xref: /titanic_44/usr/src/uts/common/nfs/auth.h (revision 5cb0d67909d9970a3e7adbea9422ca3fc88000bf)
11cc55349Srmesta /*
21cc55349Srmesta  * CDDL HEADER START
31cc55349Srmesta  *
41cc55349Srmesta  * The contents of this file are subject to the terms of the
51cc55349Srmesta  * Common Development and Distribution License (the "License").
61cc55349Srmesta  * You may not use this file except in compliance with the License.
71cc55349Srmesta  *
81cc55349Srmesta  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
91cc55349Srmesta  * or http://www.opensolaris.org/os/licensing.
101cc55349Srmesta  * See the License for the specific language governing permissions
111cc55349Srmesta  * and limitations under the License.
121cc55349Srmesta  *
131cc55349Srmesta  * When distributing Covered Code, include this CDDL HEADER in each
141cc55349Srmesta  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
151cc55349Srmesta  * If applicable, add the following below this CDDL HEADER, with the
161cc55349Srmesta  * fields enclosed by brackets "[]" replaced with your own identifying
171cc55349Srmesta  * information: Portions Copyright [yyyy] [name of copyright owner]
181cc55349Srmesta  *
191cc55349Srmesta  * CDDL HEADER END
201cc55349Srmesta  */
211cc55349Srmesta /*
221cc55349Srmesta  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
231cc55349Srmesta  * Use is subject to license terms.
241cc55349Srmesta  */
25*5cb0d679SMarcel Telka /*
26*5cb0d679SMarcel Telka  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
27*5cb0d679SMarcel Telka  */
281cc55349Srmesta 
291cc55349Srmesta #ifndef _AUTH_H
301cc55349Srmesta #define	_AUTH_H
311cc55349Srmesta 
321cc55349Srmesta /*
331cc55349Srmesta  * nfsauth_prot.x (The NFSAUTH Protocol)
341cc55349Srmesta  *
351cc55349Srmesta  * This protocol is used by the kernel to authorize NFS clients. This svc
361cc55349Srmesta  * lives in the mount daemon and checks the client's access for an export
371cc55349Srmesta  * with a given authentication flavor.
381cc55349Srmesta  *
391cc55349Srmesta  * The status result determines what kind of access the client is permitted.
401cc55349Srmesta  *
411cc55349Srmesta  * The result is cached in the kernel, so the authorization call will be
42*5cb0d679SMarcel Telka  * made only the first time the client mounts the filesystem.
431cc55349Srmesta  *
441cc55349Srmesta  * const A_MAXPATH	= 1024;
451cc55349Srmesta  *
461cc55349Srmesta  * struct auth_req {
471cc55349Srmesta  * 	netobj 	req_client;		# client's address
481cc55349Srmesta  * 	string	req_netid<>;		# Netid of address
491cc55349Srmesta  * 	string	req_path<A_MAXPATH>;	# export path
501cc55349Srmesta  * 	int	req_flavor;		# auth flavor
51*5cb0d679SMarcel Telka  *	uid_t	req_clnt_uid;		# client's uid
52*5cb0d679SMarcel Telka  *	gid_t	req_clnt_gid;		# client's gid
531cc55349Srmesta  * };
541cc55349Srmesta  *
551cc55349Srmesta  * const NFSAUTH_DENIED	  = 0x01;	# Access denied
561cc55349Srmesta  * const NFSAUTH_RO	  = 0x02;	# Read-only
571cc55349Srmesta  * const NFSAUTH_RW	  = 0x04;	# Read-write
581cc55349Srmesta  * const NFSAUTH_ROOT	  = 0x08;	# Root access
591cc55349Srmesta  * const NFSAUTH_WRONGSEC = 0x10;	# Advise NFS v4 clients to
601cc55349Srmesta  * 					# try a different flavor
61*5cb0d679SMarcel Telka  * const NFSAUTH_UIDMAP   = 0x100;	# uid mapped
62*5cb0d679SMarcel Telka  * const NFSAUTH_GIDMAP   = 0x200;	# gid mapped
631cc55349Srmesta  * #
641cc55349Srmesta  * # The following are not part of the protocol.
