linux/drivers/staging/lustre/lustre/ptlrpc/gss/gss_internal.h
<<
>>
Prefs
   1/*
   2 * Modified from NFSv4 project for Lustre
   3 *
   4 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
   5 *
   6 * Copyright (c) 2012, Intel Corporation.
   7 *
   8 * Author: Eric Mei <ericm@clusterfs.com>
   9 */
  10
  11#ifndef __PTLRPC_GSS_GSS_INTERNAL_H_
  12#define __PTLRPC_GSS_GSS_INTERNAL_H_
  13
  14#include <lustre_sec.h>
  15
  16/*
  17 * rawobj stuff
  18 */
  19typedef struct netobj_s {
  20        __u32      len;
  21        __u8        data[0];
  22} netobj_t;
  23
  24#define NETOBJ_EMPTY    ((netobj_t) { 0 })
  25
  26typedef struct rawobj_s {
  27        __u32      len;
  28        __u8       *data;
  29} rawobj_t;
  30
  31#define RAWOBJ_EMPTY    ((rawobj_t) { 0, NULL })
  32
  33typedef struct rawobj_buf_s {
  34        __u32      dataoff;
  35        __u32      datalen;
  36        __u32      buflen;
  37        __u8       *buf;
  38} rawobj_buf_t;
  39
  40int rawobj_empty(rawobj_t *obj);
  41int rawobj_alloc(rawobj_t *obj, char *buf, int len);
  42void rawobj_free(rawobj_t *obj);
  43int rawobj_equal(rawobj_t *a, rawobj_t *b);
  44int rawobj_dup(rawobj_t *dest, rawobj_t *src);
  45int rawobj_serialize(rawobj_t *obj, __u32 **buf, __u32 *buflen);
  46int rawobj_extract(rawobj_t *obj, __u32 **buf, __u32 *buflen);
  47int rawobj_extract_alloc(rawobj_t *obj, __u32 **buf, __u32 *buflen);
  48int rawobj_extract_local(rawobj_t *obj, __u32 **buf, __u32 *buflen);
  49int rawobj_extract_local_alloc(rawobj_t *obj, __u32 **buf, __u32 *buflen);
  50int rawobj_from_netobj(rawobj_t *rawobj, netobj_t *netobj);
  51int rawobj_from_netobj_alloc(rawobj_t *obj, netobj_t *netobj);
  52
  53int buffer_extract_bytes(const void **buf, __u32 *buflen,
  54                         void *res, __u32 reslen);
  55
  56/*
  57 * several timeout values. client refresh upcall timeout we using
  58 * default in pipefs implemnetation.
  59 */
  60#define __TIMEOUT_DELTA          (10)
  61
  62#define GSS_SECINIT_RPC_TIMEOUT                                  \
  63        (obd_timeout < __TIMEOUT_DELTA ?                                \
  64         __TIMEOUT_DELTA : obd_timeout - __TIMEOUT_DELTA)
  65
  66#define GSS_SECFINI_RPC_TIMEOUT  (__TIMEOUT_DELTA)
  67#define GSS_SECSVC_UPCALL_TIMEOUT       (GSS_SECINIT_RPC_TIMEOUT)
  68
  69/*
  70 * default gc interval
  71 */
  72#define GSS_GC_INTERVAL          (60 * 60) /* 60 minutes */
  73
  74static inline
  75unsigned long gss_round_ctx_expiry(unsigned long expiry,
  76                                   unsigned long sec_flags)
  77{
  78        if (sec_flags & PTLRPC_SEC_FL_REVERSE)
  79                return expiry;
  80
  81        if (get_seconds() + __TIMEOUT_DELTA <= expiry)
  82                return expiry - __TIMEOUT_DELTA;
  83
  84        return expiry;
  85}
  86
  87/*
  88 * Max encryption element in block cipher algorithms.
