Whamcloud - gitweb
LU-3289 gss: Add two additional security flavors for sk
[fs/lustre-release.git] / lustre / include / lustre_sec.h
index fab2299..306215a 100644 (file)
@@ -26,6 +26,8 @@
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
  * Use is subject to license terms.
+ *
+ * Copyright (c) 2012, Intel Corporation.
  */
 /*
  * This file is part of Lustre, http://www.lustre.org/
@@ -52,6 +54,7 @@ struct brw_page;
 /* Linux specific */
 struct key;
 struct seq_file;
+struct lustre_cfg;
 
 /*
  * forward declaration
@@ -101,6 +104,7 @@ enum sptlrpc_mech_plain {
 enum sptlrpc_mech_gss {
         SPTLRPC_MECH_GSS_NULL           = 0,
         SPTLRPC_MECH_GSS_KRB5           = 1,
+       SPTLRPC_MECH_GSS_SK             = 2,
         SPTLRPC_MECH_GSS_MAX,
 };
 
@@ -168,6 +172,8 @@ enum sptlrpc_bulk_service {
         ((__u32)(mech) |                                                \
          ((__u32)(svc) << (FLVR_SVC_OFFSET - FLVR_MECH_OFFSET)))
 
+#define SPTLRPC_SUBFLVR_GSSNULL                                                \
+       MAKE_BASE_SUBFLVR(SPTLRPC_MECH_GSS_NULL, SPTLRPC_SVC_NULL)
 #define SPTLRPC_SUBFLVR_KRB5N                                           \
         MAKE_BASE_SUBFLVR(SPTLRPC_MECH_GSS_KRB5, SPTLRPC_SVC_NULL)
 #define SPTLRPC_SUBFLVR_KRB5A                                           \
@@ -176,6 +182,14 @@ enum sptlrpc_bulk_service {
         MAKE_BASE_SUBFLVR(SPTLRPC_MECH_GSS_KRB5, SPTLRPC_SVC_INTG)
 #define SPTLRPC_SUBFLVR_KRB5P                                           \
         MAKE_BASE_SUBFLVR(SPTLRPC_MECH_GSS_KRB5, SPTLRPC_SVC_PRIV)
+#define SPTLRPC_SUBFLVR_SKN                                             \
+       MAKE_BASE_SUBFLVR(SPTLRPC_MECH_GSS_SK, SPTLRPC_SVC_NULL)
+#define SPTLRPC_SUBFLVR_SKA                                             \
+       MAKE_BASE_SUBFLVR(SPTLRPC_MECH_GSS_SK, SPTLRPC_SVC_AUTH)
+#define SPTLRPC_SUBFLVR_SKI                                             \
+       MAKE_BASE_SUBFLVR(SPTLRPC_MECH_GSS_SK, SPTLRPC_SVC_INTG)
+#define SPTLRPC_SUBFLVR_SKPI                                            \
+       MAKE_BASE_SUBFLVR(SPTLRPC_MECH_GSS_SK, SPTLRPC_SVC_PRIV)
 
 /*
  * "end user" flavors
@@ -192,6 +206,12 @@ enum sptlrpc_bulk_service {
                   SPTLRPC_SVC_NULL,                     \
                   SPTLRPC_BULK_HASH,                    \
                   SPTLRPC_BULK_SVC_INTG)
+#define SPTLRPC_FLVR_GSSNULL                           \
+       MAKE_FLVR(SPTLRPC_POLICY_GSS,                   \
+                 SPTLRPC_MECH_GSS_NULL,                \
+                 SPTLRPC_SVC_NULL,                     \
+                 SPTLRPC_BULK_DEFAULT,                 \
+                 SPTLRPC_BULK_SVC_NULL)
 #define SPTLRPC_FLVR_KRB5N                              \
         MAKE_FLVR(SPTLRPC_POLICY_GSS,                   \
                   SPTLRPC_MECH_GSS_KRB5,                \
@@ -216,6 +236,30 @@ enum sptlrpc_bulk_service {
                   SPTLRPC_SVC_PRIV,                     \
                   SPTLRPC_BULK_DEFAULT,                 \
                   SPTLRPC_BULK_SVC_PRIV)
+#define SPTLRPC_FLVR_SKN                                \
+       MAKE_FLVR(SPTLRPC_POLICY_GSS,                   \
+                 SPTLRPC_MECH_GSS_SK,                  \
+                 SPTLRPC_SVC_NULL,                     \
+                 SPTLRPC_BULK_DEFAULT,                 \
+                 SPTLRPC_BULK_SVC_NULL)
+#define SPTLRPC_FLVR_SKA                                \
+       MAKE_FLVR(SPTLRPC_POLICY_GSS,                   \
+                 SPTLRPC_MECH_GSS_SK,                  \
+                 SPTLRPC_SVC_AUTH,                     \
+                 SPTLRPC_BULK_DEFAULT,                 \
+                 SPTLRPC_BULK_SVC_NULL)
+#define SPTLRPC_FLVR_SKI                                \
+       MAKE_FLVR(SPTLRPC_POLICY_GSS,                   \
+                 SPTLRPC_MECH_GSS_SK,                  \
+                 SPTLRPC_SVC_INTG,                     \
+                 SPTLRPC_BULK_DEFAULT,                 \
+                 SPTLRPC_BULK_SVC_INTG)
+#define SPTLRPC_FLVR_SKPI                               \
+       MAKE_FLVR(SPTLRPC_POLICY_GSS,                   \
+                 SPTLRPC_MECH_GSS_SK,                  \
+                 SPTLRPC_SVC_PRIV,                     \
+                 SPTLRPC_BULK_DEFAULT,                 \
+                 SPTLRPC_BULK_SVC_PRIV)
 