651cc55349Srmesta  * #
661cc55349Srmesta  * const NFSAUTH_DROP	 = 0x20;	# Drop request
671cc55349Srmesta  * const NFSAUTH_MAPNONE = 0x40;	# Mapped flavor to AUTH_NONE
681cc55349Srmesta  * const NFSAUTH_LIMITED = 0x80;	# Access limited to visible nodes
691cc55349Srmesta  *
701cc55349Srmesta  * struct auth_res {
711cc55349Srmesta  * 	int auth_perm;
72*5cb0d679SMarcel Telka  *	uid_t	auth_srv_uid;
73*5cb0d679SMarcel Telka  *	gid_t	auth_srv_gid;
741cc55349Srmesta  * };
751cc55349Srmesta  *
761cc55349Srmesta  * program NFSAUTH_PROG {
771cc55349Srmesta  * 	version NFSAUTH_VERS {
781cc55349Srmesta  *		#
791cc55349Srmesta  *		# Authorization Request
801cc55349Srmesta  *		#
811cc55349Srmesta  * 		auth_res
821cc55349Srmesta  * 		NFSAUTH_ACCESS(auth_req) = 1;
831cc55349Srmesta  *
841cc55349Srmesta  * 	} = 1;
851cc55349Srmesta  * } = 100231;
861cc55349Srmesta  */
871cc55349Srmesta 
881cc55349Srmesta #ifndef _KERNEL
891cc55349Srmesta #include <stddef.h>
901cc55349Srmesta #endif
911cc55349Srmesta #include <sys/sysmacros.h>
921cc55349Srmesta #include <sys/types.h>
931cc55349Srmesta #include <rpc/xdr.h>
941cc55349Srmesta 
951cc55349Srmesta #ifdef	__cplusplus
961cc55349Srmesta extern "C" {
971cc55349Srmesta #endif
981cc55349Srmesta 
991cc55349Srmesta 
1001cc55349Srmesta /* --8<-- Start: nfsauth_prot.x definitions --8<-- */
1011cc55349Srmesta 
1021cc55349Srmesta #define	A_MAXPATH		1024
1031cc55349Srmesta 
1041cc55349Srmesta #define	NFSAUTH_ACCESS		1
1051cc55349Srmesta 
1061cc55349Srmesta #define	NFSAUTH_DENIED		0x01
1071cc55349Srmesta #define	NFSAUTH_RO		0x02
1081cc55349Srmesta #define	NFSAUTH_RW		0x04
1091cc55349Srmesta #define	NFSAUTH_ROOT		0x08
1101cc55349Srmesta #define	NFSAUTH_WRONGSEC	0x10
1111cc55349Srmesta #define	NFSAUTH_DROP		0x20
1121cc55349Srmesta #define	NFSAUTH_MAPNONE		0x40
1131cc55349Srmesta #define	NFSAUTH_LIMITED		0x80
114*5cb0d679SMarcel Telka #define	NFSAUTH_UIDMAP		0x100
115*5cb0d679SMarcel Telka #define	NFSAUTH_GIDMAP		0x200
1161cc55349Srmesta 
1171cc55349Srmesta struct auth_req {
1181cc55349Srmesta 	netobj	 req_client;
1191cc55349Srmesta 	char	*req_netid;
1201cc55349Srmesta 	char	*req_path;
1211cc55349Srmesta 	int	 req_flavor;
122*5cb0d679SMarcel Telka 	uid_t	 req_clnt_uid;
123*5cb0d679SMarcel Telka 	gid_t	 req_clnt_gid;
1241cc55349Srmesta };
1251cc55349Srmesta typedef struct auth_req auth_req;
1261cc55349Srmesta 
1271cc55349Srmesta struct auth_res {
1281cc55349Srmesta 	int	auth_perm;
129*5cb0d679SMarcel Telka 	uid_t	auth_srv_uid;
130*5cb0d679SMarcel Telka 	gid_t	auth_srv_gid;
1311cc55349Srmesta };