  89 */
  90#define GSS_MAX_CIPHER_BLOCK           (16)
  91
  92/*
  93 * XXX make it visible of kernel and lgssd/lsvcgssd
  94 */
  95#define GSSD_INTERFACE_VERSION    (1)
  96
  97#define PTLRPC_GSS_VERSION            (1)
  98
  99
 100enum ptlrpc_gss_proc {
 101        PTLRPC_GSS_PROC_DATA        = 0,
 102        PTLRPC_GSS_PROC_INIT        = 1,
 103        PTLRPC_GSS_PROC_CONTINUE_INIT   = 2,
 104        PTLRPC_GSS_PROC_DESTROY  = 3,
 105        PTLRPC_GSS_PROC_ERR          = 4,
 106};
 107
 108enum ptlrpc_gss_tgt {
 109        LUSTRE_GSS_TGT_MGS            = 0,
 110        LUSTRE_GSS_TGT_MDS            = 1,
 111        LUSTRE_GSS_TGT_OSS            = 2,
 112};
 113
 114enum ptlrpc_gss_header_flags {
 115        LUSTRE_GSS_PACK_BULK        = 1,
 116        LUSTRE_GSS_PACK_USER        = 2,
 117};
 118
 119static inline
 120__u32 import_to_gss_svc(struct obd_import *imp)
 121{
 122        const char *name = imp->imp_obd->obd_type->typ_name;
 123
 124        if (!strcmp(name, LUSTRE_MGC_NAME))
 125                return LUSTRE_GSS_TGT_MGS;
 126        if (!strcmp(name, LUSTRE_MDC_NAME))
 127                return LUSTRE_GSS_TGT_MDS;
 128        if (!strcmp(name, LUSTRE_OSC_NAME))
 129                return LUSTRE_GSS_TGT_OSS;
 130        LBUG();
 131        return 0;
 132}
 133
 134/*
 135 * following 3 header must have the same size and offset
 136 */
 137struct gss_header {
 138        __u8                gh_version;     /* gss version */
 139        __u8                gh_sp;        /* sec part */
 140        __u16              gh_pad0;
 141        __u32              gh_flags;       /* wrap flags */
 142        __u32              gh_proc;     /* proc */
 143        __u32              gh_seq;       /* sequence */
 144        __u32              gh_svc;       /* service */
 145        __u32              gh_pad1;
 146        __u32              gh_pad2;
 147        __u32              gh_pad3;
 148        netobj_t                gh_handle;      /* context handle */
 149};
 150
 151struct gss_rep_header {
 152        __u8                gh_version;
 153        __u8                gh_sp;
 154        __u16              gh_pad0;
 155        __u32              gh_flags;
 156        __u32              gh_proc;
 157        __u32              gh_major;
 158        __u32              gh_minor;
 159        __u32              gh_seqwin;
 160        __u32              gh_pad2;
 161        __u32              gh_pad3;
 162        netobj_t                gh_handle;
 163};
 164
 165struct gss_err_header {
 166        __u8                gh_version;
 167        __u8                gh_sp;
 168        __u16              gh_pad0;
 169        __u32              gh_flags;
 170        __u32              gh_proc;
 171        __u32              gh_major;
 172        __u32              gh_minor;
 173        __u32              gh_pad1;
 174        __u32              gh_pad2;
 175        __u32              gh_pad3;
 176        netobj_t                gh_handle;
 177};
 178
 179/*
 180 * part of wire context information send from client which be saved and
 181 * used later by server.
