);
  88 }
  89
  90
  91 struct gss_api_mech *lgss_mech_get(struct gss_api_mech *gm)
  92 {
  93         __module_get(gm->gm_owner);
  94         return gm;
  95 }
  96
  97 struct gss_api_mech *lgss_name_to_mech(char *name)
  98 {
  99         struct gss_api_mech *pos, *gm = NULL;
 100
 101         spin_lock(&registered_mechs_lock);
 102         list_for_each_entry(pos, &registered_mechs, gm_list) {
 103                 if (0 == strcmp(name, pos->gm_name)) {
 104                         if (!try_module_get(pos->gm_owner))
 105                                 continue;
 106                         gm = pos;
 107                         break;
 108                 }
 109         }
 110         spin_unlock(&registered_mechs_lock);
 111         return gm;
 112
 113 }
 114
 115 static inline
 116 int mech_supports_subflavor(struct gss_api_mech *gm, __u32 subflavor)
 117 {
 118         int i;
 119
 120         for (i = 0; i < gm->gm_sf_num; i++) {
 121                 if (gm->gm_sfs[i].sf_subflavor == subflavor)
 122                         return 1;
 123         }
 124         return 0;
 125 }
 126
 127 struct gss_api_mech *lgss_subflavor_to_mech(__u32 subflavor)
 128 {
 129         struct gss_api_mech *pos, *gm = NULL;
 130
 131         spin_lock(&registered_mechs_lock);
 132         list_for_each_entry(pos, &registered_mechs, gm_list) {
 133                 if (!try_module_get(pos->gm_owner))
 134                         continue;
 135                 if (!mech_supports_subflavor(pos, subflavor)) {
 136                         module_put(pos->gm_owner);
 137                         continue;
 138                 }
 139                 gm = pos;
 140                 break;
 141         }
 142         spin_unlock(&registered_mechs_lock);
 143         return gm;
 144 }
 145
 146 void lgss_mech_put(struct gss_api_mech *gm)
 147 {
 148         module_put(gm->gm_owner);
 149 }
 150
 151 /* The mech could probably be determined from the token instead, but it's just
 152  * as easy for now to pass it in. */
 153 __u32 lgss_import_sec_context(rawobj_t *input_token,
 154                               struct gss_api_mech *mech,
 155                               struct gss_ctx **ctx_id)
 156 {
 157         OBD_ALLOC_PTR(*ctx_id);
 158         if (*ctx_id == NULL)
 159                 return GSS_S_FAILURE;
 160
 161         (*ctx_id)->mech_type = lgss_mech_get(mech);
 162
 163         LASSERT(mech);
 164         LASSERT(mech->gm_ops);
 165         LASSERT(mech->gm_ops->gss_import_sec_context);
 166         return mech->gm_ops->gss_import_sec_context(input_token, *ctx_id);
 167 }
 168
 169 __u32 lgss_copy_reverse_context(struct gss_ctx *ctx_id,
 170                                 struct gss_ctx **ctx_id_new)
 171 {
 172         struct gss_api_mech *mech = ctx_id->mech_type;
 173         __u32                major;
 174
 175         LASSERT(mech);
 176
 177         OBD_ALLOC_PTR(*ctx_id_new);
 178         if (*ctx_id_new == NULL)
 179                 return GSS_S_FAILURE;
 180
 181         (*ctx_id_new)->mech_type = lgss_mech_get(mech);
 182
 183         LASSERT(mech);
 184         LASSERT(mech->gm_ops);
 185         LASSERT(mech->gm_ops->gss_copy_reverse_context);
 186
 187         major = mech->gm_ops->gss_copy_reverse_context(ctx_id, *ctx_id_new);
 188         if (major != GSS_S_COMPLETE) {
 189                 lgss_mech_put(mech);
 190                 OBD_FREE_PTR(*ctx_id_new);
 191                 *ctx_id_new = NULL;
 192         }
 193         return major;
 194 }
 195
 196 /*
 197  * this interface is much simplified, currently we only need endtime.
