1
2
3
4
5
6
7
8
9
10
11#ifndef __PTLRPC_GSS_GSS_INTERNAL_H_
12#define __PTLRPC_GSS_GSS_INTERNAL_H_
13
14#include <lustre_sec.h>
15
16
17
18
19typedef struct netobj_s {
20 __u32 len;
21 __u8 data[0];
22} netobj_t;
23
24#define NETOBJ_EMPTY ((netobj_t) { 0 })
25
26typedef struct rawobj_s {
27 __u32 len;
28 __u8 *data;
29} rawobj_t;
30
31#define RAWOBJ_EMPTY ((rawobj_t) { 0, NULL })
32
33typedef struct rawobj_buf_s {
34 __u32 dataoff;
35 __u32 datalen;
36 __u32 buflen;
37 __u8 *buf;
38} rawobj_buf_t;
39
40int rawobj_empty(rawobj_t *obj);
41int rawobj_alloc(rawobj_t *obj, char *buf, int len);
42void rawobj_free(rawobj_t *obj);
43int rawobj_equal(rawobj_t *a, rawobj_t *b);
44int rawobj_dup(rawobj_t *dest, rawobj_t *src);
45int rawobj_serialize(rawobj_t *obj, __u32 **buf, __u32 *buflen);
46int rawobj_extract(rawobj_t *obj, __u32 **buf, __u32 *buflen);
47int rawobj_extract_alloc(rawobj_t *obj, __u32 **buf, __u32 *buflen);
48int rawobj_extract_local(rawobj_t *obj, __u32 **buf, __u32 *buflen);
49int rawobj_extract_local_alloc(rawobj_t *obj, __u32 **buf, __u32 *buflen);
50int rawobj_from_netobj(rawobj_t *rawobj, netobj_t *netobj);
51int rawobj_from_netobj_alloc(rawobj_t *obj, netobj_t *netobj);
52
53int buffer_extract_bytes(const void **buf, __u32 *buflen,
54 void *res, __u32 reslen);
55
56
57
58
59
60#define __TIMEOUT_DELTA (10)
61
62#define GSS_SECINIT_RPC_TIMEOUT \
63 (obd_timeout < __TIMEOUT_DELTA ? \
64 __TIMEOUT_DELTA : obd_timeout - __TIMEOUT_DELTA)
65
66#define GSS_SECFINI_RPC_TIMEOUT (__TIMEOUT_DELTA)
67#define GSS_SECSVC_UPCALL_TIMEOUT (GSS_SECINIT_RPC_TIMEOUT)
68
69
70
71
72#define GSS_GC_INTERVAL (60 * 60)
73
74static inline
75unsigned long gss_round_ctx_expiry(unsigned long expiry,
76 unsigned long sec_flags)
77{
78 if (sec_flags & PTLRPC_SEC_FL_REVERSE)
79 return expiry;
80
81 if (get_seconds() + __TIMEOUT_DELTA <= expiry)
82 return expiry - __TIMEOUT_DELTA;
83
84 return expiry;
85}
86
87
88
89
90#define GSS_MAX_CIPHER_BLOCK (16)
91
92
93
94
95#define GSSD_INTERFACE_VERSION (1)
96
97#define PTLRPC_GSS_VERSION (1)
98
99
100enum ptlrpc_gss_proc {
101 PTLRPC_GSS_PROC_DATA = 0,
102 PTLRPC_GSS_PROC_INIT = 1,
103 PTLRPC_GSS_PROC_CONTINUE_INIT = 2,
104 PTLRPC_GSS_PROC_DESTROY = 3,
105 PTLRPC_GSS_PROC_ERR = 4,
106};
107
108enum ptlrpc_gss_tgt {
109 LUSTRE_GSS_TGT_MGS = 0,
110 LUSTRE_GSS_TGT_MDS = 1,
111 LUSTRE_GSS_TGT_OSS = 2,
112};
113
114enum ptlrpc_gss_header_flags {
115 LUSTRE_GSS_PACK_BULK = 1,
116 LUSTRE_GSS_PACK_USER = 2,
117};
118
119static inline
120__u32 import_to_gss_svc(struct obd_import *imp)
121{
122 const char *name = imp->imp_obd->obd_type->typ_name;
123
124 if (!strcmp(name, LUSTRE_MGC_NAME))
