xref: /freebsd/sys/kgssapi/gss_impl.c (revision bb15ca603fa442c72dde3f3cb8b46db6970e3950)
1 /*-
2  * Copyright (c) 2008 Isilon Inc http://www.isilon.com/
3  * Authors: Doug Rabson <dfr@rabson.org>
4  * Developed with Red Inc: Alfred Perlstein <alfred@freebsd.org>
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  */
27 
28 #include <sys/cdefs.h>
29 __FBSDID("$FreeBSD$");
30 
31 #include <sys/param.h>
32 #include <sys/kernel.h>
33 #include <sys/kobj.h>
34 #include <sys/malloc.h>
35 #include <sys/module.h>
36 #include <sys/priv.h>
37 #include <sys/syscall.h>
38 #include <sys/sysent.h>
39 #include <sys/sysproto.h>
40 
41 #include <kgssapi/gssapi.h>
42 #include <kgssapi/gssapi_impl.h>
43 #include <rpc/rpc.h>
44 #include <rpc/rpc_com.h>
45 #include <rpc/rpcsec_gss.h>
46 
47 #include "gssd.h"
48 #include "kgss_if.h"
49 
50 MALLOC_DEFINE(M_GSSAPI, "GSS-API", "GSS-API");
51 
52 /*
53  * Syscall hooks
54  */
55 static int gssd_syscall_offset = SYS_gssd_syscall;
56 static struct sysent gssd_syscall_prev_sysent;
57 MAKE_SYSENT(gssd_syscall);
58 static bool_t gssd_syscall_registered = FALSE;
59 
60 struct kgss_mech_list kgss_mechs;
61 CLIENT *kgss_gssd_handle;
62 
63 static void
64 kgss_init(void *dummy)
65 {
66 	int error;
67 
68 	LIST_INIT(&kgss_mechs);
69 	error = syscall_register(&gssd_syscall_offset, &gssd_syscall_sysent,
70 	    &gssd_syscall_prev_sysent);
71 	if (error)
72 		printf("Can't register GSSD syscall\n");
73 	else
74 		gssd_syscall_registered = TRUE;
75 }
76 SYSINIT(kgss_init, SI_SUB_LOCK, SI_ORDER_FIRST, kgss_init, NULL);
77 
78 static void
79 kgss_uninit(void *dummy)
80 {
81 
82 	if (gssd_syscall_registered)
83 		syscall_deregister(&gssd_syscall_offset,
84 		    &gssd_syscall_prev_sysent);
85 }
86 SYSUNINIT(kgss_uninit, SI_SUB_LOCK, SI_ORDER_FIRST, kgss_uninit, NULL);
87 
88 int
89 sys_gssd_syscall(struct thread *td, struct gssd_syscall_args *uap)
90 {
91         struct sockaddr_un sun;
92         struct netconfig *nconf;
93 	char path[MAXPATHLEN];
94 	int error;
95 
96 	error = priv_check(td, PRIV_NFS_DAEMON);
97 	if (error)
98 		return (error);
99 
100 	if (kgss_gssd_handle)
101 		CLNT_DESTROY(kgss_gssd_handle);
102 
103 	error = copyinstr(uap->path, path, sizeof(path), NULL);
104 	if (error)
105 		return (error);
106 
107         sun.sun_family = AF_LOCAL;
108         strcpy(sun.sun_path, path);
109         sun.sun_len = SUN_LEN(&sun);
110 
111         nconf = getnetconfigent("local");
112         kgss_gssd_handle = clnt_reconnect_create(nconf,
113 	    (struct sockaddr *) &sun, GSSD, GSSDVERS,
114 	    RPC_MAXDATASIZE, RPC_MAXDATASIZE);
115 
116 	return (0);
117 }
118 
119 int
120 kgss_oid_equal(const gss_OID oid1, const gss_OID oid2)
121 {
122 
123 	if (oid1 == oid2)
124 		return (1);
125 	if (!oid1 || !oid2)
126 		return (0);
127 	if (oid1->length != oid2->length)
128 		return (0);
129 	if (memcmp(oid1->elements, oid2->elements, oid1->length))
130 		return (0);
131 	return (1);
132 }
133 
134 void
135 kgss_install_mech(gss_OID mech_type, const char *name, struct kobj_class *cls)
136 {
137 	struct kgss_mech *km;
138 
139 	km = malloc(sizeof(struct kgss_mech), M_GSSAPI, M_WAITOK);
140 	km->km_mech_type = mech_type;
141 	km->km_mech_name = name;
142 	km->km_class = cls;
143 	LIST_INSERT_HEAD(&kgss_mechs, km, km_link);
144 }
145 
146 void
147 kgss_uninstall_mech(gss_OID mech_type)
148 {
149 	struct kgss_mech *km;
150 
151 	LIST_FOREACH(km, &kgss_mechs, km_link) {
152 		if (kgss_oid_equal(km->km_mech_type, mech_type)) {
153 			LIST_REMOVE(km, km_link);
154 			free(km, M_GSSAPI);
155 			return;
156 		}
157 	}
158 }
159 
160 gss_OID
161 kgss_find_mech_by_name(const char *name)
162 {
163 	struct kgss_mech *km;
164 
165 	LIST_FOREACH(km, &kgss_mechs, km_link) {
166 		if (!strcmp(km->km_mech_name, name)) {
167 			return (km->km_mech_type);
168 		}
169 	}
170 	return (GSS_C_NO_OID);
171 }
172 
173 const char *
