1258578Shrs/*- 2258578Shrs * Copyright (c) 2009, Sun Microsystems, Inc. 3258578Shrs * All rights reserved. 4177633Sdfr * 5258578Shrs * Redistribution and use in source and binary forms, with or without 6258578Shrs * modification, are permitted provided that the following conditions are met: 7258578Shrs * - Redistributions of source code must retain the above copyright notice, 8258578Shrs * this list of conditions and the following disclaimer. 9258578Shrs * - Redistributions in binary form must reproduce the above copyright notice, 10258578Shrs * this list of conditions and the following disclaimer in the documentation 11258578Shrs * and/or other materials provided with the distribution. 12258578Shrs * - Neither the name of Sun Microsystems, Inc. nor the names of its 13258578Shrs * contributors may be used to endorse or promote products derived 14258578Shrs * from this software without specific prior written permission. 15258578Shrs * 16258578Shrs * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17258578Shrs * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18258578Shrs * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19258578Shrs * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE 20258578Shrs * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21258578Shrs * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22258578Shrs * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23258578Shrs * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24258578Shrs * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25258578Shrs * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26258578Shrs * POSSIBILITY OF SUCH DAMAGE. 27177633Sdfr */ 28177633Sdfr 29177633Sdfr#if defined(LIBC_SCCS) && !defined(lint) 30177633Sdfrstatic char *sccsid2 = "@(#)svc_auth_unix.c 1.28 88/02/08 Copyr 1984 Sun Micro"; 31177633Sdfrstatic char *sccsid = "@(#)svc_auth_unix.c 2.3 88/08/01 4.0 RPCSRC"; 32177633Sdfr#endif 33177633Sdfr#include <sys/cdefs.h> 34177633Sdfr__FBSDID("$FreeBSD$"); 35177633Sdfr 36177633Sdfr/* 37177633Sdfr * svc_auth_unix.c 38177633Sdfr * Handles UNIX flavor authentication parameters on the service side of rpc. 39177633Sdfr * There are two svc auth implementations here: AUTH_UNIX and AUTH_SHORT. 40177633Sdfr * _svcauth_unix does full blown unix style uid,gid+gids auth, 41177633Sdfr * _svcauth_short uses a shorthand auth to index into a cache of longhand auths. 42177633Sdfr * Note: the shorthand has been gutted for efficiency. 43177633Sdfr * 44177633Sdfr * Copyright (C) 1984, Sun Microsystems, Inc. 45177633Sdfr */ 46177633Sdfr 47177633Sdfr#include <sys/param.h> 48177633Sdfr#include <sys/lock.h> 49177633Sdfr#include <sys/mutex.h> 50177633Sdfr#include <sys/systm.h> 51177633Sdfr#include <sys/ucred.h> 52177633Sdfr 53177633Sdfr#include <rpc/rpc.h> 54177633Sdfr 55177685Sdfr#include <rpc/rpc_com.h> 56177633Sdfr 57177633Sdfr#define MAX_MACHINE_NAME 255 58177633Sdfr#define NGRPS 16 59177633Sdfr 60177633Sdfr/* 61177633Sdfr * Unix longhand authenticator 62177633Sdfr */ 63177633Sdfrenum auth_stat 64177633Sdfr_svcauth_unix(struct svc_req *rqst, struct rpc_msg *msg) 65177633Sdfr{ 66177633Sdfr enum auth_stat stat; 67177633Sdfr XDR xdrs; 68177633Sdfr int32_t *buf; 69177633Sdfr uint32_t time; 70177633Sdfr struct xucred *xcr; 71177633Sdfr u_int auth_len; 72177633Sdfr size_t str_len, gid_len; 73177633Sdfr u_int i; 74177633Sdfr 75177633Sdfr xcr = rqst->rq_clntcred; 76177633Sdfr auth_len = (u_int)msg->rm_call.cb_cred.oa_length; 77177633Sdfr xdrmem_create(&xdrs, msg->rm_call.cb_cred.oa_base, auth_len, 78177633Sdfr XDR_DECODE); 79177633Sdfr buf = XDR_INLINE(&xdrs, auth_len); 80177633Sdfr if (buf != NULL) { 81177633Sdfr time = IXDR_GET_UINT32(buf); 82177633Sdfr str_len = (size_t)IXDR_GET_UINT32(buf); 83177633Sdfr if (str_len > MAX_MACHINE_NAME) { 84177633Sdfr stat = AUTH_BADCRED; 85177633Sdfr goto done; 86177633Sdfr } 87177633Sdfr str_len = RNDUP(str_len); 88177633Sdfr buf += str_len / sizeof (int32_t); 89177633Sdfr xcr->cr_uid = IXDR_GET_UINT32(buf); 90177633Sdfr xcr->cr_groups[0] = IXDR_GET_UINT32(buf); 91177633Sdfr gid_len = (size_t)IXDR_GET_UINT32(buf); 92177633Sdfr if (gid_len > NGRPS) { 93177633Sdfr stat = AUTH_BADCRED; 94177633Sdfr goto done; 95177633Sdfr } 96177633Sdfr for (i = 0; i < gid_len; i++) { 97194498Sbrooks if (i + 1 < XU_NGROUPS) 98177633Sdfr xcr->cr_groups[i + 1] = IXDR_GET_INT32(buf); 99177633Sdfr else 100177633Sdfr buf++; 101177633Sdfr } 102194498Sbrooks if (gid_len + 1 > XU_NGROUPS) 103194498Sbrooks xcr->cr_ngroups = XU_NGROUPS; 104177633Sdfr else 105177633Sdfr xcr->cr_ngroups = gid_len + 1; 106177633Sdfr 107177633Sdfr /* 108177633Sdfr * five is the smallest unix credentials structure - 109177633Sdfr * timestamp, hostname len (0), uid, gid, and gids len (0). 110177633Sdfr */ 111177633Sdfr if ((5 + gid_len) * BYTES_PER_XDR_UNIT + str_len > auth_len) { 112177633Sdfr (void) printf("bad auth_len gid %ld str %ld auth %u\n", 113177633Sdfr (long)gid_len, (long)str_len, auth_len); 114177633Sdfr stat = AUTH_BADCRED; 115177633Sdfr goto done; 116177633Sdfr } 117177633Sdfr } else if (! xdr_authunix_parms(&xdrs, &time, xcr)) { 118177633Sdfr stat = AUTH_BADCRED; 119177633Sdfr goto done; 120177633Sdfr } 121177633Sdfr 122184588Sdfr rqst->rq_verf = _null_auth; 123177633Sdfr stat = AUTH_OK; 124177633Sdfrdone: 125177633Sdfr XDR_DESTROY(&xdrs); 126177633Sdfr 127177633Sdfr return (stat); 128177633Sdfr} 129177633Sdfr 130177633Sdfr 131177633Sdfr/* 132177633Sdfr * Shorthand unix authenticator 133177633Sdfr * Looks up longhand in a cache. 134177633Sdfr */ 135177633Sdfr/*ARGSUSED*/ 136177633Sdfrenum auth_stat 137177633Sdfr_svcauth_short(rqst, msg) 138177633Sdfr struct svc_req *rqst; 139177633Sdfr struct rpc_msg *msg; 140177633Sdfr{ 141177633Sdfr return (AUTH_REJECTEDCRED); 142177633Sdfr} 143