125 return LUSTRE_GSS_TGT_MGS;
126 if (!strcmp(name, LUSTRE_MDC_NAME))
127 return LUSTRE_GSS_TGT_MDS;
128 if (!strcmp(name, LUSTRE_OSC_NAME))
129 return LUSTRE_GSS_TGT_OSS;
130 LBUG();
131 return 0;
132}
133
134
135
136
137struct gss_header {
138 __u8 gh_version;
139 __u8 gh_sp;
140 __u16 gh_pad0;
141 __u32 gh_flags;
142 __u32 gh_proc;
143 __u32 gh_seq;
144 __u32 gh_svc;
145 __u32 gh_pad1;
146 __u32 gh_pad2;
147 __u32 gh_pad3;
148 netobj_t gh_handle;
149};
150
151struct gss_rep_header {
152 __u8 gh_version;
153 __u8 gh_sp;
154 __u16 gh_pad0;
155 __u32 gh_flags;
156 __u32 gh_proc;
157 __u32 gh_major;
158 __u32 gh_minor;
159 __u32 gh_seqwin;
160 __u32 gh_pad2;
161 __u32 gh_pad3;
162 netobj_t gh_handle;
163};
164
165struct gss_err_header {
166 __u8 gh_version;
167 __u8 gh_sp;
168 __u16 gh_pad0;
169 __u32 gh_flags;
170 __u32 gh_proc;
171 __u32 gh_major;
172 __u32 gh_minor;
173 __u32 gh_pad1;
174 __u32 gh_pad2;
175 __u32 gh_pad3;
176 netobj_t gh_handle;
177};
178
179
180
181
182
183struct gss_wire_ctx {
184 __u32 gw_flags;
185 __u32 gw_proc;
186 __u32 gw_seq;
187 __u32 gw_svc;
188 rawobj_t gw_handle;
189};
190
191#define PTLRPC_GSS_MAX_HANDLE_SIZE (8)
192#define PTLRPC_GSS_HEADER_SIZE (sizeof(struct gss_header) + \
193 PTLRPC_GSS_MAX_HANDLE_SIZE)
194
195
196static inline __u64 gss_handle_to_u64(rawobj_t *handle)
197{
198 if (handle->len != PTLRPC_GSS_MAX_HANDLE_SIZE)
199 return -1;
200 return *((__u64 *) handle->data);
201}
202
203#define GSS_SEQ_WIN (2048)
204#define GSS_SEQ_WIN_MAIN GSS_SEQ_WIN
205#define GSS_SEQ_WIN_BACK (128)
206#define GSS_SEQ_REPACK_THRESHOLD (GSS_SEQ_WIN_MAIN / 2 + \
207 GSS_SEQ_WIN_MAIN / 4)
208
209struct gss_svc_seq_data {
210 spinlock_t ssd_lock;
211
212
213
214 __u32 ssd_max_main;
215 __u32 ssd_max_back;
216
217
218
219
220
221 unsigned long ssd_win_main[GSS_SEQ_WIN_MAIN/BITS_PER_LONG];
222 unsigned long ssd_win_back[GSS_SEQ_WIN_BACK/BITS_PER_LONG];
223};
224
225struct gss_svc_ctx {
226 struct gss_ctx *gsc_mechctx;
227 struct gss_svc_seq_data gsc_seqdata;
228 rawobj_t gsc_rvs_hdl;
229 __u32 gsc_rvs_seq;
230 uid_t gsc_uid;
231 gid_t gsc_gid;
232 uid_t gsc_mapped_uid;
233 unsigned int gsc_usr_root:1,
234 gsc_usr_mds:1,
235 gsc_usr_oss:1,
236 gsc_remote:1,
237 gsc_reverse:1;
238};
239
240struct gss_svc_reqctx {
241 struct ptlrpc_svc_ctx src_base;
242
243
244
245 struct gss_wire_ctx src_wirectx;
246 struct gss_svc_ctx *src_ctx;
247
248
249
250 struct ptlrpc_bulk_sec_desc *src_reqbsd;
251 int src_reqbsd_size;
252 struct ptlrpc_bulk_sec_desc *src_repbsd;
253 int src_repbsd_size;
254
255
256
257 unsigned int src_init:1,
258 src_init_continue:1,
259 src_err_notify:1;
260 int src_reserve_len;
261};
262
