1  /*
       2   * svc_auth.c, Server-side rpc authenticator interface.
       3   *
       4   * Copyright (c) 2010, Oracle America, Inc.
       5   *
       6   * Redistribution and use in source and binary forms, with or without
       7   * modification, are permitted provided that the following conditions are
       8   * met:
       9   *
      10   *     * Redistributions of source code must retain the above copyright
      11   *       notice, this list of conditions and the following disclaimer.
      12   *     * Redistributions in binary form must reproduce the above
      13   *       copyright notice, this list of conditions and the following
      14   *       disclaimer in the documentation and/or other materials
      15   *       provided with the distribution.
      16   *     * Neither the name of the "Oracle America, Inc." nor the names of its
      17   *       contributors may be used to endorse or promote products derived
      18   *       from this software without specific prior written permission.
      19   *
      20   *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
      21   *   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
      22   *   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
      23   *   FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
      24   *   COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
      25   *   INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
      26   *   DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
      27   *   GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
      28   *   INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
      29   *   WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
      30   *   NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
      31   *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
      32   */
      33  
      34  #include <rpc/rpc.h>
      35  #include <rpc/svc.h>
      36  #include <rpc/svc_auth.h>
      37  #include <shlib-compat.h>
      38  
      39  /*
      40   * svcauthsw is the bdevsw of server side authentication.
      41   *
      42   * Server side authenticators are called from authenticate by
      43   * using the client auth struct flavor field to index into svcauthsw.
      44   * The server auth flavors must implement a routine that looks
      45   * like:
      46   *
      47   *      enum auth_stat
      48   *      flavorx_auth(rqst, msg)
      49   *              register struct svc_req *rqst;
      50   *              register struct rpc_msg *msg;
      51   *
      52   */
      53  
      54  static enum auth_stat _svcauth_null (struct svc_req *, struct rpc_msg *);
      55  				/* no authentication */
      56  extern enum auth_stat _svcauth_unix (struct svc_req *, struct rpc_msg *);
      57  				/* unix style (uid, gids) */
      58  extern enum auth_stat _svcauth_short (struct svc_req *, struct rpc_msg *);
      59  				/* short hand unix style */
      60  extern enum auth_stat _svcauth_des (struct svc_req *, struct rpc_msg *);
      61  				/* des style */
      62  
      63  static const struct
      64    {
      65      enum auth_stat (*authenticator) (struct svc_req *, struct rpc_msg *);
      66    }
      67  svcauthsw[] =
      68  {
      69    { _svcauth_null },		/* AUTH_NULL */
      70    { _svcauth_unix },		/* AUTH_UNIX */
      71    { _svcauth_short },		/* AUTH_SHORT */
      72    { _svcauth_des }		/* AUTH_DES */
      73  };
      74  #define	AUTH_MAX	3	/* HIGHEST AUTH NUMBER */
      75  
      76  
      77  /*
      78   * The call rpc message, msg has been obtained from the wire.  The msg contains
      79   * the raw form of credentials and verifiers.  authenticate returns AUTH_OK
      80   * if the msg is successfully authenticated.  If AUTH_OK then the routine also
      81   * does the following things:
      82   * set rqst->rq_xprt->verf to the appropriate response verifier;
      83   * sets rqst->rq_client_cred to the "cooked" form of the credentials.
      84   *
      85   * NB: rqst->rq_cxprt->verf must be pre-allocated;
      86   * its length is set appropriately.
      87   *
      88   * The caller still owns and is responsible for msg->u.cmb.cred and
      89   * msg->u.cmb.verf.  The authentication system retains ownership of
      90   * rqst->rq_client_cred, the cooked credentials.
      91   *
      92   * There is an assumption that any flavour less than AUTH_NULL is
      93   * invalid.
      94   */
      95  enum auth_stat
      96  _authenticate (register struct svc_req *rqst, struct rpc_msg *msg)
      97  {
      98    register int cred_flavor;
      99  
     100    rqst->rq_cred = msg->rm_call.cb_cred;
     101    rqst->rq_xprt->xp_verf.oa_flavor = _null_auth.oa_flavor;
     102    rqst->rq_xprt->xp_verf.oa_length = 0;
     103    cred_flavor = rqst->rq_cred.oa_flavor;
     104    if ((cred_flavor <= AUTH_MAX) && (cred_flavor >= AUTH_NULL))
     105      return (*(svcauthsw[cred_flavor].authenticator)) (rqst, msg);
     106  
     107    return AUTH_REJECTEDCRED;
     108  }
     109  libc_hidden_nolink_sunrpc (_authenticate, GLIBC_2_1)
     110  
     111  static enum auth_stat
     112  _svcauth_null (struct svc_req *rqst, struct rpc_msg *msg)
     113  {
     114    return AUTH_OK;
     115  }