 198  */
 199 __u32 lgss_inquire_context(struct gss_ctx *context_handle,
 200                            unsigned long  *endtime)
 201 {
 202         LASSERT(context_handle);
 203         LASSERT(context_handle->mech_type);
 204         LASSERT(context_handle->mech_type->gm_ops);
 205         LASSERT(context_handle->mech_type->gm_ops->gss_inquire_context);
 206
 207         return context_handle->mech_type->gm_ops
 208                 ->gss_inquire_context(context_handle,
 209                                       endtime);
 210 }
 211
 212 /* gss_get_mic: compute a mic over message and return mic_token. */
 213 __u32 lgss_get_mic(struct gss_ctx *context_handle,
 214                    int msgcnt,
 215                    rawobj_t *msg,
 216                    rawobj_t *mic_token)
 217 {
 218         LASSERT(context_handle);
 219         LASSERT(context_handle->mech_type);
 220         LASSERT(context_handle->mech_type->gm_ops);
 221         LASSERT(context_handle->mech_type->gm_ops->gss_get_mic);
 222
 223         return context_handle->mech_type->gm_ops
 224                 ->gss_get_mic(context_handle,
 225                               msgcnt,
 226                               msg,
 227                               mic_token);
 228 }
 229
 230 /* gss_verify_mic: check whether the provided mic_token verifies message. */
 231 __u32 lgss_verify_mic(struct gss_ctx *context_handle,
 232                       int msgcnt,
 233                       rawobj_t *msg,
 234                       rawobj_t *mic_token)
 235 {
 236         LASSERT(context_handle);
 237         LASSERT(context_handle->mech_type);
 238         LASSERT(context_handle->mech_type->gm_ops);
 239         LASSERT(context_handle->mech_type->gm_ops->gss_verify_mic);
 240
 241         return context_handle->mech_type->gm_ops
 242                 ->gss_verify_mic(context_handle,
 243                                  msgcnt,
 244                                  msg,
 245                                  mic_token);
 246 }
 247
 248 #if 0
 249 __u32 lgss_wrap(struct gss_ctx *context_handle,
 250                 __u32 qop,
 251                 rawobj_buf_t *inbuf,
 252                 rawobj_t *outbuf)
 253 {
 254         LASSERT(context_handle);
 255         LASSERT(context_handle->mech_type);
 256         LASSERT(context_handle->mech_type->gm_ops);
 257         LASSERT(context_handle->mech_type->gm_ops->gss_wrap);
 258
 259         return context_handle->mech_type->gm_ops
 260                 ->gss_wrap(context_handle, qop, inbuf, outbuf);
 261 }
 262 #endif
 263
 264 __u32 lgss_wrap(struct gss_ctx *context_handle,
 265                 rawobj_t *msg,
 266                 int msg_buflen,
 267                 rawobj_t *out_token)
 268 {
 269         LASSERT(context_handle);
 270         LASSERT(context_handle->mech_type);
 271         LASSERT(context_handle->mech_type->gm_ops);
 272         LASSERT(context_handle->mech_type->gm_ops->gss_wrap);
 273
 274         return context_handle->mech_type->gm_ops
 275                 ->gss_wrap(context_handle, msg, msg_buflen, out_token);
 276 }
 277
 278 __u32 lgss_unwrap(struct gss_ctx *context_handle,
 279                   rawobj_t *token,
 280                   rawobj_t *out_msg)
 281 {
 282         LASSERT(context_handle);
 283         LASSERT(context_handle->mech_type);
 284         LASSERT(context_handle->mech_type->gm_ops);
 285         LASSERT(context_handle->mech_type->gm_ops->gss_unwrap);
 286
 287         return context_handle->mech_type->gm_ops
 288                 ->gss_unwrap(context_handle, token, out_msg);
 289 }
 290
 291
 292 __u32 lgss_plain_encrypt(struct gss_ctx *ctx,
 293                          int decrypt,
 294                          int length,
 295                          void *in_buf,
 296                          void *out_buf)
 297 {
 298         LASSERT(ctx);
 299         LASSERT(ctx->mech_type);
 300         LASSERT(ctx->mech_type->gm_ops);
 301         LASSERT(ctx->mech_type->gm_ops->gss_plain_encrypt);
 302
 303         return ctx->mech_type->gm_ops
 304                 ->gss_plain_encrypt(ctx, decrypt, length, in_buf, out_buf);
 305 }
 306
 307 /* gss_delete_sec_context: free all resources associated with context_handle.
 308  * Note this differs from the RFC 2744-specified prototype in that we don't
 309  * bother returning an output token, since it would never be used anyway. */
 310
 311 __u32 lgss_delete_sec_context(struct gss_ctx **context_handle)
 312 {
 313         struct gss_api_mech *mech;
 314
 315         CDEBUG(D_SEC, "deleting %p\n", *context_handle);
 316
 317         if (!*context_handle)
 318                 return(GSS_S_NO_CONTEXT);
 319
 320         mech = (*context_handle)->mech_type;
 321         if ((*context_handle)->internal_ctx_id != 0) {
 322                 LASSERT(mech);
 323                 LASSERT(mech->gm_ops);
 324                 LASSERT(mech->gm_ops->gss_delete_sec_context);
 325                 mech->gm_ops->gss_delete_sec_context(
 326                                         (*context_handle)->internal_ctx_id);
 327         }
 328         if (mech)
 329                 lgss_mech_put(mech);
 330
 331         OBD_FREE_PTR(*context_handle);
 332         *context_handle=NULL;
 333         return GSS_S_COMPLETE;
 334 }
 335
 336 int lgss_display(struct gss_ctx *ctx,
 337                  char           *buf,
 338                  int             bufsize)
 339 {
 340         LASSERT(ctx);
 341         LASSERT(ctx->mech_type);
 342         LASSERT(ctx->mech_type->gm_ops);
 343         LASSERT(ctx->mech_type->gm_ops->gss_display);
 344
 345         return ctx->mech_type->gm_ops->gss_display(ctx, buf, bufsize);
 346 }