1321cc55349Srmesta typedef struct auth_res auth_res;
1331cc55349Srmesta 
1341cc55349Srmesta /* --8<-- End: nfsauth_prot.x definitions --8<-- */
1351cc55349Srmesta 
1361cc55349Srmesta 
1371cc55349Srmesta #define	NFSAUTH_DR_OKAY		0x0	/* success */
1381cc55349Srmesta #define	NFSAUTH_DR_BADCMD	0x100	/* NFSAUTH_ACCESS is only cmd allowed */
1391cc55349Srmesta #define	NFSAUTH_DR_DECERR	0x200	/* mountd could not decode arguments */
1401cc55349Srmesta #define	NFSAUTH_DR_EFAIL	0x400	/* mountd could not encode results */
1411cc55349Srmesta #define	NFSAUTH_DR_TRYCNT	5	/* door handle acquisition retry cnt */
1421cc55349Srmesta 
1431cc55349Srmesta #if defined(DEBUG) && !defined(_KERNEL)
1441cc55349Srmesta #define	MOUNTD_DOOR		"/var/run/mountd_door"
1451cc55349Srmesta #endif
1461cc55349Srmesta 
1471cc55349Srmesta /*
1481cc55349Srmesta  * Only cmd is added to the args. We need to know "what" we want
1491cc55349Srmesta  * the daemon to do for us. Also, 'stat' returns the status from
1501cc55349Srmesta  * the daemon down to the kernel in addition to perms.
1511cc55349Srmesta  */
1521cc55349Srmesta struct nfsauth_arg {
1531cc55349Srmesta 	uint_t		cmd;
1541cc55349Srmesta 	auth_req	areq;
1551cc55349Srmesta };
1561cc55349Srmesta typedef struct nfsauth_arg nfsauth_arg_t;
1571cc55349Srmesta 
1581cc55349Srmesta struct nfsauth_res {
1591cc55349Srmesta 	uint_t		stat;
1601cc55349Srmesta 	auth_res	ares;
1611cc55349Srmesta };
1621cc55349Srmesta typedef struct nfsauth_res nfsauth_res_t;
1631cc55349Srmesta 
1641cc55349Srmesta /*
1651cc55349Srmesta  * For future extensibility, we version the data structures so
1661cc55349Srmesta  * future incantations of mountd(1m) will know how to XDR decode
1671cc55349Srmesta  * the arguments.
1681cc55349Srmesta  */
1691cc55349Srmesta enum vtypes {
1701cc55349Srmesta 	V_ERROR = 0,
1711cc55349Srmesta 	V_PROTO = 1
1721cc55349Srmesta };
1731cc55349Srmesta typedef enum vtypes vtypes;
1741cc55349Srmesta 
1751cc55349Srmesta typedef struct varg {
1761cc55349Srmesta 	uint_t	vers;
1771cc55349Srmesta 	union {
1781cc55349Srmesta 		nfsauth_arg_t	arg;
1791cc55349Srmesta 		/* additional args versions go here */
1801cc55349Srmesta 	} arg_u;
1811cc55349Srmesta } varg_t;
1821cc55349Srmesta 
1831cc55349Srmesta extern bool_t	xdr_varg(XDR *, varg_t *);
1841cc55349Srmesta extern bool_t	xdr_nfsauth_arg(XDR *, nfsauth_arg_t *);
1851cc55349Srmesta extern bool_t	xdr_nfsauth_res(XDR *, nfsauth_res_t *);
1861cc55349Srmesta 
1871cc55349Srmesta #ifdef	__cplusplus
1881cc55349Srmesta }
1891cc55349Srmesta #endif
1901cc55349Srmesta 
1911cc55349Srmesta #endif /* _AUTH_H */
192