 182 */
 183struct gss_wire_ctx {
 184        __u32              gw_flags;
 185        __u32              gw_proc;
 186        __u32              gw_seq;
 187        __u32              gw_svc;
 188        rawobj_t                gw_handle;
 189};
 190
 191#define PTLRPC_GSS_MAX_HANDLE_SIZE      (8)
 192#define PTLRPC_GSS_HEADER_SIZE    (sizeof(struct gss_header) + \
 193                                         PTLRPC_GSS_MAX_HANDLE_SIZE)
 194
 195
 196static inline __u64 gss_handle_to_u64(rawobj_t *handle)
 197{
 198        if (handle->len != PTLRPC_GSS_MAX_HANDLE_SIZE)
 199                return -1;
 200        return *((__u64 *) handle->data);
 201}
 202
 203#define GSS_SEQ_WIN                  (2048)
 204#define GSS_SEQ_WIN_MAIN                GSS_SEQ_WIN
 205#define GSS_SEQ_WIN_BACK                (128)
 206#define GSS_SEQ_REPACK_THRESHOLD        (GSS_SEQ_WIN_MAIN / 2 + \
 207                                         GSS_SEQ_WIN_MAIN / 4)
 208
 209struct gss_svc_seq_data {
 210        spinlock_t              ssd_lock;
 211        /*
 212         * highest sequence number seen so far, for main and back window
 213         */
 214        __u32              ssd_max_main;
 215        __u32              ssd_max_back;
 216        /*
 217         * main and back window
 218         * for i such that ssd_max - GSS_SEQ_WIN < i <= ssd_max, the i-th bit
 219         * of ssd_win is nonzero iff sequence number i has been seen already.
 220         */
 221        unsigned long      ssd_win_main[GSS_SEQ_WIN_MAIN/BITS_PER_LONG];
 222        unsigned long      ssd_win_back[GSS_SEQ_WIN_BACK/BITS_PER_LONG];
 223};
 224
 225struct gss_svc_ctx {
 226        struct gss_ctx   *gsc_mechctx;
 227        struct gss_svc_seq_data gsc_seqdata;
 228        rawobj_t                gsc_rvs_hdl;
 229        __u32              gsc_rvs_seq;
 230        uid_t              gsc_uid;
 231        gid_t              gsc_gid;
 232        uid_t              gsc_mapped_uid;
 233        unsigned int        gsc_usr_root:1,
 234                                gsc_usr_mds:1,
 235                                gsc_usr_oss:1,
 236                                gsc_remote:1,
 237                                gsc_reverse:1;
 238};
 239
 240struct gss_svc_reqctx {
 241        struct ptlrpc_svc_ctx      src_base;
 242        /*
 243         * context
 244         */
 245        struct gss_wire_ctx          src_wirectx;
 246        struct gss_svc_ctx           *src_ctx;
 247        /*
 248         * record place of bulk_sec_desc in request/reply buffer
 249         */
 250        struct ptlrpc_bulk_sec_desc    *src_reqbsd;
 251        int                          src_reqbsd_size;
 252        struct ptlrpc_bulk_sec_desc    *src_repbsd;
 253        int                          src_repbsd_size;
 254        /*
 255         * flags
 256         */
 257        unsigned int                src_init:1,
 258                                        src_init_continue:1,
 259                                        src_err_notify:1;
 260        int                          src_reserve_len;
 261};
 262
 263struct gss_cli_ctx {
 264        struct ptlrpc_cli_ctx   gc_base;
 265        __u32              gc_flavor;
 266        __u32              gc_proc;
 267        __u32              gc_win;
 268        atomic_t            gc_seq;
 269        rawobj_t                gc_handle;
 270        struct gss_ctx   *gc_mechctx;
 271        /* handle for the buddy svc ctx */
 272        rawobj_t                gc_svc_handle;
 273};
 274
 275struct gss_cli_ctx_keyring {
 276        struct gss_cli_ctx      gck_base;
 277        struct key           *gck_key;
 278        struct timer_list      *gck_timer;
 279};
 280
 281struct gss_sec {
 282        struct ptlrpc_sec       gs_base;
 283        struct gss_api_mech     *gs_mech;
 284        spinlock_t              gs_lock;
 285        __u64                   gs_rvs_hdl;
 286};
 287
 288struct gss_sec_pipefs {
 289        struct gss_sec    gsp_base;
 290        int                  gsp_chash_size;  /* must be 2^n */
 291        struct hlist_head       gsp_chash[0];
 292};
 293
 294/*
 295 * FIXME cleanup the keyring upcall mutexes
 296 */
 297#define HAVE_KEYRING_UPCALL_SERIALIZED  1
 298
 299struct gss_sec_keyring {
 300        struct gss_sec    gsk_base;
 301        /*
 302         * all contexts listed here. access is protected by sec spinlock.