 #define SPTLRPC_FLVR_DEFAULT            SPTLRPC_FLVR_NULL
 
@@ -504,17 +548,17 @@ struct ptlrpc_ctx_ops {
                                         PTLRPC_CTX_ERROR)
 
 struct ptlrpc_cli_ctx {
-        cfs_hlist_node_t        cc_cache;      /* linked into ctx cache */
-        cfs_atomic_t            cc_refcount;
-        struct ptlrpc_sec      *cc_sec;
-        struct ptlrpc_ctx_ops  *cc_ops;
-        cfs_time_t              cc_expire;     /* in seconds */
-        unsigned int            cc_early_expire:1;
-        unsigned long           cc_flags;
-        struct vfs_cred         cc_vcred;
-        cfs_spinlock_t          cc_lock;
-        cfs_list_t              cc_req_list;   /* waiting reqs linked here */
-        cfs_list_t              cc_gc_chain;   /* linked to gc chain */
+       struct hlist_node       cc_cache;       /* linked into ctx cache */
+       atomic_t                cc_refcount;
+       struct ptlrpc_sec      *cc_sec;
+       struct ptlrpc_ctx_ops  *cc_ops;
+       cfs_time_t              cc_expire;      /* in seconds */
+       unsigned int            cc_early_expire:1;
+       unsigned long           cc_flags;
+       struct vfs_cred         cc_vcred;
+       spinlock_t              cc_lock;
+       struct list_head        cc_req_list;    /* waiting reqs linked here */
+       struct list_head        cc_gc_chain;    /* linked to gc chain */
 };
 
 /**
@@ -794,11 +838,11 @@ struct ptlrpc_sec_sops {
 };
 
 struct ptlrpc_sec_policy {
-        cfs_module_t                   *sp_owner;
-        char                           *sp_name;
-        __u16                           sp_policy; /* policy number */
-        struct ptlrpc_sec_cops         *sp_cops;   /* client ops */
-        struct ptlrpc_sec_sops         *sp_sops;   /* server ops */
+       struct module                  *sp_owner;
+       char                           *sp_name;
+       __u16                           sp_policy; /* policy number */
+       struct ptlrpc_sec_cops         *sp_cops;   /* client ops */
+       struct ptlrpc_sec_sops         *sp_sops;   /* server ops */
 };
 
 #define PTLRPC_SEC_FL_REVERSE           0x0001 /* reverse sec */
@@ -815,28 +859,42 @@ struct ptlrpc_sec_policy {
  * \see sptlrpc_import_sec_adapt().
  */
 struct ptlrpc_sec {
-        struct ptlrpc_sec_policy       *ps_policy;
-        cfs_atomic_t                    ps_refcount;
-        /** statistic only */
-        cfs_atomic_t                    ps_nctx;
-        /** unique identifier */
-        int                             ps_id;
+       struct ptlrpc_sec_policy       *ps_policy;
+       atomic_t                        ps_refcount;
+       /** statistic only */
+       atomic_t                        ps_nctx;
+       /** unique identifier */
+       int                             ps_id;
         struct sptlrpc_flavor           ps_flvr;
         enum lustre_sec_part            ps_part;
         /** after set, no more new context will be created */
         unsigned int                    ps_dying:1;
         /** owning import */
         struct obd_import              *ps_import;
-        cfs_spinlock_t                  ps_lock;
-
-        /*
-         * garbage collection
-         */
-        cfs_list_t                      ps_gc_list;
-        cfs_time_t                      ps_gc_interval; /* in seconds */
-        cfs_time_t                      ps_gc_next;     /* in seconds */
+       spinlock_t                      ps_lock;
+
+       /*
+        * garbage collection
+        */
+       struct list_head                ps_gc_list;
+       cfs_time_t                      ps_gc_interval; /* in seconds */
+       cfs_time_t                      ps_gc_next;     /* in seconds */
 };
 
