xref: /freebsd/include/rpc/auth.h (revision 43960f159d60217fcb3c5c03095effdb77a0f291)
1 /*	$NetBSD: auth.h,v 1.15 2000/06/02 22:57:55 fvdl Exp $	*/
2 
3 /*
4  * Sun RPC is a product of Sun Microsystems, Inc. and is provided for
5  * unrestricted use provided that this legend is included on all tape
6  * media and as a part of the software program in whole or part.  Users
7  * may copy or modify Sun RPC without charge, but are not authorized
8  * to license or distribute it to anyone else except as part of a product or
9  * program developed by the user.
10  *
11  * SUN RPC IS PROVIDED AS IS WITH NO WARRANTIES OF ANY KIND INCLUDING THE
12  * WARRANTIES OF DESIGN, MERCHANTABILITY AND FITNESS FOR A PARTICULAR
13  * PURPOSE, OR ARISING FROM A COURSE OF DEALING, USAGE OR TRADE PRACTICE.
14  *
15  * Sun RPC is provided with no support and without any obligation on the
16  * part of Sun Microsystems, Inc. to assist in its use, correction,
17  * modification or enhancement.
18  *
19  * SUN MICROSYSTEMS, INC. SHALL HAVE NO LIABILITY WITH RESPECT TO THE
20  * INFRINGEMENT OF COPYRIGHTS, TRADE SECRETS OR ANY PATENTS BY SUN RPC
21  * OR ANY PART THEREOF.
22  *
23  * In no event will Sun Microsystems, Inc. be liable for any lost revenue
24  * or profits or other special, indirect and consequential damages, even if
25  * Sun has been advised of the possibility of such damages.
26  *
27  * Sun Microsystems, Inc.
28  * 2550 Garcia Avenue
29  * Mountain View, California  94043
30  *
31  *	from: @(#)auth.h 1.17 88/02/08 SMI
32  *	from: @(#)auth.h	2.3 88/08/07 4.0 RPCSRC
33  *	from: @(#)auth.h	1.43 	98/02/02 SMI
34  * $FreeBSD$
35  */
36 
37 /*
38  * auth.h, Authentication interface.
39  *
40  * Copyright (C) 1984, Sun Microsystems, Inc.
41  *
42  * The data structures are completely opaque to the client.  The client
43  * is required to pass a AUTH * to routines that create rpc
44  * "sessions".
45  */
46 
47 #ifndef _RPC_AUTH_H
48 #define _RPC_AUTH_H
49 #include <rpc/xdr.h>
50 #include <rpc/clnt_stat.h>
51 #include <sys/cdefs.h>
52 #include <sys/socket.h>
53 
54 #define MAX_AUTH_BYTES	400
55 #define MAXNETNAMELEN	255	/* maximum length of network user's name */
56 
57 /*
58  *  Client side authentication/security data
59  */
60 
61 typedef struct sec_data {
62 	u_int	secmod;		/* security mode number e.g. in nfssec.conf */
63 	u_int	rpcflavor;	/* rpc flavors:AUTH_UNIX,AUTH_DES,RPCSEC_GSS */
64 	int	flags;		/* AUTH_F_xxx flags */
65 	caddr_t data;		/* opaque data per flavor */
66 } sec_data_t;
67 
68 #ifdef _SYSCALL32_IMPL
69 struct sec_data32 {
70 	uint32_t secmod;	/* security mode number e.g. in nfssec.conf */
71 	uint32_t rpcflavor;	/* rpc flavors:AUTH_UNIX,AUTH_DES,RPCSEC_GSS */
72 	int32_t flags;		/* AUTH_F_xxx flags */
73 	caddr32_t data;		/* opaque data per flavor */
74 };
75 #endif /* _SYSCALL32_IMPL */
76 
77 /*
78  * AUTH_DES flavor specific data from sec_data opaque data field.
79  * AUTH_KERB has the same structure.
80  */
81 typedef struct des_clnt_data {
82 	struct netbuf	syncaddr;	/* time sync addr */
83 	struct knetconfig *knconf;	/* knetconfig info that associated */
84 					/* with the syncaddr. */
85 	char		*netname;	/* server's netname */
86 	int		netnamelen;	/* server's netname len */
87 } dh_k4_clntdata_t;
88 
89 #ifdef _SYSCALL32_IMPL
90 struct des_clnt_data32 {
91 	struct netbuf32 syncaddr;	/* time sync addr */
92 	caddr32_t knconf;		/* knetconfig info that associated */
93 					/* with the syncaddr. */
94 	caddr32_t netname;		/* server's netname */
95 	int32_t netnamelen;		/* server's netname len */
96 };
97 #endif /* _SYSCALL32_IMPL */
98 
99 #ifdef KERBEROS
100 /*
101  * flavor specific data to hold the data for AUTH_DES/AUTH_KERB(v4)
102  * in sec_data->data opaque field.