 303         */
 304        struct hlist_head       gsk_clist;
 305        /*
 306         * specially point to root ctx (only one at a time). access is
 307         * protected by sec spinlock.
 308         */
 309        struct ptlrpc_cli_ctx  *gsk_root_ctx;
 310        /*
 311         * specially serialize upcalls for root context.
 312         */
 313        struct mutex                    gsk_root_uc_lock;
 314
 315#ifdef HAVE_KEYRING_UPCALL_SERIALIZED
 316        struct mutex            gsk_uc_lock;    /* serialize upcalls */
 317#endif
 318};
 319
 320static inline struct gss_cli_ctx *ctx2gctx(struct ptlrpc_cli_ctx *ctx)
 321{
 322        return container_of(ctx, struct gss_cli_ctx, gc_base);
 323}
 324
 325static inline
 326struct gss_cli_ctx_keyring *ctx2gctx_keyring(struct ptlrpc_cli_ctx *ctx)
 327{
 328        return container_of(ctx2gctx(ctx),
 329                            struct gss_cli_ctx_keyring, gck_base);
 330}
 331
 332static inline struct gss_sec *sec2gsec(struct ptlrpc_sec *sec)
 333{
 334        return container_of(sec, struct gss_sec, gs_base);
 335}
 336
 337static inline struct gss_sec_pipefs *sec2gsec_pipefs(struct ptlrpc_sec *sec)
 338{
 339        return container_of(sec2gsec(sec), struct gss_sec_pipefs, gsp_base);
 340}
 341
 342static inline struct gss_sec_keyring *sec2gsec_keyring(struct ptlrpc_sec *sec)
 343{
 344        return container_of(sec2gsec(sec), struct gss_sec_keyring, gsk_base);
 345}
 346
 347
 348#define GSS_CTX_INIT_MAX_LEN        (1024)
 349
 350/*
 351 * This only guaranteed be enough for current krb5 des-cbc-crc . We might
 352 * adjust this when new enc type or mech added in.
 353 */
 354#define GSS_PRIVBUF_PREFIX_LEN   (32)
 355#define GSS_PRIVBUF_SUFFIX_LEN   (32)
 356
 357static inline
 358struct gss_svc_reqctx *gss_svc_ctx2reqctx(struct ptlrpc_svc_ctx *ctx)
 359{
 360        LASSERT(ctx);
 361        return container_of(ctx, struct gss_svc_reqctx, src_base);
 362}
 363
 364static inline
 365struct gss_svc_ctx *gss_svc_ctx2gssctx(struct ptlrpc_svc_ctx *ctx)
 366{
 367        LASSERT(ctx);
 368        return gss_svc_ctx2reqctx(ctx)->src_ctx;
 369}
 370
 371/* sec_gss.c */
 372int gss_cli_ctx_match(struct ptlrpc_cli_ctx *ctx, struct vfs_cred *vcred);
 373int gss_cli_ctx_display(struct ptlrpc_cli_ctx *ctx, char *buf, int bufsize);
 374int gss_cli_ctx_sign(struct ptlrpc_cli_ctx *ctx, struct ptlrpc_request *req);
 375int gss_cli_ctx_verify(struct ptlrpc_cli_ctx *ctx, struct ptlrpc_request *req);
 376int gss_cli_ctx_seal(struct ptlrpc_cli_ctx *ctx, struct ptlrpc_request *req);
 377int gss_cli_ctx_unseal(struct ptlrpc_cli_ctx *ctx, struct ptlrpc_request *req);
 378
 379int  gss_sec_install_rctx(struct obd_import *imp, struct ptlrpc_sec *sec,
 380                          struct ptlrpc_cli_ctx *ctx);
 381int  gss_alloc_reqbuf(struct ptlrpc_sec *sec, struct ptlrpc_request *req,
 382                      int msgsize);
 383void gss_free_reqbuf(struct ptlrpc_sec *sec, struct ptlrpc_request *req);
 384int  gss_alloc_repbuf(struct ptlrpc_sec *sec, struct ptlrpc_request *req,