+static inline int flvr_is_rootonly(__u32 flavor)
+{
+       return (SPTLRPC_FLVR_POLICY(flavor) == SPTLRPC_POLICY_GSS &&
+               (SPTLRPC_FLVR_MECH(flavor) == SPTLRPC_MECH_GSS_NULL ||
+                SPTLRPC_FLVR_MECH(flavor) == SPTLRPC_MECH_GSS_SK));
+}
+
+static inline int flvr_allows_user_desc(__u32 flavor)
+{
+       return (SPTLRPC_FLVR_POLICY(flavor) == SPTLRPC_POLICY_GSS &&
+               (SPTLRPC_FLVR_MECH(flavor) == SPTLRPC_MECH_GSS_NULL ||
+                SPTLRPC_FLVR_MECH(flavor) == SPTLRPC_MECH_GSS_SK));
+}
+
 static inline int sec_is_reverse(struct ptlrpc_sec *sec)
 {
         return (sec->ps_flvr.sf_flags & PTLRPC_SEC_FL_REVERSE);
@@ -849,8 +907,8 @@ static inline int sec_is_rootonly(struct ptlrpc_sec *sec)
 
 
 struct ptlrpc_svc_ctx {
-        cfs_atomic_t                    sc_refcount;
-        struct ptlrpc_sec_policy       *sc_policy;
+       atomic_t                        sc_refcount;
+       struct ptlrpc_sec_policy       *sc_policy;
 };
 
 /*
@@ -883,13 +941,6 @@ enum sptlrpc_bulk_hash_alg {
         BULK_HASH_ALG_MAX
 };
 
-struct sptlrpc_hash_type {
-        char           *sht_name;
-        char           *sht_tfm_name;
-        unsigned int    sht_size;
-};
-
-const struct sptlrpc_hash_type *sptlrpc_get_hash_type(__u8 hash_alg);
 const char * sptlrpc_get_hash_name(__u8 hash_alg);
 __u8 sptlrpc_get_hash_alg(const char *algname);
 
@@ -948,17 +999,17 @@ char *sptlrpc_flavor2name_bulk(struct sptlrpc_flavor *sf,
 char *sptlrpc_flavor2name(struct sptlrpc_flavor *sf, char *buf, int bufsize);
 char *sptlrpc_secflags2str(__u32 flags, char *buf, int bufsize);
 
-static inline
-struct ptlrpc_sec_policy *sptlrpc_policy_get(struct ptlrpc_sec_policy *policy)
+static inline struct ptlrpc_sec_policy *
+sptlrpc_policy_get(struct ptlrpc_sec_policy *policy)
 {
-        __cfs_module_get(policy->sp_owner);
-        return policy;
+       __module_get(policy->sp_owner);
+       return policy;
 }
 
-static inline
-void sptlrpc_policy_put(struct ptlrpc_sec_policy *policy)
+static inline void
+sptlrpc_policy_put(struct ptlrpc_sec_policy *policy)
 {
-        cfs_module_put(policy->sp_owner);
+       module_put(policy->sp_owner);
 }
 
 /*
@@ -1109,6 +1160,8 @@ int sptlrpc_enc_pool_add_user(void);
 int sptlrpc_enc_pool_del_user(void);
 int  sptlrpc_enc_pool_get_pages(struct ptlrpc_bulk_desc *desc);
 void sptlrpc_enc_pool_put_pages(struct ptlrpc_bulk_desc *desc);
+int get_free_pages_in_pool(void);
+int pool_is_at_full_capacity(void);
 
 int sptlrpc_cli_wrap_bulk(struct ptlrpc_request *req,
                           struct ptlrpc_bulk_desc *desc);