103  */
104 typedef struct krb4_svc_data {
105 	int		window;		/* window option value */
106 } krb4_svcdata_t;
107 
108 typedef struct krb4_svc_data	des_svcdata_t;
109 #endif /* KERBEROS */
110 
111 /*
112  * authentication/security specific flags
113  */
114 #define AUTH_F_RPCTIMESYNC	0x001	/* use RPC to do time sync */
115 #define AUTH_F_TRYNONE		0x002	/* allow fall back to AUTH_NONE */
116 
117 
118 /*
119  * Status returned from authentication check
120  */
121 enum auth_stat {
122 	AUTH_OK=0,
123 	/*
124 	 * failed at remote end
125 	 */
126 	AUTH_BADCRED=1,			/* bogus credentials (seal broken) */
127 	AUTH_REJECTEDCRED=2,		/* client should begin new session */
128 	AUTH_BADVERF=3,			/* bogus verifier (seal broken) */
129 	AUTH_REJECTEDVERF=4,		/* verifier expired or was replayed */
130 	AUTH_TOOWEAK=5,			/* rejected due to security reasons */
131 	/*
132 	 * failed locally
133 	*/
134 	AUTH_INVALIDRESP=6,		/* bogus response verifier */
135 	AUTH_FAILED=7			/* some unknown reason */
136 #ifdef KERBEROS
137 	/*
138 	 * kerberos errors
139 	 */
140 	AUTH_KERB_GENERIC = 8,		/* kerberos generic error */
141 	AUTH_TIMEEXPIRE = 9,		/* time of credential expired */
142 	AUTH_TKT_FILE = 10,		/* something wrong with ticket file */
143 	AUTH_DECODE = 11,			/* can't decode authenticator */
144 	AUTH_NET_ADDR = 12		/* wrong net address in ticket */
145 #endif /* KERBEROS */
146 };
147 
148 union des_block {
149 	struct {
150 		uint32_t high;
151 		uint32_t low;
152 	} key;
153 	char c[8];
154 };
155 typedef union des_block des_block;
156 __BEGIN_DECLS
157 #ifdef __STDC__
158 extern bool_t xdr_des_block(XDR *, des_block *);
159 #else
160 extern bool_t xdr_des_block();
161 #endif
162 __END_DECLS
163 
164 /*
165  * Authentication info.  Opaque to client.
166  */
167 struct opaque_auth {
168 	enum_t	oa_flavor;		/* flavor of auth */
169 	caddr_t	oa_base;		/* address of more auth stuff */
170 	u_int	oa_length;		/* not to exceed MAX_AUTH_BYTES */
171 };
172 
173 
174 /*
175  * Auth handle, interface to client side authenticators.
176  */
177 typedef struct __auth {
178 	struct	opaque_auth	ah_cred;
179 	struct	opaque_auth	ah_verf;
180 	union	des_block	ah_key;
181 	struct auth_ops {
182 		void	(*ah_nextverf) (struct __auth *);
183 		/* nextverf & serialize */
184 		int	(*ah_marshal) (struct __auth *, XDR *);
185 		/* validate verifier */
186 		int	(*ah_validate) (struct __auth *,
187 			    struct opaque_auth *);
188 		/* refresh credentials */
189 		int	(*ah_refresh) (struct __auth *, void *);
190 		/* destroy this structure */
191 		void	(*ah_destroy) (struct __auth *);
192 	} *ah_ops;
193 	caddr_t ah_private;
194 } AUTH;
195 
196 
197 /*
198  * Authentication ops.
199  * The ops and the auth handle provide the interface to the authenticators.
200  *
201  * AUTH	*auth;
202  * XDR	*xdrs;
203  * struct opaque_auth verf;
204  */
205 #define AUTH_NEXTVERF(auth)		\
206 		((*((auth)->ah_ops->ah_nextverf))(auth))
207 #define auth_nextverf(auth)		\
208 		((*((auth)->ah_ops->ah_nextverf))(auth))
209 
210 #define AUTH_MARSHALL(auth, xdrs)	\
211 		((*((auth)->ah_ops->ah_marshal))(auth, xdrs))
212 #define auth_marshall(auth, xdrs)	\
213 		((*((auth)->ah_ops->ah_marshal))(auth, xdrs))
214 
215 #define AUTH_VALIDATE(auth, verfp)	\
216 		((*((auth)->ah_ops->ah_validate))((auth), verfp))
217 #define auth_validate(auth, verfp)	\
218 		((*((auth)->ah_ops->ah_validate))((auth), verfp))
219 
220 #define AUTH_REFRESH(auth, msg)		\
221 		((*((auth)->ah_ops->ah_refresh))(auth, msg))
222 #define auth_refresh(auth, msg)		\
223 		((*((auth)->ah_ops->ah_refresh))(auth, msg))
224 
225 #define AUTH_DESTROY(auth)		\
226 		((*((auth)->ah_ops->ah_destroy))(auth))
227 #define auth_destroy(auth)		\
228 		((*((auth)->ah_ops->ah_destroy))(auth))
229 
230 
231 __BEGIN_DECLS
232 extern struct opaque_auth _null_auth;
233 __END_DECLS
234 
235 /*
236  * These are the various implementations of client side authenticators.