 385                      int msgsize);
 386void gss_free_repbuf(struct ptlrpc_sec *sec, struct ptlrpc_request *req);
 387int  gss_enlarge_reqbuf(struct ptlrpc_sec *sec, struct ptlrpc_request *req,
 388                        int segment, int newsize);
 389
 390int  gss_svc_accept(struct ptlrpc_sec_policy *policy,
 391                    struct ptlrpc_request *req);
 392void gss_svc_invalidate_ctx(struct ptlrpc_svc_ctx *svc_ctx);
 393int  gss_svc_alloc_rs(struct ptlrpc_request *req, int msglen);
 394int  gss_svc_authorize(struct ptlrpc_request *req);
 395void gss_svc_free_rs(struct ptlrpc_reply_state *rs);
 396void gss_svc_free_ctx(struct ptlrpc_svc_ctx *ctx);
 397
 398int cli_ctx_expire(struct ptlrpc_cli_ctx *ctx);
 399int cli_ctx_check_death(struct ptlrpc_cli_ctx *ctx);
 400
 401int gss_copy_rvc_cli_ctx(struct ptlrpc_cli_ctx *cli_ctx,
 402                         struct ptlrpc_svc_ctx *svc_ctx);
 403
 404struct gss_header *gss_swab_header(struct lustre_msg *msg, int segment,
 405                                   int swabbed);
 406netobj_t *gss_swab_netobj(struct lustre_msg *msg, int segment);
 407
 408void gss_cli_ctx_uptodate(struct gss_cli_ctx *gctx);
 409int gss_pack_err_notify(struct ptlrpc_request *req, __u32 major, __u32 minor);
 410int gss_check_seq_num(struct gss_svc_seq_data *sd, __u32 seq_num, int set);
 411
 412int gss_sec_create_common(struct gss_sec *gsec,
 413                          struct ptlrpc_sec_policy *policy,
 414                          struct obd_import *imp,
 415                          struct ptlrpc_svc_ctx *ctx,
 416                          struct sptlrpc_flavor *sf);
 417void gss_sec_destroy_common(struct gss_sec *gsec);
 418void gss_sec_kill(struct ptlrpc_sec *sec);
 419
 420int gss_cli_ctx_init_common(struct ptlrpc_sec *sec,
 421                            struct ptlrpc_cli_ctx *ctx,
 422                            struct ptlrpc_ctx_ops *ctxops,
 423                            struct vfs_cred *vcred);
 424int gss_cli_ctx_fini_common(struct ptlrpc_sec *sec,
 425                            struct ptlrpc_cli_ctx *ctx);
 426
 427void gss_cli_ctx_flags2str(unsigned long flags, char *buf, int bufsize);
 428
 429/* gss_keyring.c */
 430int  __init gss_init_keyring(void);
 431void __exit gss_exit_keyring(void);
 432
 433/* gss_pipefs.c */
 434int  __init gss_init_pipefs(void);
 435void __exit gss_exit_pipefs(void);
 436
 437/* gss_bulk.c */
 438int gss_cli_prep_bulk(struct ptlrpc_request *req,
 439                      struct ptlrpc_bulk_desc *desc);
 440int gss_cli_ctx_wrap_bulk(struct ptlrpc_cli_ctx *ctx,
 441                          struct ptlrpc_request *req,
 442                          struct ptlrpc_bulk_desc *desc);
 443int gss_cli_ctx_unwrap_bulk(struct ptlrpc_cli_ctx *ctx,
 444                            struct ptlrpc_request *req,
 445                            struct ptlrpc_bulk_desc *desc);
 446int gss_svc_prep_bulk(struct ptlrpc_request *req,
 447                      struct ptlrpc_bulk_desc *desc);
 448int gss_svc_unwrap_bulk(struct ptlrpc_request *req,