263struct gss_cli_ctx {
264 struct ptlrpc_cli_ctx gc_base;
265 __u32 gc_flavor;
266 __u32 gc_proc;
267 __u32 gc_win;
268 atomic_t gc_seq;
269 rawobj_t gc_handle;
270 struct gss_ctx *gc_mechctx;
271
272 rawobj_t gc_svc_handle;
273};
274
275struct gss_cli_ctx_keyring {
276 struct gss_cli_ctx gck_base;
277 struct key *gck_key;
278 struct timer_list *gck_timer;
279};
280
281struct gss_sec {
282 struct ptlrpc_sec gs_base;
283 struct gss_api_mech *gs_mech;
284 spinlock_t gs_lock;
285 __u64 gs_rvs_hdl;
286};
287
288struct gss_sec_pipefs {
289 struct gss_sec gsp_base;
290 int gsp_chash_size;
291 struct hlist_head gsp_chash[0];
292};
293
294
295
296
297#define HAVE_KEYRING_UPCALL_SERIALIZED 1
298
299struct gss_sec_keyring {
300 struct gss_sec gsk_base;
301
302
303
304 struct hlist_head gsk_clist;
305
306
307
308
309 struct ptlrpc_cli_ctx *gsk_root_ctx;
310
311
312
313 struct mutex gsk_root_uc_lock;
314
315#ifdef HAVE_KEYRING_UPCALL_SERIALIZED
316 struct mutex gsk_uc_lock;
317#endif
318};
319
320static inline struct gss_cli_ctx *ctx2gctx(struct ptlrpc_cli_ctx *ctx)
321{
322 return container_of(ctx, struct gss_cli_ctx, gc_base);
323}
324
325static inline
326struct gss_cli_ctx_keyring *ctx2gctx_keyring(struct ptlrpc_cli_ctx *ctx)
327{
328 return container_of(ctx2gctx(ctx),
329 struct gss_cli_ctx_keyring, gck_base);
330}
331
332static inline struct gss_sec *sec2gsec(struct ptlrpc_sec *sec)
333{
334 return container_of(sec, struct gss_sec, gs_base);
335}
336
337static inline struct gss_sec_pipefs *sec2gsec_pipefs(struct ptlrpc_sec *sec)
338{
339 return container_of(sec2gsec(sec), struct gss_sec_pipefs, gsp_base);
340}
341
342static inline struct gss_sec_keyring *sec2gsec_keyring(struct ptlrpc_sec *sec)
343{
344 return container_of(sec2gsec(sec), struct gss_sec_keyring, gsk_base);
345}
346
347
348#define GSS_CTX_INIT_MAX_LEN (1024)
349
350
351
352
353
354#define GSS_PRIVBUF_PREFIX_LEN (32)
355#define GSS_PRIVBUF_SUFFIX_LEN (32)
356
357static inline
358struct gss_svc_reqctx *gss_svc_ctx2reqctx(struct ptlrpc_svc_ctx *ctx)
359{
360 LASSERT(ctx);
361 return container_of(ctx, struct gss_svc_reqctx, src_base);
362}
363
364static inline
365struct gss_svc_ctx *gss_svc_ctx2gssctx(struct ptlrpc_svc_ctx *ctx)
366{
367 LASSERT(ctx);
368 return gss_svc_ctx2reqctx(ctx)->src_ctx;
369}
370
371
372int gss_cli_ctx_match(struct ptlrpc_cli_ctx *ctx, struct vfs_cred *vcred);
373int gss_cli_ctx_display(struct ptlrpc_cli_ctx *ctx, char *buf, int bufsize);
374int gss_cli_ctx_sign(struct ptlrpc_cli_ctx *ctx, struct ptlrpc_request *req);
375int gss_cli_ctx_verify(struct ptlrpc_cli_ctx *ctx, struct ptlrpc_request *req);