237  */
238 
239 /*
240  * System style authentication
241  * AUTH *authunix_create(machname, uid, gid, len, aup_gids)
242  *	char *machname;
243  *	int uid;
244  *	int gid;
245  *	int len;
246  *	int *aup_gids;
247  */
248 __BEGIN_DECLS
249 extern AUTH *authunix_create(char *, int, int, int,
250     int *);
251 extern AUTH *authunix_create_default(void);	/* takes no parameters */
252 extern AUTH *authnone_create(void);		/* takes no parameters */
253 __END_DECLS
254 /*
255  * DES style authentication
256  * AUTH *authsecdes_create(servername, window, timehost, ckey)
257  * 	char *servername;		- network name of server
258  *	u_int window;			- time to live
259  * 	const char *timehost;			- optional hostname to sync with
260  * 	des_block *ckey;		- optional conversation key to use
261  */
262 __BEGIN_DECLS
263 extern AUTH *authdes_create (char *, u_int, struct sockaddr *, des_block *);
264 extern AUTH *authdes_seccreate (const char *, const u_int, const  char *,
265     const  des_block *);
266 __END_DECLS
267 
268 __BEGIN_DECLS
269 extern bool_t xdr_opaque_auth		__P((XDR *, struct opaque_auth *));
270 __END_DECLS
271 
272 #define authsys_create(c,i1,i2,i3,ip) authunix_create((c),(i1),(i2),(i3),(ip))
273 #define authsys_create_default() authunix_create_default()
274 
275 /*
276  * Netname manipulation routines.
277  */
278 __BEGIN_DECLS
279 extern int getnetname(char *);
280 extern int host2netname(char *, const char *, const char *);
281 extern int user2netname(char *, const uid_t, const char *);
282 extern int netname2user(char *, uid_t *, gid_t *, int *, gid_t *);
283 extern int netname2host(char *, char *, const int);
284 extern void passwd2des ( char *, char * );
285 __END_DECLS
286 
287 /*
288  *
289  * These routines interface to the keyserv daemon
290  *
291  */
292 __BEGIN_DECLS
293 extern int key_decryptsession(const char *, des_block *);
294 extern int key_encryptsession(const char *, des_block *);
295 extern int key_gendes(des_block *);
296 extern int key_setsecret(const char *);
297 extern int key_secretkey_is_set(void);
298 __END_DECLS
299 
300 #ifdef KERBEROS
301 /*
302  * Kerberos style authentication
303  * AUTH *authkerb_seccreate(service, srv_inst, realm, window, timehost, status)
304  *	const char *service;			- service name
305  *	const char *srv_inst;			- server instance
306  *	const char *realm;			- server realm
307  *	const u_int window;			- time to live
308  *	const char *timehost;			- optional hostname to sync with
309  *	int *status;				- kerberos status returned
310  */
311 __BEGIN_DECLS
312 extern AUTH	*authkerb_seccreate(const char *, const char *, const  char *,
313 		    const u_int, const char *, int *);
314 __END_DECLS
315 
316 /*
317  * Map a kerberos credential into a unix cred.
318  *
319  *	authkerb_getucred(rqst, uid, gid, grouplen, groups)
320  *	const struct svc_req *rqst;		- request pointer
321  *	uid_t *uid;
322  *	gid_t *gid;
323  *	short *grouplen;
324  *	int *groups;
325  *
326  */
327 __BEGIN_DECLS
328 extern int	authkerb_getucred(/* struct svc_req *, uid_t *, gid_t *,
329 		    short *, int * */);
330 __END_DECLS
331 #endif /* KERBEROS */
332 
333 __BEGIN_DECLS
334 struct svc_req;
335 struct rpc_msg;
336 enum auth_stat _svcauth_null __P((struct svc_req *, struct rpc_msg *));
337 enum auth_stat _svcauth_short __P((struct svc_req *, struct rpc_msg *));
338 enum auth_stat _svcauth_unix __P((struct svc_req *, struct rpc_msg *));
339 __END_DECLS
340 
341 #define AUTH_NONE	0		/* no authentication */
342 #define	AUTH_NULL	0		/* backward compatibility */
343 #define	AUTH_SYS	1		/* unix style (uid, gids) */
344 #define AUTH_UNIX	AUTH_SYS
345 #define	AUTH_SHORT	2		/* short hand unix style */
346 #define AUTH_DH		3		/* for Diffie-Hellman mechanism */
347 #define AUTH_DES	AUTH_DH		/* for backward compatibility */
348 #define AUTH_KERB	4		/* kerberos style */
349 
350 #endif /* !_RPC_AUTH_H */
351