xref: /titanic_51/usr/src/uts/common/rpc/sec/svc_authu.c (revision 15d9d0b528387242011cdcc6190c9e598cfe3a07)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 1989 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
28 /*	  All Rights Reserved  	*/
29 
30 /*
31  * Portions of this source code were derived from Berkeley 4.3 BSD
32  * under license from the Regents of the University of California.
33  */
34 
35 #ident	"%Z%%M%	%I%	%E% SMI"
36 
37 /*
38  * svc_auth_unix.c
39  * Handles UNIX flavor authentication parameters on the service side of rpc.
40  * There are two svc auth implementations here: AUTH_UNIX and AUTH_SHORT.
41  * _svcauth_unix does full blown unix style uid, gid+gids auth,
42  * _svcauth_short uses a shorthand auth to index into a cache of longhand auths.
43  * Note: the shorthand has been gutted for efficiency.
44  */
45 
46 #include <sys/param.h>
47 #include <sys/types.h>
48 #include <sys/time.h>
49 #include <sys/systm.h>
50 #include <sys/stream.h>
51 #include <sys/stropts.h>
52 #include <sys/strsubr.h>
53 #include <sys/tiuser.h>
54 #include <sys/tihdr.h>
55 #include <sys/t_kuser.h>
56 #include <sys/cmn_err.h>
57 
58 #include <rpc/types.h>
59 #include <rpc/xdr.h>
60 #include <rpc/auth.h>
61 #include <rpc/clnt.h>
62 #include <rpc/rpc_msg.h>
63 #include <rpc/svc.h>
64 #include <rpc/auth_unix.h>
65 #include <rpc/svc_auth.h>
66 
67 
68 /*
69  * Unix longhand authenticator
70  */
71 enum auth_stat
72 _svcauth_unix(struct svc_req *rqst, struct rpc_msg *msg)
73 {
74 	enum auth_stat stat;
75 	XDR xdrs;
76 	struct authunix_parms *aup;
77 	int32_t *buf;
78 	struct area {
79 		struct authunix_parms area_aup;
80 		char area_machname[MAX_MACHINE_NAME+1];
81 		u_int area_gids[NGRPS];
82 	} *area;
83 	u_int auth_len;
84 	u_int str_len, gid_len;
85 	int i;
86 
87 	/* LINTED pointer alignment */
88 	area = (struct area *) rqst->rq_clntcred;
89 	aup = &area->area_aup;
90 	aup->aup_machname = area->area_machname;
91 	aup->aup_gids = (gid_t *)area->area_gids;
92 	auth_len = (u_int)msg->rm_call.cb_cred.oa_length;
93 	xdrmem_create(&xdrs, msg->rm_call.cb_cred.oa_base, auth_len,
94 	    XDR_DECODE);
95 	buf = XDR_INLINE(&xdrs, auth_len);
96 	if (buf != NULL) {
97 		aup->aup_time = IXDR_GET_INT32(buf);
98 		str_len = IXDR_GET_U_INT32(buf);
99 		if (str_len > MAX_MACHINE_NAME) {
100 			stat = AUTH_BADCRED;
101 			goto done;
102 		}
103 		bcopy((caddr_t)buf, aup->aup_machname, (u_int)str_len);
104 		aup->aup_machname[str_len] = 0;
105 		str_len = RNDUP(str_len);
106 		buf += str_len / sizeof (int32_t);
107 		aup->aup_uid = IXDR_GET_INT32(buf);
108 		aup->aup_gid = IXDR_GET_INT32(buf);
109 		gid_len = IXDR_GET_U_INT32(buf);
110 		if (gid_len > NGRPS) {
111 			stat = AUTH_BADCRED;
112 			goto done;
113 		}
114 		aup->aup_len = gid_len;
115 		for (i = 0; i < gid_len; i++) {
116 			aup->aup_gids[i] = IXDR_GET_INT32(buf);
117 		}
118 		/*
119 		 * five is the smallest unix credentials structure -
120 		 * timestamp, hostname len (0), uid, gid, and gids len (0).
121 		 */
122 		if ((5 + gid_len) * BYTES_PER_XDR_UNIT + str_len > auth_len) {
123 			printf("bad auth_len gid %d str %d auth %d",
124 			    gid_len, str_len, auth_len);
125 			stat = AUTH_BADCRED;
126 			goto done;
127 		}
128 	} else if (! xdr_authunix_parms(&xdrs, aup)) {
129 		xdrs.x_op = XDR_FREE;
130 		(void) xdr_authunix_parms(&xdrs, aup);
131 		stat = AUTH_BADCRED;
132 		goto done;
133 	}
134 	rqst->rq_xprt->xp_verf.oa_flavor = AUTH_NULL;
135 	rqst->rq_xprt->xp_verf.oa_length = 0;
136 	stat = AUTH_OK;
137 done:
138 	XDR_DESTROY(&xdrs);
139 	return (stat);
140 }
141 
142 
143 /*
144  * Shorthand unix authenticator
145  * Looks up longhand in a cache.
146  */
147 /* ARGSUSED */
148 enum auth_stat
149 _svcauth_short(struct svc_req *rqst, struct rpc_msg *msg)
150 {
151 	return (AUTH_REJECTEDCRED);
152 }
153