376int gss_cli_ctx_seal(struct ptlrpc_cli_ctx *ctx, struct ptlrpc_request *req);
377int gss_cli_ctx_unseal(struct ptlrpc_cli_ctx *ctx, struct ptlrpc_request *req);
378
379int gss_sec_install_rctx(struct obd_import *imp, struct ptlrpc_sec *sec,
380 struct ptlrpc_cli_ctx *ctx);
381int gss_alloc_reqbuf(struct ptlrpc_sec *sec, struct ptlrpc_request *req,
382 int msgsize);
383void gss_free_reqbuf(struct ptlrpc_sec *sec, struct ptlrpc_request *req);
384int gss_alloc_repbuf(struct ptlrpc_sec *sec, struct ptlrpc_request *req,
385 int msgsize);
386void gss_free_repbuf(struct ptlrpc_sec *sec, struct ptlrpc_request *req);
387int gss_enlarge_reqbuf(struct ptlrpc_sec *sec, struct ptlrpc_request *req,
388 int segment, int newsize);
389
390int gss_svc_accept(struct ptlrpc_sec_policy *policy,
391 struct ptlrpc_request *req);
392void gss_svc_invalidate_ctx(struct ptlrpc_svc_ctx *svc_ctx);
393int gss_svc_alloc_rs(struct ptlrpc_request *req, int msglen);
394int gss_svc_authorize(struct ptlrpc_request *req);
395void gss_svc_free_rs(struct ptlrpc_reply_state *rs);
396void gss_svc_free_ctx(struct ptlrpc_svc_ctx *ctx);
397
398int cli_ctx_expire(struct ptlrpc_cli_ctx *ctx);
399int cli_ctx_check_death(struct ptlrpc_cli_ctx *ctx);
400
401int gss_copy_rvc_cli_ctx(struct ptlrpc_cli_ctx *cli_ctx,
402 struct ptlrpc_svc_ctx *svc_ctx);
403
404struct gss_header *gss_swab_header(struct lustre_msg *msg, int segment,
405 int swabbed);
406netobj_t *gss_swab_netobj(struct lustre_msg *msg, int segment);
407
408void gss_cli_ctx_uptodate(struct gss_cli_ctx *gctx);
409int gss_pack_err_notify(struct ptlrpc_request *req, __u32 major, __u32 minor);
410int gss_check_seq_num(struct gss_svc_seq_data *sd, __u32 seq_num, int set);
411
412int gss_sec_create_common(struct gss_sec *gsec,
413 struct ptlrpc_sec_policy *policy,
414 struct obd_import *imp,
415 struct ptlrpc_svc_ctx *ctx,
416 struct sptlrpc_flavor *sf);
417void gss_sec_destroy_common(struct gss_sec *gsec);
418void gss_sec_kill(struct ptlrpc_sec *sec);
419
420int gss_cli_ctx_init_common(struct ptlrpc_sec *sec,
421 struct ptlrpc_cli_ctx *ctx,
422 struct ptlrpc_ctx_ops *ctxops,
423 struct vfs_cred *vcred);
424int gss_cli_ctx_fini_common(struct ptlrpc_sec *sec,
425 struct ptlrpc_cli_ctx *ctx);
426
427void gss_cli_ctx_flags2str(unsigned long flags, char *buf, int bufsize);
428
429
430int __init gss_init_keyring(void);
431void __exit gss_exit_keyring(void);
432
433
434int __init gss_init_pipefs(void);
435void __exit gss_exit_pipefs(void);
436
437
438int gss_cli_prep_bulk(struct ptlrpc_request *req,
439 struct ptlrpc_bulk_desc *desc);
440int gss_cli_ctx_wrap_bulk(struct ptlrpc_cli_ctx *ctx,
441 struct ptlrpc_request *req,
442 struct ptlrpc_bulk_desc *desc);