 449                        struct ptlrpc_bulk_desc *desc);
 450int gss_svc_wrap_bulk(struct ptlrpc_request *req,
 451                      struct ptlrpc_bulk_desc *desc);
 452
 453/* gss_mech_switch.c */
 454int init_kerberos_module(void);
 455void cleanup_kerberos_module(void);
 456
 457/* gss_generic_token.c */
 458int g_token_size(rawobj_t *mech, unsigned int body_size);
 459void g_make_token_header(rawobj_t *mech, int body_size, unsigned char **buf);
 460__u32 g_verify_token_header(rawobj_t *mech, int *body_size,
 461                            unsigned char **buf_in, int toksize);
 462
 463
 464/* gss_cli_upcall.c */
 465int gss_do_ctx_init_rpc(char *buffer, unsigned long count);
 466int gss_do_ctx_fini_rpc(struct gss_cli_ctx *gctx);
 467
 468int  __init gss_init_cli_upcall(void);
 469void __exit gss_exit_cli_upcall(void);
 470
 471/* gss_svc_upcall.c */
 472__u64 gss_get_next_ctx_index(void);
 473int gss_svc_upcall_install_rvs_ctx(struct obd_import *imp,
 474                                   struct gss_sec *gsec,
 475                                   struct gss_cli_ctx *gctx);
 476int gss_svc_upcall_expire_rvs_ctx(rawobj_t *handle);
 477int gss_svc_upcall_dup_handle(rawobj_t *handle, struct gss_svc_ctx *ctx);
 478int gss_svc_upcall_update_sequence(rawobj_t *handle, __u32 seq);
 479int gss_svc_upcall_handle_init(struct ptlrpc_request *req,
 480                               struct gss_svc_reqctx *grctx,
 481                               struct gss_wire_ctx *gw,
 482                               struct obd_device *target,
 483                               __u32 lustre_svc,
 484                               rawobj_t *rvs_hdl,
 485                               rawobj_t *in_token);
 486struct gss_svc_ctx *gss_svc_upcall_get_ctx(struct ptlrpc_request *req,
 487                                           struct gss_wire_ctx *gw);
 488void gss_svc_upcall_put_ctx(struct gss_svc_ctx *ctx);
 489void gss_svc_upcall_destroy_ctx(struct gss_svc_ctx *ctx);
 490
 491int  __init gss_init_svc_upcall(void);
 492void __exit gss_exit_svc_upcall(void);
 493
 494/* lproc_gss.c */
 495void gss_stat_oos_record_cli(int behind);
 496void gss_stat_oos_record_svc(int phase, int replay);
 497
 498int  __init gss_init_lproc(void);
 499void __exit gss_exit_lproc(void);
 500
 501/* gss_krb5_mech.c */
 502int __init init_kerberos_module(void);
 503void __exit cleanup_kerberos_module(void);
 504
 505
 506/* debug */
 507static inline
 508void __dbg_memdump(char *name, void *ptr, int size)
 509{
 510        char *buf, *p = (char *) ptr;
 511        int bufsize = size * 2 + 1, i;
 512
 513        OBD_ALLOC(buf, bufsize);
 514        if (!buf) {
 515                CDEBUG(D_ERROR, "DUMP ERROR: can't alloc %d bytes\n", bufsize);
 516                return;
 517        }
 518
 519        for (i = 0; i < size; i++)
 520                sprintf(&buf[i+i], "%02x", (__u8) p[i]);
 521        buf[size + size] = '\0';
 522        LCONSOLE_INFO("DUMP %s@%p(%d): %s\n", name, ptr, size, buf);
 523        OBD_FREE(buf, bufsize);
 524}
 525
 526#endif /* __PTLRPC_GSS_GSS_INTERNAL_H_ */
 527