174 kgss_find_mech_by_oid(const gss_OID oid)
175 {
176 	struct kgss_mech *km;
177 
178 	LIST_FOREACH(km, &kgss_mechs, km_link) {
179 		if (kgss_oid_equal(km->km_mech_type, oid)) {
180 			return (km->km_mech_name);
181 		}
182 	}
183 	return (NULL);
184 }
185 
186 gss_ctx_id_t
187 kgss_create_context(gss_OID mech_type)
188 {
189 	struct kgss_mech *km;
190 	gss_ctx_id_t ctx;
191 
192 	LIST_FOREACH(km, &kgss_mechs, km_link) {
193 		if (kgss_oid_equal(km->km_mech_type, mech_type))
194 			break;
195 	}
196 	if (!km)
197 		return (NULL);
198 
199 	ctx = (gss_ctx_id_t) kobj_create(km->km_class, M_GSSAPI, M_WAITOK);
200 	KGSS_INIT(ctx);
201 
202 	return (ctx);
203 }
204 
205 void
206 kgss_delete_context(gss_ctx_id_t ctx, gss_buffer_t output_token)
207 {
208 
209 	KGSS_DELETE(ctx, output_token);
210 	kobj_delete((kobj_t) ctx, M_GSSAPI);
211 }
212 
213 OM_uint32
214 kgss_transfer_context(gss_ctx_id_t ctx)
215 {
216 	struct export_sec_context_res res;
217 	struct export_sec_context_args args;
218 	enum clnt_stat stat;
219 	OM_uint32 maj_stat;
220 
221 	if (!kgss_gssd_handle)
222 		return (GSS_S_FAILURE);
223 
224 	args.ctx = ctx->handle;
225 	bzero(&res, sizeof(res));
226 	stat = gssd_export_sec_context_1(&args, &res, kgss_gssd_handle);
227 	if (stat != RPC_SUCCESS) {
228 		return (GSS_S_FAILURE);
229 	}
230 
231 	maj_stat = KGSS_IMPORT(ctx, res.format, &res.interprocess_token);
232 	ctx->handle = 0;
233 
234 	xdr_free((xdrproc_t) xdr_export_sec_context_res, &res);
235 
236 	return (maj_stat);
237 }
238 
239 void
240 kgss_copy_buffer(const gss_buffer_t from, gss_buffer_t to)
241 {
242 	to->length = from->length;
243 	if (from->length) {
244 		to->value = malloc(from->length, M_GSSAPI, M_WAITOK);
245 		bcopy(from->value, to->value, from->length);
246 	} else {
247 		to->value = NULL;
248 	}
249 }
250 
251 /*
252  * Kernel module glue
253  */
254 static int
255 kgssapi_modevent(module_t mod, int type, void *data)
256 {
257 	int error = 0;
258 
259 	switch (type) {
260 	case MOD_LOAD:
261 		rpc_gss_entries.rpc_gss_secfind = rpc_gss_secfind;
262 		rpc_gss_entries.rpc_gss_secpurge = rpc_gss_secpurge;
263 		rpc_gss_entries.rpc_gss_seccreate = rpc_gss_seccreate;
264 		rpc_gss_entries.rpc_gss_set_defaults = rpc_gss_set_defaults;
265 		rpc_gss_entries.rpc_gss_max_data_length =
266 		    rpc_gss_max_data_length;
267 		rpc_gss_entries.rpc_gss_get_error = rpc_gss_get_error;
268 		rpc_gss_entries.rpc_gss_mech_to_oid = rpc_gss_mech_to_oid;
269 		rpc_gss_entries.rpc_gss_oid_to_mech = rpc_gss_oid_to_mech;
270 		rpc_gss_entries.rpc_gss_qop_to_num = rpc_gss_qop_to_num;
271 		rpc_gss_entries.rpc_gss_get_mechanisms = rpc_gss_get_mechanisms;
272 		rpc_gss_entries.rpc_gss_get_versions = rpc_gss_get_versions;
273 		rpc_gss_entries.rpc_gss_is_installed = rpc_gss_is_installed;
274 		rpc_gss_entries.rpc_gss_set_svc_name = rpc_gss_set_svc_name;
275 		rpc_gss_entries.rpc_gss_clear_svc_name = rpc_gss_clear_svc_name;
276 		rpc_gss_entries.rpc_gss_getcred = rpc_gss_getcred;
277 		rpc_gss_entries.rpc_gss_set_callback = rpc_gss_set_callback;
278 		rpc_gss_entries.rpc_gss_clear_callback = rpc_gss_clear_callback;
279 		rpc_gss_entries.rpc_gss_get_principal_name =
280 		    rpc_gss_get_principal_name;
281 		rpc_gss_entries.rpc_gss_svc_max_data_length =
282 		    rpc_gss_svc_max_data_length;
283 		break;
284 	case MOD_UNLOAD:
285 		/*
286 		 * Unloading of the kgssapi module is not currently supported.
287 		 * If somebody wants this, we would need to keep track of
288 		 * currently executing threads and make sure the count is 0.
289 		 */
290 		/* FALLTHROUGH */
291 	default:
292 		error = EOPNOTSUPP;
293 	};
294 	return (error);
295 }
296 static moduledata_t kgssapi_mod = {
297 	"kgssapi",
298 	kgssapi_modevent,
299 	NULL,
300 };
301 DECLARE_MODULE(kgssapi, kgssapi_mod, SI_SUB_VFS, SI_ORDER_ANY);
302 MODULE_DEPEND(kgssapi, krpc, 1, 1, 1);
303 MODULE_VERSION(kgssapi, 1);
304