443int gss_cli_ctx_unwrap_bulk(struct ptlrpc_cli_ctx *ctx,
444 struct ptlrpc_request *req,
445 struct ptlrpc_bulk_desc *desc);
446int gss_svc_prep_bulk(struct ptlrpc_request *req,
447 struct ptlrpc_bulk_desc *desc);
448int gss_svc_unwrap_bulk(struct ptlrpc_request *req,
449 struct ptlrpc_bulk_desc *desc);
450int gss_svc_wrap_bulk(struct ptlrpc_request *req,
451 struct ptlrpc_bulk_desc *desc);
452
453
454int init_kerberos_module(void);
455void cleanup_kerberos_module(void);
456
457
458int g_token_size(rawobj_t *mech, unsigned int body_size);
459void g_make_token_header(rawobj_t *mech, int body_size, unsigned char **buf);
460__u32 g_verify_token_header(rawobj_t *mech, int *body_size,
461 unsigned char **buf_in, int toksize);
462
463
464
465int gss_do_ctx_init_rpc(char *buffer, unsigned long count);
466int gss_do_ctx_fini_rpc(struct gss_cli_ctx *gctx);
467
468int __init gss_init_cli_upcall(void);
469void __exit gss_exit_cli_upcall(void);
470
471
472__u64 gss_get_next_ctx_index(void);
473int gss_svc_upcall_install_rvs_ctx(struct obd_import *imp,
474 struct gss_sec *gsec,
475 struct gss_cli_ctx *gctx);
476int gss_svc_upcall_expire_rvs_ctx(rawobj_t *handle);
477int gss_svc_upcall_dup_handle(rawobj_t *handle, struct gss_svc_ctx *ctx);
478int gss_svc_upcall_update_sequence(rawobj_t *handle, __u32 seq);
479int gss_svc_upcall_handle_init(struct ptlrpc_request *req,
480 struct gss_svc_reqctx *grctx,
481 struct gss_wire_ctx *gw,
482 struct obd_device *target,
483 __u32 lustre_svc,
484 rawobj_t *rvs_hdl,
485 rawobj_t *in_token);
486struct gss_svc_ctx *gss_svc_upcall_get_ctx(struct ptlrpc_request *req,
487 struct gss_wire_ctx *gw);
488void gss_svc_upcall_put_ctx(struct gss_svc_ctx *ctx);
489void gss_svc_upcall_destroy_ctx(struct gss_svc_ctx *ctx);
490
491int __init gss_init_svc_upcall(void);
492void __exit gss_exit_svc_upcall(void);
493
494
495void gss_stat_oos_record_cli(int behind);
496void gss_stat_oos_record_svc(int phase, int replay);
497
498int __init gss_init_lproc(void);
499void __exit gss_exit_lproc(void);
500
501
502int __init init_kerberos_module(void);
503void __exit cleanup_kerberos_module(void);
504
505
506
507static inline
508void __dbg_memdump(char *name, void *ptr, int size)
509{
510 char *buf, *p = (char *) ptr;
511 int bufsize = size * 2 + 1, i;
512
513 OBD_ALLOC(buf, bufsize);
514 if (!buf) {
515 CDEBUG(D_ERROR, "DUMP ERROR: can't alloc %d bytes\n", bufsize);
516 return;
517 }
518
519 for (i = 0; i < size; i++)
520 sprintf(&buf[i+i], "%02x", (__u8) p[i]);
521 buf[size + size] = '\0';
522 LCONSOLE_INFO("DUMP %s@%p(%d): %s\n", name, ptr, size, buf);
523 OBD_FREE(buf, bufsize);
524}
525
526#endif
527